Portnox Blog
Catch up on the latest surrounding network security, cyber threats, and all things Portnox.
- Products
-
-
-
- The Securities and Exchange Commission (SEC) has made a significant stride in promoting transparency in the corporate sector. It has introduced new regulations obligating publicly traded companies to reveal significant cybersecurity incidents, offering investors a more transparent view of their cybersecurity risk management, strategy, and governance. Aimed at fostering informed investment decisions, the new SEC cyber reporting requirements mark a turning point in how public companies handle cybersecurity risks. The SEC Rules Unraveled At the heart of these rules is a requirement for public companies to announce material cybersecurity incidents within four business days of identifying their material nature. Materiality is discerned based on factors like the incident’s scale and character, repercussions on company operations, and possible effects on financial standing. Additionally, these rules compel public companies to provide more comprehensive information about their cybersecurity risk management, strategy, and governance. Disclosure Obligations for Public Companies After determining a cybersecurity incident is material: Companies must disclose on Item 1.05 of Form 8-K the incident’s nature, scope, and timing along with its impact on the company’s operations and financial health within 4 business days. Details regarding compromised data and ongoing or completed remediation efforts should also be included. Registrants must provide details on Form 10-K (Regulation S-K Item 106) that discuss how they assess, identify, and manage material risks from cybersecurity threats. Details on board oversight of risks from cybersecurity threats and management’s role in assessing and managing them must also be included . Foreign private issuers are required to provide similar disclosures for material cybersecurity incidents and to detail cybersecurity risks management, strategy, and governance on Form 20-F. The new regulations will be enacted in December or 30 days after publication in the Federal Register. Smaller companies will be allowed an additional 180 days to submit their Form 8-K disclosures. Additionally, disclosures may be delayed if the United States Attorney General determines that immediate disclosure would pose significant national security or public safety risks and notifies the Commission of this in writing. Tailoring Your Security Strategy for Optimal Compliance These technologies and frameworks can provide a multi-layered approach for compliance: Network Access Control: Your First Line of Defense In the face of the SEC’s new regulations, the implementation of Network Access Control (NAC) can be a game-changer. NAC solutions provide real-time visibility of all devices connected to the network, along with their user credentials and activities. By enforcing strong access policies, a NAC can ensure only authorized users and devices gain access to critical data, keeping potential threats at bay while aligning with the SEC’s push for improved cybersecurity risk management. Trust but Verify: Leveraging the Zero Trust Framework Additionally, adopting a zero trust framework provides a structured and secure approach to compliance. Zero trust operates the belief that no user or device – whether inside or outside the network should be trusted by default. Each access request is verified before access is granted, significantly reducing the risk of breaches while allowing easier compliance with SEC regulations. Passwordless Authentication: The Future of Secure Access Password-based systems have long been a weak link in the cybersecurity chain. By making the move towards passwordless authentication, companies can address this issue head-on. Replacing easily cracked, often forgotten passwords for stronger alternatives like biometrics, hardware tokens, or one-time passcodes, offer a user-friendly approach that bolsters security measures while meeting SEC directives. Closing Thoughts As we embrace the digital era, public companies face escalating cybersecurity risks. The new SEC cyber reporting requirements shine light on the traditionally opaque world of cyber risk in public companies, while increasing critical transparency with investors. By leveraging a multi-layered security approach, companies can secure an effective path to compliance while mitigating malicious threats. Read more...
