• Search for:
    23Dec, 2023
    Every “Thing” Everywhere All at Once

    In the movie Everything Everywhere All at Once, protagonist Evelyn Wang must travel between dimensions to confront and defeat an evil that threatens her family’s existence in their home universe. For Wang it is a confusing and taxing fight that requires her to use information, experience, and power gained as she navigates the multiverse to know what she must do to overcome the challenges she meets along the way. It’s a convoluted story arc that is not unlike the day-to-day of a CISO working to protect the modern enterprise and the universe of “things” that are being deployed.

    The Modern Enterprise is a Multiverse

    Like Evelyn Wang’s world, today’s technology estates are convoluted and multi-dimensional environments where decisions made anywhere have implications everywhere. Multi-campus, multi-cloud, on-premises, cloud-based, mobile, and software defined are all common terms defining a single enterprise. And then you have to take into account the physical and virtual assets comprising a typical environment, many of which come and go, connect and disconnect independent of IT management. It’s hard to keep up; but keep up you must, because threat actors are constantly on the prowl looking for vulnerabilities that will allow them to perpetrate whatever attack they’ve got in mind.

    A recent conversation I had with the CISO of a large enterprise illustrates the dilemma.

    “I am responsible for every device, whether I know about it or not,” he said. “Because we don’t know all of the devices that are connected to the network, we have blind spots that are unprotected.”

    What You See Isn’t All You Get

    To protect a technology estate, you need to be able to see across the network—in real-time—and have information in context for making good decisions. That is a tall order for any organization, but especially for those that rely on a sprawling IT estate. In a 2022 study commissioned by IBM, technology analyst firm IDC found that the average number of IT assets managed by 29 organizations studied was 2.7 million. That’s a lot of systems and devices, and it’s only the ones that are in the known inventory. Another report found that as many as 20% of an organization’s IT assets may be invisible to IT management and security operations, meaning more than a half-million unsecured things are operating in the average enterprise.

    Of that 20%, not all of it is traditional IT that has simply gotten lost in a fast-growing technology environment. Because connectivity is so essential, a lot of things that constitute the Internet of Things (IoT) end up attaching themselves to the enterprise network. In our experience here at Ordr, we’ve seen exercise equipment, gaming consoles, Kegerators, Tesla automobiles, and a lot more operating alongside mission-critical IT systems, Internet of Medical Things (IoMT) devices, operational technology (OT), and plenty more.

    Real-time Asset Inventory Is the Foundation for Security

    Every asset in an organization’s inventory that is not accounted for and protected is a potential attack vector, or step along a path or lateral movement that an attacker can use to gain access or move undetected. Threat actors know this and are targeting IoT more and more to take advantage. One cybersecurity firm says attacks targeting IoT devices have increased 700% since 2020, and Microsoft security researchers recently discovered a “a sophisticated attack campaign” targeting IoT devices.

    That puts a lot of pressure on the CISO, and it also feeds into a vicious asset management and security cycle since a failure to keep track of all assets, including IoT, means that you can’t properly identify your attack surface. These include assets with vulnerabilities, those running outdated operating systems, or devices missing a security agent or patches. This also means IT and security operations aren’t running at maximal efficiency, the context by which decisions are made (and automated) are less precise. Threats thrive in chaos, and so risks increase when assets are not fully inventoried, monitored, and managed in real-time.

    Three Security Considerations To Navigate The Modern Asset Universe

    When security blind spots are a problem, the best first step toward a remedy is to employ tools that enable IT and security teams to gain visibility into the enterprise’s cracks and crevasses. But there are considerations for this:

