News – Digital IT News

Cybersecurity Nonprofits Team Up to Form “Nonprofit Cyber” Coalition

Olivia Rowan — Thu, 24 Feb 2022 22:00:44 +0000

The world’s leading implementation-focused nonprofit cybersecurity organizations have launched Nonprofit Cyber. The group is a first-of-its-kind coalition of global nonprofit organizations to enhance joint action to improve cybersecurity. All coalition members are nonprofits that serve the public interest by developing, sharing, deploying, and increasing the awareness of cybersecurity best practices, tools, standards, and services.

“I applaud that this consummate consortium of nonprofits has formed to actively protect us against security threats to our digital infrastructure and uphold our open internet, combining their knowledge, skills, and tools for the greatest effect,” said Govind Shivkumar, director of responsible technology at Omidyar Network.

Nonprofit Cyber will initially focus on two priorities: building awareness of the work of cybersecurity nonprofits globally and aligning their work to achieve the greatest effect. Envisioned as a “collaboration-of-equals,” each member organization has committed to work in coordination to better serve Internet users globally. Coalition members must be a 501(c)(3) or 501(c)(6) nonprofit if organized under U.S. law or hold an equivalent status if organized under the laws of another country. More information is available at the coalition’s website NonprofitCyber.org and on Twitter at @NonprofitCyber.

The twenty-two founding members of Nonprofit Cyber are the Anti-Phishing Working Group, the Center for Internet Security, the Center for Threat-Informed Defense, the Cloud Security Alliance, Consumer Reports, CREST International, the Cyber Defence Alliance, the CyberPeace Institute, the Cyber Readiness Institute, the Cyber Threat Alliance, the Cybercrime Support Network, the CyberGreen Institute, the FIDO Alliance, the Forum of Incident Response and Security Teams, the Global Cyber Alliance, the National Cyber Forensics and Training Alliance, the National Cybersecurity Alliance, the Open Web Application Security Project, SAFECode, the Shadowserver Foundation, Sightline Security, and #ShareTheMicInCyber. Tony Sager of CIS and Philip Reitinger of GCA will serve as co-chairs as the organization begins operations.

Nonprofit Cyber welcomes applications for new members that work to implement best practices and solutions at scale. Nonprofit Cyber is focused on these organizations, rather than lobbying or policy development and advocacy organizations, or industry associations.

Information on joining Nonprofit Cyber can be found at its website.

About the Nonprofit Cyber Founding Members

The Anti-Phishing Working Group (APWG) is the international coalition unifying the global response to cybercrime across industry, government and law-enforcement sectors and NGO communities. Learn more at https://apwg.org.

The Center for Internet Security (CIS) makes the connected world a safer place for people, businesses, and governments through our core competencies of collaboration and innovation. Learn more at https://cisecurity.org.

The Center for Threat-Informed Defense (CTID) is a non-profit, privately funded research and development organization whose mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Learn more at https://ctid.mitre-engenuity.org/.

The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. Learn more at https://cloudsecurityalliance.org.

Consumer Reports (CR) is an independent, nonprofit member organization that works side by side with consumers for truth, transparency, and fairness in the marketplace. Learn more at https://www.consumerreports.org.

CREST International is an international not-for-profit accreditation and certification body that represents and supports the technical information security market. Learn more at https://crest-approved.org.

The Cyber Defence Alliance (CDA) is a not for profit members organization based in London working on behalf of financial institutions to proactively share threat intelligence and expertise to prevent and disrupt cyber attacks, liaise with Law enforcement agencies to target cybercriminal networks and apprehend the most prolific offenders. The CDA works on a cross sector basis and with like minded organizations on an international basis to address the global threat from cybercrime. The CDA also provides a 24/7 incident response capability to support the member organizations and the UK Financial Services Cybercrime Collaboration Centre (FSCCC) during major cyber incidents.

The Cyber Readiness Institute (CRI) mission is to empower small and medium-sized enterprises with free tools and resources to help them become more secure and resilient. Learn more at https://cyberreadinessinstitute.org.

