Info Risk Today Podcast

The latest edition of the ISMG Security Report analyzes why cyberattacks against banks have surged in recent weeks. Plus: The increasingly ruthless tactics of ransomware gangs; cybersecurity strategies for small businesses.

As cyberthreats to medical research on COVID-19 - and other intellectual property - grow, organzations must take critical steps to prevent the theft of their "innovation capital," says Russell Koste, chief security officer of Alexion Pharmaceuticals.

The American Medical Association has issued a set of privacy principles for health data that it hopes Congress and regulators will keep in mind as they prepare legislation and regulations. In an interview, AMA Board Chair Jesse Ehrenfeld, M.D., describes the recommendations.

Healthcare organizations need to diligently assess whether a security incident involving patient information truly qualifies as a reportable breach under HIPAA to avoid needlessly reporting it to federal regulators, says regulatory attorney Helen Oscislawski.

The latest edition of the ISMG Security Report features Retired General Keith Alexander, former NSA director, discussing the long-term security implications of the shift to working from home. Also: an update on ransomware gangs leaking data and an analysis of using open source code for app development.

Kevin Schwarz of Zscaler discusses the security implications of the "new normal" of employees working from home, including the role of a "zero trust" strategy.

"Risk acceptance" was the operative term as organizations quickly deployed remote workforces in response to the global crisis. But now, as this deployment becomes a long-term option, enterprises need to take a future-focused view toward identity, cloud, and the attack surface. Forcepoint's Homayun Yaqub offers tips.

Besides hospitals and academic institutions, dozens of nonprofits, including nongovernmental organizations - or NGOs - around the world must protect their COVID-19 research and related activities from those seeking to steal data or disrupt their operations, says cyber risk management expert Stanley Mierzwa.

DevSecOps is in its "awkward teenage years," says Matthew Rose of Checkmarx. But with new tooling and automation - particularly application security testing tools - he sees the practice maturing quickly and delivering improved outcomes.

The latest edition of the ISMG Security Report discusses securing RDP to prevent ransomware attacks. Also featured: A look at three likely scenarios for the COVID19 pandemic, and an analysis of why we're still using PINs for certain card payments.

To keep up with security issues raised by the transition to a much larger remote workforce and expanded telehealth services during the COVID-19 crisis, healthcare entities should "streamline" their approach to risk management, says Dustin Hutchison of the security consultancy Pondurance.

As manufacturers - including companies such as automakers that do not typically produce healthcare devices - race to help fill medical equipment shortages during the COVID-19 crisis, steps must be taken to ensure adequate security testing, says Fairuz Rafique of cybersecurity services firm EmberSec.

The latest edition of the ISMG Security Report analyzes the many challenges involved in developing and implementing contact-tracing apps to help in the battle against COVID-19. Also featured: A discussion of emerging privacy issues and a report on why account takeover fraud losses are growing.

With more employees working remotely and a much heavier demand for telehealth services, entities need to consider extra, accelerated steps in keeping data and systems secure, says Martin Littmann, Kelsey-Seybold Clinic CISO, and Stephen Moore, a former security leader at Anthem.

The latest edition of the ISMG Security Report analyzes the rising costs of ransomware attacks and the latest victims. Also featured: An assessment of Australia's new contact-tracing app designed to help battle the spread of COVID-19, and a discussion of applying the "zero trust" model to the remote workforce.

To ensure data is protected, business units must work closely with IT and security specialists to resolve data governance issues, says Sydney-based Prashant Haldankar, CISO at Privasec.

Because it's inevitable that some attackers will get around defenses, Kettering Health Network added an extra layer of endpoint security to help mitigate the risks posed by ransomware and other cyberthreats, says Michael Berry, director of information security. He describes what's unusual about the approach.

The shift to working at home during the COVID-19 pandemic is yet another reason to embrace the "zero trust" strategy, says Dave Lewis of Duo Security, who provides guidance.

Vistra Energy, a Texas-based power generation firm, recently underwent a network transformation project. CISO Paul Reyes, joined by Zscaler's Dan Shelton, opens up on how to make the move to cloud-based models and what it can do to support your business.

The latest edition of the ISMG Security Report analyzes the privacy issues raised by COVID-19 contact-tracing apps. Also featured: An update on efforts to fight fraud tied to economic stimulus payments; John Kindervag on the origins of "zero trust."

Modern enterprises are large and complex - and so are their IT environments. How does this complexity translate to securing access in hybrid environments? Frederico Hakamine of Okta breaks down the challenge and discusses solutions.

The latest edition of the ISMG Security Report offers a discussion of the potential insider threats posed by the remote workforce during the COVID-19 crisis. Also featured: An update on payment fraud shifts and the long-term outlook for the cybersecurity market.

As healthcare organizations navigate the COVID-19 crisis, they should take critical steps to improve their security posture and third-party security risk governance, says consultant Brenda Ferraro, the former CISO at Meritain Health, an Aetna subsidiary.

The ransomware threat has scaled up to match the new remote workforce. But have backup policies and incident recovery procedures improved to keep pace? David Shaw and John Bilotti of Nasuni share tips on ransomware recovery, remote file-sharing and business continuity.

As the COVID-19 crisis continues, healthcare organizations need to ramp up efforts to mitigate the threats posed by cybercriminals who are trying to exploit the chaos, says attorney Jason G. Weiss, a cyber forensics expert and retired FBI agent.

As some cities and states recruit retired healthcare professionals, new medical school graduates and clinicians from other regions to assist in their COVID-19 responses, it's critical to ensure these workers understand the importance of protecting patient information, says privacy attorney Iliana Peters.

