• Search for:
    20Oct, 2022
    Cyber Talent Still in High Demand

    Demand for cyber workers continues to surge, according to new data released Tuesday that puts the number of cyber job openings listed in the U.S. between October 2021 and last month at 769,736.

    That’s according to Cyberseek, an analytics platform from the National Institute for Standards and Technology’s National Initiative for Cybersecurity Education, Lightcast and CompTIA.

    That tally is up from the last one reported for May 2021 to April 2022, where there were 714,548 postings, according to a press release from CompTIA. 

    The cyber workforce count for the most recent 12-month period is over 1.1 million.

    For the public sector in particular, 47,114 cyber jobs were listed and 72,599 workers employed.

    “The data should compel us to double-down on efforts to raise awareness of cybersecurity career opportunities to youth and adults,” said Rodney Petersen, NICE director, in a statement. 

    Nine of the top 10 months for cyber job listings in the last decade were in 2022, according to the CompTIA press release about the new data.

    This isn’t the only refreshed picture of the cybersecurity job landscape to look for this week. 

    (ISC)2, a nonprofit cyber membership association, is also set to release their annual cybersecurity workforce study on Thursday, which will contain its own global cybersecurity workforce estimates.

    Increasing demand for cybersecurity talent is “good” in its own way, despite the worker shortages, Clar Rosso, (ISC)2 CEO, told FCW.

    “We need demand to increase because we need organizations to understand their cyber risks and want to do something about it,” she said.

    Rosso also pointed to the impact of workforce shortages that’ve been borne out by her organization’s previous studies. The ultimate result of understaffing: “we don’t get the basics right,” she said.

    In last year’s study, participants cited misconfigured systems, limited time for risk assessments and more as results of understaffing. 

    Rosso’s prescription for the government in particular is to “stop trying to hire the all stars,” she said. “Hire entry level folks from different backgrounds, train them to do this work that you need to get done that’s not getting done and that frees up your more experienced professionals to do the work that requires more experience.”

    Other takeaways from the new CyberSeek data are more specialized fields in cyber, as well as more cyber skills being required in non-cyber specific jobs like auditors and software developers.

    Still, some experts say that there’s more to be done in terms of getting good data on the federal and national cyber workforces.

    A February 2022 report by the National Academy of Public Administration on the Cybersecurity and Infrastructure Security Agency’s cyber workforce programs called for the creation of a Bureau of Cybersecurity Statistics to collect data on the workforce in addition to a list of other cybersecurity items. The Cyberspace Solarium Commission has also issued a similar recommendation for a government office to be focused on cyber data.

    Currently, “we have a lot of data,” said Karen Evans, co-chair of the NAPA report, a former longtime government technology official.

    But estimates of the labor shortage often vary among sources based on how they define the work and what data sources they pull from, said Evans. And currently, efforts like CyberSeek can’t compel the offering up of information the way an official government bureau might be able to.

    Cyberseek in particular gets its workforce numbers using artificial intelligence to analyze data like job postings and career transitions, according to the tool’s website.

    “Now, let’s take it to the next level and have some veracity around the data,” said Evans. “What we need is an authoritative source.”

    Resource : https://www.nextgov.com/cybersecurity/2022/10/cyber-talent-still-high-demand/378618/

    19Oct, 2022
    What are the top 3 email threats today?

    Security was never at the forefront of email design; as a service, email is intended specifically for the sharing of information. For threat actors, email has been a consistent, primary vector for attacks on organizations. From ransomware to phishing scams to business email compromise (BEC) attacks, email is a vulnerable resource that is typically critical for an organization’s infrastructure.

    Here are the top three email-based threats, what they have in common and how you can protect your organization.

    The common thread

    Email-based attacks fall into three broad categories based on methods and goals: phishing, social engineering and malware infection. Each attack can be carried out by other means, such as phone calls, text messages or malicious websites. But email messages remain a convenient and reliable vector for attackers, who often combine two or more of these types of attacks to increase their chances of success.

    Most successful email-based attacks have something in common. They generally involve email spoofing, which is when an attacker fakes the sender’s address to make it seem like an email message comes from a trustworthy sender. You’re more likely to click on a link or open an attachment when you think it comes from someone you know or a company you trust.

    Spoofing is not an attack itself but a means to an end. Fortunately, technological defenses against spoofing called DKIM, DMARC and SPF are free and widely available. Implementing them will go a long way toward making your organization’s email communications, both incoming and outgoing, more secure. You can read more about these defenses against spoofing in our article “How to: Fresh strategies to secure email.”

    Phishing

    Phishing is the most common email threat and the one that’s least likely to disappear with time. It tricks you into handing over private bits of information such as account usernames, passwords, email addresses, credit-card numbers or Social Security numbers.

    The phisher fools you by using technology to impersonate a trustworthy entity, which can be a well-known company or a workplace colleague. Malware is rarely involved, and there’s little personal interaction. The best phishing scams blend into your daily routine so that you never notice anything is wrong.

    In an email-security study conducted by CyberRisk Alliance in early 2022, 60% of CISOs and other IT managers surveyed cited phishing and spoofing as among their top three email-security concerns, right behind ransomware. And Microsoft in July 2022 found that a phishing campaign had targeted 10,000 companies with the aim of committing BEC attacks.

    In the most common scenario, a phisher’s email message tells you there’s something wrong with one of your accounts and that you need to log in immediately. The message includes what seems to be a link to the account login page but is really a clever mockup. As soon as you type in your credentials, the attacker has them.

    Phishing can also be done via SMS text messages, in which case it’s called “smishing,” or through voice calls, i.e. “vishing.” But phishing first arose with email messages, which are still the primary vector of attack.

    Targeted phishing attacks aimed at a single person or a small group of people, such as company executives or human-resources or IT staffers, are called “spear phishing.” In these cases, attackers often research their targets beforehand and personalize the malicious messages to make them more likely to succeed.

    “They are no longer sending one-size-fits-all,” said one CISO interviewed by CyberRisk Alliance. “They are researching people to target and tailor their approach to increase the likelihood of a successful attack.”

    While anti-spoofing defenses like DMARC will greatly reduce the number of phishing messages that reach your staffers, they won’t stop them all. If an attacker gets access to an employee’s internal network account, possibly by spear phishing, then they can send phishing emails to other staffers that genuinely come from that employee’s account.