The Cyber Threat Alliance (CTA) is working to improve the cybersecurity of our global digital ecosystem by enabling near real-time, high-quality cyber threat information sharing among companies and organizations in the cybersecurity field. Learn more at https://www.cyberthreatalliance.org.

The Cybercrime Support Network’s (CSN) mission is to serve individuals and small businesses impacted by cybercrime. Learn more at https://cybercrimesupport.org. ‘

The CyberGreen Institute (CyberGreen) is dedicated to mobilizing a global community of experts, business leaders, and policymakers to revolutionize cybersecurity through the development of a science of Internet Public Health. Learn more at https://www.cybergreen.net.

The CyberPeace Institute is a nongovernmental organization whose mission is to reduce the harms from cyberattacks on people’s lives worldwide, provide assistance to vulnerable communities and call for responsible cyber behaviour, accountability and cyberpeace. At the heart of the CyberPeace Institute’s efforts is the recognition that cyberspace is about people. Learn more at https://cyberpeaceinstitute.org

The FIDO Alliance is an open industry association with a focused mission: authentication standards to help reduce the world’s over-reliance on passwords. The FIDO Alliance promotes the development of, use of, and compliance with standards for authentication and device attestation. Learn more at https://fidoalliance.org/.

The Forum of Incident Response and Security Teams (FIRST) aspires to bring together incident response and security teams from every country across the world to ensure a safe internet for all. Learn more at https://www.first.org.

The Global Cyber Alliance (GCA) builds practical, measurable solutions and tools that are easy to use, and works with partners to accelerate adoption around the world. Learn more at www.globalcyberalliance.org.

The National Cyber Forensics and Training Alliance (NCFTA) was established in 2002 as a nonprofit partnership between private industry, government, and academia. The NCFTA provides a neutral environment for operational collaboration in the ongoing effort to identify, mitigate, and disrupt cyber crime. Learn more at https://www.ncfta.net.

The National Cybersecurity Alliance (NCA) advocates for the safe use of all technology and educates everyone on how best to protect ourselves, our families, and our organizations from cybercrime. Learn more at www.staysafeonline.org.

The Open Web Application Security Project® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. Learn more at https://owasp.org.

SAFECode is a global industry forum where business leaders and technical experts come together to exchange insights and ideas on creating, improving, and promoting scalable and effective software security programs. Learn more at https://safecode.org.

The Shadowserver Foundation’s (Shadowserver) mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats. Learn more at https://shadowserver.org.

#ShareTheMicInCyber (#STMIC) is an online movement to address issues stemming from systemic racism in cybersecurity. The social media campaign highlights the experiences of Black practitioners in this field, catalyzes a critical conversation on race in the industry, and shines a light on Black practitioners’ accomplishments to showcase them as experts in their fields all while creating professional opportunities and bringing the cyber community together. Learn more at www.sharethemicincyber.com.

Sightline Security is a nonprofit security organization whose mission is to equip, empower, and support global nonprofits to navigate and embed cybersecurity into their organizations with confidence—founded to address the lack of cybersecurity adoption in the nonprofit sector by offering a holistic, business, and community-centric approach designed to embrace cybersecurity best practices. At Sightline, there is a world where nonprofits have the confidence, knowledge, and business acumen to stay protected in a digital world. Learn more at https://sightlinesecurity.org.

The post Cybersecurity Nonprofits Team Up to Form “Nonprofit Cyber” Coalition appeared first on Digital IT News.

Launched by CREST Accreditation: New Globally Available Practical Penetration Testing Certification

Taylor Graham — Tue, 07 Sep 2021 17:31:35 +0000

CREST, a not-for-profit accreditation and certification body representing the technical information security industry, has launched the first of four new practical penetration testing certifications that are designed to be delivered via selected Pearson Vue centers around the world. The new CREST Registered Security Analyst (CRSA) certification will provide CREST members, CREST qualified individuals and the wider industry with flexible, global access to this practical penetration testing examination.

