AD_Layout 1 7/10/2017 1:29 PM Page 2

AD_Layout 1 7/10/2017 1:29 PM Page 3

Page 04_Layout 1 7/10/2017 1:26 PM Page 4

INDEX

08 BUZZ
Automotive Cybersecurity: A New Market
with a Distinct Challenge

14 IN THE SPOTLIGHT
An Interview with Manish Tiwari

20 INSIGHT 14
GDPR: Whats in Store for Businesses

24 COVER STORY
Securing Smart Cities

30 TABLE TALK
Few Minutes with Heath Renfrow

36 IN THE HOTSEAT
High-Profile Appointments in the
Cybersecurity World

39 IN THE NEWS
Top Stories Related to Cybersecurity

46 EVENT FOCUS
A Curtain Raiser to Hacker Halted

49 KICK-STARTERS
Startups making waves in the 24
Cybersecurity World

54 KNOWLEDGE HUB
Demystifying Dark Web: An
Organizational Point of View

57 VIEWPOINT
Trust the Cloud and Carry Your Umbrella

60 PROFILE
A Peak into Ixias Offerings

62 COLLABORATIONS
Famous Collaborations in the
Cybersecurity World

66 TECH TALK
Bug Bountry Programs: Closing Security
Gaps 20 54
CISO MAG | July 2017
Page 05_Layout 1 7/10/2017 6:16 PM Page 5

EDITORS
NOTE

With the fabric of our society

now defined by the
technology we use, the issue
of cybersecurity has become
more important than ever. Volume 1 | Issue 1 | July 2017
Time and again, major
cybersecurity breaches have
shaken up the world, serving
Editorial
as wake-up calls for
International Editor
authorities and individuals
Amber Pedroncelli
to initiate measures to
amber.williams@eccouncil.org
improve the security and
stability of the cyberspace. Senior Editor
Rahul Arora
The threats we foresee are
rahul.arora@eccouncil.org
not expected to cease and
one can only expect to Feature Writer
uncover more calculated Augustin Kurian
attacks on a wider scale. Therefore, there is a continuous need for augustin.k@eccouncil.org
providing unbiased and useful information to the professionals working
to secure critical sectors. To provide cybersecurity experts key information
and analysis to tackle critical security challenges, we have CISO MAG, an
Design
information security magazine for best practices, trends, and news. Design Head and Visualizer
MSH Rabbani
This issues cover story features smart cities, a topic that has been gaining rabbani@eccouncil.org
attention around the world. The story discusses the importance of the
security of smart cities, and explores the impending threats inherent to Designer
added technology and the need for standardization. Surendra Bitti
surendra@eccouncil.org
Move on to the Buzz section of this issue where we discuss vehicle
hacking. The era of connected cars is upon us. Modern day cars are Management
supercomputers with accelerator pedals, transmission, and brakes that Business Head
can be connected to your phones. Some phone apps can even summon Apoorba Kumar*
cars from your garage. But phones and computers can be hacked, the cars apoorba@eccouncil.org
are not any less vulnerable as well.
Sales Manager
In the Under the Spotlight section, we interview Manish Tiwari, CISO of Basant Das
Microsoft India, who is a result-driven cybersecurity professional basant.das@eccouncil.org
responsible for various IT security initiatives in the Indian Navy and later
in Microsoft India.
Technology
The magazine comprises a host of other informative features that look Chief Information Security Ocer
cybersecurity from an all-encompassing perspectiveregulations, Subrahmanya Gupta Boda
workforce development, partnerships, and much more. gupta.boda@eccouncil.org

Tell us what you think of this issue. If you have any suggestions,
Director of Technology
comments, or queries, please reach us at editorial@cisomag.com.
Raj Kumar Vishwakarma
Jay Bavisi rajkumar@eccouncil.org
Editor-in-Chief
jay@eccouncil.org Information Security Specialist
Manoj Kakara
manoj@eccouncil.org

* Responsible for selection of news under PRB Act. Printed & Published by Apoorba Kumar, E-Commerce Consultants Pvt. Ltd. and printed at G97 Network Pvt. Ltd., Editor: Rahul Arora.
The publishers regret that they cannot accept liability for errors & omissions contained in this publication, howsoever caused. The opinion & views contained in this publication are not necessarily those of the
publisher. Readers are advised to seek specialist advice before acting on the information contained in the publication which is provided for general use & may not be appropriate for the readers particular
circumstances. The ownership of trade marks is acknowledged. No part of this publication or any part of the contents thereof may be reproduced, stored in a retrieval system, or transmitted in any form without the
permission of the publishers in writing.
Page 06-07_Layout 1 7/10/2017 12:02 PM Page 6

ADVISORY
BOARD

CISO MAG is honored to have an Advisory Board that

comprises some of the foremost innovators and thought
leaders in the cybersecurity space. The board members
provide us the strategic advice regarding the magazine
general direction, including shaping our editorial content,
identifying important topics and special issues,
moderating discussions, and helping to create initiatives
that benefit the industry at large.

Curtis is a proven technologist with over 25 years of experience in cybersecurity/defense,

continuity/recovery of operations, and information governance. He is an expert in designing and
implementing strategic and tactical information security architectures and best practices for
organizations with a wide variety of risk postures in complex and distributed environments.
Curtis has served with distinction, two sitting presidents of the United States, two chairmen of
the joint chiefs of staff and the chief justice of the United States.

Curtis Levinson
Private Consultant and United States Cyber Defense Advisor to NATO

The former CISO of Cox Communications, VeriSign, and SecureIT, Phil helped transform security
at GE, Alcatel, Scientific-Atlanta, Cisco, and Dell. He has influenced the privacy, cybersecurity,
and IT industries for almost 30 years through his leadership and influence in policy/standards
bodies and industry think tanks. He has shaped payments security on the PCI Security Standards
Council Board of Advisors and FS-ISAC PPISC Steering Committee.

Phil Agcaoili
Senior Vice President, U.S. Bank, and Chief Information Security Officer, Elavon

Selim has over 20 years of computer and financial industry experience, and was named by the IT
Security Magazine as one of the "Top 59 Most Influential Security Experts. He has published over
30 journal and conference papers and co-authored the book Security for Mobile Networks and
Platforms. Selim has over 100 patents filed, and has previously worked with Visa as vice
president of Global Information Security and headed Strategic Planning for eCommerce, Security,
Manageability, Content Protection, Enterprise & Virtualization for Intel.

Selim Aissi
Chief Information Security Officer, Ellie Mae

CISO MAG | July 2017

Page 06-07_Layout 1 7/10/2017 12:02 PM Page 7

ADVISORY
BOARD

Betty has over 35 years of experience in information technology (IT), networks, application
development, information security, cybersecurity, privacy, cloud services, risk management,
compliance, certification and accreditation, information assurance, and other security or privacy
assessments. A subject matter expert in security authorization and regulatory compliance
including NIST, FedRAMP, and international regulations, her certifications include CISSP, ISSMP,
CAP, CIPP/US, CIPP/G, NSA-IAM, NSA-IEM, C|CISO, and CIPM. She designed and implemented the
first cybercast from the White House and led the team that won the Hammer Award for
Excellence from Vice President Al Gore.

Betty Lambuth
Private Consultant

Tammy not only secures and protects Venafi, she also collaborates globally to help CIOs and
CISOs fortify their strategies to defend against increasingly complex and damaging cyberattacks
against the trust established by cryptographic keys and digital certificates. Tammys professional
experience, leadership, and recognized domain expertise as the CISO of Global 250 companies
will help fellow CISOs defend their organizations. A veteran in information technology, she is
noted by her peers to be a results-driven and passionate executive leader.

Tammy Moskites
Chief Information Officer and Chief Information Security Officer, Venafi

Prashant is an internationally renowned cyber law and cybersecurity expert, author and a
lawyer based out of Mumbai, India. He has been awarded as the Cyber Security Lawyer of the
Year-India by Financial Monthly magazine of UK (2016). He has also been awarded as Cyber
Security & Cyber Law Lawyer of the Year 2014 by Indian National Bar Association.

Prashant Mali
International Cyber Law and Cybersecurity Expert

Magda calls herself a cyber feminist and a cyber evangelist. She is involved in public speaking
and international conferences as a keynote speaker where she addresses industries' challenges
with cybersecurity as well as diversity in the sector and the presence of women. In addition of
managing her business, she acts as chief information security officer for various companies. She
speaks five languages fluently, and has a PhD in Telecommunication Engineering with a
subsequent specialization in cybersecurity with a CISSP certification.

Magda Chelly
Managing Director, Responsible Cyber Pte

Sunil has over 22 years of leadership experience with renowned companies in Banking, Telecom,
ITES and Manufacturing in Middle East, United States and India. He has participated in various
advisory forums globally, and has published and presented several articles related to information
assurance. Two of his patent application on information security is currently in consideration.

Sunil Varkey
Chief Information Security Officer, Wipro Technologies

CISO MAG | July 2017

Page 08-12_Layout 1 7/10/2017 12:09 PM Page 8

BUZZ

AUTOMOTIVE
CYBERSECURITY:
A NEW MARKET WITH
A DISTINCT CHALLENGE
Augustin Kurian

CISO MAG | July 2017

Page 08-12_Layout 1 7/10/2017 12:09 PM Page 9
I
nnovation in the automotive
industry has led to a scenario
where a car being manual
may simply mean it has a
steering wheel. Once
composed of only
mechanical and electrical
parts, cars have now turned into
complex systems that comprise
sensors, microprocessors, software,
and much more.
The proliferation of autonomous
vehicles means that microprocessors
and sensors will soon take a much
more active role in driving cars.
However, even before self-driving
cars become commonplace, modern
cars are already vulnerable to
hackers via in-car technology like Wi-
Fi. These connected cars are
becoming standard. In 2015, there
were around 6.5 million connected
cars on the road and by 2017, the
figure almost doubled to 12.5 million.
According to estimates, there will be
as many as a quarter billion
connected vehicles on the road by
2020.
BUZZ
This new technology has also opened
a floodgate of security threats. While
you might be behind the wheel,
potentially vulnerable software
control your cars functions. There is
almost nothing in your car that is not
mediated by a computer, said
Professor Stefan Savage, Department
of Computer Science, UC San Diego,
while speaking to Motherboard
magazine for a short documentary
on car hacking.
Fear of car hacking has not yet
penetrated the general populations
psyche, as demonstrated by a 2016
Kelley Blue Book survey of drivers.
The results of the survey show that
among its sample size, very few
drivers fear car hacking and most
consider connected apps and Wi-Fi
networks nice features to have.
Worries over security have also not
slowed down the pace at which
connectivity features continue to be 9
rolled out due to the real benefits all
this technology can bring with it.
Connectivity technologies in
commercial vehicles not only
improve efficiency and streamline
logistics, they also lower occurrences
There is almost
nothing in your car that
is not mediated by a
computer, said
Professor Stefan
Savage, Department of
Computer Science, UC
San Diego, while
speaking to
Motherboard magazine
for a short documentary
on car hacking.
CISO MAG | July 2017
Page 08-12_Layout 1 7/10/2017 12:09 PM Page 10
BUZZ
of road accidents and reduce
preventive maintenance costs.
Incorporating connectivity
technologies can also reduce 62
percent of all trucking costs, it is
estimated.
A REAL THREAT
Vehicle hacking isnt just a theory or
seen only in Hollywood movies. In
2016, Nissan had to shut down its
proprietary app NissanConnected EV
for its Leaf line-up after it was found
that hackers could access the cars
climate control and other battery
operated features to drain the
batteries. Also, in 2015, automaker
Fiat Chrysler had to issue a recall for
almost 1.4 million vehicles after
10
CISO MAG | July 2017
researchers Charlie Miller and Chris
Valasek of Wired demonstrated a
wireless hack on Jeep Grand
Cherokee, taking over the controls of
the dashboard, steering wheel,
powertrain, and even the brakes.
Recently, WikiLeaks released
documents blowing a whistle on the
CIA suggesting journalist Michael
Hastingss fatal car crash was
triggered by a car hack. In
2013, Hastings died
after the car he
was driving
abruptly
sped up
and
crashed
into a
tree. The media has largely covered
this idea as a fringe conspiracy
theory, but many of the details are
consistent with how a hacked car
could behave.
REGULATORS, INDUSTRY
RESPOND
Autonomous vehicles are no longer a
pipe dream and all vehicles soon will
come with smartphone connectivity
embedded into their systems.
Fortunately, all manufacturers
prioritize the satisfaction
and safety of their
customers. The
burgeoning field of
automotive
cybersecurity will grow
Page 08-12_Layout 1 7/10/2017 12:09 PM Page 11

BUZZ

TAKEAWAYS FOR CISOs

In a time where cars are predicted to generate 25 gigabytes of data per hour, enterprises may need to consider
connected cars as an insider threat due to their vulnerability to data theft. Cars come with connected features
to pair your personal device for several purposes like hands-free driving, access to infotainment, GPS, and
maps. Pairing devices like smartphones that carry sensitive data to a cars network may pose a serious threat.
The data under threat can be personal or belong to an enterprise. And many times, information security heads
are oblivious to the number of cloud apps in employees device. In fact, according to a Symantec report, when
most CISO/CIOs assumed employees in their organizations use up to 40 cloud apps on their devices
(smartphones, tablets, laptops), in reality the number neared 1,000. The volume of exposed data is massive.
CISOs need to be more vigilant, else, they may see a shift in ways data breaches occur.
To ensure the prevention of data theft from insider threats, organizations can do the following:
Train employees on safe pairing techniques of devices and cars
Encourage employees to charge mobile devices through cigarette lighter and not the USB
Encourage employees to implement various security measures like installing firewall, antivirus and
encryption software on employees' devices. Company-owned devices should be issued with mobile device
management (MDM) software.
In case the device is lost, there should be a way to locate and lock the device, and if necessary, the device
should be implanted with a kill switch.

in partnership with regulatory and
compliance bodies, original
equipment manufacturers (OEMs),
technology companies, insurance
companies, and other stakeholders
pressing for safe and secure
architecture. Connected and
autonomous automobiles are
dynamic threat environments and
numerous patrons are collaborating
with groups like the newly formed
Auto-ISAC, to sketch guidelines,
standardizations, and best practices.
These bodies endorse integration of
cybersecurity into the entire lifecycle
of a vehicle from concept to
production, maintenance, and
decommission.
Even governments are taking notice
of this. Earlier this January, a
bipartisan bill titled Security and
Privacy of Your (SPY) Car Study of
2017 was introduced in the United
States focusing on the cybersecurity
of automobiles. The bill mandated
that the National Highway Traffic
Safety Administration create
appropriate cybersecurity standards
for vehicles. Other nodal agencies
mentioned in the bill were the
Department of Defense, National
Institutes of Standards and
Technology, and the Federal Trade
Commission, among others. The bill
stressed the importance of isolation
measures to separate critical
software from trivial programs and
The European Union
Agency for Network and
Information Security
(ENISA) has also
envisaged similar
scenarios and come up
with a report on Cyber
Security Resilience of
Smart Cars.
11
take measures to detect anomalous
codes.
The European Union Agency for
Network and Information Security
(ENISA) has also envisaged similar
scenarios and come up with a report
on Cyber Security Resilience of
Smart Cars.
GROWING TECH, BROADER
SAFETY NET
Security cannot be an afterthought
it must be integral throughout the
design process. Automotive
cybersecurity is a new emerging
market. According to report titled
Automotive Cyber Security - Global
Forecast to 2021, the global
automotive cybersecurity market is
projected to grow at a compound
annual growth rate (CAGR) of 13.2
percent by 2021, to reach a market
size of $31.8 million by 2021.
A sizeable number of private firms
are also venturing into automotive

