CISO , Cybersecurity , Governance

Cybersecurity Employment at Record Levels, But Still Doesn't Meet Demand Eric Chabrow (GovInfoSecurity) • October 13, 2016     Competitors at a U.S. Cyber Challenge competition. (Photo: Eric Chabrow)

Although an analysis of the latest government statistics confirms continued growth in the information security workforce, the supply of security expertise isn't meeting the demand.

See Also: Managing Identity, Security and Device Compliance in an IT World

Information Security Media Group's analysis of the latest quarterly employment numbers from the U.S. Bureau of Labor Statistics shows the size of the information security analysts workforce has soared by 68 percent since the BLS began producing these jobs reports in 2011.

In the third quarter, the number of workers in the United States who consider themselves information security analysts stood at an annualized 88,000, up from 80,500 in the second quarter and 72,800 a year earlier.

Information Security Analysts Workforce

ISMG analysis of U.S. Bureau of Labor Statistics data

Numerous efforts are underway to help boost the security workforce. For example, in the past decade, scores of colleges and universities have introduced information security degree programs. Also, many companies have identified workers, often with programming and other computer expertise, and provided them the training to become information security professionals. Among the best known programs are competitions, such as those sponsored by the U.S. Cyber Challenge, which introduces students and young workers to cybersecurity and allows them to participate in contests that tests their security skills.

"The cyber challenges around the country - and world - are a positive influence on building the workforce," says Elise Yacobellis, manager of the Global Information Security Workforce Survey published by (ISC)2, an international, not-for-profit organization that provides IT security education and certification. "They're exposing IT security as a separate profession that could be sought out versus just the IT field. It helps them understand at a hands-on level what they'll possibly be doing if they were to move into this career. And, it also helps them understand if they like it, they have the aptitude for it and this is something they want to pursue."

None of these programs are flooding the job market with IT security specialists, although they're apparently beginning to help add personnel to the cybersecurity employment rolls.

Demand Outstrips Supply

But despite the pickup in the pace of the growth of information security analysts, the supply of IT security expertise isn't meeting the demand. A 2015 study by Frost & Sullivan for (ISC)2 projects a shortfall in worldwide IT security specialist of 1.5 million by 2019.

"Growth is very shallow and is at risk from the perspective that we clearly don't have a good number of deeply experienced professionals in this field," says Danny Miller, systems CISO at Texas A&M University. "I know of companies that have lots of openings, but no qualified personnel to fill them."

Still, IT security expertise can be found in other computer fields, especially database administrators, network and computer systems administrators, computer systems analysts and computer network architects.

And those occupations also are experiencing growth. Computer occupations have seen a steady climb, with more than 5 million people working or seeking work in a variety of information technology jobs, according to the ISMG analysis. That's a jump of 22 percent - or 4.6 percent annualized - since the BLS implemented its new way to calculate employment at the beginning of decade, according to the ISMG analysis.

Computer Occupations Workforce

Third quarter, 2016

Occupations	Size
Computer and information systems managers	619,000
Computer and information research scientists	24,000
Computer systems analysts	528,000
Computer programmers	483,500
Software developers, applications and systems software	1,477,800
Web developers	222,800
Computer support specialists	556,800
Database administrators	98,000
Computer occupations, all other	604,500
Total	5,041,500

Source: ISMG analysis of U.S. Bureau of Labor Statistics

Defining InfoSec Occupations

BLS defines information security analysts as those who plan, implement, upgrade or monitor security measures for the protection of computer networks and information. They may ensure appropriate security controls are in place that will safeguard digital files and vital electronic infrastructure and respond to computer security breaches and viruses. Job titles could include computer security specialists, network security specialists and internet security specialist.

Historically, the BLS numbers have reflected IT and information security employment trends. Because of the sample size of the survey, it's not statistically reliable for the information security analysts category. However, on recommendation of BLS economists, ISMG annualizes the survey results, which make them more reliable. That's attained by adding the latest four quarters worth of survey data and dividing the result by four. For example, to arrive at the 88,000 figure for the information security analyst workforce, ISMG took the reported numbers for the last quarter of 2015 and the first three quarters of 2016 then divided by four.

BLS recognizes that shortcomings exist in the way it defines IT and IT security occupations. The bureau says it's revising its Standard Occupation Classification and might add new information security occupation descriptions. BLS says it expects to publish shortly new SOCs that would take effect in 2018. The last update of the SOC occurred in 2010, with the first employment surveys based on it occurring in 2011.

