Morning9 – Page 33 – Your Tech Learning Hub

6Jan, 2023

SRE Vs DevOps: The Best Solution for Your Business

In the last few years DevOps has disrupted the software development lifecycle. According to a recent report, the global DevOps market was valued at USD 6.78 billion in 2020 and is projected to grow to USD 57.90 billion by 2030. The figure highlights the growing demand for DevOps as a means for businesses to optimise the time to market for new products and services, whilst ensuring greater stability of operations, and safer business continuity.

DevOps facilitates collaboration and communication between developers and the operations team where building, testing and releasing software can happen rapidly and reliably. Under a DevOps model, companies can:

Reduce organisation silos
Accept failure as a natural part of the process
Implement gradual change
Leverage tooling and automation
Measure everything

Site Reliability Engineering (SRE) SRE evolved independently from DevOps as a means to build, maintain and run production systems at scale. SRE deals with implementing the product developed by the development team while reducing the level of incidents and improving stability and reliability. The 2022 LinkedIn Jobs on the Rise list includes SRE among the 25 fastest-growing job titles with the highest global demand throughout the past five years. It appears the SRE practice will continue to gain adoption as a method to support higher availability, reliability and improved digital customer experiences.

Seth Vargo (Developer Advocate at Google) and Liz Fong-Jones (Site Reliability Engineer at Google) provide an interesting insight on the SRE vs DevOps debate: ‘if DevOps is a philosophy, SRE is a prescriptive way of accomplishing that philosophy’.

But is there a difference between the two? Let’s find out.

Difference between DevOps and SRE

Whilst there are some overlaps in job roles within DevOps and SRE, there are differences in some key functions. Here are four main distinctions between DevOps and SRE:

1. Objective

The primary objective of DevOps is product development with Continuous Integration/Continuous Delivery (CI/CD) and to ensure timely release. Developers wants to build features and products and ship them as quickly as possible to customers. However, SRE’s main objective is the system’s stability and reliability. Operators are responsible for the system not going down. So, in this sense DevOps and SRE are two opposing ideas. Developers want to move fast, whilst operators move slowly.

2. DevOps focuses on ‘What’, SRE focuses on ‘How’

Seth Vargo explains, ‘DevOps is like an abstract class or interface in programming whereas SRE is a concrete implementation of that class.’ DevOps provides a list of ‘what’ needs to be done whereas SRE demonstrates ‘how’ to implement them.

For example – reducing organisation silos is one of the five pillars in the DevOps model. However, SRE shows us how to achieve this. Site Reliability Engineers reduce organisation silos by sharing ownership with developers by using the same shared set of tooling across the organisation. By leveraging a single set of tools for production systems we have software developers and SREs contributing at the same time and you can start building high-performance, reliable tooling that facilitates project completion.

3. Team structure

DevOps teams typically comprise of a group of professionals with very specific and pre-defined roles like – product owner, software developer, release manager, QA Engineer etc. On the other hand, SRE teams are made up of engineers who have a combination of operational and development skills.

4. Process Flow

A DevOps team has a perspective of the development environment to put changes from development to production. On the other hand, SREs have a perspective of production, so they can make suggestions to the development team to limit the failure rates despite the new changes.

FDM’s DevOps training programme

The FDM DevOps programme is an 11-week course comprising carefully designed modules that target specific areas of learning in the code, build, test, release, deploy, operate and monitor pipeline. The course is intended to provide comprehensive training in the methodologies, principles and strategies of DevOps.

The FDM DevOps programme is split across nine modules, each covering a key functionality under the broader remit of DevOps. These include:

Professional Skills – a combination of key professional skills including report writing and presentation skills, written and verbal communications and the fundamentals of collaboration and teamwork. The foundation module also introduces GDPR (General Data Protection Regulation) and Cyber Security – both critical elements of a DevOps project.
SQL
UNIX
Agile/ Scrum
Software development
Automation testing
Infrastructure and cloud technologies
IT operations and information security
DevOps and CICD

Consultant Insight

Xavier Vella is an FDM consultant presently placed with a large Australian Financial Services institution. Speaking of his experience within the DevOps space, he says:

‘Currently working with a large financial services client, I see DevOps as the most integral cog in the technology space – maintaining a healthy platform through monitoring and analysing data, automating processes and clear communication allows for a consistent approach to collaboration across the business. Since starting my placement, I have gained exposure to large scale cloud platforms and DevOps tools such as Google Cloud Platform, Kubernetes, Kong, New Relic, Terraform, CodeFresh and more recently Istio. I look forward to further advancements in the space and continuing to play an important role in software development and deployment.’

Resource : https://www.fdmgroup.com/blog/sre-vs-devops/

6Jan, 2023

Top 5 Most In-Demand Tech Skills for 2023

The technology industry is booming and there are plenty of exciting opportunities out there for tech professionals in the UK, offering high earning potential, job satisfaction and security. And since it’s very much a candidate’s market in the tech industry, job seekers have the opportunity to find a role that truly ticks all their boxes. In fact, according to a Business Wire survey, over half of tech professionals feel comfortable enough in their skills and current market prospects to change jobs!

This puts tech candidates in a very powerful position, as a record number of employers are now on the lookout for the top tech talent to fill their skills gaps. We reveal the top five most in-demand tech skills for 2023 and a few tips on how to get started in the technology industry – even if you have no experience at all.

