Category Archives: Internet Security
Could the lights go out in Europe? | BCS – BCS
When encountering security practitioners from espionages darker side, I often start the conversation with an initial question: how far inside our critical infrastructure might our adversaries be? And, how far inside theirs do you think we are?
What usually results is a short silence, followed by a swift rhetorical manoeuvre towards another topic.
In reality, the answer to my question might simply be unknown but the fact that experts dont seem willing to engage with the enquiry is important in itself. For example, do the Russians (or other potential adversaries) have the capability to disable our electrical power networks? Can they do this with a click of a mouse and with the same apparent ease with which Russia can turn off gas supplies across Europe?
We live in uncertain times. The war in Ukraine, concerns about Taiwans security and conflicts in the Middle East are evidence of a world thats far from stable or predictable.
In times like these, you dont need to look too far to find headlines speculating on cyber-attacks and their technicalities.
Its reasonable to expect that since the start of Russias war GCHQ, the National Cyber Security Centre, the NSA and other Western cyber-powers have all been sharing knowledge with Ukraine.
Early in the Ukraine war, NBC reported that President Biden had received a menu of options for conducting cyber attacks against Russia. The story stated the attacks would focus on disrupting networks and not harming people. Read past the headline, however, and the story reports that a US government spokesperson described the its given menu of possible cyber attacks as wildly off base and does not reflect what is actually being discussed.
Despite the spokespersons reported rebuttals, its hard to imagine that what NBC described in its story isnt already part of a longstanding strategic cyber response plan.
Russia itself is sure to have utilised, at least in some part, their significant cyberwarfare capabilities to further their intentions in Ukraine. During the 2014 invasion of Crimea Russia amped up its attacks on Ukraine, taking down government sites and social media platforms, and using spyware to track the movements of Ukrainian politicians.
Attacks went as far as physically ripping up fibre-optic cables between the Crimean peninsula and the rest of Ukraine in order to sever communications with Kyiv and give the Russian state media the monopoly on information. But the attacks made during the conflict itself were not the first: for months before the start of the 2014 invasion, Russia had been taking part in strategic cyber-espionage to gather information they could use in advance of their first strike.
Moving to the current war in Ukraine, reports continue to emerge of cyber activities. Some commentators suggest a haphazard approach by Russias cyber forces a theory which seems to line up with the invading states reportedly ineffective overall military approach to date.
Its a fair assumption that Russia will have used their cyber capabilities to assist their military objectives. It is equally fair to assume that Ukraine will have done everything in its power to prevent a Russian cyber-victory. We are unlikely to ever discover the reality of the situation, but some of the initial activity that we have observed include: various Ukrainian Government sites suffering Distributed Denial of Service (DDoS) attacks, spear-phishing activities taking place in NATO countries and a malware wiper tool erasing data from devices. Pro-Russian hacking groups have also been able to successfully disrupt businesses and government infrastructure in countries backing Ukraine, including in Lithuania, Latvia, Poland and Denmark.
The most worrying aspect in the cyber world is that, unlike the Cold War and its nuclear proliferation, there is no dtente - no international agreement or arms control. Additionally, we currently live in the cyber-wild-west where politically motivated cyber attacks arent the sole preserve of nation states. Rather, such attacks can be launched by individuals.
However you describe them patriots or vigilantes these attackers have many potent digital weapons at their disposal. Just how numerous and dangerous these software tools are became clear with the recent Vulkan Files leak: disgruntled by the war in Russia, black-hat hackers leaked a huge trove of data and insights about how Russias offensive cyber activities work.
An attackers actions also have the potential for catastrophic worldwide impact. Even targeted attacks by nation states have the potential to spill over into the rest of the world, as we saw with the Petya/NotPetya ransomware attacks carried out on Ukraine. These spread to organisations across the globe, including Maersk, Mondelez International and the UKs own Reckitt Benckiser.
The Internet of Things (IoT) is often not well-protected, leaving systems such as CCTV cameras vulnerable to attack. Indeed, there have been reports of Russian individuals hacking the dashboard cameras of Ukrainian defence forces, leading to dashcams being banned in parts of the country.
While this is, of course, incredibly dangerous for Ukrainians on the battlefield, other scenarios could see serious impacts for civilians too. Moving our discussion away from the battle field, your smart doorbell, baby monitor and smart watch data could all theoretically be used to paint a picture of your life: what you do, where you go and who you care about. These devices, which often have only basic defences against malware, could all also be used to monitor politicians, civil servants, judges or military personnel and provide hostile states with invaluable intelligence.
Cyber security: An insight into the business of keeping people safe – Euronews
Cyber security, surveillance and data storage are all sectors seeing spectacular growth. But in an increasingly tense and complex world - how secure should CEOs really feel?
Life in our internet-enabled, hyper-connected world can feel scary at times. In the last few years, we've seen a rise in geo-political tensions and reports of cyber hacks and attacks seem to occur with alarming regularity.
