Day: August 31, 2018

Posted on

Meet Your Cybersecurity Advocate: 5 Questions with Tony Vizza

Tony Vizza, CISSP, is the newest addition to the (ISC)² Cybersecurity Advocacy team! Based in Sydney, Australia, Tony works with corporations, government agencies and academic institutions to encourage collaboration across the industry, effective cybersecurity curriculums and strong legislation to attract and enable the workforce we need to manage the Asia-Pacific region’s most critical security issues. Tony has worked in the field for more than 25 years and has earned the CISSP certification, as well as the CRISC, CISM and is certified as an ISO/IEC 27001 Lead Auditor. To get to know Tony a bit better, we asked him five questions …

  • What brought you into the profession we now know as “cybersecurity?”

I started at a young age “discovering vulnerabilities” in my school’s network systems. From there, I went on to study computer science at university. IT has always been in my blood and over the past ten years, network security and cybersecurity have been the core of my professional career.

  • What career accomplishment are you most proud of?

Far and beyond all else – even both of my university degrees – I am most proud of achieving my CISSP certification. It was a culmination of months of study and preparation, on top of years of experience, and it finally made me feel proven to work in the field of information security. I had fantastic mentors and supporters who helped me through the process and I felt both disbelief and on top of the world when I passed my exam!

  • What is something about cybersecurity that you wish those outside of the field had a better understanding of?

Like many other industries portrayed in the media, our reality is much more mundane than the fictionalized version the rest of the world is presented with. The most effective protection against “hackers” isn’t what you see on CSI, but rather understanding the value of your own personal data. It’s important to understand how IT devices share information and remember to be mindful of what you post on social media. Human education is infinitely important. In fact, it is the most important factor in ensuring good cybersecurity.

  • What are you most looking forward to in your role as a Director of Cybersecurity Advocacy at (ISC)²?

I am looking forward to making a difference in the lives of many people in the APAC region, by helping to empower our members. When our members are able to succeed in their own endeavors, that is the best way to magnify our message of creating a safe and secure cyber world.

  • When not advocating for the cybersecurity professional – and the profession itself – where might our members find you?

You will most likely find me playing with my two toddler children, helping my partner with housework, studying law at university, or (hopefully) catching up on sleep! I also enjoy watching live stand-up comedy, taking a relaxing walk along the beautiful coastline of Sydney or attending a great music festival with my family.

Tony joins John McCumber, our director of cybersecurity advocacy for North America, in working for you, the cybersecurity professional. You’ll be hearing even more from Tony in this blog, our InfoSecurity Professional magazine and at cybersecurity events around the Asia-Pacific region.

[(ISC)² Blog]

Source: http://blog.isc2.org/isc2_blog/2018/08/meet-your-cybersecurity-advocate-5-questions-with-tony-vizza.html

Posted on

Can Blockchain Help Fight Digital Ad Fraud?

If you are a netizen, you must have already noticed how certain ads pop up while you are surfing videos on YouTube. Most of the times, these advertisements have close connections to the products and brands you have been searching recently. However, this is not the case always! Finding fake ads of reputed brands like Mercedes-Benz and Waitrose is not uncommon at all. According to reports from The Times of London, several reputed brands have found their advertisements among objectionable and explicit content.

Why should you care about online ad fraud?
If you are an advertiser, this should be a cause of concern for you. According to a recent study, over 20% of the clicks you are getting on your ads can be from bots and tricksters. Censoring the internet and running the entire web without advertisement is impossible. In short, good content and commendable user experience require sponsorship.

Sadly, advertisers are pouring money into digital ads, but they are not receiving the returns they expect. The advent of various smart devices may have expanded the scope of viewing content, but they have done little to ensure that the content is genuine.

According to the Association of National Advertisers, entrepreneurs are wasting over $7 billion on online adverts people do not see. The experts expect the numbers to grow beyond $335.5 billion in the next two years. When companies are ready to spend billions on online advertisements, it is understandable why malicious activities are always around the corner, waiting.

We have seen the likes of Meth-bot that cost the ad industry around $5 million per day. They used bots to mimic human data, created over 250,000 individual domains. These new sites had a resemblance to big fish like ESPN and Vogue.

Digital ad fraud is a serious concern for advertisers and users, too. While the fraudsters use bots to mimic human behavior, trace cursor movements, and hack social media accounts, they fake their geo-location data to avoid detection. As a result, along with regular display ads, the premium online video advertisements are also taking a hit. Digital fraudsters are messing up analytical data, upturning the KPIs and disrupting online campaigns of many of the more reputable brands in the world.

Blockchain as a potential solution to online fraud
Is there any current technology that can prevent pixel stuffing, ad stacking, search ad frauds and affiliate ad frauds? Experts say that it’s possible. They believe that advertisers can prevent similar frauds by turning to blockchain. We are not talking about cryptocurrencies, but the decentralized open-source ledgers.