Top 5 tech skills employers are looking for in 2023

1. Data Storytelling

According to Forbes, data communication and storytelling will be two key skills to have this year, as an increasing number of jobs will require teams to work with data. But this will mean more than just data handling and interpretation. It includes data collection, preparation, visualisation, analysis and storytelling. Essentially, the focus will be on transforming data into digestible and useful insights to be shared and, most importantly, understood across teams and external parties – be that stakeholders or customers!

This could include additional skills such as producing data reports, designing creative visualisations using tools like Tableau or PowerBI, or delivering engaging presentations.

2. Cybersecurity

Cyber attacks and data breaches are on the rise and businesses are beginning to feel the financial impact of this. Especially with many employees now working remotely, using their own internet networks and electronic devices, there is an even greater threat posed to businesses and their data. As a result, many are falling victim to hefty fines, suffering from reputational damage and losing customer trust.

In order to address the issue, businesses are on the lookout for talented cybersecurity experts to join their teams, however, not necessarily just in their IT departments. With the increase in cyber threats becoming a serious matter, businesses will expect each and every employee to be well-versed in cybersecurity risks and best practices, whether that’s in the finance, sales or marketing team.

That being said, cybersecurity specialists will still be in high demand to work on larger, more complex projects, such as handling sensitive data, dealing with cloud migrations and protecting a company’s IT infrastructure. In fact, it is estimated that an incredible 10 million jobs will be needed in cybersecurity in 2023 alone. So, now’s the time to upskill yourself!

Are you interested in Risk, Regulation & Compliance (RRC)? Kickstart your RRC career today.

3. Machine Learning (ML) and Artificial Intelligence (AI)

In recent years, Machine Learning (ML) and Artificial Intelligence (AI) have become a huge part of our daily lives – whether that’s talking to a human-like chatbot online or asking Alexa to play our favourite song. It is predicted that global spending on AI technology will top $500 billion in 2023, as many businesses look to adopt these technologies, which means an increase in demand for ML and AI experts.

Key essential skills for those who want to work in Machine Learning and Artificial Intelligence include domain knowledge, programming languages, and predictive and data analysis. Showing no signs of slowing down, updating your skill set and learning more about ML and AI could be a smart move for 2023!

4. User Experience (UX) Design

With the acceleration of digital transformation, technology has become a part of our day-to-day lives, no matter who we are and what we do. As such, it is essential that tech is accessible to all and designed with the user in mind.

UX Designers are responsible for making sure technology is user-friendly – whether that’s reconsidering font size and style to improve a mobile banking app, categorising article themes to help users find what they are looking for on a blog, or adding a favourites function on an e-commerce shop. Without UX Designers, technology would be difficult to use and people would be less likely to buy it. In fact, every $1 invested in UX design brings $100 in return on average, so it’s a no-brainer for many businesses.

Some of the skills required for a UX Designer include conducting market and audience research, creating user personas, designing wireframes and carrying out testing. Although coding knowledge is not essential to the role, a solid understanding of programming languages could give you a competitive edge in the job market!

5. Cloud Computing

Gartner estimates that global cloud spending will reach $591.8 billion in 2023, up by over 20.7% compared to the previous year. And with 82% of businesses considering cloud migration as an essential step in their digital transformation, cloud computing will play a vital role in modernisation and growth for organisations across the world. However, to facilitate this expansion, businesses will need to hire the very finest cloud professionals, who are comfortable with programming languages, such as SQL and Linux, database management, AI and ML and cloud technologies, like AWS, Google, Oracle and Microsoft.

Does this sound like the right fit for you? FDM has teamed up with AWS to offer a full-time skills development programme to help you on your way to becoming a successful Cloud Computing Engineer – no matter your academic or professional background,

Resource :

5Jan, 2023

Cybersecurity Statistics and Predictions for 2023

The past few years have witnessed a surge in cyber threats, including data breaches, ransomware attacks, and DDoS attacks. As CIOs navigate the challenges of remote work, the pandemic, and geopolitical issues, it’s more important than ever to stay vigilant against these threats. By examining the current threat landscape and considering recent statistics and predictions, we can get a clear understanding of where the majority of attacks are occurring and take steps to protect the enterprises. In this blog, we’ll discuss the top highlights of 2022 and what we can expect in 2023, along with relevant cybersecurity statistics.

2022 At a Glance

Cybersecurity remains a top priority for CIOs across the globe as threat actors find new ways to infiltrate a network and exploit sensitive information. Here are some of the top highlights from 2022:

Investment fraud was the most expensive form of cybercrime, with an average of $70,811 lost per victim. Top attack vectors, according to IBM, were compromised credentials (19% of all breaches), phishing (16%), and cloud misconfiguration (15%).

Statista predicts cybercrime costs to skyrocket from $8.44 trillion in 2022 to $23.84 trillion by 2027.

The average data breach cost is rising, the average cost of a data breach has increased from $4.24 million in 2021 to $4.35 million in 2022. This represents a 12.7% increase from the 2020 average cost of $3.86 million.

Kaspersky’s DDoS Intelligence system noticed 57,116 DDoS attacks in Q3, 2022.

This is only the tip of the iceberg. 2022 has seen a massive surge in cybercrimes, which are expected to grow in the coming years. So let’s see what the future of cybersecurity holds.