The job of staying safe now means much more than locking our doors at night, and for the bosses of the world's biggest companies - doing business securely has become more complicated than ever.
Throughout 2023, government privacy and protection regulations are predicted to reach more than 5 billion citizens.
Compliance with the latest data protection laws across different countries can require intricate and exhaustive planning.In fact, government regulations requiring firms to provide consumer privacy rights are estimated to cover more than 70% of global GDP.
Cyber Security expert and Managing Partner at SBS, Augusto Coriglioni,is on the front line of the fight to fend off digital threats.
Euronews asked him to describe what CEOs and their security teams are dealing with day to day.
"Generally speaking, cyber security is safe enough. Even if we are to say that cyberspace is limitless. Back to real life, [daily] life, we have to say there are thousands of attacks and accidents every day. Also, there are some others which are detected but are not reported by companies or authorities because they do not want to create panic or misinformation for their users," he explained.
"But it is also very important to understand there are some other kinds of attacks where they enter your system and stay silent for information,"Coriglioni added.
Governments also have a huge role to play in keeping us safe. Euronews spoke toAir Commodore Mark Biggadike, who was the UK Senior Representative for the FIFA World Cup 2022, andCaptain Talal Burshaidfrom the Qatari Emiri Air Force to find out how teamwork between different countries helped everyone stay safe during last year's FIFA World Cup in Qatar.
"Bringing in the other partner nations the United States, Italy, France, Turkey and Pakistan as a group we worked extremely well together. Qatar were very welcoming and open and I think that really helped in establishing a very effective security operation, keeping the event safe, secure and successful," saidAir Commodore Mark Biggadike.
"I think the military, particularly the royal air force has always had a close relationship with business and technology specifically. So, I see that only increasing as we get more complex technologies and we incorporate those into our assets. I think defence engagement is a growth area for us, we are very keen as [the] UK to work with our international allies and partners on these sorts of projects so I think its only going in one direction."
"Over many years we collaborated and worked with a number of global security partners to ensure we would be ready to host the World Cup and now it has successfully passed, all of the knowledge sharing that occurred and the experiences that were also shared will always be applied in future references in hosting any global events and any sporting events," explainedCaptain Talal Burshaid.
Its not only big businesses and governments that need to adapt to the challenges of cybersecurity. In the modern-day virtual world, members of the public also must take precautions in order to ensure they are safe whilst they surf the net.
Laurie Maclachlan from the multibillion-dollar tech company, Launch Darkly, told Euronews that even though people might be concerned, there is a huge amount of security protocol in place to combat these problems.
"I think they are quite right to be concerned, absolutely. But I think with the evolution of the cloud has come the introduction of a huge number of different safety checks and protocols adherence to data protection laws for example. They still have a choice. They certainly dont need to consume all of their services. Certainly, if 94% of all businesses are using the cloud, that tells you there is a huge amount of safety built into everything which is delivered by the cloud," LaurieMaclachlan explained.
The business of keeping us safe is booming. Decisions about our safety whether in the corporate boardroom or the cockpit of an aircraft are being made with millions of data simultaneously. It's this state of constant connection that creates the commercial opportunity - but with 5 billion people now protected by some kind of data regulation - scrutiny of those we trust to keep us safe has never been greater.
Pharmaceutical giant, Johnson & Johnson, is set to publish its first quarterly earnings of 2023. In the aftermath of the Covid-19 pandemic, pharmaceutical companies are seeking alternative methods of keeping revenue high with Johnson and Johnson pinning hopes on a new drug to treat the Dengue virus which if successful, could be ground-breaking in tackling the disease.
From Pharma Giants to Banking giants, JP Morgan is also set to unveil their first quarterly results of the year. The American banking behemoth will publish its results during a time of concern for the US banking system with the collapse of SVB.
And will it be refreshing news for Coca-Cola shareholders as they meet this week for their first annual conference of the year? The soft drink company is preparing to release their quarterly results after a strong finish to 2022. Their shareholders will be hoping that their stock market performance continues to sparkle.
See more here:
Cyber security: An insight into the business of keeping people safe - Euronews
How can we Secure the Internet of Things (IoT)? – Security Boulevard
Strategies for Preventing Compromised Devices:An introduction, for security professionals, to IoT protection and the current smart device landscape.
The rapid expansion of the Internet of Things (IoT) has given rise to an increasingly interconnected world, permeating both consumer and enterprise landscapes. The inherent complexity of IoT ecosystems from smart security systems and kitchen devices to medical sensors and fire alarms has spawned a plethora of new vulnerabilities and attack vectors, placing the security of these devices at the forefront of cybersecurity concerns.
In this post, we will look at the current IoT security landscape, provide real-world examples of IoT breaches, and discuss strategies to mitigate risks, including visibility into device relations, lateral movement protection, microsegmentation, and Zero Trust.
