-- Table structure for table `node__webform`
--

CREATE TABLE `node__webform` (
  `bundle` varchar(128) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL DEFAULT '' COMMENT 'The field instance bundle to which this row belongs, used when deleting a field instance',
  `deleted` tinyint NOT NULL DEFAULT '0' COMMENT 'A boolean indicating whether this data item has been deleted',
  `entity_id` int unsigned NOT NULL COMMENT 'The entity id this data is attached to',
  `revision_id` int unsigned NOT NULL COMMENT 'The entity revision id this data is attached to',
  `langcode` varchar(32) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL DEFAULT '' COMMENT 'The language code for this data item.',
  `delta` int unsigned NOT NULL COMMENT 'The sequence number for this data item, used for multi-value fields',
  `webform_target_id` varchar(32) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL COMMENT 'The ID of the webform entity.',
  `webform_default_data` text COLLATE utf8mb4_general_ci COMMENT 'Default submission data.',
  `webform_status` varchar(20) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT 'Flag to control whether this webform should be open, closed, or scheduled for new submissions.',
  `webform_open` varchar(20) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT 'The open date/time.',
  `webform_close` varchar(20) COLLATE utf8mb4_general_ci DEFAULT NULL COMMENT 'The close date/time.',
  PRIMARY KEY (`entity_id`,`deleted`,`delta`,`langcode`),
  KEY `bundle` (`bundle`),
  KEY `revision_id` (`revision_id`),
  KEY `webform_target_id` (`webform_target_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci COMMENT='Data storage for node field webform.';

--
-- Dumping data for table `node__webform`
--

INSERT INTO `node__webform` VALUES ('webinar',0,132,709,'en',0,'register_now','','scheduled','2025-11-20T00:00:00','2025-11-22T03:00:00');

--
-- Table structure for table `node_access`
--

CREATE TABLE `node_access` (
  `nid` int unsigned NOT NULL DEFAULT '0' COMMENT 'The "node".nid this record affects.',
  `langcode` varchar(12) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL DEFAULT '' COMMENT 'The "language".langcode of this node.',
  `fallback` tinyint unsigned NOT NULL DEFAULT '1' COMMENT 'Boolean indicating whether this record should be used as a fallback if a language condition is not provided.',
  `gid` int unsigned NOT NULL DEFAULT '0' COMMENT 'The grant ID a user must possess in the specified realm to gain this row''s privileges on the node.',
  `realm` varchar(255) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL DEFAULT '' COMMENT 'The realm in which the user must possess the grant ID. Modules can define one or more realms by implementing hook_node_grants().',
  `grant_view` tinyint unsigned NOT NULL DEFAULT '0' COMMENT 'Boolean indicating whether a user with the realm/grant pair can view this node.',
  `grant_update` tinyint unsigned NOT NULL DEFAULT '0' COMMENT 'Boolean indicating whether a user with the realm/grant pair can edit this node.',
  `grant_delete` tinyint unsigned NOT NULL DEFAULT '0' COMMENT 'Boolean indicating whether a user with the realm/grant pair can delete this node.',
  PRIMARY KEY (`nid`,`gid`,`realm`,`langcode`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci COMMENT='Identifies which realm/grant pairs a user must possess in…';

--
-- Dumping data for table `node_access`
--

INSERT INTO `node_access` VALUES (0,'',1,0,'all',1,0,0);

--
-- Table structure for table `node_field_data`
--

CREATE TABLE `node_field_data` (
  `nid` int unsigned NOT NULL,
  `vid` int unsigned NOT NULL,
  `type` varchar(32) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL COMMENT 'The ID of the target entity.',
  `langcode` varchar(12) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL,
  `status` tinyint NOT NULL,
  `uid` int unsigned NOT NULL COMMENT 'The ID of the target entity.',
  `title` varchar(255) COLLATE utf8mb4_general_ci NOT NULL,
  `created` int NOT NULL,
  `changed` int NOT NULL,
  `promote` tinyint NOT NULL,
  `sticky` tinyint NOT NULL,
  `default_langcode` tinyint NOT NULL,
  `revision_translation_affected` tinyint DEFAULT NULL,
  PRIMARY KEY (`nid`,`langcode`),
  KEY `node__id__default_langcode__langcode` (`nid`,`default_langcode`,`langcode`),
  KEY `node__vid` (`vid`),
  KEY `node_field__type__target_id` (`type`),
  KEY `node_field__uid__target_id` (`uid`),
  KEY `node_field__created` (`created`),
  KEY `node_field__changed` (`changed`),
  KEY `node__status_type` (`status`,`type`,`nid`),
  KEY `node__frontpage` (`promote`,`status`,`sticky`,`created`),
  KEY `node__title_type` (`title`(191),`type`(4))
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci COMMENT='The data table for node entities.';

--
-- Dumping data for table `node_field_data`
--

INSERT INTO `node_field_data` VALUES (1,1,'landing_page','en',1,1,'Homepage',1762262821,1763565055,0,0,1,1),(2,2,'banner','en',1,1,'Mindful Technology Solutions through Holistic Approaches, Proven Expertise, and Collaborative Partnerships',1753456794,1761827102,0,0,1,1),(5,5,'banner','en',1,1,'Seeking Excellence, with Grace',1753874983,1753875095,0,0,1,1),(6,6,'banner','en',1,1,'Enterprise Architecture and Roadmaps',1753875321,1761827389,0,0,1,1),(7,7,'banner','en',1,1,'Salesforce powered modern platform',1753876166,1761827311,0,0,1,1),(8,8,'banner','en',1,1,'Custom Lead to Cash platform',1753876394,1761827231,0,0,1,1),(10,10,'contributors','en',1,1,'Contributor',1754578986,1754579051,1,0,1,1),(11,674,'blog','en',0,1,'Practicing Effective Cybersecurity',1754657826,1763459487,1,0,1,1),(12,22,'testimonial','en',1,1,'The trust that we have earned',1754999982,1763026617,0,0,1,1),(13,23,'testimonial','en',1,1,'The trust that we have earned',1755000383,1763026596,0,0,1,1),(14,24,'testimonial','en',1,1,'The trust that we have earned ',1755000530,1763026578,0,0,1,1),(15,25,'testimonial','en',1,1,'The trust that we have earned',1755000661,1763026549,0,0,1,1),(16,26,'page','en',1,1,'test page',1756473868,1756473878,0,0,1,1),(20,30,'what_we_do','en',1,1,'test',1758202154,1758202168,0,0,1,1),(21,32,'page','en',1,1,'Privacy Policy',1758214175,1758214857,0,0,1,1),(22,33,'why_divihn','en',1,1,'Why DivIHN ',1758274979,1759927884,0,0,1,1),(23,710,'who_we_serve','en',1,1,'Who we serve ',1759234672,1763720632,1,0,1,1),(24,37,'certifications','en',1,1,'CMMI',1759485500,1759485528,1,0,1,1),(25,38,'certifications','en',1,1,'ISO 9001',1759485545,1759485571,1,0,1,1),(26,39,'certifications','en',1,1,'ISO 20000',1759485583,1759485610,1,0,1,1),(27,40,'certifications','en',1,1,'ISO 27001',1759485618,1759485635,1,0,1,1),(28,41,'government_page','en',1,1,'Holistic Technology Services and Solutions in service of our Government',1759490597,1759490812,0,0,1,1),(29,42,'government_page','en',1,1,'Holistic Technology Services and Solutions in service of our Government',1759490597,1760541732,0,0,1,1),(31,703,'services','en',1,1,'Digital Strategy  & Transformation ',1759831038,1763642689,1,0,1,1),(38,139,'why_divihn_page','en',1,1,'Why DivIHN',1759934275,1760540018,1,0,1,NULL),(40,77,'sled','en',1,1,'TOPS CAT-3 JPMC',1760087502,1760088371,1,0,1,1),(41,79,'sled_content_pages','en',1,1,'TOPS CAT-3 JPMC',1760089689,1760099414,1,0,1,1),(42,83,'sled_content_pages','en',1,1,'Illinois Public Higher Education Cooperative',1760100009,1760103008,1,0,1,1),(43,105,'contributors','en',1,2,'Laszlo S. Gonc',1760354778,1760458125,1,0,1,NULL),(44,653,'blog','en',1,2,'IoT Medical Device Cybersecurity',1760360422,1763374067,1,0,1,1),(46,619,'blog','en',1,2,'Zero Trust – Securing Your Business',1760427870,1762861906,1,0,1,1),(47,606,'featured_article','en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762860704,1,0,1,1),(48,608,'featured_article','en',1,2,'Managing Business Risk in the context of increased remote',1760437306,1762860975,1,0,1,1),(49,609,'featured_article','en',1,2,'Employee Security Awareness Training',1760438920,1762861032,1,0,1,1),(50,610,'featured_article','en',1,2,'Third-Party Supply Chain Risk During The COVID-19',1760440566,1762861108,1,0,1,1),(51,611,'featured_article','en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1762861193,1,0,1,1),(52,679,'client_success','en',0,1,'IT Integration in M & A Pre-Announce through Day 1',1760449611,1763463742,1,0,1,1),(53,612,'featured_article','en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1762861326,1,0,1,1),(54,680,'client_success','en',0,1,'Cyber PMO project prioritization',1760450131,1763463821,1,0,1,1),(55,613,'featured_article','en',1,2,'Whitepaper: Managing Risk In Open Source',1760452482,1762861360,1,0,1,1),(56,681,'client_success','en',0,1,'Cybersecurity Architecture For County Government',1760452234,1763464063,1,0,1,1),(57,614,'featured_article','en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1762861442,1,0,1,1),(58,166,'contributors','en',1,2,'Joseph F. Norton',1760454566,1760626786,1,0,1,NULL),(59,113,'contributors','en',1,2,'Shantanoo Govilkar',1760458423,1760507172,1,0,1,NULL),(60,618,'webinar','en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1762861848,1,0,1,1),(61,620,'featured_article','en',1,2,'Practicing Effective Cybersecurity',1760522608,1762861946,1,0,1,1),(62,621,'webinar','en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1762862014,1,0,1,1),(63,622,'webinar','en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760543878,1762862042,1,0,1,1),(64,623,'blog','en',1,2,'Security By Design',1760544700,1762862077,1,0,1,1),(65,624,'blog','en',1,2,'Security By Design - Part 2',1762439980,1762862101,0,0,1,1),(66,625,'blog','en',1,2,'Security By Design - Part 3',1760603427,1762862129,1,0,1,1),(67,626,'blog','en',1,2,'Security By Design - Part 4',1760614033,1762862153,1,0,1,1),(68,627,'blog','en',1,2,'Security By Design - Part 5',1760619051,1762862185,1,0,1,1),(69,165,'contributors','en',1,2,'Jeff Lanham',1760622352,1760626765,1,0,1,NULL),(70,628,'featured_article','en',1,2,'The Legacy Of ELIZA',1760622728,1762862287,1,0,1,1),(71,174,'sled','en',1,1,'Technology and Talent Solutions for State, Local, Education and Government Agencies.',1760624511,1760630004,1,0,1,1),(72,169,'contributors','en',1,2,'Kannan Venkataraman',1760627408,1760627587,1,0,1,1),(73,629,'blog','en',1,2,'The Benefits Of Salesforce Communities',1760627598,1762862311,1,0,1,1),(74,675,'featured_article','en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1763460096,1,0,1,NULL),(75,199,'contributors','en',1,2,'Doug Picirillo',1760690979,1760691119,1,0,1,1),(76,631,'blog','en',1,2,'AI In Mainstream Enterprise Applications ',1760691130,1762862404,1,0,1,1),(77,632,'blog','en',1,2,'What Does AI Offer Humankind?',1760695829,1762862435,1,0,1,1),(78,633,'blog','en',1,2,'What Does AI Offer Users of Mainstream Enterprise Systems?',1760696904,1762862466,1,0,1,1),(79,634,'featured_article','en',1,2,'What is Governance Risk and Compliance (GRC)? A Definitive Guide',1760704882,1762862518,1,0,1,1),(80,635,'featured_article','en',1,2,'15 Best Practices In    Salesforce Development ',1760709402,1762862549,1,0,1,1),(81,683,'featured_article','en',1,2,'Unleashing Business Potential: The Power of Adaptive Enterprise Architecture',1760712443,1763477143,1,0,1,NULL),(82,637,'blog','en',1,2,'Security By Design - Part 6',1760944401,1762862703,1,0,1,1),(83,638,'blog','en',1,2,'Security By Design- Part 7',1760946722,1762862726,1,0,1,1),(84,639,'blog','en',1,2,'Security By Design - Part 8',1760949145,1762862748,1,0,1,1),(85,640,'blog','en',1,2,'Security By Design Part- 9',1760954578,1762862765,1,0,1,1),(86,641,'blog','en',1,2,'Security By Design- Part 10',1760956577,1762862890,1,0,1,1),(87,642,'blog','en',1,2,'Security By Design- Part 11',1760960262,1762862913,1,0,1,1),(88,643,'blog','en',1,2,'Security By Design- Part 12',1760961485,1762862936,1,0,1,1),(89,644,'blog','en',1,2,'Security By Design- Part 13',1761043780,1762862957,1,0,1,1),(90,645,'blog','en',1,2,'Security By Design- Part 14',1761046040,1762862976,1,0,1,1),(91,646,'webinar','en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1762863072,1,0,1,1),(92,673,'page','en',1,1,'Perspectives',1761128226,1763457559,0,0,1,1),(93,273,'unique_template_pages','en',1,1,'Your Talent, Our Network',1761222406,1763122990,0,0,1,1),(94,274,'unique_template_pages','en',1,1,'Job Openings',1761227452,1761228559,0,0,1,1),(95,275,'unique_template_pages','en',1,1,'Grow with Purpose',1761228962,1763469320,0,0,1,1),(96,573,'client_success','en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1762777112,1,0,1,NULL),(97,574,'client_success','en',1,2,'Cyber PMO project prioritization',1761561196,1762777251,1,0,1,NULL),(98,652,'client_success','en',1,2,'Cybersecurity Architecture For County Government',1761561749,1763025755,1,0,1,1),(99,576,'client_success','en',1,2,'Third Party Risk Management',1761562456,1762777773,1,0,1,NULL),(100,649,'client_success','en',1,2,'Cyber Proofing Legal Documents',1761567129,1762879493,1,0,1,1),(101,578,'client_success','en',1,2,'Sales and Operations Platform',1761568018,1762777913,1,0,1,NULL),(102,579,'client_success','en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1762777962,1,0,1,NULL),(103,580,'client_success','en',1,2,'IT Audit Head',1761569357,1762777998,1,0,1,NULL),(104,581,'client_success','en',1,2,'Global Cybersecurity Talent',1761571163,1762778025,1,0,1,NULL),(105,648,'client_success','en',1,2,'Data Science Talent',1761571712,1762879415,1,0,1,1),(106,583,'client_success','en',1,2,'Application Health Assessment',1761572754,1762778109,1,0,1,NULL),(107,584,'client_success','en',1,2,'Application Security',1761573085,1762778150,1,0,1,NULL),(108,585,'client_success','en',1,2,'Medical Device Security',1761573518,1762778182,1,0,1,NULL),(109,586,'client_success','en',1,2,'IT Integration in M & A Strategy and Readiness',1761573932,1762778287,1,0,1,NULL),(110,651,'client_success','en',1,2,'Enterprise Cyber Risk',1761574295,1763025697,1,0,1,1),(111,588,'client_success','en',1,2,'IT Integration in M & A Post Announce through Full Integration',1761574821,1762778356,1,0,1,NULL),(112,650,'client_success','en',1,2,'Learning Management System',1761575438,1763025655,1,0,1,1),(113,590,'client_success','en',1,2,'IT Integration in M & A Due Diligence',1761575792,1762778393,1,0,1,NULL),(115,386,'unique_template_pages','en',1,1,'Security in The Digital DNA',1761655499,1761729955,0,0,1,1),(116,410,'unique_template_pages','en',1,1,'Client Success Page',1761732790,1763030058,0,0,1,1),(117,704,'services','en',1,2,'Business Technology Transformation',1761819233,1763642778,1,0,1,NULL),(118,429,'services','en',1,2,'Cybersecurity Services',1761825745,1761841917,1,0,1,NULL),(119,428,'services','en',1,2,'Operations & Management',1761832243,1761841459,1,0,1,1),(120,658,'services','en',1,2,'Better Results require Better Partners.',1761842411,1763384597,1,0,1,1),(121,439,'specialization_pages','en',1,2,'Enterprise Architecture',1762169252,1763369857,0,0,1,1),(122,440,'specialization_pages','en',1,2,'Data Analytics  with AI / ML',1762173812,1763386057,0,0,1,1),(123,441,'specialization_pages','en',1,2,'Salesforce Solutions',1762243922,1762248882,0,0,1,1),(124,442,'specialization_pages','en',1,2,'Microsoft',1762250810,1763386760,0,0,1,1),(125,443,'specialization_pages','en',1,2,'Cybersecurity',1762258233,1763386903,0,0,1,1),(126,444,'specialization_pages','en',1,2,'ServiceNow',1762261079,1763387133,0,0,1,1),(127,605,'podcast','en',1,2,'Cyber threats in your supply chain',1762435756,1762860604,1,0,1,1),(128,615,'podcast','en',1,2,'Cybersecurity & Remote Teleworking Featu...',1762437731,1762861511,1,0,1,1),(129,616,'podcast','en',1,2,'Third Party Supplier Risk',1762438187,1762861704,1,0,1,1),(130,617,'podcast','en',1,2,'Employee Training & Awareness',1762438426,1762861756,1,0,1,1),(131,647,'blog','en',1,2,'Shadow AI and the Governance Gap: What Leaders Must Do Now',1762515676,1762863101,1,0,1,1),(132,709,'webinar','en',1,1,'Clone of The CISO Exchange for a Safer Digital World',1762860220,1763720324,1,0,1,1),(133,677,'jobs','en',1,1,'Sample Job Listing',1763460748,1763460807,0,0,1,1),(134,678,'unique_template_pages','en',1,1,'Internal Careers Open Positions',1763463458,1763464326,0,0,1,1),(135,682,'unique_template_pages','en',1,1,'Contact Us',1763469386,1763714898,0,0,1,1);

--
-- Table structure for table `node_field_revision`
--

CREATE TABLE `node_field_revision` (
  `nid` int unsigned NOT NULL,
  `vid` int unsigned NOT NULL,
  `langcode` varchar(12) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL,
  `status` tinyint NOT NULL,
  `uid` int unsigned NOT NULL COMMENT 'The ID of the target entity.',
  `title` varchar(255) COLLATE utf8mb4_general_ci DEFAULT NULL,
  `created` int DEFAULT NULL,
  `changed` int DEFAULT NULL,
  `promote` tinyint DEFAULT NULL,
  `sticky` tinyint DEFAULT NULL,
  `default_langcode` tinyint NOT NULL,
  `revision_translation_affected` tinyint DEFAULT NULL,
  PRIMARY KEY (`vid`,`langcode`),
  KEY `node__id__default_langcode__langcode` (`nid`,`default_langcode`,`langcode`),
  KEY `node_field__uid__target_id` (`uid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci COMMENT='The revision data table for node entities.';