    Your correspondent once fell for an email that seemed to come from an HR staffer and asked all staffers to address a payroll issue. A link in the message led to what looked like the Office 365 login page. Antivirus software blocked the site for some staffers, but other employees weren’t so lucky and had their paycheck direct deposits rerouted to other bank accounts.

    Aside from anti-spoofing protocols, protections against phishing are numerous. Endpoint protection, antivirus software and web browsers block known malicious websites. Multi-factor authentication (MFA) can prevent account takeovers even if a username and password are successfully phished.

    Just as important, however, is employee training. Teach your staffers about how to watch out for phishing attacks and what to do if they fall for one. None of these methods is foolproof, but by combining them you’ll greatly increase your email-security stance.

    “Employees are able to recognize and flag fraudulent emails because we see that in analytics and test them thru simulated phishing emails,” a CISO working in the tech sector told CyberRisk Alliance. (Read more about next-generation training in our eBook, “Don’t Call It Training: Achieving Cyber Resilience Through Workforce Optimization.”)

    BEC and other forms of social engineering

    Social engineering is a new name for old-school confidence tricks that don’t always involve technology. If you’ve ever talked your way into an exclusive party or event you weren’t invited to, that’s social engineering. So are Ponzi schemes and the well-worn “Nigerian prince” advance-fee scam.

    Today, crooks are using high-level social engineering to carry out business email compromise (BEC) attacks, aka “CEO fraud.” They impersonate company CEOs or CFOs and convince employees to pay phony invoices or make wire transfers to random bank accounts. The attacks usually include spoofing and may be facilitated by phishing, but do not generally involve malware; the goal is money.

    BEC attacks can be done in a number of ways, including by sending text messages to staffers after hours (not many people will recognize their CEO’s cellphone number) or by dialing into video conferences.

    “In those meetings, the fraudster would insert a still picture of the CEO with no audio, or a ‘deep fake’ audio through which fraudsters, acting as business executives, would then claim their audio/video was not working properly,” said the FBI in its 2021 Internet Crime Report.

    But the most common vector for BEC attacks is via email. Often, the attackers compile lists of company employees authorized to make payments, which can be obtained from LinkedIn or company websites or harvested by information-stealing malware.

    Then the attackers target employees with spoofed emails that seem to come from the boss and demanding urgent wire transfers to a specific companies or bank accounts. If the employees who get the emails believe the scam and can make the payments, then the money may be gone for good.

    The FBI estimates that U.S. businesses and individuals lost $2.4 billion to BEC scams in 2021, with losses rising 65% from July 2019 to December 2021. The worldwide cumulative damage since June 2016 reached $43 billion.

    “It’s the BEC attacks that are rising most dramatically,” one CISO told CyberRisk Alliance. Another cited “a strange email saying our sales VP authorized this payment invoice” that amounted to “a few ten thousands” of dollars, and thwarted only when an accountant double-checked with the sales VP.

    Anti-spoofing technologies will help reduce BEC emails, as will company policies that mandate multiple staffers signing off on large payments. Again, you may get the best results by training employees to spot BEC attempts, although some may need more training than others.

     “We have a mixture of older and younger employees; the younger employees tend to recognize phishing emails more than our older employees,” a CISO in the education sector told CyberRisk Alliance.

    This training will also cut down on other forms of social engineering, such as when a trusted supplier suddenly seems to demand payment of an overlooked invoice.

    However, a CISO in business and professional services said that even with training sessions, some staffers “still click on things they shouldn’t, open up emails or attachments when they shouldn’t.”

    “If they don’t get a big red warning from the security systems,” the CISO added, “they just don’t think about every email they touch.”

    Malware and booby-trapped attachments

    In 2011, a large information-security vendor was hit by Chinese state-sponsored attackers who sent email messages to just a few people in the company, spoofing addresses so that the staffers seemed to be emailing each other. Attached to the messages was a Microsoft Excel file that exploited a previously unknown vulnerability in Adobe Flash and gave the attackers full control of the employees’ machines.

    The attackers used that access to penetrate the vendor’s networks and compromise its leading security product, which was used by U.S. defense contractors and thousands of other organizations to protect their networks. The security company had to make good with its clients and took a $66 million charge as a result of the attack.

    Email-delivered malware is perhaps the most dangerous email threat of all. It can deeply penetrate an organization’s systems, quietly stealing information for months or even years. If the goal is money rather than information, then it can install ransomware that locks up those systems and demands payment to free them or steal proprietary data and ransom that too.

    Such malware often comes in the form of an attachment that looks innocuous, like an invoice or a resume. The accompanying message may urge that the attachment be opened immediately. In other cases, the message contains a link that takes the recipient to a website that silently tries to install malware through a web browser.

    Aside from anti-spoofing measures, the best defenses against email-borne malware are strong endpoint protection software that automatically scans all email attachments, regular application and operating-system updates, and strict network segmentation and identity and access management (IAM) policies.

    And of course, you should train your employees to be suspicious of emails that come from outside the company — and sometimes those that come from inside as well.

    “We have trained our users to be very paranoid and not only to delete suspicious emails but to be very proactive about reporting suspicious emails,” one CISO told CyberRisk Alliance. “Every user is incredibly skeptical about anything that is even halfway sketchy.”

    Resource : https://www.scmagazine.com/resource/email-security/what-are-the-top-3-email-threats-today

    19Oct, 2022
    What are Digital Certificates?? How It Stops Hackers From Stealing Sensitive Data

    The digital certificates are an electronic credential that binds the identity to the owner of the certificate which can also pair the electronic encryption keys that can be public and private. This mainly uses to encrypt the sign information digitally.

    The main work for the digital certificate is to make sure the public key content, which belongs to the entity which has issues. on the other side, it verifies the person who is sending the message and also provides a message to the receiver; it means that you have successfully created a encode where you can reply to the sender.

    This is encryption technique which gets used by the public and private key. This also supports the distribution and identification. Messages can be encrypted with a public or private key, which would get used to decrypt the data. They also will give the assurance where data gets originated and by whom if there any particular object.

    The receiver will come to know which valid key got used. Mainly, certified authorities commonly trust the third party who can verify and match the public key through identity, emails, and much more.

    This Certificate Authority package works together in one certificate where a public key is included. It gets the information about the encryption algorithms, subject data, digital signature, etc. Everything has to be verified by the certificate authority, and the data range of the certificate has to be considered valid.