    • Granular context matters – Asset visibility must include deep threat and asset context. This requires a combination of methods to continuously discover and classify an asset – via deep packet inspection of network traffic, API, NetFlow. For example, in order to determine if you’re impacted by a Zero Day like MOVEit, you must know what applications are actually running on your device. Similarly, to identify vulnerabilities that affect your assets, you may need to know the specific minor version of operating systems running.
    • Behavioral analysis via AI can be a differentiator – Devices are deterministic, a video surveillance camera or an HVAC system or a medical device all have specific behaviors in the network based on their functions. The ability to baseline these communications patterns not only surfaces anomalies– early indicators of a potential compromise, but also informs the foundational Zero Trust policies to secure those devices.
    • Automated policies are important to scale – When there are hundreds of thousands of connected devices in the network, the only way to secure them are via automated policies. This means dynamically generating proactive Zero Trust policies to enable only “baseline” communications for mission-critical devices, or generating reactive policies to block ports, move devices to a different segment or terminate sessions. When a device fits a specific profile, a pre-defined policy can automatically be applied, for example, activating a vulnerability scan when a new device is discovered on the network. 

    Evelyn Wang learned how to navigate her way between dimensions of the multiverse to tackle the challenges that were not visible in her home dimension. CISO’s must gain the means to see every asset across a multidimensional enterprise with fidelity and granular context. Only then will they be able to identify their attack surface and address the security gaps that put their enterprise at risk.

    Resource : https://www.securityweek.com/every-thing-everywhere-all-at-once/

    6Dec, 2023
    New P2PInfect Botnet MIPS Variant Targeting Routers and IoT Devices

    Cybersecurity researchers have discovered a new variant of an emerging botnet called P2PInfect that’s capable of targeting routers and IoT devices.

    The latest version, per Cado Security Labs, is compiled for Microprocessor without Interlocked Pipelined Stages (MIPS) architecture, broadening its capabilities and reach.

    “It’s highly likely that by targeting MIPS, the P2PInfect developers intend to infect routers and IoT devices with the malware,” security researcher Matt Muir said in a report shared with The Hacker News.

    P2PInfect, a Rust-based malware, was first disclosed back in July 2023, targeting unpatched Redis instances by exploiting a critical Lua sandbox escape vulnerability (CVE-2022-0543, CVSS score: 10.0) for initial access.

    A subsequent analysis from the cloud security firm in September revealed a surge in P2PInfect activity, coinciding with the release of iterative variants of the malware.

    The new artifacts, besides attempting to conduct SSH brute-force attacks on devices embedded with 32-bit MIPS processors, pack in updated evasion and anti-analysis techniques to fly under the radar.

    The brute-force attempts against SSH servers identified during the scanning phase are carried out using common username and password pairs present within the ELF binary itself.

    It’s suspected that both SSH and Redis servers are propagation vectors for the MIPS variant owing to the fact that it’s possible to run a Redis server on MIPS using an OpenWrt package known as redis-server.

    One of the notable evasion methods used is a check to determine if it’s being analyzed and, if so, terminate itself, as well as an attempt to disable Linux core dumps, which are files automatically generated by the kernel after a process crashes unexpectedly.

    The MIPS variant also includes an embedded 64-bit Windows DLL module for Redis that allows for the execution of shell commands on a compromised system.

    “Not only is this an interesting development in that it demonstrates a widening of scope for the developers behind P2PInfect (more supported processor architectures equals more nodes in the botnet itself), but the MIPS32 sample includes some notable defense evasion techniques,” Cado said.

    “This, combined with the malware’s utilization of Rust (aiding cross-platform development) and rapid growth of the botnet itself, reinforces previous suggestions that this campaign is being conducted by a sophisticated threat actor.”

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Resource : https://thehackernews.com/2023/12/new-p2pinfect-botnet-mips-variant.html

    24Nov, 2023
    5 Satellite IoT Connectivity Solutions For Remote Areas

    As part of IoT Week, CRN rounds up five satellite IoT connectivity solutions that can help organizations keep devices connected in remote areas where there is little to no cellular coverage.

    When IoT devices are deployed in areas where there is little to no coverage for cellular networks and other ground-based communications infrastructure, satellite connectivity is there to fill in the gaps.

    In recent years, IoT has become a greater priority for satellite vendors and service providers due to satellite IoT connectivity revenue growing far faster than traditional satellite connectivity revenue, according to Kathryn Weldon, research director at data and analytics firm GlobalData.