To understand the magnitude of IoT security challenges, consider the following notable incidents:
To effectively address IoT security risks, it is crucial first to comprehend the challenges they pose:
Mitigating IoT security risks
A comprehensive approach to IoT security should encompass the following strategies:
An in-depth understanding of the relationships between IoT devices and their associated networks is crucial for effective security. To achieve this:
Relevant Link: NISTs Guidelines for Managing IoT Cybersecurity and Privacy Risks
Restricting lateral movement within a network can significantly reduce the potential impact of a compromised IoT device. To achieve this:
Relevant Link: Lateral Movement Protection Best Practices
Segmentation provides granular control over network traffic, enabling the enforcement of security policies at the device level. To implement microsegmentation:
Relevant Link: Microsegmentation Made Easy
Adopting a Zero Trust security model requires the verification of all applications, users and devices attempting to access resources, regardless of their location. To implement zero trust for IoT:
Relevant Link: Zero Trust and Your Organization: What It Will Take to Put Theory into Practice?
The ever-increasing reliance on IoT devices brings an expanding attack surface and the potential for significant security breaches. Security professionals can effectively safeguard their organizations from IoT-related threats by implementing comprehensive strategies that include visibility into device relations, lateral movement protection, microsegmentation, and zero trust. As the IoT landscape evolves, cybersecurity professionals must remain vigilant and adaptable, ensuring that security measures keep pace with technological advancements.
Working towards securing IoT
At TrueFort, we specialize in lateral movement protection and have formed strategic alliance with Armis, major asset visibility and security provider. This joint effort enhances our customers ability to discover, comprehend, and implement security policies across IT, Internet of Things (IoT), and operational technology (OT) settings.
The post How can we Secure the Internet of Things (IoT)? appeared first on TrueFort.
*** This is a Security Bloggers Network syndicated blog from TrueFort authored by Nik Hewitt. Read the original post at: https://truefort.com/securing-the-internet-of-things/
More here:
How can we Secure the Internet of Things (IoT)? - Security Boulevard
DirectDefense, Claroty Partner for Extended Internet of Things (XIoT … – MSSP Alert
by Dan Kobialka Apr 12, 2023
MSSP DirectDefense has added Claroty eXtended internet of things (XIoT) and cyber-physical security capabilities to its services offering, the companies said.
In doing so, DirectDefense customers can use the Claroty Platform to secure cyber-physical systems across their industrial, healthcare and commercial environments.
Jim Broome, DirectDefenses president and CTO, commented on the addition of the Claroty Platform to his companys services offering:
By adding Claroty to our services offering, customers in the industrial, healthcare and commercial industries can better secure their XIoT environments Time and time again we hear the challenges these industries face with the proliferation of connected devices and the difficulty managing and securing them.
The Claroty platform provides the required visibility and protection and with our 247 SOC managing those alerts in partnership with our Connected Systems team, customers will elevate their security posture and increase their cyber resiliency.
The Claroty Platform integrates with an organizations existing infrastructure to provide controls for visibility, risk and vulnerability management, threat detection and secure remote access, the company noted.
Key features of the Claroty Platform include:
The Claroty Platform drives cyber and operational resilience, said CJ Radford, Clarotys global vice president of channel and alliances. As such, DirectDefense customers can utilize the Claroty Platform to secure their XIoT assets and devices, respond to and recover from incidents and preserve operational continuity and safety across their XIoT environments.
The Claroty partnership comes after DirectDefense in February 2023 appointed Christopher Walcutt as its chief security officer. Walcutt is responsible for DirectDefenses security management, the company said. He previously served as DirectDefenses president of strategy.
DirectDefense offers managed security services, risk assessments and penetration testing to global organizations. Along with Claroty, DirectDefense has established partnerships with anti-ransomware platform provider Halcyon and other cybersecurity companies.
The company also offers a partner program that allows MSSPs, MSPs and other technology providers to deliver managed detection and response (MDR) and other security services.
Read more:
DirectDefense, Claroty Partner for Extended Internet of Things (XIoT ... - MSSP Alert
Why IT leaders are putting more business spin on security spend – CIO
Gartner projects that spending oninformation security and risk managementproducts and services will grow 11.3% to reach more than $188.3 billion this year. But despite those expenditures, there have already been at least 13 major data breaches, including at Apple, Meta and Twitter.
To better focus security spend, some chief information security officers (CISOs) are shifting their risk assessments from IT systems to the data, applications, and processes that keep the business going.
If you look at security from a purely technical perspective, its easy to get lost in, `I need to have this shiny object because everyone else has it, says David Christensen, VP and CISO at benefits administration software provider PlanSource. The reality is often the most popular or well-known new security solution can waste money and slow the business, especially if it doesnt align with business goals. And even if it helps secure one part of the business, it may not be the part of the business or business process that creates the most risk or is most important.
