Think You Can’t Afford Recovery and Remediation? Think Again. You Have Everything to Lose

Most businesses say they want to prioritize remediation and recovery capabilities, yet when it gets down to it, many ultimately opt not to make these investments. Thirty-five percent require days or even weeks to recover lost SaaS data, and more than a third worry that their company doesn’t have a good enough backup and recovery solution, according to the 2025 State of SaaS Backup and Recovery Report, which surveyed more than 3,700 IT professionals across sectors.

This mindset is problematic because it fails to consider what the company has to lose if it lacks the ability to recover business operations quickly in the event of a cyberattack or other outage.

Just imagine the loss in reputation, accrued regulatory fines, stock value decline and lost business you would face if you ceased operations for several days, weeks or even months. 

According to The Hidden Costs of Downtime report by Oxford Economics, downtime from cyber incidents such as ransomware costs Global 2000 companies an estimated $400 billion annually, or roughly 9% of annual profits — a staggering financial impact of operational disruption.

Businesses that can’t recover rapidly and control their losses could be lost forever.

Here’s how to avoid that by strengthening your defenses and recovering from attacks faster.

Educate Your Teams About How to Avoid Cyber Risk

Talking to your employees about the downstream business impacts of cyber incidents like phishing attacks and offering tips on how best to avoid them can strengthen your resilience.

Tell employees to watch out for unexpected emails or messages, check senders’ emails, avoid clicking on suspicious links, never share passwords via email and report suspicious emails to IT.

Implement Zero-Trust Principles 

The first step in protecting your business and keeping operations up and running is to prevent cyberattacks in the first place. But businesses understand that’s not always possible, given how common and sophisticated such events, which are a when-not-if proposition, have become. 

However, you can significantly enhance your security by implementing zero-trust principles within storage systems to ensure that no one has implicit access to any part of the data. Part of a zero-trust strategy includes encrypting data end-to-end, protecting data through its lifecycle.

Embrace Modern Processes for Compliance, Efficiency and Resilience

Many businesses still rely on the IT processes they have had in place for 20 years. But modern processes now enable businesses to become extremely efficient at keeping their operations up and running. That’s even more critical now that new regulations such as DORA have emerged.

Now is the time to look at your existing processes and technologies and understand what’s working well and what needs to change. Ask yourself: Who manages that process? Is there a single decision-maker? How secure is that process to the business? What does security access control look like, and who should have that access? If there’s an attack, do you have the ability to test against the data set that’s been attacked to know where your recovery point will be?

In light of new directives, you also need to test your processes. This is critical because businesses haven’t traditionally tested their recovery capabilities and verified that their data is good after an attack, because companies typically didn’t have the time. Now, regulations require you to prove you can meet requirements by doing these fire drills at regular intervals. 

To incorporate these new practices into operations and do them quickly will require IT design change. Adopt modern IT infrastructure and processes to meet the cybersecurity and disaster recovery demands of new and existing regulations. Ensure your IT environment enables you to operate at the risk level that’s acceptable to your business. Implement an IT environment and processes that will give you the confidence that cyber incidents will have the least possible impact on your organization, while making it easy for you to access and benefit from your data and providing you with maximum performance capabilities.

Employ Digital Twin Technology for Real-Time Remediation and Resilience

When investing in IT technology that helps your business become more resilient and provides added value, explore how capabilities such as digital twins can enable you to offset that cost.

A digital twin can allow you to use an automated process to help you recover and empower you to be more preventative. You could create the twin of the minimum viable requirements for your company based on the IT infrastructure that’s running your operation. 

If you isolate that digital twin outside of the production environment, you can contend with everything that’s associated with an attack via your digital twin strategy. This will enable you to do real-time remediation and testing to ensure you’re meeting minimum viable requirements in line with regulations. Plus, if a regulator requires your business to do forensic analysis on production, you can do that while continuing your operations. 

Join Forces With a Proven Partner With Sector-Specific Expertise and Skin in the Game    

Many cybersecurity and disaster recovery suppliers give customers a piece of technology and leave it to the enterprise to do the rest. What businesses really need is a strategic partner that they can trust to provide the right advice and deliver high-performance, scalable, sustainable solutions to lower their risk and costs while positioning them to be more competitive.

Seek a trusted supplier that knows your industry, takes the time and effort to learn about your business, has the technology and expertise to deliver what you need, and guarantees predictable recovery in minutes instead of days. Work with that provider to create a business continuity plan that protects your data against cyber risk, minimizes downtime, meets workload demands every time, streamlines operations and empowers you to achieve more with less.

When the operations of your business are at risk, you can’t leave anything to chance. Make sure your cybersecurity and disaster recovery strategies include education across your enterprise, zero trust, modern IT and processes, real-time remediation and resilience for optimal business continuity, and work with a proven partner that deeply understands IT, your sector and you.

Chris millington headshot

Chris Millington is the Global Solutions Lead, Data and Cyber Resilience at Hitachi Vantara.  Chris Millington is a seasoned veteran with 35 years of experience in the IT industry. Throughout his career, he has held various roles, including channel theatre lead, specialist SE, technical expert and global solutions lead. Chris has been instrumental in bridging the gap between field organizations, product management and engineering teams. His efforts have significantly contributed to mentoring the technical community, partner community and customer engagements. In his current role at Hitachi Vantara, Chris provides global coverage for products and solutions within the Hitachi Data Resilience and Compliance portfolio. His deep insights into current trends, regulations and compliance associated with modern infrastructure and processes make him a valuable asset to the organization. Image courtesy of Millington

https://www.securitymagazine.com/blogs/14-security-blog/post/101762-think-you-cant-afford-recovery-and-remediation-think-again-you-have-everything-to-lose



47% of Manufacturing Breaches in 2024 Involved Ransomware

KnowBe4 released its new report highlighting cybersecurity challenges facing the manufacturing industry. As the most targeted industry for cyberattacks for a fourth consecutive year, the report reveals that the manufacturing sector’s expanding digital footprint is putting operations, intellectual property and economic resilience at risk.