Cybercrimes Are Increasing at an Alarming Rate Globally

Cybercrimes have been at an all-time high. According to Cybersecurity Ventures: “Cybercrime costs include damage and destruction of data, stolen money, lost productivity, theft of intellectual property, theft of personal and financial data, embezzlement, fraud, post-attack disruption to the normal course of business, forensic investigation, restoration and deletion of hacked data and systems, and reputational harm.”

Global cybercrime cost is expected to rise by 15% YoY over the next five years, reaching USD 10.5 trillion annually by 2025, up from USD 3 trillion in 2015.

Data breaches are at an all-time high, with roughly 15 million data being exposed during the third quarter of 2022.

Education/research, government/military, and healthcare sectors are the top 3 sectors hurt by the increasing attacks of cybercriminals, as noted by CPR with 2,148, 1,564, and 1,426 average weekly attacks, respectively.

Ransomware Continues to Escalate

Ransomware has repeatedly broken the news headlines, yet it remains one of the biggest threats to organizations.

Not only is the number of ransomware crimes increasing, but it is also becoming more complex. Earlier hackers encrypted the data and demanded ransom to release it, but now they’re threatening companies to pay the ransom, or the hackers will sell their data.

Cybereason surveyed 1,400 global cybersecurity professionals and noted that:

73% of organizations suffered at least one ransomware attack in 2022.

Supply chains are being exploited for infiltrating target networks, as 64% of companies believe ransomware gang made their way into their network via one of their business partners or suppliers.

35% of companies had to face C-level resignations following a ransomware attack.

According to FortiGuard Labs, ransomware incidents have increased by nearly 1100% over the last year.

Crypto Hacking Is Becoming an Increasing Threat

DeFi (decentralized finance), the primary protocol used in cryptocurrency for investors to lend, borrow, and trade without a central mediator, is being largely exploited by hackers.

Rug pull is one of the major crimes conducted by hackers to exploit DeFi. It is a malicious act where hackers lure investors to invest their money, then either run off with it or sell off their pre-mined holdings. According to The Chainalysis 2022 Crypto Crime Report:

The overall revenue from crypto scams rose 82% in 2021 to $7.8 billion, of which $2.8 billion came from rug pulls.

Over $3 billion were stolen in 2021 due to increased Defi (decentralized finance) thefts.

Nearly $3.2 billion in cryptocurrency was stolen in 2021.

Zero Trust Is Getting Embraced

The zero-trust security model has gained significant traction in recent years, especially after the onset of remote working. This mode prioritizes verifying users and devices before granting access to network resources.

Gartner predicts that by 2025, 60% of organizations will have implemented Zero Trust as their primary security model.

IBM says that the share of organizations embracing zero-trust grew from 35% in 2021 to 41% in 2022. And organizations not deploying zero-trust will incur an average of USD 1 million greater breach cost compared to those with the technology deployed.

80% of respondents in a Statista survey plan to adopt zero trust in the future or have already adopted it.

Healthcare is starting to embrace zero-trust, with 37% of companies implementing it in 2021 and 58% in 2022.

Operational Technology Will Need to Be Secured

With the increased adoption of technology comes the responsibility of safeguarding it. The threats to OT infrastructure not only cause damage to the organization but also hurt human beings and the environment.

Sectrio’s The IoT and OT CISO Peer Survey 2022 notes that nearly 90% of CIOs reported one major incident in the past year. Most respondents say their operations were halted for over four days, incurring a loss of over $2.5 million.

3% of organizations find technical integration of legacy and aging OT with modern systems the most challenging, according to The State of ICS/OT Cybersecurity in 2022 and Beyond.

Conclusion: How to Prepare for the Future

Cybercrimes are at an all-time high. With threat actors constantly finding new methods to infiltrate and exploit organizations, CIOs globally have to take preventive measures to safeguard their organizations.

Some of the most common, yet overseen methods, are using complex passwords, regularly updating patches and upgrading software, giving cybersecurity training, using anti-ransomware solutions, and more go a long way in keeping organizations safe.

Not only this but employing security solutions that fit best for your enterprise is essential.

To know how Array can help you protect your enterprise from malicious threat actors, reach out to our sales team today.

Resource : https://www.cxotoday.com/specials/cybersecurity-statistics-and-predictions-for-2023/

5Jan, 2023

Cybersecurity trends in 2023 that will directly impact everyday life

The scale of cyberthreats are growing, spilling into the mainstream. In 2023, expect the spotlight to add pressure to businesses that have underinvested in security.

There are a few certainties in cybersecurity: ransomware will cause headaches for companies; third parties will spark cyber incidents; and every December, cybersecurity analysts will put together lists of their predictions and trends they believe will have an impact in the coming year.

Most of the predictions are designed to help organizations build out their security programs, but every so often a trend will build slowly over time until its impact is clear.

Sometimes these trends will reach far beyond an individual company and impact society at large.

Here are some of the biggest trends Cybersecurity Dive is watching this year. Are there any security patterns you are watching closely? Email us at cybersecurity.dive.editors@industrydive.com.

The global impact of state-sponsored activities

State-sponsored threats trend every year, but as we begin 2023, those threats have a different, more menacing, feel to them. The countries responsible for much of the state-sponsored activity — Russia, China and Iran — are embroiled in conflict.

