Simple Opt Out makes it easier to opt out of data sharing by companies.
1-10-60 Rule
Dmitri Alperovitch, CTO at CrowdStrike, breaks down the 1-10-60 rule and why organizations should track and improve their incident response times with this benchmark in mind i.e.
Detect an incident in 1 minute
Investigate the incident in 10 minutes
Remediate or contain the incident in 60 minutes
Leadership
The challenge of leadership is to be strong, but not rude; be kind, but not weak; be bold, but not bully; be thoughtful, but not lazy; be humble, but not timid; be proud, but not arrogant; have humor, but without folly.
Jim Rohn
Under the Hood of Password Managers
Password managers allow the storage and retrieval of sensitive information from an encrypted database. Users rely on them to provide better security guarantees against trivial exfiltration than alternative ways of storing passwords, such as an unsecured flat text file. In this paper we propose security guarantees password managers should offer and examine the underlying workings of five popular password managers targeting the Windows 10 platform: 1Password 7 [1], 1Password 4 [1], Dashlane [2], KeePass [3], and LastPass [4]. We anticipated that password managers would employ basic security best practices, such as scrubbing secrets from memory when they are not in use and sanitization of memory once a password manager was logged out and placed into a locked state. However, we found that in all password managers we examined, trivial secrets extraction was possible from a locked password manager, including the master password in some cases, exposing up to 60 million users that use the password managers in this study to secrets retrieval from an assumed secure locked state.
Source: Password Managers: Under the Hood of Secrets Management
CIS Controls Self Assessment Tool
The Center for Internet Security has launched the CIS Controls Self-Assessment Tool, or CIS CSAT, to enable organizations to track and prioritize their implementation of the CIS Controls. The tool includes features such as the ability to:
- Delegate questions to other team members
- Set deadlines for each CIS Control and sub-control
- Collect documentation related to your findings
- Capture team discussion about each assessment question
To start with the Self Assessment Tool, visit https://csat.cisecurity.org/