• Search for:
    29Dec, 2022
    Top 10 Best IoT Security Tools – 2023

    Top 10 Best IoT Security Tools

    • AWS IoT Device Defender
    • Appknox
    • Palo Alto Network
    • Azure Sphere
    • Microsoft Defender for IoT
    • Forescout Platform
    • Verizon IoT Security
    • Verimatrix
    • Trustwave
    • Armis

    1. AWS IoT Device Defender

    An easy-to-perform audit that scans an entire group of AWS IoT devices to find any type of gap in your IoT network.

    one of the best Traffic monitoring IoT Security Tools that can be run using ML models or your own defined actions against malicious IPs.

    It helps you implement consistent security policies across your AWS IoT device fleet and makes it easier to respond to attacks.

    The AWS IoT Security Team continuously updates its knowledge base of security best practices. All data is also implemented into the tool to provide the best possible solution to IoT network vulnerabilities.

    ProsCons
    Integration with APIIntegration with API is a little difficult

    2. Appknox

    Appnox and IoXt have partnered to bring security to IoT devices. All users must follow ioXt security promises to keep their devices safe.

    The eight principles are:

    Do not set a default password on the device (i.e. change the default password).

    Interface security is provided by the manufacturer against security attacks. Authentication methods are stricter.

    Encryption is implemented on the device and many layers of encryption are performed to keep your connection and data secure. Device certification profiles are checked for basic security measures.

    The latest updates for your device from the manufacturer are sent to you and updated for known vulnerabilities.

    It has an automatic security update feature that makes security updates available to users, and the manufacturer is responsible for security updates, validation, and deployment.

    Manufacturers must have good vulnerability reports and act appropriately (that is, patch all vulnerabilities) according to the vulnerabilities found in the reports.

    The time when the security update will be fixed and users will be notified of the expiration date.

    ProsCons
    Easy and scalable.High Cost
    Industry standards test cases and good security.you have to update your tool with other test cases
    Api  Scans need improvement

    3. Palo Alto Network

    Palo Alto Network is the industry’s first complete IoT security solution, providing a machine-learning approach to detect any anomaly.

    This tool uses a zero-trust system and policy based on risks for your IoT network to prevent any kind of blind spots in your network.

    The unique combination of the NGFW and IoT visibility enables context-aware network segmentation as a result of which the risk exposure is reduced.

    ProsCons
    very high throughput and low latencyIt is costly
    Very easy for establishing a VPN and implementing allow/deny rules.logs are saved for one week, which can be improved

    4. Azure Sphere

    The Azure Sphere IoT Security Tool is a high-level application platform that provides security for internet-connected devices (IoT devices).

    The Azure Sphere has an MCU (microcontroller unit). It is a custom, high-level Linux-based operating system, and cloud-based security service that provides continuous, updatable security.

    I am using the Azure Sphere security service from Azure Sphere. Connectivity to the cloud and web is secured to the MCU.

    This service ensures that devices are only booted with genuine, genuine software and also provides a channel through which operating system updates are automatically performed. Protection against many possible errors.

    ProsCons
    One Stop ShopMonitoring Response is Slow
    Low-cost option with high-quality security

    5. Microsoft Defender for IoT

    Microsoft Defender for IoT is an integrated security solution for identifying IoT (Internet of Things) and OT (operational technology) devices, vulnerabilities, and threats. And all of this can be centrally managed with the help of Microsoft Defender for IoT.

    Microsoft Defender for IoT can be deployed in a hybrid environment connected to Azure or completely on-premises.

    Microsoft Defender for IoT also provides lightweight micro-agents that support standard IoT operating systems such as Linux and RTOS for IoT device makers. It also helps ensure that security is built into IoT devices.

    ProsCons
    They have a good UI and the features are very useful.Setting Up is a little difficult
    Easy to Use.
    Easily binds with cloud-based IoT network.

    6. Forescout Platform

    A unified platform that discovers all devices on the network (IoT, IoMT, OT, or IT devices) whenever they connect to the network.

    It also classifies and segments all devices based on a three-dimensional taxonomy (device type, operating system, and model).

    Takes automatic action on every red light and eliminates time spent resolving alarms.

    Proven scalability with multiple deployments of over 2 million devices and over 1,000 locations.

    ProsCons
    User management is very easy with this tooldue to the license the cost gets higher.
    Good Visibility in the toolservice are chargeable every time

    7. Verizon IoT Security

    IoT Security Credentialing platform of Verizon provides a comprehensive approach to the security of Iot Devices.

    IoT Security Credentialing offers three layers of protection, with an over-the-top layer of security for devices and apps, data encryption, and trusted user and device authentication.

    The ThingSpace platform provides tools to test and manage the devices and apps on the Verizon Platform. You can also scale a prototype you want to implement on an enterprise level, with the help of ThingSpace.

