IT Support and Hardware for Clinics
35.6K views | +3 today
Follow
IT Support and Hardware for Clinics
News, Information and Updates on Hardware and IT Tools to help improve your Medical practice
Your new post is loading...
Your new post is loading...
Scoop.it!

How Serious is the Cybersecurity Talent Shortage? 

How Serious is the Cybersecurity Talent Shortage?  | IT Support and Hardware for Clinics | Scoop.it

Across all industries worldwide, cybersecurity has become a top priority. Hackers keep pumping out new types of malware, and data breaches keep occurring. As of April 8, there were already 281 breaches exposing nearly 6 million records in 2019 so far, according to the Identity Theft Resource Center. Businesses can’t afford to sit back and wait until they’re attacked to defend themselves against cybercriminals.

 

With the average cost of a data breach globally totaling $3.86 million according to IBM and the Ponemon Institute, the wisest course of action is to proactively protect your organization with a comprehensive cybersecurity strategy.

 

However, everyone looking to effectively combat IT security threats faces a significant obstacle: a cybersecurity talent shortage. If you’re a business leader seeking to minimize your data breach risk, consider the following information on the extent of this issue and what you can do to overcome it.

 

The Cybersecurity Workforce Gap by the Numbers (ISC)² – an international, nonprofit association for information security professionals – released a report on the cybersecurity workforce gap in 2018. The report draws on a survey of nearly 1,500 cybersecurity pros and IT pros who spend at least 25 percent of their time on cybersecurity tasks.

 

Here are a few key statistics from the report that illustrate the extent of the talent shortage: The global shortage of cybersecurity professionals is approximately 2.93 million. 63 percent of survey respondents said their organizations have a shortage of IT staff focused on cybersecurity. 59 percent also say their organizations have a moderate or extreme cyberattack risk level because they lack sufficient cybersecurity talent. “Awareness of the cybersecurity skills shortage has been growing worldwide,” the report’s introduction states.

 

“Nevertheless, that workforce gap continues to grow, putting organizations at risk. Despite increases in tech spending, this imbalance between supply and demand of skilled professionals continues to leave companies vulnerable.” What’s Behind the Cybersecurity Talent Gap?

 

The increasing popularity of e-commerce and the rise of new technologies like mobile devices and the Internet of Things has created more opportunities for cybercrime. In the past few years, in particular, the demand for cybersecurity talent has surged, according to Verizon. Basically, the supply hasn’t had time to catch up to the skyrocketing demand. Universities and training programs need time to develop the right courses so that job candidates have the cybersecurity skills companies are searching for, Verizon explains.

 

However, it will take a while for college students to complete the new coursework and find their way into the workforce. Another, faster answer to the talent shortage is for workers to learn through on-the-job training.

 

What Can Businesses that Need IT Security Expertise Do to Overcome the Talent Gap? There are several ideas out there already concerning how to remedy the growing and highly concerning cybersecurity skills shortage.

 

Here are a few notable proposals: Form an industry-wide alliance: If large enterprises in the IT world (e.g., Dell, Cisco, Microsoft, Google and so on) join forces, they could put cybersecurity training programs in motion to address the talent shortage, according to the CSO opinion piece “The cybersecurity skills shortage is getting worse” by Jon Oltsik, a principal analyst at Enterprise Strategy Group. Broaden the job search to include candidates with the potential to learn.

 

Companies shouldn’t necessarily rule out professionals who don’t have the ideal qualifications in terms of degrees, certifications, and experience, Arctic Wolf Networks CEO Brian NeSmith advises in the Forbes article “The Cybersecurity Talent Gap Is An Industry Crisis.” Be open-minded and consider that intelligent candidates with great problem-solving skills might do well in the role, even if they don’t have all the prerequisites.

 

Turn to a third-party provider for assistance. A managed security services provider like Stratosphere Networks can help you gain access to high-level cybersecurity expertise while still containing costs. Services such as virtual CISO and CSO can give you all the benefits of having a security pro on staff without drawbacks like the price of training and hiring an in-house executive.

Technical Dr. Inc.'s insight:
Contact Details :

inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com

more...
No comment yet.
Scoop.it!