A particular concern raised in the report is the persistent threat of ransomware, which continues to dominate attacks in the sector. Manufacturing was the most targeted industry for ransomware from 2023 to 2024, according to the ENISA Threat Landscape 2024. A key reason for this is the industry’s low tolerance for downtime, with every minute of disruption potentially incurring massive costs and cascading effects across entire supply chains.

Key findings from the report include:

  • The frequency of attacks against manufacturing is rising, as the number of confirmed data breaches increased by 89.2% from 2023 to 2024.
  • According to the 2025 Verizon DBIR, ransomware accounted for 47% of all breaches in manufacturing, underscoring its dominance as the attack method of choice.
  • Nearly half (47%) of all manufacturing breaches in 2024 involved ransomware. European manufacturers remain prime targets for major ransomware groups including LockBit, PlayCrypt, and 8Base.
  • Human risk remains a critical vulnerability as social engineering was responsible for 22% of breaches in manufacturing organizations.

The report highlights the significant impact of security awareness training in reducing human risk within the manufacturing sector. Over a 12-month period of consistent and effective training, phishing susceptibility dropped from 31.8% to just 3.6% — a 89% reduction.

Read the report.

https://www.securitymagazine.com/articles/101763-47-of-manufacturing-breaches-in-2024-involved-ransomware



GPUHammer: le GPU NVIDIA sono vulnerabili a un exploit di Rowhammer

Lug 15, 2025 Hacking, In evidenza, Minacce, News, RSS, Vulnerabilità 0

Nuova minaccia per le GPU: secondo un recente comunicato di NVIDIA, le GPU della compagnia sarebbero vulnerabili a RowHammer, una tecnica di attacco che sfrutta la possibilità di alterare la DRAM. 

Rowhammer

Questa tecnica sfrutta la densità delle celle di memoria per corrompere i dati e, di conseguenza, violarne la riservatezza o elevare i propri privilegi. Nel dettaglio, l’attacco consiste nel “martellare” uno specifico bit subissandolo di richieste in un breve periodo, finché non si crea un’interferenza elettrica che altera i bit adiacenti, portandoli da 0 a 1 o viceversa.

I ricercatori Chris Lin, Joyce Qu e Gururaj Saileshwar dell’Università di Toronto hanno dimostrato l’efficacia dell’attacco su diverse tipologie di GPU. Soprannominato “GPUHammer“, l’exploit è riuscito a degradare l’accuratezza di una rete neurale in esecuzione sulla GPU NVIDIA A6000 con memoria GDDR6 dall’80% allo 0,1%.

La vulnerabilità è nota sin dal 2014 ed è stata studiata a lungo, ma soltanto ora si è cominciato ad analizzarne l’impatto sulle GPU. “Con carichi di lavoro critici di IA e ML che vengono eseguiti su GPU discrete in cloud, è fondamentale valutare la vulnerabilità delle GPU agli attacchi Rowhammer” hanno spiegato i ricercatori.

Nonostante sia un attacco difficile da eseguire sulle memorie GDDR per via di una maggiore latenza di comunicazione (rispetto alle memorie DDR4) e di mapping non noti di indirizzi DRAM, l’exploit proposto dai ricercatori dell’Università di Toronto dimostra che è possibile eseguire un GPUHammer.

L’attacco mette a serio rischio l’integrità dei modelli di IA; considerando che questi modelli sono sempre più dipendenti dalle GPU, l’impatto dell’exploit è significativo.

Rowhammer contro le GPU: la risposta di NVIDIA

Poiché Rowhammer è una minaccia hardware, è difficile mitigarla a livello software. Inizialmente si pensava fosse un attacco eseguibile solo in locale, ma nel corso degli anni sono emerse alcune varianti che possono essere eseguite da remoto.

Nel suo comunicato NVIDIA consiglia di abilitare gli ECC (Error Correction Codes) a livello di sistema, ovvero una serie di tecniche per rilevare e correggere gli errori nei dati durante la trasmissione e memorizzazione.

I ricercatori sottolineano però che abilitare gli ECC, oltre a limitarsi a mitigare il rischio senza risolvere il problema alla radice, implica rallentare i carichi di lavoro di inferenza del 10%.

Sebbene le GPU più nuove, come la H100 e l’RTX 5090, non sono vulnerabili all’attacco, è molto probabile che in futuro emergano varianti di Rowhammer che riescano a bypassare le limitazioni attuali.

Condividi l’articolo

Articoli correlati

Altro in questa categoria

https://www.securityinfo.it/2025/07/15/gpuhammer-le-gpu-nvidia-sono-vulnerabili-a-un-exploit-di-rowhammer/?utm_source=rss&utm_medium=rss&utm_campaign=gpuhammer-le-gpu-nvidia-sono-vulnerabili-a-un-exploit-di-rowhammer



New ZuRu Malware Variant Targeting Developers

A new SentinelOne report reveals new artifacts associated with ZuRu, an Apple macOS malware. ZuRu typically spreads via trojanized versions of legitimate software. In May 2025, the malware was observed mimicking a cross platform SSH client and server management tool called Termius. 

Initially documented in September 2021, ZuRu was involved in a campaign hijacking searches for iTerm2 (a macOS Terminal app). ZuRu predominantly relies on sponsored web searches to spread, suggesting the malicious actors responsible for this malware are opportunistic rather than targeted. 

Below, security leaders share insights on this malware as well as risk mitigation strategies. 