-
-
-
-
-
- It’s now common knowledge that successful cyberattacks result in severe consequences for organizations – financial loss, disruptive system downtime, and hefty reputational damage. However, in some industries, these consequences can be even more dire. For example, The Joint Commission, a leading authority in healthcare accreditation, recently advised hospitals to plan for at least a month of post-breach downtime following a cyberattack as part of its new cybersecurity management guidelines. An Escalating Threat Landscape In healthcare, a successful cyberattack can compromise patient data, interrupt critical care, and even jeopardize lives. The reliance on the Internet of Medical Things (IoMT) devices and electronic health records makes healthcare systems particularly vulnerable. At the same time, patient data, which is inherently sensitive, is considered incredibly lucrative. Lastly, the healthcare industry is the most likely to pay up during a ransomware attack. This combination of factors makes healthcare organizations high-stakes targets for malicious actors. As a result, hospital breaches have surged in recent years. For example, August 2023 saw an incredibly destructive ransomware attack on a 16-hospital system based in California. The onslaught caused ambulances to be diverted, outpatient services to close, and emergency departments to shutter. And the bigger picture is even more alarming – US healthcare organizations suffered an average of 1,410 weekly cyberattacks per organization in 2022, up 86% compared with 2021. Post-Breach Downtime Three to Four Weeks to Restore Critical Systems Getting critical systems back online isn’t a quick fix; it’s often a lengthy process. The national adviser for cybersecurity and risk at the American Hospital Association estimates that restoring essential systems can take three to four weeks. And for noncritical systems? Expect an even longer recovery period. The stakes are high; even a few staff members falling for a phishing scam can set off a chain of events with severe, far-reaching consequences. In this context, a month-long downtime isn’t just an inconvenience. It’s a critical period where patient care may suffer, and lives could be at risk. Why So Long? Three to four weeks of system downtime is incredibly disruptive, especially in an industry with such high stakes. So why does it take so long to restore essential systems? Complexity and Interconnectedness: Hospitals operate on intricate, interdependent networks that are challenging to untangle or repair. One compromised system can affect several others, making restoration a coordinated and complicated endeavor. Forensic Analysis and Software Patching: Identifying the scope of the breach and fixing security vulnerabilities is a meticulous process. It involves not just a deep dive into what happened but also patching software flaws, which can be especially time-consuming if specialized or custom software is involved. Hardware and Data Integrity: Cyberattacks can corrupt both hardware and data. Replacing or repairing hardware and verifying data integrity are labor-intensive and time-consuming tasks, often requiring specialized expertise. Compliance and Legal Obligations: Restoring systems isn’t just a technical challenge; it’s a legal one. Hospitals must adhere to strict regulatory guidelines when handling breaches, including patient notifications and coordination with authorities, which divert resources and add time to the recovery process. Patient Safety Concerns: The foremost priority is ensuring the restored systems are functional and safe for patient care. Rigorous testing is required before these systems can be put back into operation, adding an additional layer of time and caution to the process. How Healthcare Organizations Fall Victim to Cyberattacks Phishing Phishing is a significant weak point. In these attacks, cybercriminals send seemingly legitimate emails that may mimic the appearance of trustworthy sources like medical suppliers, governmental health agencies, or internal departments. These emails often contain malicious links or attachments. Once an employee clicks on these, they may inadvertently provide access to sensitive data such as patient records or login credentials. Because healthcare workers are often under time pressure and may lack comprehensive cybersecurity training, they are more susceptible to falling for phishing scams. This makes it easier for attackers to penetrate otherwise secure networks. Internet of Medical Things (IoMT) IoMT devices like patient monitoring systems, MRI machines, and wearable fitness trackers expand the attack surface for cybercriminals. Many IoMT devices lack robust built-in security measures, making them easy targets. Additionally, these devices are often overlooked during security audits and may not be included in regular network monitoring. As a result, attackers can exploit vulnerabilities in these medical devices to gain unauthorized access to healthcare systems, potentially manipulating device functionality and compromising patient safety. According to Cynerio’s State of Healthcare IoT Device Security 2022 report, 53% of connected devices are at risk of a cyber-attack. Ransomware Attacks Ransomware attacks have seen a sharp rise in frequency and sophistication across all sectors, but they are particularly crippling for healthcare organizations. In these attacks, malicious software encrypts essential files and systems, rendering them inaccessible. Data recovery becomes an arduous task, often requiring specialized expertise and tools. Cybercriminals often favor ransomware attacks over other types of cyberattacks when targeting healthcare institutions for several reasons. First, healthcare organizations manage sensitive and critical data essential for patient care, making them more likely to pay the ransom quickly. Second, the healthcare sector is generally focused on patient care rather than cybersecurity, creating potential vulnerabilities that make ransomware attacks easier to execute. When weighed against the cost and complexity of data recovery, especially during a time-sensitive medical emergency, paying the ransom often seems to be the lesser of two evils, perpetuating the cycle of attacks. Final Thoughts Healthcare organizations can’t afford to skimp on cybersecurity. The stakes are incredibly high, ranging from financial loss to endangering lives. Investing in robust cybersecurity measures is crucial to mitigate the risk of attacks and prevent the devastating, time-consuming aftermath of system downtime. Read more...