    Digital certificate always has to be used by the different types of transactions including email, groupware, electronic commerce, fund transfer, etc.

    Who can Issue the Digital Certificate?

    Any entity has the authority to create its own PKI and can issue the digital certificate. But few cases, the approach can be change and reasonable. Every organization maintains its own PKI for its internal work. The majority of the certificate is issued by the certificate authority (CA).

    They are considered trusted third parties who issue digital certificates so that individuals can extent their trust in the CA, and make it done their digital certificate.

    Types of Digital Certificates:

    There are several types of digital certificate which gets used by the web browser and web server. These all are authenticated on the internet. Digital certificates are mainly linked with the web server for the domain and with the organization. Here you will get several types of certificates those are discussing below:

    1. Domain Validated (DV SSL): This is one type of certificate that offers the latest assurance about the holder. The applicant needs to certificate to demonstrate that he has the right to use this name. This certificate works as an assurance where it proves that the sender is a known entity.
    2. Wildcard SSL: This is mainly used to secure subdomains under a primary domain. You can find cheap wildcard SSL certificate from authenticating resellers. You will get numerous benefits with a wildcard SSL certificate. It can be available in domain and organization validation. 
    3. Organization Validated (OV SSL): This is one type of certificate that provides the additional assurance regarding the holder to confirm the applicant that he has the right on the domain.
    4. Extended Validation (EV SSL):  This is the certificate issued after the applicant provides his identity and gives the CA’s satisfaction. This process includes verification, existence, identity match with the official record, verifying the entity with the authorized domain, confirming everything with the owner, match with an insurance certificate, etc.
    5. Code Signing Certificates: This is mainly used to confirm the software authentication, and files downloaded from the internet. Developer has to sign the software to confirmation about the third party sites which proves that it is not tempered.
    6. Client Certification: The client certificate is a digital ID that makes the individual use another user and one machine to another machine. Usually, when the sender signs the communication digitally, it has to be verified by the recipient and helps the user access the database.

    Beneficial Features of the Digital Certificates:

    Digital certificates have become important due to cyberattacks. Here we will get few features of digital certificate which can help us to reduce the cyber-attack. Those are discussing below:

    1. Security: Digital certificate main work is to encrypt the internal and external communication to stop the attacker from stealing the sensitive data and intercepting the data.
    2. Scalability: This mainly provides the shape and size to the business, which gives encryption quality. These are highly scalable, which means you can easily issue, renew, revoke and use as a secure user device. Everything gets manage through the centralized platform.
    3. Authenticity: This is crucial thing, ensuring that the authenticity of the online communication so that cyberattack should not be widespread. You also need to make sure that the user’s message always reaches their intendened recipient.
    4. Reliability: It is mandatory that only publicly trusted Cas can issue the digital certificates. It needs rigorous vetting that makes sure that the hackers are not fake and you are not the victim to use this digital certificate.
    5. Public Trust: Digital certificate confirm that website is genuine and every email are authentic. This is entirely going on in public trust, and it assures the client that he is dealing with a genuine company which has value and security.

    Which Type of Security do Digital Certificates offer?

    The digital certificate works as a verification step which mainly use to send confidential data which needs protection. Now the discussion is what benefits you can expect from the digital certificate user; here you will get the points.

    1. Data Confidentiality: The user can easily depend on the digital certificates, and the organization can easily communicate with indeed. Without a public key, no one can access the document or message whichever sender has sent her digital certificate. It assures that sender’s data will never be lost, leak and stolen.
    2. Data Integrity: Digital certificate ensures that whichever information has sent must be free, and get tempered while transmission for the intended recipient. When everything gets agreed, only the signing authority’s work comes, and after it gets signed contract cannot be changed.
    3. Access Management: This type of digital certificate makes sure that only involved parties access of the documents and other files.
    4. Transaction Receipts: When you use the digital certificate it lies on the non-repudiation, it means that the sender and receiver cannot deny that messages has got exchanged.

    Final Thought

    Since, cyber-crime is increasing continuously, our daily life at risk, but the technology users are the gainer. In this case, a digital certificate helps the organization to have safe communication by engaging the online transaction.

    Resource : https://cybersecuritynews.com/digital-certificates/

    18Oct, 2022
    How to safeguard your brand from spoofing attacks

    It can take years of work to establish a world-renowned brand, but just one malicious email to destroy it. 

    Email- and web-borne brand exploitation attempts are on the rise. Mimecast’s 2022 State of Email Security Report found that more than 90% of organizations experienced an email- or web-based spoofing attack in the previous 12 months. These types of attacks are increasing for 46% of organizations, compared to just 19% who say they are declining.

    Brand spoofing attacks can lead to the loss of revenue and consumer trust and have long-term negative outcomes. That means cyber risk is business risk, and protecting your brand is paramount to protecting your reputation and bottom line. 

    Brand Spoofing: Offensive and Defensive Tactics 

    There are two primary ways in which threat actors execute brand spoofing attacks. The first occurs within an organization, where, under the guise of remote IT support, attackers are capitalizing on remote work environments to pose as the organization and its suppliers in the hopes of luring end-users into clicking on links, providing credentials, or installing (malicious) software. The second occurs externally, where threat actors impersonate brands to attack supply chains, customers, and partners, often making contact through email and directing victims to spoofed web domains. These attacks are typically camouflaged as donation drives, unauthorized purchase notifications, closeout sales, or offers tied to timely geopolitical and other events.

    Brand spoofing attempts pose a major threat to organizations. However, there are several precautions brands can take to shore up defenses against these attacks. Below are three critical steps to a strong brand protection framework that will help maintain customer trust and keep your work protected: 

    • Understand your web and domain real estate. Brands need a firm grasp on their owned web assets and domains to understand where key vulnerabilities exist. Where possible, consolidate domains under a single registrar so your IT and security teams can implement protections and remediations effectively. Vulnerabilities should be patched early and often, backed by strong processes and technologies, and organizations should ensure all new domains and web assets are properly secured from the onset. 
    • Implement DMARC. The Domain-based Message Authentication, Reporting, and Conformance (DMARC) email authentication standard is a necessity for brands looking to prevent domain spoofing and thwart attackers attempting to trick customers and suppliers into thinking that a malicious email is legitimate. Deploy DMARC protections to fortify your preexisting security solutions, and expect your trusted suppliers and partners to do the same. 
    • Reduce your attack surface area as much as possible. In addition to the above, there’s a lot that goes into reducing your attack surface: understanding threat actor TTPs, implementing streamlined processes, leveraging best-in-class solutions, investing in security awareness training, and more. To maximize efficacy, ensure your cybersecurity framework is holistic and clearly defined. 