    Verizon IoT Security provides a lot of different approaches to IoT Security such as:

    IoT Security Credentialing

    ThingSpace for IoT

    IoT Marketplace

    IoT for small business

    ThingSpace Marketplace provides one place solution for any IoT solution. You can purchase, activate and manage your devices as your solution and business grow.

    IoT for small businesses from its name itself shows that it is made by keeping small businesses in mind they provide two functionalities as follows:

    • Fleet and Mobile Worker Management
    • Critical Asset Tracking
    ProsCons
    On-Site SupportTypes of Software/Services
    Highly ScalableRemote Support is not that good
    On-Premise

    8. Verimatrix

    This IoT Security Tool Verimatrix software features a shield suite consisting of Code Protection, Whitebox, and App Shield tools that integrate with your IoT device infrastructure to provide comprehensive security.

    Verimatrix provides end-to-end security for a wide range of IoT devices including medical devices, smart home devices, and connected cars.

    This will also prevent an increase in threats from 5G networks.

    With the help of verimatrix Whitebox, your team can design their own custom architecture based on cryptography. This protects your data even if it falls into the wrong hands.

    Code Shield Stops and disrupt hackers with the most demanding, market-proven, patented, intelligent, and automated security tools. App Shield injects the solution directly into your app without affecting your application’s functionality.

    ProsCons
    Open Source Component MonitoringSupport is slow to respond

    9. Trustwave

    Trustwave’s Managed IoT Security helps you scan your network and retrieve asset details.

    Trustwave Managed IoT Security can scan APIs, servers, and cloud clusters to better protect your IoT devices.

    Trustwave provides database monitoring for implementers and manufacturers who can implement security directly.

    With the help of the Digital Forensic and Incident Response Team, organizations can proactively prevent attacks of all kinds.

    ProsCons
    Easy to UseTakes longer to Compile
    Has Advanced FeaturesA little complicated for a non-technical person
    Large user community

    10. Armis

    This IoT Security Tool is the first enterprise-class agentless security platform to address the emerging threat landscape of unmanaged IoT devices.

    Armis provides security for all managed and unmanaged devices. 1000s of fortune companies trust Armis for out-of-band sensing technology.

    Armis CIPP Services enable you to quickly leverage Armis Intelligence data for recommended policy changes, incident response, operations management, and remediation.

    It also monitors connecting devices in the airspace using peer-to-peer protocols ignored by traditional security products.

    Allows automatic disconnection/quarantine of all devices that fail to match the base-level security policy.

    ProsCons
    Create Dashlets in DashboardA little expensive
    Managing alerts is very easyMaking Policies right according to your need takes a little time.

    Resource : https://cybersecuritynews.com/iot-security-tools/

    29Dec, 2022
    7 High-Income Skills Worth Learning in 2023

    Developing these seven skills could lead to more job opportunities and a bigger salary.

    Every job requires some combination of workplace skills and technical skills, and chances are, you have already built an impressive skill set derived from your education or past work experience.

    High-income skills are tools and expertise that employers tend to value highly and may make it easier to change jobs and even industries, according to a 2022 report from McKinsey & Company [1]. These job skills may be rare, and they’re often crucial to running a successful business.

    As you aim to advance your career or shift your career focus, you may want to find ways to highlight your high-income skills. Depending on your desired career path, you may be able to leverage these skills to reach your salary goals.

    7 high-income skills to learn

    Below, you’ll find seven high-income skills that you can feature on your resume to help stand out to potential employers. To build this list, we looked at reports forecasting the most in-demand skills through 2030 from the World Economic Forum [2], Pearson [3], Future Learn [4], LinkedIn [5], Glassdoor [6], and Coursera [7].

    The skills listed here are all transferable across a number of career paths. As you read this list, consider your career goals, past experiences, and the job descriptions of your desired roles, and notice whether any of these skills may naturally facilitate your path.

    1. Data analysis

    Analytical thinking and innovation is the top skill forecasted in the World Economic Forum’s Future of Jobs Report [2]. As businesses across industries increasingly rely on data to make informed decisions, they require more employees with the ability to collect, interpret, and share data that can solve their business problems.

    People skilled in data analysis may use a range of tools including Microsoft Excel, Google Sheets, SQL, Tableau, R, or Python.

    Here are some careers that use data analysis, along with average base pay in the United States as of December 2022, according to Glassdoor:

    Job titleAverage base pay
    Business analyst$76,147
    Data analyst$67,179
    Data engineer$94,327
    Data scientist$102,994

    2. Software development

    Increasingly, industries are turning toward technology to advance their business capabilities, and they need people skilled in developing, maintaining, and improving their technological systems. People who work in DevOps or software engineering build, monitor, and control an organization’s technology.

