2015 Online Trust Audit & Honor Roll Review June 23, All rights reserved. Online Trust Alliance (OTA) Slide 1
|
|
|
- Jonathan Booth
- 5 years ago
- Views:
Transcription
1 2015 Online Trust Audit & Honor Roll Review June 23, 2015 Sal Tripi AVP, Publishers Clearing House Jeff Wilbur VP Marketing, Iconix Craig Spiezle Executive Director & President, OTA 2015 All rights reserved. Online Trust Alliance (OTA) Slide 1 Who Is OTA? Mission - To enhance online trust and empowering users, while promoting innovation and the vitality of the internet. Goal to help educate businesses, policy makers and stakeholders while developing and advancing best practices and tools to enhance the protection of users' security, privacy and identity. OTA supports collaborative public-private partnerships, benchmark reporting, meaningful self-regulation and data stewardship. IRS approved 501c3 tax-exempt charitable organization Supported by over 100 leading brands, advertisers, marketers, technology leaders, non-profits and government agencies All rights reserved. Online Trust Alliance (OTA) Slide 2 1
2 Online Trust Audit & Honor Roll Objectives: Move from a compliance mindset to stewardship Recognize leadership brands, sites & apps that implement security and privacy practices protecting users data Incentivize businesses and developers to enhance their security, data protection and privacy practices Make security & privacy part of a brand s value proposition Increase awareness and preference for best practices Education 2015 All rights reserved. Online Trust Alliance (OTA) Slide 3 Honor Roll Overview Analysis of ~1,000 web sites FDIC Banking 100 Internet Retailer Top 500 Top 50 Social Top 50 News/Media (introduced in 2014) Top 50 Federal Gov t OTA Members IoT 50 (Home automation, Wearables) Scoring Up to 100 points in each category Bonus points for emerging practices Penalty points for Data loss incident, fines/settlement Inadequate practices Italics = new in 2015 Security Brand Protection Honor Roll = 80% of total points, 55% or better in each category Privacy 2015 All rights reserved. Online Trust Alliance (OTA) Slide 4 2
3 Collaborative & Open Audit Open call for comments Published methodology Webinar and tools to aid companies Powered in part by Agari, AVG Technologies, DigiCert, Disconnect, Distil Networks, Ensighten, GlobalSign, High- Tech Bridge SA, IID, Microsoft, Return Path, SiteLock, SSL Labs, Symantec, ThreatWave, TRUSTe & VERISIGN 2015 All rights reserved. Online Trust Alliance (OTA) Slide 5 Overall Achievement Record level of Honor Roll achievement, despite more stringent criteria Primarily due to many organizations near threshold raising score with simple improvements Most consistent increase was in privacy policy scores 2015 All rights reserved. Online Trust Alliance (OTA) Slide 6 3
4 Overall Achievement by Sector 2015 All rights reserved. Online Trust Alliance (OTA) Slide 7 Top of The Class Ranked #1 of all 800 sites across all sectors Online Retailers Social Federal Banking News IoT 2015 All rights reserved. Online Trust Alliance (OTA) Slide 8 4
5 Internet Retailer Top All rights reserved. Online Trust Alliance (OTA) Slide 9 Baseline Category Scores 2015 All rights reserved. Online Trust Alliance (OTA) Slide 10 5
6 Range and Median by Sector Online Trust Index is the total of baseline points and bonus/penalty points, normalized to All rights reserved. Online Trust Alliance (OTA) Slide 11 Honor Roll vs. Failures 2015 All rights reserved. Online Trust Alliance (OTA) Slide 12 6
7 Reasons for Failure 2015 All rights reserved. Online Trust Alliance (OTA) Slide 13 Brand Protection Base points authentication SPF and DKIM at top-level and subdomains DMARC record and policy Policy=Reject for max points Bonus points TLS for DNSSEC Penalty points Italics = new in 2015 Domain locking (not locked) Security Brand Protection Privacy Best practices to help detect and prevent malicious and spoofed and protect corporate domains 2015 All rights reserved. Online Trust Alliance (OTA) Slide 14 7