--
-- Dumping data for table `node_field_revision`
--

INSERT INTO `node_field_revision` VALUES (1,1,'en',1,1,'Homepage',1762262821,1763565055,0,0,1,1),(2,2,'en',1,1,'Mindful Technology Solutions through Holistic Approaches, Proven Expertise, and Collaborative Partnerships',1753456794,1761827102,0,0,1,1),(5,5,'en',1,1,'Seeking Excellence, with Grace',1753874983,1753875095,0,0,1,1),(6,6,'en',1,1,'Enterprise Architecture and Roadmaps',1753875321,1761827389,0,0,1,1),(7,7,'en',1,1,'Salesforce powered modern platform',1753876166,1761827311,0,0,1,1),(8,8,'en',1,1,'Custom Lead to Cash platform',1753876394,1761827231,0,0,1,1),(10,10,'en',1,1,'Contributor',1754578986,1754579051,1,0,1,1),(11,21,'en',1,1,'Practicing Effective Cybersecurity',1754657826,1754657873,1,0,1,1),(12,22,'en',1,1,'The trust that we have earned',1754999982,1763026617,0,0,1,1),(13,23,'en',1,1,'The trust that we have earned',1755000383,1763026596,0,0,1,1),(14,24,'en',1,1,'The trust that we have earned ',1755000530,1763026578,0,0,1,1),(15,25,'en',1,1,'The trust that we have earned',1755000661,1763026549,0,0,1,1),(16,26,'en',1,1,'test page',1756473868,1756473878,0,0,1,1),(20,30,'en',1,1,'test',1758202154,1758202168,0,0,1,1),(21,31,'en',1,1,'Privacy Policy',1758214175,1758214459,0,0,1,1),(21,32,'en',1,1,'Privacy Policy',1758214175,1758214857,0,0,1,1),(22,33,'en',1,1,'Why DivIHN ',1758274979,1759927884,0,0,1,1),(11,34,'en',1,1,'Practicing Effective Cybersecurity',1754657826,1758723231,1,0,1,1),(23,35,'en',1,1,'Who we serve ',1759234672,1759236641,1,0,1,1),(23,36,'en',1,1,'Who we serve ',1759234672,1759239449,1,0,1,1),(24,37,'en',1,1,'CMMI',1759485500,1759485528,1,0,1,1),(25,38,'en',1,1,'ISO 9001',1759485545,1759485571,1,0,1,1),(26,39,'en',1,1,'ISO 20000',1759485583,1759485610,1,0,1,1),(27,40,'en',1,1,'ISO 27001',1759485618,1759485635,1,0,1,1),(28,41,'en',1,1,'Holistic Technology Services and Solutions in service of our Government',1759490597,1759490812,0,0,1,1),(29,42,'en',1,1,'Holistic Technology Services and Solutions in service of our Government',1759490597,1760541732,0,0,1,1),(31,47,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1759831738,1,0,1,1),(31,48,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1759832303,1,0,1,1),(31,49,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1759835807,1,0,1,1),(31,50,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1759836251,1,0,1,1),(31,51,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1759836322,1,0,1,1),(31,52,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1759836563,1,0,1,1),(38,61,'en',1,1,'Why DivIHN',1759934275,1759935581,1,0,1,1),(38,62,'en',1,1,'Why DivIHN',1759934275,1759937002,1,0,1,1),(38,63,'en',1,1,'Why DivIHN',1759934275,1759937088,1,0,1,1),(38,64,'en',1,1,'Why DivIHN',1759934275,1759937818,1,0,1,1),(38,65,'en',1,1,'Why DivIHN',1759934275,1759938399,1,0,1,1),(38,66,'en',1,1,'Why DivIHN',1759934275,1759939187,1,0,1,NULL),(40,77,'en',1,1,'TOPS CAT-3 JPMC',1760087502,1760088371,1,0,1,1),(41,78,'en',1,1,'TOPS CAT-3 JPMC',1760089689,1760099091,1,0,1,1),(41,79,'en',1,1,'TOPS CAT-3 JPMC',1760089689,1760099414,1,0,1,1),(42,80,'en',1,1,'Illinois Public Higher Education Cooperative',1760100009,1760101054,1,0,1,1),(42,81,'en',1,1,'Illinois Public Higher Education Cooperative',1760100009,1760101977,1,0,1,1),(42,82,'en',1,1,'Illinois Public Higher Education Cooperative',1760100009,1760102733,1,0,1,1),(42,83,'en',1,1,'Illinois Public Higher Education Cooperative',1760100009,1760103008,1,0,1,1),(43,84,'en',1,2,'Laszlo S. Gonc',1760354778,1760355675,1,0,1,1),(44,85,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1760363735,1,0,1,1),(46,87,'en',1,2,'Zero Trust – Securing Your Business',1760427870,1760430555,1,0,1,1),(47,88,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1760434621,1,0,1,1),(47,89,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1760434746,1,0,1,1),(43,90,'en',1,2,'Laszlo S. Gonc',1760354778,1760434961,1,0,1,NULL),(47,91,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1760435241,1,0,1,1),(44,92,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1760435858,1,0,1,NULL),(46,93,'en',1,2,'Zero Trust – Securing Your Business',1760427870,1760435927,1,0,1,NULL),(47,94,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1760437182,1,0,1,1),(48,95,'en',1,2,'Managing Business Risk in the context of increased remote',1760437306,1760438496,1,0,1,1),(49,96,'en',1,2,'Employee Security Awareness Training',1760438920,1760440200,1,0,1,1),(50,97,'en',1,2,'Third-Party Supply Chain Risk During The COVID-19',1760440566,1760442614,1,0,1,1),(51,98,'en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1760447155,1,0,1,1),(52,99,'en',1,1,'IT Integration in M & A Pre-Announce through Day 1',1760449611,1760450065,1,0,1,1),(53,100,'en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1760450127,1,0,1,1),(54,101,'en',1,1,'Cyber PMO project prioritization',1760450131,1760452152,1,0,1,1),(55,102,'en',1,2,'Whitepaper: Managing Risk In Open Source Contributor',1760452482,1760453554,1,0,1,1),(56,103,'en',1,1,'Cybersecurity Architecture For County Government',1760452234,1760453765,1,0,1,1),(57,104,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1760454147,1,0,1,1),(43,105,'en',1,2,'Laszlo S. Gonc',1760354778,1760458125,1,0,1,NULL),(58,106,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760454566,1760458372,1,0,1,1),(59,107,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760458423,1760460645,1,0,1,1),(59,108,'en',1,2,'Shantanoo Govilkar',1760458423,1760461105,1,0,1,1),(58,109,'en',1,2,'Joseph F. Norton',1760454566,1760461127,1,0,1,1),(59,110,'en',1,2,'Shantanoo Govilkar',1760458423,1760461200,1,0,1,NULL),(60,111,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760462207,1,0,1,1),(58,112,'en',1,2,'Joseph F. Norton',1760454566,1760507159,1,0,1,NULL),(59,113,'en',1,2,'Shantanoo Govilkar',1760458423,1760507172,1,0,1,NULL),(60,114,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760507933,1,0,1,1),(60,115,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760507998,1,0,1,1),(60,116,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760520520,1,0,1,1),(60,117,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760520876,1,0,1,1),(60,118,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760522066,1,0,1,1),(60,119,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760522257,1,0,1,NULL),(61,120,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1760523191,1,0,1,1),(61,121,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1760523638,1,0,1,1),(61,122,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1760523700,1,0,1,1),(60,123,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760524002,1,0,1,NULL),(62,124,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1760529203,1,0,1,1),(44,125,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1760531740,1,0,1,1),(46,126,'en',1,2,'Zero Trust – Securing Your Business',1760427870,1760532065,1,0,1,1),(47,127,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1760532190,1,0,1,1),(48,128,'en',1,2,'Managing Business Risk in the context of increased remote',1760437306,1760532259,1,0,1,1),(49,129,'en',1,2,'Employee Security Awareness Training',1760438920,1760532403,1,0,1,1),(50,130,'en',1,2,'Third-Party Supply Chain Risk During The COVID-19',1760440566,1760532487,1,0,1,1),(51,131,'en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1760532601,1,0,1,1),(53,132,'en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1760532666,1,0,1,1),(57,133,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1760532996,1,0,1,1),(57,134,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1760533119,1,0,1,1),(55,135,'en',1,2,'Whitepaper: Managing Risk In Open Source Contributor',1760452482,1760533162,1,0,1,1),(61,136,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1760533507,1,0,1,1),(44,137,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1760533547,1,0,1,NULL),(23,138,'en',1,1,'Who we serve ',1759234672,1760539730,1,0,1,NULL),(38,139,'en',1,1,'Why DivIHN',1759934275,1760540018,1,0,1,NULL),(63,140,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760543878,1760544404,1,0,1,1),(62,141,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1760544542,1,0,1,1),(64,142,'en',1,2,'Security By Design',1760544700,1760545618,1,0,1,1),(64,143,'en',1,2,'Security By Design',1760544700,1760545648,1,0,1,NULL),(64,144,'en',1,2,'Security By Design',1760544700,1760545723,1,0,1,NULL),(64,145,'en',1,2,'Security By Design',1760544700,1760545774,1,0,1,NULL),(60,146,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1760546528,1,0,1,1),(63,147,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760543878,1760546696,1,0,1,1),(62,148,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1760546848,1,0,1,1),(65,149,'en',1,2,'Security By Design - Part 2',1760598481,1760600436,1,0,1,1),(65,150,'en',1,2,'Security By Design - Part 2',1760598481,1760600491,1,0,1,NULL),(65,151,'en',1,2,'Security By Design - Part 2',1760598481,1760601137,1,0,1,NULL),(66,152,'en',1,2,'Security By Design - Part 3',1760603427,1760612008,1,0,1,1),(66,153,'en',1,2,'Security By Design - Part 3',1760603427,1760612034,1,0,1,1),(66,154,'en',1,2,'Security By Design - Part 3',1760603427,1760613805,1,0,1,1),(66,155,'en',1,2,'Security By Design - Part 3',1760603427,1760613829,1,0,1,1),(67,156,'en',1,2,'Security By Design - Part 4',1760614033,1760615946,1,0,1,1),(67,157,'en',1,2,'Security By Design - Part 4',1760614033,1760615995,1,0,1,1),(67,158,'en',1,2,'Security By Design - Part 4',1760614033,1760619558,1,0,1,NULL),(62,159,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1760619645,1,0,1,NULL),(68,160,'en',1,2,'Security By Design - Part 5',1760619051,1760620607,1,0,1,1),(68,161,'en',1,2,'Security By Design - Part 5',1760619051,1760620691,1,0,1,1),(69,162,'en',1,2,'Jeff Lanham',1760622352,1760622647,1,0,1,1),(70,163,'en',1,2,'The Legacy Of ELIZA',1760622728,1760623509,1,0,1,1),(71,164,'en',1,1,'Technology and Talent Solutions for State, Local, Education and Government Agencies.',1760624511,1760625394,1,0,1,1),(69,165,'en',1,2,'Jeff Lanham',1760622352,1760626765,1,0,1,NULL),(58,166,'en',1,2,'Joseph F. Norton',1760454566,1760626786,1,0,1,NULL),(71,167,'en',1,1,'Technology and Talent Solutions for State, Local, Education and Government Agencies.',1760624511,1760627142,1,0,1,1),(70,168,'en',1,2,'The Legacy Of ELIZA',1760622728,1760627317,1,0,1,NULL),(72,169,'en',1,2,'Kannan Venkataraman',1760627408,1760627587,1,0,1,1),(71,170,'en',1,1,'Technology and Talent Solutions for State, Local, Education and Government Agencies.',1760624511,1760627663,1,0,1,1),(71,171,'en',1,1,'Technology and Talent Solutions for State, Local, Education and Government Agencies.',1760624511,1760629043,1,0,1,1),(71,172,'en',1,1,'Technology and Talent Solutions for State, Local, Education and Government Agencies.',1760624511,1760629182,1,0,1,NULL),(71,173,'en',1,1,'Technology and Talent Solutions for State, Local, Education and Government Agencies.',1760624511,1760629824,1,0,1,1),(71,174,'en',1,1,'Technology and Talent Solutions for State, Local, Education and Government Agencies.',1760624511,1760630004,1,0,1,1),(73,175,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760633073,1,0,1,1),(73,176,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760633168,1,0,1,1),(73,177,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760633264,1,0,1,NULL),(73,178,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760633373,1,0,1,NULL),(73,179,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760633509,1,0,1,1),(73,180,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760633731,1,0,1,1),(73,181,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760633850,1,0,1,NULL),(73,182,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760634426,1,0,1,1),(73,183,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760635007,1,0,1,1),(73,184,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760681045,1,0,1,1),(73,185,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760681361,1,0,1,1),(73,186,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760681494,1,0,1,1),(73,187,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760681627,1,0,1,1),(73,188,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760686147,1,0,1,1),(73,189,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760686303,1,0,1,1),(73,190,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760686616,1,0,1,1),(73,191,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760686820,1,0,1,1),(73,192,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1760686857,1,0,1,1),(74,193,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1760689013,1,0,1,1),(74,194,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1760689206,1,0,1,NULL),(74,195,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1760689263,1,0,1,1),(74,196,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1760689334,1,0,1,1),(74,197,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1760690739,1,0,1,NULL),(74,198,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1760690763,1,0,1,1),(75,199,'en',1,2,'Doug Picirillo',1760690979,1760691119,1,0,1,1),(76,200,'en',1,2,'AI In Mainstream Enterprise Applications ',1760691130,1760692055,1,0,1,1),(77,201,'en',1,2,'What Does AI Offer Humankind?',1760695829,1760696632,1,0,1,1),(77,202,'en',1,2,'What Does AI Offer Humankind?',1760695829,1760696892,1,0,1,NULL),(78,203,'en',1,2,'What Does AI Offer Users of Mainstream Enterprise Systems?',1760696904,1760698306,1,0,1,1),(78,204,'en',1,2,'What Does AI Offer Users of Mainstream Enterprise Systems?',1760696904,1760703751,1,0,1,1),(74,205,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1760704748,1,0,1,NULL),(79,206,'en',1,2,'What is Governance Risk and Compliance (GRC)? A Definitive Guide',1760704882,1760708961,1,0,1,1),(80,207,'en',1,2,'15 Best Practices In    Salesforce Development ',1760709402,1760712259,1,0,1,1),(81,208,'en',1,2,'Unleashing Business Potential: The Power of Adaptive Enterprise Architecture',1760712443,1760714039,1,0,1,1),(82,209,'en',1,2,'Security By Design - Part 6',1760944401,1760946284,1,0,1,1),(83,210,'en',1,2,'Security By Design- Part 7',1760946722,1760948842,1,0,1,1),(84,211,'en',1,2,'Security By Design - Part 8',1760949145,1760950657,1,0,1,1),(84,212,'en',1,2,'Security By Design - Part 8',1760949145,1760953245,1,0,1,1),(85,213,'en',1,2,'Security By Design Part- 9',1760954578,1760955810,1,0,1,1),(85,214,'en',1,2,'Security By Design Part- 9',1760954578,1760956489,1,0,1,NULL),(86,215,'en',1,2,'Security By Design- Part 10',1760956577,1760957171,1,0,1,1),(87,216,'en',1,2,'Security By Design- Part 11',1760960262,1760961271,1,0,1,1),(87,217,'en',1,2,'Security By Design- Part 11',1760960262,1760961307,1,0,1,1),(88,218,'en',1,2,'Security By Design- Part 12',1760961485,1760965401,1,0,1,1),(88,219,'en',1,2,'Security By Design- Part 12',1760961485,1760965461,1,0,1,NULL),(88,220,'en',1,2,'Security By Design- Part 12',1760961485,1760966878,1,0,1,1),(88,221,'en',1,2,'Security By Design- Part 12',1760961485,1760967690,1,0,1,NULL),(89,222,'en',1,2,'Security By Design- Part 13',1761043780,1761045398,1,0,1,1),(90,223,'en',1,2,'Security By Design- Part 14',1761046040,1761047951,1,0,1,1),(91,224,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1761123457,1,0,1,1),(91,225,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1761124233,1,0,1,NULL),(91,226,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1761124280,1,0,1,1),(91,227,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1761124649,1,0,1,1),(92,228,'en',1,1,'Perspectives',1761128226,1761128246,0,0,1,1),(92,229,'en',1,1,'Perspectives',1761128226,1761128280,0,0,1,NULL),(92,230,'en',1,1,'Perspectives',1761128226,1761128485,0,0,1,1),(90,231,'en',1,2,'Security By Design- Part 14',1761046040,1761128988,1,0,1,1),(90,232,'en',1,2,'Security By Design- Part 14',1761046040,1761141806,1,0,1,NULL),(89,233,'en',1,2,'Security By Design- Part 13',1761043780,1761149006,1,0,1,1),(88,234,'en',1,2,'Security By Design- Part 12',1760961485,1761150996,1,0,1,1),(87,235,'en',1,2,'Security By Design- Part 11',1760960262,1761151013,1,0,1,1),(86,236,'en',1,2,'Security By Design- Part 10',1760956577,1761151026,1,0,1,1),(85,237,'en',1,2,'Security By Design Part- 9',1760954578,1761151048,1,0,1,1),(84,238,'en',1,2,'Security By Design - Part 8',1760949145,1761151091,1,0,1,1),(83,239,'en',1,2,'Security By Design- Part 7',1760946722,1761151308,1,0,1,1),(82,240,'en',1,2,'Security By Design - Part 6',1760944401,1761151400,1,0,1,1),(78,241,'en',1,2,'What Does AI Offer Users of Mainstream Enterprise Systems?',1760696904,1761153532,1,0,1,1),(77,242,'en',1,2,'What Does AI Offer Humankind?',1760695829,1761153563,1,0,1,1),(76,243,'en',1,2,'AI In Mainstream Enterprise Applications ',1760691130,1761153588,1,0,1,1),(73,244,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1761153616,1,0,1,1),(68,245,'en',1,2,'Security By Design - Part 5',1760619051,1761153638,1,0,1,1),(67,246,'en',1,2,'Security By Design - Part 4',1760614033,1761153754,1,0,1,1),(66,247,'en',1,2,'Security By Design - Part 3',1760603427,1761153788,1,0,1,1),(65,248,'en',1,2,'Security By Design - Part 2',1760598481,1761153892,1,0,1,1),(64,249,'en',1,2,'Security By Design',1760544700,1761154070,1,0,1,1),(44,250,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1761154157,1,0,1,1),(46,251,'en',1,2,'Zero Trust – Securing Your Business',1760427870,1761154299,1,0,1,1),(73,252,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1761154722,1,0,1,NULL),(74,253,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1761206819,1,0,1,1),(47,254,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1761206957,1,0,1,NULL),(47,255,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1761219753,1,0,1,1),(74,256,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1761219820,1,0,1,1),(91,257,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1761219958,1,0,1,1),(81,258,'en',1,2,'Unleashing Business Potential: The Power of Adaptive Enterprise Architecture',1760712443,1761220023,1,0,1,1),(80,259,'en',1,2,'15 Best Practices In    Salesforce Development ',1760709402,1761220126,1,0,1,1),(79,260,'en',1,2,'What is Governance Risk and Compliance (GRC)? A Definitive Guide',1760704882,1761220215,1,0,1,1),(70,261,'en',1,2,'The Legacy Of ELIZA',1760622728,1761220338,1,0,1,1),(62,262,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1761220476,1,0,1,1),(63,263,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760543878,1761220501,1,0,1,1),(60,264,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1761220591,1,0,1,1),(61,265,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1761220652,1,0,1,1),(55,266,'en',1,2,'Whitepaper: Managing Risk In Open Source Contributor',1760452482,1761220764,1,0,1,1),(57,267,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1761220787,1,0,1,1),(53,268,'en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1761220852,1,0,1,1),(51,269,'en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1761220895,1,0,1,1),(50,270,'en',1,2,'Third-Party Supply Chain Risk During The COVID-19',1760440566,1761220913,1,0,1,1),(49,271,'en',1,2,'Employee Security Awareness Training',1760438920,1761220948,1,0,1,1),(48,272,'en',1,2,'Managing Business Risk in the context of increased remote',1760437306,1761220976,1,0,1,1),(93,273,'en',1,1,'Your Talent, Our Network',1761222406,1763122990,0,0,1,1),(94,274,'en',1,1,'Job Openings',1761227452,1761228559,0,0,1,1),(95,275,'en',1,1,'Grow with Purpose',1761228962,1763469320,0,0,1,1),(96,276,'en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1761561128,1,0,1,1),(97,277,'en',1,2,'Cyber PMO project prioritization',1761561196,1761561693,1,0,1,1),(97,278,'en',1,2,'Cyber PMO project prioritization',1761561196,1761561722,1,0,1,1),(98,279,'en',1,2,'Cybersecurity Architecture For County Government',1761561749,1761562366,1,0,1,1),(99,280,'en',1,2,'Third Party Risk Management',1761562456,1761563317,1,0,1,1),(99,281,'en',1,2,'Third Party Risk Management',1761562456,1761566600,1,0,1,1),(100,282,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1761567755,1,0,1,1),(101,283,'en',1,2,'Sales and Operations Platform',1761568018,1761568387,1,0,1,1),(102,284,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1761569320,1,0,1,1),(102,285,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1761569339,1,0,1,1),(103,286,'en',1,2,'IT Audit Head',1761569357,1761569744,1,0,1,1),(104,287,'en',1,2,'Global Cybersecurity Talent',1761571163,1761571594,1,0,1,1),(105,288,'en',1,2,'Data Science Talent',1761571712,1761571961,1,0,1,1),(105,289,'en',1,2,'Data Science Talent',1761571712,1761572175,1,0,1,1),(105,290,'en',1,2,'Data Science Talent',1761571712,1761572323,1,0,1,NULL),(96,291,'en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1761572360,1,0,1,1),(97,292,'en',1,2,'Cyber PMO project prioritization',1761561196,1761572382,1,0,1,1),(98,293,'en',1,2,'Cybersecurity Architecture For County Government',1761561749,1761572406,1,0,1,1),(99,294,'en',1,2,'Third Party Risk Management',1761562456,1761572427,1,0,1,1),(100,295,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1761572447,1,0,1,1),(101,296,'en',1,2,'Sales and Operations Platform',1761568018,1761572472,1,0,1,NULL),(102,297,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1761572489,1,0,1,1),(103,298,'en',1,2,'IT Audit Head',1761569357,1761572520,1,0,1,1),(104,299,'en',1,2,'Global Cybersecurity Talent',1761571163,1761572547,1,0,1,1),(105,300,'en',1,2,'Data Science Talent',1761571712,1761572564,1,0,1,NULL),(96,301,'en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1761572582,1,0,1,NULL),(106,302,'en',1,2,'Application Health Assessment',1761572754,1761573067,1,0,1,1),(107,303,'en',1,2,'Application Security',1761573085,1761573410,1,0,1,1),(108,304,'en',1,2,'Medical Device Security',1761573518,1761573837,1,0,1,1),(109,305,'en',1,2,'IT Integration in M & A Strategy and Readiness',1761573932,1761574194,1,0,1,1),(110,306,'en',1,2,'Enterprise Cyber Risk',1761574295,1761574762,1,0,1,1),(111,307,'en',1,2,'IT Integration in M & A Post Announce through Full Integration',1761574821,1761575229,1,0,1,1),(112,308,'en',1,2,'Learning Management System',1761575438,1761575672,1,0,1,1),(113,309,'en',1,2,'IT Integration in M & A Due Diligence',1761575792,1761576074,1,0,1,1),(92,310,'en',1,1,'Perspectives',1761128226,1761577540,0,0,1,1),(106,311,'en',1,2,'Application Health Assessment',1761572754,1761644983,1,0,1,1),(102,312,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1761645013,1,0,1,1),(110,313,'en',1,2,'Enterprise Cyber Risk',1761574295,1761645050,1,0,1,1),(108,314,'en',1,2,'Medical Device Security',1761573518,1761645087,1,0,1,1),(107,315,'en',1,2,'Application Security',1761573085,1761645104,1,0,1,1),(99,316,'en',1,2,'Third Party Risk Management',1761562456,1761645132,1,0,1,1),(112,317,'en',1,2,'Learning Management System',1761575438,1761645238,1,0,1,1),(105,318,'en',1,2,'Data Science Talent',1761571712,1761645258,1,0,1,1),(104,319,'en',1,2,'Global Cybersecurity Talent',1761571163,1761645280,1,0,1,1),(103,320,'en',1,2,'IT Audit Head',1761569357,1761645297,1,0,1,1),(113,321,'en',1,2,'IT Integration in M & A Due Diligence',1761575792,1761645332,1,0,1,1),(110,322,'en',1,2,'Enterprise Cyber Risk',1761574295,1761645377,1,0,1,1),(108,323,'en',1,2,'Medical Device Security',1761573518,1761645408,1,0,1,1),(107,324,'en',1,2,'Application Security',1761573085,1761645451,1,0,1,1),(104,325,'en',1,2,'Global Cybersecurity Talent',1761571163,1761645479,1,0,1,1),(103,326,'en',1,2,'IT Audit Head',1761569357,1761645508,1,0,1,1),(100,327,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1761645530,1,0,1,1),(99,328,'en',1,2,'Third Party Risk Management',1761562456,1761645548,1,0,1,1),(98,329,'en',1,2,'Cybersecurity Architecture For County Government',1761561749,1761645576,1,0,1,1),(97,330,'en',1,2,'Cyber PMO project prioritization',1761561196,1761645600,1,0,1,1),(111,331,'en',1,2,'IT Integration in M & A Post Announce through Full Integration',1761574821,1761645877,1,0,1,1),(109,332,'en',1,2,'IT Integration in M & A Strategy and Readiness',1761573932,1761645910,1,0,1,1),(106,333,'en',1,2,'Application Health Assessment',1761572754,1761645940,1,0,1,1),(102,334,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1761645986,1,0,1,1),(101,335,'en',1,2,'Sales and Operations Platform',1761568018,1761646016,1,0,1,1),(96,336,'en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1761646043,1,0,1,1),(112,337,'en',1,2,'Learning Management System',1761575438,1761646133,1,0,1,1),(105,338,'en',1,2,'Data Science Talent',1761571712,1761646153,1,0,1,NULL),(110,339,'en',1,2,'Enterprise Cyber Risk',1761574295,1761649126,1,0,1,1),(106,340,'en',1,2,'Application Health Assessment',1761572754,1761649164,1,0,1,1),(101,341,'en',1,2,'Sales and Operations Platform',1761568018,1761651290,1,0,1,1),(103,342,'en',1,2,'IT Audit Head',1761569357,1761651325,1,0,1,1),(110,343,'en',1,2,'Enterprise Cyber Risk',1761574295,1761651356,1,0,1,1),(106,344,'en',1,2,'Application Health Assessment',1761572754,1761651382,1,0,1,1),(101,345,'en',1,2,'Sales and Operations Platform',1761568018,1761651409,1,0,1,1),(98,346,'en',1,2,'Cybersecurity Architecture For County Government',1761561749,1761651449,1,0,1,1),(113,347,'en',1,2,'IT Integration in M & A Due Diligence',1761575792,1761651482,1,0,1,1),(107,348,'en',1,2,'Application Security',1761573085,1761651506,1,0,1,1),(113,349,'en',1,2,'IT Integration in M & A Due Diligence',1761575792,1761651521,1,0,1,NULL),(96,350,'en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1761651555,1,0,1,1),(113,351,'en',1,2,'IT Integration in M & A Due Diligence',1761575792,1761651624,1,0,1,1),(112,352,'en',1,2,'Learning Management System',1761575438,1761651650,1,0,1,1),(112,353,'en',1,2,'Learning Management System',1761575438,1761651679,1,0,1,NULL),(111,354,'en',1,2,'IT Integration in M & A Post Announce through Full Integration',1761574821,1761651706,1,0,1,1),(110,355,'en',1,2,'Enterprise Cyber Risk',1761574295,1761651766,1,0,1,1),(109,356,'en',1,2,'IT Integration in M & A Strategy and Readiness',1761573932,1761651788,1,0,1,1),(108,357,'en',1,2,'Medical Device Security',1761573518,1761651825,1,0,1,1),(107,358,'en',1,2,'Application Security',1761573085,1761651845,1,0,1,1),(103,359,'en',1,2,'IT Audit Head',1761569357,1761651861,1,0,1,1),(102,360,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1761651954,1,0,1,1),(100,361,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1761651978,1,0,1,1),(97,362,'en',1,2,'Cyber PMO project prioritization',1761561196,1761651994,1,0,1,1),(96,363,'en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1761652025,1,0,1,1),(112,364,'en',1,2,'Learning Management System',1761575438,1761652065,1,0,1,1),(110,365,'en',1,2,'Enterprise Cyber Risk',1761574295,1761652088,1,0,1,1),(108,366,'en',1,2,'Medical Device Security',1761573518,1761652117,1,0,1,1),(105,367,'en',1,2,'Data Science Talent',1761571712,1761652170,1,0,1,1),(104,368,'en',1,2,'Global Cybersecurity Talent',1761571163,1761652242,1,0,1,1),(102,369,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1761652259,1,0,1,1),(100,370,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1761652283,1,0,1,1),(97,371,'en',1,2,'Cyber PMO project prioritization',1761561196,1761652318,1,0,1,1),(113,372,'en',1,2,'IT Integration in M & A Due Diligence',1761575792,1761652396,1,0,1,1),(109,373,'en',1,2,'IT Integration in M & A Strategy and Readiness',1761573932,1761652418,1,0,1,1),(108,374,'en',1,2,'Medical Device Security',1761573518,1761652442,1,0,1,1),(107,375,'en',1,2,'Application Security',1761573085,1761652464,1,0,1,1),(105,376,'en',1,2,'Data Science Talent',1761571712,1761652490,1,0,1,1),(104,377,'en',1,2,'Global Cybersecurity Talent',1761571163,1761652520,1,0,1,1),(102,378,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1761652544,1,0,1,1),(100,379,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1761652581,1,0,1,1),(99,380,'en',1,2,'Third Party Risk Management',1761562456,1761652731,1,0,1,1),(100,381,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1761652751,1,0,1,NULL),(99,382,'en',1,2,'Third Party Risk Management',1761562456,1761652790,1,0,1,1),(97,383,'en',1,2,'Cyber PMO project prioritization',1761561196,1761652819,1,0,1,1),(96,384,'en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1761652840,1,0,1,1),(115,386,'en',1,1,'Security in The Digital DNA',1761655499,1761729955,0,0,1,1),(51,387,'en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1761656374,1,0,1,1),(53,388,'en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1761657330,1,0,1,1),(55,389,'en',1,2,'Whitepaper: Managing Risk In Open Source',1760452482,1761657433,1,0,1,1),(57,390,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1761657503,1,0,1,1),(63,391,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760543878,1761658643,1,0,1,1),(46,392,'en',1,2,'Zero Trust – Securing Your Business',1760427870,1761658886,1,0,1,1),(57,393,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1761658908,1,0,1,NULL),(61,394,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1761658996,1,0,1,1),(64,395,'en',1,2,'Security By Design',1760544700,1761659079,1,0,1,1),(65,396,'en',0,2,'Security By Design - Part 2',1762439980,1762439980,0,0,1,1),(66,397,'en',1,2,'Security By Design - Part 3',1760603427,1761659189,1,0,1,1),(67,398,'en',1,2,'Security By Design - Part 4',1760614033,1761659237,1,0,1,1),(68,399,'en',1,2,'Security By Design - Part 5',1760619051,1761659272,1,0,1,1),(82,400,'en',1,2,'Security By Design - Part 6',1760944401,1761659293,1,0,1,1),(83,401,'en',1,2,'Security By Design- Part 7',1760946722,1761659310,1,0,1,1),(84,402,'en',1,2,'Security By Design - Part 8',1760949145,1761659335,1,0,1,1),(85,403,'en',1,2,'Security By Design Part- 9',1760954578,1761659361,1,0,1,1),(86,404,'en',1,2,'Security By Design- Part 10',1760956577,1761659377,1,0,1,1),(87,405,'en',1,2,'Security By Design- Part 11',1760960262,1761659396,1,0,1,1),(88,406,'en',1,2,'Security By Design- Part 12',1760961485,1761659415,1,0,1,1),(89,407,'en',1,2,'Security By Design- Part 13',1761043780,1761659432,1,0,1,1),(90,408,'en',1,2,'Security By Design- Part 14',1761046040,1761659446,1,0,1,1),(91,409,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1761659569,1,0,1,1),(116,410,'en',1,1,'Client Success Page',1761732790,1763030058,0,0,1,1),(31,411,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1761818466,1,0,1,NULL),(31,412,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1761820615,1,0,1,1),(31,413,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1761821430,1,0,1,1),(31,414,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1761821787,1,0,1,1),(31,415,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1761822401,1,0,1,1),(117,416,'en',1,2,'Business Technology Transformation',1761819233,1761823721,1,0,1,1),(117,417,'en',1,2,'Business Technology Transformation',1761819233,1761825611,1,0,1,1),(118,418,'en',1,2,'Cybersecurity Services',1761825745,1761830696,1,0,1,1),(118,419,'en',1,2,'Cybersecurity Services',1761825745,1761830900,1,0,1,1),(118,420,'en',1,2,'Cybersecurity Services',1761825745,1761830975,1,0,1,1),(119,421,'en',1,2,'Operations & Management',1761832243,1761834035,1,0,1,1),(119,422,'en',1,2,'Operations & Management',1761832243,1761836171,1,0,1,1),(119,423,'en',1,2,'Operations & Management',1761832243,1761836746,1,0,1,1),(119,424,'en',1,2,'Operations & Management',1761832243,1761836935,1,0,1,1),(119,425,'en',1,2,'Operations & Management',1761832243,1761840756,1,0,1,1),(119,426,'en',1,2,'Operations & Management',1761832243,1761840874,1,0,1,NULL),(119,427,'en',1,2,'Operations & Management',1761832243,1761841374,1,0,1,1),(119,428,'en',1,2,'Operations & Management',1761832243,1761841459,1,0,1,1),(118,429,'en',1,2,'Cybersecurity Services',1761825745,1761841917,1,0,1,NULL),(120,430,'en',1,2,'Better Results require Better Partners.',1761842411,1761843647,1,0,1,1),(120,431,'en',1,2,'Better Results require Better Partners.',1761842411,1761845296,1,0,1,1),(120,432,'en',1,2,'Better Results require Better Partners.',1761842411,1761845672,1,0,1,1),(120,433,'en',1,2,'Better Results require Better Partners.',1761842411,1761845720,1,0,1,1),(91,434,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1761845762,1,0,1,1),(91,435,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1761906435,1,0,1,1),(120,436,'en',1,2,'Better Results require Better Partners.',1761842411,1761912054,1,0,1,1),(120,437,'en',1,2,'Better Results require Better Partners.',1761842411,1761915493,1,0,1,1),(91,438,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1762169641,1,0,1,NULL),(121,439,'en',1,2,'Enterprise Architecture',1762169252,1763369857,0,0,1,1),(122,440,'en',1,2,'Data Analytics  with AI / ML',1762173812,1763386057,0,0,1,1),(123,441,'en',1,2,'Salesforce Solutions',1762243922,1762248882,0,0,1,1),(124,442,'en',1,2,'Microsoft',1762250810,1763386760,0,0,1,1),(125,443,'en',1,2,'Cybersecurity',1762258233,1763386903,0,0,1,1),(126,444,'en',1,2,'ServiceNow',1762261079,1763387133,0,0,1,1),(47,445,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762434363,1,0,1,NULL),(80,446,'en',1,2,'15 Best Practices In    Salesforce Development ',1760709402,1762434510,1,0,1,1),(127,447,'en',1,2,'Cyber threats in your supply chain',1762435756,1762436304,1,0,1,1),(47,448,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762437085,1,0,1,NULL),(44,449,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1762437176,1,0,1,1),(48,450,'en',1,2,'Managing Business Risk in the context of increased remote',1760437306,1762437320,1,0,1,1),(49,451,'en',1,2,'Employee Security Awareness Training',1760438920,1762437353,1,0,1,1),(50,452,'en',1,2,'Third-Party Supply Chain Risk During The COVID-19',1760440566,1762437434,1,0,1,1),(51,453,'en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1762437507,1,0,1,NULL),(53,454,'en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1762437564,1,0,1,NULL),(55,455,'en',1,2,'Whitepaper: Managing Risk In Open Source',1760452482,1762437613,1,0,1,NULL),(57,456,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1762437685,1,0,1,NULL),(128,457,'en',1,2,'Cybersecurity & Remote Teleworking Featu...',1762437731,1762438016,1,0,1,1),(128,458,'en',1,2,'Cybersecurity & Remote Teleworking Featu...',1762437731,1762438179,1,0,1,1),(129,459,'en',1,2,'Third Party Supplier Risk',1762438187,1762438399,1,0,1,1),(130,460,'en',1,2,'Employee Training & Awareness',1762438426,1762438497,1,0,1,1),(60,461,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1762438847,1,0,1,1),(60,462,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1762439056,1,0,1,1),(46,463,'en',1,2,'Zero Trust – Securing Your Business',1760427870,1762439129,1,0,1,NULL),(61,464,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1762439443,1,0,1,NULL),(62,465,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1762439573,1,0,1,1),(63,466,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760543878,1762439628,1,0,1,1),(64,467,'en',1,2,'Security By Design',1760544700,1762439752,1,0,1,1),(66,468,'en',1,2,'Security By Design - Part 3',1760603427,1762440013,1,0,1,NULL),(65,469,'en',1,2,'Security By Design - Part 2',1762439980,1762440029,0,0,1,1),(66,470,'en',1,2,'Security By Design - Part 3',1760603427,1762440044,1,0,1,NULL),(67,471,'en',1,2,'Security By Design - Part 4',1760614033,1762440067,1,0,1,NULL),(68,472,'en',1,2,'Security By Design - Part 5',1760619051,1762440099,1,0,1,NULL),(70,473,'en',1,2,'The Legacy Of ELIZA',1760622728,1762440146,1,0,1,1),(73,474,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1762440255,1,0,1,1),(74,475,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1762440299,1,0,1,1),(76,476,'en',1,2,'AI In Mainstream Enterprise Applications ',1760691130,1762440376,1,0,1,1),(77,477,'en',1,2,'What Does AI Offer Humankind?',1760695829,1762440460,1,0,1,1),(78,478,'en',1,2,'What Does AI Offer Users of Mainstream Enterprise Systems?',1760696904,1762440500,1,0,1,1),(79,479,'en',1,2,'What is Governance Risk and Compliance (GRC)? A Definitive Guide',1760704882,1762440682,1,0,1,1),(80,480,'en',1,2,'15 Best Practices In    Salesforce Development ',1760709402,1762440769,1,0,1,1),(81,481,'en',1,2,'Unleashing Business Potential: The Power of Adaptive Enterprise Architecture',1760712443,1762440810,1,0,1,1),(82,482,'en',1,2,'Security By Design - Part 6',1760944401,1762444773,1,0,1,NULL),(83,483,'en',1,2,'Security By Design- Part 7',1760946722,1762444793,1,0,1,NULL),(84,484,'en',1,2,'Security By Design - Part 8',1760949145,1762444809,1,0,1,NULL),(85,485,'en',1,2,'Security By Design Part- 9',1760954578,1762444833,1,0,1,NULL),(86,486,'en',1,2,'Security By Design- Part 10',1760956577,1762444850,1,0,1,NULL),(87,487,'en',1,2,'Security By Design- Part 11',1760960262,1762444872,1,0,1,NULL),(88,488,'en',1,2,'Security By Design- Part 12',1760961485,1762444892,1,0,1,NULL),(89,489,'en',1,2,'Security By Design- Part 13',1761043780,1762444909,1,0,1,NULL),(90,490,'en',1,2,'Security By Design- Part 14',1761046040,1762444928,1,0,1,NULL),(91,491,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1762445523,1,0,1,1),(91,492,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1762447030,1,0,1,1),(131,493,'en',1,2,'Shadow AI and the Governance Gap: What Leaders Must Do Now',1762515676,1762516652,1,0,1,1),(131,494,'en',1,2,'Shadow AI and the Governance Gap: What Leaders Must Do Now',1762515676,1762516706,1,0,1,NULL),(97,495,'en',1,2,'Cyber PMO project prioritization',1761561196,1762516932,1,0,1,NULL),(98,496,'en',1,2,'Cybersecurity Architecture For County Government',1761561749,1762516988,1,0,1,NULL),(99,497,'en',1,2,'Third Party Risk Management',1761562456,1762517118,1,0,1,1),(100,498,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1762517215,1,0,1,1),(101,499,'en',1,2,'Sales and Operations Platform',1761568018,1762517308,1,0,1,NULL),(102,500,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1762517384,1,0,1,NULL),(103,501,'en',1,2,'IT Audit Head',1761569357,1762517424,1,0,1,NULL),(104,502,'en',1,2,'Global Cybersecurity Talent',1761571163,1762517456,1,0,1,NULL),(105,503,'en',1,2,'Data Science Talent',1761571712,1762517478,1,0,1,NULL),(105,504,'en',1,2,'Data Science Talent',1761571712,1762517514,1,0,1,1),(106,505,'en',1,2,'Application Health Assessment',1761572754,1762517555,1,0,1,NULL),(107,506,'en',1,2,'Application Security',1761573085,1762517598,1,0,1,1),(108,507,'en',1,2,'Medical Device Security',1761573518,1762517717,1,0,1,NULL),(109,508,'en',1,2,'IT Integration in M & A Strategy and Readiness',1761573932,1762517807,1,0,1,1),(110,509,'en',1,2,'Enterprise Cyber Risk',1761574295,1762517850,1,0,1,NULL),(111,510,'en',1,2,'IT Integration in M & A Post Announce through Full Integration',1761574821,1762517937,1,0,1,1),(112,511,'en',1,2,'Learning Management System',1761575438,1762518126,1,0,1,1),(113,512,'en',1,2,'IT Integration in M & A Due Diligence',1761575792,1762518204,1,0,1,1),(91,513,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1762529527,1,0,1,1),(127,514,'en',1,2,'Cyber threats in your supply chain',1762435756,1762770779,1,0,1,1),(47,515,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762770868,1,0,1,NULL),(44,516,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1762770918,1,0,1,NULL),(48,517,'en',1,2,'Managing Business Risk in the context of increased remote',1760437306,1762771005,1,0,1,NULL),(49,518,'en',1,2,'Employee Security Awareness Training',1760438920,1762771170,1,0,1,NULL),(50,519,'en',1,2,'Third-Party Supply Chain Risk During The COVID-19',1760440566,1762771221,1,0,1,NULL),(51,520,'en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1762771270,1,0,1,NULL),(53,521,'en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1762771291,1,0,1,NULL),(55,522,'en',1,2,'Whitepaper: Managing Risk In Open Source',1760452482,1762771311,1,0,1,NULL),(57,523,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1762771331,1,0,1,NULL),(128,524,'en',1,2,'Cybersecurity & Remote Teleworking Featu...',1762437731,1762771404,1,0,1,1),(129,525,'en',1,2,'Third Party Supplier Risk',1762438187,1762771485,1,0,1,1),(130,526,'en',1,2,'Employee Training & Awareness',1762438426,1762771636,1,0,1,1),(112,527,'en',1,2,'Learning Management System',1761575438,1762772157,1,0,1,1),(60,528,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1762773780,1,0,1,1),(60,529,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1762773834,1,0,1,1),(127,530,'en',1,2,'Cyber threats in your supply chain',1762435756,1762774306,1,0,1,NULL),(47,531,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762774320,1,0,1,NULL),(44,532,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1762774365,1,0,1,NULL),(48,533,'en',1,2,'Managing Business Risk in the context of increased remote',1760437306,1762774403,1,0,1,NULL),(49,534,'en',1,2,'Employee Security Awareness Training',1760438920,1762774417,1,0,1,NULL),(50,535,'en',1,2,'Third-Party Supply Chain Risk During The COVID-19',1760440566,1762774446,1,0,1,NULL),(51,536,'en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1762774457,1,0,1,NULL),(53,537,'en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1762774468,1,0,1,NULL),(55,538,'en',1,2,'Whitepaper: Managing Risk In Open Source',1760452482,1762774490,1,0,1,NULL),(57,539,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1762774499,1,0,1,NULL),(128,540,'en',1,2,'Cybersecurity & Remote Teleworking Featu...',1762437731,1762774509,1,0,1,NULL),(129,541,'en',1,2,'Third Party Supplier Risk',1762438187,1762774530,1,0,1,NULL),(130,542,'en',1,2,'Employee Training & Awareness',1762438426,1762774542,1,0,1,NULL),(60,543,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1762774583,1,0,1,1),(46,544,'en',1,2,'Zero Trust – Securing Your Business',1760427870,1762774637,1,0,1,NULL),(61,545,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1762774666,1,0,1,NULL),(62,546,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1762774889,1,0,1,1),(63,547,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760543878,1762775038,1,0,1,1),(64,548,'en',1,2,'Security By Design',1760544700,1762775057,1,0,1,NULL),(65,549,'en',1,2,'Security By Design - Part 2',1762439980,1762775121,0,0,1,NULL),(66,550,'en',1,2,'Security By Design - Part 3',1760603427,1762775141,1,0,1,NULL),(67,551,'en',1,2,'Security By Design - Part 4',1760614033,1762775152,1,0,1,NULL),(68,552,'en',1,2,'Security By Design - Part 5',1760619051,1762775166,1,0,1,NULL),(70,553,'en',1,2,'The Legacy Of ELIZA',1760622728,1762775183,1,0,1,NULL),(73,554,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1762775228,1,0,1,NULL),(74,555,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1762775610,1,0,1,NULL),(76,556,'en',1,2,'AI In Mainstream Enterprise Applications ',1760691130,1762775626,1,0,1,NULL),(77,557,'en',1,2,'What Does AI Offer Humankind?',1760695829,1762775637,1,0,1,NULL),(78,558,'en',1,2,'What Does AI Offer Users of Mainstream Enterprise Systems?',1760696904,1762775651,1,0,1,NULL),(79,559,'en',1,2,'What is Governance Risk and Compliance (GRC)? A Definitive Guide',1760704882,1762775669,1,0,1,NULL),(80,560,'en',1,2,'15 Best Practices In    Salesforce Development ',1760709402,1762775680,1,0,1,NULL),(81,561,'en',1,2,'Unleashing Business Potential: The Power of Adaptive Enterprise Architecture',1760712443,1762775694,1,0,1,NULL),(82,562,'en',1,2,'Security By Design - Part 6',1760944401,1762775734,1,0,1,NULL),(83,563,'en',1,2,'Security By Design- Part 7',1760946722,1762775746,1,0,1,NULL),(84,564,'en',1,2,'Security By Design - Part 8',1760949145,1762775756,1,0,1,NULL),(85,565,'en',1,2,'Security By Design Part- 9',1760954578,1762775771,1,0,1,NULL),(86,566,'en',1,2,'Security By Design- Part 10',1760956577,1762775783,1,0,1,NULL),(87,567,'en',1,2,'Security By Design- Part 11',1760960262,1762775792,1,0,1,NULL),(88,568,'en',1,2,'Security By Design- Part 12',1760961485,1762775849,1,0,1,NULL),(89,569,'en',1,2,'Security By Design- Part 13',1761043780,1762775860,1,0,1,NULL),(90,570,'en',1,2,'Security By Design- Part 14',1761046040,1762775869,1,0,1,NULL),(91,571,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1762776604,1,0,1,1),(131,572,'en',1,2,'Shadow AI and the Governance Gap: What Leaders Must Do Now',1762515676,1762776656,1,0,1,NULL),(96,573,'en',1,2,'IT Integration in M & A Pre-Announce through Day 1',1761559929,1762777112,1,0,1,NULL),(97,574,'en',1,2,'Cyber PMO project prioritization',1761561196,1762777251,1,0,1,NULL),(98,575,'en',1,2,'Cybersecurity Architecture For County Government',1761561749,1762777325,1,0,1,NULL),(99,576,'en',1,2,'Third Party Risk Management',1761562456,1762777773,1,0,1,NULL),(100,577,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1762777895,1,0,1,NULL),(101,578,'en',1,2,'Sales and Operations Platform',1761568018,1762777913,1,0,1,NULL),(102,579,'en',1,2,'Rationalization Of A Large Application Portfolio',1761568826,1762777962,1,0,1,NULL),(103,580,'en',1,2,'IT Audit Head',1761569357,1762777998,1,0,1,NULL),(104,581,'en',1,2,'Global Cybersecurity Talent',1761571163,1762778025,1,0,1,NULL),(105,582,'en',1,2,'Data Science Talent',1761571712,1762778049,1,0,1,NULL),(106,583,'en',1,2,'Application Health Assessment',1761572754,1762778109,1,0,1,NULL),(107,584,'en',1,2,'Application Security',1761573085,1762778150,1,0,1,NULL),(108,585,'en',1,2,'Medical Device Security',1761573518,1762778182,1,0,1,NULL),(109,586,'en',1,2,'IT Integration in M & A Strategy and Readiness',1761573932,1762778287,1,0,1,NULL),(110,587,'en',1,2,'Enterprise Cyber Risk',1761574295,1762778338,1,0,1,NULL),(111,588,'en',1,2,'IT Integration in M & A Post Announce through Full Integration',1761574821,1762778356,1,0,1,NULL),(112,589,'en',1,2,'Learning Management System',1761575438,1762778375,1,0,1,NULL),(113,590,'en',1,2,'IT Integration in M & A Due Diligence',1761575792,1762778393,1,0,1,NULL),(92,591,'en',1,1,'Perspectives',1761128226,1762784273,0,0,1,1),(127,592,'en',1,2,'Cyber threats in your supply chain',1762435756,1762788861,1,0,1,1),(47,593,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762790843,1,0,1,1),(127,594,'en',1,2,'Cyber threats in your supply chain',1762435756,1762791022,1,0,1,1),(47,595,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762791059,1,0,1,1),(47,596,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762791094,1,0,1,1),(47,597,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762791136,1,0,1,1),(47,598,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762791398,1,0,1,1),(47,599,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762791410,1,0,1,NULL),(44,600,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1762791666,1,0,1,1),(57,601,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1762791839,1,0,1,1),(127,602,'en',1,2,'Cyber threats in your supply chain',1762435756,1762860142,1,0,1,NULL),(132,603,'en',1,1,'Clone of The CISO Exchange for a Safer Digital World',1762860220,1762860244,1,0,1,1),(127,604,'en',1,2,'Cyber threats in your supply chain',1762435756,1762860431,1,0,1,1),(127,605,'en',1,2,'Cyber threats in your supply chain',1762435756,1762860604,1,0,1,1),(47,606,'en',1,2,'Cybersecurity Incident Response Preparedness',1760434127,1762860704,1,0,1,1),(44,607,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1762860778,1,0,1,1),(48,608,'en',1,2,'Managing Business Risk in the context of increased remote',1760437306,1762860975,1,0,1,1),(49,609,'en',1,2,'Employee Security Awareness Training',1760438920,1762861032,1,0,1,1),(50,610,'en',1,2,'Third-Party Supply Chain Risk During The COVID-19',1760440566,1762861108,1,0,1,1),(51,611,'en',1,2,'Zero Trust As An Enterprise Security Model',1760443875,1762861193,1,0,1,1),(53,612,'en',1,2,'CCPA: Insights Into Applicability And Preparation',1760447583,1762861326,1,0,1,1),(55,613,'en',1,2,'Whitepaper: Managing Risk In Open Source',1760452482,1762861360,1,0,1,1),(57,614,'en',1,2,'Whitepaper: Ransomware Threat Management',1760453783,1762861442,1,0,1,1),(128,615,'en',1,2,'Cybersecurity & Remote Teleworking Featu...',1762437731,1762861511,1,0,1,1),(129,616,'en',1,2,'Third Party Supplier Risk',1762438187,1762861704,1,0,1,1),(130,617,'en',1,2,'Employee Training & Awareness',1762438426,1762861756,1,0,1,1),(60,618,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760461215,1762861848,1,0,1,1),(46,619,'en',1,2,'Zero Trust – Securing Your Business',1760427870,1762861906,1,0,1,1),(61,620,'en',1,2,'Practicing Effective Cybersecurity',1760522608,1762861946,1,0,1,1),(62,621,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760524041,1762862014,1,0,1,1),(63,622,'en',1,2,'Zero Trust Architecture Adoption in Federal Government',1760543878,1762862042,1,0,1,1),(64,623,'en',1,2,'Security By Design',1760544700,1762862077,1,0,1,1),(65,624,'en',1,2,'Security By Design - Part 2',1762439980,1762862101,0,0,1,1),(66,625,'en',1,2,'Security By Design - Part 3',1760603427,1762862129,1,0,1,1),(67,626,'en',1,2,'Security By Design - Part 4',1760614033,1762862153,1,0,1,1),(68,627,'en',1,2,'Security By Design - Part 5',1760619051,1762862185,1,0,1,1),(70,628,'en',1,2,'The Legacy Of ELIZA',1760622728,1762862287,1,0,1,1),(73,629,'en',1,2,'The Benefits Of Salesforce Communities',1760627598,1762862311,1,0,1,1),(74,630,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1762862348,1,0,1,1),(76,631,'en',1,2,'AI In Mainstream Enterprise Applications ',1760691130,1762862404,1,0,1,1),(77,632,'en',1,2,'What Does AI Offer Humankind?',1760695829,1762862435,1,0,1,1),(78,633,'en',1,2,'What Does AI Offer Users of Mainstream Enterprise Systems?',1760696904,1762862466,1,0,1,1),(79,634,'en',1,2,'What is Governance Risk and Compliance (GRC)? A Definitive Guide',1760704882,1762862518,1,0,1,1),(80,635,'en',1,2,'15 Best Practices In    Salesforce Development ',1760709402,1762862549,1,0,1,1),(81,636,'en',1,2,'Unleashing Business Potential: The Power of Adaptive Enterprise Architecture',1760712443,1762862634,1,0,1,1),(82,637,'en',1,2,'Security By Design - Part 6',1760944401,1762862703,1,0,1,1),(83,638,'en',1,2,'Security By Design- Part 7',1760946722,1762862726,1,0,1,1),(84,639,'en',1,2,'Security By Design - Part 8',1760949145,1762862748,1,0,1,1),(85,640,'en',1,2,'Security By Design Part- 9',1760954578,1762862765,1,0,1,1),(86,641,'en',1,2,'Security By Design- Part 10',1760956577,1762862890,1,0,1,1),(87,642,'en',1,2,'Security By Design- Part 11',1760960262,1762862913,1,0,1,1),(88,643,'en',1,2,'Security By Design- Part 12',1760961485,1762862936,1,0,1,1),(89,644,'en',1,2,'Security By Design- Part 13',1761043780,1762862957,1,0,1,1),(90,645,'en',1,2,'Security By Design- Part 14',1761046040,1762862976,1,0,1,1),(91,646,'en',1,2,'The CISO Exchange for a Safer Digital World',1761122528,1762863072,1,0,1,1),(131,647,'en',1,2,'Shadow AI and the Governance Gap: What Leaders Must Do Now',1762515676,1762863101,1,0,1,1),(105,648,'en',1,2,'Data Science Talent',1761571712,1762879415,1,0,1,1),(100,649,'en',1,2,'Cyber Proofing Legal Documents',1761567129,1762879493,1,0,1,1),(112,650,'en',1,2,'Learning Management System',1761575438,1763025655,1,0,1,1),(110,651,'en',1,2,'Enterprise Cyber Risk',1761574295,1763025697,1,0,1,1),(98,652,'en',1,2,'Cybersecurity Architecture For County Government',1761561749,1763025755,1,0,1,1),(44,653,'en',1,2,'IoT Medical Device Cybersecurity',1760360422,1763374067,1,0,1,1),(120,654,'en',1,2,'Better Results require Better Partners.',1761842411,1763381851,1,0,1,1),(120,655,'en',1,2,'Better Results require Better Partners.',1761842411,1763382119,1,0,1,1),(120,656,'en',1,2,'Better Results require Better Partners.',1761842411,1763382524,1,0,1,NULL),(120,657,'en',1,2,'Better Results require Better Partners.',1761842411,1763383580,1,0,1,1),(120,658,'en',1,2,'Better Results require Better Partners.',1761842411,1763384597,1,0,1,1),(31,659,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763387298,1,0,1,NULL),(31,660,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763388542,1,0,1,1),(31,661,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763388615,1,0,1,1),(31,662,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763388865,1,0,1,1),(31,663,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763389634,1,0,1,1),(31,664,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763389843,1,0,1,1),(92,665,'en',1,1,'Perspectives',1761128226,1763390945,0,0,1,1),(92,666,'en',1,1,'Perspectives',1761128226,1763391059,0,0,1,1),(31,667,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763391650,1,0,1,1),(31,668,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763391698,1,0,1,1),(31,669,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763393144,1,0,1,NULL),(31,670,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763393283,1,0,1,NULL),(92,671,'en',1,1,'Perspectives',1761128226,1763456994,0,0,1,NULL),(92,672,'en',1,1,'Perspectives',1761128226,1763457122,0,0,1,1),(92,673,'en',1,1,'Perspectives',1761128226,1763457559,0,0,1,1),(11,674,'en',0,1,'Practicing Effective Cybersecurity',1754657826,1763459487,1,0,1,1),(74,675,'en',1,2,'Artificial Intelligence For All, Responsibly',1760687448,1763460096,1,0,1,NULL),(132,676,'en',0,1,'Clone of The CISO Exchange for a Safer Digital World',1762860220,1763460348,1,0,1,1),(133,677,'en',1,1,'Sample Job Listing',1763460748,1763460807,0,0,1,1),(134,678,'en',1,1,'Internal Careers Open Positions',1763463458,1763464326,0,0,1,1),(52,679,'en',0,1,'IT Integration in M & A Pre-Announce through Day 1',1760449611,1763463742,1,0,1,1),(54,680,'en',0,1,'Cyber PMO project prioritization',1760450131,1763463821,1,0,1,1),(56,681,'en',0,1,'Cybersecurity Architecture For County Government',1760452234,1763464063,1,0,1,1),(135,682,'en',1,1,'Contact Us',1763469386,1763714898,0,0,1,1),(81,683,'en',1,2,'Unleashing Business Potential: The Power of Adaptive Enterprise Architecture',1760712443,1763477143,1,0,1,NULL),(23,684,'en',1,1,'Who we serve ',1759234672,1763545493,1,0,1,1),(23,685,'en',1,1,'Who we serve ',1759234672,1763549792,1,0,1,1),(23,686,'en',1,1,'Who we serve ',1759234672,1763564315,1,0,1,1),(23,687,'en',1,1,'Who we serve ',1759234672,1763571464,1,0,1,1),(31,688,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763632184,1,0,1,1),(31,689,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763632510,1,0,1,1),(31,690,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763635921,1,0,1,1),(31,691,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763636236,1,0,1,1),(31,692,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763636311,1,0,1,1),(31,693,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763636404,1,0,1,1),(31,694,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763636604,1,0,1,1),(31,695,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763639173,1,0,1,1),(31,696,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763639330,1,0,1,NULL),(31,697,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763639378,1,0,1,1),(31,698,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763640340,1,0,1,1),(31,699,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763640617,1,0,1,1),(31,700,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763640705,1,0,1,1),(31,701,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763641664,1,0,1,1),(117,702,'en',1,2,'Business Technology Transformation',1761819233,1763642680,1,0,1,1),(31,703,'en',1,1,'Digital Strategy  & Transformation ',1759831038,1763642689,1,0,1,1),(117,704,'en',1,2,'Business Technology Transformation',1761819233,1763642778,1,0,1,NULL),(23,705,'en',1,1,'Who we serve ',1759234672,1763654147,1,0,1,1),(132,706,'en',0,1,'Clone of The CISO Exchange for a Safer Digital World',1762860220,1763719092,1,0,1,1),(132,707,'en',0,1,'Clone of The CISO Exchange for a Safer Digital World',1762860220,1763719284,1,0,1,1),(132,708,'en',1,1,'Clone of The CISO Exchange for a Safer Digital World',1762860220,1763719322,1,0,1,1),(132,709,'en',1,1,'Clone of The CISO Exchange for a Safer Digital World',1762860220,1763720324,1,0,1,1),(23,710,'en',1,1,'Who we serve ',1759234672,1763720632,1,0,1,1);