    Work Smarter with AI and Tool Consolidation

    Organizations can look to artificial intelligence (AI) and tool consolidation to simplify processes, augment overworked security teams, and drive efficiencies. AI-powered email security solutions leverage a fusion of threat intelligence and real-world contextual data to help organizations protect their brands swiftly and effectively. 

    AI can ingest a high volume of data from a variety of sources and fuse that with your brand and digital assets to streamline threat detection and remediation. By automating the analysis of both incoming threats and shared API intelligence from the external world, it can detect common twists of your brand’s name and domains and then alert employees in real time. A strong feedback loop is critical here for continuous fine-tuning. This helps identify new threat actors and weed out false positives so that the AI isn’t flagging legitimate emails, thus causing security efforts to lose credibility and spur frustration among employees. 

    AI is crucial in augmenting labor for ever-changing and often understaffed security teams. It enables organizations to take their security team’s expertise, automate it, and codify it to allocate their time and resources to more difficult challenges that strongly influence security posture. 

    In addition to AI/ML adoption, security teams should also prioritize tool consolidation to simplify their tech stacks. On average, companies with more than 10,000 employees leverage 45 different security monitoring tools, many of which go unused, underused, or otherwise forgotten. Communication is key, and it’s important that your separate security solutions can operate in tandem and complement one another to reduce friction. For example, if you detect a spoofed website, how can you ensure web and email traffic to that malicious site is proactively blocked?

    An early warning system should be strung together by your out-of-the-box integrations or APIs and custom programming to “create your own recipe” and find immediate value. By leveraging APIs in your ecosystem of controls, threat intelligence can be cross-pollinated among endpoint solutions, firewall solutions, and other threat detection stacks so they can be enriched and more effective in protecting your brand. 

    Articulating Cyber Risk as Business Risk to Get Buy-in 

    People, processes, and technology make up the age-old holy trinity of a strong cybersecurity framework. The framework’s goal is to protect the organization’s communications, people and data, which can directly impact your brand if not protected. However, there can often be a disconnect that gets in the way of protecting your brand and keeping your communications, people and data safe. The disconnect is that the teams tasked with building brands are often siloed from the teams tasked with protecting them. So how can we bridge the gap and make stakeholders in non-security roles prioritize brand exploitation? 

    The key is identifying commonalities among stakeholders and articulating risk in terms that resonate with their priorities. For example, consider asking your chief marketing officer: “On a scale of one to five, with five being the worst thing that could happen to this company, what’s your five? Is it losing X number of customers or potential deals? Losing Y dollars? Long-term reputational damage?” Once you know what that “five” is, you can identify common goals, provide real-world examples, and translate the technical aspects of IT security into business terms. 

    After securing collective buy-in among key stakeholders, be sure to document and execute on that commitment, including it as a key metric in quarterly meetings with senior leadership or your board of directors. Accountability for the quality and consistency of risk mitigation efforts will be paramount moving forward; in fact, Gartner forecasts that by 2026, 50% of C-level executives will have performance requirements related to risk built into their employment contracts. 

    There’s no denying that brand spoofing is a significant and impactful attack vector. While there’s no silver bullet to eliminating the threat of brand impersonation attacks, organizations can leverage a strategic mix of processes, technology, and people to proactively mitigate risk from all angles. In doing so, they safeguard the hard-earned legacies and critical reputations of their brand.

    Resource : https://www.securitymagazine.com/articles/98492-how-to-safeguard-your-brand-from-spoofing-attacks

    18Oct, 2022
    Top outcomes organizations want from their security investments

    Preventing data breaches and safeguarding remote workers are among the top security priorities and outcomes organizations want from their security investments, according to WithSecure.

    outcomes security investments

    WithSecure polled over 3,000 IT decision makers, IT influencers, and top management from organizations in 12 different countries about a variety of business and cybersecurity topics, including their top priorities and challenges in the near future.

    Preventing data breaches was the most common technical security priority for respondents, with over a third placing it in their top five. It was the most common priority identified by respondents from Canada, Finland, Japan, the Netherlands, the UK, and the US, as well as respondents working in healthcare, IT, manufacturing, the public sector and education, and trade and commerce.

    Other common priorities included ensuring protection against malware/ransomware, preventing advanced email-based threats such as phishing or business email compromise, ensuring security of cloud-based collaboration applications such as Office 365 and Salesforce, and ensuring the security of an increasingly diverse pool of devices, services, and software.

    Safeguarding their remote/hybrid workforce was the most common business security outcome sought by organizations. It was the most identified outcome by survey participants from Canada, Finland, the UK, and the US, as well those working in manufacturing, public service and education, and professional services (such as media and advertising, tourism, etc.).

    According to WithSecure Cyber Security Advisor Paul Brucciani, what seems to be missing from the identified priorities is the importance of security in organizations’ everyday work.

    “The mundane stuff that has a real lasting impact is overlooked because it needs to be driven internally and is often very difficult. Most organizations are missing out on these factors and they aren’t among their top priorities,” said Brucciani. “Building a security culture, for example, isn’t something that can be outsourced, and it won’t happen overnight.”

    While safeguarding remote workers was the most frequent business security outcome identified by respondents, creating a strong security-first culture was also in the top five. Other common outcomes highlighted by respondents included increasing the speed and effectiveness of their response to cyber security incidents, increasing their understanding of cyber security threats/risks and awareness across the organization, and securing business continuity without interruptions.

    “Security permeates every facet of an organization. CISOs need to produce multiple outcomes rather than focus all of their efforts on one thing at a time,” said Brucciani. “It is a tough challenge, but with suitable planning, preparation, and assessment, organizations can use security to accomplish their strategic goals.”

    Resource : https://www.helpnetsecurity.com/2022/10/17/top-outcomes-security-investments/?web_view=true

    15Oct, 2022
    Policy-as-code approach counters ‘cloud native’ security risks

    So-called ‘cloud native’ IT architectures are creating new threats for organizations, just as they look to update their technology infrastructure, security researchers have warned.

    Over half of developers and security professionals expect the risks to their organizations to increase over the next year, according to research from developer security tools vendor Snyk. The drivers include cloud-native threats and, especially, control plane compromises.