CRSA is a new Registered level practical penetration testing certification. It has a slightly broader scope than the CREST Registered Penetration Tester (CRT) and includes desktop breakout assessments and a larger web application component. CRSA will run in parallel with CRT.

The UK’s National Cyber Security Centre (NCSC) has confirmed that the CRSA certification will be recognized alongside the CRT for technical entry for CHECK Team Member. This applies to all CRSA certifications awarded, wherever in the world candidates take the examination.

The existing CREST Practitioner Security Analyst (CPSA) certification, which is already a prerequisite for the CRT, is also a prerequisite for the new CRSA examination. Please note that a CPSA qualification attained via equivalency cannot be used as the pre-requisite for booking the CRSA examination.

The CRSA is available to book from today through Pearson Vue CREST :: Pearson VUE.

The CRSA is the first in a suite of new practical certifications being developed by CREST. The others, which have not yet been recognized by NCSC, are:

CREST Certified Security Consultant (Red Team) – CCSC RED
CREST Certified Security Consultant (Networks) – CCSC NET
CREST Certified Security Consultant (Web) – CCSC WEB

“The examinations for all four new practical penetration testing certifications have been designed to be delivered entirely through Pearson Vue centers,” said Ian Glover, President of CREST International. “This opens up the opportunity to individuals working in the cyber security industry to get the access to certify with CREST wherever they are in the world.”

Pearson Vue centers offer a distraction-free, secure testing environment with continuous candidate surveillance. There are number of mandatory security measures at all test centers to ensure the integrity of the examinations and the safety of the candidates.

For full details on the CRSA please visit: https://www.crest-approved.org/professional-qualifications/crest-exams/index.html

Image licensed by pexels.com

CREST Launches Remote Audit Facility for SOC Accreditation

For future updates on Penetration Testing Certifications and announcements, follow Digital IT News on Twitter, LinkedIn, or Facebook, or visit our Contact Page for subscription options.

The post Launched by CREST Accreditation: New Globally Available Practical Penetration Testing Certification appeared first on Digital IT News.

Microsoft’s Power Apps New Vector of Data Exposure

Taylor Graham — Wed, 25 Aug 2021 20:55:51 +0000

Microsoft’s Power Apps portals platform was unintentionally left unprotected online, prompting attention to an issue of a “new vector of data exposure” of more than 38 million records from 47 different entities.

Microsoft Power Apps is a browser-based platform that allows non-developers to build low-code personalized business apps by simply dragging and dropping objects to a Web browser. PowerApps targets business users and works across mobile and the web with options to retrieve and store information.

An analyst for UpGuard first discovered that the OData API for a Power Apps portal had anonymous accessible list data including personally identifiable information. UpGuard’s view that this isn’t precisely a software vulnerability, it is a platform issue that necessitates product code updates, and thus should be handled in the same way as vulnerabilities.

“The real scale of the issue is hard to assess. On one hand, it is obvious that headlines are overstating it: the majority of the exposed 38 million records did not include the most sensitive details like SSN or health information. Security researchers from UpGuard give some examples of data the exposed records included in their blog post. For the majority of records this was limited to names and email addresses. That said, more sensitive information was still exposed for at least hundreds of thousands of individuals. On the other hand, there is no way to be certain these records had not been harvested before UpGuard reported the issue to Microsoft and the application owners,” according to Ilia Sotnikov, VP of User Experience & Security Strategist at Netwrix.

Kenn White, director of the Open Crypto Audit Project, said it was a wakeup call for the industry as a whole. ‘Secure default settings matter,’ he told Wired. ‘When a pattern emerges in web-facing systems built using a particular technology that continue to be misconfigured, something is very wrong. ‘If developers from diverse industries and technical backgrounds continue to make the same missteps on a platform, the spotlight should be squarely on the builder of that platform.’

