Old Vulnerabilities issues

Today I was reading the article on Security week and noted that a lot of old vulnerabilities are still exploited by malware. This made me think that why the organizations are not having the old vulnerabilities patched even after 4-5 years. Its evident that most organizations are buying latest security applications to enhance their security practices. On the other hand they are not putting enough efforts to strengthen the basic security structure.

These security applications presume that the organization is having the basic security established and maintaining it throughout. Organization are superficially in an impression that since they have latest security applications their security is enhanced. It’s a mirage for the organizations. They must understand the importance of having basic security in place and ensuring that it is continuously maintained and improved. Otherwise they would be having a very showy security infrastructure but underneath they would be as vulnerable as anyone.

This is a very pinching question to CISO’s that how they need to have the perfect balance between basic security and enhancement on the upper layer. How to optimize the allocation of resources to ensure efficient and effective security infrastructure?

Sprituality

I read an article on Facebook about the hypothetical perception of embryos in the womb of mother. A very nice portrayal of spiritual connection between us and supreme power. May be other people have taken it more literally, but for me it was really spiritual. A very simple representation of how we miss the big picture and underestimate the presence of supreme power around us. How we perceive wrongly with our minuscule minds the things around us. the article forced me to think that just embryos in the womb think or perceive that there would be no life after they come out of womb, we also think that there is no life after we die. May be what is death for us is actually our birth in another world. May be supreme power is taking care of us like a mother does for her unborn child feeding from umbilical cord..

It is so delightful to think from that perspective, if we are embryos in supreme power’s womb then we are being well taken cared of by her and would be cared even after we go out of this physical world to another world which might be a spiritual world. It made me feel more strongly connected to supreme power and thank incessantly for the love and care that I’m blessed with. It also gave me the strength to try and do my best in anything and everything that I do and also to be more focused towards enlightenment of my soul as that’s what would go to the next world.

Mobile Security Concerns

Android.. android.. android.. I hope that hardly anyone would be unaware of this term nowadays. Android based devices have become an inseparable part of our daily life.. from low end mobile to high end tabs android is everywhere. It helps us to stays connected on the social media portals, to chat with our friends and families, to click pictures on the go and upload, to find direction in unknown areas, to find restaurants, cinemas, shopping malls.. to pay bills .. so on and so forth..

Our dependency on android based devices has lured the cyber criminals and also provided them an easy platform as mobile security is in its nascent stages.. no matter how big talks are being done on these topics, still mobile security is far behind than where it must have been considering the growing usage of mobile devices for personal and professional purposes. The exponential growth of mobile usage has its own demeaning effect on the information security efforts, its like technology is advancing so fast that security professionals are finding it difficult to cope up with that pace.

So what is the remedy? Well most important aspect of mobile security is to understand that mobile security isn’t only about device security, the prime objective is to protect the data/ information. If we focus our efforts to ensure the security of data and information, we would be able to optimally utilize the limited resources. Determine the criticality of information and don’t let the device security affect it.

Sophistication of Cyber Attacks

I’m simply in awe of the sophistication after reading about the Crypto-ransom-ware malware. They really need an applause on the creative thinking, visionary attitude, diligence and delicate attempts to perform the attacks.

The attackers might have prepared a detailed blueprint of such an attack and the targeted time-frames.  They might have worked out all the details on how to enter an environment and replace the encryption keys, let the systems running for a good 6 months so that all the probable backups are also encrypted with the malicious key. Seriously, it is time for security professionals and business folks to think ahead of these criminals. Just imagine that theoretically, these hackers are not having all the latest sophisticated technologies, neither they have that much buying power, yet they are miles ahead of security professionals in breaking into the environments like it is a piece of cake for them. The question arises ‘do we ourselves offering them out organizations in plates’ by not able to have effective controls in place. In my experience, I’ve seen organization to give only verbal importance to information security efforts, but practically Information security is still considered as an unnecessary burden and the least privileged section.

Business has to understand that by making things easily accessible to everyone in the organization or by providing extra privileges to everyone they are creating more and more exposure points for mal-intent individuals or criminals to get into our environment.

Business-ease Bug

I always encountered one particular scenario that lead to compromises and that is ‘business ease’. In the name of business ease, organizations does a lot of such minute mistakes that result in major hacks. Minutes mistakes such as not ensuring that third party vendors are using adequate security controls, validating the security of 3^rd party software before installing those in the environment and especially the since-it-was-so-it-is approach. It is one approach that business people always say that since it is being used this way, so let it be this way. But with the change in the environment, these processes must also be optimized. One example is providing some 3^rd party software to Cashier in retail stores just because it was being previously not because it is crucial for having it in cashiers machine. Not looking for simple alternatives such as using a non-critical machine for such 3^rd party tool. Organization create a lot of such exposure points for cyber criminals to enter into their environment.

It is something that organizations must understand that by avoiding such a small step, they can save a lot. There are always simpler solutions for such business ease issues that organization don’t like to consider.