    Other potential problems include misconfigured cloud resources, as well as compromised credentials.

    Speaking at the recent International Cyber Expo in London, Ashish Rajan, principal cloud security advocate at Snyk, explained that security breaches are no longer only about data. Increasingly, criminal groups are also looking to steal or expose credentials, including cloud infrastructure credentials.

    Rajan cited the recent breach at ride-hailing company Uber, which used social engineering as part of an attack that ultimately succeeded in gaining access to the company’s credentials for Amazon Web Services and Google Workspace.

    “It’s not just a breach, a release of records, they also shared the AWS and Google Cloud credentials on the internet as well,” he said. “We are actually talking about data breaches creeping into our cloud environment or even broader production environments as well.”

    Credentials targeted

    Attackers are searching for credentials for cloud services by searching for ‘open S3 buckets’, blob storage or other open storage sites, as well as GitHub repositories, SSH [Secure Shell] and SSL vulnerabilities, and even posts by developers on sites such as Stack Overflow. “People are finding easier targets,” Rajan said.

    This is forcing developers to pay more attention to both application security and cloud security, the speaker argued. Although organizations and their developers increasingly understand the need for application security, cloud security is too often treated separately rather than as part of the same problem, he asserted.

    “In my previous company, we had a product security team and we had cloud people. But they weren’t on the same team. It didn’t make sense. We were still protecting this one application,” said Rajan.

    Cloudy with a chance of breaches

    And the situation is made more difficult still by the ‘shared responsibility’ model of cloud security. Too often, contended Rajan, developers and their managers rely on the cloud provider’s security measures, rather than ensuring that their infrastructure and code is secure.

    According to Snyk’s 2022 State of Cloud Security Report, 80% of organizations experienced a “serious cloud sec incident” during the past year. Of those, 33% suffered a cloud data breach, and 26% a cloud data leak. A further 27% detected an intrusion into their environment.

    Catch up on the latest DevSecOps-related news and analysis

    The research also found that companies that use the cloud to host applications that had migrated from a data center were the most likely to report serious cloud security incidents: 89% did so during the past year.

    That was higher than the total for organizations using the cloud to build and run in-house applications (73%) or those hosting third-party applications (78%).

    Infrastructure as code

    To counter this, Rajan suggests that developers should follow five fundamentals of cloud security. These are knowing the operating environment, focusing on prevention and secure design, empowering developers, using policy as code to align with security requirements and automate compliance, and ensuring security teams are “measuring what matters”.

    To adhere to these fundamentals, organizations should be looking to ’shift left’ and build in security checks earlier in a project’s timeline. Firms should map out a cloud secure development lifecycle, using infrastructure as code (IaC) tools and CI/CD pipelines. And organizations can take this a step further by defining security policies within IaC.

    This, Rajan said, removes, or at least reduces, one of the most common causes of cloud security failures: human error.

    “What’s the policy look like? Can I define the policy as IaC? That’s where a lot of people have found that you can reduce credentials being leaked or over-privilege, or misconfiguration of resources, as well as having identity not in control,” he said. Policy as code allows organizations to apply their security rules, whether they use a single cloud platform, or two or even three, added Rajan.

    Resource : https://portswigger.net/daily-swig/policy-as-code-approach-counters-cloud-native-security-risks

    13Oct, 2022
    What Is Workload Rate in Hard Drives?

    Before picking up a new hard drive or solid-state drive, it’s worth understanding how workload rate will impact their performance. Here’s what you need to know about this mysterious attribute and why it’s so important.

    What Is Workload Rate?

    Workload rate is a term used to describe how much data can be transferred to or from a hard drive before its performance begins to deteriorate. Most manufacturers advertise the annual workload rate, giving users an idea of how much data can be transferred in a year before running into issues or (possibly) voiding the warranty.

    The exact formula for determining annual workload rate varies slightly by manufacturer. Seagate, one of the most-trusted producers of hard drives and SSDs, calculates its annualized workload rate as follows.

    Why Does Workload Rate Matter?

    If you’re moving massive amounts of data on a regular basis, workload rate is just as important as the actual capacity of your drive. A 10TB drive with a 180TB/year workload rate might not cut it if you’re regularly moving large files. For example, you’d only be able to move a 1TB file 180 times over the course of a year—something that might pose serious issues if you’re a photographer or filmmaker who deals with massive files on a regular basis.

    Casual users or folks who move small files probably won’t be impacted by workload rate. Instead, it’s typically professionals, small businesses, and gamers who butt up against the limitations of their drives. Workload rate is particularly important for NAS hard drives, which have multiple users transferring data, thereby increasing the likelihood of exceeding the recommended limits.

    In a nutshell, workload rate is incredibly important for users who frequently transfer large amounts of data from their hard drive or SSD. If you fall into that category, you should be paying close attention to this spec.

    Your hard drive won’t immediately shut down upon hitting its workload rate limit, but it’s highly recommended you do everything possible to stay under this rating. Exceeding a hard drive’s workload rate increases the odds of running into reliability issues down the road and could result in data loss.

    Other Important HDD Terms

    You’re probably familiar with the term capacity and how it relates to hard drives. But understanding how much data your drive can hold is only the tip of the iceberg. Workload rate is often overlooked but, as we’ve seen, can be just as important as capacity—and it’s not the only spec that deserves more attention.

    “Mean time between failures” (MTBF) is a reliability rating for any given hard drive. And unlike workload rate, which is most important for users transferring large amounts of data, MTBF impacts everyone. MTBF is exactly what it sounds like: the mean time before your drive fails.

    Total operational time between failures/number of failures

    Put simply, you’ll want this number to be as large as possible. The bigger the number, the longer your drive will go before running into a failure. Buy a device with a low MTBF, and you could stumble into data reliability issues down the road.

    “Data transfer rate” is another important spec, giving you an idea of how fast the drive can move data from one place to the next. Once again, a larger number is best. SSDs typically offer faster transfer rates than their HDD counterparts, although you’ll pay a premium for the performance.

    Be sure to keep your eyes peeled for these values when picking up your next storage solution.

    Products With Impressive Workload Rates

    There are plenty of products on today’s market that offer great workload rates. If you don’t want to scour through every retailer’s catalog, here are some of our favorites:

    The IronWolf Pro offers capacities ranging from 20TB to 2TB and with a workload rate of either 550TB/year or 300TB/year, a great option for professionals.

