{"id":14908,"date":"2019-10-11T15:02:19","date_gmt":"2019-10-11T19:02:19","guid":{"rendered":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/?p=14908"},"modified":"2022-10-14T18:27:42","modified_gmt":"2022-10-14T22:27:42","slug":"devsecops-phishing-api-abusesand-more-a-call-to-action-for-holistic-security-and-privacy","status":"publish","type":"post","link":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/security\/devsecops-phishing-api-abusesand-more-a-call-to-action-for-holistic-security-and-privacy.html","title":{"rendered":"DevSecOps, Phishing, API Abuses\u2026and More! A Call to Action for Holistic Security and Privacy"},"content":{"rendered":"\n

Guest post by top IT and business transformation analyst Akshay Sharma<\/a><\/p>\n\n\n\n

As digital transformation permeates the enterprises, with\nIoT, POS systems, mobile payment from smartphones, RFID and NFC-based payment\nsystems, cloud-based solutions, open API\u2019s, software bus middleware solutions,\nand Phishing attacks, we are all exposed to a fast-growing cyber threat\nlandscape that makes personal data increasingly vulnerable to attack due to the\ngenerally insecure state of the back office systems, network infrastructure as\nwell as the connected devices used today. <\/p>\n\n\n\n

So What Do We Do?<\/em><\/p>\n\n\n\n

As Rich Tehrani recently published Cybersecurity\nEssentials<\/a>:<\/p>\n\n\n\n

Initial Steps with Next Steps include:<\/p>\n\n\n\n

  1. Have a business continuity plan.
    1. Evaluate your IT disaster recovery and service continuity:<\/li><\/ol><\/li>
    2. Are geo-diverse, hybrid multi-clouds in use, and in sync?<\/li>
    3. Are IT service management (ITSM) tools for IT asset management (ITAM) and IT recovery orchestration tools in place?<\/li>
    4. Is Crisis\/emergency management in place?<\/li>
    5. Are workflows automated, and if so can manual fallback procedures take over?<\/li>
    6. Are the networks resilient with hitless failover to diverse networks in place?<\/li>
    7. Are databases and applications resilient with hitless failover to backup server farms?  <\/li>
    8. Keep computer operating systems and software patched!
      1. Ensure Holistic version control of networks and applications<\/li><\/ol><\/li>
      2. Network Configuration Management with DevOps Applications Source Code Management, with version audits to ensure compliance.<\/li>
      3. Network Policy Compliance Enforcements with Document Electronic Data Record Compliance, and Workflow\/Process Compliance  <\/li>
      4. Networks Maintenance\/Upgrades Management with DevOps Applications for Requirements Management, Test Management, Issues and Change Management.<\/li>
      5. Can an IT Release Manager override and overrule a DevOps CI\/CD upgrade ?<\/li>
      6. If so how? And how quickly, with compliance audits in place?<\/li>
      7. If not, look to DevOps CI\/CD Compliance and Workflow firms like Kovair.<\/li>
      8. Understand that every person in an organization is a potential target.
        1. Look at Phishing prevention solutions like Knowbe4, as well as vendors like ColorTokens with embedded agents providing WhiteList\/BlackList policy-based controls, as well as potentially the usage Blockchain with it’s Smart Contracts, Consensus Algorithms and encrypted distributed ledgers, along with behavioral analytics from vendors like Cybraics, to see if rogue employees or those impersonating them can be verified to see the devices they are using, their credentials, their location, their IP address, and the context of what is being accessed.<\/li><\/ol><\/li>
        2. Ensure social media accounts are private.<\/li>
        3. According to PhoenixNAP, the following is a useful checklist.<\/li>
        4. Start by developing a social media policy.<\/li>
        5. Don\u2019t advertise company vacation time or any events that may have most senior staff being away. This can be announcing the right time to launch a cyber attack.<\/li>
        6. Be proactive with network security on all devices and networks. This includes cell phones, and it also means keeping social media off the company\u2019s business network.<\/li>
        7. Teach employees about social media security threats with consistent training and security awareness programs.<\/li>
        8. Use social media management software to track company accounts.<\/li>
        9. Keep personal information private. Hackers are always looking for a way to get personal information that can open the door to gaining account access.<\/li><\/ol>\n\n\n\n