“In the past year, we’ve seen [Russia’s] invasion of Ukraine; a worsening of the relationship between China and the West combined with tightening control by Xi Jinping and further pressure on Taiwan; and a growing concern in Iran about dissident activity and pressures on the regime both internally and abroad,” said Mike McLellan, director of intelligence for the Secureworks Counter Threat Unit.

All those factors affect state-sponsored threat group tasking and activities and will be reflected in what they do in the coming year.

“While cybercriminal threats such as ransomware are an ‘equal opportunity’ risk for organizations lacking robust cybersecurity defenses in all sectors, state-sponsored threats can be more targeted,” said McLellan.

As political tensions rise in these countries, it is expected that nation-state actors will use that to their advantage to broaden their attacks.

China, for example, is often interested in obtaining intellectual property from high-tech targets, and there is concern that other Russian groups will carry out large-scale covert foreign intelligence gathering activities, spurred by concerns about Russia’s general standing in the world.

Certain sectors or countries have always been at greater risk of state-sponsored attacks, but 2023 may be the year that risk against critical infrastructure sectors, government, and high-tech companies escalates — especially if a nation-state sees outside interference.

Resource : https://www.cybersecuritydive.com/news/cyber-security-trends/639480/

3Jan, 2023

The cybersecurity industry will undergo significant changes in 2023

The cybersecurity industry will undergo some significant changes in 2023. As more systems get connected, we can expect to see more outages. We probably won’t see a “digital Pearl Harbor,” but we will see more breaches, impact, and fear. How will this reshape the cybersecurity industry in the year ahead?

Consolidation across the infosec industry

Since the infosec sector is “hot,” investment has poured into it as everyone tries to get in on the action. In every area, there are multiple tools; they can’t all succeed. Furthermore, big players will likely shore up their offerings by buying small players. This happens across tech, and as (if) the recessions start to bite, it’s a good time to pick up some bargains. Further, some of the tools aren’t particularly good; all fill a far too tiny niche to gain any real traction. Finally, as budgets crunch, there are likely to be some casualties.

The cybersecurity hiring market will have a reality check

As with number one, infosec jobs are also “hot” and have been for a while. A shortage has led to various certifications appearing – all claiming to help you land that dream job – many of which aren’t very useful in the real world. Tied to this, as budgets shrink, crazy salaries will no longer be paid, which is probably going to mean people think certs are a way to return to the crazy salary, and we end up with this vicious cycle. We have many people in infosec, some of whom need more training/experience for their job. They don’t have it, so they introduce more risk (by making incorrect decisions), which further increases this problem.

Attack surface management tools will vanish

Attack surface management was nice and “buzzwordy”, but it will be consumed by other tools, which do 90% of what those platforms do now. Not to sound cynical, but I suspect most of these are bandwagon plays by VCs to make a quick buck. The tools add one or two features the standard tooling doesn’t have. Hopefully, that’s enough reason for someone to buy those companies. I’m not saying all the products in this space are bad, but I’m wondering how much value they add or why we need to carve this out as a distinct product.

More people will return to the office

Return to the office is inevitable – offices cost money, companies need to get a return from them, and serendipity of ideas doesn’t occur over Zoom. For the past two years, remote access has been critical for companies, and we saw it rise in the areas clients were concerned with. People will return to the office and priorities will likely shift. This, in turn, is likely to lead to remote access systems needing to be patched more vigorously.

The government will introduce more regulations

The government has many good ideas, but unfortunately, they are mainly influenced by all the big players, which means we get practical stuff for 5% of companies. Right now, SBOM (software bill of materials) is very popular, and as per the first point, we already see tools in this space. It’s a good idea for open-source software with libraries we can find, CVEs published for them, etc. But for giant pieces of commercial off-the-shelf software, I’m not sure that’s so easy. Also, that’s going to be a serious overhead for smaller software manufacturers.

At the same time, we will probably see more legislation introduced, some of which might help but needs to be grounded in reality. The private sector will get wind of these and try to “head them off at the pass” (we know of this happening in the past). In the long run, this doesn’t help either since those initiatives end up being for-profit exercises and therefore pay-to-play.

For example, we had some valuable intelligence for an entire sector, went to the organization responsible for sharing info, and offered to provide it for free (literally write it an email, and they can share it). But we were told we could only share the info if we paid $20k to speak at a conference. So, I want to tell you how someone will set your house on fire, but I can only do that if I pay your homeowners association.

Resource : https://www.helpnetsecurity.com/2023/01/03/cybersecurity-industry-2023/?web_view=true

3Jan, 2023

Over 30 WordPress Plugins and Themes Can be Abused by New Linux Malware

A security firm has disclosed a malicious Linux threat that hacks websites built on a WordPress CMS. The malware exploits 30 vulnerabilities in different plugins and themes for WordPress.

Unseen malware variants

According to Dr. Web, the malware targets 32-bit and 64-bit Linux systems, and has remote command capabilities.

If a site is detected using outdated versions of add-ons, the web pages are injected with malicious JavaScript codes. Click on the page redirects uses to pages of hackers’ choice.
The malware, identified as Linux.BackDoor.WordPressExploit.1, can attack a specific webpage, switch to standby mode, shut itself down, and even pause its logging actions.
Additionally, the experts have spotted an updated version of the malware (Linux.BackDoor.WordPressExploit.2) It has a different C&C server, and domain address for downloading malicious JavaScript, and impacts more vulnerabilities.

