From the report, “This report compares the budgets of global security decision makers at firms spending up to 10%, 11% to 20%, and 21% to 30% of their IT budget on information security. Security leaders can use these budget ranges as a starting point to evaluate their own programs, then compare their product, service, staffing, and other allocations with those of similar firms.” Read on to find out more.

Synopsys and SAE International partnered to commission this independent survey of the current cybersecurity practices in the automotive industry to fill a gap that has existed far too long—the lack of data needed to understand the automotive industry’s cybersecurity posture and its capability to address software security risks inherent in connected, software-enabled vehicles. Ponemon Institute was selected to conduct the study. Researchers surveyed 593 professionals responsible for contributing to or assessing the security of automotive components.

“The people, not just tools, are the key to enterprise cyber security. It’s time to devise an actionable plan to make sure every member of your organization is cyber-ready. In this guide, we will present a basic framework for optimizing the types, frequency and costs of security simulation training for the entire enterprise.”

This report offers the following highlights - Case study of a Fortune 50 organization breached via social media, Deep dive into each layer of the new attack chain, A detailed look at impersonation accounts and hijacked accounts, a new staple in the attack lifecycle, Tactics, techniques, and procedures (TTPs) used by the modern attacker on social media, Recommendations and best practices for updating your security posture.

The survey upon which this report is based was fielded by the Financial Services Information Sharing and Analysis Center, in conjunction with Deloitte’s Cyber Risk Services practice. Fifty-one companies participated in the pilot launch of the survey, with representation from entities both larch and small, as well as those in between. Respondents came from all financial sectors, albeit skewed more heavily toward the US banking community.

CISOs Investigate: User Behavior Analytics (UBA) includes interviews with 11 security leaders who have deployed or are looking to deploy third-party solutions. This report replaces the ad hoc, often informal and time-consuming processes of personally gathering peer insight. Spanning verticals, the CISO contributors share real-world use cases and provide guidance.

From the report, “DOur objective was to (1) summarize unclassified and classified reports issued and testimonies made from the DoD oversight community and the Government Accountability Office (GAO) between July 1, 2017, and June 30, 2018, that included DoD cybersecurity issues; (2) identify cybersecurity risk areas for DoD management to address based on the five functions of the National Institute of Standards and Technology (NIST), “Framework for Improving Critical Infrastructure Cybersecurity,” April 16, 2018 (Cybersecurity Framework); and (3) identify the open DoD cybersecurity recommendations. This summary report also addresses the Federal Information Security Modernization Act of 2014 (FISMA) requirement to provide an annual independent evaluation of the agency’s information security program by using the identified findings to support the responses made in our assessment.”

Creating)Value)and)Managing)Risk)in)the)World)of)PSD2,“a"white"paper"developed"by"Aite"Group” in close cooperation with ThreatMetrix, provides insight into the key provisions of the revised & Payment(Service(Directive (PSD2) legislation and its impact on market practices.

In this report, you’ll learn how many DevOps servers may be exposed based on a study done by the IntSights research team, how cyber criminals typically access open DevOps servers, and what you can do to protect yourself and your data from a DevOps cyber attack.

From the report, “The Puppet 2018 State of DevOps Report took a new tack this year, seeking prescriptive guidance for teams to follow. We designed our survey to learn how organizations progress through their DevOps journeys, and after analyzing the data, we found that the successful ones go through specific stages. Our research also revealed a set of core practices — we call them “foundational practices” — that are critical to success throughout the entire DevOps evolution. In this paper, we’ll take you through an in-depth description of these foundational practices, and offer you our advice for how to begin instituting them in the way that makes most sense for your organization, based on our findings.”

From the report, “This year we designed our DevOps survey to reveal what successful organizations actually do as they progress on their DevOps journeys. We discovered that they experience five distinct stages of DevOps evolution, which we have shared in full detail in our 2018 State of DevOps Report. This CIO guide digests our research into a report that’s just for you. We want to help you quickly understand what successful organizations do at each stage of DevOps evolution; which practices must be established at each stage (we call these the defining practices); and how you can best support your team throughout its DevOps journey to assure continuing progress and success.”

From the report, “Without trust, the future of our digital economy and its nearly limitless potential is in peril. Piecemeal efforts to address cybersecurity issues—including the Internet’s inherent flaws, vulnerabilities from the Internet of Things (IoT), identity and data veracity and increasing digital fragmentation—have fallen short. Through their decisions above ground on industry-wide governance and their business architecture and technology infrastructure below ground, however, CEOs can have the influence necessary to collaboratively address these overarching issues.”

From the report, “It’s that time of year again. We’ve conducted and compiled the results of our State of DevOps survey to illustrate how your job, salary, and industry compare to other professionals in your field. This is our fifth annual DevOps salary report, and each year we learn more about how DevOps practices impact organizations globally and how the people who produce those results and how they’re compensated. This report examines a myriad of factors impacting salary levels, which include region, role, demographics, industry, and size of organization. We had over 3,000 technology professionals from around the world respond to our survey. As before, we broke down the data by geographic region — but this time with an international focus on the UK, Asia, and Europe.”

This report offers insight into the DevSecOps Community.

This survey, representing the voice of 2,076 IT professionals, demonstrates that DevSecOps practices continue to mature rapidly and that, once automated, security is difficult to ignore.

A survey of financial services executives responsible for digital security measures at their firms (see Methodology) sheds light on the industry’s objectives for digital channels, perceptions about the scale of the threat posed by fraud and a range of vectors for attack, and confidence in existing defenses.

From the report, “The fight to protect your company’s data isn’t for the faint of heart. As an embattled IT warrior, with more systems, apps, and users to support than ever before, keeping everything up and running is a battle in itself. When it comes to preventing the worst-case scenario from happening, you need all the help you can get, despite your super-hero status. That’s why we’ve developed this incident response guide. We’ve collected and curated decades of infosec war stories and intelligence — from across the galaxy — so that you’re better armed in the fight against cybercrime. You’ll have an insider’s perspective on how to build an incident response plan and team, and what tools and training you can use to arm those team members.”

In the summer of 2018, AT&T Business and Spiceworks performed a research study with 250 IT leaders. The research revealed that 99% of organizations have a security risk management strategy. However, there is a sharp performance divide between the organizations confident in their risk management strategies (42% called the “Confident Investors”) and organizations who are not (57% called the “Unconfident Investors”).

Cybersecurity has emerged as a key risk factor to be weighed during the due diligence process of any merger and acquisition. How should organizations on both sides approach the process? Steve Chabinsky of CrowdStrike shares his thoughts on strategy for assessing cyber risk during the M&A due diligence process.

This study’s principal conclusion clearly mirrors today’s cybersecurity landscape: every organization is vulnerable to a cyber attack. This report uses measures of awareness and readiness to assess three degrees of vulnerability, each of which indicate differing needs to take action.

This report details a new Cylance survey of iTnews readers and provides insight into the state of endpoint security.