    People skilled in DevOps or software engineering may use tools like Git, Docker, Jenkins, or Kubernetes, and may know coding languages like Python, Java, or C++.

    Here are some careers that use software development, along with average base pay in the United States as of December 2022, according to Glassdoor:

    Job titleAverage base pay
    Applications engineer$81,008
    Systems developer$90,943
    Software engineer$90,390
    DevOps engineer$104,148

    3. User experience

    Hand in hand with technological development comes user experience (UX), which has to do with the way a consumer interacts with a product. People working in UX figure out the best way to present a product to consumers. They may conduct research, design, or help market a product.

    Although they still involve some data, UX roles are grounded in design and tend to offer room for creativity, and they require a high level of social perceptiveness—three skills that come up in multiple skill reports [2, 3, 4].

    Here are some careers utilizing user experience skills, along with average base pay in the United States as of December 2022, according to Glassdoor:

    Job titleAverage total pay
    UX writer$98,553
    UX researcher$100,490
    User interface (UI) designer$102,987
    UX designer$105,118
    Product designer$107,400

    4. Web development

    Web development brings together the fundamentals of software development and user experience, incorporating the technical aspects of the former with the design elements of the latter. People skilled in web development will also be familiar with technical search engine optimization (SEO) in order to design and program websites that meet business needs.

    Here are some careers that require web development skills, along with average base pay in the United States as of December 2022, according to Glassdoor:

    Job titleAverage total pay
    Front-end developer$104,394
    Full-stack developer$110,497
    Webmaster$110,686
    Back-end developer$119,292

    5. Project management

    Many companies use an organizational structure in which different departments, teams, or team members all work on a singular product or project. A person who is skilled in coordinating efforts across each of those touchpoints is skilled in project management. These team members may be responsible for maintaining schedules, organizing budgets, and communicating with project stakeholders (or various parties interested or invested in the project outcomes).

    You can consider “project management” to be a catch-all term for leadership, communication, planning, resilience, and organizational skills—all of which are frequently cited as valuable to employers [2, 3, 4, 6].

    Project management shows up in many careers and becomes especially important as you move into managerial positions. However, you can also pursue a career as a project manager. Here are some careers along the project manager path and their average base pay in the United States as of December 2022, according to Glassdoor:

    Job titleAverage total pay
    Project coordinator$89,374
    Program manager$89,989
    Project manager$93,043
    Portfolio manager$119,373

    6. Account management

    While project management typically has an internal focus, account management taps into a similar subset of skills to work with people outside of your organization. Often highly valued in sales positions, account management skills enable you to confidently position your company and its products to customers.

    Account management skills incorporate both the organizational aspects required to close a business deal as well as the interpersonal skills required to productively negotiate and maintain relationships. They often work with a customer relationship management (CRM) tool like Salesforce.

    Here are some careers that use account management and sales skills, along with average base pay in the United States as of December 2022, according to Glassdoor:

    Job titleAverage total pay
    Account manager$83,999
    Business development associate$88,601
    Business development manager$98,861
    Sales representative$100,310

    7. Content creation and management

    Content creation and management skills involve storytelling and are often crucial for marketing careers. This skill set incorporates creativity, originality, social perceptiveness, and emotional intelligence. Taking these skills a step further can also mean adding data analysis to your toolbox, specifically honing in on marketing analytics so that you can assess how well an audience is connecting with your content.

    Here are some careers that use content creation and management skills, along with average base pay in the United States as of December 2022, according to Glassdoor:

    Job titleAverage total pay
    Social media manager$76,325
    Digital marketing manager$96,206
    Content marketing manager$107,777
    Brand marketing manager$109,952

    Keep learning

    You can build many skills through your regular work activities, however, sometimes it can help to bolster your skill set with outside classes or certifications. If you are trying to figure out the best skills for you to increase your earning potential, visit the Career Academy on Coursera. Here, you’ll get an in-depth look at the key skills across several career paths and can find specific online courses for each path.

    Resource : https://www.coursera.org/articles/high-income-skills

    28Dec, 2022
    Cybercrime (and Security) Predictions for 2023

    Threat actors continue to adapt to the latest technologies, practices, and even data privacy laws—and it’s up to organizations to stay one step ahead by implementing strong cybersecurity measures and programs.

    Here’s a look at how cybercrime will evolve in 2023 and what you can do to secure and protect your organization in the year ahead.

    Increase in digital supply chain attacks #

    With the rapid modernization and digitization of supply chains come new security risks. Gartner predicts that by 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains—this is a three-fold increase from 2021. Previously, these types of attacks weren’t even likely to happen because supply chains weren’t connected to the internet. But now that they are, supply chains need to be secured properly.

    The introduction of new technology around software supply chains means there are likely security holes that have yet to be identified, but are essential to uncover in order to protect your organization in 2023.

