Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Jack Danahy
Unlocking the Power of Cybersecurity Solution Integration - GRC Viewpoint
Recent publicly disclosed cybersecurity attacks have not been simple events. They capitalize on the disjoint nature of cybersecurity policies, protections, and technologies. An error by a trusting user is compounded by an overly permissive network, that access is used to find and exploit a vulnerable service running nearby, and results or control are passed smoothly to an external address. The result? Hundreds of machines or the personal details of thousands of individuals are compromised.
Addressing Security Gaps and Risks Post-M&A in Healthcare
4 minutes ago bankinfosecurity NuHarbor Security's Jack Danahy on Mistakes to Avoid Post-Merger & Acquisition Marianne Kolbasuk McGee (HealthInfoSec) • September 8, 2023 15 Minutes In the aftermath of mergers and acquisitions among healthcare entities - and the resulting IT integration and cost-cutting moves - gaps in technology and skills and other gaps often put organizations at higher risk for attacks and other security incidents, said Jack Danahy of NuHarbor Security.
Cybersecurity Is the Healthcare Your Organization Needs
Since the early 1990s, we've watched the internet evolve from dial-up connections to high-speed, cloud-based computing. Organizations have navigated a shifting maze of technology while defending against cyberattacks. Sadly, after three decades in cybersecurity, I see organizations wrestling with the same problems in 2023 that they grappled with in 1995 when they first plugged into the internet.
Stop Wasting Money On Cybersecurity
Jack Danahy is a 3-time security company founder and now the Chief Evangelist at managed detection and response (MDR) pioneer, Alert Logic. getty This challenging and remarkable year is nearly over, and it’s time to get serious about 2021 security planning. Meaningful shifts in user access and technologies away from the on-premises infrastructure due to widespread remote working has accelerated cloud and SaaS adoption.
Effective Security Communication
Cyber attacks have been increasing for almost three decades. Meanwhile, security is an essential part of the critical path for major initiatives like cloud migration and the success of a growing remote workforce. While press and analysts have increased awareness on the part of executives, security teams still struggle to get the management support they need, and their stress and burnout rate is naturally increasing.
Build Value, Not Frustration, Into Your Security Strategy
Jack Danahy is the SVP for Strategy and Chief Evangelist at managed detection and response (MDR) pioneer, Alert Logic. Getty The challenge of securing online services and protecting private data increases in complexity daily. In the U.S., there were over 17,000 new vulnerabilities discovered in 2019, and we’re on track for over 19,000 this year. Even more troubling, data breaches are also on the rise, with nearly 1,500 data breaches leaking over 160 million records in 2019.
Defining MDR and MSS : @VMblog
By Jack Danahy, SVP and Chief Evangelist, Alert Logic Complexity has become the defining characteristic of cybersecurity today. Cyber threats have become more sophisticated and automated while security teams are being asked to protect a rapidly expanding attack surface. As the challenge of meeting these threats has become increasingly complicated, so too have the tools designed to address them.
Security Boulevard
This past Monday, Alert Logic’s Tom Gorup (VP of Security Operations) and I led an #MDRMonday Twitter chat to talk about the role of threat hunting in the delivery of managed detection and response (MDR) services. As it stands, the MDR Manifesto stresses the importance of threat intelligence, but threat hunting is not called out as a unique requirement of MDR. After a suggestion by one of the industry’s most trusted analysts, we decided to open this up to the MDR community on Twitter.
There Will Always Be Successful Attacks Which Is Why There Must Be MDR
Businesses are in a period of rapid technical evolution, and the result is an increasingly complex and dynamic environment that they are trying to protect against an equally rapidly evolving swarm of vulnerabilities and threats. Most don't have the resources or expertise necessary to feel confident in their protection. To fill this gap, vendors and customers are turning to a new type of managed security service; Managed Detection and Response (MDR).
There Will Always Be Successful Attacks Which Is Why There Must Be MDR
Businesses are in a period of rapid technical evolution, and the result is an increasingly complex and dynamic environment that they are trying to protect against an equally rapidly evolving swarm of vulnerabilities and threats. Most don’t have the resources or expertise necessary to feel confident in their protection. To fill this gap, vendors and customers are turning to a new type of managed security service; Managed Detection and Response (MDR).
Defining Required Capabilities for Managed Detection and Response
In security, clarity has always been a struggle. Buyers don't know what solutions do, and vendors don't understand what buyers really need. It's even harder because the security solution marketplace has become as complex and varied as any has ever been. For example, a simple term like “protection” can mean anything from preventing network access to enabling secure network access.
The Biggest Gap in Cybersecurity is Empathy
“Ultimately, I think empathy is the cornerstone of design,” Ilse Crawford, studioilse The security challenges of complexity, alert fatigue, knowledge gaps, resource scarcity, and staff burn-out aren’t new. When you consider them alongside the staggering investments that we’ve made in security, it doesn’t seem right.