Security Leaders Weigh In

Ms. Nivedita Murthy, Senior Staff Consultant at Black Duck:

MacOS users should be cautious of the evolving ZuRu trojan, which is being embedded in legitimate software. To protect themselves, users should adhere to software security best practices, such as downloading applications from trusted sources, such as the App or Play Store, keeping software up-to-date, and avoiding suspicious links. Software is an essential driver of growth and innovation at every company; therefore, IT departments should implement stricter controls on software installation, including restricting who can install software and from where. When updating software, a thorough review should be conducted to ensure that it doesn’t introduce new, undocumented functionality or compromise company data.

Heath Renfrow, Chief Information Security Officer and Co-founder at Fenix24:

The core issue isn’t a novel vulnerability in macOS — it’s social engineering. Organizations must double down on user education to reinforce that all software, even widely-used free tools, should only be downloaded from verified developer websites or trusted app stores. Avoiding sponsored links in search results is key.

ZuRu uses a modified version of the Khepri post-exploitation framework, meaning EDR tools capable of behavioral analytics (like CrowdStrike Falcon, SentinelOne, or eSentire) are essential. This is not just about detecting initial access — it’s about visibility into privilege escalation, persistence, and lateral movement. Teams should proactively threat hunt for signs of modified .app bundles and unusual process behavior related to Terminal utilities.

Mac admins should enforce code signing policies and use MDM solutions to restrict the execution of unsigned or improperly signed apps. While Apple’s Gatekeeper helps, in enterprise settings, more granular controls are often needed to stop ad hoc-signed binaries from executing.

Organizations often lack a tested IR playbook for macOS. This resurgence is a reminder to develop specific detection and response protocols for Apple endpoints — especially as more remote and hybrid workers rely on macOS tools for SSH, RDP, and database access.

Bottom line:

ZuRu’s distribution method and tooling indicate it’s less about targeting specific organizations and more about casting a wide net over users downloading administrative tools. The “fix” is layered: security controls, endpoint visibility, user discipline, and a plan for what to do when a Mac is compromised.

Eric Schwake, Director of Cybersecurity Strategy at Salt Security:

Although the macOS ZuRu malware is primarily a concern for endpoint and supply chain security, its broader implications affect an organization’s overall security, especially regarding APIs.

The risk lies in how compromised endpoints can directly access critical systems and data, much of which is managed and accessed through APIs. For example, trojanized tools such as SSH clients or database utilities can be used to steal credentials or remotely control systems. Attackers can then exploit legitimate API access to backend servers, cloud environments, and sensitive databases, enabling them to execute unauthorized commands, exfiltrate data, or alter services via APIs.

To defend against these threats, organizations should adopt a multi-layered security strategy. This involves strict software supply chain controls to prevent malicious applications from entering the environment, advanced Endpoint Detection and Response (EDR) tools to identify and quarantine malware such as ZuRu, and strong Identity and Access Management (IAM) to safeguard credentials. Crucially, robust API posture governance ensures APIs are designed with least privilege and configured adequately from the outset, complementing behavioral threat detection capabilities that actively monitor for suspicious API activity originating from potentially compromised endpoints. Such a comprehensive approach helps ensure that even if an endpoint is compromised, ongoing attempts to misuse credentials or access APIs are detected and blocked.

https://www.securitymagazine.com/articles/101760-new-zuru-malware-variant-targeting-developers



Zero Trust Onboarding

Questo approfondimento conclude la serie dedicata all’onboarding dei dispositivi IoT, con un focus specifico sullo zero trust onboarding e la sua implementazione pratica. L’articolo esplora le strategie di verifica continua dell’identità, la micro-segmentazione delle reti, l’implementazione del Software-defined Perimeter (SDP) e le tecniche di protezione contro minacce zero-day. Viene presentata una visione completa delle moderne architetture di sicurezza IoT basate sullo zero trust onboarding, con particolare attenzione ai sistemi di monitoraggio continuo e alla gestione delle minacce emergenti.

Verifica Continua e Policy Enforcement nell’IoT Zero Trust

La verifica continua dell’identità dei dispositivi avviene tramite Il “Policy Enforcement Point” (PEP) si riferisce a un componente di sicurezza che applica le politiche di accesso e sicurezza in un sistema. Il PEP è responsabile della decisione di consentire o negare l’accesso a risorse specifiche in base alle politiche definite.

Micro-segmentazione durante onboarding

Un’impresa può scegliere di implementare un’architettura Zero Trust (ZTA) basata sul posizionamento di singole risorse o gruppi di risorse su un segmento di rete unico protetto da un componente di sicurezza del gateway. In questo approccio, l’impresa posiziona dispositivi infrastrutturali come switch intelligenti (o router) o next generation firewall (NGFW) o dispositivi gateway di scopo speciale per fungere da PEP (Policy Enforcement Point) che proteggono ciascuna risorsa o piccolo gruppo di risorse.

In alternativa (o in aggiunta), l’impresa può scegliere di implementare la micro-segmentazione basata su host utilizzando agenti software o firewall sugli asset endpoint. Questi dispositivi gateway concedono dinamicamente l’accesso a singole richieste da un client, asset o servizio. A seconda del modello, il gateway può essere l’unico componente PEP o parte di un PEP multipart composto dal gateway e da un agente lato client.

Ogni risorsa sarà quindi protetta da un firewall dedicato e il traffico in ingresso e uscita monitorato da appositi strumenti quali IDS/IPS e relativi EDD/XDR sulle relative macchine. Questa difesa a strati con richieste d’accesso controllato e continuo monitoraggio consentono un elevato livello di sicurezza delle risorse. Inoltre qualora la macchina in essere risulti compromessa sarà sufficiente isolare solo una specifica area garantendo la continuità degli altri processi, laddove possibile.