    If you’ve introduced new software supply chains to your technology stack, or plan to do so sometime in the next year, then you must integrate updated cybersecurity configurations. Employ people and processes that have experience with digital supply chains to ensure that security measures are implemented correctly.

    Mobile-specific cyber threats are on-the-rise#

    It should come as no surprise that with the increased use of smartphones in the workplace, mobile devices are becoming a greater target for cyber-attack. In fact, cyber-crimes involving mobile devices have increased by 22% in the last year, according to the Verizon Mobile Security Index (MSI) 2022 with no signs of slowing down in advance of the new year.

    As hackers hone in on mobile devices, SMS-based authentication has inevitably become less secure. Even the seemingly most secure companies can be vulnerable to mobile device hacks. Case in point, several major companies, including Uber and Okta were impacted by security breaches involving one-time passcodes in the past year alone.

    This calls for the need to move away from relying on SMS-based authentication, and instead to multifactor authentication (MFA) that is more secure. This could include an authenticator app that uses time-sensitive tokens, or more direct authenticators that are hardware or device-based.

    Organizations need to take extra precautions to prevent attacks that begin with the frontline by implementing software that helps verify user identity. According to the World Economic Forum’s 2022 Global Risks Report, 95% of cybersecurity incidents are due to human error. This fact alone emphasizes the need for a software procedure that decreases the chance of human error when it comes to verification. Implementing a tool like Specops’ Secure Service Desk helps reduce vulnerabilities from socially engineered attacks that are targeting the help desk, enabling a secure user verification at the service desk without the risk of human error.

    Double down on cloud security #

    As more companies opt for cloud-based activities, cloud security—any technology, policy, or service that protects information stored in the cloud—should be a top priority in 2023 and beyond. Cyber criminals become more sophisticated and evolve their tactics as technologies evolve, which means cloud security is essential as you rely on it more frequently in your organization.

    The most reliable safeguard against cloud-based cybercrime is a zero trust philosophy. The main principle behind zero trust is to automatically verify everything—and essentially not trust anyone without some type of authorization or inspection. This security measure is critical when it comes to protecting data and infrastructure stored in the cloud from threats.

    Ransomware-as-a-Service is here to stay #

    Ransomware attacks continue to increase at an alarming rate. Data from Verizon discovered a 13% increase in ransomware breaches year-over-year. Ransomware attacks have also become increasingly targeted — sectors such as healthcare and food and agriculture are just the latest industries to be victims, according to the FBI.

    With the rise in ransomware threats comes the increased use of Ransomware-as-a-Service (RaaS). This growing phenomenon is when ransomware criminals lease out their infrastructure to other cybercriminals or groups. RaaS kits make it even easier for threat actors to deploy their attacks quickly and affordably, which is a dangerous combination to combat for anyone leading the cybersecurity protocols and procedures. To increase protection against threat actors who use RaaS, enlist the help of your end-users.

    End-users are your organization’s frontline against ransomware attacks, but they need the proper training to ensure they’re protected. Make sure your cybersecurity procedures are clearly documented and regularly practiced so users can stay aware and vigilant against security breaches. Employing backup measures like password policy software, MFA whenever possible, and email-security tools in your organization can also mitigate the onus on end-user cybersecurity.

    Data privacy laws are getting stricter—get ready #

    We can’t talk about cybersecurity in 2023 without mentioning data privacy laws. With new data privacy laws set to go into effect in several states over the next year, now is the time to assess your current procedures and systems to make sure they comply. These new state-specific laws are just the beginning; companies would be wise to review their compliance as more states are likely to develop new privacy laws in the years to come.

    Data privacy laws often require changes to how companies store and processing data, and implementing these new changes might open you up to additional risk if they are not implemented carefully. Ensure your organization is in adherence to proper cyber security protocols, including zero trust, as mentioned above.

    Resource: https://thehackernews.com/2022/12/cybercrime-and-security-predictions-for.html

    28Dec, 2022
    Modern technology and cyber recovery will intersect in the next generation of attacks

    As technology continues to evolve for business and personal use, cybercriminals are also leveraging innovation in the next generation of attacks, according to Experian.

    Additional frontiers are a focus for 2023

    In addition to the metaverse, hackers will increasingly explore more frontiers, including space and innovative technology like artificial intelligence, come 2023. A new Experian report outlines several predictions to help companies understand where cybercriminals will lurk and how they will attack. These predictions include the following:

    Wild, wild west of the metaverse

    While embarking on a virtual life journey is appealing to many, it has vulnerabilities. As the metaverse continues to gain momentum, phishing attempts, NFT-related scams and malware attacks have already begun, with potentially more looming in the year ahead. AR and VR devices increase the impact of data breaches as these devices collect large amounts of personal information and user data. This may increase their potential to be hacked and lead to more sophisticated attacks.