CISO MAG | July 2017

Page 08-12_Layout 1 7/10/2017 12:09 PM Page 12
BUZZ
12
cybersecurity. Israeli startup
Karamba Security unveiled security
systems for connected cars that
prevent hackers from running any
malicious code on the car system like
lane assist, infotainment, and GPS
tracking. Another startup working in
the same field is Argus Cyber
Security. Argus helps car
manufacturers, their Tier 1 suppliers,
and aftermarket connectivity
providers protect connected cars and
commercial vehicles from hacking.
This is the Internet of Things (IoT) era
CISO MAG | July 2017
and cars are no longer basic modes of leverage these systems to offer free
transportation. Connected cars could rides to stores to retain customer
be a new and refreshing use of big loyalty.
data and a business model worth
The initial architecture of car
leveraging as insights from these
networks is now almost 30 years old
data can be monetized. A McKinsey
and was devised for various reasons,
report states that, Once autonomous
but security was not one of them.
driving and car connectivity
The systems were designed without
combine, customers might be offered
an inkling that vehicles could be
mobility services in exchange for
hacked, but its not too late. Its time
watching targeted advertisements,
for cybersecurity professionals to
providing product feedback, or
step in and do what they do best
making purchases while in the car.
clean up the tech to avert disaster.
Businesses in the future might also
AD_Layout 1 7/10/2017 1:31 PM Page 13
Page 14-17_Layout 1 7/10/2017 12:23 PM Page 14

UNDER THE
SPOTLIGHT

14

MANISH TIWARI
CISO, Microsoft India
A result-driven cybersecurity professional responsible for various
IT security initiatives in the Indian Navy, Manish Tiwari dons many
hats. He is currently working as the Chief (Information) Security
Officer at Microsoft India and has a strong foundation in
information security management. In an exclusive interview with
CISO MAG, Manish talks about managing IT risks efficiently while
covering aspects such as the evolution of the CISO role, the
disconnect between CIOs and CISOs, and the shortage of skills in
information security.
Rahul Arora

CISO MAG | July 2017

Page 14-17_Layout 1 7/10/2017 12:23 PM Page 15

UNDER THE
SPOTLIGHT

15

CISO MAG | July 2017

Page 14-17_Layout 1 7/10/2017 12:23 PM Page 16

UNDER THE
SPOTLIGHT

You have had such an illustrious

career with the Indian Defense
Forces. How is working with a
corporation like Microsoft
different from working for the
Since I work in almost all the sectors, I do
government? come across many scenarios where I see a
I dont see much difference between disconnect between the CIOs and the CISOs.
the two; I think work is work.
However, every organization is Let us try to understand the root cause of the
different in structure and culture.
Working in the government sector problem. Typically, the role of a CIO is to
and a corporation is a little different manage and improve the IT infrastructure of
in that sense. No matter which
organization you work with, you an organization. A CISO is in many ways
have to uphold the values of the
company and understand its responsible for identifying, monitoring, and
philosophy as well as its goals. My resolving some of the security issues.
mantra has always been
professionalism, hard work, honesty,

and perseverance.

During the course of your

16 illustrious career, you must have
handled a number of crises.
Which situation really tested
you to your limits? Do you
remember your first challenge
when it came to cybersecurity?
If you are a veteran of 28 years in an
industry, it is impossible for you to
grow without handling crises.
Problems and challenges are part of
your professional life. It does not
matter whether you are in the armed
forces or corporate, you have to take
those challenges head-on and
convert them into opportunities.
That is how I look at it. I do not want
to single out one specific instance
because I have had a very diverse
career.
An information technology
journalist once said that the job
of the CSO or CISO is part
diplomat, part technocrat, part
salesperson, and part scapegoat.
Do you concur? How has the role
of a CISO evolved in the last five
years?
The statement is very apt. As far as
taking the blame is concerned, as a
team, you take the good and bad as it
comes along. To answer your other
question, I dont think it will be
correct to describe the evolution of
CISOs in the last five years. I think the
role has evolved over the last 20
years. In 1990s, people started using
computers frequently. The Internet
was seen as an amazing productivity
tool and a platform to connect people
across the globe. What it also meant
that information in your repository
could be at risk too. The loss or
tampering of information could lead
to a personal loss or the leakage of
important or sensitive data about a
product, which could result in a loss
of an image or brand. I think that is
when the evolution of the CISO really
started.
In one of the conferences you
attended, you said that there is a
disconnect between CIOs and
CISOs. What makes you say that?
It was not a blanket statement for
the industry. Since I work in almost
all the sectors, I do come across many
scenarios where I see a disconnect
between the CIOs and the CISOs. Let
us try to understand the root cause of
the problem. Typically, the role of a
CIO is to manage and improve the IT
infrastructure of an organization. A
CISO is in many ways responsible for
identifying, monitoring, and
resolving some of the security issues.
The process of carrying out an IT
assessment test or IT risk
management falls primarily under
the CISO.
It is important to find the right
balance to meet business and
cybersecurity requirements. There
can be an end risk, therefore, some
additional control or processes need
to be applied. So, at times I do see a
disconnect in that regard, especially
in Indian banks. We are already

CISO MAG | July 2017

Page 14-17_Layout 1 7/10/2017 12:23 PM Page 17

UNDER THE
SPOTLIGHT

seeing that information technology
is converging and penetrating into
the business operations, making IT
security an integral aspect of the
business. In my opinion, all these
aspects need to be under one
umbrella.
I heard you saying in one of your
keynotes that most companies
either dont go through an IT risk
assessment process or dont do
it properly. Do you think
cybersecurity is taken lightly
overall?
There was a report from KPMG in
2015, which stated that almost 74%
of the organizations in India had not
undergone an IT risk assessment.
That is very alarming because it is
important to carry out an analysis. If
you do not know what is wrong, or
what are the gaps then how do you
strategize security? How do you
optimally utilize limited resources to
select and apply appropriate
controls? An IT risk assessment is a
proactive exercise that allows you to
identify the gaps. It also helps us
understand issues, how they need to
be addressed using a combination of
people, process and technology, and
how to balance that with business
requirements. It also helps you tackle
risks, identify the residual risks, and
find ways to combat them. IT risk
assessments must be done on a
routine basis; they must be an
exercise for every six months at least.
Do you think there is skill
shortage in the information
security industry?
Yes, there is a shortage. What we
have been noticing is that the
professionals are getting into the IT
security industry at a later part of
their careers probably five to six
years into their profession, if not
later. That is our limitation. However,
many in the current generation have
now taken interest in the subject
from their school days. If someone
who has aptitude and interest starts
taking interest in information
security at an early stage, he/she can
scale newer heights. Cybersecurity is
something that requires a
tremendous amount of aptitude.
Training and certifications can help,
but at the end of the day, you need
the aptitude. In fact, many basic
skills, such as vulnerability
assessment, application security
testing, are self-taught. Once you get
the basics right, you can start
building your expertise. Fortunately,
things are changing for good. I am
optimistic about it and I hope people
will take up IT security at early stages
of their careers. 17

What would be your advice to a
budding information security
professional? What can he/she
If someone who has aptitude and interest learn from Manish Tiwari?
After spending a number of years in
starts taking interest in information security this profession, I can say with
at an early stage, he/she can scale newer certainty that this generation is at
benefit as compared to the earlier
heights. Cybersecurity is something that generations. We did not have a
course on computer science 30 years
requires a tremendous amount of aptitude. ago, but now the youngsters can
Training and certifications can help, but at the choose from a host of options.
Therefore, they now have the option
end of the day, you need the aptitude. In fact, to build a foundation. They have to
follow their heart and mind. This is
many basic skills, such as vulnerability true for every profession. Without
assessment, application security testing, are your heart in the job, it is very
difficult to have the fire in your belly
self-taught. Once you get the basics right, you and push yourself beyond the limits.
You should be able to spend time
can start building your expertise. understanding the career path. Do
your research. Cybersecurity is a very
rewarding field. I encourage

youngsters to take it up and be

passionate about it.

CISO MAG | July 2017

AD_Layout 1 7/10/2017 1:34 PM Page 18
AD_Layout 1 7/10/2017 1:34 PM Page 19
Page 20-22_Layout 1 7/10/2017 12:26 PM Page 20

INSIGHT

20

GENERAL DATA
PROTECTION REGULATION:
WHAT'S IN STORE FOR BUSINESSES?
Raymond Teo, Senior Vice President, Business Development, APAC, NTT Security

CISO MAG | July 2017

Page 20-22_Layout 1 7/10/2017 12:26 PM Page 21
I
n an uncertain world, one
thing international
organizations can be sure
about is the need to mark
May 25, 2018, in their
calendars. Why? Because on
that date, the new General
Data Protection Regulation will come
into effect. This will impact every
organization in the world that
collects or retains personal
identifiable data from any European
individual.
Four years in the making, this
European data protection initiative
aims to harmonize the fragmented
data privacy framework across the
European Economic Area (EEA), and
ensure that fundamental rights are
protected in todays digital economy.
Legislators believed that an increase
in legal certainty would both reduce
compliance costs and encourage
long-term consumer confidence in
the safety of the global digital
marketplace. This is why GDPRs
jurisdiction cannot be limited to the
European Union (EU) and requires
extraterritoriality to be addressed.
In our experience, many
organizations that are located
outside Europe but have a global
employee and customer base, remain
behind the curve in assessing the
risks and opportunities of GDPR.
They do not have clear visibility,
understanding, and control over the
personal data they process, nor
appropriate access to its movement
across multiple geographical
locations. This lack of engagement
could be a risky strategy. With
massive fines and requirements for
notification that will push more
breaches into the public eye, GDPR
promises to make data privacy a
potential public relations challenge.
With proposed penalties for falling
short of compliance including fines
of up to four percent of total
worldwide annual turnover these
potentially staggering numbers have
a purpose: to put privacy and data
security on the boardroom agenda by
bringing it in line with the highest
sanctions for regulatory non-
compliance such as anti-bribery
and anti-trust laws.
This article aims to highlight the
areas of GDPR that international
businesses need to consider, and the
practical steps they can take to
ensure that they are ready for the
2018 deadline.
GDPR: A FRAMEWORK FOR
A DIGITAL WORLD
In seeking to transform data
protection culture as well as practice,
GDPR has bold ambitions. It
encourages organizations to make
privacy and data protection core
business values, instead of a casual
afterthought. By placing the
principle of data protection by
design and default at its heart, GDPR
requires organizations to only
process the personal data necessary
for the specific purpose for which it
was collected, and to implement
controls to protect that data
throughout the process lifecycle. And
what counts as personal data? GDPR
defines this as any information
relating to an identified or
identifiable natural person. This may
include data such as physical
address, email address, IP addresses,
age, gender, location, health
information, search queries, items
purchased, cookies and RFID tags for
any EU citizen.
As well as trying to investigate how
the directive applies to their
businesses, many of the
organizations that we talk to are
using GDPR as an opportunity to
review and fully understand the
personal data that they retain. Many
wish to find practical ways to
INSIGHT
minimize data to reduce risk.
Organizations are also actively
revising processes for data storage
and perhaps most challengingly
how access to personal data is
controlled and restricted.
However, as we embrace the
commercial opportunities of the
digital world, should we allow GDPR
to be a constraint? Or will consumer
demand for new and innovative
global services not be matched by an
expectation that their personal
information is protected? Not only
does much of the directive build on
existing EU legislations, it also aligns
with the direction of travel of other
jurisdictions. While differences exist
between countries in their approach
and the level of legislative
development, there are signs of
upward convergence towards
important data protection principles
in particular in certain regions of the 21
world.2 This variety of global data
protection initiatives, some driven by
GDPR and some not, is one of the
reasons that organizations seek to
work with data protection advisors
with international knowledge and up
to date, relevant experience of these
frameworks.
DONT FORGET THE PR IN
GDPR
For GDPR, or indeed any compliance
to be effective, failure must carry a
reputational risk. Organizations that
think this is just an IT issue have
missed the fundamental necessity
for every department within the
business to think hard about data
privacy. Sales, Marketing, HR,
Finance: all process data and
therefore may introduce risk. The
new requirements for data breach
reporting within 72 hours will be a
challenge for many organizations
not just in how and what to report to
the regulators, but in actually having
the right systems in place to assess
CISO MAG | July 2017
Page 20-22_Layout 1 7/10/2017 12:26 PM Page 22

INSIGHT

and analyze a breach. Not

forgetting that the regulators
could come knocking at any
time to ensure that adequate
protections are in place and a
failure to satisfy them may
result in a fine, even if an
organization has not suffered
a breach.
The principle of
accountability within the
regulation requires clear lines
of responsibility and
reporting. The GDPR,
therefore, mandates the
appointment of a data
protection officer (DPO) for
certain types of businesses
either because they are
public organizations, or
because their activities
include regular and
systematic monitoring of
22 data on a large scale.
Organizations are at varying
stages of readiness for GDPR
from identifying and strong data protection system the continuous road of privacy
clarifying the exact requirements facilitates data flows by building compliance, as in the race for
and effect of GDPR to reviewing the consumer confidence in companies increasingly innovative technologies
adequacy of their existing program that care about the way they handle that strive to make human life more
or seeking to create audited evidence their customers personal data.3 In efficient or fun. Consequently,
of implemented controls and our experience, organizations across businesses cannot afford to let GDPR
compliance with GDPR (see Figure 1). the globe are at very different stages constrain their digital aspirations. If
Wherever you are on your journey, in their preparations for GDPR. But the road gets bumpy, organizations
this will require security and DPO whatever stage they are at, it is clear may want to consider qualified
executives to work together on that international businesses external partners ready to help them
assessing their GDPR readiness: wishing to operate in the global navigate the long compliance
digital market must think about the journey ahead.
WHERE ARE YOU ON YOUR impact of GDPR in order to seize its
JOURNEY TO GDPR? commercial opportunities, as well as The opinions expressed within this article are the
personal opinions of the author. The facts and
Protecting and exchanging personal mitigate risk. But as we have said, opinions appearing in the article do not reflect the
views of CISO MAG and CISO MAG does not assume
data are not mutually exclusive. A GDPR is just another milestone on any responsibility or liability for the same.

