Our local CyberSecurity Agency has come out with a directive:
•      Review internal structure to ensure C-Suite has oversight of cybersecurity risks as part of enterprise risk management
•      Ensure security team has direct line to C-Suite

EE expert has provided the CISO handbook below but I'll need more "Terms of Ref" that will cover a
CISO's  "Scope of Work (& what is out of scope)", "Authority", need for "impartiality/independence":
currently all risks-related roles come under CFO but CFO's kpi is on cost control and one
link says this is inappropriate as CISO may need to spend on compliances, manpower,
tools, services etc

Extract from EE:
"In most cases, the agency’s internal policies delegate management of the agency’s information to the Chief Information Officer (CIO). Under FISMA, the CIO may then delegate  tasks related to information security to the senior agency information security officer (often referred to as CISO).
There are more information on reporting requirements specific to agency responsibility and how these key stakeholders are involved.
https://www.cio.gov/assets/files/CISO_Handbook.pdf


https://www.securityroundtable.org/whats-the-best-reporting-structure-for-the-ciso/
Above link gives various suggestions but will need something authoritative like
ISO standard or to further support what CyberSecurity Agency has provided above.


Deloitte & one ErnstY papers statistics show most sites still adopt the model of
CISO going under CIO:
…

What's the latest easy and simple defense against comment spam? mybigdata.co.uk has a contact form and BOTS submit spam as a message. The solution will be something else than captcha as other businesses also don't use it.

I am trying the to find an application were if my laptop or desktop was compromise meaning by cyber-attack, and it’s a new an unknown bug I would like to setup a data file or word document, which if the attack click on the file or document it will trigger an email to my email account.

we need to set up within 8 weeks a small SIEM for 30 servers  n hopefully its something low-cost, fast to set up n easy to use/manage.

Solarwinds, ManageEngine, Websense or ?

There's request to set up a dedicated Internet Wifi hotspot
that will be used to connect up IoT : one such item in mind
is power meter.

We are not a financial/banking/healthcare organization but
still need to adhere to government guideline on cybersecurity.

I can only think of the following if this is to be granted:

a) restrict it to IoTs only ie corporate laptops/PCs/user devices
    can't connect to it : so what kind of mechanisms out there
    can stop corporate PCs/laptops and user BYODs from
    connecting?

b) we'll make the SSID unscannable

c) as many IoTs have been known to be compromised, such
    as Mirai, botnets attacks, how shall we mitigate these as
    the IoT is exposed to risks from Internet.
 
d) any other mitigations?

Hi Experts,

We recently had one of our employees click on a link in a e-mail that took him to a fake site where he entered his credentials and his e-mail account was compromised.
Management hired a cyber security company who did scans on the systems, his e-mails and also other things on the web.
We have managed symantec Endpoint protection, intrustion, malware which is up to date and active.  
We also didn't have anything on the back end set up (per management) to protect our e-mail against spam, malware, all e-mails were to come through.
The cyber people are telling management that Symantec only gets 20% of intrusions, viruses and malware.  (I don't believe that, I have a e-mail box flooded with all the intrustions Symantec is getting and not one virus in 4 years which it caught).
Management from their advice is most likely going to force me to uninstall Symantec from all of our workstations and servers and deploy Carbon Black?

Can anyone tell me if this sounds as insane as it I think it is?  Anyone familiar with Carbon Black?  

Please help, I don't trust this at all and would love to be proven right or wrong.  I think this cyber company might be banking on management fears from my co-workers mistake.

Thank you

Hi Experts
I am planing to study the information security, I am working in the IT field long time ago
But I do not know any courses i can start by.  some of them told me that CEH is perfect and other told me  to CEH it is useless
please advice me

I've set our web.config file on a WP site we've built to have secure cookies but all tests we've run online suggest cookies are still not secure. The httpOnly setting also hasn't taken effect.

The code snippet from the web.config is below and always the PHPSESSID cookie doesn't have these settings

<system.web>
    <httpCookies httpOnlyCookies="true" requireSSL="true"  />
</system.web>

Select all Open in new window

What else do we need to look at to ensure this setting takes effect?

Thanks
Iain

https://www.garrison.com/browsing.php

I'm looking for similar competing products (preferably with local Singapore support presence) to provide
secure browsing of Internet and emails (these are the top 2 vectors of malwares): looking to adopt this
'logical segregation' instead of 'physical segregation':
I suppose this is more useable/implementable than doing physical segregation.

We have corporate Wifi too, so need to take this into consideration if it's relevant.

Q1:
Can suggest a few products & local resellers (if available)?

Q2:
if there's comparison of features (how each product fare against competitors), do provide as well.
It helps to justify the purchase.