    Developed with gamers in mind, the FireCuda HDD offers a 300TB/year workload rate and impressive 255MB/s transfer speeds. The Exos, another product from Seagate designed for professionals and business owners, offers a 550TB/year workload rate. Finally, WD Gold Enterprise is another reliable HDD that’s from Western Digital, boasting a 550TB/year workload rate.

    Resource : https://www.howtogeek.com/832299/what-is-workload-rate-in-hard-drives/

    13Oct, 2022
    Interface shares tips on cyber security for retailers

    As cyber security awareness month becomes a focus of discussion in October, Interface Systems, a leading managed service provider delivering business security, managed network, UCaaS, and business intelligence solutions to distributed enterprises, shares best practices on how to prevent retail cyber-attacks and mitigate fraud.

    As retailers integrate their digital and physical shopping experiences to future-proof their business models, it’s never been more important to be aware of the cyber security vulnerabilities that can be created by digital transformation. 

    Retail chains face a variety of security challenges, from connected POS (Point of sale) systems and devices to online ordering and delivery applications. Retailers’ data lakes, which combine their customers’ data with credit card information, make them particularly attractive targets for cyber criminals. The consequences of security lapses go beyond legal issues and often result in significant financial loss as customers lose confidence in the brand.

    Securing the Point of Sale

    POS applications are directly connected to credit card data, loyalty management applications, and inventory management systems. They are easily accessible, and retailers often struggle to manage the sheer number of in-store terminals, self-service kiosks, and mobile payment devices. To secure their POS, retailers need to:

    • Encrypt all POS data end-to-end
    • Accept EMV chip cards and NFC (contactless payment) technologies
    • Whitelist applications to run on a POS system
    • Keep their POS software up to date
    • Address PCI-DSS compliance gaps proactively
    • Segment the POS network
    • Physically secure POS devices including mobile POS devices
    • Watch out for unusual transactions
    • Integrate security cameras with POS transactions
    • Securing cloud-based applications

    Retailers are leading the way in cloud adoption and security breaches in cloud applications can have devastating repercussions for retailers. According to the 2022 IBM Cost of a Data Breach Report, the average cost of a data breach in retail in 2022 is $3.28 million. To protect their cloud-based applications, retailers need to:

    • Adopt a zero-trust security model to help prevent unauthorized access to sensitive data.
    • Protect sensitive data in cloud environments using policy and encryption.
    • Invest in security orchestration and automation of response (SOAR) and extended. detection and response (XDR) to help improve detection and response times.
    • Understand the scope of cloud service provider security responsibilities.
    • Organise ongoing security awareness training for all employees.
    • Protecting against loyalty programs fraud

    While loyalty programmes have evolved in the last decade, they have to deal with a variety of sophisticated cyberattacks and scams. The key to stopping loyalty program fraud is to implement multiple layers of protection:

    • Implement a robust data analytics system to flag suspicious transactions.
    • Enforce password policies and encourage multifactor authentication.
    • Limit the personal data needed to enroll in the rewards programme.
    • Regulate access to loyalty management systems and implement a zero-trust security framework.

    Choosing the right partner

    Interface’s managed network services and PCI compliance programme can help retail chains proactively address cyber security threats and accelerate digital transformation. Interface handles design, implementation, and maintenance for all network, security and business intelligence services allowing retail chains to improve security, eliminate operational complexity, and focus on innovation.

    Resource : https://www.securityworldmarket.com/int/News/Business-News/interface-shares-tips-on-cyber-security-for-retailers1

    12Oct, 2022
    6 Important IoT Trends For 2022-2024

    There is currently well over 7 billion internet of things (IoT) devices installed throughout the world.

    That number is expected to rise to over 30 billion by 2025.

    The economic impact of this technology is even more impressive. Deloitte predicts that by 2023, global spending on IoT initiatives will exceed $1 trillion.

    To learn about the most important trends impacting the IoT space in 2022, read on.

    1. IoT Data Feeds AI Models

    Artificial intelligence (AI) and the IoT are natural complements to one another.

    And when combined, they allow for insights that were almost unimaginable before.

    This combination is known as AIoT.

    Searches for “AIoT” have increased by 655% in 5 years.

    Back in 2019, Gartner found that only about 10% of IoT projects were utilizing AI to develop insights.

    But as the IoT installed base grows, it’s inevitable that AI will help parse the reams of data that are collected via IoT devices. And the data will be essential in “training” AI systems.

    By 2025, it is expected that IoT devices will generate roughly 73.1 ZB of data.

    That’s roughly 4x the 18.3 ZB generated in 2019.

    With all this data, the use of AI and machine learning will be essential.

    Because of this, Gartner expects that over 80% of IoT initiatives will be paired with AI by the end of 2022.

    For instance, Voice AI and Vision AI at scale seem to be impossible without the help of the IoT.

    Approximately 74% of consumers between 18-24 report using a mobile phone voice assistant in their home.

    A report by PWC discovered that many members of Gen Z use voice-enabled assistants.

    Younger generations are quickly making the switch to voice-first search.

    And there would be no practical way to analyze the mountains of difficult data produced by this without AI in connection with IoT.

    In retail, companies like Walmart and Amazon are using IoT to manage inventory and make supply chains more efficient.

    Walmart manages about 1.5 billion messages from IoT devices each day.

    They use this data to manage key tasks, like predicting in-store maintenance needs.

    In Canada, the retail giant is partnering with DLT Labs to reduce inefficiency in its supply chain.

    As a result of DLT’s IoT implementation, Walmart Canada claims it has been able to eliminate about 97% of shipping discrepancies.

    Even with these stories of success, it is obvious that the market is still in its early days.

    Gartner found in 2019 that almost nine out of ten businesses said they failed to extract enough value from their data.

    And it’s estimated that about three-quarters of enterprise data are not being utilized.

    Take another example: SenseAware.

    FedEx developed SenseAware in 2016 in order to equip IoT sensors to its delivery trucks.

    But it wasn’t until it partnered with Microsoft that the courier actually developed real IoT use cases.

    SenseAware being used in the field.

    FedEx is now able to utilize the tech giant’s AI capabilities to put the data it gathers into use. And Microsoft is able to train its algorithms on a data pool that would be impossible to collect without IoT.

    All in all, without effective AI, much of the data collected by IoT devices is practically useless.