Don Pecha, CISO at managed services provider FNTS, agrees, adding: Each business unit of the company might have unique considerations, and unique compliance, regulatory, or privacy applications, and each business may have unique risks for the board or C-suite to consider.
Frank Kim, CISO-in-residence at venture capital firm YL Ventures, and fellow at the SANS Institute, cites the case of one CISO who was fired after suggesting costly endpoint detection, and response and incident response programs considered not stage appropriate for such a startup. Their focus was on survival and revenue growth, Kim says. He didnt realize his job was not just to suggest a bunch of new security capabilities, but business enablement.
Aligning security with the business goes beyond traditional methods of justifying security spend, such as warning of consequences from hacks or trying to prove ROI. For internal enterprise security teams, Kim says to accept that security is a cost center and demonstrate how the CISO manages total cost of ownership over time. This might include updating CFOs and CEOs on specific cost reduction, such as reducing spend with a security vendor, finding a less expensive product to fill a security need, or improving internal metrics such as the average cost to mitigate a vulnerability, adds Tyson Kopczynski,SVP and CISO at financial services provider Oportun.
Christensen further suggests explaining how security can cut costs or increase productivity. For example, he says, web application firewalls dont only protect applications but cut networking costs by reducing spurious and malicious traffic. Also, adopting zero-trust architecture and secure access service edge technologies can help boost productivity by freeing users from manually deploying virtual private networks to access resources or interrupt meetings when their VPN fails.
Kopczynski adds that CISOs can uncover such improvements with questions such as whether their organization is using all the functions in a security tool, if those features overlap with other tools, and whether the organization is paying too much for licenses or for too many licenses. Ways to maximize value include considering tools that perform multiple security functions, or running penetration tests, attack simulations, or offensive security campaigns that prove a tool can repel high impact attacks, he says. For example, he uses the Titaniam encryption engine to support several data protection use cases, as well as security tools provided by cloud providers such as Amazon and Microsoft. We also look at generic cloud security solutions that provide multiple sets of protections, versus addressing one particular use case, he says.
At global marketing agency and consulting firm The Channel Company, security considerations are deeply embedded in business strategy and budgeting, says CIO Rik Wright. This ranges from the need to meet the European Unions GDPR to complying with security requirements from customers.
Averting threats is also part of the security value equation at the firm, which uses managed services provider GreenPages both for infrastructure and to help meet its security needs. Wright says hes seen some companies spend potentially business threatening amounts up to $20 million after a ransomware attack, so preventing such losses, he says, represents very real value.
Aligning security spend with business needs starts with understanding what is most important to business managers.
Kim recommends using a risk = impact x likelihood formula, and understanding on a scale of 1 to 10 what your most important processes and assets are. Your financial data might be a 10 but your HR data might be a seven as its not a business differentiator, he says. Just using a simple scoring rubric to your risk calculation helps to bubble up what the priorities are.
Besides business, Christensen says CISOs must also consult IT to understand the administrative burden a new security technology might impose, and all the areas in which a security tool could be used to maximize its value. He uses the Secure Web Gateway from dope.security to not only control access, but to understand what information and Web sites users are accessing, and the potential risks they expose the business to.
Industry standard frameworks can also provide a common language and structure for risk assessment, like the NIST (National Institute of Standards and Technology) cybersecurity framework. Its simple enough that its not necessary to be a security practitioner to understand it, but it models your maturity and helps to relate that to business stakeholders, says Christensen, adding its also based on industry standards rather than the CISOs opinions, and is continually updated to reflect new risks.
Different security frameworks are best for different industries, says Pecha. If Im in government, Im going to align with NIST, he says. If youre a global business, use the ISO/IEC27000 family of standards. Its not necessary to be certified, but be compliant and understand what the controls are in order to understand your partners security needs as well as your own.
Scott Reynolds, senior security and network engineering manager for manufacturer Johns Manville, uses the ISA/IEC 62443 standard to create a common understanding between business managers, security experts and suppliers about common terms such as the zones of assets that share common security needs. This process also shows we agree on the same level of risk for the entire zone, and not just each asset in the zone, he says. The weakest link in the zone will impact all the assets within it.
Over at media creation and editing technology provider Avid Technology, Dmitriy Sokolovskiy, its CISO and CSO, uses NISTs Cybersecurity Framework to measure the maturity of his security processes, and the Center for Internet Securitys top security controls for specific tactical guidance,which, he says, highlight, low-hanging fruit that businesses can easily address in their infrastructure.
Several CISOs were skeptical about using benchmarks to compare their security spend with others. Thats because, they say, companies may define security spend differently or have different needs. They also say benchmarks often dont describe how and why organizations allocate their security budgets. As a result, they use benchmarks as a rough guide to budgeting, relying primarily on their own risk assessments.
