Cloud Hosting

What is your organizations approach to security events?For many organizations, each security alarm is treated with the same urgency as a fire.While a sense of urgency is good, the ensuing panic that occurs is not a recipe for longevity. The constant shifting of attention from one emergency to the next is fatiguing; it can often lead to mistakes that compound an event.

The all hands on deck approach is similar to an ineffective method of weeding a garden.If you have a team of gardeners who are dedicated to pulling up sprouting weeds, they will forever be chasing weed sprouts rather than attacking the main root, known as the taproot.Fortunately, there is a better way to handle security.

Attacking the taproot is not only more effective but also more cost effective. That sounds good, but it does not address a reliable approach to IT security.It has somewhat of a boil the ocean ring to it.What is needed is a more measured approach to a security program. In the accounting profession, personnel rely on a methodology known as Generally Accepted Accounting Principles (or GAAP).One of the purposes of GAAP is to protect an accounting organization from liability if something goes wrong.That is, and organization is less likely to be sued for negligence if it can be shown that the industry-recognized best practices were being followed.

Unfortunately, there isnt really a generally accepted set of IT security principles.How can organizations protect against lawsuits in the event of a security breach?One method that has advanced and matured over the years is to use the controls that are offered through the Center for Internet Security (collectively known as the CIS Controls).

Formerly a list of 20 controls, the newest CIS version has been reduced to 18 controls.This is deceptively attractive, as it has been a long-standing joke in the security community that achieving the controls is a life-long pursuit.However, it is one worth pursuing.

Why is the attainment of the CIS Controls goal so difficult?One of the main reasons is that from the very first control, an organization must take aim at nailing down a seemingly moving target: asset inventory. It is suggested that the Controls be fulfilled in the order that they are presented in the document, as they progress in a very logical way.If successful, the result is a comprehensive security strategy.However, considering that everything changes, not only from an attackers approach but also from the perspective of an organizations assets, is this ever attainable?

Tools such as Tripwire Enterprise can help an organization to confront areas such as configuration and change management.Along with that, Tripwire Log Center meets the specifications for Audit Log management.

A major hurdle is to address all of the vulnerabilities in all of the discovered assets. It should be noted that vulnerability management falls almost midway on the control list, but the comparative lack of resources when tackling vulnerabilities makes this control one of the most daunting.Some of the tools to manage vulnerabilities do it in a manner that may not relieve the resource burden in the best way.This is where a tool such as Tripwire IP360 can make more sense by correctly setting priorities. Tripwire IP360 shows the riskiest vulnerabilities, for example, by displaying the machines that represent the greatest aggregate risk in an environment. The difference between Tripwire IP360 and other vulnerability scanners is that IP360 looks at how hard it is to take advantage of a vulnerability to actually exploit it.There are some vulnerabilities that have no known exploits, for instance, and there are other vulnerabilities that are freely exploitable by anybody regardless of a persons programming knowledge just by downloading a tool from the internet.

The Tripwire IP360 algorithm uses a risk rating that distinguishes between a vulnerability that is not actively exploited such as zero-day threats and those that need to be immediately remediated.While both are important, the two extremes must be treated and prioritized differently.The heat map also analyses the severity of an exploit, meaning that it can examine if a compromise would be limited to a local event or an escalated compromise.

The fundamental Tripwire goal is to help an organization to target that taproot, not constantly pulling out the weed sprouts as they spread out throughout the yard.According to the IT Process Institute, foundational controls can help a company to detect or avoid the huge majority of all security breaches.The CIS Controls were not designed with a particular vertical in mind.The authors were looking at IT security and how to best succeed in the most cost-effective and actionable way. Whether the Controls are used in a bank or utility company, (Each has its own separate compliance requirements and audits.) if an industry best practice is used, compliance is much more likely to emerge as a result of that. IT security can be seen as a super-set of what can be found in terms of specific requirements in compliance initiatives.

Using best practices all makes the point similar to an organizations legal standard of care for all of their business practices and transactions. Evidence that a general security principle or a recognized set of controls is followed is how a company can avoid being sued for negligence. In the case of the CIS Controls used in tandem with Tripwire products, it also has the benefit of creating a manageable security environment.