    While satellite IoT connectivity has been around for many years, it has recently become more viable as a result of vendors and service providers developing solid business models around low Earth orbit (LEO) satellite technologies after an initial wave of companies failed to do so, Weldon said.

    “There’s a new set of companies, many of which are still doing LEOs as their primary satellite technology but have somehow figured out more of the cost equations and instead of having a whole constellation of satellites, at the beginning, they have staged launches,” she told CRN.

    To address growing demand for satellite IoT connectivity, mobile network operators such as Telefónica, Deutsche Telekom and Skyle has developed new partnerships with satellite providers in recent years to give organizations with IoT fleets a continuum of coverage from cellular networks to satellites.

    “There’s more partnering, and there will continue to be more partnering for the operators and satellite providers,” said Weldon.

    As part of IoT Week, CRN has rounded up five satellite IoT connectivity solutions that can help organizations keep devices connected in remote areas where there is little to no cellular coverage.

    Soracom

    Soracom provides a satellite IOT messaging service that can connect any IoT device or sensor to Astrocast’s network of nanosatellites for areas where there is limited to no cellular coverage.

    The messaging service allows organizations to manage satellite IoT connections and billing alongside cellular, Wi-Fi and low-power wide-area connections through Soracom’s platform, which also enables users to remotely monitor and track their assets.

    Soracom’s service is hardware-agnostic, and it lets organizations ingest data from sensors on any cloud service without the need for a relay server, software development kit or on-device credentials.

    Sateliot

    Sateliot allows devices with narrowband IoT connectivity to communicate over the company’s constellation of satellites to enable “massive adoption of IoT in traditional out-of-coverage areas.”

    Narrowband IoT, also known as NB-IoT, is a subset of the LTE standard for cellular networks that enables a high density of connections for low-cost indoor devices with long battery life.

    By supporting the NB-IoT standard in its satellite technology, Sateliot said it’s able to “provide service at a similar cost and price to that of terrestrial cellular networks.”

    The Barcelona, Spain-based company’s satellite service is provided through mobile network operators like Telefonica as well as mobile virtual network operators.

    Myriota

    Myriota enables satellite connectivity for IoT devices through its Myriota Modules, which securely transfers data to the cloud through its nanosatellites without the need for ground-based infrastructure.

    The Australian company said its Myriota Modules contain patented technology that reduces energy use and increases longer battery life for IoT devices with the modules installed. These modules send “almost imperceptible” signals to Myriota’s satellites, which can support billions of devices.

    Data collected by Myriota’s satellites are sent down to a global network of satellite ground stations and processed in the cloud, which the company makes accessible though an API.

    Inmarasat

    Inmarasat provides a large portfolio of satellite IoT connectivity services with “unrivalled levels of reliability, choice and mobility” for enterprises.

    The company’s services include the BGAN M2M two-way IP data service for long-term management of machine-to-machine communication, the IsatData Pro service for tracking and monitoring assets and a leasing program that lets enterprises create a virtual network using its satellite constellations.

    These services are part of Inmarasat’s Elera IoT connectivity platform, which takes advantage of its Elera L-band satellite network. Target industries for these services include agriculture, transport and logistics, mining, oil and gas and electrical utilities.

    Vodafone

    Vodafone offers what it calls the “first global cellular and satellite IOT managed connectivity service,” which combines the company’s cellular network with Inmarasat’s BGAN satellite network.

    The service relies on the Vodafone Global SIM card, which sits within Inmarasat satellite terminals and connects devices to the satellite network when they enter roaming.

    Vodafone’s platform features enhanced device management functionality and supports more than 250 device types, with the ability to add new ones on demand.

    Resource : https://www.crn.com/news/internet-of-things/5-satellite-iot-connectivity-solutions-for-remote-areas/6

    11Oct, 2023
    IZ1H9 Botnet Targets IoT Devices With New Exploits

    FortiGuard Labs, the research arm of security firm Fortinet, has uncovered a significant evolution in the IZ1H9 Mirai-based DDoS campaign. 