Culling Employment Data

For this report, the workforce numbers come from the government's Current Population Survey of American households, the same survey BLS uses to determine the monthly unemployment rate. Survey takers interviewing households ask respondents characteristics about their jobs and then determine their appropriate occupation category.

BLS each quarter furnishes, upon request, a breakdown of 535 job categories, including the ones labeled information security analysts, database administrators and network and computer systems administrators. Because the survey size for some individual occupation categories, such as information security analysts, is too small to be statistically reliable, BLS neither officially publishes this data, nor claims it's reliable.

Compliance , Cybersecurity , Risk Management

Senators Question Whether FTC Provided Lab with 'Due Process' Marianne Kolbasuk McGee (HealthInfoSec) • October 11, 2016     Senators Jeff Flake, R-Ariz. (left) and Mike Lee, R-Utah

Two Republican U.S. Senate subcommittee chairmen are demanding answers from the Federal Trade Commission about the "due process afforded" LabMD in the agency's data security enforcement case against the now-shuttered cancer testing laboratory.

See Also: Key Cybercrime Trends in 2016

Meanwhile, LabMD has requested that a federal appeals court issue an "emergency stay," or delay, in the FTC's enforcement of its order against LabMD pending the lab's appeal of the order in the court. The FTC recently rejected LabMD's stay request.

The FTC's final order, issued in July, requires, among other things, that LabMD establish a comprehensive information security program; obtain periodic independent, third-party assessments over the next 20 years regarding the implementation of the information security program; and notify consumers whose personal information was allegedly "exposed on a peer-to-peer network about the unauthorized disclosure of their personal information and about how they can protect themselves from identity theft or related harms."

Although LabMD stopped accepting specimen samples and conducting tests in January 2014, the company continues to exist as a corporation and has not ruled out a resumption of operations, the FTC notes. LabMD continues to maintain the personal information of approximately 750,000 consumers on its computer system, according to the agency.

LabMD CEO Michael Daugherty, who has portrayed the FTC's actions against his company as unfair, tells Information Security Media Group that he's pleased that the case is now being considered by the court. "We're really happy to be on a level playing field now," he says.

Senators' Letter

The Sept. 20 letter sent to FTC chairwoman Edith Ramirez by Sen. Jeff Flake, R-Ariz., chair of the Senate Subcommittee on Privacy, Technology and the Law, and Sen. Mike Lee, R-Utah, chair of the Senate Subcommittee on Antitrust, Competition and Consumer Rights, notes that the legislators are reviewing the facts pertaining to why the FTC commissioners decided in July to reverse a decision last fall by FTC's own administrative law judge, Michael Chappell, to dismiss the case against LabMD.

Chappell had ruled that the FTC's counsel had not shown that LabMD's data security practices either caused or were likely to cause substantial injury. In reversing Chappell's ruling, however, the FTC commissioners concluded that LabMD's data security practices constitute an unfair act or practice that violated Section 5 of the Federal Trade Commission Act.

Immediate Concern

The senators, in their letter to the FTC, express concern about "the extent to which the FTC's cybersecurity regime complies with the protections of due process under the constitution." They ask FTC's Ramirez several questions about the agency's cybersecurity enforcement efforts, including:

What, if any, guidance has the FTC given as to how small businesses are to weigh the costs and benefits of data security? How does the relative size or sophistication of a business affect the extent to which the FTC's enforcement activities provide the business with notice of their cybersecurity obligations? How many other cybersecurity enforcements had the FTC completed prior to LabMD's 2008 incident?

A spokeswoman for Flake tells ISMG that the senators have not yet received an FTC response to the letter. Neither Lee nor FTC immediately responded to ISMG's request for comment.

Previous Scrutiny

The FTC complaint against LabMD, filed in August 2013, alleged that a LabMD spreadsheet containing insurance billing information was found on a peer-to-peer network in 2008. The spreadsheet allegedly contained sensitive personal information for more than 9,000 consumers, putting individuals at risk for identity theft and medical identity theft, the FTC contends. LabMD's allegedly unsecured spreadsheet was discovered by peer-to-peer security firm Tiversa, which reported the matter to the FTC.

During testimony at the FTC's 2015 administrative hearing into the case, however, LabMD's Daugherty alleged that Tiversa reported false information to the FTC about the supposed security incident involving LabMD's data after the lab refused to buy Tiversa's remedial services. A former Tiversa employee also testified that it was a "common practice" for Tiversa to approach prospective clients with exaggerated information about their allegedly unsecured files that the security firm found "spreading" on the Internet in an attempt to sell the company's security monitoring and remedial services (see Bombshell Testimony in FTC's LabMD Case). Tiversa CEO Robert Boback, in a May 2015 statement provided to ISMG, called the former worker's testimony "purely baseless allegations from a terminated employee."