Ilia Sotnikov also said, “This news should hopefully lead to both vendors and companies to think more about the balance between time to market and security of their solutions. Power Aps allow to build and quickly launch no code or low code applications. Since this is hosted by Microsoft, this may create a false sense of security for a customer that just puts together the building blocks. Companies still must take time to learn the security features and the access model of the cloud platforms they use. They also should do at least basic threat modelling and security review for the applications they build and launch.”

“Hats off to the UpGuard team for their efforts not only to report the issue to the vendor (Microsoft), but working closely with affected parties to remediate the impact of potential exposure of sensitive data,” continued Netwrix VP of User Experience & Security Strategy. “Great way to handle security research and coordinate the response and disclosure efforts across multiple parties.”

The prevalence of sensitive data being leaked with more and more information moved online, increasing cyberattacks, and hackers around every corner, it is more important than ever that businesses need to extensively safeguard their IT department. Consistently it’s the “bad” news surrounding data breaches that we become aware of and not the good Samaritan offering a hand.

Image licensed by unsplash.com

Lack of Budget and Cloud Security Skills are Top Obstacles Keeping Organizations from Protecting Data in the Cloud, According to Netwrix Study

The post Microsoft’s Power Apps New Vector of Data Exposure appeared first on Digital IT News.

CompTIA ISAO Adds Real-time Cybersecurity Threat Analysis and Intelligence Resources from Sophos

Leigh Porter — Thu, 05 Aug 2021 20:10:24 +0000

Advanced cybersecurity threat analysis and intelligence capabilities are now available from the CompTIA Information Sharing and Analysis Organization (ISAO) through an expanded collaboration with global next-generation cybersecurity leader Sophos and it industry-leading and highly acclaimed threat research lab, SophosLabs.

The announcement of the new cyber capabilities was made today by CompTIA, the nonprofit association for the information technology (IT) industry and workforce.

CompTIA ISAO members can directly submit suspicious URLs and files through the ISAO’s Cyber Forum to SophosLabs Intelix for rapid analysis to determine if they are known or zero-day cybersecurity threats. SophosLabs Intelix combines petabytes of threat intelligence derived from decades of SophosLabs threat research with Sophos AI tools and techniques, bringing a powerful new source of threat intelligence to the CompTIA ISAO and its managed services provider (MSP), vendor, distributor, and associate members.

“SophosLabs research illustrates how adversaries are constantly changing their tactics, techniques and procedures (TTPs) to breach targets, move laterally and carry out ransomware and other attacks,” said Simon Reed, senior vice president, SophosLabs. “The only way to effectively fight modern cybercrime is if we do it together. That’s why Sophos is committed to sharing actionable threat intelligence with the CompTIA community. This new integration gives member organizations advanced abilities to quickly investigate suspicious URLs and files to determine their risk and to understand what happens if they are opened or executed. Powered by machine learning, SophosLabs Intelix predictively convicts never-before-seen threats, and is constantly improving based on the collective input of community intelligence.”

“This is a real differentiator for our members, who can access a powerful analysis resource to identify, classify and prevent threats, further protecting themselves and more importantly, their customers,” said MJ Shoer, senior vice president and executive director of the CompTIA ISAO.

The new integration expands Sophos’ support of the CompTIA ISAO. As a Silver Industry Partner, Sophos has been contributing detailed threat analysis from SophosLabs Uncut to the CompTIA ISAO.

“This is a significant addition to the resources available to our members,” Shoer added. “It is the latest example of the support that industry partners such as Sophos have for the CompTIA ISAO, and the commitment we all have to make the industry more secure.”

The CompTIA ISAO is a community of nearly 1,200 member companies that share best practices, cyber threat intelligence, educational content and more to help address ever-evolving cyber threats. Working closely with public and private cybersecurity agencies and organizations, the CompTIA ISAO is helping its members understand the threat landscape, defend against current and future attacks and raise cybersecurity awareness throughout the global tech industry. For complete details on the CompTIA ISAO and the benefits of membership visit https://www.comptiaisao.org/.