    Discovered in September and described in an advisory published on Monday, the new campaign has reportedly rapidly updated its arsenal of exploits, incorporating 13 distinct payloads, targeting various vulnerabilities across different Internet of Things (IoT) devices.

    Peak exploitation was recorded on September 6, with trigger counts reaching the tens of thousands. This highlights the campaign’s ability to infect vulnerable devices and expand its botnet swiftly through newly released exploit codes, encompassing multiple CVEs.

    The exploit payloads focus on vulnerabilities in D-Link, Netis, Sunhillo SureLine, Geutebruck, Yealink Device Management, Zyxel, TP-Link Archer, Korenix JetWave and TOTOLINK devices. Each payload is tailored to exploit specific vulnerabilities, ranging from command injection to remote code execution (RCE).

    The injected payload initiates a shell script downloader, “l.sh,” from a specific URL. It proceeds to delete logs, download and execute various bot clients for Linux architectures and obstruct network connections on multiple ports.

    IZ1H9, a Mirai variant, infects Linux-based IoT devices, rendering them remote-controlled bots for large-scale network attacks. Its configuration is decoded with an XOR key, revealing additional payload downloader URLs, along with pre-set login credentials for brute-force attacks.

    Read more on IZ1H9: New Mirai Variant Campaigns are Targeting IoT Devices

    Command-and-control (C2) communication between compromised devices and the command server is detailed, demonstrating the campaign’s sophistication in launching DDoS attacks with specific parameters.

    Fortinet researcher Cara Lin said the research underscored the persistent threat posed by RCE attacks on IoT devices. 

    “Despite the availability of patches for these vulnerabilities, the number of exploit triggers remains alarmingly high, often numbering in the thousands,” she wrote.

    “What amplifies the impact of the IZ1H9 Campaign are the rapid updates to the vulnerabilities it exploits. Once an attacker gains control of a vulnerable device, they can incorporate these newly compromised devices into their botnet, enabling them to launch further attacks like DDoS attacks and brute-force,” Lin added.

    To mitigate this threat, organizations are urged to apply patches promptly and alter default login credentials for their devices.

    Resource : https://www.infosecurity-magazine.com/news/iz1h9-botnet-targets-iot-devices/

    25May, 2023
    Mirai Variant V3G4 Targets 13 Vulnerabilities to Infect IoT Devices

    During the second half of 2022, a variant of the Mirai malware called V3G4 was seen targeting 13 vulnerabilities to ensnare Internet of Things (IoT) devices into a botnet, Palo Alto Networks reports.

    Following the successful exploitation of the targeted security flaws, the malware takes full control of the vulnerable devices and then abuses them to conduct various types of malicious activities, including distributed denial-of-service (DDoS) attacks.

    Starting July 2022, Mirai variant V3G4 was used in multiple attack campaigns, likely by the same threat actor, based on the used hardcoded command-and-control (C&C) domains, malware downloaders, XOR decryption key, identical functions, and a ‘stop list’.

    To compromise devices, the threat actor targets 13 remote code execution vulnerabilities that allow them to run specific utilities to download and execute the Mirai malware on the target devices.

    The targeted vulnerabilities impact FreePBX Elastix (CVE-2012-4869), Gitorious, FRITZ!Box webcams (CVE-2014-9727), Mitel AWC, Geutebruck IP cameras (CVE-2017-5173), Webmin (CVE-2019-15107), Spree Commerce, FLIR Thermal cameras, DrayTek Vigor (CVE-2020-8515 and CVE-2020-15415), Airspan AirSpot (CVE-2022-36267), Atlassian Confluence (CVE-2022-26134), and C-Data Web Management System (CVE-2022-4257).

    Following successful execution on a vulnerable device, the Mirai variant makes sure that only one instance of the malware runs, then attempts to terminate processes included in the hardcoded ‘stop list’.