    Houston, we have a problem

    Thinking about the scale of damage that could result from space satellites being hacked is disconcerting, but it’s also a reality we must prepare for in 2023. The combination of a disjointed regulatory environment and more satellites in orbit than ever opens the door for bad actors to exploit the satellites in orbit, or with a big enough satellite, even launch cyberattacks from space.

    Imitation that’s not a form of flattery

    While influencers of all types may chase exposure, this isn’t the kind they want. Use of deepfake technology by bad actors could be leveraged for more than just funny videos and elevated to create a new level of strategic mischief. Global leaders, business titans and influential industry experts around the world will need to stay vigilant of the misuse of their image and likeness as deepfake technology may be an increasingly popular tool in warfare and in cybercrime.

    Resiliency is the key to winning long-term

    Among Experian’s predictions is a long-term outlook that the amount of time to detect and defend against a security intrusion will probably not improve significantly over the next 10 years. Organizations still grapple to prevent data breaches with more than 1,200 breaches this year so fari. Unfortunately, according to IBM, it still takes organizations a lengthy 212 days to identify a cyber intrusion and another 75 days to contain it. Strategies to improve detection and containment need to be shored up.

    “In assessing the cyber landscape, we pinpointed a preparedness weakness that needs attention,” said Michael Bruemmer, VP, Global Data Breach Resolution at Experian. “The reality is that cyberattacks can’t be prevented 100 percent of the time, but organizations that can discover and thwart cyberattacks quickly will suffer less damage financially and reputationally. We believe there is a shift in mindset needed to focus on resiliency to complement the pursuit for absolute prevention.”

    Resource : https://www.helpnetsecurity.com/2022/12/27/modern-technology-cyber-recovery-next-generation-attacks/?web_view=true

    26Dec, 2022
    Dealing with cloud security shortfalls

    72% of IT leaders believe their companies moved to the cloud without properly understanding the skills, maturity curve, and complexities of making it all work securely, according to a recent CloudBolt Software report.

    The results of the study should be concerning to enterprises:

    • 68% said their organization’s security skill set across all clouds was only “somewhat mature.”
    • Only 8% of respondents confirmed they had implemented highly operationalized cloud security practices when spinning up new compute resources and environments; 83% say that they have “somewhat” done so.
    • Only 6% of respondents say that their companies automatically build security into every workload up front; 51% say they do it “sometimes.”

    “Several years ago in cybersecurity, companies realized that the single greatest threat vector was the individual end user. So, the focus shifted from perimeter and end-point security to automatically applying security at the user level,” said Jeff Kukowski, CEO of CloudBolt.

    “I think this new report reveals a similar parallel in cloud security. Macro solutions that don’t make cloud security automatic at the individual, cloud-provisioning ‘moment of truth’ create lots of opportunity for exposure and leave enterprises only ‘somewhat, sometimes’ secure. I predict 2023 will be the year we see significantly more focus on shoring up these current cloud security shortfalls. It’s a very solvable problem when you apply the right approaches,” Kukowski continued.

    Respondents primarily attributed shortfalls in cloud security at the user level to a growing multi-cloud skills gap and over-reliance on cloud-native security and monitoring tools.

    The multi-cloud skills gap

    As revealed in a previous CII study, there simply aren’t enough people with the necessary skills across all major cloud platforms to effectively address the biggest cloud challenges – including security.

    This latest CII report further validates these findings:

    • 56% of respondents cited “depth of native cloud skill sets/expertise” as a top security concern.
    • 29% pointed to a “lack of talent with deep security expertise” as an issue.

    Organizations rely heavily on cloud-native security tools

    Companies say they are largely utilizing the security tools each public cloud provider offers:

    • 74% said they rely on these tools to provide “adequate security.”
    • 84% indicated that simply using a monitoring tool was the best way to deal with cloud security.
    • 64% believe they can solve their cloud security concerns by embracing HashiCorp’s Terraform.

    However, each is fraught with limitations that create the “somewhat, sometimes” security issues at the user level.

    “People want to believe the cloud-native tools they use will simply take care of security for them,” said Kukowski.

    “But in a multi-cloud world, the unique nuances of settings and required knowledge between each major cloud create plenty of opportunities for errors, omissions, and mistakes by individuals. And monitoring tools alone cannot provide proactive and automatically applied guardrails. Companies appear to have been lulled into a false sense of security. The reality is that proper security processes, protocols and best practices must be built into cloud workloads up front to prevent missteps from happening in the first place. Not somewhat or sometimes – fully and all the time,” Kukowski concluded.

    The CloudBolt Software report is based on a global survey of 350 IT leaders primarily VP+ from enterprises with 5,000 or more employees, executed by the Gartner-owned Pulse research platform.