Image licensed by: Pixabay.com

80% of Global Organizations Expect to Experience a Breach of Customer Records in the Next Year

The post CompTIA ISAO Adds Real-time Cybersecurity Threat Analysis and Intelligence Resources from Sophos appeared first on Digital IT News.

Qualys Collaborates with Red Hat to Enhance Security for Red Hat Enterprise Linux CoreOS and Red Hat OpenShift

Leigh Porter — Tue, 03 Aug 2021 16:14:10 +0000

Qualys, Inc. announced it has collaborated with Red Hat to drive greater security for both the container and host operating system for Red Hat OpenShift.

Teaming with Red Hat, Qualys is offering a unique approach providing a containerized Qualys Cloud Agent that extends security to the operating system. The Cloud Agent for Red Hat Enterprise Linux CoreOS on OpenShift combined with the Qualys solution for Container Security provides continuous discovery of packages and vulnerabilities for the complete Red Hat OpenShift stack. Built on the Qualys Cloud Platform, Qualys’ solution seamlessly integrates with customers’ vulnerability management workflows, reporting and metrics to help reduce risk.

“Security is one of the biggest areas of concern for nearly every organization, and we believe that a strong partner ecosystem helps to address these concerns by giving our customers a wide range of solution choices,” said Aaron Levey, Head of Security Partner Ecosystem at Red Hat. “Qualys’ Cloud Platform and Cloud Agent helps administrators gain deeper visibility into known vulnerabilities that may be present on their Red Hat Enterprise Linux CoreOS nodes with pointers to associated Red Hat Security Advisories, leaning on the expertise of Red Hat as well as Qualys’ own skills in driving cloud-native security.”

The Qualys Cloud Agent for Red Hat Enterprise Linux CoreOS on Red Hat OpenShift helps customers:

See the Full Inventory – Continuous visibility of installed software, open ports, and Red Hat Security Advisories (RHSA) for all Red Hat Enterprise Linux CoreOS nodes with comprehensive reporting.
Manage Host Hygiene – Fully integrated on the Qualys Cloud Platform to automatically detect and manage host status related to patches and compliance adherence for known vulnerabilities.
Easily Deploy to the Host – Simplified deployment via the Qualys Cloud Agent to secure the host operating system. This approach eliminates the need to modify the host, open ports, or manage credentials.
Get Complete Coverage – Full coverage of Red Hat OpenShift and Qualys Container security delivers comprehensive visibility from the host operating system through to images and containers running on OpenShift.

“As security teams look to support modern applications built on cutting edge technology like Red Hat OpenShift, they need to secure both the running container images and the underlying OpenShift cluster,” said Sumedh Thakar, president and CEO of Qualys. “By collaborating with Red Hat, we have built a unique approach to secure Red Hat Enterprise Linux CoreOS that provides complete control over containerized workloads enhancing Qualys’ ability to help customers discover, track and continuously secure containers.”

Image licensed by Adobe Stock

68% of Sysadmins Say Their Organizations Faced Increased Risk of Cybersecurity Attacks Due to the Shift to Remote Work

The post Qualys Collaborates with Red Hat to Enhance Security for Red Hat Enterprise Linux CoreOS and Red Hat OpenShift appeared first on Digital IT News.

Optiv Security Launches Next-Gen Managed XDR to Stop Threats Earlier in Attack Lifecycle

Leigh Porter — Tue, 03 Aug 2021 16:02:09 +0000

Optiv Security, launched its Managed Extended Detection and Response (MXDR) offering at Black Hat USA 2021. The technology-independent offering enables clients to take rapid and decisive action against today’s most critical cyberattacks and strengthen their security posture.

Optiv Managed XDR is a next-generation tech-enabled service that leverages your existing technology investments and deploys Optiv’s deep expertise to detect, analyze and remediate threats in real time.