8 Authentication Overview SPF Authenticates Message Path Authorized senders in DNS DKIM Authenticates Message Content Public encryption keys in DNS DMARC Consistency A method to leverage the best of SPF and DKIM Policy Senders can declare how to process unauthenticated Visibility Reports on how receivers process received Aggregated Insights Telemetry into mail streams (RUA) Failure & Spoofed reports (RUF) 2015 All rights reserved. Online Trust Alliance (OTA) Slide 15 Transport Layer Security Rapidly being adopted standard for secure . TLS uses Public Key Infrastructure (PKI) to encrypt messages between mail servers. This encryption makes it difficult for hackers to intercept and read messages. TLS supports the use of digital certificates to authenticate the receiving servers. Authentication of sending servers is optional. This process verifies receivers (or senders) are who they say they are, which helps to prevent spoofing All rights reserved. Online Trust Alliance (OTA) Slide 16 8
9 and Brand Protection 2015 All rights reserved. Online Trust Alliance (OTA) Slide 17 Authentication Adoption Best practice is to support both SPF and DKIM Adoption of both grew in all sectors Use of DMARC records grew in all sectors, but is low Use of policy (reject or quarantine) lagging 2015 All rights reserved. Online Trust Alliance (OTA) Slide 18 9
10 Concerns Brand Protection Lack of DKIM at top-level domain Only 31% overall though 76% have at least some DKIM Lack of DMARC record and policy assertion Only 17% overall have a DMARC record though 92% support some form of authentication Protection of parked domains 2015 All rights reserved. Online Trust Alliance (OTA) Slide 19 Infrastructure Security Base points Server & SSL implementation Anti-bot Domain validation cert Bonus points EV SSL AOSSL Web App Firewall Penalty points Italics = new in 2015 XSS / iframe vulnerabilities Malware Malicious links Security Brand Protection Privacy Best practices to secure data in transit and collected by websites and prevent malicious exploits running against clients devices including desktop, mobile and IoT devices 2015 All rights reserved. Online Trust Alliance (OTA) Slide 20 10
11 SSL/TLS Deployment Best Practices Observed Issues Support of TLS 2.0 Beast Attack Mismatched certs Cross site scripting iframes exploits SHA1 depreciation weak signature, need to upgrade to SHA2 Poodle attack Servers accepting RC4 cipher FREAK Exploits Lack of support of Forward Secrecy with the reference browsers 2015 All rights reserved. Online Trust Alliance (OTA) Slide 21 Enhanced SSL Criteria Two new grades, A+ (100 pts) and A- (90 pts), allow for finer grading. Support for TLS 1.2 required for an A. If not, grade is capped at B. Key lengths below 2048-bit capped at B (below 1024-bit receive an F) MD5 certificate signatures considered insecure, receive an F Warnings servers with good configuration, but one or more warnings, are reduced to an A- Servers not supporting Forward Secrecy receive a warning Servers that do not support secure renegotiation receive a warning Servers that use RC4 with TLS 1.1 or TLS 1.2 receive a warning 2015 All rights reserved. Online Trust Alliance (OTA) Slide 22 11
12 Current Testing Dynamic threat landscape 2015 All rights reserved. Online Trust Alliance (OTA) Slide 23 AOSSL Bonus Points Best practice to secure data for the entire session (not just during/after login) Many sites have moved to AOSSL All rights reserved. Online Trust Alliance (OTA) Slide 24 12
13 Site and Server Security Summary 2015 All rights reserved. Online Trust Alliance (OTA) Slide 25 Concerns Site Security Vulnerabilities constantly emerging sites must keep pace with latest protocols/configuration SHA2 will be required soon (only 51% adoption overall) AOSSL will soon impact interaction with browsers, SEO (only 24% adoption overall) Often a case of operational discipline; vs technical resources All rights reserved. Online Trust Alliance (OTA) Slide 26 13
14 Privacy Base points Privacy policy Third-party trackers on site Bonus points Layered privacy policies Multi-lingual policies Use of Icons Do Not Track status, policy Tag mgmt or privacy solution Penalty points WHOIS (if Private vs Public) Data Breach Incidents Italics = new in 2015 FTC / State Settlements Security Brand Protection Privacy Best practices providing users clear notice and control of the data being collected, tracked and shared with third parties 2015 All rights reserved. Online Trust Alliance (OTA) Slide 27 Privacy Scores and Monitoring 2015 All rights reserved. Online Trust Alliance (OTA) Slide 28 14
15 Privacy Policy and Disclosures 2015 All rights reserved. Online Trust Alliance (OTA) Slide 29 Privacy Bonus Points Layered Notice & Icons Publishers Clearing House Reduced word count from over 4,000 words to 475! Adds clarity, readability & transparency Added bonus points for icons 2015 All rights reserved. Online Trust Alliance (OTA) Slide 30 15
