The AV-TEST Institute recently tested the most popular Windows 10 client antivirus products on three primary criteria: protection, performance, and usability. Five of the 16 products tested earned a perfect rating of 6 for each of those criteria:

• Bitdefender Endpoint Security
• Kaspersky Small Office Security
• Kaspersky Endpoint Security
• Symantec Endpoint Protection
• Symantec Endpoint Protection Cloud

The top 12 antivirus offerings shown here in alphabetical order scored at least 17.5 points out of a possible 18. You can drill down on the full results at The AV-TEST Institute's website. 

To read this article in full, please click here

There is nothing like attending a face-to-face event for career networking and knowledge gathering, and we don’t have to tell you how helpful it can be to get a hands-on demo of a new tool or to have your questions answered by experts.

Fortunately, plenty of great conferences are coming up in the months ahead.

If keeping abreast of security trends and evolving threats is critical to your job — and we know it is — then attending some top-notch security conferences is on your must-do list for 2019 and 2020.

From major events to those that are more narrowly focused, this list from the editors of CSO, will help you find the security conferences that matter the most to you.

To read this article in full, please click here

An undocumented feature in Intel CPUs allows attackers to manipulate the voltage of Intel CPUs to trigger computational faults in a controlled manner. This can be used to defeat the security guarantees of the Intel SGX trusted execution environment, which is meant to protect cryptographic secrets and to isolate sensitive code execution in memory.

The Intel Software Guard Extensions (SGX) is a technology present in modern Intel CPUs that allow users to set up so-called enclaves where the CPU encrypts part of the memory and doesn’t allow any programs except those running inside the enclave to access it.

To read this article in full, please click here

Along with ransomware, cryptocurrency mining malware is one of the most common threats to enterprise systems. Just like with ransomware, the sophistication of cryptominers has grown over the years, incorporating attack vectors and techniques such as fileless execution, run-time compilation and reflective code injection that were once associated with advanced persistent threats (APTs).

One of the biggest threats to privacy and national security is the ability of the immensely powerful quantum computers to break prevailing methods of encryption almost instantaneously. Once quantum computers become a reality, something that could conceivably happen in the next decade or two, all of the data protected by encrypted systems on the internet will become decrypted and unprotected, accessible to all individuals, organizations or nation-states.

Dr. Jill Pipher, President of the American Mathematical Society, VP for Research, and Elisha Benjamin Andrews Professor of Mathematics at Brown University led a briefing last week for lawmakers on Capitol Hill called “No Longer Secure: Cryptography in the Quantum Era” about the threats that quantum computing poses to existing cryptographic systems that support national and economic security. Senator Jack Reed (D-RI) began the briefing by saying “we’re acutely aware of the potential advantages and disadvantages that quantum presents. And we’re also very concerned that some of our adversaries and competitors are investing a great deal in quantum computing.”

To read this article in full, please click here

If you think attacking civilian infrastructure is a war crime, you'd be right, but spies from countries around the world are fighting a silent, dirty war to pre-position themselves on civilian infrastructure — like energy-producing civilian nuclear plants — to be able to commit sabotage during a moment of geopolitical tension.

What follows is an explanation of how India's Kudankulam Nuclear Power Plant (KNPP) got hacked — and how it could have been easily avoided.

The KNPP hack

The news came to light, as it so often does these days, on Twitter. Pukhraj Singh (@RungRage), a "noted cyber intelligence specialist" who was "instrumental in setting up of the cyber-warfare operations centre of the National Technical Research Organisation (NTRO)," according to The New Indian Express, tweeted: "So, it's public now. Domain controller-level access Kudankulam Nuclear Power Plant. The government was notified way back. Extremely mission-critical targets were hit," noting in a quote tweet that he was aware of the attack as early as September 7, 2019, calling it a "causus belli" (an attack sufficiently grave to provoke a war).

To read this article in full, please click here

One of the most effective ways to uncover flaws and weaknesses in your security posture is to have a third party carry out planned attacks on your system. Penetration testing is all about exposing gaps in your defenses so that they can be plugged before someone with malicious intent can take advantage. There are several different types of pen test designed to target different aspects of your organization.

From network infrastructure to applications to devices to employees, there are many potential avenues of attack for a criminal targeting your business. A good pen testing partner will approach the problem with an open mind and try to emulate a malicious hacker, probing for weaknesses, and trying various techniques and tools to breach your network.

To read this article in full, please click here

Looking for a qualified candidate or new job? CSO's security recruiter directory is your one-stop shop.

The recruiters listed below can help you find your next Chief Security Officer (CSO), Chief Information Security Officer (CISO), or VP of Security and fill hard-to-hire positions in risk management, security operations, security engineering, compliance, application security, penetration testers, and computer forensics, among many others.

If you're a security recruiting firm, we want your information! Our goal is to provide the most complete recruiter resource available, but to do that we need your assistance. Please send the name, contact info and a few sentences about your company and its specialties to Michael Nadeau.

To read this article in full, please click here

Cybersecurity definition

Cybersecurity is the practice of defending computers, networks, and data from malicious electronic attacks. It is often contrasted with physical security, which is the more traditional security practice aimed at controlling access to buildings and other objects in the real world.

Although there are plenty of high-tech physical security techniques, and sometimes physical and cybersecurity are joined together in the org chart under the same executive, cybersecurity focuses on protecting assets from malicious logins and code, not burglaries.

To read this article in full, please click here

Whether you host your authentication system internally or externally, you need to select an authentication protocol carefully. The correct protocol for your use case will allow the overall system to operate securely with minimal effort and enable future expansion and compatibility with standards. In addition, if you want to make your users’ identities available to external services, it is important to consider how easy it is for these services to consume that data while keeping the process secure.

The CSO Hall of Fame was created to spotlight outstanding leaders who have significantly contributed to the advancement of information risk management and security. Selected by the editors of CSO, its advisors and executives, the individuals in this inaugural class of the CSO Hall of Fame exemplify leadership excellence and, by their example, contribute to the improvement of security across all organizations.

Honorees will be recognized at the CSO50 Conference + Awards taking place April 27 - 29, 2020 at the JW Marriott Camelback Inn Resort in Scottsdale, AZ. The annual conference draws 200+ security decision-makers for three days of peer interaction, education and engagement, and culminates in an awards ceremony recognizing the winners of our annual CSO50 awards and Hall of Fame inductees. Attendees travel from across the U.S. to learn from industry experts and top vendors as they seek out information on security solutions and best practices.

To read this article in full, please click here

President Donald Trump, Senator John Kennedy from Louisiana and Secretary of State Mike Pompeo have all given credence to what cybersecurity experts and the US intelligence community deride as a baseless conspiracy theory pushed by Russia. That theory posits that Ukraine, and not Russia, was responsible for hacking into the networks of the Democratic National Committee (DNC) in the run-up to the 2016 presidential election.

Kennedy quickly backtracked from blaming Ukraine for the DNC hack, but nonetheless left wiggle room to return to this contention. After admitting he was “wrong” to imply Ukraine and not Russia hacked the DNC, he went on to say, “There is a lot of evidence, proven and unproven — everyone’s got an opinion — that Ukraine did try to interfere, along with Russia and probably others, in the 2016 election.”

To read this article in full, please click here