    2. IoT Platforms Look To Improve Functionality

    With the complicated nature of IoT data collection and analysis, it’s inevitable that applications will come along to help inexperienced businesses cope.

    For instance, spending on IoT software grew by over 24% in 2021.

    While spending on the actual hardware only grew by around 5%.

    While IoT hardware still comprises about 32% of overall spend, IoT software spend is rapidly catching up at 26%.

    It’s obvious that the most important changes are taking place in the software ecosystem that supports IoT.

    As more companies deal with IoT devices manufactured and maintained by a variety of vendors, they need ways to manage the software associated with all of these devices.

    Containerized applications are one way to do this.

    Containers are, simply put, a way to virtualize an entire software ecosystem.

    Specifically, contailers alow developers to observe and understand different operating systems that are working together inside an organization. Which makes them essential for large-scale IoT.

    Searches for “Containerization” have increased slightly by 80% in 10 years.

    In fact, containers are so essential that Gartner predicts that three-quarters of global organizations will be using containerized applications by 2022. That is compared to under a third of businesses using them last year.

    Blynk is a platform that is enabled by containerization.

    Searches for “Blynk” have grown by 8,300% over the last 10 years.

    The company provides no-code software that allows businesses to build APIs to manage and interact with connected devices they use.

    And it’s not just startups or high-tech companies that are creating these apps.

    Automotive companies like Volkswagen are developing IoT apps as well.

    The company’s We Connect app is a way for car owners to use embedded IoT devices to control and monitor their car’s use.

    VW’s We Connect app.

    And while there are a lot of startups in the IoT platform and app market, larger competitors are starting to take notice.

    IoT Analytics found that some of the largest cloud companies (like Microsoft Azure and AWS) have driven the market forward faster than previously thought possible.

    In fact, as a result, the IoT platform market has grown in value from around $300 million in 2015 to about $5 billion in 2020.

    Hyperscalers like IBM, AWS, Microsoft, Google, and Oracle now have about 30% of the market.

    3. IoT Connects Healthcare To Patient Needs

    COVID-19 lockdowns changed the way healthcare was delivered in the U.S.

    Before 2020, there were around 36 million estimated virtual health visits a year.

    This number quickly jumped after the beginning of COVID, with some experts estimated around 1 billion telehealth visits by the end of 2020.

    Searches for “Telehealth” have spiked. But are still well above pre-pandemic levels.

    McKinsey has found that telehealth visits to doctors’ offices and outpatient facilities have stabilized at roughly 38x higher than it was pre-pandemic.

    Telehealth claims per month.

    Now, roughly 84% of physicians also say they provide some kind of telehealth offering for patients.

    This sudden shift has opened up a whole new set of opportunities for the internet of things.

    The industry, dubbed the Internet of Medical Things (IoMT), is expected to be worth over $350 billion by 2027.

    Search interest in “IoMT” has risen by 328% over the last 5 years.

    And McKinsey suggests that roughly 20% ($250 billion) of outpatient and office medical visits could currently be digitized.

    To see how fast the market has grown, look no further than the number of devices in use.

    In 2015, there were about 4.5 billion IoMT devices in circulation.

    By the end of 2020, there were an estimated 20-30 billion IoMT devices being used.

    The total market is wide-ranging and consists of anything from medical device sensors to hospital bed management software.

    For instance, remote monitoring of elderly patients is an area ripe for improvement.

    Remote patient monitoring could prevent countless trips to the doctor’s office as well as catch health issues before they happen.

    AliveCor has created one of the most effective IoMT devices on the market.

    Searches for “AliveCor” have grown by 176% over the last 15 years.

    The company’s Kardia products gather data on a customer. Then, using proprietary AI, AliveCor develops a heart profile of a particular user.

    One of the company’s most successful products is KardiaMobile.

    Search interest in “KardiaMobile” has jumped by 3,700% in 5 years.

    The product is a finger-reading electrocardiogram (ECG) device that offers “medical grade” heart readings in as little as 30 seconds.

    The KardiaMobile device is paired with an Android or Apple phone to allow the customer to visualize their heart rhythms.

    In addition, for a monthly subscription, patients can get KardiaCare. This service provides monthly health reports as well as regular ECG readings by cardiologists.

    In 2020, AliveCor raised $65 million in venture funding, a trend that we will probably accelerate in the near future.

    4. Industry 4.0 Increasingly Relies On IoT

    Industry 4.0 (or the Fourth Industrial Revolution) is a term that refers to vast improvements in manufacturing and industry brought about by widespread automation and increased efficiency.

    Searches for “Industry 4.0” have increased by 4,700% over the last decade.

    A major component of this concept is IoT. Without IoT, the large-scale data collection and monitoring required to improve industrial capacity would be impossible.

    And of the four major components of Industry 4.0 (IoT, AI, cloud infrastructure, and big data/analytics), Statista reports that industrial organizations find that IoT is the most important (72% of them said so in a study).

    This makes a lot of sense considering data collection and factory monitoring is the ground on which every other component of Industry 4.0 is built.

    Industry 4.0 isn’t necessarily industry-specific.

    The benefits of IoT combined with other technologies can help transform any sector reliant on manufacturing and industrial processes.

    Overall, the improvements brought about by Industry 4.0 are expected to add roughly $7.1 trillion to U.S GDP by 2030

    Much of this will be a result of widespread IoT adoption.

    5. Cybersecurity And Data Privacy Are Very Serious Concerns

    Because IoT could be so integral to the infrastructure of a country or the health of its citizens, it is also subject to serious cybersecurity threats.

    Palo Alto Networks found that a concerning 57% of IoT devices are susceptible to attacks by malicious actors.

    Even more worrying, the same report found that a whopping 83% of medical imaging devices are running on unsupported operating systems. This leaves their entire network vulnerable to attack.

    This is even more serious when you consider that over half of all hacking threats to healthcare providers involve imaging devices.

    This is where a company like SentinelOne comes in.

    The cybersecurity company has developed an AI-based platform that focuses on endpoint security.

    This kind of security deals with stopping threats that attack endpoints of a network (i.e., things like IoT devices and laptops).

    It’s estimated that the endpoint security market could be worth over $18 billion by 2024. And it’s only expected to get bigger as the IoT market grows at a rapid rate.

    In fact, TechCrunch has reported that just under a third of all IT managers didn’t know how many endpoints they managed.

    This makes an offering like SentinelOne’s essential to the IoT revolution.