    Resource : https://www.helpnetsecurity.com/2022/12/22/dealing-with-cloud-security-shortfalls/?web_view=true

    26Dec, 2022
    Drokbk Flying Under the Radar by using GitHub as Dead Drop Resolver

    Organizations need servant leaders to step forward and make their teams’ professional effectiveness and happiness a priority.

    A subgroup of the Iranian Cobalt Mirage threat group, known as Nemesis Kitten, is using a new custom malware dubbed Drokbk, written in .NET. The group is using GitHub as a dead-drop resolver to target a variety of U.S. organizations.

    How Drokbk was discovered

    Secureworks researchers discovered the group conducting broad scan-and-exploit activity to target vulnerable systems in organizations in the U.S. and Israel.

    • The malware was first spotted in February in a U.S. local government network intrusion. The attackers compromised a VMware Horizon server using the two Log4j vulnerabilities (CVE-2021-44228 and CVE-2021-45046).
    • They embedded a malicious executable in a compressed archive hosted on the legitimate transfer .sh online service. Upon execution, the dropper created a directory, dropped the final payload, executed it, and deleted traces from the compromised system.

    Diving into malware functionalities

    Drokbk is a relatively unknown piece of malware and consists of a dropper and a payload.

    • It has limited built-in functionality such as installing a web shell on a compromised server. 
    • It is deployed post-intrusion, alongside other persistent access mechanisms and additional tools for the lateral expansion phase within the victim’s environment.
    • It primarily executes additional commands or code from the C2 server. 
    • It provides the threat actors with arbitrary remote access and an additional foothold, alongside tunneling tools such as Fast Reverse Proxy (FRP) and Ngrok.

    GitHub as dead drop resolver

    Drokbk is using the dead drop resolver technique to find its C2 server by connecting to GitHub.

    • The final payload (SessionService.exe) begins by finding its C2 domain by searching for preconfigured information stored on a cloud service in a GitHub account.
    • The attackers posted content on a GitHub account with embedded malicious domains or IP addresses in an effort to hide their nefarious intent. The content is either preconfigured in the malware or can be deterministically located by the malware.
    • Researchers observed an attacker-operated GitHub account Shinault23 that dynamically updates its C2 server to maintain resiliency against shuttering of its GitHub account.

    Conclusion

    Abuse of GitHub as dead drop resolvers by Drokbk points towards the increasing interest of attackers towards using similar techniques. Organizations are recommended to invest in credential hygiene, least privileges, and network segmentation to prevent such kinds of cyber threats.

    Resource : https://cyware.com/news/drokbk-flying-under-the-radar-by-using-github-as-dead-drop-resolver-eee32e68

    23Dec, 2022
    Researchers Develop AI-powered Malware Classification for 5G-enabled IIoT

    The global industrial internet of things (IIoT) market reached an all-time high in 2022 and, by many accounts, it is expected to continue to grow. It is estimated the market will reach $106.1bn by 2026, according to MarketsandMarkets. Meanwhile, Data Bridge Market Research mentions a global value of $541bn by 2029 and Future Markets Insight expects it to reach $1.3tn by 2032.

    This surge comes in a context where there are very few IoT standards and regulations, let alone IIoT specific standards. This poses a significant security risk, leaving devices used in critical applications such as healthcare, safety systems, or utilities, vulnerable to cyberattacks.

    To start addressing the problem, a team of multinational researchers led by Professor Gwanggil Jeon from Incheon National University, in South Korea, have developed a deep learning-based malware detection and classification system. Their work was published online on September 9, 2022 in the journal IEEE Transactions on Industrial Informatics.

    The system developed by the team first uses a deep learning network to analyze the malware, and then applies a multi-level convolutional neural network (CNN) architecture to a malware classification method known as ‘grayscale image visualization’.

    This technique consists of transforming the raw bytes of malware into grayscale images and extract the malware texture features for classification. The team also integrated this security system with 5G, which allows for low latency and high throughput sharing of real-time data and diagnostics.

    Groundwork For Advanced Security Systems

    The first results are staggering: “Compared to conventional system architectures, the new design showed an improved accuracy that reached 97% on the benchmark dataset,” the paper reads. The team of researchers also discovered that the reason behind such high accuracy is the system’s ability to extract complementary discriminative features by combining multiple layers of information.

    According to the researchers, this novel malware detection and classification method can be used “to secure real-time connectivity applications such as smart cities and autonomous vehicles [and] provides solid groundwork for the development of advanced security systems that can curb a wide range of cybercrime activities.”

    “Our system harnesses the power of AI to enable industries to recognize miscreants and prevent the entry of unreliable devices and systems in their IIoT networks,” Jeon said.

    Resource : https://www.infosecurity-magazine.com/news/ai-malware-classification-for-5g/

    22Dec, 2022
    Cost of a Data Breach: Infrastructure

    What Is Critical Infrastructure?