--
-- Table structure for table `node_revision`
--

CREATE TABLE `node_revision` (
  `nid` int unsigned NOT NULL,
  `vid` int unsigned NOT NULL AUTO_INCREMENT,
  `langcode` varchar(12) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL,
  `revision_uid` int unsigned DEFAULT NULL COMMENT 'The ID of the target entity.',
  `revision_timestamp` int DEFAULT NULL,
  `revision_log` longtext COLLATE utf8mb4_general_ci,
  `revision_default` tinyint DEFAULT NULL,
  PRIMARY KEY (`vid`),
  KEY `node__nid` (`nid`),
  KEY `node_field__langcode` (`langcode`),
  KEY `node_field__revision_uid__target_id` (`revision_uid`)
) ENGINE=InnoDB AUTO_INCREMENT=711 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci COMMENT='The revision table for node entities.';

--
-- Dumping data for table `node_revision`
--

INSERT INTO `node_revision` VALUES (1,1,'en',1,1753353843,NULL,1),(2,2,'en',1,1753456962,NULL,1),(5,5,'en',1,1753875075,NULL,1),(6,6,'en',1,1753875411,NULL,1),(7,7,'en',1,1753876203,NULL,1),(8,8,'en',1,1753876440,NULL,1),(10,10,'en',1,1754579051,NULL,1),(11,21,'en',1,1754657873,NULL,1),(12,22,'en',1,1755000230,NULL,1),(13,23,'en',1,1755000474,NULL,1),(14,24,'en',1,1755000574,NULL,1),(15,25,'en',1,1755000733,NULL,1),(16,26,'en',1,1756473878,NULL,1),(20,30,'en',1,1758202168,NULL,1),(21,31,'en',1,1758214459,NULL,1),(21,32,'en',1,1758214857,NULL,1),(22,33,'en',1,1758275323,NULL,1),(11,34,'en',1,1758723231,NULL,1),(23,35,'en',1,1759236641,NULL,1),(23,36,'en',1,1759239449,NULL,1),(24,37,'en',1,1759485528,NULL,1),(25,38,'en',1,1759485571,NULL,1),(26,39,'en',1,1759485610,NULL,1),(27,40,'en',1,1759485635,NULL,1),(28,41,'en',1,1759490812,NULL,1),(29,42,'en',1,1759490846,NULL,1),(31,47,'en',1,1759831738,NULL,1),(31,48,'en',1,1759832303,NULL,1),(31,49,'en',1,1759835807,NULL,1),(31,50,'en',1,1759836251,NULL,1),(31,51,'en',1,1759836322,NULL,1),(31,52,'en',1,1759836563,NULL,1),(38,61,'en',1,1759935581,NULL,1),(38,62,'en',1,1759937002,NULL,1),(38,63,'en',1,1759937088,NULL,1),(38,64,'en',1,1759937818,NULL,1),(38,65,'en',1,1759938399,NULL,1),(38,66,'en',1,1759939187,NULL,1),(40,77,'en',1,1760088371,NULL,1),(41,78,'en',1,1760099091,NULL,1),(41,79,'en',1,1760099414,NULL,1),(42,80,'en',1,1760101054,NULL,1),(42,81,'en',1,1760101977,NULL,1),(42,82,'en',1,1760102733,NULL,1),(42,83,'en',1,1760103008,NULL,1),(43,84,'en',2,1760355675,NULL,1),(44,85,'en',2,1760363735,NULL,1),(46,87,'en',2,1760430555,NULL,1),(47,88,'en',2,1760434621,NULL,1),(47,89,'en',2,1760434746,NULL,1),(43,90,'en',1,1760434961,NULL,1),(47,91,'en',2,1760435241,NULL,1),(44,92,'en',2,1760435858,NULL,1),(46,93,'en',2,1760435927,NULL,1),(47,94,'en',2,1760437182,NULL,1),(48,95,'en',2,1760438496,NULL,1),(49,96,'en',2,1760440200,NULL,1),(50,97,'en',2,1760442614,NULL,1),(51,98,'en',2,1760447155,NULL,1),(52,99,'en',1,1760450065,NULL,1),(53,100,'en',2,1760450127,NULL,1),(54,101,'en',1,1760452152,NULL,1),(55,102,'en',2,1760453554,NULL,1),(56,103,'en',1,1760453765,NULL,1),(57,104,'en',2,1760454147,NULL,1),(43,105,'en',1,1760458125,NULL,1),(58,106,'en',2,1760458372,NULL,1),(59,107,'en',2,1760460645,NULL,1),(59,108,'en',2,1760461105,NULL,1),(58,109,'en',2,1760461127,NULL,1),(59,110,'en',2,1760461200,NULL,1),(60,111,'en',2,1760462207,NULL,1),(58,112,'en',2,1760507159,NULL,1),(59,113,'en',2,1760507172,NULL,1),(60,114,'en',2,1760507933,NULL,1),(60,115,'en',2,1760507998,NULL,1),(60,116,'en',2,1760520520,NULL,1),(60,117,'en',1,1760520876,NULL,1),(60,118,'en',2,1760522066,NULL,1),(60,119,'en',2,1760522257,NULL,1),(61,120,'en',2,1760523191,NULL,1),(61,121,'en',2,1760523638,NULL,1),(61,122,'en',2,1760523700,NULL,1),(60,123,'en',2,1760524002,NULL,1),(62,124,'en',2,1760529203,NULL,1),(44,125,'en',2,1760531740,NULL,1),(46,126,'en',2,1760532065,NULL,1),(47,127,'en',2,1760532190,NULL,1),(48,128,'en',2,1760532259,NULL,1),(49,129,'en',2,1760532403,NULL,1),(50,130,'en',2,1760532487,NULL,1),(51,131,'en',2,1760532601,NULL,1),(53,132,'en',2,1760532666,NULL,1),(57,133,'en',2,1760532996,NULL,1),(57,134,'en',2,1760533119,NULL,1),(55,135,'en',2,1760533162,NULL,1),(61,136,'en',2,1760533507,NULL,1),(44,137,'en',2,1760533547,NULL,1),(23,138,'en',1,1760539730,NULL,1),(38,139,'en',1,1760540018,NULL,1),(63,140,'en',2,1760544404,NULL,1),(62,141,'en',2,1760544542,NULL,1),(64,142,'en',2,1760545618,NULL,1),(64,143,'en',2,1760545648,NULL,1),(64,144,'en',2,1760545723,NULL,1),(64,145,'en',2,1760545774,NULL,1),(60,146,'en',2,1760546528,NULL,1),(63,147,'en',2,1760546696,NULL,1),(62,148,'en',2,1760546848,NULL,1),(65,149,'en',2,1760600436,NULL,1),(65,150,'en',2,1760600491,NULL,1),(65,151,'en',2,1760601137,NULL,1),(66,152,'en',2,1760612008,NULL,1),(66,153,'en',2,1760612034,NULL,1),(66,154,'en',2,1760613805,NULL,1),(66,155,'en',2,1760613829,NULL,1),(67,156,'en',2,1760615946,NULL,1),(67,157,'en',2,1760615995,NULL,1),(67,158,'en',1,1760619558,NULL,1),(62,159,'en',1,1760619645,NULL,1),(68,160,'en',2,1760620607,NULL,1),(68,161,'en',2,1760620691,NULL,1),(69,162,'en',2,1760622647,NULL,1),(70,163,'en',2,1760623509,NULL,1),(71,164,'en',1,1760625394,NULL,1),(69,165,'en',2,1760626765,NULL,1),(58,166,'en',2,1760626786,NULL,1),(71,167,'en',1,1760627142,NULL,1),(70,168,'en',2,1760627317,NULL,1),(72,169,'en',2,1760627587,NULL,1),(71,170,'en',1,1760627663,NULL,1),(71,171,'en',1,1760629043,NULL,1),(71,172,'en',1,1760629182,NULL,1),(71,173,'en',1,1760629824,NULL,1),(71,174,'en',1,1760630004,NULL,1),(73,175,'en',2,1760633073,NULL,1),(73,176,'en',2,1760633168,NULL,1),(73,177,'en',2,1760633264,NULL,1),(73,178,'en',2,1760633373,NULL,1),(73,179,'en',2,1760633509,NULL,1),(73,180,'en',2,1760633731,NULL,1),(73,181,'en',2,1760633850,NULL,1),(73,182,'en',2,1760634426,NULL,1),(73,183,'en',2,1760635007,NULL,1),(73,184,'en',2,1760681045,NULL,1),(73,185,'en',2,1760681361,NULL,1),(73,186,'en',2,1760681494,NULL,1),(73,187,'en',2,1760681627,NULL,1),(73,188,'en',2,1760686147,NULL,1),(73,189,'en',2,1760686303,NULL,1),(73,190,'en',2,1760686616,NULL,1),(73,191,'en',2,1760686820,NULL,1),(73,192,'en',2,1760686857,NULL,1),(74,193,'en',2,1760689013,NULL,1),(74,194,'en',2,1760689206,NULL,1),(74,195,'en',2,1760689263,NULL,1),(74,196,'en',2,1760689334,NULL,1),(74,197,'en',2,1760690739,NULL,1),(74,198,'en',2,1760690763,NULL,1),(75,199,'en',2,1760691119,NULL,1),(76,200,'en',2,1760692055,NULL,1),(77,201,'en',2,1760696632,NULL,1),(77,202,'en',2,1760696892,NULL,1),(78,203,'en',2,1760698306,NULL,1),(78,204,'en',2,1760703751,NULL,1),(74,205,'en',1,1760704748,NULL,1),(79,206,'en',2,1760708961,NULL,1),(80,207,'en',2,1760712259,NULL,1),(81,208,'en',2,1760714039,NULL,1),(82,209,'en',2,1760946284,NULL,1),(83,210,'en',2,1760948842,NULL,1),(84,211,'en',2,1760950657,NULL,1),(84,212,'en',2,1760953245,NULL,1),(85,213,'en',2,1760955810,NULL,1),(85,214,'en',2,1760956489,NULL,1),(86,215,'en',2,1760957171,NULL,1),(87,216,'en',2,1760961271,NULL,1),(87,217,'en',2,1760961307,NULL,1),(88,218,'en',2,1760965401,NULL,1),(88,219,'en',2,1760965461,NULL,1),(88,220,'en',2,1760966878,NULL,1),(88,221,'en',2,1760967690,NULL,1),(89,222,'en',2,1761045398,NULL,1),(90,223,'en',2,1761047951,NULL,1),(91,224,'en',2,1761123457,NULL,1),(91,225,'en',2,1761124233,NULL,1),(91,226,'en',2,1761124280,NULL,1),(91,227,'en',2,1761124649,NULL,1),(92,228,'en',1,1761128246,NULL,1),(92,229,'en',1,1761128280,NULL,1),(92,230,'en',1,1761128485,NULL,1),(90,231,'en',1,1761128988,NULL,1),(90,232,'en',2,1761141806,NULL,1),(89,233,'en',2,1761149006,NULL,1),(88,234,'en',2,1761150996,NULL,1),(87,235,'en',2,1761151013,NULL,1),(86,236,'en',2,1761151026,NULL,1),(85,237,'en',2,1761151048,NULL,1),(84,238,'en',2,1761151091,NULL,1),(83,239,'en',2,1761151308,NULL,1),(82,240,'en',2,1761151400,NULL,1),(78,241,'en',2,1761153532,NULL,1),(77,242,'en',2,1761153563,NULL,1),(76,243,'en',2,1761153588,NULL,1),(73,244,'en',2,1761153616,NULL,1),(68,245,'en',2,1761153638,NULL,1),(67,246,'en',2,1761153754,NULL,1),(66,247,'en',2,1761153788,NULL,1),(65,248,'en',2,1761153892,NULL,1),(64,249,'en',2,1761154070,NULL,1),(44,250,'en',2,1761154157,NULL,1),(46,251,'en',2,1761154299,NULL,1),(73,252,'en',2,1761154722,NULL,1),(74,253,'en',2,1761206819,NULL,1),(47,254,'en',2,1761206957,NULL,1),(47,255,'en',2,1761219753,NULL,1),(74,256,'en',2,1761219820,NULL,1),(91,257,'en',2,1761219958,NULL,1),(81,258,'en',2,1761220023,NULL,1),(80,259,'en',2,1761220126,NULL,1),(79,260,'en',2,1761220215,NULL,1),(70,261,'en',2,1761220338,NULL,1),(62,262,'en',2,1761220476,NULL,1),(63,263,'en',2,1761220501,NULL,1),(60,264,'en',2,1761220591,NULL,1),(61,265,'en',2,1761220652,NULL,1),(55,266,'en',2,1761220764,NULL,1),(57,267,'en',2,1761220787,NULL,1),(53,268,'en',2,1761220852,NULL,1),(51,269,'en',2,1761220895,NULL,1),(50,270,'en',2,1761220913,NULL,1),(49,271,'en',2,1761220948,NULL,1),(48,272,'en',2,1761220976,NULL,1),(93,273,'en',1,1761222479,NULL,1),(94,274,'en',1,1761227495,NULL,1),(95,275,'en',1,1761228967,NULL,1),(96,276,'en',2,1761561128,NULL,1),(97,277,'en',2,1761561693,NULL,1),(97,278,'en',2,1761561722,NULL,1),(98,279,'en',2,1761562366,NULL,1),(99,280,'en',2,1761563317,NULL,1),(99,281,'en',2,1761566600,NULL,1),(100,282,'en',2,1761567755,NULL,1),(101,283,'en',2,1761568387,NULL,1),(102,284,'en',2,1761569320,NULL,1),(102,285,'en',2,1761569339,NULL,1),(103,286,'en',2,1761569744,NULL,1),(104,287,'en',2,1761571594,NULL,1),(105,288,'en',2,1761571961,NULL,1),(105,289,'en',1,1761572175,NULL,1),(105,290,'en',2,1761572323,NULL,1),(96,291,'en',2,1761572360,NULL,1),(97,292,'en',2,1761572382,NULL,1),(98,293,'en',2,1761572406,NULL,1),(99,294,'en',2,1761572427,NULL,1),(100,295,'en',2,1761572447,NULL,1),(101,296,'en',2,1761572472,NULL,1),(102,297,'en',2,1761572489,NULL,1),(103,298,'en',2,1761572520,NULL,1),(104,299,'en',2,1761572547,NULL,1),(105,300,'en',2,1761572564,NULL,1),(96,301,'en',2,1761572582,NULL,1),(106,302,'en',2,1761573067,NULL,1),(107,303,'en',2,1761573410,NULL,1),(108,304,'en',2,1761573837,NULL,1),(109,305,'en',2,1761574194,NULL,1),(110,306,'en',2,1761574762,NULL,1),(111,307,'en',2,1761575229,NULL,1),(112,308,'en',2,1761575672,NULL,1),(113,309,'en',2,1761576074,NULL,1),(92,310,'en',1,1761577540,NULL,1),(106,311,'en',2,1761644983,NULL,1),(102,312,'en',2,1761645013,NULL,1),(110,313,'en',2,1761645050,NULL,1),(108,314,'en',2,1761645087,NULL,1),(107,315,'en',2,1761645104,NULL,1),(99,316,'en',2,1761645132,NULL,1),(112,317,'en',2,1761645238,NULL,1),(105,318,'en',2,1761645258,NULL,1),(104,319,'en',2,1761645280,NULL,1),(103,320,'en',2,1761645297,NULL,1),(113,321,'en',2,1761645332,NULL,1),(110,322,'en',2,1761645377,NULL,1),(108,323,'en',2,1761645408,NULL,1),(107,324,'en',2,1761645451,NULL,1),(104,325,'en',2,1761645479,NULL,1),(103,326,'en',2,1761645508,NULL,1),(100,327,'en',2,1761645530,NULL,1),(99,328,'en',2,1761645548,NULL,1),(98,329,'en',2,1761645576,NULL,1),(97,330,'en',2,1761645600,NULL,1),(111,331,'en',2,1761645877,NULL,1),(109,332,'en',2,1761645910,NULL,1),(106,333,'en',2,1761645940,NULL,1),(102,334,'en',2,1761645986,NULL,1),(101,335,'en',2,1761646016,NULL,1),(96,336,'en',2,1761646043,NULL,1),(112,337,'en',2,1761646133,NULL,1),(105,338,'en',2,1761646153,NULL,1),(110,339,'en',2,1761649126,NULL,1),(106,340,'en',2,1761649164,NULL,1),(101,341,'en',2,1761651290,NULL,1),(103,342,'en',2,1761651325,NULL,1),(110,343,'en',2,1761651356,NULL,1),(106,344,'en',2,1761651382,NULL,1),(101,345,'en',2,1761651409,NULL,1),(98,346,'en',2,1761651449,NULL,1),(113,347,'en',2,1761651482,NULL,1),(107,348,'en',2,1761651506,NULL,1),(113,349,'en',2,1761651521,NULL,1),(96,350,'en',2,1761651555,NULL,1),(113,351,'en',2,1761651624,NULL,1),(112,352,'en',2,1761651650,NULL,1),(112,353,'en',2,1761651679,NULL,1),(111,354,'en',2,1761651706,NULL,1),(110,355,'en',2,1761651766,NULL,1),(109,356,'en',2,1761651788,NULL,1),(108,357,'en',2,1761651825,NULL,1),(107,358,'en',2,1761651845,NULL,1),(103,359,'en',2,1761651861,NULL,1),(102,360,'en',2,1761651954,NULL,1),(100,361,'en',2,1761651978,NULL,1),(97,362,'en',2,1761651994,NULL,1),(96,363,'en',2,1761652025,NULL,1),(112,364,'en',2,1761652065,NULL,1),(110,365,'en',2,1761652088,NULL,1),(108,366,'en',2,1761652117,NULL,1),(105,367,'en',2,1761652170,NULL,1),(104,368,'en',2,1761652242,NULL,1),(102,369,'en',2,1761652259,NULL,1),(100,370,'en',2,1761652283,NULL,1),(97,371,'en',2,1761652318,NULL,1),(113,372,'en',2,1761652396,NULL,1),(109,373,'en',2,1761652418,NULL,1),(108,374,'en',2,1761652442,NULL,1),(107,375,'en',2,1761652464,NULL,1),(105,376,'en',2,1761652490,NULL,1),(104,377,'en',2,1761652520,NULL,1),(102,378,'en',2,1761652544,NULL,1),(100,379,'en',2,1761652581,NULL,1),(99,380,'en',2,1761652731,NULL,1),(100,381,'en',2,1761652751,NULL,1),(99,382,'en',2,1761652790,NULL,1),(97,383,'en',2,1761652819,NULL,1),(96,384,'en',2,1761652840,NULL,1),(115,386,'en',1,1761655509,NULL,1),(51,387,'en',2,1761656374,NULL,1),(53,388,'en',2,1761657330,NULL,1),(55,389,'en',2,1761657433,NULL,1),(57,390,'en',2,1761657503,NULL,1),(63,391,'en',2,1761658643,NULL,1),(46,392,'en',2,1761658886,NULL,1),(57,393,'en',2,1761658908,NULL,1),(61,394,'en',2,1761658996,NULL,1),(64,395,'en',2,1761659079,NULL,1),(65,396,'en',2,1761659165,NULL,1),(66,397,'en',2,1761659189,NULL,1),(67,398,'en',2,1761659237,NULL,1),(68,399,'en',2,1761659272,NULL,1),(82,400,'en',2,1761659293,NULL,1),(83,401,'en',2,1761659310,NULL,1),(84,402,'en',2,1761659335,NULL,1),(85,403,'en',2,1761659361,NULL,1),(86,404,'en',2,1761659377,NULL,1),(87,405,'en',2,1761659396,NULL,1),(88,406,'en',2,1761659415,NULL,1),(89,407,'en',2,1761659432,NULL,1),(90,408,'en',2,1761659446,NULL,1),(91,409,'en',2,1761659569,NULL,1),(116,410,'en',1,1761732812,NULL,1),(31,411,'en',1,1761818466,NULL,1),(31,412,'en',1,1761820615,NULL,1),(31,413,'en',1,1761821430,NULL,1),(31,414,'en',1,1761821787,NULL,1),(31,415,'en',1,1761822401,NULL,1),(117,416,'en',2,1761823721,NULL,1),(117,417,'en',2,1761825611,NULL,1),(118,418,'en',2,1761830696,NULL,1),(118,419,'en',2,1761830900,NULL,1),(118,420,'en',2,1761830975,NULL,1),(119,421,'en',2,1761834035,NULL,1),(119,422,'en',2,1761836171,NULL,1),(119,423,'en',2,1761836746,NULL,1),(119,424,'en',2,1761836935,NULL,1),(119,425,'en',2,1761840756,NULL,1),(119,426,'en',2,1761840874,NULL,1),(119,427,'en',2,1761841374,NULL,1),(119,428,'en',2,1761841459,NULL,1),(118,429,'en',2,1761841917,NULL,1),(120,430,'en',2,1761843647,NULL,1),(120,431,'en',2,1761845296,NULL,1),(120,432,'en',1,1761845672,NULL,1),(120,433,'en',1,1761845720,NULL,1),(91,434,'en',1,1761845762,NULL,1),(91,435,'en',1,1761906435,NULL,1),(120,436,'en',2,1761912054,NULL,1),(120,437,'en',2,1761915493,NULL,1),(91,438,'en',2,1762169641,NULL,1),(121,439,'en',2,1762169427,NULL,1),(122,440,'en',2,1762175364,NULL,1),(123,441,'en',2,1762243987,NULL,1),(124,442,'en',2,1762250849,NULL,1),(125,443,'en',2,1762258268,NULL,1),(126,444,'en',2,1762261086,NULL,1),(47,445,'en',1,1762434363,NULL,1),(80,446,'en',1,1762434510,NULL,1),(127,447,'en',2,1762436304,NULL,1),(47,448,'en',2,1762437085,NULL,1),(44,449,'en',2,1762437176,NULL,1),(48,450,'en',2,1762437320,NULL,1),(49,451,'en',2,1762437353,NULL,1),(50,452,'en',2,1762437434,NULL,1),(51,453,'en',2,1762437507,NULL,1),(53,454,'en',2,1762437564,NULL,1),(55,455,'en',2,1762437613,NULL,1),(57,456,'en',2,1762437685,NULL,1),(128,457,'en',2,1762438016,NULL,1),(128,458,'en',2,1762438179,NULL,1),(129,459,'en',2,1762438399,NULL,1),(130,460,'en',2,1762438497,NULL,1),(60,461,'en',2,1762438847,NULL,1),(60,462,'en',2,1762439056,NULL,1),(46,463,'en',2,1762439129,NULL,1),(61,464,'en',2,1762439443,NULL,1),(62,465,'en',2,1762439573,NULL,1),(63,466,'en',2,1762439628,NULL,1),(64,467,'en',2,1762439752,NULL,1),(66,468,'en',2,1762440013,NULL,1),(65,469,'en',2,1762440029,NULL,1),(66,470,'en',2,1762440044,NULL,1),(67,471,'en',2,1762440067,NULL,1),(68,472,'en',2,1762440099,NULL,1),(70,473,'en',2,1762440146,NULL,1),(73,474,'en',2,1762440255,NULL,1),(74,475,'en',2,1762440299,NULL,1),(76,476,'en',2,1762440376,NULL,1),(77,477,'en',2,1762440460,NULL,1),(78,478,'en',2,1762440500,NULL,1),(79,479,'en',2,1762440682,NULL,1),(80,480,'en',2,1762440769,NULL,1),(81,481,'en',2,1762440810,NULL,1),(82,482,'en',2,1762444773,NULL,1),(83,483,'en',2,1762444793,NULL,1),(84,484,'en',2,1762444809,NULL,1),(85,485,'en',2,1762444833,NULL,1),(86,486,'en',2,1762444850,NULL,1),(87,487,'en',2,1762444872,NULL,1),(88,488,'en',2,1762444892,NULL,1),(89,489,'en',2,1762444909,NULL,1),(90,490,'en',2,1762444928,NULL,1),(91,491,'en',2,1762445523,NULL,1),(91,492,'en',2,1762447030,NULL,1),(131,493,'en',2,1762516652,NULL,1),(131,494,'en',2,1762516706,NULL,1),(97,495,'en',2,1762516932,NULL,1),(98,496,'en',2,1762516988,NULL,1),(99,497,'en',2,1762517118,NULL,1),(100,498,'en',2,1762517215,NULL,1),(101,499,'en',2,1762517308,NULL,1),(102,500,'en',2,1762517384,NULL,1),(103,501,'en',2,1762517424,NULL,1),(104,502,'en',2,1762517456,NULL,1),(105,503,'en',2,1762517478,NULL,1),(105,504,'en',2,1762517514,NULL,1),(106,505,'en',2,1762517555,NULL,1),(107,506,'en',2,1762517598,NULL,1),(108,507,'en',2,1762517717,NULL,1),(109,508,'en',2,1762517807,NULL,1),(110,509,'en',2,1762517850,NULL,1),(111,510,'en',2,1762517937,NULL,1),(112,511,'en',2,1762518126,NULL,1),(113,512,'en',2,1762518204,NULL,1),(91,513,'en',1,1762529527,NULL,1),(127,514,'en',2,1762770779,NULL,1),(47,515,'en',2,1762770868,NULL,1),(44,516,'en',2,1762770918,NULL,1),(48,517,'en',2,1762771005,NULL,1),(49,518,'en',2,1762771170,NULL,1),(50,519,'en',2,1762771221,NULL,1),(51,520,'en',2,1762771270,NULL,1),(53,521,'en',2,1762771291,NULL,1),(55,522,'en',2,1762771311,NULL,1),(57,523,'en',2,1762771331,NULL,1),(128,524,'en',2,1762771404,NULL,1),(129,525,'en',2,1762771485,NULL,1),(130,526,'en',2,1762771636,NULL,1),(112,527,'en',1,1762772157,NULL,1),(60,528,'en',2,1762773780,NULL,1),(60,529,'en',2,1762773834,NULL,1),(127,530,'en',2,1762774306,NULL,1),(47,531,'en',2,1762774320,NULL,1),(44,532,'en',2,1762774365,NULL,1),(48,533,'en',2,1762774403,NULL,1),(49,534,'en',2,1762774417,NULL,1),(50,535,'en',2,1762774446,NULL,1),(51,536,'en',2,1762774457,NULL,1),(53,537,'en',2,1762774468,NULL,1),(55,538,'en',2,1762774490,NULL,1),(57,539,'en',2,1762774499,NULL,1),(128,540,'en',2,1762774509,NULL,1),(129,541,'en',2,1762774530,NULL,1),(130,542,'en',2,1762774542,NULL,1),(60,543,'en',2,1762774583,NULL,1),(46,544,'en',2,1762774637,NULL,1),(61,545,'en',2,1762774666,NULL,1),(62,546,'en',2,1762774889,NULL,1),(63,547,'en',2,1762775038,NULL,1),(64,548,'en',2,1762775057,NULL,1),(65,549,'en',2,1762775121,NULL,1),(66,550,'en',2,1762775141,NULL,1),(67,551,'en',2,1762775152,NULL,1),(68,552,'en',2,1762775166,NULL,1),(70,553,'en',2,1762775183,NULL,1),(73,554,'en',2,1762775228,NULL,1),(74,555,'en',2,1762775610,NULL,1),(76,556,'en',2,1762775626,NULL,1),(77,557,'en',2,1762775637,NULL,1),(78,558,'en',2,1762775651,NULL,1),(79,559,'en',2,1762775669,NULL,1),(80,560,'en',2,1762775680,NULL,1),(81,561,'en',2,1762775694,NULL,1),(82,562,'en',2,1762775734,NULL,1),(83,563,'en',2,1762775746,NULL,1),(84,564,'en',2,1762775756,NULL,1),(85,565,'en',2,1762775771,NULL,1),(86,566,'en',2,1762775783,NULL,1),(87,567,'en',2,1762775792,NULL,1),(88,568,'en',2,1762775849,NULL,1),(89,569,'en',2,1762775860,NULL,1),(90,570,'en',2,1762775869,NULL,1),(91,571,'en',2,1762776604,NULL,1),(131,572,'en',2,1762776656,NULL,1),(96,573,'en',2,1762777112,NULL,1),(97,574,'en',2,1762777251,NULL,1),(98,575,'en',2,1762777325,NULL,1),(99,576,'en',2,1762777773,NULL,1),(100,577,'en',2,1762777895,NULL,1),(101,578,'en',2,1762777913,NULL,1),(102,579,'en',2,1762777962,NULL,1),(103,580,'en',2,1762777998,NULL,1),(104,581,'en',2,1762778025,NULL,1),(105,582,'en',2,1762778049,NULL,1),(106,583,'en',2,1762778109,NULL,1),(107,584,'en',2,1762778150,NULL,1),(108,585,'en',2,1762778182,NULL,1),(109,586,'en',2,1762778287,NULL,1),(110,587,'en',2,1762778338,NULL,1),(111,588,'en',2,1762778356,NULL,1),(112,589,'en',2,1762778375,NULL,1),(113,590,'en',2,1762778393,NULL,1),(92,591,'en',1,1762784273,NULL,1),(127,592,'en',2,1762788861,NULL,1),(47,593,'en',2,1762790843,NULL,1),(127,594,'en',2,1762791022,NULL,1),(47,595,'en',2,1762791059,NULL,1),(47,596,'en',2,1762791094,NULL,1),(47,597,'en',2,1762791136,NULL,1),(47,598,'en',2,1762791398,NULL,1),(47,599,'en',2,1762791410,NULL,1),(44,600,'en',2,1762791666,NULL,1),(57,601,'en',2,1762791839,NULL,1),(127,602,'en',2,1762860142,NULL,1),(132,603,'en',1,1762860244,NULL,1),(127,604,'en',2,1762860431,NULL,1),(127,605,'en',2,1762860604,NULL,1),(47,606,'en',2,1762860704,NULL,1),(44,607,'en',2,1762860778,NULL,1),(48,608,'en',2,1762860975,NULL,1),(49,609,'en',2,1762861032,NULL,1),(50,610,'en',2,1762861108,NULL,1),(51,611,'en',2,1762861193,NULL,1),(53,612,'en',2,1762861326,NULL,1),(55,613,'en',2,1762861360,NULL,1),(57,614,'en',2,1762861442,NULL,1),(128,615,'en',2,1762861511,NULL,1),(129,616,'en',2,1762861704,NULL,1),(130,617,'en',2,1762861756,NULL,1),(60,618,'en',2,1762861848,NULL,1),(46,619,'en',2,1762861906,NULL,1),(61,620,'en',2,1762861946,NULL,1),(62,621,'en',2,1762862014,NULL,1),(63,622,'en',2,1762862042,NULL,1),(64,623,'en',2,1762862077,NULL,1),(65,624,'en',2,1762862101,NULL,1),(66,625,'en',2,1762862129,NULL,1),(67,626,'en',2,1762862153,NULL,1),(68,627,'en',2,1762862185,NULL,1),(70,628,'en',2,1762862287,NULL,1),(73,629,'en',2,1762862311,NULL,1),(74,630,'en',2,1762862348,NULL,1),(76,631,'en',2,1762862404,NULL,1),(77,632,'en',2,1762862435,NULL,1),(78,633,'en',2,1762862466,NULL,1),(79,634,'en',2,1762862518,NULL,1),(80,635,'en',2,1762862549,NULL,1),(81,636,'en',2,1762862634,NULL,1),(82,637,'en',2,1762862703,NULL,1),(83,638,'en',2,1762862726,NULL,1),(84,639,'en',2,1762862748,NULL,1),(85,640,'en',2,1762862765,NULL,1),(86,641,'en',2,1762862890,NULL,1),(87,642,'en',2,1762862913,NULL,1),(88,643,'en',2,1762862936,NULL,1),(89,644,'en',2,1762862957,NULL,1),(90,645,'en',2,1762862976,NULL,1),(91,646,'en',2,1762863072,NULL,1),(131,647,'en',2,1762863101,NULL,1),(105,648,'en',1,1762879415,NULL,1),(100,649,'en',1,1762879493,NULL,1),(112,650,'en',1,1763025655,NULL,1),(110,651,'en',1,1763025697,NULL,1),(98,652,'en',1,1763025755,NULL,1),(44,653,'en',1,1763374067,NULL,1),(120,654,'en',2,1763381851,NULL,1),(120,655,'en',2,1763382119,NULL,1),(120,656,'en',2,1763382524,NULL,1),(120,657,'en',1,1763383580,NULL,1),(120,658,'en',2,1763384597,NULL,1),(31,659,'en',2,1763387298,NULL,1),(31,660,'en',2,1763388542,NULL,1),(31,661,'en',2,1763388615,NULL,1),(31,662,'en',2,1763388865,NULL,1),(31,663,'en',2,1763389634,NULL,1),(31,664,'en',2,1763389843,NULL,1),(92,665,'en',1,1763390945,NULL,1),(92,666,'en',1,1763391059,NULL,1),(31,667,'en',2,1763391650,NULL,1),(31,668,'en',2,1763391698,NULL,1),(31,669,'en',1,1763393144,NULL,1),(31,670,'en',1,1763393283,NULL,1),(92,671,'en',1,1763456994,NULL,1),(92,672,'en',1,1763457122,NULL,1),(92,673,'en',1,1763457559,NULL,1),(11,674,'en',2,1763459487,NULL,1),(74,675,'en',2,1763460096,NULL,1),(132,676,'en',2,1763460348,NULL,1),(133,677,'en',1,1763460807,NULL,1),(134,678,'en',1,1763463497,NULL,1),(52,679,'en',2,1763463742,NULL,1),(54,680,'en',2,1763463821,NULL,1),(56,681,'en',2,1763464063,NULL,1),(135,682,'en',1,1763469436,NULL,1),(81,683,'en',1,1763477143,NULL,1),(23,684,'en',1,1763545493,NULL,1),(23,685,'en',1,1763549792,NULL,1),(23,686,'en',1,1763564315,NULL,1),(23,687,'en',1,1763571464,NULL,1),(31,688,'en',1,1763632184,NULL,1),(31,689,'en',1,1763632510,NULL,1),(31,690,'en',1,1763635921,NULL,1),(31,691,'en',1,1763636236,NULL,1),(31,692,'en',1,1763636311,NULL,1),(31,693,'en',1,1763636404,NULL,1),(31,694,'en',1,1763636604,NULL,1),(31,695,'en',1,1763639173,NULL,1),(31,696,'en',1,1763639330,NULL,1),(31,697,'en',1,1763639378,NULL,1),(31,698,'en',1,1763640340,NULL,1),(31,699,'en',1,1763640617,NULL,1),(31,700,'en',1,1763640705,NULL,1),(31,701,'en',1,1763641664,NULL,1),(117,702,'en',2,1763642680,NULL,1),(31,703,'en',1,1763642689,NULL,1),(117,704,'en',2,1763642778,NULL,1),(23,705,'en',1,1763654147,NULL,1),(132,706,'en',1,1763719092,NULL,1),(132,707,'en',1,1763719284,NULL,1),(132,708,'en',1,1763719322,NULL,1),(132,709,'en',1,1763720324,NULL,1),(23,710,'en',1,1763720632,NULL,1);