But Kim warns CISOs against refusing C-level requests for benchmarking. Its not unreasonable to ask for a benchmark, he says. A chief financial officer couldnt say, We cant compare our earnings-per-share with others in the industry. Provide benchmarks, he says, but as one part of a wider explanation of how your security spend compares with others, the challenges the organization faces, and how youre reducing the total cost of ownership of security over time.
CISOs should describe current threats and attacks, says Pecha, and supply alternatives to remediate them. Its then up to the board and the C-suite to decide whats acceptable and what needs to be done to manage the overall risk to the business, he says, because only they have the clout to drive change.
Insisting a business executive formally accept a business risk, even in writing, often convinces them to agree instead to the proposed security spend. When Sokolovskiy has insisted such signoff, Without fail, so far the business unit was actually driven to lower the risk themselves because they own it, he says.
A business-focused approach can also spur efforts by security and business teams to identify opportunities to increase efficiency and save money, says Christensen, such as by eliminating redundant systems and processes. With business alignment, you have no choice but to find unique and innovative ways to solve problems that are generated by how the business operates, he says.
Read more:
Why IT leaders are putting more business spin on security spend - CIO
Leonardo and Cisco partner up to develop joint technology projects – Leonardo
The MoU will boost cooperation between the two players in various areas, with the aim of co-developing solutions in specific technology fields such as quantum cryptography, the green transition and secure solutions for logistics and transportation markets
Leonardo, one of the worlds leading players in the Aerospace, Defence & Security sector, and Cisco Systems, a global leader in the networking and IT sectors, have signed a Memorandum of Understanding (MoU) with the aim of scaling up their mutual business relations and launching a structured collaboration in the civil and defense industry domains.
Within the framework of the MoU, activities will be carried out with the aid of dedicated working groups to periodically and jointly identify business opportunities and areas of technical cooperation that can meet market demands, particularly in the sectors of cyber security, secure networking, Internet-of-Things, the digital workplace and cloud edge computing.
Amongst other things, the agreement provides for the development of potential integrated solutions based on the two players specific and distinctive technological capabilities, with a view to proposing appropriate solutions for market needs. Detailed roadmaps will be drawn up for specific technology areas, such as quantum cryptography, the green transition and security solutions for logistics and transport, enabled using drones and advanced urban security systems.
The MoU also embraces the possibility of joint commercial offerings, via a process of analyzing existing products and solutions aimed at national and international markets, in order to broaden the business opportunities and the audience of potential customers for both players. Finally, under the agreement, Leonardo and Cisco commit to guaranteeing each other reciprocal commercial advantages on proposals previously identified by the two companies that will be finalized in a series of strategic programs.To optimize the joint activity governed by the MoU, a steering committee will be set up to monitor the progress of the partnership and evaluate the overall performance of the collaboration. In turn, the steering committee will set up specific working groups to concretely pursue the joint business opportunities that have been identified.
****
Leonardo, a global high-technology company, is among the top world players in Aerospace, Defense and Security and Italys main industrial company. Organized into five business divisions, Leonardo has a significant industrial presence in Italy, the United Kingdom, Poland and the USA, where it also operates through subsidiaries that include Leonardo DRS (defense electronics), and joint ventures and partnerships: ATR, MBDA, Telespazio, Thales Alenia Space and Avio. Leonardo competes in the most important international markets by leveraging its areas of technological and product leadership (Helicopters, Aircraft, Aerostructures, Electronics, Cyber & Security Solutions and Space). Listed on the Milan Stock Exchange (LDO), in 2021 Leonardo recorded consolidated revenues of 14.1 billion and invested 1.8 billion in Research and Development. The company has been part of the Dow Jones Sustainability Indices (DJSI) since 2010 and has been confirmed among the global sustainability leaders in 2022. Leonardo is also included in the MIB ESG index.
Cisco (NASDAQ: CSCO) is the worldwide leaderin technologythat powers the Internet. Cisco inspires new possibilities by reimagining your applications, securing your data, transforming your infrastructure, and empowering your teamsfor a global and inclusive future. Discover more onThe Networkand follow us on Twitter at@Cisco.Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. A listing of Ciscos trademarks can be found at http://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company.
Press contacts:
Leonardo
Tel: +39 06 32473313
leonardopressoffice@leonardo.com
CISCO
Tel: + 39 02 91339811
Follow this link:
Leonardo and Cisco partner up to develop joint technology projects - Leonardo
Wazuh launches version 4.4 with a suite of new capabilities – CSO Online
Open source security provider Wazuh has launched the latest version of its unified extended detection and response (XDR) and security information and event management (SIEM) platform with a suite of upgraded capabilities.