A fusion of existing ad technology and blockchain can give advertisers the power to keep an eye on each impression and eliminate the fear of fraud. Leading advertising research firms like Interactive Advertising Bureau’s Tech Lab and Data & Marketing Associations already are working on creating a blockchain solution that can help advertisers detect and prevent fraudulent activities. However, the wide variety of online ad frauds make the task of developing a uniform system difficult.

Below are the major use cases of blockchain that can be implemented to prevent online ad frauds:

Ethereum-based ready solutions – Several startups and advertising research companies have been working on blockchain systems that can stop bots and impostors. Ethereum is the best-known blockchain right after Bitcoin. Instead of a central ad server, it offers a decentralized system to advertisers to monitor the activity of their partners. Google, Amazon, Twitter, YouTube, Facebook, and Snapchat have adopted similar history-proof, decentralized ledgers.

Blockchain counterattack – This mechanism adopted by the Ads.txt DApp allows publishers and content owners to list the authorized sellers of their inventory in a .txt file. This file is served from within the root path of their domain’s web server.

Blockchain-based exchange for traders – A combination of the financial matching engine and the latest blockchain technology allows advertisers to enable transparent transactions. It is a NASDAQ Inc. initiative that aims to provide advertisers and publishers a completely secure platform that supports buying, selling and re-trading advertising contracts.

In the digital era, online ads are an important channel for brands to use to reach out to their target audience. Ad fraud not only puts a hole in the pocket of the brands but also harms the end users, who need reliable information to make the right decisions. With the ability to impart transparency to the system and trace an online asset, blockchain can surely help reduce, if not completely stop digital fraud.

Ankit Shrivastav

[ISACA Now Blog]

Source: https://www.isaca.org/Knowledge-Center/Blog/Lists/Posts/Post.aspx?ID=1061

Posted on

Healthcare CISOs: Manage infosec risks and safeguard patient safety

Prominent CISOs from leading health systems and providers throughout the country have come together to establish the Provider Third Party Risk Management Council to develop, recommend and promote a series of practices to manage their information security-related risks in their supply chain and to safeguard patient safety and information.

Members of the Council observed their supply chains are filled with third parties who support the care delivery process and require access to patient information. Properly vetting and monitoring these third parties is a major challenge, and in some cases, insurmountable for many organizations who simply don’t have the expertise or resources. Through innovation and industry leadership, the council are developing common vetting and oversight practices that will benefit health systems, hospitals and other providers in the United States and around the world.

“Health systems and other providers need to be more active in assessing and monitoring risks posed by third parties to protect patient information while delivering effective care,” says Taylor Lehmann, CISO of Wellforce, parent organization of a health system that includes Tufts Medical Center and Floating Hospital for Children. “The primary challenge is organizations can engage with vendors of various sizes, maturity and complexity without really knowing whether the vendor should be engaged in the first place based on their beliefs and investment in cybersecurity.”

Lehmann says third parties may have a small number of customers or possibly hundreds or thousands to serve. For third parties, this challenge has resulted in lost time and resources in attempting to comply with each organization’s risk management requirements and ensure efficiency for both parties.

The council is working with the HITRUST CSF and its assurance programs for this initiative to better manage risk. The organizations on the council have each independently decided to require their third-party vendors to become HITRUST CSF Certified within the next 24 months. The HITRUST CSF Certification will serve as their standard for third parties providing services that require access to patient or sensitive information and will be accepted by all the council’s organizations.

Goal of the Provider Third-Party Risk Management Council

The Provider Third Party Risk Management Council recognizes that a more efficient approach to third-party assurance is necessary and strives to improve how the industry approaches assessing, monitoring, and responding to risks posed by third parties. By choosing to adopt a single assessment and certification program, healthcare organizations represented by the council are prioritizing the safety, care, and privacy of their patients by providing clarity and adopting best practices that their vendors can also adopt, while providing vendors the expectation of what it takes to do business with their organizations.

“We believe the healthcare industry as a whole, our organizations and our third parties will benefit from a common set of information security requirements with a standardized assessment and reporting process,” says John Houston, Vice President, Privacy and Information Security & Associate Counsel, UPMC. “We are strongly encouraging other provider organizations to follow suit and adopt these principles.”

The founding member organizations for the Provider Third Party Risk Management Council include:

  • Allegheny Health Network
  • Cleveland Clinic
  • University of Rochester Medical Center
  • UPMC
  • Vanderbilt University Medical Center
  • Wellforce/Tufts University.

Help Net Security

Source: https://www.helpnetsecurity.com/2018/08/30/provider-third-party-risk-management-council/

English
English
Exit mobile version