--
-- Table structure for table `node_revision__body`
--

CREATE TABLE `node_revision__body` (
  `bundle` varchar(128) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL DEFAULT '' COMMENT 'The field instance bundle to which this row belongs, used when deleting a field instance',
  `deleted` tinyint NOT NULL DEFAULT '0' COMMENT 'A boolean indicating whether this data item has been deleted',
  `entity_id` int unsigned NOT NULL COMMENT 'The entity id this data is attached to',
  `revision_id` int unsigned NOT NULL COMMENT 'The entity revision id this data is attached to',
  `langcode` varchar(32) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL DEFAULT '' COMMENT 'The language code for this data item.',
  `delta` int unsigned NOT NULL COMMENT 'The sequence number for this data item, used for multi-value fields',
  `body_value` longtext COLLATE utf8mb4_general_ci NOT NULL,
  `body_summary` longtext COLLATE utf8mb4_general_ci,
  `body_format` varchar(255) CHARACTER SET ascii COLLATE ascii_general_ci DEFAULT NULL,
  PRIMARY KEY (`entity_id`,`revision_id`,`deleted`,`delta`,`langcode`),
  KEY `bundle` (`bundle`),
  KEY `revision_id` (`revision_id`),
  KEY `body_format` (`body_format`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci COMMENT='Revision archive storage for node field body.';