Techcrunch: General Data Protection Regulation: A Milestone Of The Digital Age https://techcrunch.com/2016/01/10/the-biggest-privacy-law-
1.

in-the-world-has-arrived/
Data protection regulations and international data flows: Implications for trade and development, UNCTAD (2016):
2.

http://unctad.org/en/PublicationsLibrary/dtlstict2016d1_en.pdf
3.
European Commission COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL. Exchanging and
Protecting Personal Data in a Globalised World: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52017DC0007&from=EN

CISO MAG | July 2017

AD_Layout 1 7/10/2017 1:36 PM Page 23
Page 24-28_Layout 1 7/10/2017 12:33 PM Page 24

COVER
STORY

SECURING
A SMARTER
WORLD
Augustin Kurian
24

CISO MAG | July 2017

Page 24-28_Layout 1 7/10/2017 12:33 PM Page 25

COVER
STORY

T
he concept of smart technology (ICT) with the Internet of
cities has triggered Things (IoT) and Machine to
evangelical fervor in a Machine (M2M) for effective
variety of management.
stakeholders from
Smart cities often pose complex
planners to engineers
challenges that require several
to futurists. The
organizational and regulatory
concept of smart cities integrates
changes focusing on the latest
multiple technological solutions
technologies and communication
electronically, creating a secure
through the Internet. While many
environment for the management
city governments are excited to turn
of a citys infrastructures. It also
their city into a smart city, they
brings local information systems,
dont always focus on smart
hospitals, schools, transportation
regulations, governance, and
systems, and law enforcement
security. Laws and regulations
under one grid and efficiently uses
safeguarding the privacy of citizens
real-time control systems and
and the security of systems are
sensors from data gathered from
sometimes considered an
people and enterprises leading to
afterthought as technology and
optimized systems. The architecture
infrastructure develop faster than
of smart cities integrates
the tools of security.
information and communication

One of the key areas that needs to 25

be addressed is the security of the
Building Internet of Things (BIoT),
the next generation of green,
intelligent buildings that are
integrated, open architected, IP-
centric, energy efficient,
connected, and operationally
efficient. A report titled Cyber
Security in Smart Commercial
Buildings 2017 to 2021, notes
that The cybersecurity market of
smart commercial buildings is
largely immature and poorly
defined. This is due to the
perennial confusion about the
cybersecurity industry.
Stakeholders in the success of a
project often do not realize until
its too late that they must
incorporate security into their
projects. Many important

THREATS AND stakeholders still lack an

understanding of the cyber
threats a smart city represents.

VULNERABILITIES Immaturity and poor definition of

smart commercial buildings also

CISO MAG | July 2017

Page 24-28_Layout 1 7/10/2017 12:33 PM Page 26
COVER
STORY
leave room for risks. Without a more
comprehensive understanding of
threats posed, they [many important
stakeholders] are struggling to find
the right strategies and strategic
partners to address the issue. Many
organizations simply do not have the
experience or training necessary to
develop a viable security policy,
protect critical assets and network
environments, or identify and
respond to todays more
sophisticated attacks the report
suggests.
Along with BIoT, another vulnerable
component of smart cities is their
ubiquitous smart terminals. Parking
terminals, public mobile device
charging booths, bicycle rental spots,
etc., become part of the landscape of
a connected city and all these smart
terminals are interlinked and
connected to the local area networks.
These smart terminals sometimes
26
maintain sensitive user data
including personal and financial
information. Since the terminals are
available around the clock and in
public places, they are highly
vulnerable to hacking. In fact, there
are numerous reported incidents of
public terminal hacking.
According to a Kaspersky Lab report
entitled Fooling Smart Cities, most
terminals do not have reliable
protection. From a technical point of
view, almost all these terminals,
DATA AND PRIVACY
Smart city initiatives often create
thousands upon thousands of words
of new proposals and collaboration
options from governments but the
word privacy is rarely mentioned. As
is so often the case with new
technology, considerations for
CISO MAG | July 2017
According to a
Kaspersky Lab report
entitled Fooling Smart
Cities, most terminals
do not have reliable
protection. From a
technical point of view,
almost all these
terminals, irrespective
of their purpose, are just
your everyday PC with
kiosk mode activated on
a touchscreen interface.
irrespective of their purpose, are just
your everyday PC with kiosk mode
activated on a touchscreen interface.
Kiosk mode blocks users from
accessing the operating system (OS),
and is supposed to ensure they
access a limited set of features meant
for a designated task.
Smart cities are invariably being built
upon existing cities. This is a problem
because, as any cyber expert will tell
you, the critical infrastructure
underpinning most modern cities
exists in a patchwork of old systems,
dozens of governmental bodies,
security seem to only be tacked onto
projects as an afterthought.
Wim Elfrink, executive vice president
of industry solutions and Chief
and privacy are going to be the
Globalization Officer of Cisco, in an
interview with The Guardian said,
Having security policies, having
conflicting or overlapping
regulations, and confusion. In the
future when connectivity and
network grows, there are chances
that critical infrastructure get
vulnerable leading to catastrophic
breaches and cyber terrorism.
According to Heath Renfrow, CISO of
Army Medical, We have to look at
our critical infrastructure across the
board. You can come across several
attacks that are happening. Saudi
Arabia and many other countries in
the Middle East have been crippled
with the attacks on their critical
infrastructure.
It may not be wrong to say that a
potential cyber 9/11 is on the
horizon. If such an event were to
occur, it could cripple an entire
country taking down the power
grid, water infrastructure,
transportation networks, and
financial networks.
Research commissioned by IP EXPO
Europe revealed that nearly half the
information technology decision
makers in the United Kingdom
identify cyber-terrorism attack as the
biggest threat in the future, followed
by attacks on grid and national
infrastructure. In fact, traditional
cyber threats, such as malware,
ransomware, and DDoS attacks, were
ranked lower than infrastructure
hacks.
privacy policies is a given. I think you
have to first give the citizens the
right to opt-in or opt-out. Then all
these policies, longer term, security
biggest imperatives. If we dont solve
this, people will opt-out more."
Page 24-28_Layout 1 7/10/2017 12:33 PM Page 27

COVER
STORY

27

STANDARDIZING
SECURED ARCHITECTURE
The concept of smart cities is still in a Lim Chee Kean, CEO of Standardizations are
prototype phase. The early adopters Ascent Solutions and pivotal, as they
like Singapore mandated a standard deputy chairman of These ensure effective
to act as a tool to ensure that the Internet of standards will management.
government, agencies, and planners Things Technical help the other projects Kean stressed
understood a common language of Committee that standards
development. In Switzerland, the (IoTTC), while
to identify key areas like will enable
International Organization of talking to roadway development, public and
Standardization (ISO) is developing a Spring.gov said, energy conservation, safety, private
tool under the ISO 37120 series that We are currently transportation, pollution agencies to
will provide support for the smart looking at checks, and wastewater manage real-
city initiative and lay the foundation developing time
management.
for the rest of the world to join. These standards that cover information to
standards will help the other projects the end-to-end deliver improved
to identify key areas like roadway architectural framework of services. According to
development, energy conservation, the IoT to enhance the ability Kean, standardization helps
safety, transportation, pollution of smart applications and devices to organization establish best practices,
checks, and wastewater work together. which enable better compliance with
management. data security legislation.

CISO MAG | July 2017

Page 24-28_Layout 1 7/10/2017 12:33 PM Page 28
COVER
STORY
28
REGULATORY HITCHES
Heavy reliance on technology creates
numerous challenges to regulators.
The information traffic is huge and
there is massive data that needs to be
managed.
A major concern is meeting the
expenses of such a colossal program.
This can only be achieved if
governments collaborate with
private parties, but private
CISO MAG | July 2017
organizations often mean vested
interests and agendas, as well as
concerns like data privacy, data
sharing, protection of sensitive
information, identity thefts, and,
even worse, vulnerability to cyber
attacks.
At present, stakeholders of smart
cities might need to fundamentally
rethink some key components. There
should be a better and novel legal
framework that puts individuals first.
The complexities of smart cities
create new and unique threats. It is
crucial that a smart city is composed
of mechanisms that not only serve as
a medium of effective communication
but also contribute to the security of
the city. Laws and regulations can
either build or break a smart city.
AD_Layout 1 7/10/2017 1:37 PM Page 29
Page 30-33_Layout 1 7/10/2017 12:38 PM Page 30

TABLE
TALK

There are no
government
regulations
guiding the
way critical
infrastructure
is directed.
30

FEW MINUTES WITH
HEATH RENFROW
Amber Pedroncelli

CISO MAG | July 2017

Page 30-33_Layout 1 7/10/2017 12:38 PM Page 31
S
hortly after the
WannaCry hack broke,
Amber Pedroncelli of
CISO MAG sat down
with Heath Renfrow,
CISO of Army Medical,
to talk about how the
hack impacted his business.
First, some background. Renfrow
joined the Navy in 1997 and started
working in tactical communications.
For around 9 years, he travelled
around the world working on
satellites, UHF, and high frequencies,
and was deployed to the Middle East
during Operations Enduring Freedom
and Iraqi Freedom. He got into
information security organically
during this time.
In that world, you start seeing, for
instance in the field when we needed
to make adjustments we would make
adjustments to equipment that was
made by manufacture, so in essence
we were hacking. To be able to get
the functionality we needed out of it.
And that originally started piquing
my interest in seeing that, using DOS
capability back in the day, and FTP
into servers that I needed to get into
to pull data from, even though the
system administrators didn't know I
was in there. After leaving the Navy
nine years later, he decided to focus
solely on technology at the Joint
Interoperability Test Command at
Fort Huachuaca in Arizona. As part of
his duties as an Action Officer, he
noticed the military GPS systems
were vulnerable to spoofing
prompting him to think, as he puts it,
Well, I think this cyber thing is
gonna be a big deal. So this is around
2002, 2003, and I ran with it.
Now, as the CISO for all of Army
Medical, he has his hands more than
full. In his own words, his job sounds
exhausting. To go over Army
Medicine just real quick, we cover the
globe. We have 48 medical hospitals
they probably
could at any time
lock down our grid
and shut it off.
around the world, and we have over
600 clinics, over 700 thousand
medical devices. We also have the
veterinarian clinics at 100 locations
across the globe. Yes, Army Medicine
has vets. We do have dogs, and horses
and other things, which are part of
our infrastructure. And we also have
all our dental locations around the
globe. So, it's a very broad and vast
environment. My coworkers that
don't work cyber that work with me
like to walk around and go, "How's
the empire today, Heath?" So ...
Does that make him an emperor?
Well, I'd like to think of myself not as
an emperor, but more as the guy who
is smart enough to hire people who
are smarter than him to work across
the globe.
When asked about the recent hack,
Renfrow answers honestly, saying
I'm fighting that battle right now,
Amber. Just to give you an update on
our current situation, we've decided
in DOD to go another level with
WannaCry. I have not slept probably
in 48 hours, my teams are working
diligently with the Med Law
community, who handles most of our
medical devises at our MTS. We're
talking to vendors right now. We're
trying to get the patch for the
Microsoft patch to fix this
TABLE
TALK
vulnerability from WannaCry, which
has exposed and taken advantage of
across our medical devices. So we're
in contact with the vendors right
now saying. Please tell us what you
can do to get this pass and give us
the patch' So, we've been burning the
lines.
Ominously, he goes on to say what
many experts in information security
have been saying, We do feel that
this is just a precursor. That is
everything in my community and
everything in the DOD community is
indicating that this is just a precursor
to something probably bigger. All
indications are that this is a nation
hack, an attack from a certain
nation... There are theories that it's
North Korea, I don't know that for
sure, but I wouldn't be surprised.
One of Renfrows passions within
information security is critical
infrastructure. 31
I've worked with the Army Core
engineers as a consultant, working
on their Skater and ICS networks
across the country. And when you
think about those, those control your
dams, they control your levees for
your waterways, for all your rivers,
like the Mississippi River for example.
And you can imagine the damage
that can be done if a hacker is able to
get into those systems and
manipulate them.
What he learned during his work on
critical infrastructure paints a dismal
picture for doomsday scenarios in
the U.S. Some [systems] don't even
have security built into their
infrastructure at all. I gave you an
example last time we talked about
the ugly gorilla hack that happened
in the Midwest of an electrical grid a
couple years ago. Chinese were the
folks who got in there. They poked
around, they took schematics, they
gathered data. Thats historically
what they do: they steal information,
CISO MAG | July 2017
Page 30-33_Layout 1 7/10/2017 12:38 PM Page 32

TABLE
TALK

they take information and they tuck

it away. And they've probably done
that across our entire grid, and they
probably could at any time lock
down our grid and shut it off.
He is optimistic about the future and
the possibility of a more secure
system, however. I do not believe it's
something we can't fix. For example,
your [US] electrical grid is made up of
over 3,000 private and public entities.
Most people don't realize that. That's
a lot of people to try and tie together.
That's a lot of people that are trying
to follow the same path. There are no
government regulations guiding the
way critical infrastructure is directed.
The President could, but it's never
happened, direct the private sector to
do certain things. When you have
this portion in the Midwest and
Southwest, and everybody doing
their own little thing thats where it
32 gets difficult.
On the subject of the complexities
inherent in medicine, Renfrow is
pragmatic and introspective. I have
gone from a cybersecurity guy who is
black and white, to someone who
has a little bit of a gray view on We're working very hard on our

things. The challenge with health
care medicine and health care
security is you're dealing with a
hospital and patient care, and that is
the number one priority of that
hospital and the people within that
hospital, and also us cybersecurity
folks. And I had to learn real quickly
that just because a medical device for
example had, what we would
consider vulnerabilities, I couldn't
just go up and make my folks patch
it. I had to learn about the FDA and
certification of medical devises and
that the vendors are in charge of the
patching should they choose to allow
it to happen, the integrity of the
system has to be maintained or a
relationship with our medical
vendors, we are pushing the NIST
framework, risk management
So, the vulnerabilities framework, and to all our packages.
We are actually scanning and trying
are there and the risk to accredit these systems across the
globe right now. And it's a challenge.
is there, but getting It's new to the vendors, it's been a
vendors to come cultural change that is slowly
starting to happen. I'm working, it's
onboard and adhere to one of the reasons I volunteer to do
conversations like this because I'm
the NIST framework trying to get the word out there to
and scan their issues anybody in the health care field that
may have challenges with medical
has been a huge devices. We have to somehow team
up, because, believe it or not DOD
challenge. medicine is a very small portion of
the pie for these medical folks. And

patient's life could be at risk.
do not get me wrong, I don't believe
It's all about measuring the risk.