“Optiv MXDR brings simplicity, transparency and automation to clients’ environments, enhancing existing defenses to counter known and emerging threats with confidence and speed,” said David Martin, chief services officer for Optiv. “What’s more, we can seamlessly leverage the power of Optiv to extend and layer the offering with a full suite of complementary services like remediation, incident response, threat hunting, and beyond.”

Optiv MXDR is the only managed cloud-based, next-gen advanced threat detection and response service that ingests data across various layers of technologies to correlate, normalize, enrich, and enable automated responses to malicious activity in real-time. By automating incident investigation with actionable insights, organizations can detect threats faster and prioritize which threats to mitigate first, significantly reducing the attack surface.

“We know the threat landscape; both what’s at stake and how to circumvent threat actors while significantly reducing time to detect and respond,” said John Ayers, XDR vice president for Optiv. “We meet clients where they are and customize our continuously managed approach to ease the burden of the unknown and allow teams to detect, respond and remediate threats faster while also automating deeper investigation for future improvements.”

Devo has been named a foundational partner in Optiv MXDR, delivering scalable, cloud-native logging and security analytics via the Devo Platform, enabling full visibility across cloud and on-premise environments for Optiv customers.

“Security teams are eager to learn more about XDR as they look to consolidate their security stack for greater efficiency and accuracy in threat detection and response,” said Ted Julian, SVP of Product at Devo. “Two constraints have always stood in their way: lack of real-time access to historical data, and the inability to collect and analyze the massive data volumes associated with modern operational environments. Devo eliminates these concerns and is uniquely qualified to power solutions like Optiv’s MXDR.”

Optiv delivers threat management solutions to more than 60 percent of Fortune 500 companies. View the complete MXDR service brief and find out how organizations can enhance their security posture with Optiv.

Image licensed by: unsplash.com

Veristor and Network Data Systems Partner to Deliver Services for Managed Secure Networking

The post Optiv Security Launches Next-Gen Managed XDR to Stop Threats Earlier in Attack Lifecycle appeared first on Digital IT News.

PC Matic Selected by NIST’s National Cybersecurity Center of Excellence to Demonstrate Zero Trust Architectures

Leigh Porter — Thu, 22 Jul 2021 19:48:01 +0000

PC Matic, announced it has been selected by the National Institute of Standards and Technology’s (NIST) National Cybersecurity Center of Excellence (NCCoE) to participate in their Implementing a Zero Trust Architecture Project.

A collaboration amongst many industry leaders in cybersecurity, PC Matic will join seventeen other companies to develop practical approaches to designing and implementing zero-trust architectures. The approaches designed by these organizations will result in a cybersecurity practice guide published by the NCCoE for government and enterprise organizations who seek to implement a zero-trust architecture.

“Since inception, PC Matic has utilized a zero-trust approach to stop malicious cyber threats such as ransomware,” said PC Matic CEO Rob Cheng. “Understanding just how effective this framework has been for our own customers, we are very grateful to the NCCoE for the opportunity to contribute to this project. We look forward to working together with the NCCoE and our other project partners to showcase the capabilities of and implementation strategies for zero trust architectures.”

Through its engagement in the project, PC Matic will assist the NCCoE in achieving the program’s objectives:

Demonstrate an example implementation(s) of a Zero Trust Architecture (ZTA), using commercially available technology components designed and deployed according to the zero trust concepts and tenets described in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207, Zero Trust Architecture.
Demonstrate various types of user access to enterprise resources (e.g., data sources, computing services, and IoT devices) spread across boundaries, from on premises to multiple cloud environments, all confined by policy based security constraints orchestrated by leveraging zero trust principles and approaches.
Publish a NIST Cybersecurity Practice Guide, a publicly available description of the practical steps needed to implement a cybersecurity reference design that addresses this challenge.

“Implementing a zero-trust architecture has become a federal cybersecurity mandate and a business imperative,” said Natalia Martin, Acting Director of the NCCoE. “We are excited to work with industry demonstrating various approaches to implementing a zero-trust architecture using a diverse mix of vendor products and capabilities, and share ‘how to’ guidance and lessons learned from the experience.”