--
-- Dumping data for table `node_revision__body`
--

INSERT INTO `node_revision__body` VALUES ('banner',0,2,2,'en',0,'<p><a href=\"https://divihn.com/why-divihn#PathtoSuccsses\">View Our Stories</a></p>','','basic_html'),('blog',0,11,21,'en',0,'<p>I began my last blog post by quoting from a business forum I had read: “To put it bluntly, the CISO role is dead.” And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future. Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something. I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain. It is a fair bet for me to say again today that: The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry. &amp; Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today. Let me take this one step further: “Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!” This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role. The CISO role as we know it today is past its shelf life. It is time to embrace the Digital Risk and Resilience Officer role.</p>','','basic_html'),('blog',0,11,34,'en',0,'<p>I began my last blog post by quoting from a business forum I had read: “To put it bluntly, the CISO role is dead.” And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future. Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something. I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain. It is a fair bet for me to say again today that: The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry. &amp; Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today. Let me take this one step further: “Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!” This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role. The CISO role as we know it today is past its shelf life. It is time to embrace the Digital Risk and Resilience Officer role.</p>','','basic_html'),('blog',0,11,674,'en',0,'<p>I began my last blog post by quoting from a business forum I had read: “To put it bluntly, the CISO role is dead.” And I closed my last post saying that I would encourage you all to think about the potential of a Digital Risk and Resilience Officer role and focus as an evolution needed in Information Security which will be more encompassing and vital to the success of your business’s future. Some of you who read my last post may have dismissed my comment as out of hand. Others may have read a bit deeper into my comments and your reaction, at least internally, were that Joe has no clue what he is talking about. Just maybe, one or two of you may have thought about my comments and said to yourself, he may be onto something. I do not claim to have all the clues, but I can assure you that throughout my career I have prided myself in working hard to ensure I had at least half a clue concerning what was going on around me in my professional domain. It is a fair bet for me to say again today that: The threats and risks our businesses face today are at the highest level of systemic digital risk I have experienced in my 45+ years in the Information Technology industry. &amp; Information Technology organizations no longer control all the information technology devices and systems in use in their organizations today. Let me take this one step further: “Never in the history of modern business operations has there been a risk domain as impactful as Information Technology. Information Technology and Digital Business Systems are the only risk domain which can bring my company’s business operations to a complete standstill in an instant!” This is a quote from a discussion I recently had with the head of Enterprise Risk Management for a multi-billon dollar business. My conversations during the past year with many Chief Risk Officers, Enterprise Risk Managers and Chief Information Security Officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the CISO role as we know it today is past its shelf life, and it is time to seriously embrace a Digital Risk and Resilience Officer role. The CISO role as we know it today is past its shelf life. It is time to embrace the Digital Risk and Resilience Officer role.</p>','','basic_html'),('testimonial',0,12,22,'en',0,'<p>I have found DivIHN to be a reliable partner - bringing a holistic solution oriented approach to every challenge and opportunity. I value their advisory, solutioning, and consulting capabilities. DivIHN is highly customer focused – probing and engaging with the customers to deliver quality and value. I have utilized their services for several years and found their business practices to be healthy and honest. I trust them.</p>','','full_html'),('testimonial',0,13,23,'en',0,'<p>Understanding our needs, addressing those with commendable attention to detail and quality, while maintaining honest business dealings, has been a defining characteristic of DivIHN while serving us. They continue to serve us as a reliable technology services partner. Over the last 15 years, they have earned our trust through performance with integrity.</p>','','basic_html'),('testimonial',0,14,24,'en',0,'<p>DivIHN has been our trusted development partner for over three years. After they performed an application assessment of our legacy platform, we asked them to develop a replacement. Today, this is the mission-critical core sales and operations platform for our business users across the US and Canada.</p>','','basic_html'),('testimonial',0,15,25,'en',0,'<p>DivIHN has been a strategic partner of ours since 2010. We have used DivIHN on many projects, including Flexible ad-hoc projects where we need resources that are dependable, have high expertise, and can deliver with optimal speed. It is one thing to find a good talented person, but it’s another thing to stand behind that person. DivIHN put themselves on the line for it.</p>','','basic_html'),('page',0,21,31,'en',0,'<p>DivIHN Integration Inc. (“DivIHN”) provides this Privacy Policy to let you know our policies and procedures regarding the collection, use and disclosure of information through www.divihn.com (the “Site”), and any other websites, features, applications, widgets or online services that are owned or controlled by DivIHN and that post a link to this Privacy Policy (together with the Site, the “Service”), as well as any information DivIHN collects offline in connection with the Service. It also describes the choices available to you regarding the use of, your access to, and how to update and correct your personal information. Note that we combine the information we collect from you from the Site, through the Service generally, or offline.</p><p>Please note that certain features or services referenced in this Privacy Policy may not be offered on the Service at all times.</p><p>Please note that commercial agreements with our customers and partners including but not limited to Master Services Agreements, Statements of Work, and Mutual Non-Disclosure Agreements take precedence over this Privacy Policy. In the event of conflicting provisions between this policy and any commercial agreement, the most restrictive provision will apply.</p><p>We’ve provided short summaries in this Privacy Policy to help you understand what information we collect, how we use it, and what choices or rights you may have. While these summaries help explain some of the concepts in a simple and clear way, we encourage you to read the entire Privacy Policy to understand our data practices.</p><h4>TABLE OF CONTENTS</h4><ol><li>INFORMATION COLLECTION</li></ol>','','full_html'),('page',0,21,32,'en',0,'<h2 style=\"text-align:center;\">Privacy Policy</h2><p>DivIHN Integration Inc. (“DivIHN”) provides this Privacy Policy to let you know our policies and procedures regarding the collection, use and disclosure of information through www.divihn.com (the “Site”), and any other websites, features, applications, widgets or online services that are owned or controlled by DivIHN and that post a link to this Privacy Policy (together with the Site, the “Service”), as well as any information DivIHN collects offline in connection with the Service. It also describes the choices available to you regarding the use of, your access to, and how to update and correct your personal information. Note that we combine the information we collect from you from the Site, through the Service generally, or offline.</p><p>Please note that certain features or services referenced in this Privacy Policy may not be offered on the Service at all times.</p><p>Please note that commercial agreements with our customers and partners including but not limited to Master Services Agreements, Statements of Work, and Mutual Non-Disclosure Agreements take precedence over this Privacy Policy. In the event of conflicting provisions between this policy and any commercial agreement, the most restrictive provision will apply.</p><p>We’ve provided short summaries in this Privacy Policy to help you understand what information we collect, how we use it, and what choices or rights you may have. While these summaries help explain some of the concepts in a simple and clear way, we encourage you to read the entire Privacy Policy to understand our data practices.</p><h4>TABLE OF CONTENTS</h4><ol><li>INFORMATION COLLECTION</li></ol>','','full_html'),('who_we_serve',0,23,35,'en',0,'<p>We are dedicated to earning our clients\' trust by<br>actively contributing to their success and transformation. Our proven track record of<br>trust includes partnerships with organizations in commercial,<br>non-profit, state and federal government sectors</p>','','full_html'),('who_we_serve',0,23,36,'en',0,'<p>We are dedicated to earning our clients\' trust by<br>actively contributing to their success and transformation. Our proven track record of<br>trust includes partnerships with organizations in commercial,<br>non-profit, state and federal government sectors</p>','','full_html'),('who_we_serve',0,23,138,'en',0,'<p>We are dedicated to earning our clients\' trust by<br>actively contributing to their success and transformation. Our proven track record of<br>trust includes partnerships with organizations in commercial,<br>non-profit, state and federal government sectors</p>','','full_html'),('who_we_serve',0,23,684,'en',0,'<p>We are dedicated to earning our clients\' trust by<br>actively contributing to their success and transformation. Our proven track record of<br>trust includes partnerships with organizations in commercial,<br>non-profit, state and federal government sectors</p>','','full_html'),('who_we_serve',0,23,685,'en',0,'<p class=\"short_description\"><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"0\"><span class=\"overflow-animation\">We are dedicated to earning our clients\' trust by &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"100\"><span class=\"overflow-animation\">actively contributing to their success and transformation. Our proven track record of &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"200\"><span class=\"overflow-animation\">trust includes partnerships with organizations in commercial, &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"300\"><span class=\"overflow-animation\">non-profit, state and federal government sectors.</span></small></p>','','full_html'),('who_we_serve',0,23,686,'en',0,'<p class=\"short_description\"><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"0\"><span class=\"overflow-animation\">We are dedicated to earning our clients\' trust by &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"100\"><span class=\"overflow-animation\">actively contributing to their success and transformation. Our proven track record of &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"200\"><span class=\"overflow-animation\">trust includes partnerships with organizations in commercial, &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"300\"><span class=\"overflow-animation\">non-profit, state and federal government sectors.</span></small></p>','','full_html'),('who_we_serve',0,23,687,'en',0,'<p class=\"short_description\"><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"0\"><span class=\"overflow-animation\">We are dedicated to earning our clients\' trust by &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"100\"><span class=\"overflow-animation\">actively contributing to their success and transformation. Our proven track record of &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"200\"><span class=\"overflow-animation\">trust includes partnerships with organizations in commercial, &nbsp;</span></small><br><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"300\"><span class=\"overflow-animation\">non-profit, state and federal government sectors.</span></small></p>','','full_html'),('who_we_serve',0,23,705,'en',0,'<p class=\"short_description\"><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"0\"><span class=\"overflow-animation\">We are dedicated to earning our clients\' trust by &nbsp;</span></small> <small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"100\"><span class=\"overflow-animation\">actively contributing to their success and transformation. Our proven track record of &nbsp;</span></small> <small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"200\"><span class=\"overflow-animation\">trust includes partnerships with organizations in commercial, &nbsp;</span></small> <small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"300\"><span class=\"overflow-animation\">non-profit, state and federal government sectors.</span></small></p>','','full_html'),('who_we_serve',0,23,710,'en',0,'<p class=\"short_description\"><small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"0\"><span class=\"overflow-animation\">We are dedicated to earning our clients\' trust by &nbsp;</span></small> <small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"100\"><span class=\"overflow-animation\">actively contributing to their success and transformation. Our proven track record of &nbsp;</span></small> <small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"200\"><span class=\"overflow-animation\">trust includes partnerships with organizations in commercial, &nbsp;</span></small> <small class=\"aos-init aos-animate\" data-aos=\"fade-up\" data-aos-delay=\"300\"><span class=\"overflow-animation\">non-profit, state and federal government sectors.</span></small></p>','','full_html'),('government_page',0,28,41,'en',0,'<p>DivIHN seeks Success and Transformation for the Government Clients, through leadership in Strategy Alignment, Technology Vision, Holistic Design, and Delivery Excellence.</p>','','basic_html'),('government_page',0,29,42,'en',0,'<p>DivIHN seeks Success and Transformation for the Government Clients, through leadership in Strategy Alignment, Technology Vision, Holistic Design, and Delivery Excellence.</p>','','basic_html'),('services',0,31,47,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,48,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,49,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,50,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,51,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,52,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,411,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,412,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,413,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,414,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,415,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,659,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,660,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,661,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,662,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,663,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,664,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,667,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,668,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,669,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,670,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,688,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,689,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,690,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,691,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,692,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,693,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,694,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,695,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,696,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,697,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,698,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,699,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,700,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,701,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('services',0,31,703,'en',0,'<p>We design Digital Transformation strategies to optimize Impact and Value for your clients, employees, and shareholders.</p>','','basic_html'),('why_divihn_page',0,38,61,'en',0,'<p>We seek ‘Success and Transformation’ for our Clients, Coworkers, and Community, including our Partner Organizations. We do these with the aid of our Value Delivery Model, our Value System, and Culture, making positive impacts, one interaction at a time.</p>','','full_html'),('why_divihn_page',0,38,62,'en',0,'<p>We seek ‘Success and Transformation’ for our Clients, Coworkers, and Community, including our Partner Organizations. We do these with the aid of our Value Delivery Model, our Value System, and Culture, making positive impacts, one interaction at a time.</p>','','full_html'),('why_divihn_page',0,38,63,'en',0,'<p>We seek ‘Success and Transformation’ for our Clients, Coworkers, and Community, including our Partner Organizations. We do these with the aid of our Value Delivery Model, our Value System, and Culture, making positive impacts, one interaction at a time.</p>','','full_html'),('why_divihn_page',0,38,64,'en',0,'<p>We seek ‘Success and Transformation’ for our Clients, Coworkers, and Community, including our Partner Organizations. We do these with the aid of our Value Delivery Model, our Value System, and Culture, making positive impacts, one interaction at a time.</p>','','full_html'),('why_divihn_page',0,38,65,'en',0,'<p>We seek ‘Success and Transformation’ for our Clients, Coworkers, and Community, including our Partner Organizations. We do these with the aid of our Value Delivery Model, our Value System, and Culture, making positive impacts, one interaction at a time.</p>','','full_html'),('why_divihn_page',0,38,66,'en',0,'<p>We seek ‘Success and Transformation’ for our Clients, Coworkers, and Community, including our Partner Organizations. We do these with the aid of our Value Delivery Model, our Value System, and Culture, making positive impacts, one interaction at a time.</p>','','full_html'),('why_divihn_page',0,38,139,'en',0,'<p>We seek ‘Success and Transformation’ for our Clients, Coworkers, and Community, including our Partner Organizations. We do these with the aid of our Value Delivery Model, our Value System, and Culture, making positive impacts, one interaction at a time.</p>','','full_html'),('sled',0,40,77,'en',0,'<div class=\"SpotlightCopyBox\">The <a href=\"https://www.bidbuy.illinois.gov/bso/external/purchaseorder/poSummary.sdo?docId=23-448DOIT-ADMIN-P-56207&amp;releaseNbr=0&amp;external=true&amp;parentUrl=close\" target=\"_blank\">TOPS CAT-3</a> contract simplifies the procurement of technology consulting resources for all state agencies, boards and commissions, governmental units, and qualified not-for-profit agencies. Category 3 focuses on Cybersecurity, Data, Service Management, and Training ,and it is in place through October 10, 2033. Please contact <a href=\"mailto:sled@divihn.com\">sled@divihn.com</a> with any inquiries.</div><h3>PRIMARY AWARDEE: DIVIHN INTEGRATION INC.</h3><p>&nbsp;</p><table class=\"table category-table\"><thead><tr><th class=\"category-header\">Category Three</th><th class=\"category-header\">BidBuy #: P-56207</th><th class=\"category-header\">Contract #: CMT456207</th></tr></thead><tbody><tr><td class=\"domains\" colspan=\"3\">DOMAINS: Cybersecurity, Data, Service Management, Training</td></tr><tr><td class=\"position-title\">POSITION TITLES</td><td colspan=\"2\"><div class=\"row\"><div class=\"col-md-4 col-12\"><ul><li>Business Analyst</li><li>Business Architect</li><li>Cybersecurity Analyst</li><li>Data Analyst</li><li>Data Developer</li><li>Data Manager</li></ul></div><div class=\"col-md-4 col-12\"><ul><li>Data Trainer</li><li>Information Systems</li><li>Auditor</li><li>ITIL Business Analyst</li><li>Project Manager</li><li>Security Architect</li></ul></div><div class=\"col-md-4 col-12\"><ul><li>Security Engineer</li><li>ServiceNow Change Management Specialist</li><li>ServiceNow IT Asset Management/Configuration Management Specialist</li><li>ServiceNow IT Service Management Specialist</li><li>Solution Architect</li><li>Technical Writer</li><li>Trainers (all types)</li></ul></div></div></td></tr></tbody></table><div class=\"container bg-white text-dark p-4\"><p style=\"-webkit-text-stroke-width:0px;background-color:rgb(255, 255, 255);box-sizing:border-box;color:rgb(34, 34, 32);font-family:Outfit_Regular;font-size:medium;font-style:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-weight:400;letter-spacing:normal;line-height:23px;margin:0px;orphans:2;outline:none;padding:0px;text-align:start;text-decoration-color:initial;text-decoration-style:initial;text-decoration-thickness:initial;text-indent:0px;text-transform:none;white-space:normal;widows:2;word-spacing:0px;\">Cybersecurity, Data, Service Management includes but is not limited to the following high-level categories:</p><p style=\"-webkit-text-stroke-width:0px;background-color:rgb(255, 255, 255);box-sizing:border-box;color:rgb(34, 34, 32);font-family:Outfit_Regular;font-size:medium;font-style:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-weight:400;letter-spacing:normal;line-height:23px;margin:0px;orphans:2;outline:none;padding:0px;text-align:start;text-decoration-color:initial;text-decoration-style:initial;text-decoration-thickness:initial;text-indent:0px;text-transform:none;white-space:normal;widows:2;word-spacing:0px;\">&nbsp;</p><p style=\"-webkit-text-stroke-width:0px;background-color:rgb(255, 255, 255);box-sizing:border-box;color:rgb(34, 34, 32);font-family:Outfit_Regular;font-size:medium;font-style:normal;font-variant-caps:normal;font-variant-ligatures:normal;font-weight:400;letter-spacing:normal;line-height:23px;margin:0px;orphans:2;outline:none;padding:0px;text-align:start;text-decoration-color:initial;text-decoration-style:initial;text-decoration-thickness:initial;text-indent:0px;text-transform:none;white-space:normal;widows:2;word-spacing:0px;\">&nbsp;</p></div>','','full_html'),('sled_content_pages',0,41,78,'en',0,'<div class=\"SpotlightCopyBox\">The <a href=\"https://www.bidbuy.illinois.gov/bso/external/purchaseorder/poSummary.sdo?docId=23-448DOIT-ADMIN-P-56207&amp;releaseNbr=0&amp;external=true&amp;parentUrl=close\" target=\"_blank\">TOPS CAT-3</a> contract simplifies the procurement of technology consulting resources for all state agencies, boards and commissions, governmental units, and qualified not-for-profit agencies. Category 3 focuses on Cybersecurity, Data, Service Management, and Training ,and it is in place through October 10, 2033. Please contact <a href=\"mailto:sled@divihn.com\">sled@divihn.com</a> with any inquiries.</div><h3>PRIMARY AWARDEE: DIVIHN INTEGRATION INC.</h3><p>&nbsp;</p><table class=\"table category-table\"><thead><tr><th class=\"category-header\">Category Three</th><th class=\"category-header\">BidBuy #: P-56207</th><th class=\"category-header\">Contract #: CMT456207</th></tr></thead><tbody><tr><td class=\"domains\" colspan=\"3\">DOMAINS: Cybersecurity, Data, Service Management, Training</td></tr><tr><td class=\"position-title\">POSITION TITLES</td><td colspan=\"2\"><div class=\"row\"><div class=\"col-md-4 col-12\"><ul><li>Business Analyst</li><li>Business Architect</li><li>Cybersecurity Analyst</li><li>Data Analyst</li><li>Data Developer</li><li>Data Manager</li></ul></div><div class=\"col-md-4 col-12\"><ul><li>Data Trainer</li><li>Information Systems</li><li>Auditor</li><li>ITIL Business Analyst</li><li>Project Manager</li><li>Security Architect</li></ul></div><div class=\"col-md-4 col-12\"><ul><li>Security Engineer</li><li>ServiceNow Change Management Specialist</li><li>ServiceNow IT Asset Management/Configuration Management Specialist</li><li>ServiceNow IT Service Management Specialist</li><li>Solution Architect</li><li>Technical Writer</li><li>Trainers (all types)</li></ul></div></div></td></tr></tbody></table><p>Cybersecurity, Data, Service Management includes but is not limited to the following high-level categories:</p><p>1) Cyber/Information Security Services,<br>2) Incident Response and Disaster Recovery Services,<br>3) Information and Identification Services,<br>4) Teaching and Learning Services, and<br>5) Deployment Services.</p><p><br>&nbsp;</p>','','full_html'),('sled_content_pages',0,41,79,'en',0,'<div class=\"SpotlightCopyBox\">The <a href=\"https://www.bidbuy.illinois.gov/bso/external/purchaseorder/poSummary.sdo?docId=23-448DOIT-ADMIN-P-56207&amp;releaseNbr=0&amp;external=true&amp;parentUrl=close\" target=\"_blank\">TOPS CAT-3</a> contract simplifies the procurement of technology consulting resources for all state agencies, boards and commissions, governmental units, and qualified not-for-profit agencies. Category 3 focuses on Cybersecurity, Data, Service Management, and Training ,and it is in place through October 10, 2033. Please contact <a href=\"mailto:sled@divihn.com\">sled@divihn.com</a> with any inquiries.</div><h3>PRIMARY AWARDEE: DIVIHN INTEGRATION INC.</h3><p>&nbsp;</p><table class=\"table category-table\"><thead><tr><th class=\"category-header\">Category Three</th><th class=\"category-header\">BidBuy #: P-56207</th><th class=\"category-header\">Contract #: CMT456207</th></tr></thead><tbody><tr><td class=\"domains\" colspan=\"3\">DOMAINS: Cybersecurity, Data, Service Management, Training</td></tr><tr><td class=\"position-title\">POSITION TITLES</td><td colspan=\"2\"><div class=\"row\"><div class=\"col-md-4 col-12\"><ul><li>Business Analyst</li><li>Business Architect</li><li>Cybersecurity Analyst</li><li>Data Analyst</li><li>Data Developer</li><li>Data Manager</li></ul></div><div class=\"col-md-4 col-12\"><ul><li>Data Trainer</li><li>Information Systems</li><li>Auditor</li><li>ITIL Business Analyst</li><li>Project Manager</li><li>Security Architect</li></ul></div><div class=\"col-md-4 col-12\"><ul><li>Security Engineer</li><li>ServiceNow Change Management Specialist</li><li>ServiceNow IT Asset Management/Configuration Management Specialist</li><li>ServiceNow IT Service Management Specialist</li><li>Solution Architect</li><li>Technical Writer</li><li>Trainers (all types)</li></ul></div></div></td></tr></tbody></table><p>Cybersecurity, Data, Service Management includes but is not limited to the following high-level categories:</p><p>1) Cyber/Information Security Services,<br>2) Incident Response and Disaster Recovery Services,<br>3) Information and Identification Services,<br>4) Teaching and Learning Services, and<br>5) Deployment Services.</p><p><br>&nbsp;</p>','','full_html'),('sled_content_pages',0,42,80,'en',0,'<p class=\"why-us-heading\">About DivIHN</p><p>Formed in 2002, DivIHN (pronounced ‘Divine’) is a holistic Technology Solutions and Services provider with multiple areas of expertise. We intend to be impactful in the way we serve our clients and employees, and give back to our community. We see our core purpose as ‘Positively impacting lives, one interaction at a time’.</p><p>Our business focus is on Success and Transformation for our Clients, Co-workers, and other stakeholders. The values we cultivate are Honesty, Commitment, and Relationship. The culture that we seek in our organization is one of Excellence, with Grace.</p><p>We are committed to bringing thought leadership and expertise to our clients in meeting their technology solution needs, through Strategy Alignment, Technology Vision, Holistic Solution Design, and Delivery Excellence.</p>','','full_html'),('sled_content_pages',0,42,81,'en',0,'<p class=\"why-us-heading\">About DivIHN</p><p>Formed in 2002, DivIHN (pronounced ‘Divine’) is a holistic Technology Solutions and Services provider with multiple areas of expertise. We intend to be impactful in the way we serve our clients and employees, and give back to our community. We see our core purpose as ‘Positively impacting lives, one interaction at a time’.</p><p>Our business focus is on Success and Transformation for our Clients, Co-workers, and other stakeholders. The values we cultivate are Honesty, Commitment, and Relationship. The culture that we seek in our organization is one of Excellence, with Grace.</p><p>We are committed to bringing thought leadership and expertise to our clients in meeting their technology solution needs, through Strategy Alignment, Technology Vision, Holistic Solution Design, and Delivery Excellence.</p>','','full_html'),('sled_content_pages',0,42,82,'en',0,'<p class=\"why-us-heading\">About DivIHN</p><p>Formed in 2002, DivIHN (pronounced ‘Divine’) is a holistic Technology Solutions and Services provider with multiple areas of expertise. We intend to be impactful in the way we serve our clients and employees, and give back to our community. We see our core purpose as ‘Positively impacting lives, one interaction at a time’.</p><p>Our business focus is on Success and Transformation for our Clients, Co-workers, and other stakeholders. The values we cultivate are Honesty, Commitment, and Relationship. The culture that we seek in our organization is one of Excellence, with Grace.</p><p>We are committed to bringing thought leadership and expertise to our clients in meeting their technology solution needs, through Strategy Alignment, Technology Vision, Holistic Solution Design, and Delivery Excellence.</p>','','full_html'),('sled_content_pages',0,42,83,'en',0,'<p class=\"why-us-heading\">About DivIHN</p><p>Formed in 2002, DivIHN (pronounced ‘Divine’) is a holistic Technology Solutions and Services provider with multiple areas of expertise. We intend to be impactful in the way we serve our clients and employees, and give back to our community. We see our core purpose as ‘Positively impacting lives, one interaction at a time’.</p><p>Our business focus is on Success and Transformation for our Clients, Co-workers, and other stakeholders. The values we cultivate are Honesty, Commitment, and Relationship. The culture that we seek in our organization is one of Excellence, with Grace.</p><p>We are committed to bringing thought leadership and expertise to our clients in meeting their technology solution needs, through Strategy Alignment, Technology Vision, Holistic Solution Design, and Delivery Excellence.</p>','','full_html'),('blog',0,44,85,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,92,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,125,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,137,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,250,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,449,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,516,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,532,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,600,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,607,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,44,653,'en',0,'<p>The prediction that healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true. The WannaCry ransomware attack highlighted the need for healthcare organizations and medical device companies to focus on stronger cybersecurity measures and protections. Regulatory bodies are increasingly emphasizing the need for healthcare organizations and manufacturers to safeguard their technologies.</p><p>Cybersecurity risks go beyond ransom attacks and traditional IT devices. A malicious actor could make their way into a pacemaker or medical pump, potentially causing more damage to a patient than an attack on a server or data center. In 2020, ransomware attacks within the healthcare sector is predicted to have quadrupled. (Source: Herjavec Group Healthcare Report)</p><p>“If the public knew how insecure so much of the equipment is out there, they would lose their faith in the medical industry,” C. Gates, principal security architect at Houston-based medical device engineering firm. “There [are] a lot of issues that need to be corrected.”</p><p>– MedTech Dive, July 2020</p><p>The risks are high. This year researchers discovered vulnerabilities in a popular TCP/IP library from a third-party software vendor used by medical device manufacturers, potentially providing hackers remote access control and the ability to alter medication dosages. The security holes, found by Israeli firm JSOF and dubbed Ripple20, are the latest example of cyber vulnerabilities in third-party software impacting the medical technology industry.</p><p>The sophistication of malware continues to adapt and grow alongside the complexity of Internet connectivity. MEDJACK, a malware virus, compromised three healthcare systems through medical devices such as x-ray machines, blood gas analyzers and diagnostic equipment.</p><p>A silver bullet for achieving security does not exist. Moreover, it cannot be considered an afterthought once a design has been completed. Cybersecurity needs to be built into the product design from the beginning. Security requires a constant focus from product conception, design, development, deployment, maintenance, all the way through support.</p><p>Four best practices for integrating security into connected medical devices:</p><h2>&nbsp;</h2><ol type=\"1\"><li>Security by Design – Set out the design features and cybersecurity controls clearly at the start of the design and development process. Begin by defining and mapping the product ecosystem including how data originates, travels and is processed – both upstream and downstream.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Identify the Security Framework and Controls – Medical devices are computers susceptible to the same threats and vulnerabilities as traditional systems. The Food Drug Administration (FDA) provides detailed guidelines for assessing the vulnerabilities and reducing cybersecurity risks</li></ol><p>link . This includes establishing the security controls, device controls and application integrations.</p><h2>&nbsp;</h2><ol type=\"1\"><li>Create a Risk Assessment and Control Strategy – Start with risk assessments of current device implementations and identify the required security and privacy controls needed to put into place to mitigate the most serious security threats and vulnerabilities.</li></ol><h2>&nbsp;</h2><ol type=\"1\"><li>Establish and Conduct Regular Security Audits – For audits of medical devices, penetration testing is the recommended approach. These tests will help evaluate identify product vulnerabilities and weaknesses, providing for a risk assessment to be completed. Nevertheless, penetration testing is not a “one and done” solution.</li></ol><p>CynergisTek in a 2019 study revealed their findings of its CAPP Community Conference surveying approximately 60 C-level healthcare executives for their cybersecurity practices. Sections of the survey pinpointed some of the barriers or disconnects within their respective organizations. Significant findings include:</p><h2>&nbsp;</h2><ul><li>Nearly one-third of respondents stated not having an effective cybersecurity strategy in place to assess the risks posed by medical devices. Almost 26% said they do not have any process at all,</li><li>Culture was identified as the main difficulty in retaining and training cybersecurity professionals,</li><li>Fifty-four percent (54%) of those surveyed said the greatest barrier to meeting privacy and security challenges was due to lack of adequate resources (tools, money, or people),</li></ul><p>For connected medical devices, a 2015 Raytheon &amp; Websense report suggests “up to seventy-five percent of hospital network traffic goes unmonitored by security solutions out of fear that improperly configured security measures or alarming false positives could dramatically increase the risk to patient health or well-being.” Medical devices and health care networks can be compromised in several ways. Malware can access and gather private data, potentially allowing cyber aggressors to gain control of connected systems.</p><p>It is critical to maintain and update operating systems, firmware and application software. Provided the complexity of these systems and the connected equipment used in manufacturing, hospitals and clinical offices, operating and application technology is often not user serviceable. It may run outdated applications and lack protections for software or firmware. Skilled software support is generally required</p><p>THE PATH FORWARD</p><p>DivIHN provides a strategy to address connected medical device security requirements through a security controls review architecture centered around the FDA guidelines. The controls must provide the appropriate technical measures to protect sensitive data generated and transmitted by the device. Technical measures include both software security controls, device security controls and well-developed foundational practices.</p>','','full_html'),('blog',0,46,87,'en',0,'<p><font size=\"6\"><strong>T</strong></font>raditional security models have been <strong>challenged</strong> as millions across the world have transitioned to <strong>remote work models</strong> wherever possible.</p><p>As the global workforce progresses towards the next normal of hybrid workplaces, organizations have adopted remote work as a new standard – but at what cost to security?</p><p>“Never trust, always verify” is the foundation of Zero Trust.</p><p>The rapid and meteoric rise in remote-based work has dramatically increased the exposure to cybersecurity threats, with more targeted attacks on organizations from cyber aggressors and nation-state groups. In addition to remote work, the increased rise in the use of Internet of Things (IoT), operational technology (OT), and network-enabled smart devices introduced new areas of potential compromise to enterprise networks. Every connected endpoint to an organization’s network is a potential hackable entry point for a cyber aggressor.</p><p>With economic activity straining, budgets decreasing, and capital expenditures shrinking, cybersecurity spend has come under pressure. Despite these pressures, a new 2020 Kaspersky report ‘Investment adjustment: aligning IT budgets with changing security priorities’, “cybersecurity remains a priority for investment among businesses.” Despite overall IT budgets decreasing, enterprise cybersecurity spend is up from 26% to 29% in 2020. In addition, according to this study, 71% of organizations expect their cybersecurity budgets to grow further in the next three years.</p><p>Zero Trust provides a scoped, scalable, agile and affordable framework to address the loss of a defined corporate perimeter and the increased security risk to corporate systems and sensitive data.</p><p><strong>STRATEGIC BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Enables digital business transformation</li><li>Protects customer data and your business</li><li>Increases business speed and agility</li><li>Allows scaling rapidly and securely</li><li>Reduces CAPEX and OPEX</li><li>Alleviates organizational friction</li><li>Reduces scope and cost of compliance</li><li>Solves the security skills shortage</li></ul><p><strong>EXECUTION BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Decreases risk and improves visibility</li><li>Allows greater control in a cloud environment</li><li>Decreased need for VPNs</li><li>Reduces complexity of the security stack</li><li>Supports cohesive IT issue resolution</li><li>Achieves lower breach potential</li><li>Reduces time to breach detection</li><li>Aids compliance audit initiatives</li></ul><p>What is Zero Trust? The Zero Trust model assumes a breach and verifies each access request as though it originates from an open network, regardless of user, resource, and origination point. This model presumes every data access request is fully authenticated, authorized, and encrypted before it is granted.</p><p>Zero Trust directly addresses the challenges of scope, scale and flexibility in a dynamically changing world. It reduces an organization’s risk footprint and attack surface by assuming any user, any device logging in from any location is a potential threat. It doesn’t increase trust, it eliminates it.</p><p>In the past, security tried to protect systems, applications, databases, and users behind a rigidly defined perimeter. With the loss of a definable perimeter, the next normal is to never trust but always verify to ensure appropriate and defined access to users and systems in an ever-changing world.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('blog',0,46,93,'en',0,'<p><font size=\"6\"><strong>T</strong></font>raditional security models have been <strong>challenged</strong> as millions across the world have transitioned to <strong>remote work models</strong> wherever possible.</p><p>As the global workforce progresses towards the next normal of hybrid workplaces, organizations have adopted remote work as a new standard – but at what cost to security?</p><p>“Never trust, always verify” is the foundation of Zero Trust.</p><p>The rapid and meteoric rise in remote-based work has dramatically increased the exposure to cybersecurity threats, with more targeted attacks on organizations from cyber aggressors and nation-state groups. In addition to remote work, the increased rise in the use of Internet of Things (IoT), operational technology (OT), and network-enabled smart devices introduced new areas of potential compromise to enterprise networks. Every connected endpoint to an organization’s network is a potential hackable entry point for a cyber aggressor.</p><p>With economic activity straining, budgets decreasing, and capital expenditures shrinking, cybersecurity spend has come under pressure. Despite these pressures, a new 2020 Kaspersky report ‘Investment adjustment: aligning IT budgets with changing security priorities’, “cybersecurity remains a priority for investment among businesses.” Despite overall IT budgets decreasing, enterprise cybersecurity spend is up from 26% to 29% in 2020. In addition, according to this study, 71% of organizations expect their cybersecurity budgets to grow further in the next three years.</p><p>Zero Trust provides a scoped, scalable, agile and affordable framework to address the loss of a defined corporate perimeter and the increased security risk to corporate systems and sensitive data.</p><p><strong>STRATEGIC BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Enables digital business transformation</li><li>Protects customer data and your business</li><li>Increases business speed and agility</li><li>Allows scaling rapidly and securely</li><li>Reduces CAPEX and OPEX</li><li>Alleviates organizational friction</li><li>Reduces scope and cost of compliance</li><li>Solves the security skills shortage</li></ul><p><strong>EXECUTION BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Decreases risk and improves visibility</li><li>Allows greater control in a cloud environment</li><li>Decreased need for VPNs</li><li>Reduces complexity of the security stack</li><li>Supports cohesive IT issue resolution</li><li>Achieves lower breach potential</li><li>Reduces time to breach detection</li><li>Aids compliance audit initiatives</li></ul><p>What is Zero Trust? The Zero Trust model assumes a breach and verifies each access request as though it originates from an open network, regardless of user, resource, and origination point. This model presumes every data access request is fully authenticated, authorized, and encrypted before it is granted.</p><p>Zero Trust directly addresses the challenges of scope, scale and flexibility in a dynamically changing world. It reduces an organization’s risk footprint and attack surface by assuming any user, any device logging in from any location is a potential threat. It doesn’t increase trust, it eliminates it.</p><p>In the past, security tried to protect systems, applications, databases, and users behind a rigidly defined perimeter. With the loss of a definable perimeter, the next normal is to never trust but always verify to ensure appropriate and defined access to users and systems in an ever-changing world.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('blog',0,46,126,'en',0,'<p><font size=\"6\"><strong>T</strong></font>raditional security models have been <strong>challenged</strong> as millions across the world have transitioned to <strong>remote work models</strong> wherever possible.</p><p>As the global workforce progresses towards the next normal of hybrid workplaces, organizations have adopted remote work as a new standard – but at what cost to security?</p><p>“Never trust, always verify” is the foundation of Zero Trust.</p><p>The rapid and meteoric rise in remote-based work has dramatically increased the exposure to cybersecurity threats, with more targeted attacks on organizations from cyber aggressors and nation-state groups. In addition to remote work, the increased rise in the use of Internet of Things (IoT), operational technology (OT), and network-enabled smart devices introduced new areas of potential compromise to enterprise networks. Every connected endpoint to an organization’s network is a potential hackable entry point for a cyber aggressor.</p><p>With economic activity straining, budgets decreasing, and capital expenditures shrinking, cybersecurity spend has come under pressure. Despite these pressures, a new 2020 Kaspersky report ‘Investment adjustment: aligning IT budgets with changing security priorities’, “cybersecurity remains a priority for investment among businesses.” Despite overall IT budgets decreasing, enterprise cybersecurity spend is up from 26% to 29% in 2020. In addition, according to this study, 71% of organizations expect their cybersecurity budgets to grow further in the next three years.</p><p>Zero Trust provides a scoped, scalable, agile and affordable framework to address the loss of a defined corporate perimeter and the increased security risk to corporate systems and sensitive data.</p><p><strong>STRATEGIC BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Enables digital business transformation</li><li>Protects customer data and your business</li><li>Increases business speed and agility</li><li>Allows scaling rapidly and securely</li><li>Reduces CAPEX and OPEX</li><li>Alleviates organizational friction</li><li>Reduces scope and cost of compliance</li><li>Solves the security skills shortage</li></ul><p><strong>EXECUTION BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Decreases risk and improves visibility</li><li>Allows greater control in a cloud environment</li><li>Decreased need for VPNs</li><li>Reduces complexity of the security stack</li><li>Supports cohesive IT issue resolution</li><li>Achieves lower breach potential</li><li>Reduces time to breach detection</li><li>Aids compliance audit initiatives</li></ul><p>What is Zero Trust? The Zero Trust model assumes a breach and verifies each access request as though it originates from an open network, regardless of user, resource, and origination point. This model presumes every data access request is fully authenticated, authorized, and encrypted before it is granted.</p><p>Zero Trust directly addresses the challenges of scope, scale and flexibility in a dynamically changing world. It reduces an organization’s risk footprint and attack surface by assuming any user, any device logging in from any location is a potential threat. It doesn’t increase trust, it eliminates it.</p><p>In the past, security tried to protect systems, applications, databases, and users behind a rigidly defined perimeter. With the loss of a definable perimeter, the next normal is to never trust but always verify to ensure appropriate and defined access to users and systems in an ever-changing world.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('blog',0,46,251,'en',0,'<p><font size=\"6\"><strong>T</strong></font>raditional security models have been <strong>challenged</strong> as millions across the world have transitioned to <strong>remote work models</strong> wherever possible.</p><p>As the global workforce progresses towards the next normal of hybrid workplaces, organizations have adopted remote work as a new standard – but at what cost to security?</p><p>“Never trust, always verify” is the foundation of Zero Trust.</p><p>The rapid and meteoric rise in remote-based work has dramatically increased the exposure to cybersecurity threats, with more targeted attacks on organizations from cyber aggressors and nation-state groups. In addition to remote work, the increased rise in the use of Internet of Things (IoT), operational technology (OT), and network-enabled smart devices introduced new areas of potential compromise to enterprise networks. Every connected endpoint to an organization’s network is a potential hackable entry point for a cyber aggressor.</p><p>With economic activity straining, budgets decreasing, and capital expenditures shrinking, cybersecurity spend has come under pressure. Despite these pressures, a new 2020 Kaspersky report ‘Investment adjustment: aligning IT budgets with changing security priorities’, “cybersecurity remains a priority for investment among businesses.” Despite overall IT budgets decreasing, enterprise cybersecurity spend is up from 26% to 29% in 2020. In addition, according to this study, 71% of organizations expect their cybersecurity budgets to grow further in the next three years.</p><p>Zero Trust provides a scoped, scalable, agile and affordable framework to address the loss of a defined corporate perimeter and the increased security risk to corporate systems and sensitive data.</p><p><strong>STRATEGIC BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Enables digital business transformation</li><li>Protects customer data and your business</li><li>Increases business speed and agility</li><li>Allows scaling rapidly and securely</li><li>Reduces CAPEX and OPEX</li><li>Alleviates organizational friction</li><li>Reduces scope and cost of compliance</li><li>Solves the security skills shortage</li></ul><p><strong>EXECUTION BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Decreases risk and improves visibility</li><li>Allows greater control in a cloud environment</li><li>Decreased need for VPNs</li><li>Reduces complexity of the security stack</li><li>Supports cohesive IT issue resolution</li><li>Achieves lower breach potential</li><li>Reduces time to breach detection</li><li>Aids compliance audit initiatives</li></ul><p>What is Zero Trust? The Zero Trust model assumes a breach and verifies each access request as though it originates from an open network, regardless of user, resource, and origination point. This model presumes every data access request is fully authenticated, authorized, and encrypted before it is granted.</p><p>Zero Trust directly addresses the challenges of scope, scale and flexibility in a dynamically changing world. It reduces an organization’s risk footprint and attack surface by assuming any user, any device logging in from any location is a potential threat. It doesn’t increase trust, it eliminates it.</p><p>In the past, security tried to protect systems, applications, databases, and users behind a rigidly defined perimeter. With the loss of a definable perimeter, the next normal is to never trust but always verify to ensure appropriate and defined access to users and systems in an ever-changing world.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('blog',0,46,392,'en',0,'<p><font size=\"6\"><strong>T</strong></font>raditional security models have been <strong>challenged</strong> as millions across the world have transitioned to <strong>remote work models</strong> wherever possible.</p><p>As the global workforce progresses towards the next normal of hybrid workplaces, organizations have adopted remote work as a new standard – but at what cost to security?</p><p>“Never trust, always verify” is the foundation of Zero Trust.</p><p>The rapid and meteoric rise in remote-based work has dramatically increased the exposure to cybersecurity threats, with more targeted attacks on organizations from cyber aggressors and nation-state groups. In addition to remote work, the increased rise in the use of Internet of Things (IoT), operational technology (OT), and network-enabled smart devices introduced new areas of potential compromise to enterprise networks. Every connected endpoint to an organization’s network is a potential hackable entry point for a cyber aggressor.</p><p>With economic activity straining, budgets decreasing, and capital expenditures shrinking, cybersecurity spend has come under pressure. Despite these pressures, a new 2020 Kaspersky report ‘Investment adjustment: aligning IT budgets with changing security priorities’, “cybersecurity remains a priority for investment among businesses.” Despite overall IT budgets decreasing, enterprise cybersecurity spend is up from 26% to 29% in 2020. In addition, according to this study, 71% of organizations expect their cybersecurity budgets to grow further in the next three years.</p><p>Zero Trust provides a scoped, scalable, agile and affordable framework to address the loss of a defined corporate perimeter and the increased security risk to corporate systems and sensitive data.</p><p><strong>STRATEGIC BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Enables digital business transformation</li><li>Protects customer data and your business</li><li>Increases business speed and agility</li><li>Allows scaling rapidly and securely</li><li>Reduces CAPEX and OPEX</li><li>Alleviates organizational friction</li><li>Reduces scope and cost of compliance</li><li>Solves the security skills shortage</li></ul><p><strong>EXECUTION BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Decreases risk and improves visibility</li><li>Allows greater control in a cloud environment</li><li>Decreased need for VPNs</li><li>Reduces complexity of the security stack</li><li>Supports cohesive IT issue resolution</li><li>Achieves lower breach potential</li><li>Reduces time to breach detection</li><li>Aids compliance audit initiatives</li></ul><p>What is Zero Trust? The Zero Trust model assumes a breach and verifies each access request as though it originates from an open network, regardless of user, resource, and origination point. This model presumes every data access request is fully authenticated, authorized, and encrypted before it is granted.</p><p>Zero Trust directly addresses the challenges of scope, scale and flexibility in a dynamically changing world. It reduces an organization’s risk footprint and attack surface by assuming any user, any device logging in from any location is a potential threat. It doesn’t increase trust, it eliminates it.</p><p>In the past, security tried to protect systems, applications, databases, and users behind a rigidly defined perimeter. With the loss of a definable perimeter, the next normal is to never trust but always verify to ensure appropriate and defined access to users and systems in an ever-changing world.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('blog',0,46,463,'en',0,'<p><font size=\"6\"><strong>T</strong></font>raditional security models have been <strong>challenged</strong> as millions across the world have transitioned to <strong>remote work models</strong> wherever possible.</p><p>As the global workforce progresses towards the next normal of hybrid workplaces, organizations have adopted remote work as a new standard – but at what cost to security?</p><p>“Never trust, always verify” is the foundation of Zero Trust.</p><p>The rapid and meteoric rise in remote-based work has dramatically increased the exposure to cybersecurity threats, with more targeted attacks on organizations from cyber aggressors and nation-state groups. In addition to remote work, the increased rise in the use of Internet of Things (IoT), operational technology (OT), and network-enabled smart devices introduced new areas of potential compromise to enterprise networks. Every connected endpoint to an organization’s network is a potential hackable entry point for a cyber aggressor.</p><p>With economic activity straining, budgets decreasing, and capital expenditures shrinking, cybersecurity spend has come under pressure. Despite these pressures, a new 2020 Kaspersky report ‘Investment adjustment: aligning IT budgets with changing security priorities’, “cybersecurity remains a priority for investment among businesses.” Despite overall IT budgets decreasing, enterprise cybersecurity spend is up from 26% to 29% in 2020. In addition, according to this study, 71% of organizations expect their cybersecurity budgets to grow further in the next three years.</p><p>Zero Trust provides a scoped, scalable, agile and affordable framework to address the loss of a defined corporate perimeter and the increased security risk to corporate systems and sensitive data.</p><p><strong>STRATEGIC BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Enables digital business transformation</li><li>Protects customer data and your business</li><li>Increases business speed and agility</li><li>Allows scaling rapidly and securely</li><li>Reduces CAPEX and OPEX</li><li>Alleviates organizational friction</li><li>Reduces scope and cost of compliance</li><li>Solves the security skills shortage</li></ul><p><strong>EXECUTION BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Decreases risk and improves visibility</li><li>Allows greater control in a cloud environment</li><li>Decreased need for VPNs</li><li>Reduces complexity of the security stack</li><li>Supports cohesive IT issue resolution</li><li>Achieves lower breach potential</li><li>Reduces time to breach detection</li><li>Aids compliance audit initiatives</li></ul><p>What is Zero Trust? The Zero Trust model assumes a breach and verifies each access request as though it originates from an open network, regardless of user, resource, and origination point. This model presumes every data access request is fully authenticated, authorized, and encrypted before it is granted.</p><p>Zero Trust directly addresses the challenges of scope, scale and flexibility in a dynamically changing world. It reduces an organization’s risk footprint and attack surface by assuming any user, any device logging in from any location is a potential threat. It doesn’t increase trust, it eliminates it.</p><p>In the past, security tried to protect systems, applications, databases, and users behind a rigidly defined perimeter. With the loss of a definable perimeter, the next normal is to never trust but always verify to ensure appropriate and defined access to users and systems in an ever-changing world.