CISO MAG | July 2017

Page 30-33_Layout 1 7/10/2017 12:38 PM Page 33
our vendors are purposely putting
out unsecure devices out there. I
think it's a lack of understanding,
and it's the new world we live in.
Everything has to be connected,
everything has an IP address to it.
He understands the risks and has
seen what can happen with unsecure
medical devices. He gives the
impression that he has taken
examples of others failures to heart.
Billy Rios, who proved the Laris
Fusion Palms and found that flaw.
And then you also have the
pacemaker by St. Jude that recently
has been showing the vulnerabilities
that can be there. And even one
WannaCry was able to get into the
Bare MRI machines in at least two
locations proven and confirmed by
Bare MRI this week, as of Wednesday
[May 24, 2017]. They confirmed that
the ransomware took over the MRI
device. So, the vulnerabilities are
there and the risk is there, but
getting vendors to come onboard and
adhere to the NIST framework and
scan their issues has been a huge
challenge. We've actually had
vendors tell us. Listen, you're a small
part of the pie for us and we're not
gonna even play with you.
As good CISOs do, Refrow
understands the business. Not just
the business of Army Medical, but
the businesses of his vendors. It's
about money. And in my world, it's
very hard too because we're DOD.
And business is important, even in
Army Medicine. So what I've had to
learn is, I can't say no. So, I design an
architecture, and we have designed
our architectures around minimizing
risk for a particular device. Say we
have a device that's severely at risk,
and patching, for example. There's a
lab company, and I won't name that
company, but they have some severe
issues with their suite. And because
of that, my hospital will be crippled if
I shut down that lab. Because it's got
to communicate to the EHRs, got to
communicate out to the outside
world. So, I have to find the right
stack to put it in. And what I mean
by stack is we do VLN architecture
our medical devices, and we look at
the commination past for those
devices. Do they need a B2B, or does
the vendor have to get data from it,
does it have to talk to the EHR? And
then we design an architecture
around that. And then minimize the
risk with defense-in-depth and put
all the right pieces in. I haven't said
no to anybody yet. I've asked for as
much support from the vendors as I
can get and then we have to look at it
from a prospective of how do we get
the functionality and minimize the
risk?
TABLE
TALK
What weighs on his mind even
more heavily than vulnerabilities
in medical devices? Facility control.
I am not worried as much about
medical devices as I am about my
facility's folks who handle all of your
facility control devices for our
hospitals. That ranges from the HVAC
systems to your doors going in and
out of your building, or in or out of
your ICU. So those are truly the
things that keep me up at night.
Medical devices are medical devices,
and I think that we've built an
architecture around our devices that
I can go to sleep at night and say,
"We're pretty good." My facility
control devices, which a lot of
vendors need access to and run
things for the HVAC system - those
are the things that keep me up at
night. My HVAC system goes down in
my hospital, or my doors get locked
out, and there's a ransomware that 33
pops up on one of those things, then
I'm putting patients lives at risk. Not
me but the attack is. And then how
am I solving that issue? So we're
working on those technologies are
even worse than medical devises.
Because they weren't ever built to be
enterprise, but they are enterprised.
Right or wrong, we do close
architecture and we have close
restricted networks and everything
else like that for our private network,
but there's always that exposure and
that capability may be possible if
somebody can enter your facility
control devices. And they are
running all on outdated equipment,
because their lifespan is 20 to 30
years. And patching hasn't been
done.
His advice to CISOs and aspiring
CISOs?
Theres no such thing as 100 percent
fix, and 100 percent security, you're
always going to have risks. It's just
how you manage it.
CISO MAG | July 2017
AD_Layout 1 7/10/2017 1:39 PM Page 34
AD_Layout 1 7/10/2017 1:39 PM Page 35
Page 36-38_Layout 1 7/10/2017 12:46 PM Page 36

IN THE
HOTSEAT

In a business landscape characterized by dynamic trends and events,

change is the only constant. Many organizations often bring about a
change in their leadership to achieve the desired results from a new
direction, to create and disseminate a vision, or just to breathe new
life into the corporate structure. The field of information security is no
different. In this segment, we take a look at some of the new
appointments in the information security domain.
CISO MAG staff

GENERAL MICHAEL
HAYDEN JOINS ROOT9B
ADVISORY BOARD

M
36
ichael Hayden, a
retired four-star
general, recently
joined the advisory
board of root 9B, a
U.S.-based company specializing in
real-time hunt operations as well as
assessment and analytic products.
With both leadership and technical
teams made up entirely of
cybersecurity professionals who
honed their craft securing DoD
networks and communications,
General Hayden is a perfect fit.
General Hayden, who currently
works as a principal at The Chertoff
Group, served as director for Central
Intelligence Agency (CIA) between
2006 and 2009 and the National
Security Agency (NSA) between 1999
and 2005. He drove a number of
well as the highest military industry, said General Hayden.
initiatives to tackle terrorism and
intelligence officer in the country. Today's cyber warfare needs a
cybersecurity challenges during his
unique solution which the team at
tenures with the CIA and NSA. He The team at root9B, starting with
root9B is uniquely qualified to offer. I
was also the first principal deputy Eric Hipkins, John Harbaugh and
look forward to being a part of this
director of national intelligence as Mike Morris, is unparalleled in the
team moving forward.

CISO MAG | July 2017

Page 36-38_Layout 1 7/10/2017 12:46 PM Page 37

IN THE
HOTSEAT

JD SHERRY APPOINTED AS CRO OF REMEDIANT

R
emediant, a
cybersecurity
startup based in
San Francisco, U.S.,
appointed JD
Sherry as their chief revenue
officer (CRO).
A technology veteran who
has held various leadership
roles, Sherry worked as the
general manager and vice
president of cloud security
for Optiv Security. Prior to
that, he worked as the CEO of
the cybersecurity firm
Cavirin. Under his
leadership, the company was
ranked among the top 20
hottest cybersecurity
companies in 2015,
according to Cybersecurity
Ventures. He has also served
as the global vice president
for Trend Micro where he
managed vendor relations
and guided cybersecurity
programs and other business
development activities.
We are going to capitalize
on recent success in some of
our larger install bases to
further mobilize Remediant
into the financial, healthcare,
retail, and government
verticals," said Sherry.
"Compromised privileged
accounts are a massive
problem that needs an
elegant and cost-effective
solution that can be
managed in a scalar fashion
with limited resources. Our
innovative approach stops
37
attacker lateral movement in
its tracks without impeding
productivity.

ABILITY INC. ANNOUNCES NEW DIRECTORS

A
bility Inc., an Israel-
based provider of
tactical communications
intelligence solutions,
announced three new
additions to its board of directors
Levi Ilsar, Brigadier General (Ret.) Eli
Polak, and Nimrod Schwartz.
Ilsar will serve as the chairman of
the Board of Directors and chair the
Audit and Compensation
Committees as well. He will also
serve on the Nominating Committee.
He is a veteran of more than four
decades in accounting and finance
and has served on the boards of
directors of various subsidiaries of U.
Dori Group, a real estate
development company.
Polak, a retired Brigadier General
from the Israel Defense Forces, will
head the Nominating Committee
and serve on the Audit and
Compensation Committee. He served
in the defense forces for three
decades and is currently serving in
the intelligence reserve corps.
Schwartz will serve on the Audit,
Compensation, and Nominating
Committees. An entrepreneur and
investor, Schwartz currently serves as
president and chief business officer
at NUVIAD, Ltd., a provider of real
time bidding technologies.
Anatoly Hurgin, Ability's co-founder
and chief executive officer,
commented, "We have assembled a
slate of highly-qualified finance and
business professionals with decades
of leadership experience with
growing and profitable companies to
provide strategic oversight and
governance of our business. I
welcome each of them and their
input and wisdom. I have no doubt
that their individual and collective
guidance will be of great value as we
navigate the Company towards
stability and future growth.

CISO MAG | July 2017

Page 36-38_Layout 1 7/10/2017 12:46 PM Page 38
IN THE
HOTSEAT
STEFAN MAIERHOFER JOINS FORCEPOINT FOR EUROPE OPERATIONS
I
n a move to expand its
operations in Europe,
cybersecurity firm Forcepoint
appointed Stefan Maierhofer as
area vice president of Central
and Eastern Europe. Maierhofer
oversees partner relationships,
insider threats, cloud and network
security, and is important for the
companys European business.
Stefan Maierhofer will report to
Senior Vice President of EMEA sales,
Andrew Philpott, who works from
the companys Munich office.
Maierhofer has over 30 years of
leadership experience in the
technology industry. Prior to this, he
38
JACKIE GROARK JOINS VERISTOR AS DIRECTOR, SECURITY/CISO
I
T solutions provider
Veristor Systems, Inc.,
specializing in virtual
infrastructure and cloud
services solutions for
enterprises, announced the
appointment of Jackie Groark as
Director, Security/CISO.
An expert in security operations
and strategies, Groark has served
as IT Security Director, Threat
Management & Intelligence
with Southern Company, where
she directed the ground up
development of a Security
Operations Center (SOC). She
oversaw threat monitoring,
incident response, content
development, and threat
intelligence.
The new appointment comes as
a major shift for Groark.
CISO MAG | July 2017
was the regional vice president for
Central and Eastern Europe at Palo
Alto Networks where he steered
companys regional business. He also
served as senior director of sales for
Central and Eastern Europe at F5
Networks.
Talking about his appointment,
Maierhofer said, "Forcepoint's
transformative outlook on behavior
and intent of users positions the
company to transform the
cybersecurity industry. I look
forward to helping our customers in
Europe protect the human point
where data is most valuable and
most vulnerable.
According to her LinkedIn
profile, Groark has served
Southern Company for 36 years,
starting as an Application
Developer in 1981. Other roles
held by her include Application
Service Supervisor, Client
Services Manager, IT Web
Infrastructure and Messaging
Manager, IT Infrastructure
Senior Manager, and IT Business
Excellence Senior Manager.
"I was honored to have had a role
in securing one of our nation's
most critical infrastructures,"
said Groark. "I am excited to be
able to contribute to our
customer's success in the area of
security from my experience. I
look forward to helping
customers chart a successful
course when it comes to
securing their business.
Page 39-44_Layout 1 7/10/2017 12:56 PM Page 39

IN THE
NEWS

Due to several data breaches in 2017, cybersecurity is a buzzing topic.

It is imperative that information security executives are updated about
the incidents around them. Read on for the 10 most important
cybersecurity stories of the first half of 2017.
CISO MAG staff

39

WANNACRY WREAKS HAVOC

A
global attack called agency until hacker group Shadow cryptoworm transferred and ran the
WannaCry Brokers leaked it. WannaCry ransomware package. The
unfolded on Friday, ransomware encrypted data and
The attack: The cyrptoworm
May 12, 2017, demanded ransom from victims in
targeted Windows computers using
using a flaw in Bitcoin cryptocurrency.
the EternalBlue exploit taking
Microsofts
advantage of the Windows' Server Effect: WannaCry has been dubbed
Windows
Message Block (SMB) protocol, as one of the most infamous
operating system. The flaw,
installing a backdoor implant tool ransomware attacks ever, affecting
discovered by the National Security
called Double Pulsar. Then, the more than 150 countries and 230,000
Agency, was kept under wraps by the

CISO MAG | July 2017

Page 39-44_Layout 1 7/10/2017 12:56 PM Page 40

IN THE
NEWS

computers. Chinese authorities have
put the number as high as one
million computers worldwide.
The worst hit nations were the
United Kingdom, U.S., Russia, China,
and Spain. The attack immediately
affected several national bodies and
enterprises like National Health
Service (NHS), Telefnica, Renault,
FedEx, Deutsche Bahn, among others.
Current situation: The attack
considerably slowed down after a 22-
year-old web security researcher,
Marcus Hutchins, found a kill switch.
Researchers also found ways to
recover data from several infected
machines. But, reports of new
versions emerged that lacked a kill
switch.
Among the recent victims were
Japanese automakers Nissan and
Honda. Honda had to disrupt the
production of about 1,000 vehicles
during the attack. ZDNet recently
reported that the attack was
perpetrated by North Korean hacker
group, The Lazarus Group, which was
earlier linked to the 2014 hack of
Sony Pictures.

FEDERAL PROSECUTORS LIED IN

CHELSEA MANNING CASE

I
nvestigations into the
diplomatic cables provided
by Chelsea Manning to
Wikileaks revealed that the
documents were not
40 nearly as damaging to
national security of United
States as prosecutors once claimed.
Chelsea Manning, earlier known as
Bradley Manning, was arrested in
2010 for passing classified
information to WikiLeaks in 2013,
in what has been dubbed as the
largest breach of secrets in United
States history.
A report obtained by Buzzfeed
investigative journalist Jason
Leopold through a Freedom of
Information Act request stated
that the contents were largely
insignificant and did not cause any
real harm to U.S. interests.
martial for 22 crimes, including prison sentence. Activists and media
On the most crucial Iraq war-related aiding the enemy, for 35 years. While cheered for Chelsea stating, Obama
documents, the report stated with serving her term, she gained massive rescued Manning from an uncertain
high confidence [Wikileaks and support from activists of free-speech future as a transgender woman
Mannings] disclosure of the Iraq and the advocates of the transgender incarcerated at the mens military
data set will have no direct personal community. prison. On May 17, 2017, Manning
impact on current and former U.S. was released from a Kansas military
leadership in Iraq. Earlier this year, former President
prison after serving seven years of
Barack Obama commuted Chelseas
Chelsea was sentenced by court- the 35-year sentence.