    Malware samples collected over the course of three different campaigns showed slight changes in the code. While some Mirai samples spread by brute-forcing weak credentials, others also use embedded exploits, but samples seen between September and December 2022 contain none of these capabilities.

    “The vulnerabilities mentioned above have less attack complexity than previously observed variants, but they maintain a critical security impact that can lead to remote code execution. Once the attacker gains control of a vulnerable device in this manner, they could take advantage by including the newly compromised devices in their botnet to conduct further attacks such as DDoS,” Palo Alto Networks notes.

    Organizations are advised to ensure that all devices in their environments are patched against known vulnerabilities, that they are protected using strong, unique passwords, and that unused ports and services, which are often targeted by cybercriminals, are either blocked or not accessible from the internet.

    Resource : https://www.securityweek.com/mirai-variant-v3g4-targets-13-vulnerabilities-to-infect-iot-devices/

    10Apr, 2023
    Nexx bugs allow to open garage doors, and take control of alarms and plugs

    A series of vulnerabilities in multiple smart devices manufactured by Nexx can be exploited to remotely open garage doors, and take control of alarms and plugs.

    In late 2022, the researcher Sam Sabetan discovered a series of critical vulnerabilities in several smart devices manufactured by Nexx, including Smart Garage Door Openers, Alarms, and Plugs. A remote attacker can exploit these vulnerabilities to open and close garage doors, take control of alarms, and switch smart plugs on and off for any customer.

    Nexx has not replied to any correspondence from myself, DHS (CISA and US-CERT) or VICE Media Group.” reads a post published by Sabetan. “I have independently verified Nexx has purposefully ignored all our attempts to assist with remediation and has let these critical flaws continue to affect their customers.”

    The researchers reported the issues to the United States Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA), which assigned the following five CVEs:

    1. Use of Hard-coded Credentials CWE-798 (CVE-2023–1748, CVSS3.0: 8.6)
    2. Authorization Bypass Through User-Controlled Key CWE-639 (CVE-2023–1749, CVSS3.0: 6.5)
    3. Authorization Bypass Through User-Controlled Key CWE-639 (CVE-2023–1750, CVSS3.0: 7.1)
    4. Improper Input Validation CWE-20 (CVE-2023–1751, CVSS3.0: 7.5)
    5. Improper Authentication Validation CWE-287 (CVE-2023–1752, CVSS3.0: 8.1)

    The expert estimated that over 40,000 devices, located in both residential and commercial properties, are affected by the above issues. He also determined that more than 20,000 individuals have active Nexx accounts.

    To mitigate the risk of the exploitation of the above flaws, it is recommended to disable internet connectivity for vulnerable Nexx devices or protect them with a firewall.

    Below is a video demo published by the researcher that shows how to exploit the flaw CVE-2023–1748 to obtain users’ info.

    Resource : https://securityaffairs.com/144488/iot/nexx-smart-devices-flaws.html

    22Mar, 2023
    Mirai V3G4 botnet exploits 13 flaws to target IoT devices

    During the second half of 2022, a variant of the Mirai bot, tracked as V3G4, targeted IoT devices by exploiting tens of flaws.

    Palo Alto Networks Unit 42 researchers reported that a Mirai variant called V3G4 was attempting to exploit several flaws to infect IoT devices from July to December 2022. 

    Below is the list of vulnerabilities exploited by V3G4:

    The threat actors’ goal is to infect the largest number of systems as possible to compose a botnet that can be used to conduct multiple attacks, including DDoS attacks.

    The researchers have observed three different Mirai V3G4 campaigns likely operated by the same threat actor for the following reasons:

    • The hardcoded command and control (C2) domains among these three campaigns contain the same string (8xl9)
    • The malware shell script downloaders are almost identical between the three campaigns
    • The botnet client samples use the same XOR decryption key
    • The botnet client samples use the same “stop list” (a list of target processes that the botnet client searches for and terminates)
    • The botnet client samples use almost identical functions

    The botnet exploited 13 vulnerabilities to achieve remote code execution on vulnerable devices. Upon successful exploitation, the malicious code executes wget and curl utilities to download Mirai bot from attackers’ infrastructure and then execute it.