16 Concerns Privacy Though scores rose, improvement is still needed in privacy policy statements (less data sharing and retention, clear disclosure) Miniscule support of icons and multi-lingual policies 2015 All rights reserved. Online Trust Alliance (OTA) Slide 31 Next Steps Continually monitor Your site & SSL configuration streams including top level and all sub domains Privacy policy, practices and those of your partners Make Security & Privacy part of your company DNA Give feedback into the 2016 audit methodology Get involved with OTA! 2015 All rights reserved. Online Trust Alliance (OTA) Slide 32 16
17 Tools & Resources Online Trust Honor Roll Methodology, past reports and related resources Infographic Security SPF/DMARC Record Validator TLS for SSL Server Test Always On SSL (AOSSL) - Extended Validation (EV) Data Protection & Breach Readiness Guide Internet of Things OTA All rights reserved. Online Trust Alliance (OTA) Slide 33 17
2015 Online Trust Audit & Honor Roll Methodology
2015 Online Trust Audit & Honor Roll Methodology Jeff Wilbur VP Marketing, Iconix Craig Spiezle Executive Director & President, OTA 2015 All rights reserved. Online Trust Alliance (OTA) Slide 1 Who Is
2016 Online Trust Audit Webinar Will Start Shortly
2016 Online Trust Audit Webinar Will Start Shortly Webinar will be recorded Presentation will be posted at https://otalliance.org/honorroll 2016 Online Trust Audit Madelon Smith VP, Director of Strategic
About Us. Overview Integrity Audit Fighting Malicious & Deceptive August 13, 2014
2014 Email Integrity Audit Fighting Malicious & Deceptive Email August 13, 2014 Craig Spiezle Executive Director & President, OTA Mike Jones Director of Product Management, Agari About Us The Online Trust
2016 Online Trust Audit Authentication Practices Deep Dive & Reality Check
2016 Online Trust Audit Email Authentication Practices Deep Dive & Reality Check July 20, 2016 Craig Spiezle Executive Director Online Trust Alliance https://otalliance.org/dmarc 2016 All rights reserved.
Are You Protecting Your & Your Customers? Learnings from the 2017 OTA Trust Audit. August 1, 2017
Are You Protecting Your Email & Your Customers? Learnings from the 2017 OTA Trust Audit August 1, 2017 2017 All rights reserved. Online Trust Alliance (OTA) Slide 1 Panel Kevin Gallant Manager, Intelligence
Jeff Wilbur VP Marketing Iconix
2016 Data Protection & Breach Readiness Guide February 3, 2016 Craig Spiezle Executive Director & President Online Trust Alliance Jeff Wilbur VP Marketing Iconix 1 Who is OTA? Mission to enhance online
2016 Data Protection & Breach Readiness Webinar Will Start Shortly. please download the guide at
2016 Data Protection & Breach Readiness Webinar Will Start Shortly please download the guide at https://otalliance.org/breach 1 2016 Data Protection & Breach Readiness Guide February 3, 2016 Craig Spiezle
2017 Cyber Incident & Breach Readiness Webinar Will Start Shortly
2017 Cyber Incident & Breach Readiness Webinar Will Start Shortly please download the guide at https://otalliance.org/incident 2017 Cyber Incident & Breach Readiness Webinar Craig Spiezle Executive Director
Is Your Marketing Trustworthy? Best Practices & Findings from Auditing 200 Top Retailers. December 13, 2017
Is Your Email Marketing Trustworthy? Best Practices & Findings from Auditing 200 Top Retailers December 13, 2017 2017 All rights reserved. Online Trust Alliance (OTA) Slide 1 Panel Sam Silberman Director
OTA Strategic Update Building & Amplifying April 5, 2017
OTA Strategic Update Building & Amplifying April 5, 2017 Reminders OTA Members Only Chatham House Rules Will be Recorded for Member Access Updated 4/7/17 OTA Strategic Update Building & Amplifying Craig
About Us. Unsub Best Practices & Audit A Decade Since CAN-SPAM. Unsub Best Practices & Audit A Decade Since CAN-SPAM September 30, 2014
Unsub Best Practices & Audit A Decade Since CAN-SPAM The Webinar Will Start Shortly Please submit questions in the GoToMeeting Question Pane Reference the 2014 Unsub Report & Resources https://otalliance.org/best-practices/unsubscribe
OTA & IoT A Shared & Collaborative Responsibility. 24 October 2017
OTA & IoT A Shared & Collaborative Responsibility 24 October 2017 Online Trust Alliance Founded as Industry Trade Organisation in 2007 65 members (e.g. DigiCert, Symantec, Verisign, Microsoft, Twitter,
IoT Security & Privacy Trust Framework v2.5
IoT Security & Privacy Trust Framework v2.5 The IoT Trust Framework includes a set of strategic principles necessary to help secure IOT devices and their data when shipped and throughout their entire life-cycle.