    And because of this, the company has attracted a lot of attention. It went public in 2021 at the highest valuation ever for a cybersecurity company.

    IoT devices are also collecting a very large amount of data. Because of the sheer breadth, it is possible that consumer privacy concerns could be an issue.

    Palo Alto Networks reports that 98% of data handled by IoT devices isn’t even encrypted.

    This is a serious issue, especially considering that much of this data is sensitive healthcare data.

    In addition, 63% of people say they find IoT data collection “creepy”.

    If IoT is expected to achieve the level of growth that many are predicting, the industry will have to deal with these two large obstacles in the near future.

    6. IoT Transforms The Global Supply Chain

    Global supply chains have become increasingly complex and interdependent.

    This has allowed for amazing improvements in transportation and delivery. But it has brought headaches as well.

    For instance, in the past manufacturers and logistics companies may have been aware that certain product components had left a port or were en route to a certain country.

    But they had no way to track every piece of this complex supply chain.

    With IoT, this is no longer a problem.

    Every shipment can be tracked and monitored. And mistakes can be caught as soon as they happen.

    It’s no wonder then that 70% of retailers are attempting to make their supply chains IoT-complaint.

    International courier company, DHL, is already taking matters into its own hands.

    The company has pledged that it will have a full fleet of 10,000 IoT-enabled trucks by 2028.

    The trucks will be equipped with sensors that will hopefully cut delivery times by half.

    And DHL isn’t alone.

    According to TechRepublic, UPS is heavily reliant on IoT devices.

    It reported that roughly 100,000 IoT tracking devices are attached to UPS transportation assets. And these devices generate 60 million messages every week.

    Conclusion

    That’s all for the top IoT trends of 2022.

    Overall, IoT is rapidly changing many parts of the manufacturing supply chain as well as industries you may not expect (like the medical field.)

    However, to expand at the pace many expect, the IoT industry will have to overcome serious cybersecurity and data privacy concerns.

    Resource : https://explodingtopics.com/blog/iot-trends

    12Oct, 2022
    3 Key Benefits of Hybrid Cloud as a Service

    Organizations are increasingly turning to hybrid cloud as the platform of choice as they continue to respond to changing business conditions caused by the global COVID-19 pandemic. In addition to research by Hewlett Packard Enterprise (HPE) on cloud acceleration and remote work, a recent survey by KPMG sheds light specifically on the value of hybrid cloud.

    Per KPMG: “Hybrid cloud models top the agenda, far surpassing other cloud strategies, including multicloud, that dominated pre-crisis. Major enterprises are planning to adopt this architectural cloud approach in the future to reduce risk of service disruption, extend the corporate network and functional workloads, take advantage of the best available services and features, and improve the flexibility and interoperability of the business.”

    Organizations today have greater flexibility than ever in choosing how to deploy hybrid cloud. This article explores three benefits of using an as-a-service hybrid cloud model and how innovative organizations have been able to leverage this model to achieve business transformation.Play Video

    Benefits of Hybrid Cloud as a Service
    One of the learnings from COVID is that IT teams need to be prepared for anything, with the agility to move quickly to preserve business continuity and adapt to changing market conditions—whether that is a shift to remote work or new business models created by digital transformation.

    In this environment, an as-a-service hybrid cloud model offers tremendous flexibility and agility because organizations can take advantage of the benefits of the cloud without having to give up the control they have traditionally experienced on premises. Key benefits include:

    1. Opex vs. Capex: Cloud computing has been a catalyst in enabling IT to shift to an Opex model where IT is delivered as a service with consumption-based pricing. However, with public-cloud-only services, many organizations have seen costs run out of control, particularly as applications scale. With a hybrid cloud model, IT organizations can move to an Opex model without giving up control and can migrate applications at their own pace, without risking business continuity gaps or disruptions.
    2. Flexibility and simplicity: With a hybrid cloud solution like HPE GreenLake Cloud Services, IT can centralize management of all services, workloads and applications, wherever they are located—in the cloud, on premises or at the edge. Using a single hybrid cloud platform, IT can get a unified view to monitor costs, performance, compliance, security and more. In addition, IT can offload the monitoring and management of on-premises and public clouds to world-class IT operations centers.
    3. Speed to innovation: HPE GreenLake customers have been able to shorten their time to market by an average of 75%, according to a Total Economic Impact™ Study by Forrester Research. Benefits include self-service reporting to forecast future capacity demands; improved efficiencies in executing IT projects; the ability to quickly scale capacity; and reduced time spent on procurement to line up with business needs.

    Hybrid Cloud Digital Game Changers
    Kern County: As the third largest county in California in square miles with nearly a million residents, Kern County was looking to centralize and modernize its IT and technology operations and deliver a cloud experience on premises. The organization adopted HPE GreenLake to gain the agility, flexibility and innovation of the cloud while preserving the compliance, governance, cost control and visibility benefits of running its applications and workloads on premises.

    When COVID-19 hit, Kern County used HPE GreenLake’s elasticity to increase its capacity for virtual desktop infrastructure. Under a legacy model, the county would have had to initiate a procurement process and provision the order, which would have taken weeks or months. Using an as-a-service hybrid cloud solution, the county was able to adjust immediately and equip workers with remote desktops without disruption to business operations or significant additional capital expenses.

    Mizuho Bank: Mizuho Bank is a leading global bank with one of the largest customer bases in Japan. Like many organizations, the bank was looking for a solution that enables the agility to respond quickly to unforeseen changes, while delivering the reliability, security and performance required by a world-class financial services leader. To meet these objectives, the bank modernized its private cloud platform with a hybrid solution.

    Mizuho Bank adopted HPE GreenLake to deploy infrastructure hardware and software as a monthly IT expense, building an adaptable and scalable platform on HPE Synergy. With the solution in place, the bank has been able to reduce IT investment and total cost of ownership, deliver services to enhance the customer experience, and adapt more readily and easily to changing business demands, such as those created by COVID-19.

    The bank has achieved its goal of implementing a solution that enables it to respond quickly to unforeseen changes. “With the increasing uncertainty in both business and technology, developing a service platform with excellent adaptability to change is a major achievement,” according to Ryota Tazuki, deputy general manager of IT and the system control department at Mizuho Bank.

    Resource : https://www.techtarget.com/searchcio/DrivingITSuccess/3-Key-Benefits-of-Hybrid-Cloud-as-a-Service?