https://rusrim.blogspot.com/2022/06/blog-post_30.html
Росстандарт: Начато публичное обсуждение проекта стандарта ГОСТ Р «Менеджмент риска. Риск-аппетит и ключевые индикаторы риска»
Росстандарт: Начато публичное обсуждение проекта стандарта ГОСТ Р «Менеджмент риска. Риск-аппетит и ключевые индикаторы риска»
Blogspot
ФНС России о применении бумажных и электронных доверенностей
Федеральная налоговая служба (ФНС России) в своём письме №ЕА-3-26/5811@ от 3 июня 2022 года разъяснила свою позицию по вопросу применения до...
https://www.wsj.com/articles/european-cloud-restrictions-could-limit-u-s-providers-reach-11656430248
WSJ
European Cloud Restrictions Could Limit U.S. Providers’ Reach
European cybersecurity authorities are drafting a new certification system for cloud services that could limit the amount of critical data held by American providers.
SANS 2022 Security Awareness Report: Human Risk Remains the Biggest Threat to Your Organization’s Cybersecurity | SANS Institute
https://www.sans.org/press/announcements/sans-2022-security-awareness-report-human-risk-remains-biggest-threat-organizations-cybersecurity/
Key Findings:
Workforce: More than 69% of security awareness professionals are spending less than half their time on security awareness. The data shows that security awareness responsibilities are very commonly assigned to staff with highly technical backgrounds who may lack the skills needed to effectively engage their workforce in simple-to-understand terms.
US Compensation: The average salary reported was $110,309 USD for security training professionals, an increase from 2021. However, those dedicated full-time to awareness were paid on average only $86,626, while those who are part-time averaged $117,584 – $30,000 difference. This difference is because people dedicated part-time to security awareness have their compensation based on their other responsibilities, which are usually more technically focused.
Global Compensation: Security awareness professionals in Australia/New Zealand had the highest average annual compensation ($121,236), while South America had the lowest ($56,960). In North America, the higher the maturity level of an organization’s security awareness program, the higher the salary for the awareness professionals who work there.
Top Reported Challenges: The three top reported challenges for building a mature awareness program were all related to a lack of time: specifically Lack of time for project management, limits on training time to engage employees, and a lack of staffing.
Pandemic Impacts: The top two reported impacts were the challenge of a more distracted and overwhelmed workforce and a working environment where human-based cyber-attacks have become more frequent and effective.
Program Maturity by Region: Consistent across all global regions is that current programs' most common maturity levels are compliance-focused and awareness/behavior change.
Successful Program Indicators: Strong leadership support, increased team size, and a higher training frequency topped the charts as key enablers to program success.
https://www.sans.org/press/announcements/sans-2022-security-awareness-report-human-risk-remains-biggest-threat-organizations-cybersecurity/
Key Findings:
Workforce: More than 69% of security awareness professionals are spending less than half their time on security awareness. The data shows that security awareness responsibilities are very commonly assigned to staff with highly technical backgrounds who may lack the skills needed to effectively engage their workforce in simple-to-understand terms.
US Compensation: The average salary reported was $110,309 USD for security training professionals, an increase from 2021. However, those dedicated full-time to awareness were paid on average only $86,626, while those who are part-time averaged $117,584 – $30,000 difference. This difference is because people dedicated part-time to security awareness have their compensation based on their other responsibilities, which are usually more technically focused.
Global Compensation: Security awareness professionals in Australia/New Zealand had the highest average annual compensation ($121,236), while South America had the lowest ($56,960). In North America, the higher the maturity level of an organization’s security awareness program, the higher the salary for the awareness professionals who work there.
Top Reported Challenges: The three top reported challenges for building a mature awareness program were all related to a lack of time: specifically Lack of time for project management, limits on training time to engage employees, and a lack of staffing.
Pandemic Impacts: The top two reported impacts were the challenge of a more distracted and overwhelmed workforce and a working environment where human-based cyber-attacks have become more frequent and effective.
Program Maturity by Region: Consistent across all global regions is that current programs' most common maturity levels are compliance-focused and awareness/behavior change.
Successful Program Indicators: Strong leadership support, increased team size, and a higher training frequency topped the charts as key enablers to program success.
www.sans.org
SANS 2022 Security Awareness Report: Human Risk Remains the Biggest Threat to Your Organization’s Cybersecurity | SANS Institute
With an unprecedented number of employees now working in hybrid or fully remote environments, compounded by an increase in cyber threats and a more overwhelmed, COVID-19 information fatigued workforce, there has never been a more critical time to effectively…
👍1
Forwarded from k8s (in)security (Дмитрий Евдокимов)
Если вы используете
1) Service Mesh Security Best Practices - From Implementation to Verification
2) A beginner’s guide to following Istio’s security best practices
Service Mesh Istio или планируете, то перед вами рано или поздно станет вопрос ее безопасности и организации безопасности с ее помощи (если захотите). И как раз для вас на последнем IstioCon 2022 была два доклада на данную тему:1) Service Mesh Security Best Practices - From Implementation to Verification
2) A beginner’s guide to following Istio’s security best practices
👍1
Forwarded from Yandex Cloud
Yandex Scale 2022 — регистрация открыта!
Каждый год мы проводим Yandex Scale — наше главное мероприятие. Мы встречаемся, чтобы открыто говорить о современных облачных технологиях и ваших задачах, которые они помогают решить. Вместе с вами ищем новые возможности для роста бизнеса и, конечно, обсуждаем новости платформы.
В этом году Yandex Scale пройдёт 23 сентября — офлайн в кинотеатре Октябрь и онлайн на сайте конференции.
Регистрируйтесь и добавляйте событие в календарь, чтобы ничего не пропустить →
А следить за новостями удобно в официальном канале конференции @yandexscale.
#yacloud_news
Каждый год мы проводим Yandex Scale — наше главное мероприятие. Мы встречаемся, чтобы открыто говорить о современных облачных технологиях и ваших задачах, которые они помогают решить. Вместе с вами ищем новые возможности для роста бизнеса и, конечно, обсуждаем новости платформы.
В этом году Yandex Scale пройдёт 23 сентября — офлайн в кинотеатре Октябрь и онлайн на сайте конференции.
Регистрируйтесь и добавляйте событие в календарь, чтобы ничего не пропустить →
А следить за новостями удобно в официальном канале конференции @yandexscale.
#yacloud_news
Forwarded from Dan Belgrad
Коллеги, начали готовить для вас целый трек докладов по безопасности на Scale! Регистрируйтесь уже сейчас!
1/ Ransomware tip: Never upload ransomware samples to VirusTotal.
Why not? Because in most cases, the ransomware creates a readme along the encrypted file, which includes information about how to enter the chat for negotiations with the attackers.
2/ The chat could leak the negotiations with the attackers (including sensitive information) or even the paid amount of ransom.
Sometimes, the chats are still online weeks after the attack. Again, just don't upload samples to VT, even weeks or months after a ransomware attack.
#Stephan_Berger
Why not? Because in most cases, the ransomware creates a readme along the encrypted file, which includes information about how to enter the chat for negotiations with the attackers.
2/ The chat could leak the negotiations with the attackers (including sensitive information) or even the paid amount of ransom.
Sometimes, the chats are still online weeks after the attack. Again, just don't upload samples to VT, even weeks or months after a ransomware attack.
#Stephan_Berger