Trusted Identities. Foundational to Cloud Services LILA KEE CHIEF PRODUCT OFFICER GLOBALSIGN
Trusted Identities Foundational to Cloud Services LILA KEE CHIEF PRODUCT OFFICER GLOBALSIGN WHAT YOU WILL LEARN TODAY Strong identity verification as a security measure and business enabler Authentication
A Federal Agency Guide to Complying with Binding Operational Directive (BOD) 18-01
Table of Contents Introduction... 2 Required Actions Overview... 2 Required Actions Email Security... 3 Required Actions Web Security... 9 Status of Implementation... 11 Roles and Responsibilities... 11
building an effective action plan for the Department of Homeland Security
Customer Guide building an effective action plan for the Department of Homeland Security Binding The recently issued directive from the Department of Homeland Security (DHS), Binding Operational Directive
DigiCert Products. SSL Certificates
DigiCert Products A leading online trust provider, DigiCert offers multiple products to suit the security needs of enterprises within the finance, healthcare, education, government and Fortune 500 sectors.
SSL Server Rating Guide
SSL Server Rating Guide version 2009k (14 October 2015) Copyright 2009-2015 Qualys SSL Labs (www.ssllabs.com) Abstract The Secure Sockets Layer (SSL) protocol is a standard for encrypted network communication.
Achieving End-to-End Security in the Internet of Things (IoT)
Achieving End-to-End Security in the Internet of Things (IoT) Optimize Your IoT Services with Carrier-Grade Cellular IoT June 2016 Achieving End-to-End Security in the Internet of Things (IoT) Table of
DMARC Continuing to enable trust between brand owners and receivers
DMARC Continuing to enable trust between brand owners and receivers February 2014 1 DMARC Defined DMARC stands for: Domain-based Message Authentication, Reporting & Conformance (pronounced dee-mark ) 2
SSL Visibility and Troubleshooting
Page 1 of 6 view online Avi Vantage provides a number of features to help understand the utilization of SSL traffic and troubleshoot SSL-related issues. Visibility Every virtual service provides a number
Protecting Against Online Fraud. F5 EMEA Webinar August 2014
Protecting Against Online Fraud F5 EMEA Webinar August 2014 Agenda Fraud threat trends and business challenges Web fraud protection Mobile fraud protection Security operations center Example architecture
IT Security Mandatory Solutions. Andris Soroka 2nd of July, RIGA
IT Security Mandatory Solutions Andris Soroka 2nd of July, 2014 @LPS, RIGA Data Security Solutions business card Specialization IT Security IT Security services (consulting, audit, pen-testing, market
TLS 1.1 Security fixes and TLS extensions RFC4346
F5 Networks, Inc 2 SSL1 and SSL2 Created by Netscape and contained significant flaws SSL3 Created by Netscape to address SSL2 flaws TLS 1.0 Standardized SSL3 with almost no changes RFC2246 TLS 1.1 Security
Security
Security +617 3222 2555 info@citec.com.au Security With enhanced intruder technologies, increasingly sophisticated attacks and advancing threats, your data has never been more susceptible to breaches from
Security by Any Other Name:
Security by Any Other Name: On the Effectiveness of Provider Based Email Security Ian Foster, Jon Larson, Max Masich, Alex C. Snoeren, Stefan Savage, and Kirill Levchenko University of California, San
Office 365: Secure configuration
Office 365: Secure email configuration Published September 2017 Copyright 2017 Health and Social Care Information Centre. The Health and Social Care Information Centre is a non-departmental body created
Security Secure Information Sharing
ASD Convention Workshop 6 e-standards: a Strategic Asset across the Value Chain Security Secure Information Sharing Steve SHEPHERD Executive Director UK CeB Istanbul, 6 October 2011 1 Information security
DMARC ADOPTION AMONG
DMARC ADOPTION AMONG Top US Colleges and Universities Q1 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 Top US Colleges
Introduction to Device Trust Architecture
Introduction to Device Trust Architecture July 2018 www.globalplatform.org 2018 GlobalPlatform, Inc. THE TECHNOLOGY The Device Trust Architecture is a security framework which shows how GlobalPlatform
Cirius Secure Messaging Enterprise Dedicated Cloud
Secure messaging and message control that is flexible to data jurisdiction, integrates rapidly into Office 365 and Outlook, and supports regulatory compliance. Enterprise organizations are recognizing