The recent letter from the senators to the FTC is just the latest Congressional scrutiny over the LabMD case. In 2014, the House Committee on Oversight and Government Reform conducted an investigation into the business practices of Tiversa (see LabMD Case: House Committee Gets Involved). A resulting staff report by the committee alleged that Tiversa "often acted unethically and sometimes unlawfully in its use of documents unintentionally exposed on peer-to-peer networks."

Lasting Legacy?

Privacy attorney Kirk Nahra of the law firm Wiley Rein says the long LabMD legal saga has been particularly unusual.

"I continue to believe that this LabMD case is essentially one-of-a-kind, given the relatively crazy twists and turns it has taken," he says. "I doubt the appeals court will stay the order only because it is generally hard to get an appeals court to stay an order. I also doubt that this case will have much overall impact on the FTC, until the time - if at all - that they get struck down on their approach."

As for the direction that FTC provides the private sector when it comes to data security issues, Nahra says: "The FTC, over time, has given a good amount of guidance, and generally has tried reasonably hard to convey to all kinds of businesses - small and large - what they should be doing in this area. The question of whether they should have their enforcement authority on these points without a specific regulation is a different issue."

A report on the verbal combat between Hillary Clinton and Donald Trump over whether the Russian government is using hacks to influence the U.S. presidential election leads the latest edition of the ISMG Security Report.

In the report, you'll hear (click player above to listen):

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Be sure to check out our Oct. 4 and Oct. 8 reports, which respectively analyze Trump's cybersecurity platform and the PCI Security Standards Council's new requirements that are designed to help thwart attempts to defeat encryption in point-of-sale devices. The next ISMG Security Report will be posted on Friday, Oct. 14.

Theme music for the ISMG Security Report is by Ithaca Audio under the Creative Commons license.

Data Breach , Fraud , Payments Fraud

Breach Dating Back to July Involved Malware Tracy Kitten (FraudBlogger) • October 12, 2016    

Fashion accessories retailer Vera Bradley says its payments processing system was compromised by a malware attack.

See Also: Secure Access in a Hybrid IT World

In a statement posted to its website on Oct. 12, the retailer says payment card transactions conducted between July 25 and Sept. 23 at some of its locations may have been affected. Vera Bradley operates stores in 35 states.

Online purchases do not appear to have been impacted by the incident, the retailer adds.

The company did not reveal the number of payment cards potentially impacted by the incident. The retailer did not immediately respond to Information Security Media Group's request for further details.

"Findings from the investigation show unauthorized access to Vera Bradley's payment processing system and the installation of a program that looked for payment card data," the retailer says in its statement. "The program was specifically designed to find track data in the magnetic stripe of a payment card - that may contain the card number, cardholder name, expiration date and internal verification code - as the data was being routed through the affected payment systems. There is no indication that other customer information was at risk."

Notified by Law Enforcement

Vera Bradley says it learned of a possible compromise of its network on Sept. 15 when it was contacted by law enforcement officials.

"Upon learning this information, we immediately notified the payment card networks and initiated an investigation with the assistance of a leading computer security firm to aggressively gather facts and determine the scope of the issue," the retailer says. "Findings from the investigation show unauthorized access to Vera Bradley's payment processing system and the installation of a program that looked for payment card data."

Vera Bradley says it has stopped the intrusion and is working with an unnamed security firm "to further strengthen the security" of its systems.

The retailer does not state whether it's providing identity theft protection or credit monitoring to customers who may have been impacted by the incident. The company has provided a hotline for consumers to call as well as links to credit-monitoring providers Equifax, Experian and TransUnion.

The fashion accessories retailer is the latest victim in a long series of payments system breaches that have involved stealing data from mag-stripe payment cards. Among some of the more noteworthy breaches of late are those that compromised fast-food chain Wendy's; apparel retailer Eddie Bauer; and hotel chains Hilton, Hyatt, Omni Hotels & Resorts, Starwood Hotels and Resorts , Trump Hotels, HEI Hotels & Resorts, Kimpton Hotels & Restaurants, Millennium Hotels & Resorts North America, Noble House Hotels and Resorts, and Hutton Hotels.

