Harbinger of the Cyber Age

  While serving as the head of an Information Security department, I once had a Chief Technology Officer (CTO) tell me, "The organization doesn't need security controls as long as they have security awareness training." The statement will seem naïve and even laughable to many security professionals. However, his words reflect a growing misconception shared by technology leaders in a time where everyone is worried about employees clicking on ransomware, visiting infected websites, or compromising a network over the VPN. Even my own Doctoral Dissertation is about the need for mandatory cybersecurity awareness training courses in middle schools. Yet, a look at the news reminds us that securing employees inside a company is not enough to secure the company. One of the most concerning stories hitting the news this month is how ransomware groups are turning their focus toward firmware attacks. Leaked chats from the Conti ransomware group reveal that the organization is acti

               The Bible uses the now-famous parable of the house that was built on the sand. When the rains came and the storms hit, the house fell because it did not have a firm foundation. Unfortunately, the cyber departments of many organizations are running the same way. They have survived the last couple of years without a major incident and so they believe they are secure. A recent article released by Help Net Security revealed that Chief Information Security Officers (CISOs) are becoming increasingly confident that their organizations will not suffer from costly cyber attacks. In fact, the number of CISOs who believe they are likely to suffer an attack in the next twelve months has dropped by almost 16%! Yet, the problem with this stat is, as the article notes, very few of these CISOs have made any significant improvements to their security environments to reduce these attacks. Instead, the increased confidence in the resiliency of their departments stems from the idea tha