CISO MAG | July 2017

Page 39-44_Layout 1 7/10/2017 6:17 PM Page 41

IN THE
NEWS

DISNEYS FITTING REPLY TO

CYBER FRAUD

K
eeping movies and
TV series hostage
for ransom isnt a
new thing in
Hollywood.
Recently, Disney
received threats of
leaking the latest outing from the
Pirates of Caribbean franchise Dead
Men Tell No Tales unless the
company pays a ransom.
Disney immediately announced the
news, declined to pay the hackers,
and sought help from the FBI. happened and, from the beginning, stated, To our knowledge, we were
Website TorrentFreak, meanwhile, no one had ever spoken about the not hacked. We had a threat of a hack
conducted its own investigation and new Pirates film being the hostage, of a movie being stolen. We decided
suggested the hacking threat was the website TorrentFreak wrote. to take it seriously but not react in
probably a hoax. Our conclusion was the manner in which the person who
Disney Chief Executive Bob Iger, 41
that the hack almost certainly never was threatening us had required.
while talking to Yahoo Finance,

BELL CANADA GETS ATTACKED

C
anadas largest the company said in a statement.
telecommunications
This is not the first time Bell Canada
company, Bell
has made the news for privacy
Canada, was a victim
concerns. Back in April 2015, the
of a major cyber
company was flagged by the
attack in May. Nearly
Canadian Privacy Commissioner over
two million customer
its customer tracking policy. The
account details were stolen, along
Canadian Privacy Commissioner
with 1,700 names and active phone
Office instructed the company to
numbers, by an anonymous hacker.
implement an opt-in format for
Fortunately, no payment card
building customer profiles that
numbers or passwords were stolen.
facilitated targeted advertising.
The firm stressed that the attack was
Also, telecoms regulator CRTC had
not connected to the global
earlier urged Bell to stop offering
WannaCry ransomware attack. Bell
apps that enabled users to watch
Canada issued an apology note and
television from channels that were
contacted every affected customer
owned by Bell Canada without a data
directly. Bell took immediate steps with the RCMP cybercrime unit in its cap, siting concerns over Net
to secure affected systems. The investigation and has informed the Neutrality.
company has been working closely Office of the Privacy Commissioner,

CISO MAG | July 2017

Page 39-44_Layout 1 7/10/2017 12:56 PM Page 42
IN THE
NEWS
UKRAINE WITNESSES ITS BIGGEST
EVER CYBERATTACK
U
kraine and Russia
faced major
disruptions after
their
infrastructures
were attacked by
a global
ransomware touted to be similar to
WannaCry. Among the initial victims
were Russia's top oil producer
Rosneftm, several Ukrainian banks,
and the Boryspil International
Airport in Kiev, Ukraine. Following
the attack, Ukraines State Agency
was forced to turn off the automatic
systems supporting Chernobyl's
radiation monitoring system and run
them in manual mode.
42 The hack, which was called the
biggest in Ukraines history, soon
went on to affect several companies
CHINA CYBER LAW TAKES EFFECT
T
o counteract cyber
warfare and data
breaches, China
unveiled new cyber
law that has been
publicized as a
milestone in data
privacy regulations. According to the
new law, companies are required to
store data like information about
Chinese citizens and/or data
concerning national interests on
domestic servers. The law mandates
every firm that exports bulk data to
undergo an annual security
assessment.
Critics argue that the law, which took
effect on June 1, 2017, would make it
CISO MAG | July 2017
and businesses in Europe and the
Asia-Pacific region, including India's
largest container port in Mumbai.
Danish shipping giant Maersk, the
world's biggest advertising agency
WPP, and Cadbury owner Mondelez
International were among the large
companies that reported global IT
outages following the attack. Eternal Blue, which experts believe
was stolen from U.S. National
Bogdan Botezatu, a senior e-threat
Security Agency (NSA).
analyst at Bitdefender, named the
attack Golden Eye. He reported that Matthieu Suiche, a security
within five hours of the attack, researcher, while talking to New York
malware operators received Times said, The attack is an
payments totaling almost $7,000. improved and more lethal version of
Reports suggested that it was a WannaCry.
coordinated attack targeted against Reports have also emerged that
Russia and Ukraine. But, it remains ransomware is very similar to a virus
unclear on how it began. Like known as Petya (Little Peter, in
WannaCry, the new ransomware Russian), which was discovered last
virus also included code known as year.
difficult to do business in China by
increasing costs for foreign firms
while giving domestic companies an
unfair advantage. Many even call
the law vague and stringent for
foreign companies who seek
expansion in the country.
According to the new law, any
business or organization
transferring over one terabyte of
data or that has information
affecting more than 500,000 users,
will be assessed on its security
measures. It would also assess
on marine environments would also
information on its potential to harm
be scrutinized. Destination countries
the national interest of the country.
and the likelihood of oversees
Under the new regulations, sensitive tampering would also be factored in
geographic data such as information to assessments.
Page 39-44_Layout 1 7/10/2017 12:56 PM Page 43
HACKER PULLS DOWN ONE-FIFTH OF
DARK WEB
I
n February, an anonymous
hacker took down one-fifth
of the dark web. Citizens
across the world cheered for
the hacktivist when he/she
removed thousands of child
pornography images from
the dark web. The hacker who
claimed responsibility called it a
vigilante move that was attained by
targeting Freedom Hosting II, a dark
web hosting service.
In all, over 10,000 hidden services
were shut down and anyone who
tried to access the site saw a message
from the Anonymous. The data
dump included the email details of
nearly 381,000 users. Troy Hunt, who
runs the popular service Have I Been
Pwned? while talking to
FRENCH ELECTIONS HIT BY HACKING
A
fter the infamous
hacks of the 2016
US election, it has
been discovered
that France has
also suffered a
similar fate when
tens of thousands of emails and
election related documents of the
now French President Emmanuel
Macron were released online ahead
of its elections in May of this year.
Macrons En Marche! Team called it
an attempt to destabilize the
elections and stated the team would
find the culprit behind the act.
Meanwhile, Frances presidential
electoral authority warned the
IN THE
NEWS
thenextweb.com said,
Given that Freedom
Hosting II was popular
with those involved in
the creation and
distribution of child
pornography, many of
those emails are likely
burner addresses.
While talking to
Motherboard, the
hacker said, This is in
fact my first hack ever. I
just had the right idea. paid for hosting and the admin knew
Initially I didn't want to take down of those sites. Thats when I decided
FH2, just look through it. The hacker to take it down instead, the hacker
found several child pornographic said. The hacker claimed to have
sites that use more than Freedom found 10 child pornography sites 43
Hosting II's stated allowance of with approximately 30 gigabytes of
256MB per site. This suggests they files.
media, especially the online media,
not to publish information from the
leaked documents.
NSA director Michael Rogers
suggested the involvement of Russia
in the hacks. "If you take a look at
the French election ... we had
become aware of Russian activity.
We had talked to our French
counterparts prior to the public
announcements of the events
publicly attributed this past
weekend and gave them a heads-
up: Look, were watching the
Russians, were seeing them
penetrate some of your
infrastructure," he said in a report
published in WIRED.
CISO MAG | July 2017
Page 39-44_Layout 1 7/10/2017 12:56 PM Page 44
IN THE
NEWS
SOUTH CHINA SEA ROW AND HACKS
T
he South China Sea
dispute has been a hot
topic for many years
among several states
such as Brunei, the
People's Republic of
China (PRC), the
Republic of China (ROC), Malaysia,
Indonesia, the Philippines, and
Vietnam. The dispute has now
moved to cyberspace. Recently, the
Singaporean militarys site was
breached in an attempt to allegedly
find classified military information.
The Singapore Ministry of Defense
stated that it is highly probable that
the attack was state sponsored. Also,
cybersecurity company FireEye
recently stated that nation-backed
Vietnamese hackers are most likely
44
targeting Philippines state agencies to
gather maritime related intelligence.
TRUMP CYBERSECURITY ORDER
RECEIVES MIXED REVIEWS
U
S president
Donald Trump
recently signed
an executive
order to boost the
government's
cybersecurity. He
called the issue a subject of top
priority. The order aims to protect
critical infrastructure and
government agencies from all
vectors of cyber threats. The order
intends to examine agencies moving
towards cloud. It also encourages the
private sector to develop strategies to
thwart cyberattacks.
The bill mandates federal agencies to
CISO MAG | July 2017
According to the
report from FireEye,
Vietnamese hackers
APT32 (OceanLotus
Group) attacked a
Philippine
technology
infrastructure firm
and a consumer
product corporation,
along with numerous
other companies that
were doing business
in Vietnam last year.
Bryce Boland, the CTO
of FireEye, stated that
the hackers have
been targeting Philippine the organizations within the
government bodies as well. "This is government operate in order to be
presumably in order to gain access to better prepared in case of potentially
information about military military conflict," said Boland during
preparation and understanding how a press briefing.
threats. It has also instructed
agencies to prepare a report within
90 days on the methods of
implementation.
The order has received mixed
reviews. A few called it, a good first
step while others called it "too
wrapped up in privacy." According to
Ed Amoroso, the former chief
information security officer of AT&T,
How many plans are being drafted
by government agencies right now
under the current Cyber Executive
Order? Hundreds. And who is going
use a framework developed by the to read them? This is not the way
National Institute of Standards and Trumps executive order should be,
Technology (NIST) to manage cyber he said.
AD_Layout 1 7/10/2017 1:40 PM Page 45
Page 46-48_Layout 1 7/10/2017 1:00 PM Page 46

EVENT
FOCUS

HACKER HALTED
TAKES A DEEP DIVE INTO
THE ART OF CYBERWAR
Hacker Halted, EC-Councils largest annual conference, will focus its
2017 edition on the teachings of Sun Tzu as applied to cyberwarfare.
The Hacker Halted speaker committee is combed through the dizzying
stack of submissions to form the agenda for this years conference with
a special focus on presentations that take the Chinese strategists
lessons to heart and apply them to the cyberwars being fought every
day across the world.
46 Amber Pedroncelli

CISO MAG | July 2017

Page 46-48_Layout 1 7/10/2017 1:00 PM Page 47
I
n a change to Hacker Halteds
long standing tracks, this years
committee has chosen three
brand new tracks that focus on
aspects of Tzus teaching.
TRACK 1: ALL CYBER WAR
IS BASED ON DECEPTION
2,500 years ago Sun Tzu wrote 13
chapters on military strategy. Fast
forward to today and we are still
learning from those chapters and
applying them in our newfound
digital age. This track focuses on
those very strategies from breaking
resistance, knowing ourselves, and,
of course, deception. This track will
focus on using deception as an aid in
defense, the great results can be
achieved with small forces, and how
that might apply to the potential
shortfalls we are facing in this
industry.
TRACK 2: PHILOSOPHY OF
CYBER WAR
In an age where war is waged over
cables and microchips instead of
battlefields, one challenge is defining
what war is and when war should be
declared. Boundaries are being
eroded as the globalization of
technology continues its march
across our physical landscape. We are
facing a future where soon our very
existence can be digitized and moved
between any number of diverse
systems. What is war these days? Is it
simply the reality that anyone with
sufficient knowledge and a decent
Internet connection can simply
declare war against anyone else be
they human, government, or nation
state? War now transcends
boundaries - what DO we do?
TRACK 3: TECH BEHIND
CYBERWAR
Leave your 0days, leave your latest
hacks behind, and bring your
playbook for the blue team. We have
EVENT
FOCUS
more hacks and more working and CCO of Pragmatick IO, Inc.;
trojans and attack vectors than we Michael J. Masucci, a Hollywood
know what to do with. What do we producer; and Mark Rasch, a
actually do with them? That is the CyberAttorneyformerly of the DoJ.
question this track will answer. This
After the debate and opening
track is not about how you attack it is
keynote by Chris Roberts, the track
ALL about how you defend. When a
talks begin. Attendees will have a
hack happens, how, where, and why
choice between talks from Dr.
do you react? How do you even know
Catherine Ullman, Senior
that you have been hacked? As
Information Security Analyst,
security experts, we have failed our
University at Buffalo;James
very charges. We continue to allow
Tubberville; Executive Director of
them to be attacked and we fail at
MINIS LLC; Dr. Fred Cohen, CEO,
defense.
Management Analytics; Laura
Hacker Halteds speaker committee is SamsoPericon, Executive Vice
made up of an all-star team of President
security veterans. Winn Schwartau,
Centurion Technologies Consulting
Founder of The Security Awareness
LLC; and Georgia Weidman, Founder
Company and security guy since
and CTO at Shevirah and Bulb
1983,;Chris Roberts, Chief Security
Security LLC among many others.
Architect at Acalvio Technologies;
AamirLakhani, Dr. Chaos and Hacker Halted has a long history of
bringing incredible information
Global Security Strategist and
security speakers together since 2008
Researcher at Fortinet; Joe Gray, 47
in the US. Every year, the conference
Enterprise Security Consultant at
Sword and Shield; and Adrian
has grown in prestige and audience,
drawing bigger names and
Crenshaw, Senior Security
incorporating more events alongside
Consultant at TrustedSec, LLCbring
the conference.
their vast networks and expertise to
the task of filling the agenda with Running alongside Hacker Halted is
the top security minds in the the Global CISO Forum. The CISO
industry. event is invitation only and open to
director-level information security
The agenda for Hacker Halted has
practitioners at the director level or
now been posted and highlights
above. This years agenda features
presentations from the best in the
several top names including Brian
ethical hacking industry. The talks
Phillips, the CISO of Macys; Kathy
chosen resonate with the theme of
Fithen, the Chief Privacy Officer of
the conference as well as current
The Coca-Cola Company, and Richard
events in infosec and beyond. The
Seiersen, CISO and VP of Trust of
opening keynote presentation is
Twilio, Inc. An exciting addition to
actually a panel debate moderated
the event will be Michael
by industry veteran and committee
Santacorangelos keynote and panel
member Winn Schwartau. The focus
discussion centered around executive
of the debate touches on issues that
leadership. Santacorangelo,
hit close to home for the public at
something of a CISO whisperer, will
large as well as the security industry.
present on the trends he sees for
The debate, entitled Hackers, The
infosec leaders, the challenges he
Media, Truth, Trust, and Alternative
sees CISOs struggling with, and the
Facts, will feature perspectives from
solutions that have shown success in
Greg Carpenter, infosec professional
his practice. After his keynote
CISO MAG | July 2017
Page 46-48_Layout 1 7/10/2017 1:00 PM Page 48
EVENT
FOCUS
address, he will lead a panel
discussion with practicing
information security executives in a
conversation that will address their
actual careers and bring practical
information to the conversation.
Santacorangelo will also be available
for 15-minute mentoring sessions for
any Forum attendee who would like
his insight.
Prior to the kickoff of Hacker Halted
and Global CISO Forum, EC-Council
will once again host its black-tie
awards gala to celebrate executives
in four categories. The CISO Awards
were created to identify and
celebrate the amazing work being
done around the world by executives
dedicated to improving the
information security of their
respective companies, governments,
and organizations. The award
48 finalists and winners are selected
and voted on by two committees
integral to the success of EC-Councils
CISO program the CCISO Advisory
Board and the CISO Events Board.
Finalists and winners are selected via
an anonymous judging process
without input by EC-Council staff.
Finalists for the 2017 awards so far
include . The finalist announcements
are all leading up to the
announcement of the winners at the
CISO Awards Gala in Atlanta, GA on
the night of October 8th, 2017. The
award categories are:
CISO OF THE YEAR
This award, available only to
Information Security Executives (VP,
CISO, etc.), recognizes an individuals
outstanding work in information
security. EC-Council will be honoring
one executive who has contributed
to the information security industry,
shown tremendous professional
growth and achievement, and has
promoted strong, innovative security
practices.
CISO MAG | July 2017
INNOVATIVE SECURITY
PROJECT OF THE YEAR
This award is intended to recognize
the most innovative security project
of the year. The winner of the award
will be a project that is:
Cost effective
Impactful to the business or
security operations
Creative in its use or creation of
new models
Groundbreaking
Measurable
MOST IMPROVED
INFORMATION SECURITY
PROGRAM OF THE YEAR
This award is intended to recognize
improvements in information
security programs that have made
use of innovative strategies to bring
value quickly to a security program
and the overall
business/organizations goals. The
winning program will show:
A baseline of the security program
before improvements including
measurable indicators
The methods used to improve the
program
Challenges encountered and the
solutions implemented to overcome
them A thorough analysis of the
program after improvements were
implemented including measurable
indicators
C|CISO OF THE YEAR
This award, available only to EC-
Council Certified CISOs (C|CISOs),
recognizes an individuals
outstanding work in information
security. EC-Council will be honoring
one C|CISO who has contributed to
the information security industry,
shown tremendous professional
growth and achievement, and has
promoted strong, innovative security
practices.
Current finalists include Manish
Tiwari, CISO of Microsoft India;
PatricVersteeg, CISO of Novamedia;
and Favour Femi-Oyewole, CISO of
the Nigerian Stock Exchange.
Winners will be announced on stage
at the Gala and be awarded with
various prize packages. Finalists will
receive a package worth $700 which
includes hotel room covered for three
nights, one guest ticket for the
Awards Gala dinner, a Global CISO
Forum ticket, website feature, and an
appearance on the Global CISO
Forum Podcast.
The Top 3 Finalists in each
categorywill receive a package worth
over $1,200 which includes
everything in the finalist package
plus three tickets to the Awards Gala
dinner, a press release announcing
finalist status, and one webinar for
the finalist company to tell their
security story.
Winners in each category will be
given packages valued at over
$10,000 which include everything
from the first two packages, EC-
Council customized training package
for staff, and apress
releaseannouncing the winners.
Hacker Halted 2017 and the events
that surround it will be a valuable
event for the information security
community at large. By bringing
together committees of experts to
build each aspect of the conference,
the quality of speakers, award
winners, and panelists continues to
increase each year, keeping pace
with the trends in information
security to arm practitioners with
the skills they need to keep the
worlds data safe.
Page 49-53_Layout 1 7/10/2017 1:08 PM Page 49