Infection process

Pages infected with malicious JavaScript act as redirects to the location of the attacker, and always get loaded first irrespective of the site’s original content.
These redirections serve phishing, malware distribution, and malvertising campaigns to avoid detection.
Further, the operators behind the auto-injector could be selling their services to other threat groups.

Ending notes

Owing to its massive popularity, WordPress has always been a lucrative target for cybercriminals. The admins of WordPress websites are suggested to stay updated with the latest available version of the themes and plugins running on the site. Further, replace those which are no longer developed. Finally, always use strong passwords and enable two-factor authentication.

Resource : https://cyware.com/news/over-30-wordpress-plugins-and-themes-can-be-abused-by-new-linux-malware-8fbd82e6

29Dec, 2022

Top 10 Best IoT Security Tools – 2023

Top 10 Best IoT Security Tools

AWS IoT Device Defender
Appknox
Palo Alto Network
Azure Sphere
Microsoft Defender for IoT
Forescout Platform
Verizon IoT Security
Verimatrix
Trustwave
Armis

1. AWS IoT Device Defender

An easy-to-perform audit that scans an entire group of AWS IoT devices to find any type of gap in your IoT network.

one of the best Traffic monitoring IoT Security Tools that can be run using ML models or your own defined actions against malicious IPs.

It helps you implement consistent security policies across your AWS IoT device fleet and makes it easier to respond to attacks.

The AWS IoT Security Team continuously updates its knowledge base of security best practices. All data is also implemented into the tool to provide the best possible solution to IoT network vulnerabilities.

Pros	Cons
Integration with API	Integration with API is a little difficult

2. Appknox

Appnox and IoXt have partnered to bring security to IoT devices. All users must follow ioXt security promises to keep their devices safe.

The eight principles are:

Do not set a default password on the device (i.e. change the default password).

Interface security is provided by the manufacturer against security attacks. Authentication methods are stricter.

Encryption is implemented on the device and many layers of encryption are performed to keep your connection and data secure. Device certification profiles are checked for basic security measures.

The latest updates for your device from the manufacturer are sent to you and updated for known vulnerabilities.

It has an automatic security update feature that makes security updates available to users, and the manufacturer is responsible for security updates, validation, and deployment.

Manufacturers must have good vulnerability reports and act appropriately (that is, patch all vulnerabilities) according to the vulnerabilities found in the reports.

The time when the security update will be fixed and users will be notified of the expiration date.

Pros	Cons
Easy and scalable.	High Cost
Industry standards test cases and good security.	you have to update your tool with other test cases
	Api Scans need improvement

3. Palo Alto Network

Palo Alto Network is the industry’s first complete IoT security solution, providing a machine-learning approach to detect any anomaly.

This tool uses a zero-trust system and policy based on risks for your IoT network to prevent any kind of blind spots in your network.

The unique combination of the NGFW and IoT visibility enables context-aware network segmentation as a result of which the risk exposure is reduced.

Pros	Cons
very high throughput and low latency	It is costly
Very easy for establishing a VPN and implementing allow/deny rules.	logs are saved for one week, which can be improved

4. Azure Sphere

The Azure Sphere IoT Security Tool is a high-level application platform that provides security for internet-connected devices (IoT devices).

The Azure Sphere has an MCU (microcontroller unit). It is a custom, high-level Linux-based operating system, and cloud-based security service that provides continuous, updatable security.

I am using the Azure Sphere security service from Azure Sphere. Connectivity to the cloud and web is secured to the MCU.

This service ensures that devices are only booted with genuine, genuine software and also provides a channel through which operating system updates are automatically performed. Protection against many possible errors.

Pros	Cons
One Stop Shop	Monitoring Response is Slow
Low-cost option with high-quality security

5. Microsoft Defender for IoT

Microsoft Defender for IoT is an integrated security solution for identifying IoT (Internet of Things) and OT (operational technology) devices, vulnerabilities, and threats. And all of this can be centrally managed with the help of Microsoft Defender for IoT.

Microsoft Defender for IoT can be deployed in a hybrid environment connected to Azure or completely on-premises.

Microsoft Defender for IoT also provides lightweight micro-agents that support standard IoT operating systems such as Linux and RTOS for IoT device makers. It also helps ensure that security is built into IoT devices.

Pros	Cons
They have a good UI and the features are very useful.	Setting Up is a little difficult
Easy to Use.
Easily binds with cloud-based IoT network.

6. Forescout Platform

A unified platform that discovers all devices on the network (IoT, IoMT, OT, or IT devices) whenever they connect to the network.

It also classifies and segments all devices based on a three-dimensional taxonomy (device type, operating system, and model).

Takes automatic action on every red light and eliminates time spent resolving alarms.

Proven scalability with multiple deployments of over 2 million devices and over 1,000 locations.

Pros	Cons
User management is very easy with this tool	due to the license the cost gets higher.
Good Visibility in the tool	service are chargeable every time

7. Verizon IoT Security

IoT Security Credentialing platform of Verizon provides a comprehensive approach to the security of Iot Devices.

IoT Security Credentialing offers three layers of protection, with an over-the-top layer of security for devices and apps, data encryption, and trusted user and device authentication.