In response to an open call in the Federal Register, PC Matic submitted its capabilities as it relates to the Implementing a Zero Trust Architecture Project. Following such submission, PC Matic was invited to sign a Cooperative Research and Development Agreement with the National Institute of Standards and Technology (NIST), allowing them to participate in this project.

More information on the project may be found here.

Image licensed by: Pixabay.com

Cloudian Ransomware Survey Finds 65% of Victims Penetrated by Phishing Had Conducted Anti-Phishing Training

The post PC Matic Selected by NIST’s National Cybersecurity Center of Excellence to Demonstrate Zero Trust Architectures appeared first on Digital IT News.

Stealthbits, Now Part of Netwrix, Named to Carahsoft ITES-SW2 Contract to Support U.S. Army Enterprise Infrastructure Goals

Leigh Porter — Mon, 21 Jun 2021 18:13:55 +0000

Stealthbits, now part of Netwrix, announced that it has been named a manufacturer on the Information Technology Enterprise Solutions – Software 2 (ITES-SW2) contract for U.S. Army Computer Hardware Enterprise Software and Solutions (CHESS). This contract is held by Carahsoft Technology Corp., The Trusted Government IT Solutions Provider^®, and is effective through August 30, 2025.

ITES-SW2 is a firm-fixed price, indefinite delivery/indefinite quantity contract vehicle for commercial off-the-shelf software products and related services and hardware. The contract has no fees, and ordering is open to all Army, DoD and federal agencies and authorized systems integrators on a worldwide basis. Under this contract, Carahsoft provides cybersecurity and data access governance software from Stealthbits to support the IT infrastructure goals of federal agencies.

Federal agencies often find it difficult to properly govern access to structured and unstructured sensitive data due to multiple layers of oversight, compliance requirements and lack of data governance. Stealthbits solutions help agencies overcome these challenges by enabling them to control data access, enforce security policy and detect threats to their most critical assets.

“We are excited to become a part of the Carahsoft ITES-SW2 contract, as it will be easier for our federal clients to purchase our products for cybersecurity and data access governance using this trusted purchase vehicle. By expanding our partnership with Carahsoft, we will increase Stealthbits’ ability to help the Army, the DoD and federal agencies mitigate their cybersecurity risks,” said Steven Hollins, Chief Revenue Officer at Netwrix (including Stealthbits).

Stealthbits software is available through Carahsoft’s ITES-SW2 contract W52P1J-20-D-0042. For procurement information, contact Carahsoft’s ITES-SW2 contract team at (703) 871-8681 orITES-SW2@carahsoft.com or visit Carahsoft’s dedicated ITES-SW2 contract resource center.

To learn more about Stealthbits’ offerings under ITES-SW2, contact the Stealthbits Team at Carahsoft at (866) 421-4683 or Stealthbits@carahsoft.com.

Image licensed by: Pixabay.com

Survey Finds User Experience is IT’s Top Remote Work Challenge

The post Stealthbits, Now Part of Netwrix, Named to Carahsoft ITES-SW2 Contract to Support U.S. Army Enterprise Infrastructure Goals appeared first on Digital IT News.

PC Matic Survey: 20% of Employers Never Require Employees to Change Passwords

Leigh Porter — Tue, 08 Jun 2021 20:52:45 +0000

PC Matic, announced the release of its third annual report analyzing users and their password habits and hygiene. The report found that nearly 30% of Americans aren’t sure when they last changed their passwords, or never have at all. The survey also revealed lax corporate passwords, finding that nearly a fifth of employers nationwide never require their employees to change their passwords.

The sixteen-page report presents the results of a nationally distributed survey by which 2,500 Americans were asked about their password behaviors and tendencies. The findings, fielded in May 2021, found that nearly 30% of Americans aren’t sure when they last changed their passwords, or never have at all. The survey also revealed lax corporate password policies, finding that nearly a fifth of employers nationwide never require their employees to change their passwords.