Wazuh 4.4 adds a string of new features to Wazuh agents and managers, which users deploy on endpoints and servers respectively. These features include support for IPv6 for agent-manager connections, search upgrade to OpenSearch v2.4.1, vulnerability detection for Suse Linux, updates to Linux software composition analysis (SCA) policies, and Azure integrations in Linux agents.
The 4.4 launch implies that all the packages and images for the version such as the AMI, OVA, and Docker images for the Wazuh central components, and the Windows, macOS, Linux, and other operating systems packages for the Wazuh agent are immediate and publicly available, said Santiago Bassett, CEO of Wazuh.
Amazon Machine Images, Open Virtualization Appliance, and Docker images are all pre-configured virtual machine images made available by AWS, VMware, and public docker registries to help users download and deploy across various virtualization platforms.
Wazuhs free and open source managed security platform can be accessed both as an on-premises as well as SaaS-based offering providing detection, incident response, and compliance management capabilities to its customers. The SaaS-based offering is called the Wazuh Cloud.
In order to keep up with the networking standards, Wazuh has updated its platform to add the latest internet protocol version 6 (IPv6) supportto allow agents to register and connect to managers through an Ipv6 address.
It means customers can leverage the benefits of the IPv6 protocol with better security and performance in the agent-server communication, Bassett said. Connecting through IPv4 is still possible, but now its users can opt to set IPv6 parameters for the connections.
Wazuh indexer and dashboard have been reworked to run the latest version of OpenSearch, Amazons open source search and analytics engine. Wazuh now integrates with OpenSearch 2.4.1 to provide a scalable and centralized solution for indexing and analyzing security events and logs collected by its endpoint agents.
Wazuh has also updated the SCA policies for Ubuntu Linux 20.04 and 22.04 because the existing version had some errors, the company said. As part of this task, it has used the Center for Internet Securityguidelines for Ubuntu Linux 22.04 LTS systems.
Previously, the SCA policy for Ubuntu 20.04 systems didnt work as expected. In particular cases, the Wazuh agent didnt report the actual system state correctly using the SCA policy file for this operating system. Wazuh would report some particular configuration test results as failed when they should have actually been reported as passed, Bassett added.
Wazuh 4.4 now supports vulnerability detection in the Suse Linux systems. This was previously available for select Linux systems and other operating systems including Windows, macOS, and FreeBSD.
The company has also added support for Azure integration on its Linux-based agents. This is done by modifying the package generation process to add Azure support on agents installed using Windows Packaging Project (WPK) packages, a distribution format for Windows applications.
Each new WPK package will contain all the updated binaries and source code, and the installer will update all files and binaries to support Azure integration.
Previously, users needed to set up the Azure integration in the Wazuh server but now its possible to configure the very Linux agents to set up the Azure integration, Bassett added.
See the article here:
Wazuh launches version 4.4 with a suite of new capabilities - CSO Online
DDoS attacks shifting to VPS infrastructure for increased power – BleepingComputer
Hyper-volumetric DDoS (distributed denial of service) attacks in the first quarter of 2023 have shifted from relying on compromised IoT devices to leveraging breached Virtual Private Servers (VPS).
According to internet security company Cloudflare, the newer generation of botnets gradually abandoned the tactic of building large swarms of individually weak IoT devices and are now shifting towards enslaving vulnerable and misconfigured VPS servers using leaked API credentials or known exploits.
This approach helps the threat actors build high-performance botnets easier and often quicker, which can be up to 5,000 times stronger than IoT-based botnets.
"The new generation of botnets uses a fraction of the amount of devices, but each device is substantially stronger," explains Cloudflare in the report.
"Cloud computing providers offer virtual private servers to allow start ups and businesses to create performant applications. The downside is that it also allows attackers to create high-performance botnets that can be as much as 5,000x stronger."
Cloudflare has been working with key cloud computing providers and partners to crack down on these emerging VPS-based threats and says it has succeeded in taking down substantial portions of these novel botnets.
In general, Cloudflare reports steady DDoS activity in the first quarter of the year, with a notable 60% YoY increase in the ransom DDoS attacks, representing 16% of all recorded/reported DDoS attacks.
These extortion-based DDoS attacks cause service outages to the target by bombarding them with garbage traffic and continue indefinitely until the victim meets the attacker's demands.
The most targeted country by DDoS attacks in general during Q1 '23 was Israel, followed by the United States, Canada, and Turkey. Internet services, marketing, software, and gaming/gambling were the most targeted sectors.
The most significant attack seen by Cloudflare this quarter peaked above 71 million requests per second. Another notable incident was a 1.3 terabits per second DDoS attack targeting a telecommunications service provider in South America.
In terms of the size and duration of the attacks, most of them (86.6%) lasted for under 10 minutes, while 91% did not exceed 500 Mbps.
However, the number of larger attacks is still growing, with attacks surpassing 100 Gbps, recording a rise of about 6.5% compared to the previous quarter.
