About Us | Contact Us
View Cart

The Magnificent Seven 2020

By Dan Hadaway | Monday, December 23, 2019 - Leave a Comment

Seven trends impacting Information Security Officers of Small Institutions!


Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


Welcome to the Magnificent Seven, my annual predictive article about the seven trends in technology that will impact the Information Security Officers of small banks (under five billion in assets).  My intent: help you organize your thoughts for the upcoming year.

In a departure from previous years, we did not spend as much time on analysis when determining 2020’s trends. Instead, we’ve compiled what we are calling an “intuitive list,” assembled from suggestions made by myself and several other team members.

And because we believe in full disclosure. . .last year we failed in our predictions. Predicting the future isn’t always easy, but to our credit we do think we nailed a couple of them: two of last year’s predictions made it to this year’s list (#2 and #5).

So, what issues do we think Information Security Officers will tackle in 2020?

M-7 Trend #7: Ransomware, Vulnerability Management, Change Management, IoT and other old threats:  We find our Clients in varying degrees of “readiness” in response to several threats articulated in previous trend articles.  The “whack-a-mole” nature of information security continues, and we all have our mitigation lists.   Another way to title this trend:  Air Gap Methodology, Nessus Scanning, Server Hardening, IoT Plugins for Nessus, and other Old Controls now Necessary.

M-7 Trend #6: Data Flow Diagramming:  We’re starting to see what we’ve been predicting all along:  examiners and auditors “ever-evolving expectations” are now in checklists.  Meanwhile, we have been furthering the cause of getting real value from “graphic thinking,” and Dan has already “cut” two webinar-movies related to our “ever-evolving-reaction” to the expectations.  For one, Dan is finding that if we can diagram a few processes, and not just data flows, the time spent will reap even more value than the “management awareness” of data flow diagramming.

M-7 Trend #5: Incident Response Testing (Holdover From 2019): If you are not already implementing incident response testing, you will be. The CAT Requires it, your examiner is wanting it, but most importantly, we believe it is the #1 control, even more important now than awareness training (though Dan maintains it IS a form of management awareness training).

M-7 Trend #4: SIEM-CAT:  Many of our MSSP Clients are reaching out to us asking for an update to our document, “how our SIEM helps you comply with the CAT.”  We understand this is being driven by the audit process, and thus we plan to do a webinar-movie on this issue in February 2020.

M-7 Trend #3: User Containment:  We’re starting to see this simple control become more complex as banks implement thin-client environments or what we’ve heard some refer to as their “virtual desktop infrastructure.”  If “user containment” is no longer a matter of “going into airplane mode or disconnecting the network jack from the back of your workstation” the bank’s ISO should be working on ways to quickly kill terminal server sessions when a user grows suspicious.  We have seen elegant solutions in some environments; in many we see a lack of awareness.  Dan is planning a webinar-movie or two on user containment in 2020.

M-7 Trend #2: Vulnerability Management (Holdover From 2019):   We are still seeing many banks struggle with the patch management war.  Testing and awareness are the big changes, and if you implement them properly not only will your job be easier, BUT MANAGEMENT WILL BE ON BOARD.  Our first “guest author” article was about Vulnerability Management.  If you are still struggling with “patch management findings,” the implementation of Vulnerability Management is so ripe for you!  We suggest you start by asking your committee to read our nontechnical article on the subject!  Then ask them to watch our movie, “Vendor Management for Directors.

M-7 Trend #1: Business Continuity Management Guidance Update:  Well, well, well, the FFIEC made picking the number one trend easy this year.  Unless, of course, they come out with NEW guidance.  While the BCM update is primarily a reorganization with a new name (Management, not Planning), there are some changes that not only make sense from a true availability risk management perspective, but also from an “easy-to-audit” perspective.  Plus the long-awaited detail on expectations for testing act alone to make the guidance well worth the update.  So . . . if you haven’t already read the new guidance . . . you should.  It’s worth the read.

 

 

Finally . . .

You Spoke, We Listened:

An honest sidebar.

