Tag Archives: security maturity

Few Fortune 100 Firms List Security Pros in Their Executive Ranks

July 21, 2023

Many things have changed since 2018, such as the names of the companies in the Fortune 100 list. But one aspect of that vaunted list that hasn’t shifted much since is that very few of these companies list any security professionals within their top executive ranks.

The next time you receive a breach notification letter that invariably says a company you trusted places a top priority on customer security and privacy, consider this: Only four of the Fortune 100 companies currently list a security professional in the executive leadership pages of their websites. This is actually down from five of the Fortune 100 in 2018, the last time KrebsOnSecurity performed this analysis.

The Value of a Hacked Company

July 14, 2016

30 Comments

Most organizations only grow in security maturity the hard way — that is, from the intense learning that takes place in the wake of a costly data breach. That may be because so few company leaders really grasp the centrality of computer and network security to the organization’s overall goals and productivity, and fewer still have taken an honest inventory of what may be at stake in the event that these assets are compromised.

Chipotle Serves Up Chips, Guac & HR Email

November 16, 2015

58 Comments

The restaurant chain Chipotle Mexican Grill seems pretty good at churning out huge numbers of huge burritos, but the company may need to revisit some basic corporate cybersecurity concepts. For starters, Chipotle’s human resources department has been replying to new job applicants using the domain “chipotlehr.com” — a Web site name that the company has never owned or controlled.

Translation: Until last week, anyone could have read email destined for the company’s HR department just by registering the domain “chipotlehr.com”. Also, Chipotle itself has inadvertently being pointing this out for months in emails to anyone who applied for a job via the company’s Web site.

What’s Your Security Maturity Level?

April 27, 2015

37 Comments

Not long ago, I was working on a speech and found myself trying to come up with a phrase that encapsulates the difference between organizations that really make cybersecurity a part of their culture and those that merely pay it lip service and do the bare minimum (think ’15 pieces of flair’). When the phrase “security maturity” came to mind, I thought for sure I’d conceived of an original idea and catchy phrase. It turns out this is already a thing. And a really notable thing at that.