    Mirai V3G4 botnet

    Upon execution, the bot prints xXxSlicexXxxVEGA. to the console. The experts noticed that V3G4 also supports a function that makes sure only one instance of this malware is executing on the compromised device. If a botnet process already exists, the botnet client will and exit.

    The botnet also attempts to terminate a list of processes, included in the hardcoded ‘stop list,’ by checking their names on the infected device.

    Unlike most Mirai variants, the V3G4 variant uses different XOR encryption keys for string encryption.

    The researchers also noticed that the bot samples from the three campaigns have minor differences. The original Mirai botnet sample spreads itself by brute-forcing weak telnet/SSH credentials, while other variants rely brute-force attacks and embedded exploits to spread.

    However, bot samples discovered between September and December 2022 don’t contain the functions of vulnerability exploitation and brute force of credentials.

    “The vulnerabilities mentioned above have less attack complexity than previously observed variants, but they maintain a critical security impact that can lead to remote code execution. Once the attacker gains control of a vulnerable device in this manner, they could take advantage by including the newly compromised devices in their botnet to conduct further attacks such as DDoS.” concludes the report. “Therefore, it is highly recommended that patches and updates are applied when possible.”

    Resource : https://securityaffairs.com/142358/malware/mirai-v3g4-botnet.html

    27Feb, 2023
    NIST Picks Ascon Algorithms to Protect Data on IoT, Small Electronic Devices

    The National Institute of Standards and Technology (NIST) has selected a group of cryptographic algorithms called Ascon as the lightweight cryptography standard to protect data flowing through IoT devices.

    Following a multi-year effort that included security code reviews, NIST announced the Ascon family of algorithms will soon be the standard to protect data created and transmitted by the Internet of Things (IoT), including its myriad tiny sensors and actuators. 

    The Ascon algorithms, developed in 2014 by a team of cryptographers from Graz University of Technology, Infineon Technologies, Lamarr Security Research and Radboud University, are designed for miniature technologies such as implanted medical devices, stress detectors inside roads and bridges, and keyless entry fobs for vehicles. 

    According to NIST, these tiny devices need “lightweight cryptography” — protection that uses the limited amount of electronic resources they possess

    The Ascon family was selected in 2019 as the primary choice for lightweight authenticated encryption in the final portfolio of the CAESAR competition, a sign that Ascon had withstood years of examination by cryptographers, NIST said in a note announcing the choice.

    “The world is moving toward using small devices for lots of tasks ranging from sensing to identification to machine control, and because these small devices have limited resources, they need security that has a compact implementation,” said NIST computer scientist Kerry McKay.  “These algorithms should cover most devices that have these sorts of resource constraints.”

    The standards body expects Ascon to power two of the most important tasks in lightweight cryptography: authenticated encryption with associated data (AEAD) and hashing. 

    The Institute made it clear that the new algorithms are not intended to be used for post-quantum encryption.  

    “One of the Ascon variants offers a measure of resistance to the sort of attack a powerful quantum computer might mount. However, that’s not the main goal here,” McKay said. “Post-quantum encryption is primarily important for long-term secrets that need to be protected for years. Generally, lightweight cryptography is important for more ephemeral secrets.” 

    Resource : https://www.securityweek.com/nist-picks-ascon-algorithms-to-protect-data-on-iot-small-electronic-devices/

    1Feb, 2023
    The Different Types of Cybersecurity

    Cyber security is a wide field covering several disciplines. It can be divided into seven main pillars:

    1. Network Security

    Most attacks occur over the network, and network security solutions are designed to identify and block these attacks. These solutions include data and access controls such as Data Loss Prevention (DLP), IAM (Identity Access Management), NAC (Network Access Control), and NGFW (Next-Generation Firewall) application controls to enforce safe web use policies.