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('blog',0,46,544,'en',0,'<p><font size=\"6\"><strong>T</strong></font>raditional security models have been <strong>challenged</strong> as millions across the world have transitioned to <strong>remote work models</strong> wherever possible.</p><p>As the global workforce progresses towards the next normal of hybrid workplaces, organizations have adopted remote work as a new standard – but at what cost to security?</p><p>“Never trust, always verify” is the foundation of Zero Trust.</p><p>The rapid and meteoric rise in remote-based work has dramatically increased the exposure to cybersecurity threats, with more targeted attacks on organizations from cyber aggressors and nation-state groups. In addition to remote work, the increased rise in the use of Internet of Things (IoT), operational technology (OT), and network-enabled smart devices introduced new areas of potential compromise to enterprise networks. Every connected endpoint to an organization’s network is a potential hackable entry point for a cyber aggressor.</p><p>With economic activity straining, budgets decreasing, and capital expenditures shrinking, cybersecurity spend has come under pressure. Despite these pressures, a new 2020 Kaspersky report ‘Investment adjustment: aligning IT budgets with changing security priorities’, “cybersecurity remains a priority for investment among businesses.” Despite overall IT budgets decreasing, enterprise cybersecurity spend is up from 26% to 29% in 2020. In addition, according to this study, 71% of organizations expect their cybersecurity budgets to grow further in the next three years.</p><p>Zero Trust provides a scoped, scalable, agile and affordable framework to address the loss of a defined corporate perimeter and the increased security risk to corporate systems and sensitive data.</p><p><strong>STRATEGIC BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Enables digital business transformation</li><li>Protects customer data and your business</li><li>Increases business speed and agility</li><li>Allows scaling rapidly and securely</li><li>Reduces CAPEX and OPEX</li><li>Alleviates organizational friction</li><li>Reduces scope and cost of compliance</li><li>Solves the security skills shortage</li></ul><p><strong>EXECUTION BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Decreases risk and improves visibility</li><li>Allows greater control in a cloud environment</li><li>Decreased need for VPNs</li><li>Reduces complexity of the security stack</li><li>Supports cohesive IT issue resolution</li><li>Achieves lower breach potential</li><li>Reduces time to breach detection</li><li>Aids compliance audit initiatives</li></ul><p>What is Zero Trust? The Zero Trust model assumes a breach and verifies each access request as though it originates from an open network, regardless of user, resource, and origination point. This model presumes every data access request is fully authenticated, authorized, and encrypted before it is granted.</p><p>Zero Trust directly addresses the challenges of scope, scale and flexibility in a dynamically changing world. It reduces an organization’s risk footprint and attack surface by assuming any user, any device logging in from any location is a potential threat. It doesn’t increase trust, it eliminates it.</p><p>In the past, security tried to protect systems, applications, databases, and users behind a rigidly defined perimeter. With the loss of a definable perimeter, the next normal is to never trust but always verify to ensure appropriate and defined access to users and systems in an ever-changing world.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('blog',0,46,619,'en',0,'<p><font size=\"6\"><strong>T</strong></font>raditional security models have been <strong>challenged</strong> as millions across the world have transitioned to <strong>remote work models</strong> wherever possible.</p><p>As the global workforce progresses towards the next normal of hybrid workplaces, organizations have adopted remote work as a new standard – but at what cost to security?</p><p>“Never trust, always verify” is the foundation of Zero Trust.</p><p>The rapid and meteoric rise in remote-based work has dramatically increased the exposure to cybersecurity threats, with more targeted attacks on organizations from cyber aggressors and nation-state groups. In addition to remote work, the increased rise in the use of Internet of Things (IoT), operational technology (OT), and network-enabled smart devices introduced new areas of potential compromise to enterprise networks. Every connected endpoint to an organization’s network is a potential hackable entry point for a cyber aggressor.</p><p>With economic activity straining, budgets decreasing, and capital expenditures shrinking, cybersecurity spend has come under pressure. Despite these pressures, a new 2020 Kaspersky report ‘Investment adjustment: aligning IT budgets with changing security priorities’, “cybersecurity remains a priority for investment among businesses.” Despite overall IT budgets decreasing, enterprise cybersecurity spend is up from 26% to 29% in 2020. In addition, according to this study, 71% of organizations expect their cybersecurity budgets to grow further in the next three years.</p><p>Zero Trust provides a scoped, scalable, agile and affordable framework to address the loss of a defined corporate perimeter and the increased security risk to corporate systems and sensitive data.</p><p><strong>STRATEGIC BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Enables digital business transformation</li><li>Protects customer data and your business</li><li>Increases business speed and agility</li><li>Allows scaling rapidly and securely</li><li>Reduces CAPEX and OPEX</li><li>Alleviates organizational friction</li><li>Reduces scope and cost of compliance</li><li>Solves the security skills shortage</li></ul><p><strong>EXECUTION BENEFITS</strong></p><h2>&nbsp;</h2><ul><li>Decreases risk and improves visibility</li><li>Allows greater control in a cloud environment</li><li>Decreased need for VPNs</li><li>Reduces complexity of the security stack</li><li>Supports cohesive IT issue resolution</li><li>Achieves lower breach potential</li><li>Reduces time to breach detection</li><li>Aids compliance audit initiatives</li></ul><p>What is Zero Trust? The Zero Trust model assumes a breach and verifies each access request as though it originates from an open network, regardless of user, resource, and origination point. This model presumes every data access request is fully authenticated, authorized, and encrypted before it is granted.</p><p>Zero Trust directly addresses the challenges of scope, scale and flexibility in a dynamically changing world. It reduces an organization’s risk footprint and attack surface by assuming any user, any device logging in from any location is a potential threat. It doesn’t increase trust, it eliminates it.</p><p>In the past, security tried to protect systems, applications, databases, and users behind a rigidly defined perimeter. With the loss of a definable perimeter, the next normal is to never trust but always verify to ensure appropriate and defined access to users and systems in an ever-changing world.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('featured_article',0,47,88,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><blockquote><p>“The majority of companies — <strong>77% of respondents</strong> — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p></blockquote><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only <strong>30% of respondents</strong> reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><h2>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</h2><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><h2>The NIST Incident Response Framework</h2><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are <strong>preparation</strong>; <strong>detection and analysis</strong>; <strong>containment, eradication and recovery</strong>; and <strong>post-incident activity</strong>. Here’s a look at each one in some detail.</p><ol><li><p><strong>Phase 1: Preparation.</strong></p><p>The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p></li><li><p><strong>Phase 2: Detection and Analysis.</strong></p><p>While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p></li><li><p><strong>Phase 3: Containment, Eradication and Recovery.</strong></p><p>Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p></li><li><p><strong>Phase 4: Post-incident activity.</strong></p><p>Post-incident activity centers on lessons learned to accomplish two things: improve the incident response capability and prevent the incident from recurring.</p></li></ol><h2>The ISO Incident Response Framework</h2><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p><strong>ISO/IEC 27035-1:2016</strong> outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><ol><li><strong>PART 1. Planning and Preparation.</strong><ul><li>Establish an information security incident management policy.</li><li>Create an incident response team.</li></ul></li><li><strong>PART 2. Detection and Reporting.</strong><ul><li>Set up the processes, procedures and technology required to detect and report the incident.</li></ul></li><li><strong>PART 3. Assessment and Decision.</strong><ul><li>Set up processes and procedures.</li><li>Establish incident descriptions and criteria.</li></ul></li><li><strong>PART 4. Response to Incidents.</strong><ul><li>Establish controls to prevent, respond and recover from incidents.</li></ul></li><li><strong>PART 5. Lessons Learned.</strong><ul><li>Learn from security incidents and improve overall computer security incident management.</li></ul></li></ol><h2>COMPARISON</h2><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><h2>SUMMARY</h2><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,89,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><blockquote><p>“The majority of companies — <strong>77% of respondents</strong> — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p></blockquote><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only <strong>30% of respondents</strong> reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><h2>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</h2><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><h2>The NIST Incident Response Framework</h2><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are <strong>preparation</strong>; <strong>detection and analysis</strong>; <strong>containment, eradication and recovery</strong>; and <strong>post-incident activity</strong>. Here’s a look at each one in some detail.</p><ol><li><p><strong>Phase 1: Preparation.</strong></p><p>The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p></li><li><p><strong>Phase 2: Detection and Analysis.</strong></p><p>While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p></li><li><p><strong>Phase 3: Containment, Eradication and Recovery.</strong></p><p>Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p></li><li><p><strong>Phase 4: Post-incident activity.</strong></p><p>Post-incident activity centers on lessons learned to accomplish two things: improve the incident response capability and prevent the incident from recurring.</p></li></ol><h2>The ISO Incident Response Framework</h2><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p><strong>ISO/IEC 27035-1:2016</strong> outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><ol><li><strong>PART 1. Planning and Preparation.</strong><ul><li>Establish an information security incident management policy.</li><li>Create an incident response team.</li></ul></li><li><strong>PART 2. Detection and Reporting.</strong><ul><li>Set up the processes, procedures and technology required to detect and report the incident.</li></ul></li><li><strong>PART 3. Assessment and Decision.</strong><ul><li>Set up processes and procedures.</li><li>Establish incident descriptions and criteria.</li></ul></li><li><strong>PART 4. Response to Incidents.</strong><ul><li>Establish controls to prevent, respond and recover from incidents.</li></ul></li><li><strong>PART 5. Lessons Learned.</strong><ul><li>Learn from security incidents and improve overall computer security incident management.</li></ul></li></ol><h2>COMPARISON</h2><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><h2>SUMMARY</h2><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,91,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><blockquote><p>“The majority of companies — <strong>77% of respondents</strong> — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p></blockquote><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only <strong>30% of respondents</strong> reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><h2>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</h2><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><h2>The NIST Incident Response Framework</h2><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are <strong>preparation</strong>; <strong>detection and analysis</strong>; <strong>containment, eradication and recovery</strong>; and <strong>post-incident activity</strong>. Here’s a look at each one in some detail.</p><ol><li><p><strong>Phase 1: Preparation.</strong></p><p>The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p></li><li><p><strong>Phase 2: Detection and Analysis.</strong></p><p>While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p></li><li><p><strong>Phase 3: Containment, Eradication and Recovery.</strong></p><p>Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p></li><li><p><strong>Phase 4: Post-incident activity.</strong></p><p>Post-incident activity centers on lessons learned to accomplish two things: improve the incident response capability and prevent the incident from recurring.</p></li></ol><h2>The ISO Incident Response Framework</h2><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p><strong>ISO/IEC 27035-1:2016</strong> outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><ol><li><strong>PART 1. Planning and Preparation.</strong><ul><li>Establish an information security incident management policy.</li><li>Create an incident response team.</li></ul></li><li><strong>PART 2. Detection and Reporting.</strong><ul><li>Set up the processes, procedures and technology required to detect and report the incident.</li></ul></li><li><strong>PART 3. Assessment and Decision.</strong><ul><li>Set up processes and procedures.</li><li>Establish incident descriptions and criteria.</li></ul></li><li><strong>PART 4. Response to Incidents.</strong><ul><li>Establish controls to prevent, respond and recover from incidents.</li></ul></li><li><strong>PART 5. Lessons Learned.</strong><ul><li>Learn from security incidents and improve overall computer security incident management.</li></ul></li></ol><h2>COMPARISON</h2><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><h2>SUMMARY</h2><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,94,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,127,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,254,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,255,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,445,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,448,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,515,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,531,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,593,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,595,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,596,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,597,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,598,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,599,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,47,606,'en',0,'<p>Awareness is growing that organizations of all sizes lack cybersecurity incident response preparedness. Companies regardless of size are not exempt from cybersecurity threats. Being prepared with an established plan of action to immediately execute following a security incident is crucial to limit incident costs and damages to the organization’s technical infrastructure, operations, and reputation.</p><p>“The majority of companies — 77% of respondents — don’t have a cybersecurity incident response plan applied across the enterprise,” according to a 2019 study conducted by the Ponemon Institute.</p><p>According to this study one of the primary reasons for this is the well-documented security skills shortage. It is particularly severe in incident response because it is a newer discipline for many companies. Survey respondents said they lack the headcount to create, maintain and test their incident response plans. Only 30% of respondents reported staffing for security is sufficient to achieve a high level of cyber resilience.</p><p><strong>INCIDENT RESPONSE (IR) FRAMEWORK VS PLAYBOOK</strong></p><p>An incident response framework provides a structure to support incident response operations. A framework typically provides guidance on what needs to be done, but not on how it is done. A framework is flexible enough to allow elements to be added or removed as necessary to satisfy a particular organization’s needs.</p><p>An incident response plan has a goal delivering effective incident response through a detailed set of steps. An incident response plan details the processes needed to deal with cybersecurity incidents, calls out the resources required, and outlines the communication and escalation paths required for plan operation.</p><p>Together the framework suggests logical elements that should be included in a plan. A plan includes those elements as well as elements of mission, services, people, process, technology and facilities. With this in mind, it helps to understand two (2) industry incident response frameworks to determine the best approach for your organization.</p><p><strong>The NIST Incident Response Framework</strong></p><p>The National Institute of Standards and Technology (NIST) is responsible for developing information security standards and guidelines, including minimum standards for federal information systems. The NIST “Computer Security Incident Handling Guide” includes an incident response framework in the form of an incident response lifecycle.</p><p>The four stages of the NIST incident response lifecycle are preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Here’s a look at each one in some detail.</p><p><strong>Phase 1: Preparation.</strong> The quality of incident response largely depends on incident response preparation. In this preparation phase of the lifecycle, all the components needed to respond effectively to a computer security incident are identified, created or acquired.</p><p><strong>Phase 2: Detection and Analysis.</strong> While the capability to detect incidents is set up as part of the preparation phase, incident detection starts the incident response process. Incidents cannot be responded to until detection occurs.</p><p><strong>Phase 3: Containment, Eradication and Recovery.</strong> Containment follows the detection and validation of a security incident. The goals of containment are simple – stop the problem from getting worse (i.e., limit the damage); and regain control of systems and network.</p><p><strong>Phase 4: Post-incident activity.</strong> Post-incident activity centers on lessons learned to accomplish two things: Improve the incident response capability and prevent the incident from recurring.</p><p><strong>The ISO Incident Response Framework</strong></p><p>The International Organization for Standardization (ISO) is an independent non-governmental international standards organization. The ISO standard details how individuals should “detect, report and assess information security incidents; respond to information security incidents … report information security vulnerabilities … learn from information security incidents and vulnerabilities, institute preventive controls, and make improvements to the overall approach to information security incident management.”</p><p>ISO/IEC 27035-1:2016 outlines the principles underlying information security incident management, which is structured into five (5) parts:</p><p><strong>PART 1. Planning and Preparation.</strong><br>Establish an information security incident management policy.<br>Create an incident response team.</p><p><strong>PART 2. Detection and Reporting.</strong><br>Set up the processes, procedures and technology required to detect and report the incident.</p><p><strong>PART 3. Assessment and Decision.</strong><br>Set up processes and procedures.<br>Establish incident descriptions and criteria.</p><p><strong>PART 4. Response to Incidents.</strong><br>Establish controls to prevent, respond and recover from incidents.</p><p><strong>PART 5. Lessons Learned.</strong><br>Learn from security incidents and improve overall computer security incident management.</p><p><strong>COMPARISON</strong></p><p>NIST and ISO 27035-1 are similar in approach to each other. However, there is an important and subtle difference. The NIST “Computer Security Incident Handling Guide” focuses on incident handling which deals with the prevention, detection and responding to incidents. ISO 27035-1 focuses on incident management, which is integrated broadly into other business management and risk reduction functions outside of the incident response organization.</p><p><strong>SUMMARY</strong></p><p>So which framework should you choose? Should you choose one framework in its entirety or should you choose part of one and combine it with parts of another framework in a kind of incident response a la carte? When considering whether to adopt a framework as is or build your own, these are some things to think about:</p><ul><li>Are your business operations within the US borders or global?</li><li>Are you publicly traded or privately held?</li><li>What are the requirements of your regulatory and compliance landscape? Are you highly regulated?</li><li>Do you have obligations under the Federal Information Systems Management Act (FISMA)?</li><li>What are your contractual obligations with your business and trading partners?</li></ul><p>There are certainly more questions to be assessed. Consider an appropriate framework that provides structure to guide the incident response plan. Building the incident response plan on the framework, not the framework itself, enables your organization to create the resilience needed to support your business.</p>','','full_html'),('featured_article',0,48,95,'en',0,'<p><strong>Remote Tele-work &amp; Cyber Safety</strong></p><p>As business leaders, our priority and paramount concern is the health and safety of our employees, staff, contractors, customers, clients, and community. The response to COVID-19 has affected many of us – family, friends, and business partners locally and around the world. When it came to virus detection, our major worry until recently has been cyber-related, and how it might affect our technology services. We now have a different virus challenge.</p><p>The COVID-19 outbreak is an unstable dynamic situation and has the potential to be incredibly impactful and disruptive to our organizations – corporate, non-profits, and governments alike. As the majority of our work force transitions to working remotely, bad actors and cyber attackers have ramped up their malicious efforts to create and spread more fear, uncertainty and doubt (FUD), in addition to stealing your information and company data.</p><p><strong>Attacks And Scams</strong></p><p>Right now hackers and bad actors are targeting a variety of our essential services for living and working including:</p><ul><li>Banks, Credits Cards, Gift Cards and most sources of Money</li><li>Grocery Stores, Restaurants, and Food Delivery Services</li><li>Doctors, Hospitals and Pharmacists (Medicines)</li><li>Online Movie Services, Podcasts and other Entertainment</li><li>Pandemic Information Updates and Government Websites, and more</li></ul><p>They want your credentials, login IDs and credit card numbers to steal your personal information, money and company data. They are doing this using easily available tools – social media platforms, devices, apps, texting, instant messaging, emails – and anything else that can get a malicious link to you.</p><p>Cyber attackers do this through:</p><ul><li>fake emails – phishing scams</li><li>fake voice mails – vishing</li><li>fake ads and coupons</li><li>fake websites and landing pages</li><li>fake direct SMS texts to your phone</li><li>fake videos and images on social media</li><li>fake PDFs and documents</li><li>fake authority communications</li></ul><p>The bad actors offer:</p><ul><li>fake COVID-19 and pandemic info</li><li>fake financial aid and loans</li><li>fake grocery and food delivery sites</li><li>fake medicines and pharmacists</li><li>fake online doctors and medical tests</li><li>fake bank sites, fake credit card sites</li><li>fake movie and entertainment</li><li>fake unemployment sites</li><li>fake government sites</li></ul><p>When you use these services, it is best to type in the URL (website address) manually instead of following a click-through search, ad or delivered link. The malicious URLs are propagated using a variety of means including domain names only one character off, through embedded attachments, or even landing on a web page.</p><p><strong>Eight (8) DO’s and DON’T’s</strong></p><ol><li><strong>Use Secure VPN.</strong> Always use your secure VPN on your devices. This ensures you have a secure encrypted communication ‘tunnel’ while working. Bad actors can monitor your traffic. Public wi-fi hotspots should be avoided.</li><li><strong>Don’t Mix Devices.</strong> Conduct business on corporate devices to ensure cybersecurity hygiene for your corporate and client data.</li><li><strong>Regular Sign On.</strong> Ensure you log onto your corporate network regularly to get the most recent updates. With the evolving cyber threats, new attacks are coming out daily.</li><li><strong>Use Multi-factor Authentication (MFA).</strong> Enable and use your multi-factor authentication credentials. MFA adds an essential layer of protection for your credentials.</li><li><strong>Don’t Share Passwords.</strong> Even at home, don’t share your passwords. In addition, please don’t write down credentials and passwords on paper, sticky pads or other mediums where they can be seen or retrieved.</li><li><strong>Don’t Click Through.</strong> If it seems suspicious, don’t click through. Type in the URL or web address manually. Report it to your IT support if possible. Do NOT forward or send the malicious content.</li><li><strong>Verify If In Doubt.</strong> If you have a request from your supervisor, co-worker or subordinate for information or money that appears suspicious – STOP. Pick up the phone or use other safe means to verify the request. Business Email Compromise (BEC) is fast on the rise.</li><li><strong>Avoid New Apps.</strong> Hackers and scammers have flooded app stores with mobile apps (and websites) faking a variety of our essential services – banking, food delivery, government, entertainment. Be careful, be mindful.</li></ol><p><strong>Actionable Take-Aways During the Covid-19 Outbreak Leading Through This Crisis</strong></p><ol><li><strong>Clear and Frequent Communication:</strong><br>Lack of data creates a vacuum leading to ill-informed decisions, and unease throughout your organization. Ensure you and your peers communicate clearly and frequently with messaging that provides directed guidance and actionable take-aways.</li><li><strong>A Single Source of Truth:</strong><br>Avoid multiple sources and channels of information. Create a single portal that works for your organization – an app, a website, a hotline. Leverage existing data and risk assessments to support better decision making, enable transparency and communicate progress efficiently and effectively with employees, staff, and others.</li><li><strong>Provide Collaboration Tools:</strong><br>Whether you have established remote working capabilities or not, you need to provide secure solutions for your organization. Determine how your organization works and provide the necessary platforms identifying critical use cases. This includes general communications and secure access to instant messaging, file sharing, enterprise applications, and other systems of engagement.</li><li><strong>Cybersecurity Safety:</strong><br>Cyber aggressors are taking advantage of this global crisis by sending malicious emails and perpetrating other scams.</li></ol>','','full_html'),('featured_article',0,48,128,'en',0,'<p><strong>Remote Tele-work &amp; Cyber Safety</strong></p><p>As business leaders, our priority and paramount concern is the health and safety of our employees, staff, contractors, customers, clients, and community. The response to COVID-19 has affected many of us – family, friends, and business partners locally and around the world. When it came to virus detection, our major worry until recently has been cyber-related, and how it might affect our technology services. We now have a different virus challenge.</p><p>The COVID-19 outbreak is an unstable dynamic situation and has the potential to be incredibly impactful and disruptive to our organizations – corporate, non-profits, and governments alike. As the majority of our work force transitions to working remotely, bad actors and cyber attackers have ramped up their malicious efforts to create and spread more fear, uncertainty and doubt (FUD), in addition to stealing your information and company data.</p><p><strong>Attacks And Scams</strong></p><p>Right now hackers and bad actors are targeting a variety of our essential services for living and working including:</p><ul><li>Banks, Credits Cards, Gift Cards and most sources of Money</li><li>Grocery Stores, Restaurants, and Food Delivery Services</li><li>Doctors, Hospitals and Pharmacists (Medicines)</li><li>Online Movie Services, Podcasts and other Entertainment</li><li>Pandemic Information Updates and Government Websites, and more</li></ul><p>They want your credentials, login IDs and credit card numbers to steal your personal information, money and company data. They are doing this using easily available tools – social media platforms, devices, apps, texting, instant messaging, emails – and anything else that can get a malicious link to you.</p><p>Cyber attackers do this through:</p><ul><li>fake emails – phishing scams</li><li>fake voice mails – vishing</li><li>fake ads and coupons</li><li>fake websites and landing pages</li><li>fake direct SMS texts to your phone</li><li>fake videos and images on social media</li><li>fake PDFs and documents</li><li>fake authority communications</li></ul><p>The bad actors offer:</p><ul><li>fake COVID-19 and pandemic info</li><li>fake financial aid and loans</li><li>fake grocery and food delivery sites</li><li>fake medicines and pharmacists</li><li>fake online doctors and medical tests</li><li>fake bank sites, fake credit card sites</li><li>fake movie and entertainment</li><li>fake unemployment sites</li><li>fake government sites</li></ul><p>When you use these services, it is best to type in the URL (website address) manually instead of following a click-through search, ad or delivered link. The malicious URLs are propagated using a variety of means including domain names only one character off, through embedded attachments, or even landing on a web page.</p><p><strong>Eight (8) DO’s and DON’T’s</strong></p><ol><li><strong>Use Secure VPN.</strong> Always use your secure VPN on your devices. This ensures you have a secure encrypted communication ‘tunnel’ while working. Bad actors can monitor your traffic. Public wi-fi hotspots should be avoided.</li><li><strong>Don’t Mix Devices.</strong> Conduct business on corporate devices to ensure cybersecurity hygiene for your corporate and client data.</li><li><strong>Regular Sign On.</strong> Ensure you log onto your corporate network regularly to get the most recent updates. With the evolving cyber threats, new attacks are coming out daily.</li><li><strong>Use Multi-factor Authentication (MFA).</strong> Enable and use your multi-factor authentication credentials. MFA adds an essential layer of protection for your credentials.</li><li><strong>Don’t Share Passwords.</strong> Even at home, don’t share your passwords. In addition, please don’t write down credentials and passwords on paper, sticky pads or other mediums where they can be seen or retrieved.</li><li><strong>Don’t Click Through.</strong> If it seems suspicious, don’t click through. Type in the URL or web address manually. Report it to your IT support if possible. Do NOT forward or send the malicious content.</li><li><strong>Verify If In Doubt.</strong> If you have a request from your supervisor, co-worker or subordinate for information or money that appears suspicious – STOP. Pick up the phone or use other safe means to verify the request. Business Email Compromise (BEC) is fast on the rise.</li><li><strong>Avoid New Apps.</strong> Hackers and scammers have flooded app stores with mobile apps (and websites) faking a variety of our essential services – banking, food delivery, government, entertainment. Be careful, be mindful.</li></ol><p><strong>Actionable Take-Aways During the Covid-19 Outbreak Leading Through This Crisis</strong></p><ol><li><strong>Clear and Frequent Communication:</strong><br>Lack of data creates a vacuum leading to ill-informed decisions, and unease throughout your organization. Ensure you and your peers communicate clearly and frequently with messaging that provides directed guidance and actionable take-aways.</li><li><strong>A Single Source of Truth:</strong><br>Avoid multiple sources and channels of information. Create a single portal that works for your organization – an app, a website, a hotline. Leverage existing data and risk assessments to support better decision making, enable transparency and communicate progress efficiently and effectively with employees, staff, and others.</li><li><strong>Provide Collaboration Tools:</strong><br>Whether you have established remote working capabilities or not, you need to provide secure solutions for your organization. Determine how your organization works and provide the necessary platforms identifying critical use cases. This includes general communications and secure access to instant messaging, file sharing, enterprise applications, and other systems of engagement.</li><li><strong>Cybersecurity Safety:</strong><br>Cyber aggressors are taking advantage of this global crisis by sending malicious emails and perpetrating other scams.</li></ol>','','full_html'),('featured_article',0,48,272,'en',0,'<p><strong>Remote Tele-work &amp; Cyber Safety</strong></p><p>As business leaders, our priority and paramount concern is the health and safety of our employees, staff, contractors, customers, clients, and community. The response to COVID-19 has affected many of us – family, friends, and business partners locally and around the world. When it came to virus detection, our major worry until recently has been cyber-related, and how it might affect our technology services. We now have a different virus challenge.</p><p>The COVID-19 outbreak is an unstable dynamic situation and has the potential to be incredibly impactful and disruptive to our organizations – corporate, non-profits, and governments alike. As the majority of our work force transitions to working remotely, bad actors and cyber attackers have ramped up their malicious efforts to create and spread more fear, uncertainty and doubt (FUD), in addition to stealing your information and company data.</p><p><strong>Attacks And Scams</strong></p><p>Right now hackers and bad actors are targeting a variety of our essential services for living and working including:</p><ul><li>Banks, Credits Cards, Gift Cards and most sources of Money</li><li>Grocery Stores, Restaurants, and Food Delivery Services</li><li>Doctors, Hospitals and Pharmacists (Medicines)</li><li>Online Movie Services, Podcasts and other Entertainment</li><li>Pandemic Information Updates and Government Websites, and more</li></ul><p>They want your credentials, login IDs and credit card numbers to steal your personal information, money and company data. They are doing this using easily available tools – social media platforms, devices, apps, texting, instant messaging, emails – and anything else that can get a malicious link to you.</p><p>Cyber attackers do this through:</p><ul><li>fake emails – phishing scams</li><li>fake voice mails – vishing</li><li>fake ads and coupons</li><li>fake websites and landing pages</li><li>fake direct SMS texts to your phone</li><li>fake videos and images on social media</li><li>fake PDFs and documents</li><li>fake authority communications</li></ul><p>The bad actors offer:</p><ul><li>fake COVID-19 and pandemic info</li><li>fake financial aid and loans</li><li>fake grocery and food delivery sites</li><li>fake medicines and pharmacists</li><li>fake online doctors and medical tests</li><li>fake bank sites, fake credit card sites</li><li>fake movie and entertainment</li><li>fake unemployment sites</li><li>fake government sites</li></ul><p>When you use these services, it is best to type in the URL (website address) manually instead of following a click-through search, ad or delivered link. The malicious URLs are propagated using a variety of means including domain names only one character off, through embedded attachments, or even landing on a web page.</p><p><strong>Eight (8) DO’s and DON’T’s</strong></p><ol><li><strong>Use Secure VPN.</strong> Always use your secure VPN on your devices. This ensures you have a secure encrypted communication ‘tunnel’ while working. Bad actors can monitor your traffic. Public wi-fi hotspots should be avoided.</li><li><strong>Don’t Mix Devices.</strong> Conduct business on corporate devices to ensure cybersecurity hygiene for your corporate and client data.</li><li><strong>Regular Sign On.</strong> Ensure you log onto your corporate network regularly to get the most recent updates. With the evolving cyber threats, new attacks are coming out daily.</li><li><strong>Use Multi-factor Authentication (MFA).</strong> Enable and use your multi-factor authentication credentials. MFA adds an essential layer of protection for your credentials.</li><li><strong>Don’t Share Passwords.</strong> Even at home, don’t share your passwords. In addition, please don’t write down credentials and passwords on paper, sticky pads or other mediums where they can be seen or retrieved.</li><li><strong>Don’t Click Through.</strong> If it seems suspicious, don’t click through. Type in the URL or web address manually. Report it to your IT support if possible. Do NOT forward or send the malicious content.</li><li><strong>Verify If In Doubt.</strong> If you have a request from your supervisor, co-worker or subordinate for information or money that appears suspicious – STOP. Pick up the phone or use other safe means to verify the request. Business Email Compromise (BEC) is fast on the rise.</li><li><strong>Avoid New Apps.</strong> Hackers and scammers have flooded app stores with mobile apps (and websites) faking a variety of our essential services – banking, food delivery, government, entertainment. Be careful, be mindful.</li></ol><p><strong>Actionable Take-Aways During the Covid-19 Outbreak Leading Through This Crisis</strong></p><ol><li><strong>Clear and Frequent Communication:</strong><br>Lack of data creates a vacuum leading to ill-informed decisions, and unease throughout your organization. Ensure you and your peers communicate clearly and frequently with messaging that provides directed guidance and actionable take-aways.</li><li><strong>A Single Source of Truth:</strong><br>Avoid multiple sources and channels of information. Create a single portal that works for your organization – an app, a website, a hotline. Leverage existing data and risk assessments to support better decision making, enable transparency and communicate progress efficiently and effectively with employees, staff, and others.</li><li><strong>Provide Collaboration Tools:</strong><br>Whether you have established remote working capabilities or not, you need to provide secure solutions for your organization. Determine how your organization works and provide the necessary platforms identifying critical use cases. This includes general communications and secure access to instant messaging, file sharing, enterprise applications, and other systems of engagement.</li><li><strong>Cybersecurity Safety:</strong><br>Cyber aggressors are taking advantage of this global crisis by sending malicious emails and perpetrating other scams.</li></ol>','','full_html'),('featured_article',0,48,450,'en',0,'<p><strong>Remote Tele-work &amp; Cyber Safety</strong></p><p>As business leaders, our priority and paramount concern is the health and safety of our employees, staff, contractors, customers, clients, and community. The response to COVID-19 has affected many of us – family, friends, and business partners locally and around the world. When it came to virus detection, our major worry until recently has been cyber-related, and how it might affect our technology services. We now have a different virus challenge.</p><p>The COVID-19 outbreak is an unstable dynamic situation and has the potential to be incredibly impactful and disruptive to our organizations – corporate, non-profits, and governments alike. As the majority of our work force transitions to working remotely, bad actors and cyber attackers have ramped up their malicious efforts to create and spread more fear, uncertainty and doubt (FUD), in addition to stealing your information and company data.</p><p><strong>Attacks And Scams</strong></p><p>Right now hackers and bad actors are targeting a variety of our essential services for living and working including:</p><ul><li>Banks, Credits Cards, Gift Cards and most sources of Money</li><li>Grocery Stores, Restaurants, and Food Delivery Services</li><li>Doctors, Hospitals and Pharmacists (Medicines)</li><li>Online Movie Services, Podcasts and other Entertainment</li><li>Pandemic Information Updates and Government Websites, and more</li></ul><p>They want your credentials, login IDs and credit card numbers to steal your personal information, money and company data. They are doing this using easily available tools – social media platforms, devices, apps, texting, instant messaging, emails – and anything else that can get a malicious link to you.</p><p>Cyber attackers do this through:</p><ul><li>fake emails – phishing scams</li><li>fake voice mails – vishing</li><li>fake ads and coupons</li><li>fake websites and landing pages</li><li>fake direct SMS texts to your phone</li><li>fake videos and images on social media</li><li>fake PDFs and documents</li><li>fake authority communications</li></ul><p>The bad actors offer:</p><ul><li>fake COVID-19 and pandemic info</li><li>fake financial aid and loans</li><li>fake grocery and food delivery sites</li><li>fake medicines and pharmacists</li><li>fake online doctors and medical tests</li><li>fake bank sites, fake credit card sites</li><li>fake movie and entertainment</li><li>fake unemployment sites</li><li>fake government sites</li></ul><p>When you use these services, it is best to type in the URL (website address) manually instead of following a click-through search, ad or delivered link. The malicious URLs are propagated using a variety of means including domain names only one character off, through embedded attachments, or even landing on a web page.</p><p><strong>Eight (8) DO’s and DON’T’s</strong></p><ol><li><strong>Use Secure VPN.</strong> Always use your secure VPN on your devices. This ensures you have a secure encrypted communication ‘tunnel’ while working. Bad actors can monitor your traffic. Public wi-fi hotspots should be avoided.</li><li><strong>Don’t Mix Devices.</strong> Conduct business on corporate devices to ensure cybersecurity hygiene for your corporate and client data.</li><li><strong>Regular Sign On.</strong> Ensure you log onto your corporate network regularly to get the most recent updates. With the evolving cyber threats, new attacks are coming out daily.</li><li><strong>Use Multi-factor Authentication (MFA).</strong> Enable and use your multi-factor authentication credentials. MFA adds an essential layer of protection for your credentials.</li><li><strong>Don’t Share Passwords.</strong> Even at home, don’t share your passwords. In addition, please don’t write down credentials and passwords on paper, sticky pads or other mediums where they can be seen or retrieved.</li><li><strong>Don’t Click Through.</strong> If it seems suspicious, don’t click through. Type in the URL or web address manually. Report it to your IT support if possible. Do NOT forward or send the malicious content.</li><li><strong>Verify If In Doubt.</strong> If you have a request from your supervisor, co-worker or subordinate for information or money that appears suspicious – STOP. Pick up the phone or use other safe means to verify the request. Business Email Compromise (BEC) is fast on the rise.</li><li><strong>Avoid New Apps.</strong> Hackers and scammers have flooded app stores with mobile apps (and websites) faking a variety of our essential services – banking, food delivery, government, entertainment. Be careful, be mindful.</li></ol><p><strong>Actionable Take-Aways During the Covid-19 Outbreak Leading Through This Crisis</strong></p><ol><li><strong>Clear and Frequent Communication:</strong><br>Lack of data creates a vacuum leading to ill-informed decisions, and unease throughout your organization. Ensure you and your peers communicate clearly and frequently with messaging that provides directed guidance and actionable take-aways.</li><li><strong>A Single Source of Truth:</strong><br>Avoid multiple sources and channels of information. Create a single portal that works for your organization – an app, a website, a hotline. Leverage existing data and risk assessments to support better decision making, enable transparency and communicate progress efficiently and effectively with employees, staff, and others.</li><li><strong>Provide Collaboration Tools:</strong><br>Whether you have established remote working capabilities or not, you need to provide secure solutions for your organization. Determine how your organization works and provide the necessary platforms identifying critical use cases. This includes general communications and secure access to instant messaging, file sharing, enterprise applications, and other systems of engagement.</li><li><strong>Cybersecurity Safety:</strong><br>Cyber aggressors are taking advantage of this global crisis by sending malicious emails and perpetrating other scams.</li></ol>','','full_html'),('featured_article',0,48,517,'en',0,'<p><strong>Remote Tele-work &amp; Cyber Safety</strong></p><p>As business leaders, our priority and paramount concern is the health and safety of our employees, staff, contractors, customers, clients, and community. The response to COVID-19 has affected many of us – family, friends, and business partners locally and around the world. When it came to virus detection, our major worry until recently has been cyber-related, and how it might affect our technology services. We now have a different virus challenge.</p><p>The COVID-19 outbreak is an unstable dynamic situation and has the potential to be incredibly impactful and disruptive to our organizations – corporate, non-profits, and governments alike. As the majority of our work force transitions to working remotely, bad actors and cyber attackers have ramped up their malicious efforts to create and spread more fear, uncertainty and doubt (FUD), in addition to stealing your information and company data.</p><p><strong>Attacks And Scams</strong></p><p>Right now hackers and bad actors are targeting a variety of our essential services for living and working including:</p><ul><li>Banks, Credits Cards, Gift Cards and most sources of Money</li><li>Grocery Stores, Restaurants, and Food Delivery Services</li><li>Doctors, Hospitals and Pharmacists (Medicines)</li><li>Online Movie Services, Podcasts and other Entertainment</li><li>Pandemic Information Updates and Government Websites, and more</li></ul><p>They want your credentials, login IDs and credit card numbers to steal your personal information, money and company data. They are doing this using easily available tools – social media platforms, devices, apps, texting, instant messaging, emails – and anything else that can get a malicious link to you.</p><p>Cyber attackers do this through:</p><ul><li>fake emails – phishing scams</li><li>fake voice mails – vishing</li><li>fake ads and coupons</li><li>fake websites and landing pages</li><li>fake direct SMS texts to your phone</li><li>fake videos and images on social media</li><li>fake PDFs and documents</li><li>fake authority communications</li></ul><p>The bad actors offer:</p><ul><li>fake COVID-19 and pandemic info</li><li>fake financial aid and loans</li><li>fake grocery and food delivery sites</li><li>fake medicines and pharmacists</li><li>fake online doctors and medical tests</li><li>fake bank sites, fake credit card sites</li><li>fake movie and entertainment</li><li>fake unemployment sites</li><li>fake government sites</li></ul><p>When you use these services, it is best to type in the URL (website address) manually instead of following a click-through search, ad or delivered link. The malicious URLs are propagated using a variety of means including domain names only one character off, through embedded attachments, or even landing on a web page.</p><p><strong>Eight (8) DO’s and DON’T’s</strong></p><ol><li><strong>Use Secure VPN.</strong> Always use your secure VPN on your devices. This ensures you have a secure encrypted communication ‘tunnel’ while working. Bad actors can monitor your traffic. Public wi-fi hotspots should be avoided.</li><li><strong>Don’t Mix Devices.</strong> Conduct business on corporate devices to ensure cybersecurity hygiene for your corporate and client data.</li><li><strong>Regular Sign On.</strong> Ensure you log onto your corporate network regularly to get the most recent updates. With the evolving cyber threats, new attacks are coming out daily.</li><li><strong>Use Multi-factor Authentication (MFA).</strong> Enable and use your multi-factor authentication credentials. MFA adds an essential layer of protection for your credentials.</li><li><strong>Don’t Share Passwords.</strong> Even at home, don’t share your passwords. In addition, please don’t write down credentials and passwords on paper, sticky pads or other mediums where they can be seen or retrieved.</li><li><strong>Don’t Click Through.</strong> If it seems suspicious, don’t click through. Type in the URL or web address manually. Report it to your IT support if possible. Do NOT forward or send the malicious content.</li><li><strong>Verify If In Doubt.</strong> If you have a request from your supervisor, co-worker or subordinate for information or money that appears suspicious – STOP. Pick up the phone or use other safe means to verify the request. Business Email Compromise (BEC) is fast on the rise.</li><li><strong>Avoid New Apps.</strong> Hackers and scammers have flooded app stores with mobile apps (and websites) faking a variety of our essential services – banking, food delivery, government, entertainment. Be careful, be mindful.</li></ol><p><strong>Actionable Take-Aways During the Covid-19 Outbreak Leading Through This Crisis</strong></p><ol><li><strong>Clear and Frequent Communication:</strong><br>Lack of data creates a vacuum leading to ill-informed decisions, and unease throughout your organization. Ensure you and your peers communicate clearly and frequently with messaging that provides directed guidance and actionable take-aways.</li><li><strong>A Single Source of Truth:</strong><br>Avoid multiple sources and channels of information. Create a single portal that works for your organization – an app, a website, a hotline. Leverage existing data and risk assessments to support better decision making, enable transparency and communicate progress efficiently and effectively with employees, staff, and others.</li><li><strong>Provide Collaboration Tools:</strong><br>Whether you have established remote working capabilities or not, you need to provide secure solutions for your organization. Determine how your organization works and provide the necessary platforms identifying critical use cases. This includes general communications and secure access to instant messaging, file sharing, enterprise applications, and other systems of engagement.</li><li><strong>Cybersecurity Safety:</strong><br>Cyber aggressors are taking advantage of this global crisis by sending malicious emails and perpetrating other scams.</li></ol>','','full_html'),('featured_article',0,48,533,'en',0,'<p><strong>Remote Tele-work &amp; Cyber Safety</strong></p><p>As business leaders, our priority and paramount concern is the health and safety of our employees, staff, contractors, customers, clients, and community. The response to COVID-19 has affected many of us – family, friends, and business partners locally and around the world. When it came to virus detection, our major worry until recently has been cyber-related, and how it might affect our technology services. We now have a different virus challenge.</p><p>The COVID-19 outbreak is an unstable dynamic situation and has the potential to be incredibly impactful and disruptive to our organizations – corporate, non-profits, and governments alike. As the majority of our work force transitions to working remotely, bad actors and cyber attackers have ramped up their malicious efforts to create and spread more fear, uncertainty and doubt (FUD), in addition to stealing your information and company data.</p><p><strong>Attacks And Scams</strong></p><p>Right now hackers and bad actors are targeting a variety of our essential services for living and working including:</p><ul><li>Banks, Credits Cards, Gift Cards and most sources of Money</li><li>Grocery Stores, Restaurants, and Food Delivery Services</li><li>Doctors, Hospitals and Pharmacists (Medicines)</li><li>Online Movie Services, Podcasts and other Entertainment</li><li>Pandemic Information Updates and Government Websites, and more</li></ul><p>They want your credentials, login IDs and credit card numbers to steal your personal information, money and company data. They are doing this using easily available tools – social media platforms, devices, apps, texting, instant messaging, emails – and anything else that can get a malicious link to you.</p><p>Cyber attackers do this through:</p><ul><li>fake emails – phishing scams</li><li>fake voice mails – vishing</li><li>fake ads and coupons</li><li>fake websites and landing pages</li><li>fake direct SMS texts to your phone</li><li>fake videos and images on social media</li><li>fake PDFs and documents</li><li>fake authority communications</li></ul><p>The bad actors offer:</p><ul><li>fake COVID-19 and pandemic info</li><li>fake financial aid and loans</li><li>fake grocery and food delivery sites</li><li>fake medicines and pharmacists</li><li>fake online doctors and medical tests</li><li>fake bank sites, fake credit card sites</li><li>fake movie and entertainment</li><li>fake unemployment sites</li><li>fake government sites</li></ul><p>When you use these services, it is best to type in the URL (website address) manually instead of following a click-through search, ad or delivered link. The malicious URLs are propagated using a variety of means including domain names only one character off, through embedded attachments, or even landing on a web page.</p><p><strong>Eight (8) DO’s and DON’T’s</strong></p><ol><li><strong>Use Secure VPN.</strong> Always use your secure VPN on your devices. This ensures you have a secure encrypted communication ‘tunnel’ while working. Bad actors can monitor your traffic. Public wi-fi hotspots should be avoided.</li><li><strong>Don’t Mix Devices.</strong> Conduct business on corporate devices to ensure cybersecurity hygiene for your corporate and client data.</li><li><strong>Regular Sign On.</strong> Ensure you log onto your corporate network regularly to get the most recent updates. With the evolving cyber threats, new attacks are coming out daily.</li><li><strong>Use Multi-factor Authentication (MFA).</strong> Enable and use your multi-factor authentication credentials. MFA adds an essential layer of protection for your credentials.</li><li><strong>Don’t Share Passwords.</strong> Even at home, don’t share your passwords. In addition, please don’t write down credentials and passwords on paper, sticky pads or other mediums where they can be seen or retrieved.</li><li><strong>Don’t Click Through.</strong> If it seems suspicious, don’t click through. Type in the URL or web address manually. Report it to your IT support if possible. Do NOT forward or send the malicious content.</li><li><strong>Verify If In Doubt.</strong> If you have a request from your supervisor, co-worker or subordinate for information or money that appears suspicious – STOP. Pick up the phone or use other safe means to verify the request. Business Email Compromise (BEC) is fast on the rise.</li><li><strong>Avoid New Apps.</strong> Hackers and scammers have flooded app stores with mobile apps (and websites) faking a variety of our essential services – banking, food delivery, government, entertainment. Be careful, be mindful.</li></ol><p><strong>Actionable Take-Aways During the Covid-19 Outbreak Leading Through This Crisis</strong></p><ol><li><strong>Clear and Frequent Communication:</strong><br>Lack of data creates a vacuum leading to ill-informed decisions, and unease throughout your organization. Ensure you and your peers communicate clearly and frequently with messaging that provides directed guidance and actionable take-aways.</li><li><strong>A Single Source of Truth:</strong><br>Avoid multiple sources and channels of information. Create a single portal that works for your organization – an app, a website, a hotline. Leverage existing data and risk assessments to support better decision making, enable transparency and communicate progress efficiently and effectively with employees, staff, and others.</li><li><strong>Provide Collaboration Tools:</strong><br>Whether you have established remote working capabilities or not, you need to provide secure solutions for your organization. Determine how your organization works and provide the necessary platforms identifying critical use cases. This includes general communications and secure access to instant messaging, file sharing, enterprise applications, and other systems of engagement.</li><li><strong>Cybersecurity Safety:</strong><br>Cyber aggressors are taking advantage of this global crisis by sending malicious emails and perpetrating other scams.