The ThingSpace platform provides tools to test and manage the devices and apps on the Verizon Platform. You can also scale a prototype you want to implement on an enterprise level, with the help of ThingSpace.

Verizon IoT Security provides a lot of different approaches to IoT Security such as:

IoT Security Credentialing

ThingSpace for IoT

IoT Marketplace

IoT for small business

ThingSpace Marketplace provides one place solution for any IoT solution. You can purchase, activate and manage your devices as your solution and business grow.

IoT for small businesses from its name itself shows that it is made by keeping small businesses in mind they provide two functionalities as follows:

Fleet and Mobile Worker Management
Critical Asset Tracking

Pros	Cons
On-Site Support	Types of Software/Services
Highly Scalable	Remote Support is not that good
On-Premise

8. Verimatrix

This IoT Security Tool Verimatrix software features a shield suite consisting of Code Protection, Whitebox, and App Shield tools that integrate with your IoT device infrastructure to provide comprehensive security.

Verimatrix provides end-to-end security for a wide range of IoT devices including medical devices, smart home devices, and connected cars.

This will also prevent an increase in threats from 5G networks.

With the help of verimatrix Whitebox, your team can design their own custom architecture based on cryptography. This protects your data even if it falls into the wrong hands.

Code Shield Stops and disrupt hackers with the most demanding, market-proven, patented, intelligent, and automated security tools. App Shield injects the solution directly into your app without affecting your application’s functionality.

Pros	Cons
Open Source Component Monitoring	Support is slow to respond

9. Trustwave

Trustwave’s Managed IoT Security helps you scan your network and retrieve asset details.

Trustwave Managed IoT Security can scan APIs, servers, and cloud clusters to better protect your IoT devices.

Trustwave provides database monitoring for implementers and manufacturers who can implement security directly.

With the help of the Digital Forensic and Incident Response Team, organizations can proactively prevent attacks of all kinds.

Pros	Cons
Easy to Use	Takes longer to Compile
Has Advanced Features	A little complicated for a non-technical person
Large user community

10. Armis

This IoT Security Tool is the first enterprise-class agentless security platform to address the emerging threat landscape of unmanaged IoT devices.

Armis provides security for all managed and unmanaged devices. 1000s of fortune companies trust Armis for out-of-band sensing technology.

Armis CIPP Services enable you to quickly leverage Armis Intelligence data for recommended policy changes, incident response, operations management, and remediation.

It also monitors connecting devices in the airspace using peer-to-peer protocols ignored by traditional security products.

Allows automatic disconnection/quarantine of all devices that fail to match the base-level security policy.

Pros	Cons
Create Dashlets in Dashboard	A little expensive
Managing alerts is very easy	Making Policies right according to your need takes a little time.

Resource : https://cybersecuritynews.com/iot-security-tools/

29Dec, 2022

7 High-Income Skills Worth Learning in 2023

Developing these seven skills could lead to more job opportunities and a bigger salary.

Every job requires some combination of workplace skills and technical skills, and chances are, you have already built an impressive skill set derived from your education or past work experience.

High-income skills are tools and expertise that employers tend to value highly and may make it easier to change jobs and even industries, according to a 2022 report from McKinsey & Company [1]. These job skills may be rare, and they’re often crucial to running a successful business.

As you aim to advance your career or shift your career focus, you may want to find ways to highlight your high-income skills. Depending on your desired career path, you may be able to leverage these skills to reach your salary goals.

7 high-income skills to learn

Below, you’ll find seven high-income skills that you can feature on your resume to help stand out to potential employers. To build this list, we looked at reports forecasting the most in-demand skills through 2030 from the World Economic Forum [2], Pearson [3], Future Learn [4], LinkedIn [5], Glassdoor [6], and Coursera [7].

The skills listed here are all transferable across a number of career paths. As you read this list, consider your career goals, past experiences, and the job descriptions of your desired roles, and notice whether any of these skills may naturally facilitate your path.

1. Data analysis

Analytical thinking and innovation is the top skill forecasted in the World Economic Forum’s Future of Jobs Report [2]. As businesses across industries increasingly rely on data to make informed decisions, they require more employees with the ability to collect, interpret, and share data that can solve their business problems.

People skilled in data analysis may use a range of tools including Microsoft Excel, Google Sheets, SQL, Tableau, R, or Python.

Here are some careers that use data analysis, along with average base pay in the United States as of December 2022, according to Glassdoor:

Job title	Average base pay
Business analyst	$76,147
Data analyst	$67,179
Data engineer	$94,327
Data scientist	$102,994

2. Software development

Increasingly, industries are turning toward technology to advance their business capabilities, and they need people skilled in developing, maintaining, and improving their technological systems. People who work in DevOps or software engineering build, monitor, and control an organization’s technology.

People skilled in DevOps or software engineering may use tools like Git, Docker, Jenkins, or Kubernetes, and may know coding languages like Python, Java, or C++.

Here are some careers that use software development, along with average base pay in the United States as of December 2022, according to Glassdoor:

Job title	Average base pay
Applications engineer	$81,008
Systems developer	$90,943
Software engineer	$90,390
DevOps engineer	$104,148

3. User experience

Hand in hand with technological development comes user experience (UX), which has to do with the way a consumer interacts with a product. People working in UX figure out the best way to present a product to consumers. They may conduct research, design, or help market a product.

