X
Back to blog

CISO Thoughts with David Lindner - April 22

By David Lindner, Chief Information Security Officer

April 22, 2022

Insight #1

"Another critical  Java zero-day was revealed in the last week. Turns out, the issue was originally reported 5 months ago to Oracle and was just now addressed. This only adds to your need to increase your control layers for the unknown. What controls are you using to protect yourself from zero-days that are not released yet, specifically for Java? If runtime application self-protection (RASP) is not on your list, it should be."
 

Insight #2

"One of the most common security requirements I still see being used in organizations is forced password expiration. NIST has explicitly stated for 4 years now (SP 800-63B Section 5.1.1.2) that memorized secrets should not be required to be changed arbitrarily and only force a change if there is evidence of compromise. If you make one change to your password policy, remove this arbitrary requirement."
 

Insight #3

"This is your weekly reminder to turn on MFA. I cannot stress it enough, it will prevent a breach."
 
Thought Leaders
David Lindner, Chief Information Security Officer

David Lindner, Chief Information Security Officer

David is an experienced application security professional with over 20 years in cybersecurity. In addition to serving as the chief information security officer, David leads the Contrast Labs team that is focused on analyzing threat intelligence to help enterprise clients develop more proactive approaches to their application security programs. Throughout his career, David has worked within multiple disciplines in the security field—from application development, to network architecture design and support, to IT security and consulting, to security training, to application security. Over the past decade, David has specialized in all things related to mobile applications and securing them. He has worked with many clients across industry sectors, including financial, government, automobile, healthcare, and retail. David is an active participant in numerous bug bounty programs.

Previous

CISO Thoughts with David Lindner - April 15
Next

Contrast Security Named a Visionary in the 2022 Gartner Magic Quadrant for Application Security Testing
Enlarged Image