KICK
STARTERS

With cybersecurity gaining more importance than ever, cybersecurity

startups have become a main attraction for venture capitalists. The
cybersecurity market has seen tremendous growth despite the
slowdown in the global economy with many companies inking record-
breaking funding deals with venture capital firms. The influx of money
has driven innovation and solutions to important security challenges.
In this section, we look at some emerging companies making waves in
the information security domain.
CISO MAG staff

49

SENTINELONE

F
ounded in 2013,
Sentinelone specializes
in innovative endpoint
protection. The
company was formed
by cybersecurity and
defense experts from
IBM, Intel, Check Point Software
Technologies, McAfee, Palo Alto
Networks, and the Israel Defense
Forces.
Sentinelone provides companies
with the option to replace their aging
antivirus solutions with its endpoint
protection platform that can prevent,
detect, and respond to malware and
insider-based attacks without
signatures or cloud access.
The company claims that its
approach is based on the thorough
inspection of all system processes
and innovative machine learning
leading to the quick isolation of
malicious behaviors and the
protection of devices against
advanced targeted threats in real
time.
The age of the antivirus is over. The
threat landscape is rapidly changing
and the current security paradigms
don't do a good enough job of
protecting at the endpoints.
Network-side solutions simply have
too limited visibility into threats,
says Sentinel Labs co-founder and
CEO Tomer Weingarten in an
interview with Pando.
Claiming to have witnessed
tremendous growth in the last 12
months, the startup recently signed a
deal with one of the worlds largest IT
technology distributors, Avnet Inc. It
is now planning for global expansion
and has grown its executive
committee.

CISO MAG | July 2017

Page 49-53_Layout 1 7/10/2017 1:08 PM Page 50
KICK
STARTERS
MYKI
M
YKI, a Beirut-
based
cybersecurity
startup,
claims to
have
developed
the first advanced password and
online identity manager in the
region. It provides smartphone users
with secured access to online
services and cuts down on the need
to manually type user login
credentials every time users access
services. It also offers secured
password management solutions.
The firm, initially known as Ki,
offered security tokens by the same
name. According to the founders,
50 prototyping and editing tokens in
Middle East and North Africa (MENA)
region was difficult for logistic
SEQURETEK
S
equretek is an
enterprise security
solutions provider
founded by Anand
Naik, former
managing director at
Symantec South
Asia, and Pankit Desai, former
president at Rolta India. The
company claims that its product
and service portfolio reduces
security complexity in
organizations. The key areas the
company operates in include
financial, IT/ITES, retail, pharma,
and logistics.
Sequreteks product Avatar focuses
on endpoint control, application
access, infrastructure access, and
CISO MAG | July 2017
reasons, and market
analysis also showed
that people were not
interested in carrying an
electronic device with
them. Due to this, the
company migrated to a
software-as-service
(SaaS) format and
launched MYKI.
MYKI is a revolutionary
solution that eliminates
the need for usernames
and passwords. What
started as an idea,
flourished into a
working model that
could change the way people use stage, but to touch people by
technology in their lives and will simplifying their everyday lives and
soon be available for the masses. Our showing them the possibilities, said
goal was not just to take the project Priscilla Elora Sharuk, co-founder of
from the concept to the execution MYKI.
user services. Avatar engages in
solving issues pertaining to
governing all technology privileges
that are given to employees from
the time they join an organization
to their exit. The second product,
Kawach, secures endpoints
(laptops, desktops, mobile) from
external, internal, and device-
related threats.
At the enterprise level, Sequretek
offers integrated & managed
cybersecurity that ensures
organizational security 24x7 across
all threat vectors and derives
actionable intelligence. Sequretek
provides organizations with a
companywide risk score that helps
them understand their risk profile.
Page 49-53_Layout 1 7/10/2017 1:08 PM Page 51

KICK
STARTERS

APVERA

A
Singaporean and signature-based
cybersecurity methods will be
startup founded in outdated in the near
2014, Apvera future and stresses
claims to specialize installing real-time
in machine endpoint profiling
learning to predict and anomaly
and prevent threats and cyberattacks detection for a 360-
by deploying behavior analytics. By degree view of
monitoring both internal and security concerns.
external threats, Apvera helps
Investing in and
companies prioritize their resources.
developing
The company employs adaptive
Singapores digital
techniques to monitor network and
capabilities will only
user behavior. Due to this, it can
help transform the
quickly analyze changes in user and
threat landscape to
network behavior that are not in line malicious activities which could
further safeguard corporate assets,
with the usual patterns, defending otherwise leave them open to
improving both social and corporate
against all possible internal and potentially damaging attacks, Eric
responsibility. Regardless of size,
external breaches. Meyer, CEO of cybersecurity firm,
companies need to protect 51
Apvera argues that threat protection themselves from cyber threats or Apvera, told Tech Wire Asia.

EVERLEDGER

F
ounded by Australian
entrepreneur Leanne
Kemp in 2015,
Everledger is a global
digital ledger that
reduces cyber fraud. The
startup claims that it
specializes in tracking and protecting
diamonds using blockchain the
technology behind bitcoins.
Everledger provides a history of each
items authenticity to every
stakeholder, from traders, consumers,
insurance companies, and financiers.
Since its inception, Everledger has
achieved a significant recognition in
the international diamond industry
and has digitally certified over
980,000 diamonds.
Apart from this, it has won
numerous global startup
competitions like Open Talent
Competition: BBVA Europe 2015,
Innovation in FinTech: Meffy Award
2015; Best in Show: FinTech Finals
2016; Best Blockchain Company:
European Financial
Technology Awards
2016.
"Blockchain is
immutable; it cannot
be changed, so records
are permanently
stored," said Kemp
while talking to WIRED.
"Information on the
blockchain is
cryptographically
proven by a federated
consensus, instead of being written
by just one person."
The company is mulling over
extending its technology to other
items of value like luxury goods and
art work.

CISO MAG | July 2017

Page 49-53_Layout 1 7/10/2017 1:08 PM Page 52

KICK
STARTERS

DIGITAL SHADOWS

H
eadquartered in
San Francisco
and London,
digital risk
monitoring
company Digital
Shadows gives
organizations an attackers view of
threats and vulnerabilities. It
monitors over 100 million data
points across all web vectors like
visible, deep, and dark web, helping
organization, detect, protect, and
mitigate threats at the earliest point
possible.
Digital Shadows finished 2016 with
more than 880 percent revenue
growth over 2015 and has expanded organizations detect mobile Shadows. But we know that a large
its operations in the U.S and Europe. application threats. percentage of mobile applications
It was also recognized as One of will fail basic security tests and this
52 Worlds Most Innovative Mobile is no longer a niche or
digital risk presents enterprises
Cybersecurity Technologies by SINET isolated part of an organizations
everywhere with brand protection
in 2016. digital footprint. New devices and
and data risk threats. In an
applications are the status quo and
Earlier this year, Digital Shadows increasingly mobile-first world, our
organizations must be able to
expanded visibility into mobile customers now have the ability to
identify the digital risks associated
driven risks with the enhancement precisely account for evolving threats
with them, said Alastair Paterson,
to its digital risk management, jeopardizing irreplaceable
CEO and co-founder of Digital
SearchLight, which helps reputations and information.

CYBEREASON

F
ounded by a team of protection and response, incident on the end points that are looking at
former Israeli responses services, and has built a all sorts of differential data. So we
intelligence agency next-generation antivirus helping have applications profiled, we have
members in 2012, organizations prevent most types of users profiled, we look at the
Cybereason is an data heists. programs [a particular user would
information security use related to other users with the
The Cybereason platform, powered
startup based in same job role] and were constantly
by a custom-built in-memory graph,
Cambridge, Massachusetts with building profiles and looking for rare
works autonomously, monitoring
offices in London, Tel Aviv, and Tokyo. events of clusters of users, or users
enterprise security and detecting
It assists forensic analysts terminate across the whole enterprise, or even
behavioral patterns across all
Malops (a set of discrete hacker cross enterprise to see how various
endpoints while cutting the need to
operations with intermediate companies use different
employ a security analyst.
objectives). The company claims that applications, Cybereason VP Mark
it specializes in endpoint detection, We have collectors, agents that sit Taber told TechCrunch.

CISO MAG | July 2017

Page 49-53_Layout 1 7/10/2017 1:08 PM Page 53

KICK
STARTERS

ZEROFOX

F
ounded in 2013 by a
Baltimorean team of
information technology
veterans, ZeroFOX
specializes in social
media security and
digital risk monitoring.
The companys cloud-based
Software-as-a-Service (SaaS)
platform parses millions of data
points across several social media
platforms on a daily basis protecting
businesses and government agencies
globally from all kinds of cyber- to Watch, Tech Council of Marylands following, support customers and
attacks. In fact, ZeroFox was one of Technology Company of the Year, and grow revenue. In response, malicious
the first companies that brought the the Security Tech Trailblazer of the actors are increasingly targeting
under-the-radar attack surface of Year. businesses by impersonating brands
social media into the limelight. and targeting customers to siphon
Social media and digital platforms
cash flow and tarnish brand
The firm has several accolades to its have become critical business
reputation, said James C. Foster, CEO
credit including SINET16 Champion, applications that all brands rely on to 53
of ZeroFOX.
Dark Readings Top Security Startups engage with their customers, build a

SILICON:SAFE

A
bootstrapped
startup founded in
Cambridge in 2013
by two former
Citrix engineers,
Silicon:Safe offers
hardware-based
solutions to protect usernames,
passwords, biometrics, and other
sensitive or critical data. The
company argues that if deployed, its
password protection product would
have averted some of the high-profile
incidents and hacks like the hacks
that hit Sony Playstation, LinkedIn,
eBay, etc. Silicon:Safe was awarded
runner-up in the storage trailblazers
award category for the 2014 Tech
Trailblazers Awards.
Silicon:Safe has thrown an open
challenge to hackers asking them to
successfully hack the system for a
handsome reward. According to
reports, there have been more than
1.25 million unsuccessful hacking
attempts.
We think it is impossible to steal
usernames and passwords from our
system, said Roger Gross, CEO and
Founder of Silicon Safe, because of
our unique hardware solution We
expect most experienced cyber
experts and hackers to realize that
they are unable to gain access to the
best shot. There are no 'back doors or
data when they read the description
administrator privileges to exploit,
of our solution, but for those who
and no code to infect; crack it if you
think they can do it, we are offering
can!
them the opportunity to give it their

CISO MAG | July 2017

Page 54-56_Layout 1 7/10/2017 1:11 PM Page 54

KNOWLEDGE
HUB

54

DEMYSTIFYING DARK WEB:

AN ORGANIZATIONAL POINT OF VIEW
By Souti Dutta, Lead Threat Analyst - SOC Services, Paladion