-
-
-
-
-
- It should come as no surprise that passwords have fallen out of favor as a reliable method of authentication. This is because passwords are often weak (easily guessable), can be forgotten, and password stores become a weak point for security (if an intruder accesses the password store, they hit the motherload). Luckily, there is a better way to reliably authenticate users – certificate-based authentication. What Is Certificate-Based Authentication? Certificate-based authentication is a cryptographic technique that uses a digital certificate to identify a user, device, or machine before granting access to specific resources. Certificate-based authentication isn’t new. It’s widely used by many internet security protocols, including SSL/TLS, a near-universal protocol that encrypts communications between a client and server, typically web browsers and websites or applications. However, certificate-based authentication works slightly differently for SSL/TLS than in other use cases. With SSL/TLS, the server confirms its identity to the client machine, but this happens in reverse for client certificate-based authentication. For example, let’s say a company wants to use certificate-based authentication to grant employees access to its email servers. In this scenario, the company will issue employees with valid certificates to access the email servers, and only employees with these certificates will be granted access. In recent years, certificate-based authentication has risen in popularity as an alternative to password-based authentication, mainly as a way to address the security gaps with usernames and passwords. For example, username/password authentication uses only what the user knows (the password). In contrast, certificate-based authentication adds another layer of security by also using what the user has (the private cryptographic key). With that said, it’s important to note that certificate-based authentication is rarely used as a replacement for usernames and passwords but instead used in conjunction with them. By using both, companies essentially achieve two-factor authentication without requiring any extra effort from the end user (getting out their cell phone to receive a one-time password (OTP), for example). How Does Certificate-Based Authentication Work? Before answering this question, we first have to understand what a digital certificate is. A digital certificate is an electronic password or file that proves the authenticity of a user, server, or device through cryptography and the public key infrastructure (PKI). PKI refers to tools leveraged to create and manage public keys for encryption. It’s built into all web browsers currently in use today, and organizations also use it to secure internal communications and connect devices securely. The digital certificate file contains identifiable information about the certificate holder and a copy of the public key from the certificate holder. This identifiable information can be a user’s name, company, department, and the device’s IP address and serial number. When it comes to the public key, the key needs to be matched to a corresponding private key to verify it’s real. So, how does this work in practice? First, the end user digitally signs a piece of data using their private key. This data and the user’s certificate then travel across the network. The destination server will then compare the signed data (protected with a private key) with the public key contained within the certificate. If the keys match, the server authenticates the user, and they’re free to access network resources. Benefits of Certificate-Based Authentication Digital certificates are widely used by organizations today and for many reasons. Let’s dive into why. Boosted Security Public key cryptography, also known as asymmetric encryption, is considered very secure. This is because all data encrypted with the public key can only be decrypted with the matching private key. So, when two parties communicate, the sender encrypts (scrambles) the data before sending it, and the receiver decrypts (unscrambles) the data after receiving it. The unscrambling can only happen if the keys match. And while in transit, the data remains scrambled and will appear as gibberish to a hacker. Ease of Deployment & Use Certificate-based solutions are easy to deploy and manage. They typically come with a cloud-based management platform that allows administrators to issue certificates to new employees with ease. The same is true for renewing or revoking certificates. Moreover, many solutions integrate with Active Directory, which makes the certificate issuing process even more straightforward. They also don’t require any additional hardware, which isn’t the case for other authentication methods like biometrics or OTP tokens. Lastly, certificate-based solutions are very user-friendly and require minimal end-user involvement. Users don’t have to expend additional effort to get this boosted level of security. This is crucial because adding friction to any security measures tends to frustrate users and can often lead to worse outcomes. We see this happen with passwords where users typically reuse passwords to ease the burden of remembering multiple highly secure phrases. Natively Supported by Many Existing Enterprise Applications Countless enterprise applications and networks natively support X.509 digital certificates – the typical format used in public key certificates. This means enterprises can get up and running with certificate-based authentication with just a few configuration tweaks. Security Flaws of Certificate-Based Authentication No solution is without its drawbacks, and the same is true for certificate-based authentication. It’s much harder to crack a key than a password, but once cracked, the results are the same. If a key is compromised, cybersecurity goes out the window. Essentially, IT can’t distinguish between a hacker and a legitimate employee if the keys match. And this is precisely why certificate-based authentication should be used in coordination with other authentication and cybersecurity measures wherever possible. Second, certificate-based authentication is only as strong as the digital certificate. Or in other words, the stronger the cryptographic algorithms used to create the certificates, the less likely an attacker can compromise them. For this reason, organizations must ensure that the certificate authority is reputable and trustworthy. Final Thoughts on Certificate-Based Authentication Certificate-based authentication can be an excellent addition to any organization’s cybersecurity stack. While it’s not without its drawbacks, the benefits outweigh the challenges. Certificate-based authentication allows only approved users and devices to access your network while keeping unauthorized users and rogue devices locked out. Read more...
-
-
-