Il Software-defined perimeter (SDP), o “Black Cloud”, è un framework di sicurezza “identity-centric” sviluppato dalla Cloud Security Alliance (CSA) che controlla l’accesso alle risorse in base all’identità. L’SDP consente alle organizzazioni di implementare un accesso sicuro personalizzato ai sistemi di rete e di limitare l’accesso agli utenti autorizzati. Il modello “need-to-know” garantisce che ogni dispositivo e utente siano verificati prima di consentire l’accesso alla risorsa.

L’SDP riduce la superficie di attacco a zero creando una connessione di rete personalizzata, micro-segmentata e uno-a-uno tra l’utente e le risorse a cui accede. Pertanto, questo sistema supera tutti gli svantaggi del tradizionale controllo degli accessi alla rete in modo efficace.

L’SDP implementa un modello di zero-trust, che si basa sul principio “Never trust, always verify”. Qualsiasi dispositivo che desideri entrare a far parte della rete dovrà essere verificato e approvato dagli amministratori della rete. Nessun dispositivo non autorizzato potrà dunque accedere alla rete, previa autorizzazione. In tale approccio inoltre ogni utente/dispositivo avrà solo e soltanto le autorizzazioni di cui ha bisogno per effettuare i propri compiti.

Dunque qualora tentasse di accedere ad un’area non consentita dovrà procedere con un iter preposto. Tendenzialmente queste autorizzazione sono a termine, ovvero, solo per il tempo necessario ad eseguire l’attività richiesta. L’SDP funziona da firewall logico, adattando in modo dinamico l’accesso alla rete secondo le politiche stabilite.

Come firewall dinamico, l’SDP segue un’unica regola: negare l’accesso a tutte le connessioni, consentendo l’accesso esclusivamente agli utenti e ai dispositivi autorizzati per interagire con host e/o servizi specifici, in conformità con le politiche.

Architettura SDP e Componenti per Zero Trust IoT

L’architettura dell’SDP ha tre componenti principali:

  • Client (initiating host): eseguito su ogni dispositivo dell’utente. Il client comunica con il controller per stabilire una connessione con il gateway. Prima di concedere il permesso, il controller può richiedere ulteriori informazioni sull’hardware e/o software.
  • Controller: è un punto di autenticazione che valuta la politica per concedere o negare l’accesso all’utente. Il controller determina quali client e gateway possono comunicare e invia le informazioni ai servizi di autenticazione esterni (attestazione, geolocalizzazione, identity services, ecc.).
  • Gateway (accepting host): protegge le risorse del sistema. Il traffico di rete dal client passa attraverso un tunnel crittografato e raggiunge il gateway, dove viene de- crittografato e inviato alle risorse protette. Il gateway stabilisce comunicazione solo su richiesta del controller.
Figura 11. Architettura dell’SDP

Quindi l’SDP client invierà una richiesta di accesso alle risorse verso il controller il quale verificherà che tutti i permessi siano presenti e che le varie utenze e certificati siano validi. In caso di necessità interrogherà l’SDP Gataway per avere maggior dettaglio sull’hardware e/o software richiesto. A tal punto, ultimate le verifiche, il controller autorizzerà il client ad accedere alle sole risorse di competenza tramite l’SDP Gateway.

Le VPN seguono un approccio ”trust-based” e “network-centric” con un focus sulla sicurezza per proteggere le risorse interne dalle minacce esterne. Le VPN sono difficili da configurare e gestire. Quelle tradizionali offrono un ampio accesso alle risorse di rete e non sono adatte al cloud. I principali rischi di sicurezza delle VPN includono il furto di credenziali e un accesso eccessivo alle risorse. Inoltre, le VPN non offrono supporto alla segmentazione della rete e visibilità del traffico; pertanto, non sono appropriate per reti dinamiche. Di seguito alcuni SDP tool:

  • SafeConnect SDP
  • Open Source SDP
  • Pulse SDP
  • Check Point SDP
  • Meta Networks SDP
  • PantherTM

Numerosi nuovi dispositivi IoT si connettono a Internet ogni giorno. Le applicazioni di back-end non solo gestiscono i dati, ma estraggono anche informazioni dai dispositivi gestendo le informazioni sensibili. Gli SDP possono oscurare i server e le loro interazioni sulla rete, migliorandone così la sicurezza.

Grazie all’implementazione del modello di zero-trust e alla fornitura di un accesso remoto sicuro, l’SDP distingue l’accesso alle applicazioni da quello alla rete, creando segmenti sicuri tra utenti e applicazioni per garantire un accesso preciso e controllato. L’SDP è anche compatibile con il cloud e si integra facilmente con esso. Offre tutte le funzionalità di una VPN e supera anche molti dei suoi svantaggi. Blocca inoltre tutte le porte, crittografa il traffico e previene attacchi attraverso la rete. Implementa inoltre la multi-factor authentication (MFA) su ogni risorsa aiutando a mitigare gli attacchi di tipo lateral movement da parte di insider. Implementa più livelli di controllo degli accessi, migliorandone la sicurezza delle applicazioni e dei dati sulla rete.

Di seguito alcuni esempi di MFA:

  • Google authenticator
  • Microsoft authenticator
  • Okta authenticator.

Questo ulteriore livello di verifica è altamente consigliato in quanto, anche in caso di esfiltrazione di credenziali riesce a bloccare momentaneamente accessi non consentiti. Pertanto se ne raccomanda sempre l’implementazione laddove possibile. L’SDP consente una sicurezza dinamica e centrata sull’identità a livello di rete. Implementando controlli di accesso mirati e verificati prima che gli utenti possano accedere alle risorse. Inoltre, previene gli attacchi DDoS sulle risorse di rete rendendo queste ultime invisibili.

Figura 12. Private Cloud Network

SDP abilita inoltre la gestione dei dispositivi tramite BYOD (Bring Your Own Device) garantendo dunque:

  • NAC (Network access Control) che rende visibili i dispositivi che hanno accesso alle risorse di rete.
  • Devices e users validation dinamica.
  • Sistemi di autenticazione sicuri e controllati (con abilitazione MFA laddove possibile).
  • All’interno del perimetro assegnato, viene effettuato un controllo dettagliato dell’accesso degli utenti.

Protezione Zero-Day e Strategie di Monitoraggio IoT

L’approccio ZTA consente inoltre un monitoraggio più efficiente in merito alle minacce zero- day, ovvero, minacce non note o prive di fix/patch. Gli attacchi zero-day coinvolgono solitamente attività che si discostano da quelle “normali”, quindi è importante documentare le linee base di un comportamento ritenuto lecito. Inoltre, instradare il traffico attraverso un servizio di sicurezza interno può garantire che eventuali correzioni influenzino tutto il traffico nel modo più efficace.

L’abilitazione di whitelist può aiutare a mitigare gli attacchi assicurando che solo i servizi/host approvati utilizzino determinate applicazioni. Tuttavia è fondamentale anche comprendere quale sia il comportamento atteso dei vari software in quanto gli attaccanti potrebbero utilizzare dei sistemi legittimi per effettuare delle azioni malevole. In tal senso è fondamentale un sistema di monitoraggio tramite l’uso di SIEM, EDR, IPD/IDS e firewall. Tra i sistemi di passlist noti vi è “AppLock” che consente appunto la definizione di software autorizzati. Infine, è fondamentale un sistema di backup per assicurare che, una volta mitigata e risolta la minaccia, si possa ripristinare il corretto funzionamento.

Uno dei modi per prevenire gli attacchi zero-day è implementando pratiche di progettazione, codifica e testing efficienti per individuare il prima possibile eventuali bug che consentano accessi o attività non autorizzate. Monitorare i siti web della comunità hacker note può spesso aiutare a rilevare attacchi precocemente, poiché gli hacker condividono spesso informazioni sugli exploit zero-day. Tale compito è svolto dai team di threat intelligence, che puntualmente creano e inviano report giornalieri sulle nuove vulnerabilità al fine di ridurre e mitigare quanto prima ogni potenziale minaccia.

Un ulteriore sistema difensivo contro gli zero-day sono le honeypot e/o honeynet. Queste forniscono informazioni sul come gli attaccanti effettuano le loro azioni e quali tool a supporto utilizzano per gli attacchi zero-day. Sono infatti strumenti molto utili per definire le tecniche, tattiche e procedure (TTP) di un attaccante. Il framework del MITRE in tal senso è un ottimo strumento a supporto: https://attack.mitre.org/versions/v10/.

Nuovi attacchi zero-day contro un’ampia gamma di sistemi tecnologici vengono annunciati regolarmente. E’ fondamentale creare un inventario delle applicazioni e mantenere un elenco dei sistemi critici per gestire i rischi di questi vettori di attacco. Poiché gli attacchi zero-day si verificano prima che venga rilasciata una correzione o una patch, prevenirli è molto complicato. Come per molti altri attacchi, è importante mantenere aggiornati alle ultime versioni. Abilitare il monitoraggio del traffico di rete e degli audit può aiutare a ricostruire il percorso di un attacco zero-day. Gli analisti possono ispezionare i log per determinare la presenza di un attacco nella rete, stimare i danni e identificare le azioni correttive.

Le euristiche vengono spesso utilizzate dai software antivirus per identificare minacce che l’analisi delle signature non può scoprire, poiché queste non sono ancora note. Molte soluzioni IDS/IPS possono utilizzano le euristiche per identificare le minacce e prontamente bloccarle.

Per fronteggiare questo fenomeno molte case produttrici di software utilizzano dei “mercati intermediari” in cui vengono convalidate le vulnerabilità zero-day scoperte e, in base alla loro criticità, pagano coloro che l’hanno segnalata. Tra le realtà più consolidate ci sono:

  • zeronomi.com
  • zerodium.com
  • netragard.com
  • zerodaytechnology.com
  • zerodayinitiative.com

I siti di questo tipo sono completamente legali, in quanto si limitano a validare e retribuire le vulnerabilità scoperte dai diversi “ethical hacker” e simili. Un altro modo per mitigare e/o individuare queste vulnerabilità, oltre alla condivisione delle informazioni con strumenti di threat intelligence quali MISP e framework come il NIST e simili, è far uso di sandbox al fine di individuare prontamente comportamenti “inattesi”. Questi ambienti sono tipicamente protetti ed isolati dall’ambiente di produzione così da garantire la sicurezza. Di seguito alcuni esempi di sandbox:

  • Fireeye
  • Cuckoo
  • Hybrid Analysis
  • AnyRun

Le sandbox sono dunque uno strumento molto utile per gli analisti e consentono lo studio di malware in ambienti protetti e controllati. Permettono infatti di verificare se durante l’esecuzione avvengono delle chiamate a siti fraudolento e/o tentativi di contattare eventuali sistemi di botnet per instaurare eventuali backdoor e sistemi di command and control (C2C). Inoltre qualora si eseguisse un ransomware, con l’abilitazione ad esempio di macro come nel caso del malware Emotet, l’unico sistema afflitto sarà la sandbox che sarà prontamente ripristinata una volta terminata l’analisi. Ogni sandbox al termine della sua esecuzione tipicamente produrrà un report a supporto dell’analista che potrà arricchirlo con sue ulteriori considerazioni.

In questo ultimo articolo della serie abbiamo esplorato l’implementazione pratica del modello Zero Trust nell’onboarding IoT, dalla micro-segmentazione alla protezione contro minacce zero-day. Per approfondire tutti gli aspetti dell’onboarding sicuro dei dispositivi IoT, dalle basi teoriche alle implementazioni pratiche, vi invitiamo a scaricare il white paper completo “Onboarding dei dispositivi IoT” di Fabrizio Giorgione e Giovanni Cappabianca.

Fonti:

Profilo Autore

Fabrizio Giorgione si è laureato nel 2018 alla magistrale in ingegneria informatica presso l’università degli studi del Sannio con una tesi dal titolo “Analisi della superficie di attacco di un sistema SCADA”. Nello stesso anno ha iniziato a lavorare nel settore della Cyber Defense in NTT Data come Cyber Security Expert all’interno dello zenSOC in molteplici contesti internazionali occupandosi anche di tematiche relative all’incident response, email security, malware analysis e threat intelligence.Ha conseguito numerose certificazioni tra cui: CompTIA CySA+, Splunk, Proofpoint, Microsoft, FireEye e Fortinet e utilizza le sue conoscenze e competenze per guidare e supportare colleghi e amici su tematiche legate alla cyber security e all’ingegneria dell’informazione.

Profilo Autore

Giovanni Cappabianca, classe 1992, ha conseguito la laurea magistrale in Ingegneria Informatica presso l’Università degli Studi del Sannio (BN) nel 2016.

La sua carriera professionale è iniziata in Ernst & Young, dove ha ricoperto il ruolo di Data Analyst, acquisendo competenze fondamentali nell’analisi dei dati. Nel 2017, ha partecipato a una competizione indetta dal Gruppo Ferrovie dello Stato, distinguendosi tra i primi 28 candidati su un ampio numero di partecipanti. Questo successo lo ha portato a trascorrere due anni presso la capogruppo “Ferrovie dello Stato S.p.A.” come ICT Project Manager, dove ha affinato le sue capacità nella gestione di progetti complessi. Successivamente, Giovanni è entrato a far parte del Gruppo Enel come ingegnere del software specializzato nell’Internet of Things (IoT).

Attualmente, ricopre il ruolo di Architetto IoT, occupandosi dell’analisi dei requisiti di business e della progettazione di soluzioni architetturali IoT end-to-end. Le sue responsabilità includono la fornitura di stime e tempi di realizzazione, la gestione tecnica dei progetti come team leader e l’analisi dei costi dei servizi cloud AWS, con l’obiettivo di individuare opportunità di ottimizzazione.

Condividi sui Social Network:

https://www.ictsecuritymagazine.com/articoli/zero-trust-onboarding/



Reframing ROI in Cybersecurity: From Cost Center to Business Enabler

In cybersecurity, success can feel like fighting an uphill battle. You can make all the right decisions, implement strong controls, train staff, follow every framework, and still fall victim to an attack. Meanwhile, others may take a more passive approach and avoid visible fallout, at least for a time. This uneven playing field makes it especially difficult for CISOs and cybersecurity leaders to define, defend and demonstrate the return on their security investments. 

As cyber budgets expand and boards demand clearer justification for security spend, CISOs and cybersecurity leaders must rethink how they define and demonstrate return on investment (ROI) — shifting the focus from cost avoidance to measurable business value.

Cybersecurity ROI isn’t just about loss prevention. It’s about enabling the business — confidently and securely. A mature security program gives organizations the freedom to innovate, expand and adapt. That’s strategic value — real and measurable, even if it doesn’t always show up on a balance sheet.

Beyond the Balance Sheet: What Cyber ROI Really Means

Traditional ROI models fall short in cybersecurity. There’s no line item for “breach prevented” or “reputation preserved.” Yet the absence of disaster is itself a return — one that often results from years of smart investment, careful planning, and continuous improvement.

The real ROI of cybersecurity lies in:

  • Reduced risk exposure
  • Avoided costs from downtime or data breaches
  • Regulatory compliance and audit readiness
  • Preserved customer trust and brand equity
  • Operational continuity during adverse events

Even when nothing happens, something valuable is being delivered: stability, resilience, and peace of mind.

Metrics That Matter

While it’s difficult to calculate “breaches avoided,” meaningful metrics do exist — and they help tell a compelling ROI story when tied to business impact. Consider tracking:

  • Mean time to detect/respond (MTTD/MTTR)
  • Severity and volume of thwarted threats
  • Reduction in legacy tools and overlapping capabilities
  • User experience improvements and policy adherence

Just as importantly, tell the story behind the metrics. A stopped credential stuffing attempt may seem minor — until you connect it to a major compromise it could have caused. These narratives transform raw data into evidence of value.

Spend Smarter, Not Just More

Budget increases alone don’t equate to better security. The most resilient organizations aren’t necessarily the ones with the largest budgets — they’re the ones that spend with precision.

Effective cyber ROI comes from:

  • Aligning security priorities with business goals
  • Investing in foundational capabilities (people, process, architecture)
  • Building flexibility to adapt as threats and technologies evolve

This disciplined, risk-informed approach ensures security is seen not as a cost center — but as a critical enabler of growth, trust, and long-term success.

Invest in What Matters: Three High-Impact Areas

To maximize long-term returns, security leaders should focus on foundational areas that drive measurable outcomes and strategic alignment:

1. Incident Response Readiness

A tested, cross-functional incident response (IR) plan is more valuable than any single product. When crisis strikes, speed and coordination make all the difference.

Invest in:

  • Tabletop exercises and simulations
  • Clearly defined roles across departments
  • Communications protocols and escalation paths

The faster your organization can detect, isolate and recover from an incident, the lower the cost and impact.

2. Talent and Training

Technology is only as effective as the people who use it. Regular, role-specific training not only reduces the likelihood of human error but also builds a security-first culture.

Prioritize:

  • Employee awareness programs tailored to real-world risks
  • Advanced exercises for security teams (e.g., red/blue/purple teaming)
  • Upskilling talent to close expertise gaps in areas like threat hunting, cloud security, and identity governance

These investments pay dividends by hardening your human layer — arguably the most targeted layer in today’s threat landscape.

3. Modern Security Architecture 

The legacy perimeter is gone. Cloud adoption, hybrid work, and shadow IT have transformed the attack surface. Forward-looking organizations are adopting architectural models like secure access service edge (SASE), which converges networking and security in a cloud-native framework. Its principles — centralized policy enforcement, identity-based access, continuous monitoring — allow for:

  • Greater agility
  • Reduced complexity
  • Stronger alignment with zero-trust strategies

Architecture modernization is not about chasing trends; it’s about building a resilient and adaptable foundation for the future.

The Bottom Line: ROI is Resilience

The goal of cybersecurity isn’t just to stop attacks — it’s to build an adaptive, durable, and business-aligned function that earns its seat at the table. A function that contributes to innovation, supports transformation, and ensures the business can operate confidently in an unpredictable world.

That’s the true return on cybersecurity investment: a resilient enterprise, ready for whatever comes next.

John hurley headshot

John Hurley is Chief Revenue Officer at Optiv. Image courtesy of Hurley

https://www.securitymagazine.com/blogs/14-security-blog/post/101761-reframing-roi-in-cybersecurity-from-cost-center-to-business-enabler



Nvidia chips become the first GPUs to fall to Rowhammer bit-flip attacks

Nvidia is recommending a mitigation for customers of one of its GPU product lines that will degrade performance by up to 10 percent in a bid to protect users from exploits that could let hackers sabotage work projects and possibly cause other compromises.

The move comes in response to an attack a team of academic researchers demonstrated against Nvidia’s RTX A6000, a widely used GPU for high-performance computing that’s available from many cloud services. A vulnerability the researchers discovered opens the GPU to Rowhammer, a class of attack that exploits physical weakness in DRAM chip modules that store data.

Rowhammer allows hackers to change or corrupt data stored in memory by rapidly and repeatedly accessing—or hammering—a physical row of memory cells. By repeatedly hammering carefully chosen rows, the attack induces bit flips in nearby rows, meaning a digital zero is converted to a one or vice versa. Until now, Rowhammer attacks have been demonstrated only against memory chips for CPUs, used for general computing tasks.

Like catastrophic brain damage

That changed last week as researchers unveiled GPUhammer, the first known successful Rowhammer attack on a discrete GPU. Traditionally, GPUs were used for rendering graphics and cracking passwords. In recent years, GPUs have become the workhorses for tasks such as high-performance computing, machine learning, neural networking, and other AI uses. No company has benefited more from the AI and HPC boom than Nvidia, which last week became the first company to reach a $4 trillion valuation. While the researchers demonstrated their attack against only the A6000, it likely works against other GPUs from Nvidia, the researchers said.

The researchers’ proof-of-concept exploit was able to tamper with deep neural network models used in machine learning for things like autonomous driving, healthcare applications, and medical imaging for analyzing MRI scans. GPUHammer flips a single bit in the exponent of a model weight—for example in y, where a floating point is represented as x times 2y. The single bit flip can increase the exponent value by 16. The result is an altering of the model weight by a whopping 216, degrading model accuracy from 80 percent to 0.1 percent, said Gururaj Saileshwar, an assistant professor at the University of Toronto and co-author of an academic paper demonstrating the attack.

https://arstechnica.com/security/2025/07/nvidia-chips-become-the-first-gpus-to-fall-to-rowhammer-bit-flip-attacks/



Nearly 250,000 Records From Tax Credit Consulting Agency Exposed

Research from Cybersecurity Researcher Jeremiah Fowler has uncovered an unencrypted, non-password-protected database containing 245,949 records. 

The database appears to belong to Rockerbox, a tax credit consultancy. The files hosted personally identifiable information (PII) that, if in the possession of a malicious actor, could leave individuals at risk of phishing, social engineering, financial crimes or identity theft. However, at this time, there is no evidence that any threat actor accessed this data. 

The PII included in the database includes: 

  • Names 
  • Addresses 
  • Email addresses 
  • Birth dates 
  • Social Security numbers and/or Social Security number cards 
  • Driver’s licenses
  • Identification cards 
  • Work opportunity tax credit documents (including employment and salary information) 
  • Letters of acceptance or denial of eligibility 
  • DD214 forms (Certificates of Release or Discharge from Active Duty) 

Fowler sent a responsible disclosure notice to the organization, and the database was later restricted.

https://www.securitymagazine.com/articles/101759-nearly-250-000-records-from-tax-credit-consulting-agency-exposed



eSIM: una vulnerabilità introdotta da Kigen consente di installare applet malevoli

Lug 14, 2025 In evidenza, Minacce, News, RSS, Vulnerabilità 0

I ricercatori di AG Security Research hanno individuato una vulnerabilità negli eUICC di Kigen, chip che abilitano le funzionalità delle eSIM, che consente a un attaccante di installare applet malevoli sui dispositivi.