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) classifies 16 infrastructure sectors as critical to the nation. Among these critical sectors are financial services, critical manufacturing, information technology, energy, transportation systems, communications, health care and public health, food and agriculture and emergency services.

    CISA designates certain industries as critical because their assets, systems and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety or some combination of those factors. When cybersecurity issues occur in organizations in critical industries, there is a ripple effect with many often-unexpected consequences.

    The Colonial Pipeline ransomware attack, for example, shut down an oil pipeline that stretches 5,500 miles from Texas to New York and carries up to 3 million barrels of fuel per day. The five-day shutdown reduced the amount of gas available to the East Coast by half. Therefore, many areas experienced gas shortages and high prices. In addition, Colonial Pipeline paid $4.5 million in ransom to restore its compromised systems and faces more fines for operational lapses and management failures. The attack also resulted in new directives issued by the Transportation Security Administration for U.S. pipelines to prevent similar attacks and reduce their impact.

    What Is a Critical Infrastructure Data Breach?

    Each time an organization in a critical sector is the victim of any type of cybersecurity incident that results in data loss, the event counts as a critical infrastructure data breach. The IBM 2022 Cost of a Data Breach Report revealed the following breakdown of types of attacks on critical infrastructure industries:

    • IT failure (25%)
    • Human error (22%)
    • Third-party business partner (17%)
    • Destructive attacks (16%)
    • Ransomware (12%)
    • Other malicious attacks (8%).

    Impact of a Critical Infrastructure Data Breach

    Interestingly, the average cost of a critical infrastructure data breach was more than $1 million more than other data breaches. It cost an average of $4.82 million compared to $3.83 million in industries such as pharmaceuticals, services, entertainment, consumer goods, media, hospitality, retail and research. These totals do not include the impacts data breaches and disruption of services have on consumers and other businesses. Those might include supply chain issues or greater health care costs from delays in care.

    Not surprisingly, health care continued its 12-year reign as the most costly industry for a data breach. In 2021, the average cost of a health care data breach was $9.23 million. However, the new report found the average cost increased to $10.10 million in 2022, an increase of 9.4%. Other critical infrastructure industries ranked in the top four, with financial services coming in second at $5.97 million. Other high-cost critical infrastructure industries include technology ($4.97 million) and energy ($4.72 million).

    Although the costs for critical infrastructure are higher, the report found that defenders find and contain breaches more quickly there than in other industries. That proves the costs would be even higher without the quick action and high priority of cybersecurity workers. The Mean Time to Identify in critical infrastructure industries was 204 days, compared to 211 days for other industries. The Mean Time to Contain for critical infrastructure industries was 69 days, compared to 71 days for other industries. Overall, the combined average for critical infrastructure industries was nine days shorter than the 282 days average for other industries. 

    Zero Trust Can Reduce Costs of Data Breaches

    A surprising finding from the report: critical infrastructure organizations were much less likely to use a zero trust framework. With a zero trust approach, an organization moves away from the traditional strategy of protecting the perimeter and endpoints. Instead, the organization reduces risk by assuming that all access requests from apps, users and devices are not authorized. The user must then prove otherwise since the organization meets every request with zero trust.

    The higher costs for critical infrastructure breaches likely relate to the lower adoption of the framework in these industries. The report found that one in five organizations in critical infrastructure industries are using zero trust. However, 41% of all organizations — both critical and non-critical infrastructure industries — now use a zero trust approach.

    The report discovered that critical infrastructure organizations that use a zero trust approach have an average breach cost of $4.23 million. Meanwhile, critical infrastructure organizations that are not using a zero trust approach have an average cost of $5.40 million. That’s a difference of $1.17 million per breach. Critical infrastructure industry organizations can reduce the cost of a breach simply by using a zero trust approach.

    Moving Forward With Zero Trust in Critical Infrastructure Industries

    While the prospect of completely shifting your cybersecurity approach can feel overwhelming, zero trust consists of multiple types of processes and technologies. By starting small, with one type of zero trust approach such as multi-factor authentication or micro-segmentation, your organization can begin to see the benefits of the approach.

    Organizations can build upon their initial framework by adding more technology and strategies as they become more experienced with zero trust. The report found that the level of maturity in zero trust makes a difference in breach costs for all organizations. That holds true both in critical infrastructure sectors and other industries. Organizations with a mature zero trust approach spent $1.51 million less than organizations just starting their journey.

    Creating a fully mature zero trust framework doesn’t happen overnight. By starting your journey today, your organization can begin reducing both risks and costs of a breach.

    Because you are in the critical infrastructure industry, your cybersecurity decisions don’t just affect your employees and customers. They affect people across the country, and even the world. With a zero trust approach, your organization ensures it is able to provide the services others depend on.