Although they still involve some data, UX roles are grounded in design and tend to offer room for creativity, and they require a high level of social perceptiveness—three skills that come up in multiple skill reports [2, 3, 4].

Here are some careers utilizing user experience skills, along with average base pay in the United States as of December 2022, according to Glassdoor:

Job title	Average total pay
UX writer	$98,553
UX researcher	$100,490
User interface (UI) designer	$102,987
UX designer	$105,118
Product designer	$107,400

4. Web development

Web development brings together the fundamentals of software development and user experience, incorporating the technical aspects of the former with the design elements of the latter. People skilled in web development will also be familiar with technical search engine optimization (SEO) in order to design and program websites that meet business needs.

Here are some careers that require web development skills, along with average base pay in the United States as of December 2022, according to Glassdoor:

Job title	Average total pay
Front-end developer	$104,394
Full-stack developer	$110,497
Webmaster	$110,686
Back-end developer	$119,292

5. Project management

Many companies use an organizational structure in which different departments, teams, or team members all work on a singular product or project. A person who is skilled in coordinating efforts across each of those touchpoints is skilled in project management. These team members may be responsible for maintaining schedules, organizing budgets, and communicating with project stakeholders (or various parties interested or invested in the project outcomes).

You can consider “project management” to be a catch-all term for leadership, communication, planning, resilience, and organizational skills—all of which are frequently cited as valuable to employers [2, 3, 4, 6].

Project management shows up in many careers and becomes especially important as you move into managerial positions. However, you can also pursue a career as a project manager. Here are some careers along the project manager path and their average base pay in the United States as of December 2022, according to Glassdoor:

Job title	Average total pay
Project coordinator	$89,374
Program manager	$89,989
Project manager	$93,043
Portfolio manager	$119,373

6. Account management

While project management typically has an internal focus, account management taps into a similar subset of skills to work with people outside of your organization. Often highly valued in sales positions, account management skills enable you to confidently position your company and its products to customers.

Account management skills incorporate both the organizational aspects required to close a business deal as well as the interpersonal skills required to productively negotiate and maintain relationships. They often work with a customer relationship management (CRM) tool like Salesforce.

Here are some careers that use account management and sales skills, along with average base pay in the United States as of December 2022, according to Glassdoor:

Job title	Average total pay
Account manager	$83,999
Business development associate	$88,601
Business development manager	$98,861
Sales representative	$100,310

7. Content creation and management

Content creation and management skills involve storytelling and are often crucial for marketing careers. This skill set incorporates creativity, originality, social perceptiveness, and emotional intelligence. Taking these skills a step further can also mean adding data analysis to your toolbox, specifically honing in on marketing analytics so that you can assess how well an audience is connecting with your content.

Here are some careers that use content creation and management skills, along with average base pay in the United States as of December 2022, according to Glassdoor:

Job title	Average total pay
Social media manager	$76,325
Digital marketing manager	$96,206
Content marketing manager	$107,777
Brand marketing manager	$109,952

Keep learning

You can build many skills through your regular work activities, however, sometimes it can help to bolster your skill set with outside classes or certifications. If you are trying to figure out the best skills for you to increase your earning potential, visit the Career Academy on Coursera. Here, you’ll get an in-depth look at the key skills across several career paths and can find specific online courses for each path.

Resource : https://www.coursera.org/articles/high-income-skills

28Dec, 2022

Cybercrime (and Security) Predictions for 2023

Threat actors continue to adapt to the latest technologies, practices, and even data privacy laws—and it’s up to organizations to stay one step ahead by implementing strong cybersecurity measures and programs.

Here’s a look at how cybercrime will evolve in 2023 and what you can do to secure and protect your organization in the year ahead.

Increase in digital supply chain attacks #

With the rapid modernization and digitization of supply chains come new security risks. Gartner predicts that by 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains—this is a three-fold increase from 2021. Previously, these types of attacks weren’t even likely to happen because supply chains weren’t connected to the internet. But now that they are, supply chains need to be secured properly.

The introduction of new technology around software supply chains means there are likely security holes that have yet to be identified, but are essential to uncover in order to protect your organization in 2023.

If you’ve introduced new software supply chains to your technology stack, or plan to do so sometime in the next year, then you must integrate updated cybersecurity configurations. Employ people and processes that have experience with digital supply chains to ensure that security measures are implemented correctly.

Mobile-specific cyber threats are on-the-rise#

It should come as no surprise that with the increased use of smartphones in the workplace, mobile devices are becoming a greater target for cyber-attack. In fact, cyber-crimes involving mobile devices have increased by 22% in the last year, according to the Verizon Mobile Security Index (MSI) 2022 with no signs of slowing down in advance of the new year.

As hackers hone in on mobile devices, SMS-based authentication has inevitably become less secure. Even the seemingly most secure companies can be vulnerable to mobile device hacks. Case in point, several major companies, including Uber and Okta were impacted by security breaches involving one-time passcodes in the past year alone.

This calls for the need to move away from relying on SMS-based authentication, and instead to multifactor authentication (MFA) that is more secure. This could include an authenticator app that uses time-sensitive tokens, or more direct authenticators that are hardware or device-based.