To learn more about Tripwire can help, download The Executives Guide to the CIS Controls today: https://www.tripwire.com/misc/executives-guide-cis-controls-register.

Excerpt from:
Conquering the Taproot of Cybersecurity | The State of Security - tripwire.com

Read More..

Text Size:A- A+

In this weeksChinascope, we will look at ChinasGalwan clash propaganda,hidden debt, controlling the algorithms, the investigationagainst formerjustice minister and other leading stories.

Chinese state media produced a propagandabroadcaston Martyrs Day remembering the PLA soldiers who died in the Galwan Valley clash on 15 June 2020. Since 2014, China has marked 30 September as Martyrs Day to remember the Chinese soldiers who fought wars with Japan andKoreain the 1950s.

PLA soldiersvisitedthe frontline of the Galwan Valley in Ladakh, where they sang the Chinese national anthem. Thetheatrics atthe borderweresupposed to send a message to India.

Incontinuationof imposing control on algorithms,theCyberspace AdministrationofChina (CAC) has set a three-year timeline to tame the algorithms used across theInternet platforms. The CACnoticeistitledStrengthening the Comprehensive Management of Internet Information Service Algorithms.

In three years, gradually establish a comprehensive algorithm security governance system with a sound governance mechanism, a sound supervision system, and a standardized algorithm ecology, says the notice.

The regulation is targeted at Internet companies and has a national security and ideological angle.Beijing justifies the national security argument of the algorithm control by drawing parallel between adherence to Communist Party and its ideology to long term prosperity of China.

TheChinese Communist Partys internal disciplinary body is investigating former justice minister Fu Zhenghua.

Chinese state mediaannouncedZhenghuasdetention for serious violations of discipline and law.Hebecame the deputy director of the Social and Legal Affairs Committee of the CPPCC National Committee.

In 2018, he wasappointedas the justice minister despite rumours implicating him in corruption scandals. XiJinpinghad trusted Fu with aprobeinto the former head of internal security Zhou Yongkang in 2013, a case which was most discussed among the anti-corruption movement. The news about the investigation was a top trend on search engine Baidu and social media platform Weibo.

This past week, AidData a research lab at William and Mary University revealed the increase in Chinese hidden debt offered by state-owned banks and state-owned enterprises. The research has discovered $385 billion in external debt owed by 42 countries, which adds up to 10% of the GDP of these countries.

AidDatasBanking on the Belt and Roadreport for the first time has given a global view of the Chinese hidden debt. A large share of the funding offered is classified as Belt and Road Initiative (BRI) funding by China. BRI is Chinas signature development financing project that critics believe is designed to trap developing countries into unsustainable debt levels.

China has responded to the revelations without mentioning the AidData report.

All major external debt indicators were within the internationally recognized thresholds, and Chinas external debt risk is under control,said the State Administration of Foreign Exchange on Saturday.

Also read: China just promoted a military general targeted at India. And Weibo chatted about Modi in US

In related news, Goldman Sachs revealed Chinese local government debt hasgrownto $8.2 trillion at the end of 2020. The debt is almost 52% of Chinas GDP.

Over the week, real estate giant Evergrande missedanotherdebt payment of $47.5 million due on Wednesday. In the last edition ofChinascope, we told you about Evergrandescontinuingdebt problems.

And, in the week, the Peoples Republic of China (PRC) celebrated its 72ndNational Day. PRC was founded on 1 October 1949, after Mao Zedongs speech in Tiananmen Square.

On PRCs National Day, Beijing set a record by sending 38 jets across the Taiwan Strait. Peoples Liberation Army Air Force intruded into Taiwans ADIZ (air defence identification zone).

Following the record-setting incursion, PLA once again intruded into Taiwans ADIZ on 2 October.ThePLA set another record by carrying out two sorties across the Taiwan Strait. Thetallyof the sorties on 2 October added to 39 PLA aircraft crossing the Taiwan Strait for the.