Security Lessons from a Division 1 Football Coach
Eliminate distractions. Create Energy. Fear Nothing. Attack Everything. The presenter who spoke before me this week at the Rackspace kickoff was Coach Dan McCarney, a former Division 1 US college football coach, and he talked about the lessons he learned while leading winning teams in the challenging (and always changing) world of college football. It was a solid presentation, and there was one area that stuck with me as particularly relevant to our challenges in security.
Geopolitical Cyberstress? Doublecheck Your Basics
With thousands of customers relying on us for protection, I’m not surprised that we’ve gotten questions about the current dire predictions of nation-state cyberwarfare resulting from ongoing global political friction. People want to know what they should do differently or do more. My answer is that they should not panic, and they shouldn’t assume they need to revamp their security portfolio.
Addressing the Growing Challenges of the Cybersecurity Workforce
It doesn’t really matter where you look, there is no denying the difficulty in staffing up and retaining a qualified team of security players. Whether you read Steve Morgan’s analysis at Cybersecurity Ventures or the numbers from the team at the Center for Strategic and International Studies ( CSIS ), there is a 7 figure gap in our industry’s ability to provide the skilled security resources that organizations require. And the challenge gets tougher.
Five Insights from and About the First AWS re:Inforce
I have some headlines for those of you who didn’t have the time or hopeful optimism to attend the inaugural AWS re:Inforce conference in Boston last month. You can read the product announcements in a thousand places online, and there are no shortage of play-by-plays, videos, and contemporaneous tweets and LinkedIn updates you can browse. I’d like to tell you the top five takeaways I actually took away from what turned out to be an interesting and focused use of a couple of days in the Bay State.
Breaking the Endless Cycle of 'Perfect' Cybercrimes
A two-step strategy for creating an attack environment that is more complex, less profitable, and more likely to expose the attacker. Regardless of their methods, hackers are constantly attempting to improve upon what is essentially a perfect crime — a crime that is simple to execute, is performed with near total anonymity, and, most of all, pays off.
Breaking the Endless Cycle of "Perfect" Cybercrimes
A two-step strategy for creating an attack environment that is more complex, less profitable, and more likely to expose the attacker. Regardless of their methods, hackers are constantly attempting to improve upon what is essentially a perfect crime — a crime that is simple to execute, is performed with near total anonymity, and, most of all, pays off.
The 3 Biggest Malware Trends to Watch in 2018
As the Threat Landscape Shifts, So Too Must Protections So far this year, IT security headlines have been dominated by two words: Meltdown and Spectre. Disclosure of the two massive CPU vulnerabilities has coincided with chip makers and OS providers scramblingemo to provide updates that fix the issues without causing other problems (with mixed results so far).
Stop Wasting Resources: How to Ease Your Endpoint Management and Security Struggles
How good is your endpoint management and security strategy? How about the quality of its execution? Chances are it’s lagging behind. According to a recent Hiscox study, 7 in 10 organizations fail when it comes to cybersecurity readiness, even though most are keenly aware of the potential impact of a cyberattack. For smaller organizations, the inability to operate after an attack is often fatal, while larger enterprises can suffer severe reputational and financial damage.
Simplicity Is the Key to Progress in Endpoint Security
There has been a critical skills shortage in cybersecurity for years. In fact, Cisco estimated that there are currently 1 million unfilled cybersecurity positions around the world. Given the rapid expansion of networks, the growing threat surface, continuous attacker innovation and the recent publicity around major campaigns such as NotPetya and WannaCry, organizations of all sizes have recognized the need for more endpoint security, which is creating even more demand for limited resources.
The Art of Disclosing Your Incident Response Strategy to the Public
As major vulnerabilities gain public attention, being able to craft a public response is no longer a distant thought — it’s an essential part of any incident response program. Business is now and forever entwined with the servers, systems and devices we use on a daily basis. Our ability to patch new vulnerabilities affects not only our own security, but that of every partner and customer we interact with.
The Biennial Cyber-Threat: How to Keep Your Company Safe During the Olympics
With the 2018 Winter Olympics in full swing, these biennial Games may already be challenging the stamina and commitment of your security team almost as much as that of the athletes involved. Related: This Is Why We Need To Focus More on Cybersecurity Strategy How can the Olympics in faraway PyeongChang be a threat to you? Malicious actors know that many of your employees will be tuning in to the Games from work.