Comodo Certificate Manager Software Version 5.0
Comodo Certificate Manager Software Version 5.0 Introducing The Certificate Dashboard Comodo CA Limited, 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Greater Manchester M5 3EQ,
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you
Cloud Security & Advance Threat Protection. Cloud Security & Advance Threat Protection
Cloud Email Security & Advance Threat Protection Cloud Email Security & Advance Threat Protection Overview Over the years Cyber criminals have become more inventive in their attack methods to infiltrate
Implementing the Administration's Critical Infrastructure and Cybersecurity Policy
Implementing the Administration's Critical Infrastructure and Cybersecurity Policy Cybersecurity Executive Order and Critical Infrastructure Security & Resilience Presidential Policy Directive Integrated
Better Mutual Authentication Project
Better Mutual Authentication Project Recommendations & Requirements for Improving Web Authentication for Retail Financial Services Presented to W3C Workshop on: Transparency & Usability of Web Authentication
DMARC ADOPTION AMONG. SaaS 1000 Q Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok
DMARC ADOPTION AMONG SaaS 1000 Q1 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 SaaS 1000... 05 DMARC Adoption Among SaaS
CipherPost Pro Enterprise Dedicated Cloud
Feature Sheet CipherPost Pro Enterprise Dedicated Cloud Secure messaging and message control that is flexible to data jurisdiction, integrates rapidly into Office 365 and Outlook and supports regulatory
The National Medical Device Information Sharing & Analysis Organization (MD-ISAO) Initiative Session 2, February 19, 2017 Moderator: Suzanne
The National Medical Device Information Sharing & Analysis Organization (MD-ISAO) Initiative Session 2, February 19, 2017 Moderator: Suzanne Schwartz, Assoc. Dir., CDRH, FDA Denise Anderson, MBA, President,
Data Security and Privacy : Compliance to Stewardship. Jignesh Patel Solution Consultant,Oracle
Data Security and Privacy : Compliance to Stewardship Jignesh Patel Solution Consultant,Oracle Agenda Connected Government Security Threats and Risks Defense In Depth Approach Summary Connected Government
Wireless e-business Security. Lothar Vigelandzoon
Wireless e-business Security Lothar Vigelandzoon E-business evolution Increased business drivers for cost efficiency & market penetration Increased Importance of brand reputation Distance between IT and
DMARC ADOPTION AMONG e-retailers
DMARC ADOPTION AMONG e-retailers Q1 2018 Almost 90% of Top US and EU e-retailer Domains Fail to Protect Consumers from Phishing Attacks Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE
What It Takes to be a CISO in 2017
What It Takes to be a CISO in 2017 Doug Copley Deputy CISO Sr. Security & Privacy Strategist February 2017 IMAGINE You re the CISO In Bangladesh Of a bank On a Friday when you re closed You realize 6 huge
Government IT Modernization and the Adoption of Hybrid Cloud
Government IT Modernization and the Adoption of Hybrid Cloud An IDC InfoBrief, Sponsored by VMware June 2018 Federal and National Governments Are at an Inflection Point Federal and national governments
DMARC ADOPTION AMONG
DMARC ADOPTION AMONG US and UK Nonprofit Organizations Q2 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 US and UK Nonprofit
DMARC ADOPTION AMONG e-retailers
DMARC ADOPTION AMONG e-retailers Q1 2018 Almost 90% of Top US and EU e-retailer Domains Fail to Protect Consumers from Phishing Attacks Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE
Towards Trustworthy Internet of Things for Mission-Critical Applications. Arjmand Samuel, Ph.D. Microsoft Azure - Internet of Things
Towards Trustworthy Internet of Things for Mission-Critical Applications Arjmand Samuel, Ph.D. Microsoft Azure - Internet of Things Internet of Things is a game changer Organizations are benefiting from
Defense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
Securing Network Devices with the IEC Standard What You Should Know. Vance Chen Product Manager
with the IEC 62443-4-2 Standard What You Should Know Vance Chen Product Manager Industry Background As the Industrial IoT (IIoT) continues to expand, more and more devices are being connected to networks.
CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001)
CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001) Gregg, Michael ISBN-13: 9781118083192 Table of Contents Foreword xxi Introduction xxvii Assessment Test xliv Chapter 1 Cryptographic
Best Practices in Securing a Multicloud World
Best Practices in Securing a Multicloud World Actions to take now to protect data, applications, and workloads We live in a multicloud world. A world where a multitude of offerings from Cloud Service Providers
TLS1.2 IS DEAD BE READY FOR TLS1.3
TLS1.2 IS DEAD BE READY FOR TLS1.3 28 March 2017 Enterprise Architecture Technology & Operations Presenter Photo Motaz Alturayef Jubial Cyber Security Conference 70% Privacy and security concerns are
13.f Toronto Catholic District School Board's IT Strategic Review - Draft Executive Summary (Refer 8b)
AGENDA ADDENDU TE REGULAR EETING OF TE AUDIT COITTEE COITTEE PUBLIC SESSION Tuesday, June 6, 2017 6:30 P.. Pages 13. Staff Reports 13.f Toronto Catholic District School Board's IT Strategic Review - Draft
DMARC ADOPTION AMONG
DMARC ADOPTION AMONG Top US Colleges and Universities Q1 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 Top US Colleges
RHM Presentation. Maas 360 Mobile device management
RHM Presentation Maas 360 Mobile device management Strong adoption in the enterprise Manufacturing Financial Consumer Healthcare Public Others 2 Trusted by over 9,000 customers Recognized Industry Leadership
How do you decide what s best for you?
How do you decide what s best for you? Experience Transparency Leadership Commitment Cost reduction Security Trustworthiness Credibility Confidence Reliability Compliance Privacy Expertise Flexibility
DigiCert Certified Partner Program. Delivering Confidence for Customers and Consumers by Securing Websites and Applications
DigiCert Certified Program Delivering Confidence for Customers and Consumers by Securing Websites and Applications Table Of Contents 3 Introduction 4 About this Guide 5 Program Structure 6 Program Benefits
PCI DSS and VNC Connect
VNC Connect security whitepaper PCI DSS and VNC Connect Version 1.2 VNC Connect security whitepaper Contents What is PCI DSS?... 3 How does VNC Connect enable PCI compliance?... 4 Build and maintain a
Delivering Integrated Cyber Defense for the Cloud Generation Darren Thomson
Delivering Integrated Cyber Defense for the Generation Darren Thomson Vice President & CTO, EMEA Region Symantec In 2009 there were 2,361,414 new piece of malware created. In 2015 that number was 430,555,582
Bringing Cybersecurity to the Boardroom Bret Arsenault
SESSION ID: CXO-T11 Bringing Cybersecurity to the Boardroom Bret Arsenault Corporate Vice President & CISO Microsoft Security has Transcended from to a an 3 How Microsoft Approaches Security Reinventproductivity
Best Practices in Securing Your Customer Data in Salesforce, Force.com & Chatter
White Paper Best Practices in Securing Your Customer Data in Salesforce, Force.com & Chatter Overcoming Security, Privacy & Compliance Concerns 333 W. San Carlos Street San Jose, CA 95110 Table of Contents
DMARC ADOPTION AMONG. SaaS 1000 Q Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok
DMARC ADOPTION AMONG SaaS 1000 Q1 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 SaaS 1000... 05 DMARC Adoption Among SaaS
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
Safeguarding company from cyber-crimes and other technology scams ASSOCHAM
www.pwc.com Safeguarding company from cyber-crimes and other technology scams ASSOCHAM Rahul Aggarwal - Director The new digital business ecosystem is complex and highly interconnected The new business
Monthly Cyber Threat Briefing
Monthly Cyber Threat Briefing January 2016 1 Presenters David Link, PM Risk and Vulnerability Assessments, NCATS Ed Cabrera: VP Cybersecurity Strategy, Trend Micro Jason Trost: VP Threat Research, ThreatStream
Digital Health Cyber Security Centre
Digital Health Cyber Security Centre Current challenges Ransomware According to the ACSC Threat Report 2017, cybercrime is a prevalent threat for Australia. Distributed Denial of Service (DDoS) Targeting