    Advanced and multi-layered network threat prevention technologies include IPS (Intrusion Prevention System), NGAV (Next-Gen Antivirus), Sandboxing, and CDR (Content Disarm and Reconstruction). Also important are network analytics, threat hunting, and automated SOAR (Security Orchestration and Response) technologies.

    2. Cloud Security

    As organizations increasingly adopt cloud computing, securing the cloud becomes a major priority. A cloud security strategy includes cyber security solutions, controls, policies, and services that help to protect an organization’s entire cloud deployment (applications, data, infrastructure, etc.) against attack.

    While many cloud providers offer security solutions, these are often inadequate to the task of achieving enterprise-grade security in the cloud. Supplementary third-party solutions are necessary to protect against data breaches and targeted attacks in cloud environments.

    3. Endpoint Security

    The zero-trust security model prescribes creating micro-segments around data wherever it may be. One way to do that with a mobile workforce is using endpoint security. With endpoint security, companies can secure end-user devices such as desktops and laptops with data and network security controls, advanced threat prevention such as anti-phishing and anti-ransomware, and technologies that provide forensics such as endpoint detection and response (EDR) solutions.

    4. Mobile Security

    Often overlooked, mobile devices such as tablets and smartphones have access to corporate data, exposing businesses to threats from malicious apps, zero-day, phishing, and IM (Instant Messaging) attacks. Mobile security prevents these attacks and secures the operating systems and devices from rooting and jailbreaking. When included with an MDM (Mobile Device Management) solution, this enables enterprises to ensure only compliant mobile devices have access to corporate assets.

    5. IoT Security

    While using Internet of Things (IoT) devices certainly delivers productivity benefits, it also exposes organizations to new cyber threats. Threat actors seek out vulnerable devices inadvertently connected to the Internet for nefarious uses such as a pathway into a corporate network or for another bot in a global bot network.

    IoT security protects these devices with discovery and classification of the connected devices, auto-segmentation to control network activities, and using IPS as a virtual patch to prevent exploits against vulnerable IoT devices. In some cases, the firmware of the device can also be augmented with small agents to prevent exploits and runtime attacks.

    6. Application Security

    Web applications, like anything else directly connected to the Internet, are targets for threat actors. Since 2007, OWASP has tracked the top 10 threats to critical web application security flaws such as injection, broken authentication, misconfiguration, and cross-site scripting to name a few.

    With application security, the OWASP Top 10 attacks can be stopped. Application security also prevents bot attacks and stops any malicious interaction with applications and APIs. With continuous learning, apps will remain protected even as DevOps releases new content.

    7. Zero Trust

    The traditional security model is perimeter-focused, building walls around an organization’s valuable assets like a castle. However, this approach has several issues, such as the potential for insider threats and the rapid dissolution of the network perimeter.

    As corporate assets move off-premises as part of cloud adoption and remote work, a new approach to security is needed. Zero trust takes a more granular approach to security, protecting individual resources through a combination of micro-segmentation, monitoring, and enforcement of role-based access controls.

    Resource : https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cybersecurity/

    12Jan, 2023
    Tech in 2023: 6 new priorities for your shortlist

    Tech executives expect their technology budgets to rise during the next year, according to predictions from analysts and other surveys, despite the economic headwinds. ZDNET spoke to tech executives and industry insiders to find out, as spending continuing to rise, where digital leaders are looking to prioritize their investments in 2023.

    1. Using the cloud as a foundation for machine learning

    Barry Panayi, chief data and insight officer at John Lewis Partnership, believes the big trend next year in most traditional businesses is going to be about getting the most from the cloud.

    “It’s a 10-year-old conversation. Until now, many people have treated the cloud like a huge hard drive, but it gives you huge capabilities,” he says.

    Panayi says one example is how companies can create significant value by using cloud-stored data as a foundation for MLOps, which aims to make machine-learning workflows across an organisation more effective.

    “Proper, automated MLOps – certainly in retail and fast-moving consumer goods – can be a game changer, especially as people are shopping more online. We’re famous for our John Lewis shops, but the shift online has been so big that having everything relating to data moving in near or real time is big deal for us.”