The latest edition of the ISMG Security Report discusses the cybersecurity challenges posed by the work-at-home shift. Also featured: Tips from NIST on developing remote worker security policies, plus a discussion of the nascent threat of AI meeting assistants.

As healthcare organizations across the U.S. respond to the COVID-19 crisis, the list of security and privacy challenges CISOs face continues to grow. Mitch Parker, CISO of Indiana University Health, provides an update on the changing risk management landscape.

AI meeting assistants present increasing risks as more companies rely on teleconferencing during the COVID-19 pandemic, says U.K.-based Steve Marshall, CISO at Bytes Technology, an IT and cybersecurity consultancy, who discusses risk mitigation steps.

"Passwordless authentication" is one of the hot cybersecurity topics, but who's actually implemented it - and how? Jeff Carpenter of HID Global discusses the business benefits and the future of passwordless authentication.

With the COVID-19 pandemic forcing large portions of the workforce to shift to telework, CISOs need to rethink corporate policies on the use of video conferencing platforms and other communications tools, says NIST's Jeff Greene, who offers risk mitigation advice.

Metrics can help CISOs clearly communicate the potential impact of risks to senior executives and win support for a risk management strategy, say Randall Frietzsche, enterprise CISO of Denver Health, and consultant Dave Bailey of CynergisTek, who describe a step-by-step approach in a joint interview.

As global enterprises get their arms around supporting and securing a near-total remote workforce, their digital adversaries are adapting - and so is the role of deception technology. Carolyn Crandall of Attivo Networks discusses how deception can help mitigate new risks.

What missteps led to hackers stealing details on 145 million Americans from Equifax in 2017? The answer to that question can be found in numerous reports and a Justice Department indictment. Security researcher Adrian Sanabria says they're essential reading for anyone responsible for cybersecurity defenses.

The latest edition of the ISMG Security Report offers an analysis of the phases businesses will go through in the recovery from the COVID-19 pandemic, plus an assessment of new risks resulting from the work-at-home shift and lessons learned from the Equifax breach.

With the U.S. presidential election now seven months away, how have threats to the campaigns evolved, and what impact might be seen from COVID-19? Brigadier General (retired) Francis X. Taylor, a leader of the U.S. CyberDome election security effort, shares an update.

APIs are ubiquitous in the enterprise today, being exposed to customers, partners and applications. But because they are relied on so heavily, they also are targeted by cybercriminals. Shreyans Mehta, co-founder and CTO of Cequence Security, discusses the API security challenge.

The latest edition of the ISMG Security Report analyzes how and why Russia is spreading disinformation about the COVID-19 pandemic. Plus: the latest CCPA regulation updates; a CISO's tips on securely managing a remote workforce.

As more consumers shift to online shopping during the COVID-19 pandemic, retailers must ramp up their efforts to guard against ecommerce payment fraud, says Toby McFarlane, a cybersecurity expert at CMSPI, a payments consultancy.

Recent HIPAA-related moves by federal regulators aim to improve information sharing and care coordination as the U.S. healthcare community battles the COVID-19 outbreak, says privacy attorney Kirk Nahra of the law firm WilmerHale. But some of the provisions could cause confusion, he notes.

While responding to the COVID-19 crisis, supply chain risks can be better managed if an organization continues to rely on its longtime vendors, says Daniel Bowden, CISO at Sentara Healthcare, who offers insights on third-party security risk management in the current environment.

Matt Barrett and Joe Drissell of U.S. Cyberdome discuss the new initiative to foster cross-campaign cybersecurity collaboration and the ramifications of potentially holding an election during social distancing as a result of the COVID-19 pandemic.

As automobile manufacturers and others rush to shift to production of ventilators and other medical equipment and supplies to help fight the COVID-19 pandemic, they must take steps to ensure security, privacy and safety risks are addressed, says technology attorney Steven Teppler.

COVID-19: Modern society has never seen anything like it, and neither have financial markets. Venture capitalist Alberto Yépez analyzes the impact of the disease caused by the new coronavirus on public and private companies' valuations, as well as technology buyers and the threat environment.

The latest edition of the ISMG Security Report analyzes how cybercriminals are exploiting the COVID-19 pandemic. Also featured: A discussion of potential 2020 election changes; tips for staying secure in a remote workplace.

With increasing demands on healthcare organizations to quickly accommodate a surge of teleworking employees as a result of the COVID-19 pandemic, IT and information security departments need to exercise security vigilance, says former healthcare CIO Drex DeFord.

Quarantines, lockdowns, supply chain disruptions and the biggest remote workforce in history. These all part of the "new normal" in the shadow of the COVID-19 pandemic. Business continuity expert Regina Phelps has some new advice for how businesses and individuals should approach the next crucial weeks.

The global outbreak of COVID-19 is intensifying the already heightened threat of attacks, including phishing scams, on healthcare organizations, says attorney Lee Kim, director of privacy and security of the Healthcare Information Management and Systems Society.

It's no exaggeration to say that, in the midst of the COVID-19 pandemic, we now have the largest-ever global remote workforce. And with it comes an expanded attack surface that requires extra attention. Phil Reitinger of the Global Cyber Alliance shares five tips for securing the remote workforce.

The COVID-19 pandemic present new challenges to healthcare IT and security teams, including the need to reassess and adjust business continuity plans, says Christopher Frenz, who leads information security at New York's Interfaith Medical Center. He's chair of an industry committee that developed guidance.