Machine Learning & Security: Making Users Part of the Equation
The Best Security Doesn’t Exclude Users, it Empowers Them If you’ve been watching, we’ve now entered the age of artificial intelligence, machine learning, and expanding automation. The capacity of modern computing to recognize patterns and make decisions based on boggling amounts of data has created new solutions and increasing customer expectations. Too many car accidents and mind-rending traffic? Self-driving cars might be the answer. Can’t get to the bank before it closes? There’s an app for that.
“Responsive” Machine Learning Could Lessen Cybersecurity Tradeoffs | Xconomy
In the wake of the Equifax breach and the global WannaCry ransomware outbreak earlier this year, tensions around cybersecurity are running high. According to a recent study conducted by the Ponemon Institute and sponsored by Barkly, seven out of 10 organizations are reporting their security risk has significantly increased during the past 12 months. Only 54 percent believe the attacks they’re facing can realistically be stopped, but they are feeling pressure to do more to keep their data safe.
The cost of IT ‘alarm fatigue’: How machine learning can help improve accuracy, reduce risk, and boost productivity
In the medical field, alarm fatigue can be a serious issue that directly impacts patient care. When roughly three-quarters of clinical alarms are false, it’s easy to see how this constant overload can desensitize nurses, physicians, and other clinicians. Many become so bogged down and frustrated with responding to every false alarm, they eventually begin to ignore them altogether.
How to Take Full Advantage of the Ransomware Wake-Up Call
Innovative Response to Ransomware Will Help Us Defend Against Still-Unseen Threats Down the Road The recent rise of ransomware, including widespread infections like the WannaCry outbreak, have had an unintentional benefit: security awareness and urgency is legitimately on the rise…for now.
Demystifying Machine Learning: How to Turn the Buzzword into Real Benefits for Endpoint Security
Machine learning has become the most popular new theme in security. Seemingly every vendor is adopting this capability in an attempt to either keep up or to make their product stand out in a crowded market. This creates confusion, because the term itself is often misunderstood, and the implications of its use are varied. Not only does “machine learning” mean different things to different people, different vendors also apply machine learning in different ways.
Stackhackr : Build Your Own Mock Malware, Then Test Your Own Security
Over the past 25 years or so, while developing a variety of security products, I’ve been asked the same question repeatedly: “Who are your competitors?” While this is a typical question that every new company is asked, it always forces me to re-examine the basic tenets of the competitive landscape with an open mind.
Security shelfware is out. Security self-sufficiency is in
Security solutions are the treadmills of the IT community. No, I don’t mean you implement them, sweat it out, and don’t really get anywhere. I mean that you buy them when you feel that change is needed, and urgent. And if you haven’t done your homework, you'll find that they aren't that easy, they make you sweat, and you don’t really have the time to realize their full benefits.
User Security is a Responsibility, Not an Excuse, Part 2
It’s no big secret the majority of security incidents companies grapple with are a result of human error. Maybe a user opens the wrong email attachment. Or maybe they visit the wrong website or plug in the wrong USB drive. People are people. They’re going to make mistakes. Cyber criminals know this and actively prey on user error as the path of least resistance inside any network they’re targeting.
Responsive machine learning is the future of protecting healthcare data
Machine learning technologies have revolutionized the healthcare industry, allowing hospitals, researchers, and pharmaceutical companies to harness big data to conquer some very serious challenges.
Health IT security's rip and replace problem
Knowing how to strategically spend your next security dollar In the aftermath of the damage and disruption caused by the WannaCry ransomware outbreak, security leaders everywhere are facing increased scrutiny and pressure. Healthcare IT leaders in particular are feeling the heat after seeing the devastating toll the attack took on hospitals across England. Some 47 NHS hospital trusts suffered significant disruption after the ransomware rendered patient data and various systems inaccessible.
Are We Learning the Right Lessons from WannaCry?
Encouraging organizations to follow the usual security best practices didn’t prevent the spread of WannaCry. Let’s acknowledge that and focus on new ideas that will.In the aftermath of the WannaCry ransomware outbreak, a familiar pattern is beginning to play itself out.
User Security is a Responsibility, Not an Excuse
Ask an IT person what the weakest link in their organization’s security is, and you’ll invariably get a witty take on the same derisive answer: “Meatware.” “Our walking, talking vulnerabilities.” “PEBKAC” (problem exists between keyboard and chair). In short, they point the finger at users. In part because, for the majority of successful breaches, the common entry point typically is a user.
Why real-time security defenses are needed to fight malware
No security solution is a silver bullet. When savvy organizations build out their security stacks, they make sure they have a variety of solutions that protect them at different stages along the malware attack cycle should any of their "upstream" defenses fail. But how exactly are healthcare organizations doing that? What stages and solutions are they prioritizing, and how are their resulting security stacks holding up against modern malware attacks?