Organizations need to take extra precautions to prevent attacks that begin with the frontline by implementing software that helps verify user identity. According to the World Economic Forum’s 2022 Global Risks Report, 95% of cybersecurity incidents are due to human error. This fact alone emphasizes the need for a software procedure that decreases the chance of human error when it comes to verification. Implementing a tool like Specops’ Secure Service Desk helps reduce vulnerabilities from socially engineered attacks that are targeting the help desk, enabling a secure user verification at the service desk without the risk of human error.

Double down on cloud security #

As more companies opt for cloud-based activities, cloud security—any technology, policy, or service that protects information stored in the cloud—should be a top priority in 2023 and beyond. Cyber criminals become more sophisticated and evolve their tactics as technologies evolve, which means cloud security is essential as you rely on it more frequently in your organization.

The most reliable safeguard against cloud-based cybercrime is a zero trust philosophy. The main principle behind zero trust is to automatically verify everything—and essentially not trust anyone without some type of authorization or inspection. This security measure is critical when it comes to protecting data and infrastructure stored in the cloud from threats.

Ransomware-as-a-Service is here to stay #

Ransomware attacks continue to increase at an alarming rate. Data from Verizon discovered a 13% increase in ransomware breaches year-over-year. Ransomware attacks have also become increasingly targeted — sectors such as healthcare and food and agriculture are just the latest industries to be victims, according to the FBI.

With the rise in ransomware threats comes the increased use of Ransomware-as-a-Service (RaaS). This growing phenomenon is when ransomware criminals lease out their infrastructure to other cybercriminals or groups. RaaS kits make it even easier for threat actors to deploy their attacks quickly and affordably, which is a dangerous combination to combat for anyone leading the cybersecurity protocols and procedures. To increase protection against threat actors who use RaaS, enlist the help of your end-users.

End-users are your organization’s frontline against ransomware attacks, but they need the proper training to ensure they’re protected. Make sure your cybersecurity procedures are clearly documented and regularly practiced so users can stay aware and vigilant against security breaches. Employing backup measures like password policy software, MFA whenever possible, and email-security tools in your organization can also mitigate the onus on end-user cybersecurity.

Data privacy laws are getting stricter—get ready #

We can’t talk about cybersecurity in 2023 without mentioning data privacy laws. With new data privacy laws set to go into effect in several states over the next year, now is the time to assess your current procedures and systems to make sure they comply. These new state-specific laws are just the beginning; companies would be wise to review their compliance as more states are likely to develop new privacy laws in the years to come.

Data privacy laws often require changes to how companies store and processing data, and implementing these new changes might open you up to additional risk if they are not implemented carefully. Ensure your organization is in adherence to proper cyber security protocols, including zero trust, as mentioned above.

Resource: https://thehackernews.com/2022/12/cybercrime-and-security-predictions-for.html

28Dec, 2022

Modern technology and cyber recovery will intersect in the next generation of attacks

As technology continues to evolve for business and personal use, cybercriminals are also leveraging innovation in the next generation of attacks, according to Experian.

Additional frontiers are a focus for 2023

In addition to the metaverse, hackers will increasingly explore more frontiers, including space and innovative technology like artificial intelligence, come 2023. A new Experian report outlines several predictions to help companies understand where cybercriminals will lurk and how they will attack. These predictions include the following:

Wild, wild west of the metaverse

While embarking on a virtual life journey is appealing to many, it has vulnerabilities. As the metaverse continues to gain momentum, phishing attempts, NFT-related scams and malware attacks have already begun, with potentially more looming in the year ahead. AR and VR devices increase the impact of data breaches as these devices collect large amounts of personal information and user data. This may increase their potential to be hacked and lead to more sophisticated attacks.

Houston, we have a problem

Thinking about the scale of damage that could result from space satellites being hacked is disconcerting, but it’s also a reality we must prepare for in 2023. The combination of a disjointed regulatory environment and more satellites in orbit than ever opens the door for bad actors to exploit the satellites in orbit, or with a big enough satellite, even launch cyberattacks from space.

Imitation that’s not a form of flattery

While influencers of all types may chase exposure, this isn’t the kind they want. Use of deepfake technology by bad actors could be leveraged for more than just funny videos and elevated to create a new level of strategic mischief. Global leaders, business titans and influential industry experts around the world will need to stay vigilant of the misuse of their image and likeness as deepfake technology may be an increasingly popular tool in warfare and in cybercrime.

Resiliency is the key to winning long-term

Among Experian’s predictions is a long-term outlook that the amount of time to detect and defend against a security intrusion will probably not improve significantly over the next 10 years. Organizations still grapple to prevent data breaches with more than 1,200 breaches this year so fari. Unfortunately, according to IBM, it still takes organizations a lengthy 212 days to identify a cyber intrusion and another 75 days to contain it. Strategies to improve detection and containment need to be shored up.

“In assessing the cyber landscape, we pinpointed a preparedness weakness that needs attention,” said Michael Bruemmer, VP, Global Data Breach Resolution at Experian. “The reality is that cyberattacks can’t be prevented 100 percent of the time, but organizations that can discover and thwart cyberattacks quickly will suffer less damage financially and reputationally. We believe there is a shift in mindset needed to focus on resiliency to complement the pursuit for absolute prevention.”

Resource : https://www.helpnetsecurity.com/2022/12/27/modern-technology-cyber-recovery-next-generation-attacks/?web_view=true