I'm invited in the Geneva Information Security Day 2018 to participate in a panel in which we will discuss myths and reality around artificial intelligence and machine learning. You may request to join us if you are interested in either this subject, or GDPR or GRC strategy on a IOT and Cloud era. Respected colleagues will share their knowledge and experience and I personally cannot wait to discuss and engage in open discussions around all these topics.
Everybody has something to say about the Facebook / Cambridge Analytica case. And I am annoyed by people saying that when you give your data to Facebook, you forego some parts of your privacy (true) so you should not be surprised (false). In simple terms, it was an actual data breach. Individuals who had not consented, had their data exposed. This was not supposed to happen. There are two aspects I would focus on regarding this issue:
Building a Security Operations Center from scratch is not an easy thing. But since it's not the first time I'm doing it, I am familiar with the challenges. These challenges include the building of the processes in a company-adjusted manner, the selection of the toolset and integrations to match the company's enterprise architecture, network architecture and of course my own security architecture, but nowadays, and due to the significant skill shortage in cybersecurity the major challenge is finding the right people.
More than a year ago I wrote an article about how you should stop remembering passwords. A few smart people figured out that was I was suggesting, was equivalent to using a password manager. Without the hassle of using one and without the risk of your password manager being compromised. Smart, right?
As everybody probably knows by now, CCleaner was compromised and malicious individuals added multi-stage malware payload on it. A typical case of compromised software if you ask me, pretty much like the one with the Ukrainian tax software that spread Not-Petya. But there is a different aspect to why compromised software is very dangerous, and it actually uses (believe it or not) social engineering in a more advanced way.
Recently I stumbled upon A CyberSecurity story called Deep Thought from ideas42. It is a book dealing with human behavior and how it affects cyber security.