Are Employees Inadvertently Jeopardizing Cybersecurity Efforts?

Story by Lisa Morgan, CeM, J.D.

Key Points:

• One notable threat is the fact that consumer-grade products and services weren’t designed for enterprise-grade security and compliance, which can cause data leakage, unauthorized access and compliance breaches.?
• “To address this threat, employees need training on IT policies, emphasizing the risks of shadow IT and the importance of consulting IT before adopting new tools. Enterprises can deploy cloud access security brokers (CASBs) to monitor and control unauthorized cloud services, ensuring adherence to security policies,” says Omer?? Cohen , CISO at customer authentication and identity management platform Descope , in an email interview.
• The threat landscape is evolving, and attack surfaces are expanding. Still, one of organizations’ weakest links is often well-meaning employees making inadvertent mistakes.?Employees may also be lax about software updates, which can translate to unpatched vulnerabilities.?
• “Even with robust protections in place, a cybersecurity incident can make the organization appear to have a poor cybersecurity program. This harms value to investors and reputation to customers,” says Jordan Rae Kelly, a senior managing director and head of cybersecurity for the Americas at business consulting and global advisory firm FTI Consulting in an email interview.?
• In the slideshow above, we reveal more ways employees undermine cybersecurity and what to do about them.?

Welcome to InformationWeek 's Big Picture!

You already know that every day at InformationWeek brings expert insights and advice to help today’s IT leaders identify the best strategies and tools to drive their organizations forward.

That means original reporting from our team of journalists and unique commentary you won’t see anywhere else! But in case you missed them, here are some of our other must-read favorites from this week:

OpenAI 's Secret Breach

Story by Carrie Pallardy

Key Points:

• As a private?company, OpenAI does not have the same breach reporting obligations as public companies. Critics have had a field day with the company’s use of “open” in its name when it now takes a closed-source approach. The decision to not disclose a breach is another strike against transparency.??
• The hacker stole information from an employee discussion forum on OpenAI’s technology, but the company judged that individual was likely not linked to any specific foreign government, according to The Times report.
• While OpenAI deemed the security incident not to be a threat to national security, alarm bells went off for some of its employees. Leopold Aschenbrenner , a former researcher with the company, voiced concerns that OpenAI’s security is not sufficient to prevent the theft of secrets by state actors, according to The Times.
• With the very real threat of AI IP theft and the potential that breaches are happening unbeknownst to users and the public, what does that mean for the industry going forward??

Will Snowflake 's Response be Enough?

Story by Shane Snider

Key Points:

• Snowflake-linked breaches have struck hundreds of companies and millions of consumers -- now the company has added multifactor authentication enforcement tools for clients to better protect their data.
• Snowflake’s organization itself was not compromised, according to the investigation findings. However, an attacker accessed demo accounts through the credentials of a former Snowflake employee. The demo accounts were not protected by MFA.
• MFA will be enabled by default for all new accounts, Snowflake CISO Brad Jones told customers in a letter. The change comes after a Mandiant (part of Google Cloud) and CrowdStrike investigation found 165 companies may have been breached through unprotected Snowflake accounts .
• “Snowflake is committed to continuing its investment into technology and tools that help our customers increase their security,” Snowflake’s Anoosh Saboori said in a joint blog post with Jones. “Soon, Snowflake will require MFA for all human users in newly created Snowflake accounts."

How Should CISOs Positively Impact Resilience?

Story by James W. Doggett

Key Points:

• Even with ample resources and technologies, hacks will happen. To bridge the divide and gain greater buy-in from the executive suite, CISOs need to focus on a critical aspect of security that is sometimes overlooked: resilience.?
• Being able to quickly identify, respond and recover from an attack -- in a word, resilience -- is just as important as protection. But historically, CISOs spend most of their time focused on prevention and detection.
• Ransomware, the current scourge of organizations across many sectors, affected 75% of organizations in 2023, according to Veeam’s 2024 Data Protection Trends Report. Resilience depends on an organization-wide understanding of security, and that depends on communication.
• In the story above, we'll reveal five steps CISOs can take to bolster security and ensure recovery, while putting both the organization and their role on a path to resilience.?

Donwtime is Sickening! Is it Time for a Resilience Checkup?