</li></ol>','','full_html'),('featured_article',0,48,608,'en',0,'<p><strong>Remote Tele-work &amp; Cyber Safety</strong></p><p>As business leaders, our priority and paramount concern is the health and safety of our employees, staff, contractors, customers, clients, and community. The response to COVID-19 has affected many of us – family, friends, and business partners locally and around the world. When it came to virus detection, our major worry until recently has been cyber-related, and how it might affect our technology services. We now have a different virus challenge.</p><p>The COVID-19 outbreak is an unstable dynamic situation and has the potential to be incredibly impactful and disruptive to our organizations – corporate, non-profits, and governments alike. As the majority of our work force transitions to working remotely, bad actors and cyber attackers have ramped up their malicious efforts to create and spread more fear, uncertainty and doubt (FUD), in addition to stealing your information and company data.</p><p><strong>Attacks And Scams</strong></p><p>Right now hackers and bad actors are targeting a variety of our essential services for living and working including:</p><ul><li>Banks, Credits Cards, Gift Cards and most sources of Money</li><li>Grocery Stores, Restaurants, and Food Delivery Services</li><li>Doctors, Hospitals and Pharmacists (Medicines)</li><li>Online Movie Services, Podcasts and other Entertainment</li><li>Pandemic Information Updates and Government Websites, and more</li></ul><p>They want your credentials, login IDs and credit card numbers to steal your personal information, money and company data. They are doing this using easily available tools – social media platforms, devices, apps, texting, instant messaging, emails – and anything else that can get a malicious link to you.</p><p>Cyber attackers do this through:</p><ul><li>fake emails – phishing scams</li><li>fake voice mails – vishing</li><li>fake ads and coupons</li><li>fake websites and landing pages</li><li>fake direct SMS texts to your phone</li><li>fake videos and images on social media</li><li>fake PDFs and documents</li><li>fake authority communications</li></ul><p>The bad actors offer:</p><ul><li>fake COVID-19 and pandemic info</li><li>fake financial aid and loans</li><li>fake grocery and food delivery sites</li><li>fake medicines and pharmacists</li><li>fake online doctors and medical tests</li><li>fake bank sites, fake credit card sites</li><li>fake movie and entertainment</li><li>fake unemployment sites</li><li>fake government sites</li></ul><p>When you use these services, it is best to type in the URL (website address) manually instead of following a click-through search, ad or delivered link. The malicious URLs are propagated using a variety of means including domain names only one character off, through embedded attachments, or even landing on a web page.</p><p><strong>Eight (8) DO’s and DON’T’s</strong></p><ol><li><strong>Use Secure VPN.</strong> Always use your secure VPN on your devices. This ensures you have a secure encrypted communication ‘tunnel’ while working. Bad actors can monitor your traffic. Public wi-fi hotspots should be avoided.</li><li><strong>Don’t Mix Devices.</strong> Conduct business on corporate devices to ensure cybersecurity hygiene for your corporate and client data.</li><li><strong>Regular Sign On.</strong> Ensure you log onto your corporate network regularly to get the most recent updates. With the evolving cyber threats, new attacks are coming out daily.</li><li><strong>Use Multi-factor Authentication (MFA).</strong> Enable and use your multi-factor authentication credentials. MFA adds an essential layer of protection for your credentials.</li><li><strong>Don’t Share Passwords.</strong> Even at home, don’t share your passwords. In addition, please don’t write down credentials and passwords on paper, sticky pads or other mediums where they can be seen or retrieved.</li><li><strong>Don’t Click Through.</strong> If it seems suspicious, don’t click through. Type in the URL or web address manually. Report it to your IT support if possible. Do NOT forward or send the malicious content.</li><li><strong>Verify If In Doubt.</strong> If you have a request from your supervisor, co-worker or subordinate for information or money that appears suspicious – STOP. Pick up the phone or use other safe means to verify the request. Business Email Compromise (BEC) is fast on the rise.</li><li><strong>Avoid New Apps.</strong> Hackers and scammers have flooded app stores with mobile apps (and websites) faking a variety of our essential services – banking, food delivery, government, entertainment. Be careful, be mindful.</li></ol><p><strong>Actionable Take-Aways During the Covid-19 Outbreak Leading Through This Crisis</strong></p><ol><li><strong>Clear and Frequent Communication:</strong><br>Lack of data creates a vacuum leading to ill-informed decisions, and unease throughout your organization. Ensure you and your peers communicate clearly and frequently with messaging that provides directed guidance and actionable take-aways.</li><li><strong>A Single Source of Truth:</strong><br>Avoid multiple sources and channels of information. Create a single portal that works for your organization – an app, a website, a hotline. Leverage existing data and risk assessments to support better decision making, enable transparency and communicate progress efficiently and effectively with employees, staff, and others.</li><li><strong>Provide Collaboration Tools:</strong><br>Whether you have established remote working capabilities or not, you need to provide secure solutions for your organization. Determine how your organization works and provide the necessary platforms identifying critical use cases. This includes general communications and secure access to instant messaging, file sharing, enterprise applications, and other systems of engagement.</li><li><strong>Cybersecurity Safety:</strong><br>Cyber aggressors are taking advantage of this global crisis by sending malicious emails and perpetrating other scams.</li></ol>','','full_html'),('featured_article',0,49,96,'en',0,'<p>Can security awareness training change behavior and reduce cyber risk?CIOs and CISOs realize human error is perhaps the biggest weakness in any information security program. Attacks are becoming more frequent. Five industries — health care, manufacturing, financial services, transportation, and government — have been ranked as the most frequently attacked sectors in the world.</p><p>While many large enterprises have mature employee training programs, incomplete employee training remains the main reason organizations are left vulnerable to phishing attacks — this is the conclusion of Proofpoint’s fourth annual 2019 Beyond the Phish report.</p><p>Here are four cybersecurity threats organizations should focus on during employee awareness training programs:</p><p><strong>TOP FOUR (4) SECURITY THREAT TOPICS FOR AWARENESS TRAINING</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Threats</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n</style><ol><li><strong>Phishing:</strong> At the enterprise level, many organizations struggle because it is a complicated issue. Employees need to be trained to be skeptical about essentially everything. Only those links that have been received from known senders should be clicked upon; however, even that can be difficult to discern.</li><li><strong>Unauthorized Application Installation/Usage:</strong> Another common security threat is posed by the installation of unauthorized applications. This can be addressed by revoking administrative access for corporate devices and for most employees. A training session explaining the importance of third-party credibility and authenticity can be enough to make employees aware of the threats posed by the installation of unauthorized applications.</li><li><strong>Password Practices:</strong> Guessing passwords is the easiest way of breaking into a system and has typically been the first trick up a hacker’s sleeve. Often times default passwords for hardware and systems are not changed. Another practice that elevates risk is using the same password for different applications. This can be addressed by spreading awareness about changing passwords and using strong passwords and the part they play in keeping the hackers at bay. Modern-day application systems won’t accept user passwords that don’t meet minimal complex security requirements.</li><li><strong>Data Leakage:</strong> Data Leakage can have serious consequences. Employees often transfer files between their personal computers and their corporate workstations or allow their family members to use their corporate devices at home, and this can create some security loopholes. Address this issue through enforcement of a company-wide policy prohibiting the transfer of data from corporate devices to personal ones. Software can be installed to address Data Loss Prevention (DLP).</li></ol><p>Even the most rigorously “secure” infrastructures can get compromised. The threats listed above are some of the most common human vulnerabilities and it is of vital importance that precautionary awareness regarding them be made widespread.</p><p><strong>SIX (6) CRITICAL COMPONENTS OF A SECURITY AWARENESS PROGRAM</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Awareness Program Components</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n    ol {\r\n        margin-left: 20px;\r\n    }\r\n</style><ol><li><strong>Content:</strong> Ensure you develop a program that employs multi-media content. Users learn from a variety of means at different levels and different paces. Utilizing a platform that allows delivery of a wide variety of content, including gamification, will help spread awareness of the program faster. You can also match different content types to different roles in your organization.</li><li><strong>Executive Support &amp; Planning:</strong> Ensure you have support from the top of the organization down. Security awareness programs require strong “tone-at-top.” Ensure you have a strategy and plan documented. Involve and communicate with your sponsor and stakeholders on a regular basis.</li><li><strong>Campaign Support Materials:</strong> A successful program should not be ‘one and done’; treat it as a marketing endeavor. Vary the content and materials to keep users engaged and active.</li><li><strong>Testing:</strong> Phishing simulations prompt users to either click a link, report the phish, or do nothing. You want to give them an opportunity to report phishing attempts and help the organization increase resilience. If they do fall for the phish, it is recommended you implement remediation follow-up training. Doing nothing is not ideal as it leaves the potential threat out there and increases risk for others in the organization.</li><li><strong>Metrics &amp; Reporting:</strong> Keep your sponsor and stakeholders apprised of the progress of the security awareness training program. You need to be able to demonstrate progress. Reporting is also useful for optimizing campaigns based on past results. You want to be able to see what is working well and what can be improved upon.</li><li><strong>Surveys/Assessments:</strong> These tools can help you understand the attitudes of your organization and how well your program is resonating with your people so you can adapt. Think of it as a pulse check of subtle nuances that are different from metrics/reporting, such as opinions, frame of mind, etc.</li></ol><p><strong>SUMMARY</strong></p><p>Effective education is imperative as cybercriminals continue targeting individuals, making a people-centric security approach essential. Use security awareness training software that provides testing. The phish testing software should provide performance reports so that you can measure improvements in employee behavior as training progresses.</p>','','full_html'),('featured_article',0,49,129,'en',0,'<p>Can security awareness training change behavior and reduce cyber risk?CIOs and CISOs realize human error is perhaps the biggest weakness in any information security program. Attacks are becoming more frequent. Five industries — health care, manufacturing, financial services, transportation, and government — have been ranked as the most frequently attacked sectors in the world.</p><p>While many large enterprises have mature employee training programs, incomplete employee training remains the main reason organizations are left vulnerable to phishing attacks — this is the conclusion of Proofpoint’s fourth annual 2019 Beyond the Phish report.</p><p>Here are four cybersecurity threats organizations should focus on during employee awareness training programs:</p><p><strong>TOP FOUR (4) SECURITY THREAT TOPICS FOR AWARENESS TRAINING</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Threats</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n</style><ol><li><strong>Phishing:</strong> At the enterprise level, many organizations struggle because it is a complicated issue. Employees need to be trained to be skeptical about essentially everything. Only those links that have been received from known senders should be clicked upon; however, even that can be difficult to discern.</li><li><strong>Unauthorized Application Installation/Usage:</strong> Another common security threat is posed by the installation of unauthorized applications. This can be addressed by revoking administrative access for corporate devices and for most employees. A training session explaining the importance of third-party credibility and authenticity can be enough to make employees aware of the threats posed by the installation of unauthorized applications.</li><li><strong>Password Practices:</strong> Guessing passwords is the easiest way of breaking into a system and has typically been the first trick up a hacker’s sleeve. Often times default passwords for hardware and systems are not changed. Another practice that elevates risk is using the same password for different applications. This can be addressed by spreading awareness about changing passwords and using strong passwords and the part they play in keeping the hackers at bay. Modern-day application systems won’t accept user passwords that don’t meet minimal complex security requirements.</li><li><strong>Data Leakage:</strong> Data Leakage can have serious consequences. Employees often transfer files between their personal computers and their corporate workstations or allow their family members to use their corporate devices at home, and this can create some security loopholes. Address this issue through enforcement of a company-wide policy prohibiting the transfer of data from corporate devices to personal ones. Software can be installed to address Data Loss Prevention (DLP).</li></ol><p>Even the most rigorously “secure” infrastructures can get compromised. The threats listed above are some of the most common human vulnerabilities and it is of vital importance that precautionary awareness regarding them be made widespread.</p><p><strong>SIX (6) CRITICAL COMPONENTS OF A SECURITY AWARENESS PROGRAM</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Awareness Program Components</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n    ol {\r\n        margin-left: 20px;\r\n    }\r\n</style><ol><li><strong>Content:</strong> Ensure you develop a program that employs multi-media content. Users learn from a variety of means at different levels and different paces. Utilizing a platform that allows delivery of a wide variety of content, including gamification, will help spread awareness of the program faster. You can also match different content types to different roles in your organization.</li><li><strong>Executive Support &amp; Planning:</strong> Ensure you have support from the top of the organization down. Security awareness programs require strong “tone-at-top.” Ensure you have a strategy and plan documented. Involve and communicate with your sponsor and stakeholders on a regular basis.</li><li><strong>Campaign Support Materials:</strong> A successful program should not be ‘one and done’; treat it as a marketing endeavor. Vary the content and materials to keep users engaged and active.</li><li><strong>Testing:</strong> Phishing simulations prompt users to either click a link, report the phish, or do nothing. You want to give them an opportunity to report phishing attempts and help the organization increase resilience. If they do fall for the phish, it is recommended you implement remediation follow-up training. Doing nothing is not ideal as it leaves the potential threat out there and increases risk for others in the organization.</li><li><strong>Metrics &amp; Reporting:</strong> Keep your sponsor and stakeholders apprised of the progress of the security awareness training program. You need to be able to demonstrate progress. Reporting is also useful for optimizing campaigns based on past results. You want to be able to see what is working well and what can be improved upon.</li><li><strong>Surveys/Assessments:</strong> These tools can help you understand the attitudes of your organization and how well your program is resonating with your people so you can adapt. Think of it as a pulse check of subtle nuances that are different from metrics/reporting, such as opinions, frame of mind, etc.</li></ol><p><strong>SUMMARY</strong></p><p>Effective education is imperative as cybercriminals continue targeting individuals, making a people-centric security approach essential. Use security awareness training software that provides testing. The phish testing software should provide performance reports so that you can measure improvements in employee behavior as training progresses.</p>','','full_html'),('featured_article',0,49,271,'en',0,'<p>Can security awareness training change behavior and reduce cyber risk?CIOs and CISOs realize human error is perhaps the biggest weakness in any information security program. Attacks are becoming more frequent. Five industries — health care, manufacturing, financial services, transportation, and government — have been ranked as the most frequently attacked sectors in the world.</p><p>While many large enterprises have mature employee training programs, incomplete employee training remains the main reason organizations are left vulnerable to phishing attacks — this is the conclusion of Proofpoint’s fourth annual 2019 Beyond the Phish report.</p><p>Here are four cybersecurity threats organizations should focus on during employee awareness training programs:</p><p><strong>TOP FOUR (4) SECURITY THREAT TOPICS FOR AWARENESS TRAINING</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Threats</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n</style><ol><li><strong>Phishing:</strong> At the enterprise level, many organizations struggle because it is a complicated issue. Employees need to be trained to be skeptical about essentially everything. Only those links that have been received from known senders should be clicked upon; however, even that can be difficult to discern.</li><li><strong>Unauthorized Application Installation/Usage:</strong> Another common security threat is posed by the installation of unauthorized applications. This can be addressed by revoking administrative access for corporate devices and for most employees. A training session explaining the importance of third-party credibility and authenticity can be enough to make employees aware of the threats posed by the installation of unauthorized applications.</li><li><strong>Password Practices:</strong> Guessing passwords is the easiest way of breaking into a system and has typically been the first trick up a hacker’s sleeve. Often times default passwords for hardware and systems are not changed. Another practice that elevates risk is using the same password for different applications. This can be addressed by spreading awareness about changing passwords and using strong passwords and the part they play in keeping the hackers at bay. Modern-day application systems won’t accept user passwords that don’t meet minimal complex security requirements.</li><li><strong>Data Leakage:</strong> Data Leakage can have serious consequences. Employees often transfer files between their personal computers and their corporate workstations or allow their family members to use their corporate devices at home, and this can create some security loopholes. Address this issue through enforcement of a company-wide policy prohibiting the transfer of data from corporate devices to personal ones. Software can be installed to address Data Loss Prevention (DLP).</li></ol><p>Even the most rigorously “secure” infrastructures can get compromised. The threats listed above are some of the most common human vulnerabilities and it is of vital importance that precautionary awareness regarding them be made widespread.</p><p><strong>SIX (6) CRITICAL COMPONENTS OF A SECURITY AWARENESS PROGRAM</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Awareness Program Components</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n    ol {\r\n        margin-left: 20px;\r\n    }\r\n</style><ol><li><strong>Content:</strong> Ensure you develop a program that employs multi-media content. Users learn from a variety of means at different levels and different paces. Utilizing a platform that allows delivery of a wide variety of content, including gamification, will help spread awareness of the program faster. You can also match different content types to different roles in your organization.</li><li><strong>Executive Support &amp; Planning:</strong> Ensure you have support from the top of the organization down. Security awareness programs require strong “tone-at-top.” Ensure you have a strategy and plan documented. Involve and communicate with your sponsor and stakeholders on a regular basis.</li><li><strong>Campaign Support Materials:</strong> A successful program should not be ‘one and done’; treat it as a marketing endeavor. Vary the content and materials to keep users engaged and active.</li><li><strong>Testing:</strong> Phishing simulations prompt users to either click a link, report the phish, or do nothing. You want to give them an opportunity to report phishing attempts and help the organization increase resilience. If they do fall for the phish, it is recommended you implement remediation follow-up training. Doing nothing is not ideal as it leaves the potential threat out there and increases risk for others in the organization.</li><li><strong>Metrics &amp; Reporting:</strong> Keep your sponsor and stakeholders apprised of the progress of the security awareness training program. You need to be able to demonstrate progress. Reporting is also useful for optimizing campaigns based on past results. You want to be able to see what is working well and what can be improved upon.</li><li><strong>Surveys/Assessments:</strong> These tools can help you understand the attitudes of your organization and how well your program is resonating with your people so you can adapt. Think of it as a pulse check of subtle nuances that are different from metrics/reporting, such as opinions, frame of mind, etc.</li></ol><p><strong>SUMMARY</strong></p><p>Effective education is imperative as cybercriminals continue targeting individuals, making a people-centric security approach essential. Use security awareness training software that provides testing. The phish testing software should provide performance reports so that you can measure improvements in employee behavior as training progresses.</p>','','full_html'),('featured_article',0,49,451,'en',0,'<p>Can security awareness training change behavior and reduce cyber risk?CIOs and CISOs realize human error is perhaps the biggest weakness in any information security program. Attacks are becoming more frequent. Five industries — health care, manufacturing, financial services, transportation, and government — have been ranked as the most frequently attacked sectors in the world.</p><p>While many large enterprises have mature employee training programs, incomplete employee training remains the main reason organizations are left vulnerable to phishing attacks — this is the conclusion of Proofpoint’s fourth annual 2019 Beyond the Phish report.</p><p>Here are four cybersecurity threats organizations should focus on during employee awareness training programs:</p><p><strong>TOP FOUR (4) SECURITY THREAT TOPICS FOR AWARENESS TRAINING</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Threats</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n</style><ol><li><strong>Phishing:</strong> At the enterprise level, many organizations struggle because it is a complicated issue. Employees need to be trained to be skeptical about essentially everything. Only those links that have been received from known senders should be clicked upon; however, even that can be difficult to discern.</li><li><strong>Unauthorized Application Installation/Usage:</strong> Another common security threat is posed by the installation of unauthorized applications. This can be addressed by revoking administrative access for corporate devices and for most employees. A training session explaining the importance of third-party credibility and authenticity can be enough to make employees aware of the threats posed by the installation of unauthorized applications.</li><li><strong>Password Practices:</strong> Guessing passwords is the easiest way of breaking into a system and has typically been the first trick up a hacker’s sleeve. Often times default passwords for hardware and systems are not changed. Another practice that elevates risk is using the same password for different applications. This can be addressed by spreading awareness about changing passwords and using strong passwords and the part they play in keeping the hackers at bay. Modern-day application systems won’t accept user passwords that don’t meet minimal complex security requirements.</li><li><strong>Data Leakage:</strong> Data Leakage can have serious consequences. Employees often transfer files between their personal computers and their corporate workstations or allow their family members to use their corporate devices at home, and this can create some security loopholes. Address this issue through enforcement of a company-wide policy prohibiting the transfer of data from corporate devices to personal ones. Software can be installed to address Data Loss Prevention (DLP).</li></ol><p>Even the most rigorously “secure” infrastructures can get compromised. The threats listed above are some of the most common human vulnerabilities and it is of vital importance that precautionary awareness regarding them be made widespread.</p><p><strong>SIX (6) CRITICAL COMPONENTS OF A SECURITY AWARENESS PROGRAM</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Awareness Program Components</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n    ol {\r\n        margin-left: 20px;\r\n    }\r\n</style><ol><li><strong>Content:</strong> Ensure you develop a program that employs multi-media content. Users learn from a variety of means at different levels and different paces. Utilizing a platform that allows delivery of a wide variety of content, including gamification, will help spread awareness of the program faster. You can also match different content types to different roles in your organization.</li><li><strong>Executive Support &amp; Planning:</strong> Ensure you have support from the top of the organization down. Security awareness programs require strong “tone-at-top.” Ensure you have a strategy and plan documented. Involve and communicate with your sponsor and stakeholders on a regular basis.</li><li><strong>Campaign Support Materials:</strong> A successful program should not be ‘one and done’; treat it as a marketing endeavor. Vary the content and materials to keep users engaged and active.</li><li><strong>Testing:</strong> Phishing simulations prompt users to either click a link, report the phish, or do nothing. You want to give them an opportunity to report phishing attempts and help the organization increase resilience. If they do fall for the phish, it is recommended you implement remediation follow-up training. Doing nothing is not ideal as it leaves the potential threat out there and increases risk for others in the organization.</li><li><strong>Metrics &amp; Reporting:</strong> Keep your sponsor and stakeholders apprised of the progress of the security awareness training program. You need to be able to demonstrate progress. Reporting is also useful for optimizing campaigns based on past results. You want to be able to see what is working well and what can be improved upon.</li><li><strong>Surveys/Assessments:</strong> These tools can help you understand the attitudes of your organization and how well your program is resonating with your people so you can adapt. Think of it as a pulse check of subtle nuances that are different from metrics/reporting, such as opinions, frame of mind, etc.</li></ol><p><strong>SUMMARY</strong></p><p>Effective education is imperative as cybercriminals continue targeting individuals, making a people-centric security approach essential. Use security awareness training software that provides testing. The phish testing software should provide performance reports so that you can measure improvements in employee behavior as training progresses.</p>','','full_html'),('featured_article',0,49,518,'en',0,'<p>Can security awareness training change behavior and reduce cyber risk?CIOs and CISOs realize human error is perhaps the biggest weakness in any information security program. Attacks are becoming more frequent. Five industries — health care, manufacturing, financial services, transportation, and government — have been ranked as the most frequently attacked sectors in the world.</p><p>While many large enterprises have mature employee training programs, incomplete employee training remains the main reason organizations are left vulnerable to phishing attacks — this is the conclusion of Proofpoint’s fourth annual 2019 Beyond the Phish report.</p><p>Here are four cybersecurity threats organizations should focus on during employee awareness training programs:</p><p><strong>TOP FOUR (4) SECURITY THREAT TOPICS FOR AWARENESS TRAINING</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Threats</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n</style><ol><li><strong>Phishing:</strong> At the enterprise level, many organizations struggle because it is a complicated issue. Employees need to be trained to be skeptical about essentially everything. Only those links that have been received from known senders should be clicked upon; however, even that can be difficult to discern.</li><li><strong>Unauthorized Application Installation/Usage:</strong> Another common security threat is posed by the installation of unauthorized applications. This can be addressed by revoking administrative access for corporate devices and for most employees. A training session explaining the importance of third-party credibility and authenticity can be enough to make employees aware of the threats posed by the installation of unauthorized applications.</li><li><strong>Password Practices:</strong> Guessing passwords is the easiest way of breaking into a system and has typically been the first trick up a hacker’s sleeve. Often times default passwords for hardware and systems are not changed. Another practice that elevates risk is using the same password for different applications. This can be addressed by spreading awareness about changing passwords and using strong passwords and the part they play in keeping the hackers at bay. Modern-day application systems won’t accept user passwords that don’t meet minimal complex security requirements.</li><li><strong>Data Leakage:</strong> Data Leakage can have serious consequences. Employees often transfer files between their personal computers and their corporate workstations or allow their family members to use their corporate devices at home, and this can create some security loopholes. Address this issue through enforcement of a company-wide policy prohibiting the transfer of data from corporate devices to personal ones. Software can be installed to address Data Loss Prevention (DLP).</li></ol><p>Even the most rigorously “secure” infrastructures can get compromised. The threats listed above are some of the most common human vulnerabilities and it is of vital importance that precautionary awareness regarding them be made widespread.</p><p><strong>SIX (6) CRITICAL COMPONENTS OF A SECURITY AWARENESS PROGRAM</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Awareness Program Components</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n    ol {\r\n        margin-left: 20px;\r\n    }\r\n</style><ol><li><strong>Content:</strong> Ensure you develop a program that employs multi-media content. Users learn from a variety of means at different levels and different paces. Utilizing a platform that allows delivery of a wide variety of content, including gamification, will help spread awareness of the program faster. You can also match different content types to different roles in your organization.</li><li><strong>Executive Support &amp; Planning:</strong> Ensure you have support from the top of the organization down. Security awareness programs require strong “tone-at-top.” Ensure you have a strategy and plan documented. Involve and communicate with your sponsor and stakeholders on a regular basis.</li><li><strong>Campaign Support Materials:</strong> A successful program should not be ‘one and done’; treat it as a marketing endeavor. Vary the content and materials to keep users engaged and active.</li><li><strong>Testing:</strong> Phishing simulations prompt users to either click a link, report the phish, or do nothing. You want to give them an opportunity to report phishing attempts and help the organization increase resilience. If they do fall for the phish, it is recommended you implement remediation follow-up training. Doing nothing is not ideal as it leaves the potential threat out there and increases risk for others in the organization.</li><li><strong>Metrics &amp; Reporting:</strong> Keep your sponsor and stakeholders apprised of the progress of the security awareness training program. You need to be able to demonstrate progress. Reporting is also useful for optimizing campaigns based on past results. You want to be able to see what is working well and what can be improved upon.</li><li><strong>Surveys/Assessments:</strong> These tools can help you understand the attitudes of your organization and how well your program is resonating with your people so you can adapt. Think of it as a pulse check of subtle nuances that are different from metrics/reporting, such as opinions, frame of mind, etc.</li></ol><p><strong>SUMMARY</strong></p><p>Effective education is imperative as cybercriminals continue targeting individuals, making a people-centric security approach essential. Use security awareness training software that provides testing. The phish testing software should provide performance reports so that you can measure improvements in employee behavior as training progresses.</p>','','full_html'),('featured_article',0,49,534,'en',0,'<p>Can security awareness training change behavior and reduce cyber risk?CIOs and CISOs realize human error is perhaps the biggest weakness in any information security program. Attacks are becoming more frequent. Five industries — health care, manufacturing, financial services, transportation, and government — have been ranked as the most frequently attacked sectors in the world.</p><p>While many large enterprises have mature employee training programs, incomplete employee training remains the main reason organizations are left vulnerable to phishing attacks — this is the conclusion of Proofpoint’s fourth annual 2019 Beyond the Phish report.</p><p>Here are four cybersecurity threats organizations should focus on during employee awareness training programs:</p><p><strong>TOP FOUR (4) SECURITY THREAT TOPICS FOR AWARENESS TRAINING</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Threats</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n</style><ol><li><strong>Phishing:</strong> At the enterprise level, many organizations struggle because it is a complicated issue. Employees need to be trained to be skeptical about essentially everything. Only those links that have been received from known senders should be clicked upon; however, even that can be difficult to discern.</li><li><strong>Unauthorized Application Installation/Usage:</strong> Another common security threat is posed by the installation of unauthorized applications. This can be addressed by revoking administrative access for corporate devices and for most employees. A training session explaining the importance of third-party credibility and authenticity can be enough to make employees aware of the threats posed by the installation of unauthorized applications.</li><li><strong>Password Practices:</strong> Guessing passwords is the easiest way of breaking into a system and has typically been the first trick up a hacker’s sleeve. Often times default passwords for hardware and systems are not changed. Another practice that elevates risk is using the same password for different applications. This can be addressed by spreading awareness about changing passwords and using strong passwords and the part they play in keeping the hackers at bay. Modern-day application systems won’t accept user passwords that don’t meet minimal complex security requirements.</li><li><strong>Data Leakage:</strong> Data Leakage can have serious consequences. Employees often transfer files between their personal computers and their corporate workstations or allow their family members to use their corporate devices at home, and this can create some security loopholes. Address this issue through enforcement of a company-wide policy prohibiting the transfer of data from corporate devices to personal ones. Software can be installed to address Data Loss Prevention (DLP).</li></ol><p>Even the most rigorously “secure” infrastructures can get compromised. The threats listed above are some of the most common human vulnerabilities and it is of vital importance that precautionary awareness regarding them be made widespread.</p><p><strong>SIX (6) CRITICAL COMPONENTS OF A SECURITY AWARENESS PROGRAM</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Awareness Program Components</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n    ol {\r\n        margin-left: 20px;\r\n    }\r\n</style><ol><li><strong>Content:</strong> Ensure you develop a program that employs multi-media content. Users learn from a variety of means at different levels and different paces. Utilizing a platform that allows delivery of a wide variety of content, including gamification, will help spread awareness of the program faster. You can also match different content types to different roles in your organization.</li><li><strong>Executive Support &amp; Planning:</strong> Ensure you have support from the top of the organization down. Security awareness programs require strong “tone-at-top.” Ensure you have a strategy and plan documented. Involve and communicate with your sponsor and stakeholders on a regular basis.</li><li><strong>Campaign Support Materials:</strong> A successful program should not be ‘one and done’; treat it as a marketing endeavor. Vary the content and materials to keep users engaged and active.</li><li><strong>Testing:</strong> Phishing simulations prompt users to either click a link, report the phish, or do nothing. You want to give them an opportunity to report phishing attempts and help the organization increase resilience. If they do fall for the phish, it is recommended you implement remediation follow-up training. Doing nothing is not ideal as it leaves the potential threat out there and increases risk for others in the organization.</li><li><strong>Metrics &amp; Reporting:</strong> Keep your sponsor and stakeholders apprised of the progress of the security awareness training program. You need to be able to demonstrate progress. Reporting is also useful for optimizing campaigns based on past results. You want to be able to see what is working well and what can be improved upon.</li><li><strong>Surveys/Assessments:</strong> These tools can help you understand the attitudes of your organization and how well your program is resonating with your people so you can adapt. Think of it as a pulse check of subtle nuances that are different from metrics/reporting, such as opinions, frame of mind, etc.</li></ol><p><strong>SUMMARY</strong></p><p>Effective education is imperative as cybercriminals continue targeting individuals, making a people-centric security approach essential. Use security awareness training software that provides testing. The phish testing software should provide performance reports so that you can measure improvements in employee behavior as training progresses.</p>','','full_html'),('featured_article',0,49,609,'en',0,'<p>Can security awareness training change behavior and reduce cyber risk?CIOs and CISOs realize human error is perhaps the biggest weakness in any information security program. Attacks are becoming more frequent. Five industries — health care, manufacturing, financial services, transportation, and government — have been ranked as the most frequently attacked sectors in the world.</p><p>While many large enterprises have mature employee training programs, incomplete employee training remains the main reason organizations are left vulnerable to phishing attacks — this is the conclusion of Proofpoint’s fourth annual 2019 Beyond the Phish report.</p><p>Here are four cybersecurity threats organizations should focus on during employee awareness training programs:</p><p><strong>TOP FOUR (4) SECURITY THREAT TOPICS FOR AWARENESS TRAINING</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Threats</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n</style><ol><li><strong>Phishing:</strong> At the enterprise level, many organizations struggle because it is a complicated issue. Employees need to be trained to be skeptical about essentially everything. Only those links that have been received from known senders should be clicked upon; however, even that can be difficult to discern.</li><li><strong>Unauthorized Application Installation/Usage:</strong> Another common security threat is posed by the installation of unauthorized applications. This can be addressed by revoking administrative access for corporate devices and for most employees. A training session explaining the importance of third-party credibility and authenticity can be enough to make employees aware of the threats posed by the installation of unauthorized applications.</li><li><strong>Password Practices:</strong> Guessing passwords is the easiest way of breaking into a system and has typically been the first trick up a hacker’s sleeve. Often times default passwords for hardware and systems are not changed. Another practice that elevates risk is using the same password for different applications. This can be addressed by spreading awareness about changing passwords and using strong passwords and the part they play in keeping the hackers at bay. Modern-day application systems won’t accept user passwords that don’t meet minimal complex security requirements.</li><li><strong>Data Leakage:</strong> Data Leakage can have serious consequences. Employees often transfer files between their personal computers and their corporate workstations or allow their family members to use their corporate devices at home, and this can create some security loopholes. Address this issue through enforcement of a company-wide policy prohibiting the transfer of data from corporate devices to personal ones. Software can be installed to address Data Loss Prevention (DLP).</li></ol><p>Even the most rigorously “secure” infrastructures can get compromised. The threats listed above are some of the most common human vulnerabilities and it is of vital importance that precautionary awareness regarding them be made widespread.</p><p><strong>SIX (6) CRITICAL COMPONENTS OF A SECURITY AWARENESS PROGRAM</strong></p><meta charset=\"UTF-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"><title>Security Awareness Program Components</title><style>\r\n    body {\r\n        font-family: Arial, Helvetica, sans-serif;\r\n        font-size: 16px;\r\n        line-height: 1.6;\r\n        color: #000;\r\n        margin: 20px;\r\n    }\r\n    strong {\r\n        display: block;\r\n        margin-bottom: 5px;\r\n    }\r\n    ol {\r\n        margin-left: 20px;\r\n    }\r\n</style><ol><li><strong>Content:</strong> Ensure you develop a program that employs multi-media content. Users learn from a variety of means at different levels and different paces. Utilizing a platform that allows delivery of a wide variety of content, including gamification, will help spread awareness of the program faster. You can also match different content types to different roles in your organization.</li><li><strong>Executive Support &amp; Planning:</strong> Ensure you have support from the top of the organization down. Security awareness programs require strong “tone-at-top.” Ensure you have a strategy and plan documented. Involve and communicate with your sponsor and stakeholders on a regular basis.</li><li><strong>Campaign Support Materials:</strong> A successful program should not be ‘one and done’; treat it as a marketing endeavor. Vary the content and materials to keep users engaged and active.</li><li><strong>Testing:</strong> Phishing simulations prompt users to either click a link, report the phish, or do nothing. You want to give them an opportunity to report phishing attempts and help the organization increase resilience. If they do fall for the phish, it is recommended you implement remediation follow-up training. Doing nothing is not ideal as it leaves the potential threat out there and increases risk for others in the organization.</li><li><strong>Metrics &amp; Reporting:</strong> Keep your sponsor and stakeholders apprised of the progress of the security awareness training program. You need to be able to demonstrate progress. Reporting is also useful for optimizing campaigns based on past results. You want to be able to see what is working well and what can be improved upon.</li><li><strong>Surveys/Assessments:</strong> These tools can help you understand the attitudes of your organization and how well your program is resonating with your people so you can adapt. Think of it as a pulse check of subtle nuances that are different from metrics/reporting, such as opinions, frame of mind, etc.</li></ol><p><strong>SUMMARY</strong></p><p>Effective education is imperative as cybercriminals continue targeting individuals, making a people-centric security approach essential. Use security awareness training software that provides testing. The phish testing software should provide performance reports so that you can measure improvements in employee behavior as training progresses.</p>','','full_html'),('featured_article',0,50,97,'en',0,'<p>Organizations – public and private – have felt the impact of the COVID-19 outbreak on our supply chains as suppliers have diminished workforces and capacity. While cybersecurity threats may appear less of a priority, hackers and cyber attackers are leveraging the headlines to swiftly escalate their attacks across most industries, including healthcare, banking, retail, and entertainment.</p><p><em>“CYFIRMA’s threat visibility and intelligence research revealed a massive increase of over 600% of cyberthreat indicators related to the Coronavirus pandemic from February to early March.”</em></p><p>Many businesses today tend to have a higher dependency on outsourced products, services, and tools to maintain ongoing operations. These services and tools can include hybrid cloud environments, hosted websites, external applications, mobile apps, and cloud storage services. This results in a higher risk exposure to critical services and potentially your sensitive data.</p><p>During this critical time, it’s important to engage and have an honest dialogue with your suppliers on business continuity and cybersecurity risk.</p><ol><li><strong>Establish a Strong Communication Channel:</strong> Establish a strong communication channel with your suppliers. It is essential for a successful partnership. Ensure you have established a clear and transparent process with a single point of contact. Begin with setting expectations and defining the related processes for refining and enforcing them. From a security standpoint, set those expectations with a clear understanding of what your vendor will do and how their activities and responsibilities can create potential security issues for your organization, in turn letting them know the potential issues.</li><li><strong>Cybersecurity Awareness:</strong> Your third-party suppliers, especially smaller organizations, may not be aware of the increased cyber threats. Be proactive through regular meetings and creating an established channel to share vetted information they can use to avoid phishing and other forms of cyber-attacks. Create a dashboard of reporting metrics to monitor your critical supply chain partners.</li><li><strong>Business Continuity:</strong> Some third-party suppliers to your organization’s operations may be determined critical. If they should be adversely affected, you may risk a loss to certain areas of your business operations. Engage your third-party suppliers and ask what they are doing to ensure their operations continue in the face of adverse events. Like cybersecurity awareness, partner with them to share vetted information for best practices in ensuring they have resources to cope with these types of challenges.</li><li><strong>Risk and Controls:</strong> Moving operations to alternative locations and external providers carries increased risks. It is important to understand your regulatory and compliance landscape, inventory and understand the critical services and sensitive information your third-party supplier handles. Beyond conducting risk assessments with your suppliers, partner with them to monitor and assess cybersecurity risks, especially when there is a change in the relationship, product, or service. In many cases, the regulatory and compliance liability remains with your organization.</li><li><strong>Centralized Assessment:</strong> Centralizing your assessment of supplier risk and resilience during periods of disruption and heightened risk represents a major operational advance for many. Third-party data breaches may force your organization to respond to incidents that are outside of your control or originate from an indirect source. Regardless of obligation, your organization may suffer significant reputational damage as a result of the incident.</li></ol><p><strong>FOUR (4) THINGS TO DO NOW TO ADDRESS THIRD PARTY RISK</strong></p><ol><li><strong>Communication:</strong> Establish clear and transparent processes, set expectations.</li><li><strong>Cybersecurity Awareness:</strong> Partner with suppliers to understand the risks.</li><li><strong>Business Continuity:</strong> Understand the impact to your business if your supplier is interrupted.</li><li><strong>Risk and Controls:</strong> Understand the regulatory and compliance landscape, monitor compliance.</li></ol><p>&nbsp;</p>','','full_html'),('featured_article',0,50,130,'en',0,'<p>Organizations – public and private – have felt the impact of the COVID-19 outbreak on our supply chains as suppliers have diminished workforces and capacity. While cybersecurity threats may appear less of a priority, hackers and cyber attackers are leveraging the headlines to swiftly escalate their attacks across most industries, including healthcare, banking, retail, and entertainment.</p><p><em>“CYFIRMA’s threat visibility and intelligence research revealed a massive increase of over 600% of cyberthreat indicators related to the Coronavirus pandemic from February to early March.”</em></p><p>Many businesses today tend to have a higher dependency on outsourced products, services, and tools to maintain ongoing operations. These services and tools can include hybrid cloud environments, hosted websites, external applications, mobile apps, and cloud storage services. This results in a higher risk exposure to critical services and potentially your sensitive data.</p><p>During this critical time, it’s important to engage and have an honest dialogue with your suppliers on business continuity and cybersecurity risk.</p><ol><li><strong>Establish a Strong Communication Channel:</strong> Establish a strong communication channel with your suppliers. It is essential for a successful partnership. Ensure you have established a clear and transparent process with a single point of contact. Begin with setting expectations and defining the related processes for refining and enforcing them. From a security standpoint, set those expectations with a clear understanding of what your vendor will do and how their activities and responsibilities can create potential security issues for your organization, in turn letting them know the potential issues.</li><li><strong>Cybersecurity Awareness:</strong> Your third-party suppliers, especially smaller organizations, may not be aware of the increased cyber threats. Be proactive through regular meetings and creating an established channel to share vetted information they can use to avoid phishing and other forms of cyber-attacks. Create a dashboard of reporting metrics to monitor your critical supply chain partners.</li><li><strong>Business Continuity:</strong> Some third-party suppliers to your organization’s operations may be determined critical. If they should be adversely affected, you may risk a loss to certain areas of your business operations. Engage your third-party suppliers and ask what they are doing to ensure their operations continue in the face of adverse events. Like cybersecurity awareness, partner with them to share vetted information for best practices in ensuring they have resources to cope with these types of challenges.</li><li><strong>Risk and Controls:</strong> Moving operations to alternative locations and external providers carries increased risks. It is important to understand your regulatory and compliance landscape, inventory and understand the critical services and sensitive information your third-party supplier handles. Beyond conducting risk assessments with your suppliers, partner with them to monitor and assess cybersecurity risks, especially when there is a change in the relationship, product, or service. In many cases, the regulatory and compliance liability remains with your organization.</li><li><strong>Centralized Assessment:</strong> Centralizing your assessment of supplier risk and resilience during periods of disruption and heightened risk represents a major operational advance for many. Third-party data breaches may force your organization to respond to incidents that are outside of your control or originate from an indirect source. Regardless of obligation, your organization may suffer significant reputational damage as a result of the incident.</li></ol><p><strong>FOUR (4) THINGS TO DO NOW TO ADDRESS THIRD PARTY RISK</strong></p><ol><li><strong>Communication:</strong> Establish clear and transparent processes, set expectations.</li><li><strong>Cybersecurity Awareness:</strong> Partner with suppliers to understand the risks.</li><li><strong>Business Continuity:</strong> Understand the impact to your business if your supplier is interrupted.</li><li><strong>Risk and Controls:</strong> Understand the regulatory and compliance landscape, monitor compliance.</li></ol><p>&nbsp;</p>','','full_html'),('featured_article',0,50,270,'en',0,'<p>Organizations – public and private – have felt the impact of the COVID-19 outbreak on our supply chains as suppliers have diminished workforces and capacity. While cybersecurity threats may appear less of a priority, hackers and cyber attackers are leveraging the headlines to swiftly escalate their attacks across most industries, including healthcare, banking, retail, and entertainment.</p><p><em>“CYFIRMA’s threat visibility and intelligence research revealed a massive increase of over 600% of cyberthreat indicators related to the Coronavirus pandemic from February to early March.”</em></p><p>Many businesses today tend to have a higher dependency on outsourced products, services, and tools to maintain ongoing operations. These services and tools can include hybrid cloud environments, hosted websites, external applications, mobile apps, and cloud storage services. This results in a higher risk exposure to critical services and potentially your sensitive data.</p><p>During this critical time, it’s important to engage and have an honest dialogue with your suppliers on business continuity and cybersecurity risk.</p><ol><li><strong>Establish a Strong Communication Channel:</strong> Establish a strong communication channel with your suppliers. It is essential for a successful partnership. Ensure you have established a clear and transparent process with a single point of contact. Begin with setting expectations and defining the related processes for refining and enforcing them. From a security standpoint, set those expectations with a clear understanding of what your vendor will do and how their activities and responsibilities can create potential security issues for your organization, in turn letting them know the potential issues.</li><li><strong>Cybersecurity Awareness:</strong> Your third-party suppliers, especially smaller organizations, may not be aware of the increased cyber threats. Be proactive through regular meetings and creating an established channel to share vetted information they can use to avoid phishing and other forms of cyber-attacks. Create a dashboard of reporting metrics to monitor your critical supply chain partners.</li><li><strong>Business Continuity:</strong> Some third-party suppliers to your organization’s operations may be determined critical. If they should be adversely affected, you may risk a loss to certain areas of your business operations. Engage your third-party suppliers and ask what they are doing to ensure their operations continue in the face of adverse events. Like cybersecurity awareness, partner with them to share vetted information for best practices in ensuring they have resources to cope with these types of challenges.</li><li><strong>Risk and Controls:</strong> Moving operations to alternative locations and external providers carries increased risks. It is important to understand your regulatory and compliance landscape, inventory and understand the critical services and sensitive information your third-party supplier handles. Beyond conducting risk assessments with your suppliers, partner with them to monitor and assess cybersecurity risks, especially when there is a change in the relationship, product, or service. In many cases, the regulatory and compliance liability remains with your organization.