Four dos and don’ts for leveraging big data to optimize healthcare IT security
Healthcare organizations are often at increased risk when it comes to data, network and system security compared to companies in other industries. Not only do the volume and value of data they house make them a target, their dependency on access to that data means attackers can cause widespread disruption and wield significant leverage by withholding it.
Swimming in Security Data Without Drowning
How much information do you need to manage your security? Until recently, the answer was always “more.” That is changing as the sheer volume of available data grows. Today, corporate networks and machines are significantly faster and more powerful than they were 10 years ago. Combine this advancement with threat intelligence feeds, which include logs from new applications and streams from hosted services, and you have a surge in security data.
Investing in Security : The Next Dollar In
Improving protection will always require increasing investment. Attackers change tactics to avoid the protections that they have already seen, and advanced attackers continue to prove they can develop attack technologies that penetrate even sophisticated targets. At the same time, pedestrian attackers and automated campaigns rely on finding new victims for older attack vectors, so existing defenses need to remain strong.
Closing the runtime gap in hospital cybersecurity
It's no secret hospitals are a favorite target for cyber criminals. They've been singled out for two primary reasons: 1. Medical records fetch a high price on the Dark Web. 2. Criminals know that attacks against hospitals work. In the past year, stories of hospitals being taken offline by ransomware and other malware have become regular fixtures in the headlines.
If you are asking about ROI in security, you are asking the wrong question
According to the Ponemon Institute almost 90% of healthcare firms experienced a data breach in 2016. With a growing number of breaches and a rise in the complexity of cyber campaigns, it is no wonder that organizations are feeling pressure to address the problem. Across the globe, teams are being asked one simple question "what is the ROI of your security solution?" Perhaps you yourself have been asked that questions. Or maybe you are asking your team about ROI.
The Evolution of Ransomware: Part 1
Public understanding and concern about cybersecurity has historically been pretty low, the domain of experts and large organizations on the lookout for sophisticated, targeted attacks. Ransomware is changing that, creating a rising tide of successful attacks that are forcing a re-examination of protection in organizations of all sizes. Businesses, numbed by constant warnings about threats, breaches, and the hopelessness of protection, are getting a serious wake-up call.
Get ready for hospital ransomware attacks 2.0
On February 5, 2016, staff members at Hollywood Presbyterian Medical Center began having difficulty accessing the hospital's computer network. The IT department was called in to investigate, and quickly, their worst fears were confirmed — the hospital's network had been infected with ransomware. Shortly afterwards, hospital staff declared an internal state of emergency, and IT systems were forced offline, knocking out access to electronic health records.
Vendor Security Alliance questionnaire: Starting a security discussion with vendors - Help Net Security
The interconnection between major organizations and their many service providers is providing a successful, and often ignored, path through which attackers are penetrating large well-protected targets such as the Office of Personnel Management and Target. In both of these examples, the breaches were enabled through an earlier successful breach of one or more of their divisions or suppliers.
5 Types of Employees Often Targeted By Phishing Attacks by @jackdanahy
Twenty years ago, hackers breached organizations by finding and exploiting holes at the network perimeter. To stop them, security teams focused on locking that perimeter down, creating a “hard, crunchy outside,” but they did much less to strengthen internal users, systems and networks. Modern attackers have evolved, moving to easier targets, at the organization's “soft, chewy, center” -- the users and their systems.
What party platforms say about handling cyber attacks (very little)
After the Wikileaks release of nearly 20,000 private emails gathered in a hack of the Democratic National Committee, new reports indicate the hack may have targeted and compromised even more people and organizations. The FBI and the Justice Department are both investigating, but so far discussion has centered around identifying the culprits (some reports point to Russian-based hacking groups).
117M LinkedIn Passwords for Sale: What You Should Do Now
Last week, a hack many of us had forgotten about shot right back into the headlines. First, the background: in 2012, LinkedIn acknowledged it had suffered a data breach that exposed the passwords of 6.5 million of its customers. What we discovered last week, however, was that the breach was actually much bigger than anyone (including LinkedIn) thought.
Next wave of ransomware could demand $millions
In February, Hollywood Presbyterian Medical Center (HPMC) was the victim of a ransomware attack that disabled access to its network, email, and patient data. The hospital was crippled. The Radiation Oncology department was shut down, CT scans and lab work were unavailable. What communication there was relied on fax machines, handwritten forms, and notes. Impacted patients were transferred to other facilities or simply turned away.
Five Cybersecurity Trends to Watch in 2016
To no one’s surprise, cybersecurity continued to be a key area of concern and struggle among organizations of all sizes in 2015. However, buried amongst the constant news cycle of new attacks and sophisticated breaches is the fact that more business leaders are understanding the importance of cybersecurity and its potential impact on the organization. Whether it’s a small operation within a niche industry or a major global corporation, everyone is at risk.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jack
Contact Jack, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack