ThreatReady by Hack The Box

Welcome to the first edition of the ThreatReady newsletter!

The ThreatReady newsletter is your strategic source of actionable truth and curated news from the industry. It offers a people-centric perspective that connects deeply with the challenges and triumphs of leading cybersecurity teams and strategy.

If the cybersecurity landscape were a chessboard, the ThreatReady newsletter would be your strategic guide for keeping you three moves ahead of bad actors and competitors.?

The skills gap continues to widen in 2024 ??

Even though it’s a reverberating theme in the security industry year after year, the skills gap continues to harm defensive capabilities.?

6% of leaders reported that they were missing the skills and people they needed to respond to a cyber incident. In 2023, this doubled to 12%, according to the Global Cybersecurity Outlook covered by the World Economic Forum (WEF).

Reskilling is clearly a significant trend we expect to see in 2024 with the shortage of talent. But what’s surprising is the impact that skills development can actually have on team performance, retention, and morale.?

68% of the 800+ security professionals we interviewed in our 2023 Cyber Attack Readiness report rated “opportunities to learn skills” as the most successful way of staying engaged at work.?

It’s easy to fixate on financial compensation to motivate a workforce, but offering the opportunity to progress your team’s skills can be just as effective.?

Combined with the ongoing talent shortage, reskilling offers a way to hit multiple “birds” with a single stone: Improved employee engagement, fewer skills gaps, and a pipeline of high-impact talent sourced from your internal org.

Is generative AI working against defensive teams? ??

In the study by the WEF, the overwhelming majority of professionals believed that generative AI would give an advantage to attackers over defenders. But what are its actual defensive use cases?

Sebastian Hague, our Head of Defensive Content, shares that it can support DFIR initiatives such as:

• Enhanced Incident Response Automation.
• Assistance in automating routine SOC tasks.
• Automated Reporting and Documentation.
• Large Data Analysis Assistance.

Generative AI is slowly becoming an indispensable ally to blue teams across the globe. If used correctly, generative AI may have a net positive impact allowing defenders to streamline processes, save time, and further fortify our defenses.

Use SEC’s new rules on disclosure to secure more resources ??

The Securities and Exchange Commission (SEC) has recently mandated quicker and more detailed reporting of cybersecurity incidents within publicly traded companies.?

The new rules will require registrants to disclose on the new Item 1.05 of Form 8-K any cybersecurity incident they determine to be “material” (capable of affecting an investor's decision to buy, sell, or hold securities of a company) and to describe the material aspects of the incident's nature, scope, and timing.

CISOs are already under constant scrutiny, and the new SEC rule places more accountability on their shoulders.?

However, the heavy legal implications of failing to comply with the ruling have a silver lining:?

They can indirectly support CISOs by helping them make the case for increasing investments in cybersecurity resources to improve risk management and incident reporting protocols.?

Solving the feud between functionality vs. security ??

Developers know that application security is important. So why is integrating secure coding practices into the software development lifecycle (SDLC) so challenging??

Security is often seen as being a trade-off with functionality. It’s often the proverbial punchbag blamed for increasing the complexity and work required to develop functionality and adding “more hoops to jump through.”?

Paired with today’s fast-paced development environment, where there’s an urge to release software quickly and update it frequently, there’s a clear emphasis on speed and functionality that compromises security.?

This “rush to release” mindset can result in security vulnerabilities being overlooked. It poses a security leader with the difficult challenge of balancing speed with security and fostering a shared responsibility between dev and security teams.?

The culprit behind poor AppSec is often a lack of communication and collaboration between the two teams; this is where a little dose of cross-team training and combined workshops go a long way in encouraging a “security-conscious development culture” within your organization that shifts to shipping products and releases that are “secure by design.”

For more actionable insights on gaining leadership buy-in for secure software development and collaborating with dev teams, check out the newly published guide & checklist.

Wins of the month (let’s celebrate fellow security leaders) ??

• Mario Ledo Hernansanz, CISO, Lynx Tech: achieved the recertification of the PCI-DSS v4 standard, aligning their cybersecurity capabilities with the last requirements issued by the PCI Council for handling card data.??
• Paul Keastead, Security Program Manager, United States Marine Corps: Passed a recent internal audit resulting in zero discrepancies and zero findings! Go Paul!??
• Moritz Samrock, Red team manager, Laokoon Security: Allocates 20% of employees' working time available for upskilling and learning new things. (Many of them use this time to take on the challenges from Hack The Box!)

Share your win with the community

Your expertise and insights are invaluable. And we’re eager to share them with our vast audience of over 2.5 million members. We’d be honored to feature your top "win" of the month related to your team, department, or security program in the next edition of ThreatReady.?

A “win” could be:?

• Achieving compliance or industry standards.?
• Successfully onboarding new team members.
• Celebrating your team’s performance.

The top wins will be shared in the next month’s edition of ThreatReady (and if it’s really good, may get some additional love on social media). Want to share your win??

Comment your win below???