</li><li><strong>Centralized Assessment:</strong> Centralizing your assessment of supplier risk and resilience during periods of disruption and heightened risk represents a major operational advance for many. Third-party data breaches may force your organization to respond to incidents that are outside of your control or originate from an indirect source. Regardless of obligation, your organization may suffer significant reputational damage as a result of the incident.</li></ol><p><strong>FOUR (4) THINGS TO DO NOW TO ADDRESS THIRD PARTY RISK</strong></p><ol><li><strong>Communication:</strong> Establish clear and transparent processes, set expectations.</li><li><strong>Cybersecurity Awareness:</strong> Partner with suppliers to understand the risks.</li><li><strong>Business Continuity:</strong> Understand the impact to your business if your supplier is interrupted.</li><li><strong>Risk and Controls:</strong> Understand the regulatory and compliance landscape, monitor compliance.</li></ol><p>&nbsp;</p>','','full_html'),('featured_article',0,50,452,'en',0,'<p>Organizations – public and private – have felt the impact of the COVID-19 outbreak on our supply chains as suppliers have diminished workforces and capacity. While cybersecurity threats may appear less of a priority, hackers and cyber attackers are leveraging the headlines to swiftly escalate their attacks across most industries, including healthcare, banking, retail, and entertainment.</p><p><em>“CYFIRMA’s threat visibility and intelligence research revealed a massive increase of over 600% of cyberthreat indicators related to the Coronavirus pandemic from February to early March.”</em></p><p>Many businesses today tend to have a higher dependency on outsourced products, services, and tools to maintain ongoing operations. These services and tools can include hybrid cloud environments, hosted websites, external applications, mobile apps, and cloud storage services. This results in a higher risk exposure to critical services and potentially your sensitive data.</p><p>During this critical time, it’s important to engage and have an honest dialogue with your suppliers on business continuity and cybersecurity risk.</p><ol><li><strong>Establish a Strong Communication Channel:</strong> Establish a strong communication channel with your suppliers. It is essential for a successful partnership. Ensure you have established a clear and transparent process with a single point of contact. Begin with setting expectations and defining the related processes for refining and enforcing them. From a security standpoint, set those expectations with a clear understanding of what your vendor will do and how their activities and responsibilities can create potential security issues for your organization, in turn letting them know the potential issues.</li><li><strong>Cybersecurity Awareness:</strong> Your third-party suppliers, especially smaller organizations, may not be aware of the increased cyber threats. Be proactive through regular meetings and creating an established channel to share vetted information they can use to avoid phishing and other forms of cyber-attacks. Create a dashboard of reporting metrics to monitor your critical supply chain partners.</li><li><strong>Business Continuity:</strong> Some third-party suppliers to your organization’s operations may be determined critical. If they should be adversely affected, you may risk a loss to certain areas of your business operations. Engage your third-party suppliers and ask what they are doing to ensure their operations continue in the face of adverse events. Like cybersecurity awareness, partner with them to share vetted information for best practices in ensuring they have resources to cope with these types of challenges.</li><li><strong>Risk and Controls:</strong> Moving operations to alternative locations and external providers carries increased risks. It is important to understand your regulatory and compliance landscape, inventory and understand the critical services and sensitive information your third-party supplier handles. Beyond conducting risk assessments with your suppliers, partner with them to monitor and assess cybersecurity risks, especially when there is a change in the relationship, product, or service. In many cases, the regulatory and compliance liability remains with your organization.</li><li><strong>Centralized Assessment:</strong> Centralizing your assessment of supplier risk and resilience during periods of disruption and heightened risk represents a major operational advance for many. Third-party data breaches may force your organization to respond to incidents that are outside of your control or originate from an indirect source. Regardless of obligation, your organization may suffer significant reputational damage as a result of the incident.</li></ol><p><strong>FOUR (4) THINGS TO DO NOW TO ADDRESS THIRD PARTY RISK</strong></p><ol><li><strong>Communication:</strong> Establish clear and transparent processes, set expectations.</li><li><strong>Cybersecurity Awareness:</strong> Partner with suppliers to understand the risks.</li><li><strong>Business Continuity:</strong> Understand the impact to your business if your supplier is interrupted.</li><li><strong>Risk and Controls:</strong> Understand the regulatory and compliance landscape, monitor compliance.</li></ol><p>&nbsp;</p>','','full_html'),('featured_article',0,50,519,'en',0,'<p>Organizations – public and private – have felt the impact of the COVID-19 outbreak on our supply chains as suppliers have diminished workforces and capacity. While cybersecurity threats may appear less of a priority, hackers and cyber attackers are leveraging the headlines to swiftly escalate their attacks across most industries, including healthcare, banking, retail, and entertainment.</p><p><em>“CYFIRMA’s threat visibility and intelligence research revealed a massive increase of over 600% of cyberthreat indicators related to the Coronavirus pandemic from February to early March.”</em></p><p>Many businesses today tend to have a higher dependency on outsourced products, services, and tools to maintain ongoing operations. These services and tools can include hybrid cloud environments, hosted websites, external applications, mobile apps, and cloud storage services. This results in a higher risk exposure to critical services and potentially your sensitive data.</p><p>During this critical time, it’s important to engage and have an honest dialogue with your suppliers on business continuity and cybersecurity risk.</p><ol><li><strong>Establish a Strong Communication Channel:</strong> Establish a strong communication channel with your suppliers. It is essential for a successful partnership. Ensure you have established a clear and transparent process with a single point of contact. Begin with setting expectations and defining the related processes for refining and enforcing them. From a security standpoint, set those expectations with a clear understanding of what your vendor will do and how their activities and responsibilities can create potential security issues for your organization, in turn letting them know the potential issues.</li><li><strong>Cybersecurity Awareness:</strong> Your third-party suppliers, especially smaller organizations, may not be aware of the increased cyber threats. Be proactive through regular meetings and creating an established channel to share vetted information they can use to avoid phishing and other forms of cyber-attacks. Create a dashboard of reporting metrics to monitor your critical supply chain partners.</li><li><strong>Business Continuity:</strong> Some third-party suppliers to your organization’s operations may be determined critical. If they should be adversely affected, you may risk a loss to certain areas of your business operations. Engage your third-party suppliers and ask what they are doing to ensure their operations continue in the face of adverse events. Like cybersecurity awareness, partner with them to share vetted information for best practices in ensuring they have resources to cope with these types of challenges.</li><li><strong>Risk and Controls:</strong> Moving operations to alternative locations and external providers carries increased risks. It is important to understand your regulatory and compliance landscape, inventory and understand the critical services and sensitive information your third-party supplier handles. Beyond conducting risk assessments with your suppliers, partner with them to monitor and assess cybersecurity risks, especially when there is a change in the relationship, product, or service. In many cases, the regulatory and compliance liability remains with your organization.</li><li><strong>Centralized Assessment:</strong> Centralizing your assessment of supplier risk and resilience during periods of disruption and heightened risk represents a major operational advance for many. Third-party data breaches may force your organization to respond to incidents that are outside of your control or originate from an indirect source. Regardless of obligation, your organization may suffer significant reputational damage as a result of the incident.</li></ol><p><strong>FOUR (4) THINGS TO DO NOW TO ADDRESS THIRD PARTY RISK</strong></p><ol><li><strong>Communication:</strong> Establish clear and transparent processes, set expectations.</li><li><strong>Cybersecurity Awareness:</strong> Partner with suppliers to understand the risks.</li><li><strong>Business Continuity:</strong> Understand the impact to your business if your supplier is interrupted.</li><li><strong>Risk and Controls:</strong> Understand the regulatory and compliance landscape, monitor compliance.</li></ol><p>&nbsp;</p>','','full_html'),('featured_article',0,50,535,'en',0,'<p>Organizations – public and private – have felt the impact of the COVID-19 outbreak on our supply chains as suppliers have diminished workforces and capacity. While cybersecurity threats may appear less of a priority, hackers and cyber attackers are leveraging the headlines to swiftly escalate their attacks across most industries, including healthcare, banking, retail, and entertainment.</p><p><em>“CYFIRMA’s threat visibility and intelligence research revealed a massive increase of over 600% of cyberthreat indicators related to the Coronavirus pandemic from February to early March.”</em></p><p>Many businesses today tend to have a higher dependency on outsourced products, services, and tools to maintain ongoing operations. These services and tools can include hybrid cloud environments, hosted websites, external applications, mobile apps, and cloud storage services. This results in a higher risk exposure to critical services and potentially your sensitive data.</p><p>During this critical time, it’s important to engage and have an honest dialogue with your suppliers on business continuity and cybersecurity risk.</p><ol><li><strong>Establish a Strong Communication Channel:</strong> Establish a strong communication channel with your suppliers. It is essential for a successful partnership. Ensure you have established a clear and transparent process with a single point of contact. Begin with setting expectations and defining the related processes for refining and enforcing them. From a security standpoint, set those expectations with a clear understanding of what your vendor will do and how their activities and responsibilities can create potential security issues for your organization, in turn letting them know the potential issues.</li><li><strong>Cybersecurity Awareness:</strong> Your third-party suppliers, especially smaller organizations, may not be aware of the increased cyber threats. Be proactive through regular meetings and creating an established channel to share vetted information they can use to avoid phishing and other forms of cyber-attacks. Create a dashboard of reporting metrics to monitor your critical supply chain partners.</li><li><strong>Business Continuity:</strong> Some third-party suppliers to your organization’s operations may be determined critical. If they should be adversely affected, you may risk a loss to certain areas of your business operations. Engage your third-party suppliers and ask what they are doing to ensure their operations continue in the face of adverse events. Like cybersecurity awareness, partner with them to share vetted information for best practices in ensuring they have resources to cope with these types of challenges.</li><li><strong>Risk and Controls:</strong> Moving operations to alternative locations and external providers carries increased risks. It is important to understand your regulatory and compliance landscape, inventory and understand the critical services and sensitive information your third-party supplier handles. Beyond conducting risk assessments with your suppliers, partner with them to monitor and assess cybersecurity risks, especially when there is a change in the relationship, product, or service. In many cases, the regulatory and compliance liability remains with your organization.</li><li><strong>Centralized Assessment:</strong> Centralizing your assessment of supplier risk and resilience during periods of disruption and heightened risk represents a major operational advance for many. Third-party data breaches may force your organization to respond to incidents that are outside of your control or originate from an indirect source. Regardless of obligation, your organization may suffer significant reputational damage as a result of the incident.</li></ol><p><strong>FOUR (4) THINGS TO DO NOW TO ADDRESS THIRD PARTY RISK</strong></p><ol><li><strong>Communication:</strong> Establish clear and transparent processes, set expectations.</li><li><strong>Cybersecurity Awareness:</strong> Partner with suppliers to understand the risks.</li><li><strong>Business Continuity:</strong> Understand the impact to your business if your supplier is interrupted.</li><li><strong>Risk and Controls:</strong> Understand the regulatory and compliance landscape, monitor compliance.</li></ol><p>&nbsp;</p>','','full_html'),('featured_article',0,50,610,'en',0,'<p>Organizations – public and private – have felt the impact of the COVID-19 outbreak on our supply chains as suppliers have diminished workforces and capacity. While cybersecurity threats may appear less of a priority, hackers and cyber attackers are leveraging the headlines to swiftly escalate their attacks across most industries, including healthcare, banking, retail, and entertainment.</p><p><em>“CYFIRMA’s threat visibility and intelligence research revealed a massive increase of over 600% of cyberthreat indicators related to the Coronavirus pandemic from February to early March.”</em></p><p>Many businesses today tend to have a higher dependency on outsourced products, services, and tools to maintain ongoing operations. These services and tools can include hybrid cloud environments, hosted websites, external applications, mobile apps, and cloud storage services. This results in a higher risk exposure to critical services and potentially your sensitive data.</p><p>During this critical time, it’s important to engage and have an honest dialogue with your suppliers on business continuity and cybersecurity risk.</p><ol><li><strong>Establish a Strong Communication Channel:</strong> Establish a strong communication channel with your suppliers. It is essential for a successful partnership. Ensure you have established a clear and transparent process with a single point of contact. Begin with setting expectations and defining the related processes for refining and enforcing them. From a security standpoint, set those expectations with a clear understanding of what your vendor will do and how their activities and responsibilities can create potential security issues for your organization, in turn letting them know the potential issues.</li><li><strong>Cybersecurity Awareness:</strong> Your third-party suppliers, especially smaller organizations, may not be aware of the increased cyber threats. Be proactive through regular meetings and creating an established channel to share vetted information they can use to avoid phishing and other forms of cyber-attacks. Create a dashboard of reporting metrics to monitor your critical supply chain partners.</li><li><strong>Business Continuity:</strong> Some third-party suppliers to your organization’s operations may be determined critical. If they should be adversely affected, you may risk a loss to certain areas of your business operations. Engage your third-party suppliers and ask what they are doing to ensure their operations continue in the face of adverse events. Like cybersecurity awareness, partner with them to share vetted information for best practices in ensuring they have resources to cope with these types of challenges.</li><li><strong>Risk and Controls:</strong> Moving operations to alternative locations and external providers carries increased risks. It is important to understand your regulatory and compliance landscape, inventory and understand the critical services and sensitive information your third-party supplier handles. Beyond conducting risk assessments with your suppliers, partner with them to monitor and assess cybersecurity risks, especially when there is a change in the relationship, product, or service. In many cases, the regulatory and compliance liability remains with your organization.</li><li><strong>Centralized Assessment:</strong> Centralizing your assessment of supplier risk and resilience during periods of disruption and heightened risk represents a major operational advance for many. Third-party data breaches may force your organization to respond to incidents that are outside of your control or originate from an indirect source. Regardless of obligation, your organization may suffer significant reputational damage as a result of the incident.</li></ol><p><strong>FOUR (4) THINGS TO DO NOW TO ADDRESS THIRD PARTY RISK</strong></p><ol><li><strong>Communication:</strong> Establish clear and transparent processes, set expectations.</li><li><strong>Cybersecurity Awareness:</strong> Partner with suppliers to understand the risks.</li><li><strong>Business Continuity:</strong> Understand the impact to your business if your supplier is interrupted.</li><li><strong>Risk and Controls:</strong> Understand the regulatory and compliance landscape, monitor compliance.</li></ol><p>&nbsp;</p>','','full_html'),('featured_article',0,51,98,'en',0,'<!-- Headline with stylized first letter --><div class=\"headline\"><span class=\"first-letter\">N</span>ever trust, always verify.</div><!-- Body Paragraph --><p>The traditional idea of the well-defined network perimeter is outdated in a world where organizations are increasingly moving applications and data to cloud services, embracing a highly mobile remote workforce, and dealing with a significantly growing number of devices attaching to the corporate network. Many digital transformation initiatives are forcing businesses to rethink their enterprise security architecture. As organizations go through these changes, security concerns are paramount with cyber attacks on the rise.</p><!-- Quoted statistic --><p class=\"quote\"><em>“In March, there was a 30,000% increase in COVID-19 related attacks and malware.”(Source: Zscaler)</em></p><!-- Follow-up content --><p>&nbsp;</p><p>Today’s new reality in an increasingly perimeter-less world begs the question: how does an organization protect itself? The Zero Trust framework presumes bad actors are already in the network. The approach deploys multiple strategies such as (a) identity and access management, (b) multifactor authentication, (c) encryption, (d) risk scoring, and (e)role-based access controls to enforce strict governance policies. These policies provide user access to specific applications and resources aligned with their roles and responsibilities. This limits not only <em>north-south</em> movement in the network, but also <em>east-west</em> lateral movement across the network.</p><p><strong>Four (4) Things You Need To Know</strong></p><p>The methodologies that enable Zero Trust accomplish five (5) core tasks:</p><ol><li><p><strong>Micro-segmentation.</strong> Micro-segmentation is a method of creating secure zones in data centers, cloud deployments, and even applications, allowing organizations to isolate workloads from one another and secure them individually. It is aimed at making network security more granular. Using micro-segmentation, files in a network can be placed in separate secure zones. A user or program with access to one of those zones will not be able to access any of the other zones without separate authorization, tying security to individual workloads.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust_0.png\" data-entity-uuid=\"64a65fd7-9658-44dd-8310-feaeb8c99e1c\" data-entity-type=\"file\" width=\"300\" height=\"249\"></p></li><li><strong>Least Privilege Access</strong>. Zero-Trust is based on granting least privilege access. However, the access is only granted on verification of multiple contextual environmental variables at each request, such as: (a) who is requesting access, (b) what is the context of the request, and (c) what is the risk of access to the environment. Zero-trust no longer provides trust to anyone or anything connecting to valued systems. It treats equally traffic originating from within the network as well traffic arriving externally – users, devices, even API’s are all treated the same. This enables minimization of the attack surface, it improves audit, and reduces the risk and costs of security breaches.</li><li><strong>Multi-factor Authentication (MFA)</strong>. MFA is a core value of zero trust security. It means simply requiring more than one piece of evidence to authenticate a user, entering a password alone is not enough to gain access. The use of two-factor authorization—the addition of a code sent to another device — is now widely used and accepted by consumers and stakeholders. Other forms of authentication — biometrics — are emerging to bolster identity verification.</li><li><p><strong>Application Behavior and Visibility</strong>. A benefit of micro-segmentation is the enablement of application security that builds in policies defining allowed behavior and protection for each individual build. As example, ideation through development occurs in an environment isolated from the rest of the network so that any breach of an application will be contained and prevented from spreading into the rest of the network. Visibility into application behavior on devices that access applications also needs to be taken into account so anomalous activity can be detected and action can be taken more quickly.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust-2png.png\" data-entity-uuid=\"556637b5-cc8f-496e-b4c5-0ed550ac54b1\" data-entity-type=\"file\" width=\"918\" height=\"522\"></p></li></ol><p><strong>Designing and Building</strong></p><p>Use a five (5) step model for implementing and maintaining a Zero Trust network:</p><ol><li><strong>Define the protect surface.</strong> In the Zero Trust defining the scope of the protect surface in manageable portions is critically important. The protect surface should include the critical</li><li><strong>Map the transactions flows.</strong> How traffic moves across a network should define how it is protected. Therefore it is essential to gain contextual insight on the interdependencies of your data, application, assets and services – the DAAS. Documenting the interaction between specific resources allows the ability to properly enforce controls. It also provides valuable context to ensure the controls help protect the data.</li><li><strong>Architect a Zero Trust network.</strong> Zero Trust networks are built from the ground up, architected and customized around specific requirements for the protect surfaces. However it is imperative that the protect surface and transaction flow maps be completed first.</li><li><strong>Create the Zero Trust policy.</strong> Once the Zero Trust network has been architected, the next step is to define and whitelist which resources should have access to the others. The questions of “who, what, when, where, why and how” work well here.</li><li><strong>Monitor and maintain the network.</strong> Lastly, the final step is to ensure logging is enabled, all logs are reviewed (both internal and external) and data is analyzed in a timely manner. Visibility should be all way through Layer 7 of the OSI model.</li></ol><p>Upon completing the first protect surface for your organization, this model can be iteratively and easily expanded to other data sets, applications, assets and services from legacy or modern systems. It can be implemented in a cost-effective and non-destructive way.</p><p><strong>Zero Trust and the Future of Work</strong></p><p>Security objectives and best practices to keep mind while designing and building a Zero Trust environment that serves today’s needs and into the future should include these considerations:</p><ul class=\"BlogPreventList\"><li><strong>Think Anytime, Anywhere. </strong>Secure applications, data, users, devices and network traffic through persistent protection, all with the same degree of effectiveness regardless of location. The user experience should be frictionless and easy to deploy.</li><li><strong>Build for Resilience. </strong>As organizations mature their continuity of operations and crisis management plans, a Zero Trust architecture allows organizations to adapt and move quickly to changing environments and realities, in addition to providing strong cybersecurity best practices.</li></ul><p>Zero Trust means different things to different organizations. It is an approach, a framework. Zero Trust is not a specific tool or set of tools. It can be adapted to many use cases, particularly for remote work, teleworking, and BYOD (Bring Your Own Device) typically a practice still not considered secure, and it can be implement one defined protect surface at a time.</p><p>As senior leaders we are asked to be more strategic and drive revenue through technologies and integration as the business goals and needs expand. At the same time, cybersecurity is an incredibly complex problem to solve from both the end user side and in the data center as attack surfaces become even broader. It’s no longer a question of “if” a breach will happen but “when.” Zero Trust provides a scalable adaptive solution.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('featured_article',0,51,131,'en',0,'<!-- Headline with stylized first letter --><div class=\"headline\"><span class=\"first-letter\">N</span>ever trust, always verify.</div><!-- Body Paragraph --><p>The traditional idea of the well-defined network perimeter is outdated in a world where organizations are increasingly moving applications and data to cloud services, embracing a highly mobile remote workforce, and dealing with a significantly growing number of devices attaching to the corporate network. Many digital transformation initiatives are forcing businesses to rethink their enterprise security architecture. As organizations go through these changes, security concerns are paramount with cyber attacks on the rise.</p><!-- Quoted statistic --><p class=\"quote\"><em>“In March, there was a 30,000% increase in COVID-19 related attacks and malware.”(Source: Zscaler)</em></p><!-- Follow-up content --><p>&nbsp;</p><p>Today’s new reality in an increasingly perimeter-less world begs the question: how does an organization protect itself? The Zero Trust framework presumes bad actors are already in the network. The approach deploys multiple strategies such as (a) identity and access management, (b) multifactor authentication, (c) encryption, (d) risk scoring, and (e)role-based access controls to enforce strict governance policies. These policies provide user access to specific applications and resources aligned with their roles and responsibilities. This limits not only <em>north-south</em> movement in the network, but also <em>east-west</em> lateral movement across the network.</p><p><strong>Four (4) Things You Need To Know</strong></p><p>The methodologies that enable Zero Trust accomplish five (5) core tasks:</p><ol><li><p><strong>Micro-segmentation.</strong> Micro-segmentation is a method of creating secure zones in data centers, cloud deployments, and even applications, allowing organizations to isolate workloads from one another and secure them individually. It is aimed at making network security more granular. Using micro-segmentation, files in a network can be placed in separate secure zones. A user or program with access to one of those zones will not be able to access any of the other zones without separate authorization, tying security to individual workloads.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust_0.png\" data-entity-uuid=\"64a65fd7-9658-44dd-8310-feaeb8c99e1c\" data-entity-type=\"file\" width=\"300\" height=\"249\"></p></li><li><strong>Least Privilege Access</strong>. Zero-Trust is based on granting least privilege access. However, the access is only granted on verification of multiple contextual environmental variables at each request, such as: (a) who is requesting access, (b) what is the context of the request, and (c) what is the risk of access to the environment. Zero-trust no longer provides trust to anyone or anything connecting to valued systems. It treats equally traffic originating from within the network as well traffic arriving externally – users, devices, even API’s are all treated the same. This enables minimization of the attack surface, it improves audit, and reduces the risk and costs of security breaches.</li><li><strong>Multi-factor Authentication (MFA)</strong>. MFA is a core value of zero trust security. It means simply requiring more than one piece of evidence to authenticate a user, entering a password alone is not enough to gain access. The use of two-factor authorization—the addition of a code sent to another device — is now widely used and accepted by consumers and stakeholders. Other forms of authentication — biometrics — are emerging to bolster identity verification.</li><li><p><strong>Application Behavior and Visibility</strong>. A benefit of micro-segmentation is the enablement of application security that builds in policies defining allowed behavior and protection for each individual build. As example, ideation through development occurs in an environment isolated from the rest of the network so that any breach of an application will be contained and prevented from spreading into the rest of the network. Visibility into application behavior on devices that access applications also needs to be taken into account so anomalous activity can be detected and action can be taken more quickly.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust-2png.png\" data-entity-uuid=\"556637b5-cc8f-496e-b4c5-0ed550ac54b1\" data-entity-type=\"file\" width=\"918\" height=\"522\"></p></li></ol><p><strong>Designing and Building</strong></p><p>Use a five (5) step model for implementing and maintaining a Zero Trust network:</p><ol><li><strong>Define the protect surface.</strong> In the Zero Trust defining the scope of the protect surface in manageable portions is critically important. The protect surface should include the critical</li><li><strong>Map the transactions flows.</strong> How traffic moves across a network should define how it is protected. Therefore it is essential to gain contextual insight on the interdependencies of your data, application, assets and services – the DAAS. Documenting the interaction between specific resources allows the ability to properly enforce controls. It also provides valuable context to ensure the controls help protect the data.</li><li><strong>Architect a Zero Trust network.</strong> Zero Trust networks are built from the ground up, architected and customized around specific requirements for the protect surfaces. However it is imperative that the protect surface and transaction flow maps be completed first.</li><li><strong>Create the Zero Trust policy.</strong> Once the Zero Trust network has been architected, the next step is to define and whitelist which resources should have access to the others. The questions of “who, what, when, where, why and how” work well here.</li><li><strong>Monitor and maintain the network.</strong> Lastly, the final step is to ensure logging is enabled, all logs are reviewed (both internal and external) and data is analyzed in a timely manner. Visibility should be all way through Layer 7 of the OSI model.</li></ol><p>Upon completing the first protect surface for your organization, this model can be iteratively and easily expanded to other data sets, applications, assets and services from legacy or modern systems. It can be implemented in a cost-effective and non-destructive way.</p><p><strong>Zero Trust and the Future of Work</strong></p><p>Security objectives and best practices to keep mind while designing and building a Zero Trust environment that serves today’s needs and into the future should include these considerations:</p><ul class=\"BlogPreventList\"><li><strong>Think Anytime, Anywhere. </strong>Secure applications, data, users, devices and network traffic through persistent protection, all with the same degree of effectiveness regardless of location. The user experience should be frictionless and easy to deploy.</li><li><strong>Build for Resilience. </strong>As organizations mature their continuity of operations and crisis management plans, a Zero Trust architecture allows organizations to adapt and move quickly to changing environments and realities, in addition to providing strong cybersecurity best practices.</li></ul><p>Zero Trust means different things to different organizations. It is an approach, a framework. Zero Trust is not a specific tool or set of tools. It can be adapted to many use cases, particularly for remote work, teleworking, and BYOD (Bring Your Own Device) typically a practice still not considered secure, and it can be implement one defined protect surface at a time.</p><p>As senior leaders we are asked to be more strategic and drive revenue through technologies and integration as the business goals and needs expand. At the same time, cybersecurity is an incredibly complex problem to solve from both the end user side and in the data center as attack surfaces become even broader. It’s no longer a question of “if” a breach will happen but “when.” Zero Trust provides a scalable adaptive solution.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('featured_article',0,51,269,'en',0,'<!-- Headline with stylized first letter --><div class=\"headline\"><span class=\"first-letter\">N</span>ever trust, always verify.</div><!-- Body Paragraph --><p>The traditional idea of the well-defined network perimeter is outdated in a world where organizations are increasingly moving applications and data to cloud services, embracing a highly mobile remote workforce, and dealing with a significantly growing number of devices attaching to the corporate network. Many digital transformation initiatives are forcing businesses to rethink their enterprise security architecture. As organizations go through these changes, security concerns are paramount with cyber attacks on the rise.</p><!-- Quoted statistic --><p class=\"quote\"><em>“In March, there was a 30,000% increase in COVID-19 related attacks and malware.”(Source: Zscaler)</em></p><!-- Follow-up content --><p>&nbsp;</p><p>Today’s new reality in an increasingly perimeter-less world begs the question: how does an organization protect itself? The Zero Trust framework presumes bad actors are already in the network. The approach deploys multiple strategies such as (a) identity and access management, (b) multifactor authentication, (c) encryption, (d) risk scoring, and (e)role-based access controls to enforce strict governance policies. These policies provide user access to specific applications and resources aligned with their roles and responsibilities. This limits not only <em>north-south</em> movement in the network, but also <em>east-west</em> lateral movement across the network.</p><p><strong>Four (4) Things You Need To Know</strong></p><p>The methodologies that enable Zero Trust accomplish five (5) core tasks:</p><ol><li><p><strong>Micro-segmentation.</strong> Micro-segmentation is a method of creating secure zones in data centers, cloud deployments, and even applications, allowing organizations to isolate workloads from one another and secure them individually. It is aimed at making network security more granular. Using micro-segmentation, files in a network can be placed in separate secure zones. A user or program with access to one of those zones will not be able to access any of the other zones without separate authorization, tying security to individual workloads.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust_0.png\" data-entity-uuid=\"64a65fd7-9658-44dd-8310-feaeb8c99e1c\" data-entity-type=\"file\" width=\"300\" height=\"249\"></p></li><li><strong>Least Privilege Access</strong>. Zero-Trust is based on granting least privilege access. However, the access is only granted on verification of multiple contextual environmental variables at each request, such as: (a) who is requesting access, (b) what is the context of the request, and (c) what is the risk of access to the environment. Zero-trust no longer provides trust to anyone or anything connecting to valued systems. It treats equally traffic originating from within the network as well traffic arriving externally – users, devices, even API’s are all treated the same. This enables minimization of the attack surface, it improves audit, and reduces the risk and costs of security breaches.</li><li><strong>Multi-factor Authentication (MFA)</strong>. MFA is a core value of zero trust security. It means simply requiring more than one piece of evidence to authenticate a user, entering a password alone is not enough to gain access. The use of two-factor authorization—the addition of a code sent to another device — is now widely used and accepted by consumers and stakeholders. Other forms of authentication — biometrics — are emerging to bolster identity verification.</li><li><p><strong>Application Behavior and Visibility</strong>. A benefit of micro-segmentation is the enablement of application security that builds in policies defining allowed behavior and protection for each individual build. As example, ideation through development occurs in an environment isolated from the rest of the network so that any breach of an application will be contained and prevented from spreading into the rest of the network. Visibility into application behavior on devices that access applications also needs to be taken into account so anomalous activity can be detected and action can be taken more quickly.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust-2png.png\" data-entity-uuid=\"556637b5-cc8f-496e-b4c5-0ed550ac54b1\" data-entity-type=\"file\" width=\"918\" height=\"522\"></p></li></ol><p><strong>Designing and Building</strong></p><p>Use a five (5) step model for implementing and maintaining a Zero Trust network:</p><ol><li><strong>Define the protect surface.</strong> In the Zero Trust defining the scope of the protect surface in manageable portions is critically important. The protect surface should include the critical</li><li><strong>Map the transactions flows.</strong> How traffic moves across a network should define how it is protected. Therefore it is essential to gain contextual insight on the interdependencies of your data, application, assets and services – the DAAS. Documenting the interaction between specific resources allows the ability to properly enforce controls. It also provides valuable context to ensure the controls help protect the data.</li><li><strong>Architect a Zero Trust network.</strong> Zero Trust networks are built from the ground up, architected and customized around specific requirements for the protect surfaces. However it is imperative that the protect surface and transaction flow maps be completed first.</li><li><strong>Create the Zero Trust policy.</strong> Once the Zero Trust network has been architected, the next step is to define and whitelist which resources should have access to the others. The questions of “who, what, when, where, why and how” work well here.</li><li><strong>Monitor and maintain the network.</strong> Lastly, the final step is to ensure logging is enabled, all logs are reviewed (both internal and external) and data is analyzed in a timely manner. Visibility should be all way through Layer 7 of the OSI model.</li></ol><p>Upon completing the first protect surface for your organization, this model can be iteratively and easily expanded to other data sets, applications, assets and services from legacy or modern systems. It can be implemented in a cost-effective and non-destructive way.</p><p><strong>Zero Trust and the Future of Work</strong></p><p>Security objectives and best practices to keep mind while designing and building a Zero Trust environment that serves today’s needs and into the future should include these considerations:</p><ul class=\"BlogPreventList\"><li><strong>Think Anytime, Anywhere. </strong>Secure applications, data, users, devices and network traffic through persistent protection, all with the same degree of effectiveness regardless of location. The user experience should be frictionless and easy to deploy.</li><li><strong>Build for Resilience. </strong>As organizations mature their continuity of operations and crisis management plans, a Zero Trust architecture allows organizations to adapt and move quickly to changing environments and realities, in addition to providing strong cybersecurity best practices.</li></ul><p>Zero Trust means different things to different organizations. It is an approach, a framework. Zero Trust is not a specific tool or set of tools. It can be adapted to many use cases, particularly for remote work, teleworking, and BYOD (Bring Your Own Device) typically a practice still not considered secure, and it can be implement one defined protect surface at a time.</p><p>As senior leaders we are asked to be more strategic and drive revenue through technologies and integration as the business goals and needs expand. At the same time, cybersecurity is an incredibly complex problem to solve from both the end user side and in the data center as attack surfaces become even broader. It’s no longer a question of “if” a breach will happen but “when.” Zero Trust provides a scalable adaptive solution.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('featured_article',0,51,387,'en',0,'<!-- Headline with stylized first letter --><div class=\"headline\"><span class=\"first-letter\">N</span>ever trust, always verify.</div><!-- Body Paragraph --><p>The traditional idea of the well-defined network perimeter is outdated in a world where organizations are increasingly moving applications and data to cloud services, embracing a highly mobile remote workforce, and dealing with a significantly growing number of devices attaching to the corporate network. Many digital transformation initiatives are forcing businesses to rethink their enterprise security architecture. As organizations go through these changes, security concerns are paramount with cyber attacks on the rise.</p><!-- Quoted statistic --><p class=\"quote\"><em>“In March, there was a 30,000% increase in COVID-19 related attacks and malware.”(Source: Zscaler)</em></p><!-- Follow-up content --><p>&nbsp;</p><p>Today’s new reality in an increasingly perimeter-less world begs the question: how does an organization protect itself? The Zero Trust framework presumes bad actors are already in the network. The approach deploys multiple strategies such as (a) identity and access management, (b) multifactor authentication, (c) encryption, (d) risk scoring, and (e)role-based access controls to enforce strict governance policies. These policies provide user access to specific applications and resources aligned with their roles and responsibilities. This limits not only <em>north-south</em> movement in the network, but also <em>east-west</em> lateral movement across the network.</p><p><strong>Four (4) Things You Need To Know</strong></p><p>The methodologies that enable Zero Trust accomplish five (5) core tasks:</p><ol><li><p><strong>Micro-segmentation.</strong> Micro-segmentation is a method of creating secure zones in data centers, cloud deployments, and even applications, allowing organizations to isolate workloads from one another and secure them individually. It is aimed at making network security more granular. Using micro-segmentation, files in a network can be placed in separate secure zones. A user or program with access to one of those zones will not be able to access any of the other zones without separate authorization, tying security to individual workloads.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust_0.png\" data-entity-uuid=\"64a65fd7-9658-44dd-8310-feaeb8c99e1c\" data-entity-type=\"file\" width=\"300\" height=\"249\"></p></li><li><strong>Least Privilege Access</strong>. Zero-Trust is based on granting least privilege access. However, the access is only granted on verification of multiple contextual environmental variables at each request, such as: (a) who is requesting access, (b) what is the context of the request, and (c) what is the risk of access to the environment. Zero-trust no longer provides trust to anyone or anything connecting to valued systems. It treats equally traffic originating from within the network as well traffic arriving externally – users, devices, even API’s are all treated the same. This enables minimization of the attack surface, it improves audit, and reduces the risk and costs of security breaches.</li><li><strong>Multi-factor Authentication (MFA)</strong>. MFA is a core value of zero trust security. It means simply requiring more than one piece of evidence to authenticate a user, entering a password alone is not enough to gain access. The use of two-factor authorization—the addition of a code sent to another device — is now widely used and accepted by consumers and stakeholders. Other forms of authentication — biometrics — are emerging to bolster identity verification.</li><li><p><strong>Application Behavior and Visibility</strong>. A benefit of micro-segmentation is the enablement of application security that builds in policies defining allowed behavior and protection for each individual build. As example, ideation through development occurs in an environment isolated from the rest of the network so that any breach of an application will be contained and prevented from spreading into the rest of the network. Visibility into application behavior on devices that access applications also needs to be taken into account so anomalous activity can be detected and action can be taken more quickly.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust-2png.png\" data-entity-uuid=\"556637b5-cc8f-496e-b4c5-0ed550ac54b1\" data-entity-type=\"file\" width=\"918\" height=\"522\"></p></li></ol><p><strong>Designing and Building</strong></p><p>Use a five (5) step model for implementing and maintaining a Zero Trust network:</p><ol><li><strong>Define the protect surface.</strong> In the Zero Trust defining the scope of the protect surface in manageable portions is critically important. The protect surface should include the critical</li><li><strong>Map the transactions flows.</strong> How traffic moves across a network should define how it is protected. Therefore it is essential to gain contextual insight on the interdependencies of your data, application, assets and services – the DAAS. Documenting the interaction between specific resources allows the ability to properly enforce controls. It also provides valuable context to ensure the controls help protect the data.</li><li><strong>Architect a Zero Trust network.</strong> Zero Trust networks are built from the ground up, architected and customized around specific requirements for the protect surfaces. However it is imperative that the protect surface and transaction flow maps be completed first.</li><li><strong>Create the Zero Trust policy.</strong> Once the Zero Trust network has been architected, the next step is to define and whitelist which resources should have access to the others. The questions of “who, what, when, where, why and how” work well here.</li><li><strong>Monitor and maintain the network.</strong> Lastly, the final step is to ensure logging is enabled, all logs are reviewed (both internal and external) and data is analyzed in a timely manner. Visibility should be all way through Layer 7 of the OSI model.</li></ol><p>Upon completing the first protect surface for your organization, this model can be iteratively and easily expanded to other data sets, applications, assets and services from legacy or modern systems. It can be implemented in a cost-effective and non-destructive way.</p><p><strong>Zero Trust and the Future of Work</strong></p><p>Security objectives and best practices to keep mind while designing and building a Zero Trust environment that serves today’s needs and into the future should include these considerations:</p><ul class=\"BlogPreventList\"><li><strong>Think Anytime, Anywhere. </strong>Secure applications, data, users, devices and network traffic through persistent protection, all with the same degree of effectiveness regardless of location. The user experience should be frictionless and easy to deploy.</li><li><strong>Build for Resilience. </strong>As organizations mature their continuity of operations and crisis management plans, a Zero Trust architecture allows organizations to adapt and move quickly to changing environments and realities, in addition to providing strong cybersecurity best practices.</li></ul><p>Zero Trust means different things to different organizations. It is an approach, a framework. Zero Trust is not a specific tool or set of tools. It can be adapted to many use cases, particularly for remote work, teleworking, and BYOD (Bring Your Own Device) typically a practice still not considered secure, and it can be implement one defined protect surface at a time.</p><p>As senior leaders we are asked to be more strategic and drive revenue through technologies and integration as the business goals and needs expand. At the same time, cybersecurity is an incredibly complex problem to solve from both the end user side and in the data center as attack surfaces become even broader. It’s no longer a question of “if” a breach will happen but “when.” Zero Trust provides a scalable adaptive solution.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),('featured_article',0,51,453,'en',0,'<!-- Headline with stylized first letter --><div class=\"headline\"><span class=\"first-letter\">N</span>ever trust, always verify.</div><!-- Body Paragraph --><p>The traditional idea of the well-defined network perimeter is outdated in a world where organizations are increasingly moving applications and data to cloud services, embracing a highly mobile remote workforce, and dealing with a significantly growing number of devices attaching to the corporate network. Many digital transformation initiatives are forcing businesses to rethink their enterprise security architecture. As organizations go through these changes, security concerns are paramount with cyber attacks on the rise.</p><!-- Quoted statistic --><p class=\"quote\"><em>“In March, there was a 30,000% increase in COVID-19 related attacks and malware.”(Source: Zscaler)</em></p><!-- Follow-up content --><p>&nbsp;</p><p>Today’s new reality in an increasingly perimeter-less world begs the question: how does an organization protect itself? The Zero Trust framework presumes bad actors are already in the network. The approach deploys multiple strategies such as (a) identity and access management, (b) multifactor authentication, (c) encryption, (d) risk scoring, and (e)role-based access controls to enforce strict governance policies. These policies provide user access to specific applications and resources aligned with their roles and responsibilities. This limits not only <em>north-south</em> movement in the network, but also <em>east-west</em> lateral movement across the network.</p><p><strong>Four (4) Things You Need To Know</strong></p><p>The methodologies that enable Zero Trust accomplish five (5) core tasks:</p><ol><li><p><strong>Micro-segmentation.</strong> Micro-segmentation is a method of creating secure zones in data centers, cloud deployments, and even applications, allowing organizations to isolate workloads from one another and secure them individually. It is aimed at making network security more granular. Using micro-segmentation, files in a network can be placed in separate secure zones. A user or program with access to one of those zones will not be able to access any of the other zones without separate authorization, tying security to individual workloads.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust_0.png\" data-entity-uuid=\"64a65fd7-9658-44dd-8310-feaeb8c99e1c\" data-entity-type=\"file\" width=\"300\" height=\"249\"></p></li><li><strong>Least Privilege Access</strong>. Zero-Trust is based on granting least privilege access. However, the access is only granted on verification of multiple contextual environmental variables at each request, such as: (a) who is requesting access, (b) what is the context of the request, and (c) what is the risk of access to the environment. Zero-trust no longer provides trust to anyone or anything connecting to valued systems. It treats equally traffic originating from within the network as well traffic arriving externally – users, devices, even API’s are all treated the same. This enables minimization of the attack surface, it improves audit, and reduces the risk and costs of security breaches.</li><li><strong>Multi-factor Authentication (MFA)</strong>. MFA is a core value of zero trust security. It means simply requiring more than one piece of evidence to authenticate a user, entering a password alone is not enough to gain access. The use of two-factor authorization—the addition of a code sent to another device — is now widely used and accepted by consumers and stakeholders. Other forms of authentication — biometrics — are emerging to bolster identity verification.</li><li><p><strong>Application Behavior and Visibility</strong>. A benefit of micro-segmentation is the enablement of application security that builds in policies defining allowed behavior and protection for each individual build. As example, ideation through development occurs in an environment isolated from the rest of the network so that any breach of an application will be contained and prevented from spreading into the rest of the network. Visibility into application behavior on devices that access applications also needs to be taken into account so anomalous activity can be detected and action can be taken more quickly.</p><p><img src=\"/sites/default/files/inline-images/Zero-Trust-2png.png\" data-entity-uuid=\"556637b5-cc8f-496e-b4c5-0ed550ac54b1\" data-entity-type=\"file\" width=\"918\" height=\"522\"></p></li></ol><p><strong>Designing and Building</strong></p><p>Use a five (5) step model for implementing and maintaining a Zero Trust network:</p><ol><li><strong>Define the protect surface.</strong> In the Zero Trust defining the scope of the protect surface in manageable portions is critically important. The protect surface should include the critical</li><li><strong>Map the transactions flows.</strong> How traffic moves across a network should define how it is protected. Therefore it is essential to gain contextual insight on the interdependencies of your data, application, assets and services – the DAAS. Documenting the interaction between specific resources allows the ability to properly enforce controls. It also provides valuable context to ensure the controls help protect the data.</li><li><strong>Architect a Zero Trust network.</strong> Zero Trust networks are built from the ground up, architected and customized around specific requirements for the protect surfaces. However it is imperative that the protect surface and transaction flow maps be completed first.</li><li><strong>Create the Zero Trust policy.</strong> Once the Zero Trust network has been architected, the next step is to define and whitelist which resources should have access to the others. The questions of “who, what, when, where, why and how” work well here.</li><li><strong>Monitor and maintain the network.</strong> Lastly, the final step is to ensure logging is enabled, all logs are reviewed (both internal and external) and data is analyzed in a timely manner. Visibility should be all way through Layer 7 of the OSI model.</li></ol><p>Upon completing the first protect surface for your organization, this model can be iteratively and easily expanded to other data sets, applications, assets and services from legacy or modern systems. It can be implemented in a cost-effective and non-destructive way.</p><p><strong>Zero Trust and the Future of Work</strong></p><p>Security objectives and best practices to keep mind while designing and building a Zero Trust environment that serves today’s needs and into the future should include these considerations:</p><ul class=\"BlogPreventList\"><li><strong>Think Anytime, Anywhere. </strong>Secure applications, data, users, devices and network traffic through persistent protection, all with the same degree of effectiveness regardless of location. The user experience should be frictionless and easy to deploy.</li><li><strong>Build for Resilience. </strong>As organizations mature their continuity of operations and crisis management plans, a Zero Trust architecture allows organizations to adapt and move quickly to changing environments and realities, in addition to providing strong cybersecurity best practices.</li></ul><p>Zero Trust means different things to different organizations. It is an approach, a framework. Zero Trust is not a specific tool or set of tools. It can be adapted to many use cases, particularly for remote work, teleworking, and BYOD (Bring Your Own Device) typically a practice still not considered secure, and it can be implement one defined protect surface at a time.</p><p>As senior leaders we are asked to be more strategic and drive revenue through technologies and integration as the business goals and needs expand. At the same time, cybersecurity is an incredibly complex problem to solve from both the end user side and in the data center as attack surfaces become even broader. It’s no longer a question of “if” a breach will happen but “when.” Zero Trust provides a scalable adaptive solution.</p><p>Author:</p><p>Laszlo S. Gonc, CISSP, First Senior Fellow, DivIHN Cybersecurity Center of Excellence</p>','','full_html'),