Security Roundup: Insight Engines, Optiv, K-12 Cybercrime, Darktrace

… multiple opportunities for MSSPs and other cybersecurity providers.

Optiv’s Brian Golumbeck

“The entire premise of the survey demonstrates the opportunity for MSSPs to educate enterprises on the need to move to a business risk-based security approach, rather than a compliance-based approach,” he said. “Business-aligned security reduces business risk, not just compliance risk. The real value of a MSSP lies in the opportunity to provide operational services that help clients move to this new risk-based program more quickly and with less change-induced risk. Finally, it is not surprising that nearly half of respondents said security risk is not fully integrated with enterprise business risk, because the difficulty CISOs have in gaining a ‘seat at the executive table’ is well-known and also represented in this data.”

Incident detection and response services are a given, but there are higher-level solutions that could help with the issues identified in the survey, Golumbeck said.

“If clients are only focused on protecting regulated data, they are leaving themselves wide open to attack,” he said. “For example, a retailer may be laser-focused on PCI compliance. But they may also have a loyalty program database that is not subject to PCI regulations, and is therefore not being protected as vigorously. [Malicious] hackers will always go for the easiest payday, so they’ll target that loyalty program database and use the data to perpetrate fraud and identity theft. The ideal solution would be to provide services to the retailer that can identify their business risk, understand the most likely avenues of attack, and then prioritize the program around those assets that represent the greatest risk.”

K-12 Education Provides Big Opportunities for Cybersecurity Channel

Public K-12 education agencies across the country experienced a total of 122 cybersecurity incidents in 2018, and many of these incidents were significant, resulting in the theft of millions of taxpayer dollars, stolen identities, tax fraud and altered school records.

That’s according to a recent report by the K-12 Cybersecurity Resource Center, “The State of K-12 Cybersecurity: 2018 Year in Review“.

“Public schools are increasingly relying on technology for teaching, learning and school operations,” said Douglas Levin, president of EdTech Strategies and report author. “It should hardly be surprising, therefore, that they are experiencing the same types of data breaches and cybersecurity incidents that have plagued even the most advanced and well-resourced corporations and government agencies.”

Data for the report is drawn from publicly-disclosed incidents – including data breaches, phishing attacks, ransomware and denial of service attacks  – cataloged on the K-12 Cyber Incident Map. Since 2016, the map has documented more than 415 publicly disclosed incidents, which equates to a rate of about one new publicly reported incident every three days.

The goal of policy makers, technologists and school leaders must be to reduce and better manage the cybersecurity risks facing increasingly technologically dependent schools, according to the Center.

“But make no mistake: keeping K-12 schools ‘cybersecure’ is a wicked problem – one that is assured to get worse until we …