Mass Production Attacks

"Hackers no longer seem to be focused on a single merchant," says Alex Holden, CISO at security and forensics firm Hold Security. "They are focused on doing mass production attacks across multiple merchants, which makes it difficult to pinpoint the point of breach. That's extremely concerning to me, because this changes the game. It's not just individual merchants that have to protect themselves; it's also the support infrastructure, the POS systems and services providers - and they are typically not as secure as the merchants."

In Development

Receive Invite When Available

CISO , Cybersecurity , Governance

Why You Need a Cybersecurity Crisis Management Plan A CISO Offers Insights Based on Real-World Experience Dr. Shamoun Siddiqui • October 12, 2016     Dr. Shamoun Siddiqui, CISO, Nationstar Mortgage LLC

Understanding the difference between cybersecurity crisis management and security incident response could be critical to your organization's survival.

See Also: API vs. Proxy: Understanding How to Get the Best Protection from Your CASB

A security incident response plan focuses on day-to-day security issues, such as routine malware infections and distributed denial-of-service attacks. In contrast, a cybersecurity crisis management plan focuses on actions and processes that must be undertaken to protect and defend the reputation of the organization, its products and its services. Crisis situations could include mass loss of credit card numbers, Social Security numbers, financial information or protected health information.

So what can CISOs do to augment their security incident response plans with cybersecurity crisis management components? Here is some guidance based on my experience in dealing with a breach.

Involve Executive Leadership

In a crisis situation, the CEO and his direct reports are thrust in the forefront of responding to customers, local authorities, business partners and the media. They all want to respond quickly and mean well. However, I have seen them convey contradicting messages or provide too little or too much information that has complicated matters unnecessarily. Therefore, it is essential to train them ahead of time. These leaders need to be familiar with their specific functions and roles during a crisis and need to be able to follow a playbook.

Create Formal Cybersecurity Crisis Management Plan

Either include the following key elements in your incident response plan or preferably create a separate document with:

Name of executive stakeholders; Representation from legal, privacy, compliance and corporate communications; Delineation of specific roles and responsibilities for each of the executives; Threat matrix with severity levels and associated response protocols; Statements for customers, business partners, media and external agencies; Pre-crafted communication templates for breach notifications as required by state privacy laws; Arrangements to immediately provide identity and credit protection services to affected individuals.

I have found pre-crafted communication templates to be, perhaps, the single most useful element. During a crisis, it's really hard to come up with the right words to communicate with your customers and other interested third parties. In one specific instance in my past, a single notification to customers took over a week to finalize because information security, corporate communications and legal could not agree on the wording

What you say could make or break the organization. So, think through the various scenarios and come up with generic communication templates that have been reviewed by your company's corporate communications, compliance and legal departments.

The creation of the plan is just the first step. The second and more challenging step is to implement the plan across your company, including among senior executives.

Conduct Breach Simulations

Lead the executives and the critical leaders in a table top exercise that simulates a breach scenario. Find a reputable third party to help lead this effort.

An increasing number of companies are offering this service. The offerings range widely in content, format and pricing. Find something that works for you based on your budget and organizational culture. One of the best simulations that I have been part of was led by one of the big name consulting companies. They even had fake news videos showing how the media was reacting to the breach. You may not need to go to this extent, but you should look for a polished presentation that can hold the attention of your executives.

Engage a Forensics Company

Once a breach is detected, there is an extreme amount of urgency in investigating it or mitigating it. Support from forensics experts is generally required. In that moment of crisis, finding a suitable third party and putting together a master services agreement or a statement of work becomes a challenge.

Therefore, it is imperative that a company's information security, compliance and legal departments jointly spend time in evaluating and selecting potential security vendors ahead of time.

Involve Your Legal Team

One of the critical areas of focus during the course of a breach should be on "protecting the privilege." The attorney-client privilege is an invaluable mechanism to protect any sensitive communications or information (such as the cause of the breach or the extent of the loss of information) from being forcibly disclosed by any third parties, including customers, competitors and law enforcement authorities. Without such protection, an organization may be vulnerable to civil or criminal lawsuits. In fact, I have recently seen consulting companies disclose the results of their risk assessments to government agencies. The lawyers in your company will help you ensure that appropriate clauses are included in the MSA and the associated SOWs to keep the attorney-client work confidential.

Be Prepared

It's only a matter of time before your organization will find itself in the unfortunate situation of suddenly realizing that it's suffered a targeted breach. Therefore, it's imperative to prepare in advance and be ready to respond in a manner that ensures your customers as well as your organization's own interests are adequately protected. That due diligence can be demonstrated with a formal cybersecurity crisis management plan