CISO MAG | July 2017

Page 54-56_Layout 1 7/10/2017 1:11 PM Page 55
T
he Internet has become
an essential fixture in
peoples life. Apart from
posting captured
moments on Instagram,
tweeting lifes
experiences on Twitter,
and browsing funny cat videos on
YouTube, the Internet can allow you to
travel beyond its surface to the deep,
dark corners of the virtual world. Such
corners are generally termed as the
Dark Web.
In recent years, there has been an
upsurge in interest and curiosity for the
Dark Web. Frequent headlines on the
existence of hidden marketplaces that
serve as hotbeds of drugs, arms
trafficking, fraud, hacking, etc., or the
supposed freedom (anonymity) on the
Dark Web have lured the common man
into these dark virtual alleys.
The Dark Web has coexisted within the
Deep Web (a segment of WWW that is
opted out from being indexed and
unavailable through regular search
engines like Google, Yahoo, etc.) for
years. It is a digital space, particularly,
for carrying out malicious activities
with the cloak of anonymity.
IS THE DARK WEB A
GROWING CONCERN FOR
ENTERPRISES?
A study has estimated that only 0.03%
of sites on the internet fall under the
Dark Web category, which are 30,000 or
less sites. However, its growing
popularity, ease of access and mass
adoption have created serious concerns
among security practitioners.
Anyone possessing a free piece of
software like Tor can gain access to the
Dark Web anonymously. In corporate
environments, where thousands of
employees access various IT resources,
even a single exposure to the Dark Web
can bring down defences. Below is a
summarized list of risks accessing the
Dark Web using tools like TOR can bring:
KNOWLEDGE
HUB
Exposes an organization to malware
and botnet attacks: Individuals/groups
that operate Exit Nodes or TOR relays
on a TOR network can abuse it by
turning it to a malware distribution
point without the knowledge of the
employee using it. Thus, leaving an
organization network susceptible to
malware attack via received responses
(wrapped with malware) from such
rogue nodes. The Dark Web maintains
CnC communication with the
organization, which creates further risk.
Exposes an organization to DDoS
attacks: If employees turn their hosts
into nodes, which participate in the
global Dark Web (e.g. Tor nodes)
network, it can elevate the risk of
bandwidth exhaustion or DDoS-like
situation. The corporate network
relaying large volume of Dark Web
traffic is the primary reason for either
high bandwidth consumption or
bandwidth saturation.
55
Allows employees to bypass security
controls: Traffic to the Dark Web is
always wrapped in encryption, so
monitoring of network traffic between
the originator and the destination host
is hard to crack. This means employees
can freely view illegal sites, purchase
contraband goods using corporate
resources with ease, etc. In addition, it
allows employees to circumvent several
security controls without any extra
effort.
Becoming the data exfiltration point:
The Exit Nodes are susceptible to
sniffing attacks, so if non-encrypted
data is out there, it can be captured and
utilised in a malicious way. Internal
hosts participating in Dark Web
activities can get infected with malware
that exfiltrates data, leaving the
organization susceptible to data theft.
Employees turning rogue insiders: A
recent study noted a new trend among
cybercriminals where they spend
considerable resources to recruit
insiders. The primary goal behind such
CISO MAG | July 2017
Page 54-56_Layout 1 7/10/2017 1:11 PM Page 56
KNOWLEDGE
HUB
recruitment is to steal data, plant
malware, enhance domain
knowledge, etc.
Loss of reputation: Organizations
can be held responsible for any illegal
activities carried out on the Dark
Web especially hosting of Dark Web
network nodes, which are involved in
transporting illegal data or in
activities such as hacking, DDoS
attacks, spying, etc.
Blacklisting: An organization found
hosting Dark Web nodes can risk its
IP being added to an Internet
blacklist, which can lead to
unnecessary restrictions from
various service providers.
LIMITING ACCESS TO DARK
WEB FROM INSIDE THE
BUSINESS NETWORK
Preventing access to the Dark Web
and detecting instances can be a real
56
challenge. There are currently no
readymade solutions to monitor and
stop such attempts. So, the solution
lays in a combination of security best
practices, technology, user awareness
and a refined security policy on
usage of the Dark and Deep Web and
associated applications. Weve listed
a few recommendations below:
CISO MAG | July 2017
Stop internal users from
downloading, installing/running
Tor: Tor (and other similar
applications such as I2P) is the key to
gain access to the Dark Web. Users
should not have access to the Tor
website from where they can acquire
the installer or a portable version of
the application. So, by deploying
application whitelisting and limiting
access rights, it is possible to prevent
running such applications. Controls
on USB ports should also be
implemented to prevent running any
portable instance of such
applications.
Maintaining a known Dark
Web/Tor node list: The primary
reason behind maintaining a list of
known Tor nodes is to limit any
outbound traffic to the Dark Web. An
explicit outbound connection deny to
all such IPs (Exit Nodes) will
minimise the live traffic destined to
the Dark Web. It is also necessary to
device an internal list of hosts who
were involved in generating traffic to
those IPs / nodes. It is also necessary
to keep the node IP list relevant and
updated. One can utilise available
feeds to capture such IPs.
on a corporate network, it can make
Outbound traffic containing self-
signed certificate data: Dark Web is
a known consumer of self-signed
certificates (certificates not created
by recognized certificate
authorities). Such certificates allow
data encryption between clients,
nodes or servers. Hence, blocking
such outbound SSL traffic will not
only meet the best practice
requirements, it will actively limit
exposure to the Dark Web.
Clear Policy on Dark Web/Tor usage:
Along with implementing security
controls, it is important to ensure the
corporate security policy talks about
accessing the Dark Web and usage of
proxy software (Tor). The updated
security policy should clearly state
the imposed limitations and
prohibitions on the access of the
Dark Web using proxy software over
the corporate network and resources.
User Awareness: Organizations
should conduct sessions where
employees and partners that use IT
services should understand the risks
related to the Dark Web.
CONCLUSION
The curiosity around the Dark Web is
obvious but if this discovery is made
an organization vulnerable to cyber
attacks. Employees unwittingly use
the Tor network as a proxy to
circumvent blocked sites, etc. It is
important for employees to be
educated about the risks such proxy
software can bring to the
organization to prevent risks the
Dark Web can bring.
Organizations should also monitor all
virtual activities by employees
regardless of seniority or technical
expertise within the corporate
environment to ensure optimal
cybersecurity.
The opinions expressed within this article are the
personal opinions of the author. The facts and
opinions appearing in the article do not reflect the
views of CISO MAG and CISO MAG does not assume
any responsibility or liability for the same.
Page 57-59_Layout 1 7/10/2017 1:14 PM Page 57
TRUST THE CLOUD AND
CARRY YOUR UMBRELLA
Aseem Ahmed, Sr. Product Manager - Cloud Security, Akamai Technologies
A
s more and more organizations surveyed. The same set
companies begin of organizations predicted that in the
to comprehend the next 15 months, around 80% of all
benefits of cloud information technology (IT) budgets
computing, its will be dedicated towards cloud
adoption is solutions. As the cloud foothold
probably highest expands globally, so does the attack
than ever before. According to the surface. With more organizations
research done by Intel security, in showing trust in cloud technology,
2016, hybrid cloud adoption has security still features as a top
increased by three times within the challenge that they would face.
VIEWPOINT
57
Many studies and research
conducted across the years focus on
understanding the true nature of
threats that target cloud
infrastructure. If you pay close
attention to these, you will realize
that cloud is hardly the target, it is
what lies within. That is your data
and applications. This is not a new
problem, this has and will always
exist.
CISO MAG | July 2017
Page 57-59_Layout 1 7/10/2017 1:14 PM Page 58
VIEWPOINT
As more and more sensitive data
moves to the cloud every day, we
seldom realize that with
disappearing boundaries appear new
privacy and data protection laws.
Interfaces and APIs, shared
technology and multi-tenancy
nature, identity management, lack of
adequate encryption, etc., are some
issues that have featured long in the
list. Compliance is an ongoing
concern for top executives, security
practices of cloud service providers
(CSPs) are often reviewed on papers
but rarely audited by experts. Market
prominence and word of mouth
publicity play an influencing role in
choosing the cloud vendor and most
often flexibility and cost are given
preference over security. Technical
measures alone arent subnormal.
Legal contracts need to evolve for
cloud nuances and risks as well. One
of the factors that has been
58 constantly undermined but more
CISO MAG | July 2017
prevalent now is the lack of skilled
security resources. Many
organizations delay moving to cloud
due to lack of appropriately skilled
cybersecurity workforce. In-house IT
teams arent equipped with the right
tools and knowledge to fight newer
battles on newer grounds.
Conventional security practices dont
hold good as your perimeter now
extends beyond your sight.
While cloud expands the attack
surface and overall risks,
organizations must truly understand
that as business owners, they are still
responsible to ensure that risks are
addressed. It is essential not only to
embrace cloud for business but also
for security, it must become an
integral part of the organizational
security culture. Unfortunately,
many organizations either dont
cover cloud as part of their security
policy or have merely listed it. Like
any other aspect of security, cloud
security continues to limp without
the right support of necessary
governance practices. The prudent
man rule applies to us more than
ever. We are responsible and
accountable for the security of our
businesses, whether in cloud or
within company premises.
Good news is that there is a silver
lining behind the cloud. As the trust
and mindset matures, security
practices and awareness have grown
as well. Many organizations
worldwide actively carry out and
participate in raising the cloud
security awareness as well as
standardizing the best practices to
adopt for securing the cloud
computing environment. Security
executives should pay close attention
to the following:
Security policy and governance
framework: establish strategy and
practices to support cloud security.
Page 57-59_Layout 1 7/10/2017 1:14 PM Page 59
Empower security practitioners to be
decision makers for cloud resources.
Audit the security controls: Dont
rely on the proof of cloud vendors
security measures alone, have
experts test and audit it. 3rdparty
assessment is usually more
beneficial. Audit them regularly.
Invest in building security skills:
train right and hire right. Many
organizations now find managed
security services as a valuable option
to bridge the security skill gap by
letting experts handle their security.
Redefine technical measures:
implement more robust technical
measures such as storing encryption
keys separately in the hardware.
Companies like Akamai have
pioneered this by building and
securing separate key management
infrastructure.
Focus on sensitive data: it is your
priceless possession. Classify it and
clearly define roles and ccountability
for safeguarding sensitive
information stored in the cloud.
Insure your legal rights: Have the
right legal and contractual clauses
especially designed for cloud
infrastructure. Ensure that it covers
clauses regarding data security and
privacy compliance.
Invest in the right tools: beat the
cloud with the cloud and not a sickle.
A number of organizations find cloud
security solutions to be effective,
scalable and beneficial to their
VIEWPOINT
59
businesses. Costs should not be a
challenge in the long run.
Redefine traditional risk
assessment: generic or traditional
risk assessment frameworks have
proven to be partially effective for
cloud deployments. Risk assessment
should consider cloud as an integral
asset.
According to Gartner, 2017 will see a
growth of 18% in the worldwide
public cloud services. The expansion
is inevitable and as security
professionals, we all need to be ready
for a rainy day. Do your due diligence,
trust the cloud and carry your umbrella.
The opinions expressed within this article are the
personal opinions of the author. The facts and
opinions appearing in the article do not reflect the
views of CISO MAG and CISO MAG does not assume
any responsibility or liability for the same.
CISO MAG | July 2017
Page 60-61_Layout 1 7/10/2017 1:15 PM Page 60

PROFILE

THE SHIFTING
ENVIRONMENT OF
NETWORK SECURITY
Bhaskar Agastya, Country Manager, Ixia

60

T
he world of threats speculation to reality. Users and were linked to U.S. presidential
expanded dramatically organizations got direct experience election results. That was a lot to take
in 2016and not just with ransomware as attacks targeted in one year.
because of an increase nearly every mobile and desktop
Todays threat landscape demands
in the amount of operating system (OS)and the
multiple proactive security systems
malware. ransomware moved from the hands
throughout the network for a strong,
Organizations are of elite programmers into the hands
layered security posture. These
dealing with larger attack surfaces. of novice hackers. State-sponsored
proactive security devices, like
Exploits of Internet of Things (IoT) cyberattacks had a larger impact
firewalls, next-gen firewalls, web-
devices have transitioned from than ever, as Russian cyberattacks

CISO MAG | July 2017

Page 60-61_Layout 1 7/10/2017 1:15 PM Page 61
application firewalls and intrusion
prevention systems (IPSs) all require
inline deployment in the network.
But the introduction of multiple
inline security systems raises
concerns and questions about
network uptime, performance,
operational ownership, security
flexibility, and overall costs.
Ransomware has become the
hackers favorite tool to make money
in the cybercrime economy. The
latest global ransomware attack
appears to be a complex attack based
on several ransomware families as
well as multiple vectors. It has
affected companies worldwide
including utilities and oil companies,
shipping companies and airlines, and
financial institutions. All this points
to the clear fact that organizations
need to protect themselves from
future breaches by implementing
preventive measures.
NEED FOR INLINE
SECURITY FRAMEWORK
Ixias Inline Security Framework is an
industry-proven solution for
deployment of multiple inline
security tools that improves overall
network availability, performance,
and operational functions, while
providing greater security flexibility
and resilience, and lowering overall
costs and personnel workloads. The
Ixia Inline Security Framework
utilizes bypass switch and packet
broker technology to create a high
availability zone in the network,
where inline security tools can be
deployed for optimal availability,
security, and flexibility. Data enters
from the red or untrusted network
and is sent via the bypass switch up
to the network packet broker (NPB),
where it aggregates traffic, load
balances across security tools, and
provides application-level filtering to
improve tool utilization. The data is
then sent back through the bypass
switch and sent on to the network.
Ixias decade of history in inline
security also provides several key
capabilities to this deployment
which are not available elsewhere in
the industry. Ixias inline solution
separates the key inline component,
the bypass, for maximum reliability
and availability. The NPBs provide
application and geography-based
traffic filtering to greatly increase
control over traffic, and offer the
most powerful user interface
available. Ixia's solution also offers
very low latency versus other NPBs
on the market, ensuring maximum
performance.
Ixia security test solutions provide
customers with advanced insight
into the performance, security and
stabilityresiliencyof
applications, devices, networks and
data centers under high-stress
conditions. Security testing has
become a critical need for
enterprises, government agencies,
service providers and equipment
manufacturers world-wide.
Customers are increasingly reliant on
Ixia's security test solutions,
including BreakingPoint, IxLoad and
Application and Threat Intelligence,
to enable faster and more
sophisticated network and security
devices, and virtualized
infrastructures.
IXIAS SECURITY
SOLUTIONS HELP YOU STAY
ONE STEP AHEAD OF
ATTACKS
BreakingPoint: Simulates real-
world legitimate traffic, distributed
denial of service (DDoS), exploits,
malware, and fuzzing, BreakingPoint
validates an organizations security
infrastructure, reduces the risk of
network degradation by almost 80%,
and increases attack readiness by
nearly 70%
PROFILE
BreakingPoint Virtual Edition:
Provides real-world application and
threat simulation for complete
performance and security testing,
and its elastic deployment model
allows you to achieve security
resilience without sacrificing
scalability or flexibility. Customers
can quickly deploy and scale
BreakingPoint VE across geo-diverse,
enterprise-wide networks, thanks to
its elastic and shareable virtualized
test capabilities. By taking advantage
of its flexible test functionality, you
can quickly acquire the tools you
need, as well as scale up and scale
down in accordance with a projects
unique demands. And the
subscription sales model reduces IT
operational expenses while
maximizing existing security
investments for significant bottom-
line benefits.
ThreatARMOR: cuts straight to the
61
core of the problem by automatically
blocking much of the network
communication that malware needs
to download instructions or transmit
sensitive data. It prevents network
probes, phishing clicks, and all traffic
to and from untrusted countries. This
reduces the risk from attacks such as
zero-day ransomware mutations
along with up to 80% of the
malicious connections that threaten
the network and generate floods of
security alerts. Ixias ATI Research
Center provides an always-on stream
of geolocation and threat intelligence
for ThreatARMORindividually
validating every single blocked IP
address, every single day. Detailed
Rap Sheets provide clear, on-screen
proof of malicious activity for all
blocked sites to mitigate the risk of
false positives.
This sponsored article is provided by Ixia. The opinions
expressed within this article are the personal opinions
of the author. The facts and opinions appearing in the
article do not reflect the views of CISO MAG and CISO
MAG does not assume any responsibility or liability for
the same.
CISO MAG | July 2017
Page 62-65_Layout 1 7/10/2017 1:18 PM Page 62

COLLABORATIONS

62

FO S EC
IN ERSHIPS
PARTN
CISO MAG | July 2017
Page 62-65_Layout 1 7/10/2017 1:18 PM Page 63

COLLABORATIONS

In an age where cyber threats are becoming

vast and frequent and the business landscape
is evolving, it is imperative for the CISOs to
take a strategic leadership role and adopt a
collaborative and inclusive approach. An
acquisition or a collaboration can serve several
purposes for organizations, right from
propelling them into new markets to
strengthening their critical IT infrastructure to
sharing information for turning knowledge
into action. These partnerships can be the
most difficult, challenging, or chaotic events,
but can represent the ultimate change for a
business. In this segment, we take a look at
some notable collaborations and acquisitions
in the cybersecurity domain.
63
CISO MAG staff
partnerships include IBM X-Force
CISCO AND IBM JOIN and Cisco Talos security which will
FORCES TO FIGHT share intelligence and data to
CYBERCRIME prevent attacks.
Cisco and IBM recently collaborated Cisco will build new applications for
to fight global cyber threats. The two IBMs QRadar to help experts analyze
information technology giants and effectively respond to threats
signed an agreement to integrate when working with Cisco's Next-
Cisco security solutions with IBM's Generation Firewall (NGFW),
QRadar to protect organizations from Next-Generation Intrusion Protection
various threat vectors. Under the System (NGIPS), Advanced Malware
agreement, IBM Global Services will Protection (AMP), and Threat Grid.
support Cisco products in their
Managed Security Service Provider IBM's Resilient Incident Response
(MSSP) offerings. Other key Platform (IRP) will integrate with