Enhancing the Cybersecurity of Federal Information and Assets through CSIP
TECH BRIEF How BeyondTrust Helps Government Agencies Address Privileged Access Management to Improve Security Contents Introduction... 2 Achieving CSIP Objectives... 2 Steps to improve protection... 3
European Union Agency for Network and Information Security
Critical Information Infrastructure Protection in the EU Evangelos Ouzounis Head of Secure Infrastructure and Services Regional Cybersecurity Forum Sofia, Bulgaria 29 th November 2016 European Union Agency
MEDICAL DEVICE CYBERSECURITY: FDA APPROACH
MEDICAL DEVICE CYBERSECURITY: FDA APPROACH CYBERMED SUMMIT JUNE 9TH, 2017 SUZANNE B. SCHWARTZ, MD, MBA ASSOCIATE DIRECTOR FOR SCIENCE & STRATEGIC PARTNERSHIPS CENTER FOR DEVICES AND RADIOLOGICAL HEALTH
Comodo Certificate Manager Software Version 5.6
Comodo Certificate Manager Software Version 5.6 Introducing The Certificate Dashboard Comodo CA Limited, 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Greater Manchester M5 3EQ,
Managing Microsoft 365 Identity and Access
Course MS-500T01-A: Managing Microsoft 365 Identity and Access Page 1 of 3 Managing Microsoft 365 Identity and Access Course MS-500T01-A: 1 day; Instructor-Led Introduction Help protect against credential
IT Security Training MS-500: Microsoft 365 Security Administration. Upcoming Dates. Course Description. Course Outline $2,
IT Security Training MS-500: Microsoft 365 Security Administration $2,595.00 4 Days Upcoming Dates Course Description Day 1: Managing Microsoft 365 Identity and Access (MS-500T01-A) Help protect against
KantanMT.com. Security & Infra-Structure Overview
KantanMT.com Security & Infra-Structure Overview Contents KantanMT Platform Security... 2 Customer Data Protection... 2 Application Security... 2 Physical and Environmental Security... 3 ecommerce Transactions...
CISCO NETWORKS BORDERLESS Cisco Systems, Inc. All rights reserved. 1
CISCO BORDERLESS NETWORKS 2009 Cisco Systems, Inc. All rights reserved. 1 Creating New Business Models The Key Change: Putting the Interaction Where the Customer Is Customer Experience/ Innovation Productivity/
En partenariat avec CA Technologies. Genève, Hôtel Warwick,
SIGS Afterwork Event in Geneva API Security as Part of Digital Transformation Projects The role of API security in digital transformation Nagib Aouini, Head of Cyber Security Services Defense & Cyber Security
Mobility, Security Concerns, and Avoidance
By Jorge García, Technology Evaluation Centers Technology Evaluation Centers Mobile Challenges: An Overview Data drives business today, as IT managers and security executives face enormous pressure to
Introduction and Overview. Why CSCI 454/554?
Introduction and Overview CSCI 454/554 Why CSCI 454/554? Get Credits and Graduate Security is important More job opportunities More research funds 1 Workload Five homework assignments Two exams (open book
Your Apps and Evolving Network Security Standards
Session System Frameworks #WWDC17 Your Apps and Evolving Network Security Standards 701 Bailey Basile, Secure Transports Engineer Chris Wood, Secure Transports Engineer 2017 Apple Inc. All rights reserved.
Students should have an understanding and a working knowledge in the following topics, or attend these courses as a pre-requisite:
Secure Java Web Application Development Lifecycle - SDL (TT8325-J) Day(s): 5 Course Code: GK1107 Overview Secure Java Web Application Development Lifecycle (SDL) is a lab-intensive, hands-on Java / JEE
Controlled Document Page 1 of 6. Effective Date: 6/19/13. Approved by: CAB/F. Approved on: 6/19/13. Version Supersedes:
Page 1 of 6 I. Common Principles and Approaches to Privacy A. A Modern History of Privacy a. Descriptions, definitions and classes b. Historical and social origins B. Types of Information a. Personal information
Who s Protecting Your Keys? August 2018
Who s Protecting Your Keys? August 2018 Protecting the most vital data from the core to the cloud to the field Trusted, U.S. based source for cyber security solutions We develop, manufacture, sell and
Overview of SSL/TLS. Luke Anderson. 12 th May University Of Sydney.