Cybercriminal gang plunders up to $1 billion from banks over two years

Cybercriminal gang plunders up to $1 billion from banks over two years | IT Support and Hardware for Clinics | Scoop.it

A still-active cybercriminal gang has stolen up to a $1 billion from banks in at least 25 countries over the last two years, infiltrating networks with malware and spying on employees’ computers to facilitate large wire transfers, Kaspersky Lab said Sunday.

The computer security vendor, which said it will release a report Monday on its findings, said the gang penetrated deeply into the banks’ networks, taking time to learn about internal procedures to make their fraudulent activity less suspicious.

In some cases, the gang learned about wire transfer systems by watching administrators’ computers over video.

“In this way the cybercriminals got to know every last detail of the bank clerks’ work and were able to mimic staff activity in order to transfer money and cash out,” Kaspersky said in a news release.

The group, called Carbanak after the malware the gang installed on computers, attempted to attack up to 100 banks and e-payment systems since 2013 in 30 countries. The gang members are suspected to be from Russia, Ukraine, other parts of Europe and China.

Some of the financial institutions affected are in Australia, Brazil, Bulgaria, Canada, China, Czech Republic, France, Germany, Hong Kong, Iceland, India, Ireland, Morocco, Nepal, Norway, Poland, Pakistan, Romania, Russia, Spain, Switzerland, Taiwan, Ukraine, the U.K., the U.S.

None of the banks or financial institutions have been named. Kaspersky said in a news release on that Interpol and Europol are involved in the investigation.

Each theft took between two and four months, Kaspersky said. Bank computers would be infected with malware through spear-phishing attacks, which involves sending targeted emails with malicious attachments or links to select employees.

Spear-phishing emails are crafted in a way to make it likely a recipient will open an attachment or click a link that appears innocuous but installs malicious software on a computer.

As much as $10 million was stolen in a raid at a time, Kaspersky said. Funds were transferred using online banking or e-payment systems to the gang’s own accounts or to other banks in the U.S. and China.

In other instances, the attackers had deep control within a bank’s accounting systems, inflating account balances in order to mask thefts. For example, Kaspersky said that an account with $1,000 would be raised to $10,000, with $9,000 transferred to the cybercriminals.

ATMs were also targeted, Kaspersky said. The gang commanded the machines to dispense money at a certain time, with accomplices ready to pick up the disgorged cash.


more...
No comment yet.
Scoop.it!

How to stop ransomware: It's really not that complicated

How to stop ransomware: It's really not that complicated | IT Support and Hardware for Clinics | Scoop.it

Ransomware. The word itself is scary enough, let alone the glimpse of just how damaging such attacks could be that the world saw in WannaCry and NotPetya during May and June. But cybersecurity experts counter that ransomware shouldn’t actually be so overwhelming to information security professionals -- if they adhere to simple best practices. 

For starters, backup files are crucial and those should be both encrypted and kept offline -- separate from the main network, according to Engin Kirda, professor of electrical and computer engineering and computer and information science at Northeastern University.

 

Lee Kim, HIMSS’ director of privacy and security said the real problem is that hospitals are often stuck running outdated, legacy systems. And even keeping pace with software patches is not always completely effective. Both NotPetya and WannaCry, for instance, leveraged vulnerabilities in these legacy systems.

In fact, Kim explained that when hospitals system must run these outdated systems, including those upon which medical devices are built, it’s necessary to make sure the ports of entry are as closed off as possible. 

 

“If an organization needs to run these systems, shelter the technology from the outside world and segment it from the network,” Lee said. “It’s always best practice to segment the network and not make it possible for one hacker to get in and pivot around your system.”

After patching, segmenting and software needs, Kim said that hospitals can increase defenses with pen testing, which actively scans the system or network for exploitable vulnerabilities.

“I can’t think of a better way to be prepared,” said Kim. “[Pen testing] should be done not just once in a blue moon, it needs to be done regularly. 

Hospitals should authorize the testing with a vendor or security employee with experience to ensure there are no disruptions due to high traffic. 

Risk assessments can also help reveal weaknesses and build defenses. 

 

“We want to make things more difficult for the attackers and reduce the volume of attacks,” she said.

Not surprisingly, the crux of the ransomware issue boils down to the biggest weakness to all networks: the user.

It’s a simple technique, hackers craft emails and trick users into action, Kirda said. “It’s just that some users don’t understand ransomware, and they end up doing things that allow a successful attack.”

 

So phishing training is critical, explained Kim. “It’s the adage of you’re only as strong as your weakest link. You can’t ignore teaching employees what to do and what not to do.”