CISO MAG | July 2017

Page 62-65_Layout 1 7/10/2017 1:18 PM Page 64
COLLABORATIONS
64
Ciscos Threat Grid to help security
staff manage incidents more quickly.
To address the growing hybrid cloud
market, IBM's Managed Security
Services team will extend its support
to Cisco security platforms in public
cloud services.
"By combining Cisco's
comprehensive security portfolio
with IBM Security's operations and
response platform, Cisco and IBM
bring best-of-breed products and
solutions across the network,
endpoint and cloud, paired with
advanced analytics and orchestration
capabilities," said David Ulevitch, SVP
and general manager, Cisco Security.
This isnt the first time the two
technology giants are working
CISO MAG | July 2017
together. During the infamous
WannaCry ransomware attack that
crippled nations across the world,
Cisco and IBM shared intelligence to
fight the threat. Their teams
monitored the spread of the malware
and constantly exchanged insights
with one another.
MICROSOFT ACQUIRES
CYBERSECURITY FIRM
HEXADITE
Microsoft announced the acquisition
of Hexadite, a cybersecurity
company that provides artificial
intelligence (AI)-enabled automated
responses to cyberattacks. The
financials details of the acquisition
were not revealed by the firms, but
Calcalist, a financial news website
from Israel, had reported in May that
the deal would be cracked for $100
million.
The acquisition aims to help
Windows 10 users detect, respond to,
and prevent network attacks.
Windows 10 currently offers
Windows Defender Advanced Threat
Protection (WDATP), a program that
has proven useful in detecting
several advanced network threats,
zero-day attacks, ransomware, etc.
According to Microsoft, adding AI
will make response and remediation
faster and more effective. At present,
WDATP protects almost 2 million
devices. With Hexadite, Microsoft
will include endpoint security
automated remediation to WDATP.
Page 62-65_Layout 1 7/10/2017 1:18 PM Page 65
Our vision is to deliver a new
generation of security capabilities
that helps our customers protect,
detect and respond to the constantly
evolving and ever-changing
cyberthreat landscape, said Terry
Myerson, executive vice president,
Windows and Devices Group,
Microsoft in a statement. Hexadites
technology and talent will augment
our existing capabilities and enable
our ability to add new tools and
services to Microsofts robust
enterprise security offerings.
The acquisition of Hexadite is a part
of Microsofts initiative to invest
more than $1 billion annually in
cybersecurity research and
development. Earlier this January,
Microsoft also invested in another
cybersecurity firm, Team8.
Post the acquisition, Hexadite team
will be fully absorbed into
Microsoft's Windows and Devices
group.
PALO ALTO NETWORKS
ACQUIRES LIGHTCYBER
FOR $105 MILLION
Cybersecurity giant Palo Alto
Networks completed the acquisition
of LightCyber, an Israel-based
cybersecurity firm. Founded in 2011
by Giora Engel and Michael
Mumcuoglu, LightCyber specializes
in behavioral analytics using
machine learning and behavioral
anomalies. LightCyber is currently
headed by Chief Executive Officer
Gonen Fink. The deal has been inked
for $105 million in cash, which is
approximately three times its capital
investment.
Palo Alto Networks will offer
LightCyber products and support
existing customer implementations.
"The LightCyber team's vision to
bring automation and machine
learning to bear in addressing the
very difficult task of identifying
COLLABORATIONS
BICS ENTERS AGREEMENT TO ACQUIRE TELESIGN
CORPORATION
BICS, a provider of wholesale connectivity and interoperability services,
entered into an agreement to acquire TeleSign Corporation, a company
specializing in authentication and mobile identity services to the
Internet and digital service providers, for $230 million. With the
acquisition, TeleSign cloud communications platform would now be
backed with BICSs global reach, creating the worlds first end-to-end
CPaaS provider. The tie-up aims to utilize TeleSigns advanced cloud
communication platform with BICSs world-wide influence to enter
newer sectors.
TeleSign, a Marina del Rey startup, has been pivotal to the security and
integrity of several top smartphone apps. For TeleSign, utilizing BICSs
infrastructure would cut down the expenses of leasing bandwidth and
help increase profits.
Weve been in the drivers seat of our industrys transformation, and
weve built a solid business of over 1.5 billion euro ($1.6 billion) in yearly
turnover, with the ambition of bridging the telecom world with the new
and innovative communications providers worldwide, said Daniel
Kurgan, chief executive officer of BICS.
Companies are moving from legacy to cloud communication. The new
partnership leverages this trend. IDC forecasts that the worldwide 65
communications platform-as-a-service market will grow from $867
million in 2016 to $8.2 billion by 2021.
The acquisition currently is subject to regulatory approval and could
close in the third quarter of the year, reported Los Angeles Times. TeleSign
would operate as a subsidiary of BICS, and will retain Aled Mies as CEO.
BICS CEO Daniel Kurgan will be appointed as chairman to TeleSign.
otherwise undetected and often very attack. Technology from LightCyber
sophisticated attacks inside the using its machine learning
network is well-aligned with our techniques cuts down the dwell time
platform approach," said Mark significantly and minimizes damage.
McLaughlin, chairman and CEO of
LightCyber also claims that its
Palo Alto Networks.
Behavioral Attack Detection
According to McLaughlin, technology platform LightCyber Magna produces
from LightCyber will complement fewer false alerts. Over 62% of all
automated threat prevention Magna alerts and 99% of confirmed
capabilities of Palo Alto. For example, alerts are investigated, remediated,
an organization takes approximately or deemed useful by Magna
five months to discover malicious customers. Investors in LightCyber
activity from a network attack. This include Battery Ventures, Access
period of five months is called the Industries, Amplify Partners and
dwell time. During the dwell time, Israel-based investors Glilot Capital
the attacker can initiate data Partners, Shlomo Kramer and Vertex
exfiltration and other modes of Ventures.
CISO MAG | July 2017
Page 66-69_Layout 1 7/10/2017 1:20 PM Page 66

TECH
TALK

BUG BOUNTY PROGRAMS:

CLOSING SECURITY GAPS
Tari Schreider, Chief Cybersecurity Strategist and Author, Prescriptive Risk
Solutions, LLC

66

WHAT IS A BUG BOUNTY
PROGRAM?
Bug or hacker bounty programs go by
several names including
vulnerability reward program, flaw
disclosure, and hacker
crowdsourcing. They all have one
thing in common: they pay people
for finding bugs in code. With few companies like Google and Facebook
exceptions, programs pay cash for that pay out millions of dollars
results. Once a bounty hunter annually.
submits proof of a vulnerability and
Today, several thousand companies
the company sponsoring the
offer a bounty program. HackerOne
program validates, cash is paid.
maintains what they claim is the
Programs come in all sizes from
most exhaustive list of known bug
small software companies who rely
bounty programs.
on voluntarily bug finding to large

CISO MAG | July 2017

Page 66-69_Layout 1 7/10/2017 1:20 PM Page 67
How a program essentially works is
you invite people to attempt to
penetrate your network, web sites,
etc. If they find a vulnerability, they
document the flaw, you verify it, and
then issue a payment based on the
conditions of your bounty. Easy
peasy.
BUG BOUNTY PROGRAM
BUDGETING
Budgeting for a bounty program is a
risk-based proposition. Ask yourself,
what would it cost to fix a bug in
production versus development or
testing? Next, determine if that has
ever happened, I am sure it has. Keep
in mind that you only pay for
successes in a bounty program. How
much does it cost to keep a team of in-
house security testers employed to
find minimal bugs?
You can design a bounty program
around any budget, even free, well
almost you still have to pay for
using the platform. Bounty hunters
want to make a name for themselves,
so some will work with programs
that only provide kudos for finding
bugs. This goes toward building their
reputation and goal of becoming a
much sought after super bug hunter.
Consider structuring your program
around the priority rating of the bugs
found. You may feel you want your
bounty dollars to go only toward
finding critical bugs and not those
that pose an acceptable risk.
Marketing can also kick in some
money for the program, as it is a way
to promote your company as doing
the right thing.
PENETRATION TESTING VS.
BUG BOUNTY PROGRAMS
Bounty programs have introduced an
interesting argument, should I
reduce my security testing staff and
essentially outsource my security
testing through a bug bounty
The following are several bounty programs that standout from the crowd:
COMPANY
Apple
Google
Hack The Pentagon
Kraken
Netgear
PayPal
Uber
United Airlines
program? In my experience, my
clients that have compared results of
in-house testing versus a bounty
program has stated that bounty
programs were far more successful in
finding critical code flaws fast. The
two main reasons are one, internal
security testers do not think like
hackers and two, the shear metric
tons of hacker brainpower who are
financially motivated to find bugs.
Penetration testing has become too
bureaucratic with lawyers, contracts,
rules of engagement, etc. I have seen
many penetration testing projects
take weeks or months to negotiate all
while a bug bounty program at
similar companies finding dozens of
bugs in that same period of time.
Now I am not advocating eliminating
penetration testing from the mix, but
rather that you consider it as an
TECH
TALK
BOUNTY
$200,000 for highest category of
bug secure boot firmware bugs.
Donations to charities in
conjunction with bounties.
Pilot bug bounty program of
$150,000 for hackers in return for
the vulnerabilities they find in its
public facing websites.
Payments made in bitcoins.
Submit a chain of bugs to receive a
bonus.
Payments made to a PayPal
account.
Hacker loyalty reward program and
bug treasure map. 67
50,000 to 1 Million award miles.
essential strategy to fast-path
security testing of public facing
critical code.
UNIQUE BUG BOUNTY
PROGRAMS
Bounties paid by companies can
average from $200 to $200,000;
however, an average reported by
bugcrowd was $505.79. With a
growing number of bounty hunters
and bounty platforms, companies are
looking for ways to gain notice by the
industrys top bug researchers.
United Airlines, for example, offers
frequent flyer miles.
I suggest you work with your
organizations marketing department
to come up with a unique and
noticeable bounty payment to attract
the best bug researchers. You
CISO MAG | July 2017
Page 66-69_Layout 1 7/10/2017 1:20 PM Page 68
TECH
TALK
certainly do not want to do what
Yahoo did in 2013 and offer t-shirts
to bug hunters for finding critical
bugs in their code. This touched off
such a hail of negative press against
Yahoo the press referred to the
incident as t-shirt gate. So a word to
the wise, really think through what
message your bounty program sends.
BUG BOUNTY &
DISCLOSURE PROGRAMS
A great way to model your bug
bounty program is to view what
other organizations have
implemented. Thanks to bugcrowd
and HackerOne, you can view nearly
2,000 with just a click of your mouse.
Bugcrowd maintains an updated list
on bounty and disclosure programs
with direct links to respective
program sites.
Think of this as security
crowdsourcing of thousands of white
68
CISO MAG | July 2017
hat hackers and professional security
vulnerability researchers.
Bugcrowd can manage your program
through a number of programs
ranging from public (collective of
thousands of hackers and
researchers), private (invite only
researchers) or on-demand (project-
based invited researchers).
Bugcrowd provides a template for
branding your bounty page, handles
bounty payment, performs bug
reporting triage and validation as
well as provides comprehensive
reporting on your program.
Bounty programs are effective and
indispensable to your SDLC or
DevOps operations. HackerOne and
Detectify are two other bounty
platforms you may wish to compare
to bugcrowd. Bounty Factory is a
European-based platform that
focuses on EU rules and regulations
related code flaws.
If you are just looking for a list of bug
bounty programs, checkout
bugsheet. This site offers a curated
list of over 370 programs offering a
collective 150 bounties.
EVOLUTION OF BUG
BOUNTY PROGRAMS
Bounty programs have been around
for many years. Jarrett Ridlinghafer
while working at Netscape in 1995
established the first bounty program.
He also coined the phrase Bugs
Bounty.
Programs have progressed from
casual in-house programs to
sophisticated managed programs
attracting only the highest profile
bug hunters and everything in
between. Bounty hunting has
become an industry with providers
ranging from hunters who just triage
code with vulnerability scanners
looking for low hanging fruit
Page 66-69_Layout 1 7/10/2017 1:20 PM Page 69
counting on the fact the sponsoring
company never bothered to scan
their own code to professional bug
researchers.
Bounty hunting has also created a
new breed of super hunter who
devote their full-time energies to
finding bugs as a profession.
BUG BOUNTY PROGRAM
TIPS
1. Brand your program marketing
matters and bounty programs attract
public attention.
2. Make your program payout
unique you want to attract the
most experienced bug hunters.
3. Use a commercial bounty
program management platform
do not reinvent the wheel.
4. Clearly document the types of
bugs you are willing to pay
ambiguous hunter instructions leads
to wasted time and money.
5. Scan your code before releasing it
for bounty you do not want to pay
for bugs you should have caught.
6. Structure a loyalty program to
attract the best bug hunters build
a rapport with your star hunters.
TECH
TALK
WHAT TYPE OF BUGS ARE FOUND?
Bugcrowd reports the following types of critical bugs found by
their researchers:
Mobile_ Net 0.30%
SQLI 1.30%
Clickjack 2.90%
CSRF 8.20%
XSS 19.90%
Other 67.70%
7. Integrate the bug bounty in little to no value, many researchers
69
DevOps focus on finding bugs in do not read the bounty guidelines.
development.
10. Expect your network probing
8. Carefully document dupe flaws once the bounty is announced,
the fastest way to tank your bounty researchers will start probing your
program is to issue the kirk response network. You know bug bounty
dupe without proof. programs have arrived when the
federal government announces their
9. Expect poor submissions over
intentions to start one.
90% of bounty programs will have
CONCLUSION
Bug bounty programs are a great
strategy to include in your arsenal of
secure coding and testing processes.
They provide a vulnerability
perspective that in-house programs
typically cannot. These programs are
ideal for due diligence and fast-
pathing testing on highly visible and
critical web sites. Invitation only
bounties have approximately twice
the success rate as public bounties
due primarily to the quality of the
bug researchers attracted, but they
do cost more. Overall, this is
something to consider in your mix of
cybersecurity program practices.
CISO MAG | July 2017
AD_Layout 1 7/10/2017 1:41 PM Page 70
AD_Layout 1 7/10/2017 1:41 PM Page 71
AD_Layout 1 7/10/2017 1:43 PM Page 72