DDoS attacks can manifest in many ways, and as defenses evolve to address them, attackers may devise new methods or return to old tactics that newer protection systems may not prioritize anymore.
In this quarter, Cloudflare recorded the following emerging trends:
DDoS attacks in Q1 2023 show a trend of increasing in size and duration, targeting a broad range of industries. Therefore, effective defense strategies require automated detection and mitigation solutions.
Here is the original post:
DDoS attacks shifting to VPS infrastructure for increased power - BleepingComputer
Identity Management Day advice: This is not a one-time project – IT World Canada
Who are you? is one of the first questions when we meet strangers.
Its also the first question a security system asks when anyone tries to access a network. Without verified identity, access is denied.
Yet identity management and its twin, access management is still a huge problem. According to the 2022 Verizon Data Breach Investigations Report, 40 per cent of the 3,875 incidents it looked at involved the use of stolen credentials.
According to a survey of 100 IT and security pros done last year for identity provider Radiant Logic, 61 per cent reported that their business views identity management as too time-intensive and costly to manage effectively on an ongoing basis (although almost the same number agreed it is of vital importance).
These numbers should be kept in mind because today is the annual Identity Management Day, observed on the second Tuesday in April. Its a day when IT leaders should think about their identity and access management strategy or lack of one.
As part of the event today, the U.S.-based Identity Defined Security Alliance is holding a day-long webinar, while Canadas IdentityNorth starts a two-day online symposium on Wednesday.
As we celebrate Identity Management Day, IdentityNorth wants to emphasize the importance of advancing trust in all aspects of identity management, said Krista Pawley, digital transformation and inclusion leader and event co-chair of Identity North. This includes trust in data, building trust with users, and future-proofing IT systems. With sensitive information at risk, building digital trust must be a top priority for IT managers.
According to the Identity Defined Security Alliance, this is a day to raise awareness about the dangers of casually or improperly managing and securing digital identities.
Account management is important enough that it ranks Number Five in the Center for Internet Securitys Top 18 security controls and access control management is Number Six.
Treat identity management like a plan, not a one-time project, urges Geoff Cairns, a principal analyst in Forester Researchs security and risk practice.
Identity management starts, Cairns said, with having executive buy-in to having a plan that recognizes not everyone can access everything. Some employees will have access limited by their roles.
Briefly, experts say, this means management agreeing to a zero-trust approach to security: Dont trust everyone who can log into the network. There has to be regular authentication for accessing sensitive assets.
Access to data or an application can be through role-based access control (based on a users role) or attribute access control (everyone in the human resources department can access a project management tool), or both. The IT leader will have to find a solution that automates provisioning.
This is followed by security control Two: Inventory and rank your software assets because management cant decide what employees and customers can access if doesnt know the data it holds.
Then follow access control best practices and policies to limit access to data to only those who need it.
In some circumstances, notes access provider StrongDM, the principle of least privilege doesnt provide the necessary flexibility that certain situations require. For instance, a help desk associate may need a temporary elevation of privileges to troubleshoot a customers urgent ticket. One way to enforce identity and access management best practices, yet still support the principle of least privilege without compromising user experience, is by leveraging just-in-time access.
A vital step in identity management, Cairns said, is limiting identity sprawl making sure that identities are revised when staff changes roles and revoked when they leave the organization. Thats where identity governance regularly auditing usage and reducing unnecessary standing permissions can pay dividends, he said.
Password management is another step. Although passwordless solutions such as biometrics are increasingly being used by organizations, experts say passwords will be with us for some time. So a login password or passphrase policy is a good place to start. This is especially important if the organization uses single-sign-on tools. Adding multifactor authentication either biometric or sending a one-time code these days is vital. Look for phishing-resistant MFA.
Finally, dont forget that machines such as sensors, servers, PCs, smartphones or POS devices may need identity management as well as people.
Chris Hickman, chief security officer of Keyfactor, notes that Googles initiative to shorten digital certificate lifespans to 90 days from 398 days will complicate identity management. On the one hand, the shorter the window of opportunity to use a stolen certificate, the greater reliance a system can put on the authenticity of the device or workload presenting that digital credential. On the other, its a significant jump and would require a higher degree of automation to manage frequent updates, or significantly more manual labor to keep up, he said in an email.
The biggest mistake IT or identity leaders make is trying to do everything at once, Cairns said. Break down things into chunks that you can prioritize. Getting your arms around what you have your user base, user population, the different roles and attributes is at the top of the list.
Another big mistake is expecting a technical process to solve what is fundamentally a process problem, he added. Identity management depends on a solid strategy and plan that covers people, business processes and technology.