The Taiwan Air Force responded byscramblingplanes to monitor the Chinese aircraft, issuing radio warnings, and mobilizing air defence assets, the Taiwan Ministry of Defencesaid.

China is facing an energy crunch because of the shortage of coal supply and Beijings carbon neutrality commitment.

Factories in 20 of the 31 provinces across China havesuffered power lossandare havingto shut down production forafew hours evencities havefacedpower cuts. Energy production has grown expensive because of the trade tussle, after which Chinabanned the import of coal from Australia.

Beijing wants a tight control on the narrative around XiJinpings common prosperity campaign. An article by blogger Li Guangman, which had made news because of its radical tone, continues to unnerve Beijing.Chinascopehadexplainedthe controversy the article created.

A Beijing-based media source told theSouth China Morning Postearlier about verbal instructions from media regulators, that Lis piece had had too negative an impact and should be toned down,wrote SCMP reporter Jun Mai.

As the origins of the Covid-19 virus continues to be debated, Xi Jinping has called forimprovement in biosecurity control in the first study session of the Politburo.

Traditional biosecurity issues and new biosecurity risks overlap with each other; foreign biological threats and internal biological risks are intertwined and coexist. Biosecurity risks have many new features, Chinas biosecurity risk prevention and control and governance system still have shortcomings and weaknesses,saida summary of Xi Jinpings remarks at the study session.

China hascriticised the USs call for an investigation into the origins of Covid-19 in the Wuhan city and instead suggested the investigation should have a global focus.

Also read: After the gaming crackdown, China to target cosmetics industry

The JoeBiden administration is set tounveil its China trade policy next week. US trade representative Katherine Tai will speak at the Center for International and Strategic Studies in Washington DC, where she will announce the policy.

Tai recentlytoldPoliticoin an interview that the Biden administration will build on tariffs imposed by theDonaldTrump administration under the trade war with China.

China has backed North Koreas call to revise the international sanctions imposed on DPRK. Hua Chunying hascalledon the US to revise sanctions that are related to humanitarian aspects.

North Korea recentlytesteda hypersonic missile,a capabilitythat onlya select group of countries have deployedso far. China is one of thecandidatesthat may have helped North Korea with its hypersonic missile programme others being Russia and Iran.

Evergrande Is a Convenient Villain for Xi Richard McGregor

How a Forgotten Religion Shaped China Mao Ming

A History of the Islamic States Media Warfare Against China Lucas Webber

The inside story of the Peace Corps in China Daniel Schoolenberg

After Japan returns to the era of short-lived regimes, one of the bigger problems is that relations with neighbouring countries will continue to decline and the Japanese state will become more and more isolated in East Asia,saidChen Yan, Executive Dean of the Japanese Enterprise Research Institute (China).

A video of the farmers protest in Barnala (Punjab) was viewed 60,000 times on Weibo. Indian farmersraised anti-Modi, anti-imperialist, and anti-capitalist enterprise slogans at the rally, said the account that posted the video.

How the Chinese state handles labour unrest, with Manfred Elfstrom Sinica Podcast

Key Takeaways From AidDatas New Report on How Chinas Finances the BRI China in Africa Podcast

China will mark the 110thanniversary of the Xinhai Revolution on Sunday. The 1911 Xinhai Revolution ended Chinas last imperial dynasty.

This is a weekly round-up that Aadil Brar will write about whats buzzing in China. This will soon be available as a subscribers-only product.

(Edited by Prashant)

Subscribe to our channels on YouTube & Telegram

Why news media is in crisis & How you can fix it

India needs free, fair, non-hyphenated and questioning journalism even more as it faces multiple crises.

But the news media is in a crisis of its own. There have been brutal layoffs and pay-cuts. The best of journalism is shrinking, yielding to crude prime-time spectacle.

ThePrint has the finest young reporters, columnists and editors working for it. Sustaining journalism of this quality needs smart and thinking people like you to pay for it. Whether you live in India or overseas, you can do it here.

Support Our Journalism

Read the original:
China wants to tame Internet algorithms. Its all about national security - ThePrint

Read More..