    Resource : https://securityintelligence.com/category/data-protection/

    22Dec, 2022
    4 Ways AI Capabilities Transform Security

    Many industries have had to tighten belts in the “new normal”. In cybersecurity, artificial intelligence (AI) can help.

    Every day of the new normal we learn how the pandemic sped up digital transformation, as reflected in the new opportunities and new risks. For many, organizational complexity and legacy infrastructure and support processes are the leading barriers to the effectiveness of their security.

    Adding to the dynamics, short-handed teams are overwhelmed with too much data from disparate sources and an abundance of tools, yet a scarcity of insights. These challenges can easily exceed the skills of even the largest, best teams.

    In a time of greater challenges and fewer resources, how can security leaders become more effective, minimize their expenses and get the most out of their employees without burning them out? A recent study from the IBM Institute for Business Value (IBV) suggests people are investing in AI and automation to address many of these challenges.

    The IBV partnered with APQC (American Productivity and Quality Center) in a survey of 1,000 business leaders to find out how AI is being used to support their operations and to quantify its impact on performance.

    AI: Defense In a Fast-Paced World

    The in-depth report contemplates questions that are top-of-mind for today’s leaders. How do AI and automation help? Where in the security life cycle do these tools have the greatest impact? Can pairing AI with automation deliver a higher return on security investment?

    There are four primary ways AI technologies are transforming security operations:

    1. Machine learning helps identify patterns, take inventory of new assets and services and refine the performance of AI models.
    1. Reasoning tools help inform data analysis, enhance scenario modeling and foresee new attack vectors.
    1. Natural language processing can be used to mine text data sources, improve threat intelligence and enrich knowledge resources.
    1. Automation can help orchestrate time-intensive tasks, improve response times and reduce the burden for human analysts.

    According to survey respondents, adopting AI-powered automation has enabled them to operate faster, with greater flexibility.

    How are they doing this? One of the survey’s most compelling findings is that the mix of AI and automation is being used to offload routine triage tasks. It enables skilled analysts to focus on higher-value investigations that require human expertise and judgment.

    Practical Use of AI

    The report offers actionable insights into how security leaders are using AI and automation to support their protection, prevention, detection and response processes. For example:

    Source: IBM Security Services based on an analysis of aggregated 2021 performance data. Note: Performance thresholds depicted are expected to improve on a continuing basis. 

    Investing in security AI and automation is leading to tangible performance benefits. Compared to non-AI adopters, AI adopters can save more than 14 weeks in threat detection and response:

    Importantly, these organizations are achieving this level of performance while also reducing costs and complexity.

    Backed By Research

    Other IBM security research studies have found similar results. The 2022 Cost of a Data Breach report from IBM and Ponemon Institute found security AI and automation had the greatest positive impact on reducing the overall costs of a data breach. To address emerging threats, the IBM X-Force annual Threat Intelligence Index suggests best practices such as adopting a zero trust approach, automating incident response and deploying extended detection and response.

    For security leaders, the key takeaway is that investing in AI and automation enables you to make more of your skilled talent while also improving your overall performance.

    Want to dig into the data or get more insights? Read the full report here. Learn more about AI and cybersecurity here.

    Resource : https://securityintelligence.com/posts/ai-capabilities-transform-security/

    21Dec, 2022
    Google Chrome now supports passkeys to eventually replace passwords

    Google announced that passkeys are now in the latest update to Chrome, a security feature companies are adopting to try to replace passwords.

    The company announced in October that it added support for passkeys in Chrome Canary, a version of its browser that it uses for testing new features. Now, the official, stable version of Chrome — M108 — has the security feature.

    Mac users can update Chrome by clicking the three-dot menu in the upper-right of the browser window and clicking Help > About Chrome.

    Passkeys

    Passkeys are an effort from Apple, Google, Microsoft, and the FIDO Alliance to replace passwords. Apple announced support for them at its WWDC event in June.

    They are based on the Web Authentication API WebAuthn, a security standard that uses public key cryptography for authentication.

    Unlike passwords, passkeys are meant to be simpler and more convenient. They can’t be reused or leaked in data breaches, and they help protect users from phishing attacks.

    They work across various browsers, websites, and apps. Users can sign into websites and apps with a passkey using biometric authentication such as Face ID or Touch ID.

    Chrome can store passkeys along with passwords
    Chrome can store passkeys along with passwords

    Passkeys can be backed up to iCloud and synced across your iPhone, iPad, and Mac devices in an end-to-end encrypted fashion. Users who create a passkey on an Apple device can sign into a website or app on a non-Apple device using a unique QR code, and authenticate with biometrics.

    Google says that Chrome will be able to save passkeys in the browser’s built-in password manager.

    Resource : https://appleinsider.com/articles/22/12/09/google-chrome-now-supports-passkeys-to-eventually-replace-passwords