Overview of SSL/TLS Luke Anderson luke@lukeanderson.com.au 12 th May 2017 University Of Sydney Overview 1. Introduction 1.1 Raw HTTP 1.2 Introducing SSL/TLS 2. Certificates 3. Attacks Introduction Raw
Security by Default: Enabling Transformation Through Cyber Resilience
Security by Default: Enabling Transformation Through Cyber Resilience FIVE Steps TO Better Security Hygiene Solution Guide Introduction Government is undergoing a transformation. The global economic condition,
Changing face of endpoint security
Changing face of endpoint security S A N T H O S H S R I N I V A S A N C I S S P, C I S M, C R I S C, C E H, C I S A, G S L C, C G E I T D I R E C T O R S H A R E D S E R V I C E S, H C L T E C H N O L
PCI DSS and the VNC SDK
RealVNC Limited 2016. 1 What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) compliance is mandated by many major credit card companies, including Visa, MasterCard, American Express,
Phishing Discussion. Pete Scheidt Lead Information Security Analyst California ISO
Phishing Discussion Pete Scheidt Lead Information Security Analyst California ISO 2 Phish What is Phishing Types of Phish 3 Phish What is Phishing Attackers (Phishers) would email (cast their nets) far
Cybersecurity The Evolving Landscape
Cybersecurity The Evolving Landscape 1 Presenter Zach Shelton, CISA Principal DHG IT Advisory Zach.Shelton@DHG.com Raleigh, NC 14+ years of experience in IT Consulting 11+ years of experience with DHG
ANATOMY OF A DATA BREACH: DEVELOPMENTS IN DATA SECURITY AND CLOUD COMPUTING LAW
ANATOMY OF A DATA BREACH: DEVELOPMENTS IN DATA SECURITY AND CLOUD COMPUTING LAW Janis Kestenbaum (Federal Trade Commission) John O Tuel (GlaxoSmithKline) Alfred Saikali (Shook Hardy & Bacon) Christopher
Welcome to the CyberSecure My Business Webinar Series We will begin promptly at 2pm EDT All speakers will be muted until that time
TM Plan. Protect. Respond. Welcome to the CyberSecure My Business Webinar Series We will begin promptly at 2pm EDT All speakers will be muted until that time Registration is open for the April webinar:
SHA-1 to SHA-2. Migration Guide
SHA-1 to SHA-2 Migration Guide Web-application attacks represented 40 percent of breaches in 2015. Cryptographic and server-side vulnerabilities provide opportunities for cyber criminals to carry out ransomware
Achieving Cyber-Readiness through Information Sharing Analysis Organizations (ISAOs)
Achieving Cyber-Readiness through Information Sharing Analysis Organizations (ISAOs) Florida Hospital Association Welcome! John Wilgis Director, Emergency Management Services Florida Hospital Association
Cloud SSL Certificate Services
Cloud SSL Certificate Services Security Beyond the Certificate 0844 334 3347 www.cloudssl.co.uk Why Cloud SSL? Trusted by more than 5,000 organizations in 85 countries Complete line of digital certificates
IBM SmartCloud Notes Security
IBM Software White Paper September 2014 IBM SmartCloud Notes Security 2 IBM SmartCloud Notes Security Contents 3 Introduction 3 Service Access 4 People, Processes, and Compliance 5 Service Security IBM
Discussion on MS contribution to the WP2018
Discussion on MS contribution to the WP2018, 30 January 2018 European Union Agency for Network and Information Security Possibilities for MS contribution to the WP2018 Expert Groups ENISA coordinates several
CERT Symposium: Cyber Security Incident Management for Health Information Exchanges
Pennsylvania ehealth Partnership Authority Pennsylvania s Journey for Health Information Exchange CERT Symposium: Cyber Security Incident Management for Health Information Exchanges June 26, 2013 Pittsburgh,
Security Best Practices. For DNN Websites
Security Best Practices For DNN Websites Mitchel Sellers Who am I? Microsoft MVP, ASPInsider, DNN MVP Microsoft Certified Professional CEO IowaComputerGurus, Inc. Contact Information msellers@iowacomputergurus.com
Medical Device Cybersecurity: FDA Perspective
Medical Device Cybersecurity: FDA Perspective Suzanne B. Schwartz MD, MBA Associate Director for Science and Strategic Partnerships Office of the Center Director (OCD) Center for Devices and Radiological
Cloud Customer Architecture for Securing Workloads on Cloud Services
Cloud Customer Architecture for Securing Workloads on Cloud Services http://www.cloud-council.org/deliverables/cloud-customer-architecture-for-securing-workloads-on-cloud-services.htm Webinar April 19,
BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE
BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE 1 WHAT IS YOUR SITUATION? Excel spreadsheets Manually intensive Too many competing priorities Lack of effective reporting Too many consultants Not
Cyber Security and Cyber Fraud
Cyber Security and Cyber Fraud Remarks by Andrew Ross Director, Payments and Cyber Security Canadian Bankers Association for Senate Standing Committee on Banking, Trade, and Commerce October 26, 2017 Ottawa