Story by Bob Wallace and Network Computing

Key Points:

• Resiliency , defined as the ability to “recover quickly,” is a major challenge for IT, as business participants report Internet outages are costing them $10 million a month. Yet ninety-seven percent of companies in the report by Catchpoint say “a reliable, resilient Internet is of utmost importance to their business success.”
• As an increasing number of businesses, small to large – are banking big on reliable connections to the net as their commerce lifeline, a variety of obstacles are standing in their way.
• "Ultimately, the CIO/CTO is accountable for the organization's digital resilience, but these are not just technology problems. Resilience and business continuity are, in fact, overall organizational issues that need to be discussed at the organization's highest levels and tested as frequently as possible," said Pete Charlton , IT Vice President, TMNAS.
• Catchpoint is addressing the issue of internet resiliency by offering internet performance monitoring offerings designed in part to make business and tech leaders aware of current problems to be addressed going forward.

Latest Major Tech Layoff Announcements

Original Story by Jessica C. Davis , Updated by Brandon Taylor

Key Points:

• As COVID drove everyone online, tech companies hired like crazy. Now, we are hitting the COVID tech bust as tech giants shed jobs by the thousands.
• Updated July 11, 2024 with layoff announcements from Intuit , CyberProof , UiPath , and 微软 .
• Check back regularly for updates to our IT job layoffs tracker.

Commentary of the Week

Story by Lisa Morgan, CeM, J.D.

Key Points:

• While some organizations, particularly highly regulated companies, have achieved a high level of cybersecurity maturity, tactics continue to evolve as new technologies become available making it more difficult for smaller organizations to cover all the bases.
• “Also evolving, and certainly anticipated by threat cyber criminals, is the vast opportunity that artificial intelligence provides for AI-powered malware, deepfake, and synthetic media, and an even more sophisticated social engineering engine, powered by AI”?says Cameron Forbes Over (she/her) , partner and cybersecurity lead at business advisory firm CrossCountry Consulting in an email interview.
• Meanwhile, enterprise attack surfaces continue to expand with the explosion of device types, pushing out from the traditional network of computers to phones, IoT and IIoT devices.
• “By the time you’re doing an annual audit, quarterly penetration tests or any number of things that are supposed to be proactive in corporate security, by the time you test again, even if it’s literally weeks -- which is what it takes to generate the report -- somebody’s been hired, somebody’s been fired. It’s as simple as that,” says Ralph Echemendia , an independent cybersecurity consultant, otherwise known as The Ethical Hacker .
• In the slideshow above, we reveal more ways more ways the threat landscape is evolving.

Podcast of the Week

Podcast and Story by Joao-Pierre Ruth

Key Points:

• In recent weeks, the European Union (EU) has gone after 苹果 for breaching the Digital Markets Act and Microsoft for Teams bundling in violation of antitrust law.
• While the EU continues to show its readiness to execute policy, regulatory oversight in the US has yet to be unified or as proactive in its approach.
• Alberto Gimeno Sánchez , CEO of Invofox (YC S22) , offers his perspective as a company that got its start in Spain, then relocated its headquarters to the US as part of the Y Combinator startup accelerator program.
• In this episode of DOS Won't Hunt, he discusses some of the differences between these markets when it comes to regulation and how that can affect a growing tech company such as his.

REGISTER NOW!

"Your Enterprise Cyber Risk Assessment"

This LIVE webinar launches on Wednesday, July 17 at 1pm ET:

Presented by InformationWeek and LogicGate

On Wednesday, July 17 - Tune into?our free, live webinar broadcast !

Our featured keynote speakers are:

• Ron Guerrier - CTO, Save the Children US
• Nicholas Kathmann - CISO, LogicGate
• Riya Sanjay - Senior Professional Services Manager, LogicGate

"Your Enterprise Cyber Risk Assessment"

If your company is to survive a growing number of relentless attacks, you had better have eyes everywhere. But no one has that many eyes.

The better strategy is to know your weak points and guard those closely. This webinar offers insights on how to realistically assess your company’s vulnerabilities, including how to prioritize them so that you put the most resources into protecting the vulnerabilities that will likely cost the most if exploited. This webinar is all about developing a custom-fitted strategy.

By attending this broadcast you’ll learn:

• How to realistically assess your company's vulnerabilities
• How to identify and prioritize risks to information and systems
• How to select controls to mitigate and treat identified risks
• Methods to improve overall resiliency and cyber posture
• Why documenting, reviewing, and regularly updating findings is critical

This is just a taste of what’s going on. If you want the whole scoop, then register for one of our email newsletters ,?but only if you’re going to read it.?We want to improve the sustainability of editorial operations, so we don’t want to send you newsletters that are just going to sit there unopened. If you're a subscriber already, please make sure Mimecast and other inbox bouncers know that we’re cool and they should let us through.

And if you’re thinking about subscribing, then maybe start with the InformationWeek in Review; it only arrives on our new look Saturdays.