As a security architect within IBM Security Services, I often get asked the question, “What exactly is a Zero Trust architecture?” Well, there is no single or unique answer to that question for two reasons. First, Zero Trust is not an architectural model but rather a set of guiding principles that should be applied to existing and new designs. W

The transition to a remote workforce has happened so quickly that many security teams have not had an opportunity to apply desired controls. Organizations are dealing with remote access and execution privileges that were unplanned even a couple of months ago. The use of personal devices and home workspaces has increased potential risks. Typical controls such

While organizations around the world are rightly focused on the COVID-19 pandemic, the work of cybersecurity must continue. In fact, attackers often increase their efforts to breach networks and systems during times of trouble, counting on the chaos as a useful distraction. In such times, the best cybersecurity practices should actually refocus on the most b

If you work in the healthcare industry, you may have heard about a family of vulnerabilities called “SweynTooth.” Researchers from Singapore first discovered the vulnerabilities in 2019. After waiting 90 days to announce them, which is part of the responsible disclosure process, they published a technical paper. If you are not familiar with the S

The constantly changing threat landscape makes a robust security program a moving target. But defenders aren’t standing still — from advanced artificial intelligence (AI) to real-time threat detection and adaptive risk protection, cybersecurity services are evolving to offer IT teams the breadth of knowledge and depth of functionality they need to rall

Penetration testing is no longer an extraordinary security engagement. Due to regulatory mandates, internal policies, business executive requests and the overall desire to avoid becoming the next breach victim, testing is now commonplace among many organizations. The kind of testing, however, can still be a question. Do you need ad hoc testing, that as-neede

Operational technology (OT) encompasses many aspects of our world, including industrial control systems (ICS) that are used to control core operational processes. ICS technologies often control essential services such as water and power supply and are also used to monitor these services to prevent hazardous conditions. Manipulation of these systems and proce

As organizations adapt and respond to the impact of COVID-19, significant new challenges are on the rise as a majority of the workforce has shifted to remote work arrangements. Employee-owned devices and home networks that were not formerly protected by enterprise security controls have rapidly expanded many organizations’ attack surfaces. At the same

Organizations around the world are adapting to respond to the impact of the novel coronavirus (COVID-19). Companies may experience increased stress and challenges across their security programs arising from increased remote user demand, site availability impacts, stringent travel restrictions and requests for social distancing. Security organizations may als

I recently had the opportunity to speak at a security conference where I presented the operating models that an organization can embrace when managing cyberthreats and the guiding principles associated with them. It was a great chance to share some of my experiences with the greater community and foster intellectual curiosity around an increasingly important

Consumer identities are at the heart of brand engagements today. Digital interactions are a routine part of our lives and touchpoints for consumers have reached astounding heights. Nearly 60 percent of the world is digitally connected and more than half of the world’s population will be using social media by the middle of 2020, according to We Are Soci

According to the recent X-Force Threat Intelligence Index 2020, more than 8.5 billion records were exposed due to breaches in 2019, of which 86 percent were due to misconfigured assets. These issues affected only half of the records breached in 2018, and as the 2017 report stated, 70 percent of the 2.9 billion records lost that year were due to misconfigurat

Internet-enabled devices are emerging more and more in business and personal environments. Often going unnoticed, they simply appear within network infrastructures, using wired or wireless connections and expanding the enterprise attack surface. In fact, enterprises nowadays likely have more internet of things (IoT) devices on their networks than traditiona

Healthcare cybersecurity attacks are on the rise. As Protenus notes, industry data breaches increased by 48 percent between 2018 and 2019, with more than 41 million patient records compromised. Meanwhile, according to the 2019 HIMSS Cybersecurity Survey, 82 percent of hospitals said they suffered a “significant security incident” in the past 12 m

The medical internet of things (IoT) is no longer a futuristic concept. It is here today, and it includes devices you may have never considered a part of the patient care ecosystem, such as elevators, beds, exit signs and clocks. Between those operational technologies and the devices the U.S. Food and Drug Administration (FDA) has already deemed critical, th