Identity Management Day underscores the importance of protecting our digital identities now that identity-related data breaches are becoming more frequent, said Stuart Wells, chief technology officer of Jumio. Organizations and the public alike must adjust to the current cyber threat landscape and take action by securing and responsibly managing their digital identities. After all, identity-related information remains one of the most coveted data by hackers, and commonplace security measures like passwords, two-factor authentication and knowledge-based authentication are no longer enough to keep data safe. Although cybersecurity is enhanced and developing daily to safeguard data, cybercriminals continue to find new and better ways to access it.
It is crucial for IT and security teams to effectively manage and regularly safeguard all digital identities in their environment, as most breaches today start with compromised identities, said Kevin Kirkwood, deputy chief information security officer of LogRhythm. The best chance of defending against fraudsters trying to access sensitive data is for organizations to deploy the requisite level of security that supports identity access management (IAM) solutions along with enabling consistent identity and single sign-on(SSO) through SIEM (security information and event management) integration.
Hackers dont break in; rather, they log in, said lmog Apirion, chief executive officer and co-founder of Cyolo. So, when we talk about enterprises, we need a shift into a robust zero-trust framework to protect all forms of user data. Identity-based access control enables businesses to strengthen their security posture while also gaining visibility and control over the access to their most critical systems.
More:
Identity Management Day advice: This is not a one-time project - IT World Canada
Standing up for democratic values and protecting stability of … – Microsoft
The explosive growth of private cyber mercenary companies poses a threat to democracy and human rights around the world. Cyber mercenaries private companies dedicated to developing, selling, and supporting offensive cyber capabilities that enable their clients to spy on the networks, computers, phones, or internet-connected devices of their targets are a real cause for concern. These tools have been used to target elections, journalists, and human rights defenders and are increasingly accessible on the open market, enabling malicious actors to undermine our key democratic institutions.
At Microsoft, we believe that digital technology has incredible potential to improve lives across the world, support democracy, and protect and promote human rights. That is why, at the second Summit for Democracy, we were proud to join the international coalition of over 150 companies that make up the Cybersecurity Tech Accord individually and collectively pushing back on the cyber mercenary market by committing to a set of industry principles.
We are also acutely aware that to have real impact, we must pair our commitment with action. Microsoft has disrupted the operations of Knotweed and Sourgum, two cyber mercenary groups targeting victims around the world. Today, we are taking further action. In partnership with security researchers from The Citizen Lab of the University of Torontos Munk School, we have tracked the malware used by an Israeli cyber mercenary we refer to as DEV-0196. The malware has been used to target communities including journalists, NGO workers, and politicians. Microsoft is sharing information about DEV-0196 with our customers, industry partners, and the public to improve collective knowledge of how cyber mercenaries operate and raise awareness about how cyber mercenaries facilitate the targeting and exploitation of civil society. Technical information for customers and the security community is available here.
Combating the threat of cyber mercenaries is a collective effort and we are grateful for our ongoing partnership with Citizen Lab. It shows the impact we can have when we work together. The Cybersecurity Tech Accord principles that members of the technology community have signed onto is also an important step. As the technology industry builds and maintains the majority of what we consider cyberspace, we as an industry have a responsibility to limit the harm caused by cyber mercenaries. A more detailed breakdown of the principles is available on the Cybersecurity Tech Accord website, but at a high level, signatories commit to:
These principles answer President Bidens call for the technology industry to come together and push against the challenges our societies face. They also come at a critical time. There is growing awareness of the existence of cyber mercenaries and an increased and welcome focus by policymakers on both sides of the Atlantic on the issues related to spyware. At the same time, those debates have only touched the tip of the proverbial iceberg. Recently, the Carnegie Endowment for International Peace identified at least 74 governments that have contracted with such firms to specifically gain spyware and digital forensics technology. This is likely an underestimate.
Moreover, it is only a matter of time before the use of the tools and technologies they sell spread even further. This poses real risk to human rights online, but also to the security and stability of the broader online environment. The services they offer require cyber mercenaries to stockpile vulnerabilities and search for new ways to access networks without authorization. Their actions do not only impact the individual they target, but leave whole networks and products exposed and vulnerable to further attacks. We need to act against this threat before the situation escalates beyond what the technology industry can handle.
Multistakeholder collaboration will be essential in combatting this threat. Much of what we know about cyber mercenary tactics has come from the tireless work of those in the civil society that have drawn attention to individual cases of abuse and supported the victims of cyber mercenaries innocent citizens around the world. We hope that industry action will help reverse a worrying trend and encourage governments, in particular democracies, to do more as well. We were therefore pleased to see the Biden Administration take the first steps in this arena with its Executive Order to Prohibit US Government Use of Commercial Spyware that Poses Risks to National Security and the follow-on Guiding Principles on Government Use of Surveillance Technologies supported by 44 Summit for Democracy participating states. We hope other countries follow suit in identifying ways to curb this dangerous market.
Tags: cyberattacks, cybersecurity, Cybersecurity Tech Accord, cyberwar
Read this article:
Standing up for democratic values and protecting stability of ... - Microsoft