LEO

A Cyber Security Concern

The 8 Principles of Cyber Security Laws

The 8 Principles of Cyber Security Laws 1000 563 SethJaffe
By Seth Jaffe. The United States has yet to promulgate a comprehensive federal cyber security law aimed at improving the cyber hygiene of companies serving its citizens. But a collation of industry-specific laws (both federal and state), proposed bills, guidance documents, and cyber strategies yields a fair indication of where our nation is headed. This [...]read more

Top 10 Universal Best Practices for Critical Infrastructure Security & Resilience

Top 10 Universal Best Practices for Critical Infrastructure Security & Resilience 1280 853 IsiahJones
By Isiah Jones, Director & Principal – ICS Cyber Security Engineering While attending the EnergySec Electric Distribution Security Forum March 22 – 23, 2018 in Washington, DC, the topic of best practices came up between trade organizations and state utility commission speakers and attendees. I informed them that in security “best practices” are already defined [...]read more

Radical Idea in ICS Cybersecurity?

Radical Idea in ICS Cybersecurity? 971 538 RobBeason
Idaho National Laboratory recently published an article, Internet Insecurity, by Andy Bochman. Many of the ideas in this article are shared by other thought leaders in the industry. The main theme from the article is that due to the inherent flawed design of the Internet, there will be a resulting lack of assurance for industrial control [...]read more

Lowering Risk By Putting Response Before Incident

Lowering Risk By Putting Response Before Incident 1920 830 JustinSilbert
Justin Silbert As individuals, some people are good at improvisation, that is, dealing with things as they come and creating the best outcome for it. But, organizations in the midst of an incident are notoriously terrible at improvising. There is no better example than Equifax, whose initial response was fraught with missteps. First, it downplayed [...]read more

When It Comes to Cyber Security, Lack of Vendor Oversight Can Lead to Legal Trouble

When It Comes to Cyber Security, Lack of Vendor Oversight Can Lead to Legal Trouble 1920 720 SethJaffe
By Seth Jaffe. Third-party cyber security programs got a shot in the arm this week in the form of two legal actions. The first, well summarized by Sue Ross over at Norton Rose Fulbright, is a proposed consent agreement by the Federal Trade Commission against mobile phone manufacturer BLU Products, Inc., alleging that BLU’s failure [...]read more

Dev Overflow – Part 9

Dev Overflow – Part 9 MikhailSudakov
By Mikhail Sudakov, Cyber Security Architect and Analyst, LEO Cyber Security. Back to Part 8 Example of XSS that would redirect a victim browsing a particular blog page to the given malicious site. Yep, it is still here, and here to stay! What are we talking about today? A7 - Cross-Site Scripting (XSS) "XSS flaws [...]read more

Securing Automobile Control Systems Part 1

Securing Automobile Control Systems Part 1 2051 1440 KevinLackey
By Kevin Lackey, OT, ICS & SCADA Cyber Security Principal Driving (pun intended) towards a Minimum Security Standard for automotive control systems is more important than ever, as these systems are quickly becoming fully independent from human control. Within 20 years of the advent of computer regulated electronic fuel injection, first mass produced and available to [...]read more

NIST Releases Cybersecurity Framework 1.1

NIST Releases Cybersecurity Framework 1.1 2160 1440 HeathRenfrow
By Heath C Renfrow, CISSP, C|CISO, C|EH, C|NDA The National Institute of Standards and Technology (NIST) announced on April 16, 2018 the release of the Cyber Security Framework (CSF) 1.1, intended to improve Critical Infrastructure Cybersecurity. The focus of this framework when first developed in 2014 was geared towards industries vital to economic and national security, [...]read more

FDA and the Medical Device Security Action Plan

FDA and the Medical Device Security Action Plan 2160 1440 HeathRenfrow
By Heath C Renfrow, CISSP, C|CISO, C|EH, C|NDA Since 2013, cyber professionals have been warning about the cyber risk and exposure healthcare organizations face from cyber-attacks on medical devices and software. As a result of these concerns the Health and Human Services (HHS) extended security and privacy rules to business associates, and the Federal Drug Administration [...]read more

To Pay or Not to Pay (Ransomware)

To Pay or Not to Pay (Ransomware) 2160 1440 HeathRenfrow
By Heath C Renfrow, CISSP, C|CISO, C|EH, C|NDA The recent ransomware attack on the City of Atlanta cost the city an estimated $2.7 million, and raises the question, do you pay or do you not pay? Ransomware has exploded over the last few years and has been especially hard on the healthcare industry - who can [...]read more

Looking Through the Different Filters of the CISO and the Board

Looking Through the Different Filters of the CISO and the Board 450 270 JustinSilbert
By Justin Silbert. Perhaps the most misunderstood challenge of the modern day CISO continues to be communication with the Board of Directors.  The task seems simple, but there is major disconnect between the CISO and the Board. According to the Cyentia Institute’s 2017 Cyber Balance Sheet report, “even basic questions on the value of cybersecurity [...]read more

Learning Through Gaming, Red vs. Blue

Learning Through Gaming, Red vs. Blue 1179 666 RobBeason
By: Rob Beason, CISSP, GSLC, Security+ At the Houston Security Conference, 2018; fellow LEOs Clint Bodungen and Kevin Lackey put on a red versus blue team training for attendees. The course was a one-day workshop intended to educate ICS practitioners, network defenders and the security conscious on the topics of basic attack methodologies and the [...]read more