    2. Get ready for the metaverse

    Lisa Heneghan, global chief digital officer at consultant KPMG, recognises that the metaverse is overhyped. However, she also believes business leaders will need to start getting to grips with this fast-moving area of tech in 2023.

    “In some ways, I hate saying the metaverse will be the next big trend, and I don’t think the metaverse and Web 3.0 is going to come to life in the next year. But I do think we need to change the way we’re thinking, so that we’re understanding how the world will change during the next five years.”

    Heneghan says she looks at the way younger people are already comfortable with increasingly immersive experiences and suggests companies must get to grips with the metaverse now – something many failed to do in the past with other big trends.

    “I remember when cloud came and everybody was asking: ‘What’s cloud?’ We can’t take as long as it took to get things going with the cloud. With the metaverse, we have to get our act together. We have to understand it and start to test and see how that technology might make a difference to us.”

    3. Ensuring data is reliable and explainable

    David Charnley, head of transformation and strategy at NatWest, points to a range of key data-led concerns, such as open banking, artificial intelligence and regulation: “All of those are important trends and activities that we need to keep a really close eye on.”

    Charnley says another key issue is demand for talent, particularly when companies like his are trying to grow their data practices: “I think the trend that we’re seeing is scarcity in the labour market for data professionals and I see that only getting tighter. I think that’s a feature of the UK market, the market in India, and elsewhere too.”

    As his bank continues to look to do exciting things with the information it holds, Charnley says it’s also important to keep an eye on data ethics and potential bias. He recognises machine-learning models can have unintended bias – and dealing with those challenges will be a big priority for 2023.

    “Getting to a place where we’re able to explain and monitor models to ensure that there isn’t a drift or bias in the way that we do business is a part of delivering great data propositions. And that’s something that we are really investing time and effort in right now at NatWest.”

    4. Getting the most out of the cloud

    Bev White, CEO at recruiter Nash Squared, is another expert who says the big priority for most digital chiefs is going to be getting the most from their investments in the cloud.

    “There’s no doubt about it,” she says. “Talk to any tech leader and it’s the first or second thing they talk about. Every time, this is where they’re putting their big investments – and they’ll be continuing to do so for the next few years.”

    White says this investment in cloud will be supported by a commitment to cybersecurity investments.

    “The more exposed we make our businesses online, the more risk we carry,” she says. “And while we hear every week about lots of examples of cybercrime and ransomware and all these other things that are going on, I’m sure we don’t hear a lot about many of the attacks. So, we’re expecting the requirement to invest more in cyber to continue.”

    5. Dealing with cybersecurity concerns

    A strong focus on proactive and preventative cyber measures is something that chimes with Andy Pocock, IT director at TrustFord, who says his priority is simple: keeping data safe and secure.

    “I think the big trend will be security and addressing that concern. It’s certainly the focus for me. To just ensure that I’ve got the capabilities and the protections in place to protect my company’s data and my customers’ data,” he says.

    “You’ve only got to go and read the National Cyber Strategy and you’ve only got to listen to the National Cyber Security Centre. The cyber threat is ever-evolving, and it’s going to get bigger.”

    6. Using the IoT to take control

    Ed Higgs, group director of IT shared services at pest control specialist Rentokil Initial, says his organisation will be looking to make more of the Internet of Things (IoT) and the data from connected devices.

    His company uses IoT-connected traps to spot signs of infestation automatically, which allows the business to take prompt preventative action before the problem worsens.

    “We’ve got millions of connected devices out there. For us, it’s going to be more IoT, much more control over that endpoint, and much more functionality connected to that endpoint,” says Higgs.

    “We’ve moved from just having a SIM card within a device, which sends an SMS, to adding a camera to the device, so that when it sends an SMS, it can also send the details of what it is that they’ve caught. So the management, security and compliance around those endpoint devices is going to be big for us.”

    Resource : https://www.zdnet.com/article/tech-in-2023-6-new-priorities-for-your-shortlist/