In the past year, we have received feedback from our regular attendees that we decided we should react to.  The following top five complaints articulate suggested changes to our “education process,” based on your feedback.  We may not be able to respond to all of these suggestions immediately, but we’d like to at least put the following on your radar:

#1: Call them “webinar-movies” if they aren’t going to be live.
Many of our audience members are pointing out that we have switched to recording our webinars as movies in advance.  We hope this makes for a better experience, but we agree that the I in CIA is data integrity, and we should be more transparent about the fact that we are actually not even there while you are watching the “webinar.”  We apologize for any confusion.

#2: If you have to use movies, can you consider a panel discussion after a movie?
Wow, what a great idea. We record a webinar-movie, show the movie, and then invite real bank ISOs to participate in a discussion about the movie.  I like it.  We’ll do it.

#3: Get a regular schedule and stick to it, stop cancelling webinars, don’t change topics after you schedule them.
Okay, you caught us. This is Dan’s fault, nobody else’s.  And it totally makes sense that you are relying on the topics we may advertise.  If you go to webinars.infotex.com before 01/01/2020, you will most likely see an empty list.  That’s because we are definitely responding to this suggestion, but in order for us to live up to its expectations, we are holding off on publishing the webinar schedule until we know it’s a schedule we can commit to.  Thank you to those who provided this honest feedback, and we apologize to everybody who may have suffered from our lack of consistency on the webinar schedule.

#4: Live Video of Dan, and maybe Sofia and Michael (whoever is involved).
This may be a bit harder to achieve than those who suggested it may think, because we all work remotely.  However, we’re looking into this.

#5: Make them shorter. Two hours, wtf?  20 minutes . . . ahhhhh.
Okay, thanks for this suggestion.  It came after our two hour Change Management Webinar, where we noticed most people left after an hour and five minutes.  We get it, nobody has time for a two-hour webinar.  But some of our material is more complicated than 20 minutes.  Still, we can break it into 20-minute segments, which is what we plan to try in 2020.  20 minutes in 2020, I like how that ends this sidebar!

 


Original article by Dan Hadaway CRISC CISA CISM. Founder and Managing Partner, infotex

“Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”


same_strip_012513


 

Latest News
    Reasons why we should be considered! infotex provides a number of services that can be checked out if you click over to offerings.infotex.com! We even made a movie with all the reasons why infotex should be your next MSOC!  
    infotex and GoTo To all infotex managed security service Clients: As recently reported by major news outlets there was a data breach affecting GoTo (formerly LogMeIn) wherein attackers stole encrypted backups containing customer information in November 2022.  Based on the advisory from GoTo the products they offer that are affected include LogMeIn Pro, LogMeIn Central, […]
    An option for increasing security for ALL organizations. . . The threat landscape is evolving daily, and it is becoming increasingly difficult for even large organizations providing cyber defense services to keep up. As Brandao (2021) notes, it is important for organizations to adapt holistic technologies that can correlate all attack events. Therefore, developing XDR […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    A relic of the internet’s less secure past, many small firms struggle to secure their email systems… An article review. With a great deal of cybersecurity related news focused on new threats and similarly new techniques aimed at combating them, it can be easy to forget some of the older threats that have never gone […]
    Seven Trends . . . …that small bank Information Security Officers face in 2023 Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Welcome to the Magnificent Seven, my annual predictive article about the seven trends in technology that will impact the Information Security Officers of […]
    System Security and Cybersecurity are not the same thing. . . Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Regarding “information security,” the last thirty years have seen an evolution of frameworks, laws, and assessment approaches which intimidate the management team with their complexity.  […]
    The cryptographic algorithm is vulnerable to attack and is no longer considered secure… An article review. NIST has announced that it plans to retire the SHA-1 cryptographic algorithm by the end of 2030, citing multiple vulnerabilities in the standard, effectively ending its use after nearly 30 years.  Introduced in 1995, SHA-1 used a 160-bit hash […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    Trending: Awareness Posters Meet Infographics Here are the top seven posters as of the last twelve months! As always, our Awareness Posters were a hit in 2022! So we decided to run some reports to see what our most popular posters were since November 2021. As everybody loves top ten lists and contests, we thought […]