Fortunately, there’s a lot that can be done with the human element. Naturally, employees should be trained to be cautious about opening attachments. “For an attack to be successful,” Kim said, “they just need a door or one hole to squeeze through.”

Some organizations are also labeling email as external, which can help employees determine the validity of an email sent supposedly from a member within the company. IT can add it to the bottom of every email in red. If an email is sent from outside it will push through the designated filter and notify the user it’s from an outside party.

 

Anti-phishing, user education and clearly marking emails as external or internal are basic blocking and tackling that can go a long way to thwarting attacks. Kim also recommended seeking outside help when you need it.

 

“Study up or hire someone experienced in cybersecurity,” Kim said. There are plenty of ethical hacking pointers available online, and “yet there are so many health organizations vulnerable to attacks. It’s really a twilight zone experience.” 

Ultimately, the issue lies with infosec professionals explaining why cybersecurity needs to be at the forefront of budget discussions and planning -- because it’s a safe bet that the attacks will keep on coming due to profitability. 

“Healthcare is low-hanging fruit,” Kim said. “That’s the unfortunate reality: the dragon is at the door.” 

Technical Dr. Inc.'s insight:
Contact Details :

inquiry@technicaldr.com or 877-910-0004
www.technicaldr.com

more...
No comment yet.
Scoop.it!

The Year of the Data Breach - HIPAA-HITECH Compliance Software & Consulting - Clearwater Compliance

As early as July, 2014 was already being called “The Year of the Data Breach”. Big brands like Home Depot and Target were the headliners, but they weren’t alone.  Retailers and financial institutions of all sizes were combating cyber crime after cyber crime. Meanwhile, the healthcare industry suffered its share of incidents as well. In fact, 2014 saw the U.S. Department of Health and Human Services’ database of major breach reports (those affecting 500 people or more) surpass 30.1 million people.

The good news is that 2014 is over. The bad news is that in 2015, things could get even worse.


It seems that 2014 was more of “a sign of things to come” than it was “a moment in time.” This rings especially true for those of us who are safeguarding protected health information.

We have entered an unprecedented era where cyber attacks are becoming more frequent and more sophisticated with every passing day.

In a recent 60 Minutes special, FireEye CEO David DeWalt estimated that 97 percent of companies are getting breached, with hundreds of thousands of attacks happening on a weekly basis across the globe.


Retailers, banks and others are consistently increasing their spending related to security. They are trying diligently to prevent attacks. But in today’s environment, DeWalt believes that breaches “are inevitable.”

The burden that breaches place on the economy, individual organizations and consumers is significant. Widespread compromises of data are driving $11 billion plus in fraud each year. Just as costly is the fact that we are teetering on a crisis of confidence. Can anyone really protect sensitive data?

Given all this, should we just waive the white flag and surrender?

Obviously, the answer is no. While breaches may indeed be “inevitable” at the macro level, there are absolutely things that can be done to reduce the amount of breaches that occur, and to give your organization a better chance of not being part of the statistics. What’s more, the eventual damage a breach causes is highly contingent upon how well you respond to it.

Consider this scary statistic. From the time a “bad guy” hacks into sensitive data, it typically takes 229 days for the breach to be detected. 229 days!

DeWalt argues, as do we, that trying to prevent a breach is only part of what your organization should be doing. A comprehensive approach means that you are assessing your risk of falling victim to a breach, identifying ways to mitigate that risk from coming to life and appropriately planning for how you will respond if you do experience a breach. In other words, how are you assessing and managing information risk within your organization?

The criminals eventually are going to find their way into organizations.

So, the task at hand if you’re among the unlucky ones is to make sure the bad guys don’t gain access to your most important information, that you identify breaches much more quickly and that you stop the criminals from leaving with valuable information. In short, limit the damage.

The plain truth is that the year ahead promises more of the same. A cybersecurity war is being waged, and your data is at the center of it. Make sure you are prepared for battle. If you haven’t done so already, I’d encourage you to download Clearwater’s whitepaper explaining our Information Risk Management Capability Advancement Model. It’s a free resource, and it offers an extensive framework for determining how well you are equipped to manage information risks, and what steps you should consider in the year ahead to strengthen your internal programs.

Here’s to hoping 2015 is a breach-free year for you!


more...
No comment yet.