More key findings from the report are as follows:

Nearly 60% of those surveys responded that they have never changed their home Wi-Fi password, or that it hasn’t been changed since setup. In 2020, 50% of those surveys responded in this same manner.
40% of respondents indicated that they are using the password lockout feature on both their work and home computers. This number is up from 25% responding that they used this feature in 2020’s survey results.
Just shy of 45% of employers don’t require their employees to utilize a Virtual Private Network (VPN). 2020’s survey results showed just a slightly higher number of respondent’s employers requiring a VPN, with 46% affirming they were required to use the security tool.
More than 50% of respondents admit to checking personal e-mail accounts at work. This number remains virtually unchanged from 2020’s survey results, and still presents an imminent threat to corporate networks.

“As employees’ transition from work-from-home to in-office work environments again, it is the perfect time implement password policies and procedures that can keep employees and corporate networks safe,” said Rob Cheng, CEO and Founder of PC Matic. “The 2021 Password Habits and Hygiene Report aimed to understand the policies and procedures being implemented and abided by users across the nation and provides further insight into how corporate IT professionals can protect networks from cybercriminals.”

More findings and the complete report may be found here.

Image licensed by: Pixabay.com

New Mandiant Services Help Organizations Balance Effective Cyber Security and Business Risk

The post PC Matic Survey: 20% of Employers Never Require Employees to Change Passwords appeared first on Digital IT News.

New Mandiant Services Help Organizations Balance Effective Cyber Security and Business Risk

Taylor Graham — Thu, 27 May 2021 09:36:45 +0000

FireEye, Inc, the intelligence-led security company, announced new Cyber Risk Management Services from Mandiant. Mandiant® Cyber Risk Management Services are designed to address critical business and security requirements to equip executives, boards of directors, and security and cross-functional leaders with risk-based data and advice to build effective and balanced security programs.

“When developing a corporate security strategy and program, it is imperative to identify the areas and assets with the highest business value and those with the most significant threats and vulnerabilities. Mandiant Cyber Risk Management Services are designed to balance business and technical considerations and provide executives with risk-based decision support,” said Jurgen Kutscher, Executive Vice President, Service Delivery, Mandiant Consulting. “Mandiant brings unparalleled frontline expertise and analysis to help business leaders focus on running their businesses more securely by prioritizing their security investments to maximize risk reduction.”

The Cyber Risk Management Services offering incorporates Mandiant threat intelligence, incident response data, and proven risk methodologies to help organizations shine a light on where harmful risk exists. This allows business and security leaders to shift from a reactive security approach to a risk-based, informed program for better decision-making and critical asset protection.

Structured as building blocks that work independently and collectively, Mandiant Cyber Risk Management Services include:

Security Program Assessment – evaluate existing capabilities and maturity, coupled with an actionable improvement roadmap focused on the areas with the highest risk based on Mandiant’s frontline expertise
Crown Jewels Assessment – identify critical assets to shift security efforts and prioritize investment on the assets that matter most
Cyber Due Diligence – surface and manage inherited cyber risks outside of an organization’s control like those found in supply chain, third-party vendors, or during corporate acquisitions and divestment
Cyber Risk Operations – design and operationalize risk programs that leverage threat intelligence and frontline experience to determine custom risk profiles and tolerances, including how to best invest in security capabilities
Threat and Vulnerability Management – build and improve the capability to identify and manage specific threats with significant technology impact and vulnerability if left exposed
Threat Modeling – uncover unknown risks in both current and future state for improved planning

Learn more about Mandiant Cyber Risk Management Services: https://www.fireeye.com/mandiant/cyber-risk-management-services.html

Image licensed by Unsplash.com

Netwrix Reports: 4 of the Top 6 Types of Cybersecurity Incidents Are Now Related to Insider Actions

The post New Mandiant Services Help Organizations Balance Effective Cyber Security and Business Risk appeared first on Digital IT News.