Nel dettaglio, il problema risiede nella tecnologia Java Card usata da Kigen negli eUICC ed è causato da condizioni di “type confusion” già segnalate dalla compagnia di sicurezza nel 2019. Oracle, gestore delle specifiche tecniche delle Java Card, aveva ritenuto che non ci fosse in realtà alcun problema di sicurezza, dal momento che il bug era “non applicabile”. Ora che i ricercatori hanno dimostrato la fattibilità dell’attacco, le aziende e associazioni coinvolte sono corse ai ripari. Probabilmente, come spesso accade, un po’ in ritardo.

eSIM Kigen

Il problema coinvolge Kigen in quanto la compagnia si occupa dell’implementazione specifica della Java Card, implementazione che si è rivelata vulnerabile proprio perché introduce condizioni di type confusion rischiose. 

Utilizzando la vulnerabilità, gli attaccanti possono utilizzare profili di test delle eSIM, come il GSMA TS.48 Generic Test Profile, un profilo di test utilizzato per effettuare verifiche di compliance, a loro piacimento. Sfruttando il bug, i cybercriminali sono in grado di installare applet non verificati, potenzialmente malevoli, di clonare le eSIM e di intercettare le comunicazioni.

Tutto ciò ha un impatto notevole sui consumatori: clonando una eSIM su un altro eUICC, gli attaccanti possono prendere il controllo delle identità degli utenti e accedere anche a quei servizi che usano l’autenticazione a due fattori tramite SMS o le password monouso. La situazione è complessa anche perché gli operatori di rete mobile non sono in grado di rilevare se un profilo eSIM sia stato compromesso e copiato su un eUICC differente.

In un advisory di sicurezza pubblicato il 9 luglio, Kigen ha annunciato ai propri utenti di aver rilasciato una patch risolutiva, introducendo un fix per il sistema operativo; al contempo, la GSMA ha applicato alcune restrizioni ai profili di test.

AG Security Research ha specificato di non essere d’accordo con l’intervento di Kigen, affermando che non è risolutivo. Secondo i ricercatori, la compagnia sussidiaria di ARM ha minimizzato l’accaduto evidenziando che le problematiche erano presenti nel profilo TS.48 Generic Test Profile, mentre la falla indicata da AG Security Research ha una natura ben più profonda e sistemica. 

Condividi l’articolo

Articoli correlati

Altro in questa categoria

https://www.securityinfo.it/2025/07/14/esim-una-vulnerabilita-introdotta-da-kigen-consente-di-installare-applet-malevoli/?utm_source=rss&utm_medium=rss&utm_campaign=esim-una-vulnerabilita-introdotta-da-kigen-consente-di-installare-applet-malevoli



4 Critical, Known Exploited Vulnerabilities Added to KEV Catalog

The Cybersecurity & Infrastructure Security Agency (CISA) has added four new vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalogue, citing evidence of active exploitation. 

The vulnerabilities are as follows:

  • Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability (CVE-2014-3931) 
  • PHPMailer Command Injection Vulnerability (CVE-2016-10033) 
  • Rails Ruby on Rails Path Traversal Vulnerability (CVE-2019-5418) 
  • Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-9621) 

Below, security leaders elaborate on these vulnerabilities and discuss the risks. 

Security Leaders Weigh In 

Jason Soroko, Senior Fellow at Sectigo:

The four flaws recently flagged by CISA illustrate how forgotten code can outlive its news cycle. Security teams should not let the publication date lull them into complacency.  

  • CVE-2014-3931 still lurks in aging Multi Router Looking Glass instances where the fastping buffer overflow lets a remote user corrupt memory.  
  • CVE-2016-10033 haunts legacy web apps that never replaced or updated PHPMailer, allowing hostile input to hijack the mail routine and run arbitrary commands.  
  • CVE-2019-5418 keeps exposing Ruby on Rails’ servers when crafted accept headers trick render calls into disclosing local files, with proof-of-concept chains that reach code execution in some setups.  
  • Only CVE-2019-9621 has a known campaign: Trend Micro tied the Earth Lusca group to widespread Zimbra breaches in 2023 that planted web shells and Cobalt Strike beacons via the SSRF bug.

James Maude, Field CTO at BeyondTrust:

Just like fashion trends, the lifecycle of a vulnerability can be cyclical. If you get it wrong, it can really come back to bite you. With huge volumes of vulnerabilities reported every year, the challenge many organizations face is that if they don’t patch it within the first 90 days, they might never patch it. In some cases, risks of not patching will be accepted as they may be mitigated by access controls However, once an attacker is within the network or able to access the system then those historic mitigations fail.

As an industry, this should be a bit of a wake-up call that prevention isn’t dead. Software patching, implementing least privilege, and controlling execution are hugely effective defenses that shouldn’t be dismissed in favor the latest detection trends. One of the challenges many organizations face is holistic visibility of their attack surface, that could be through unpatched software vulnerabilities or increasingly their identity attack surface both of which have likely grown significantly over the years. 

While many might be surprised at the age of these vulnerabilities when it comes to threat actors “it ain’t stupid if it works” and in many cases compromising the right identity will provide access to a VPN and a network full of vulnerable systems. When it comes, any exploit, be that one from a decade ago to a brand new zero day, the more you can control the privilege and access of identities the less risk you are exposed to. Now is the time to patch and proactively reduce the attack surface.

Mr. Mayuresh Dani, Security Research Manager, at Qualys Threat Research Unit:

The inclusion of these older, but actively exploited, vulnerabilities in the CISA KEV catalog cements the fact that threat actors are adept at finding and abusing unpatched software regardless of their age. This shows that threat actors often select vulnerabilities based on their ability to maximize access, persistence and impact within a target environment rather than their age.

Organizations should not assume that only new vulnerabilities are being targeted. What’s more is that all affected products are commonly accessible from the internet or serve as critical infrastructure — such as email servers, web application frameworks, and network diagnostic tools, making them prime targets for automated scanning and exploitation. To address these vulnerabilities, organizations should:

  1. Conduct a thorough inventory to locate all systems running vulnerable software, including legacy and shadow IT assets. 
  2. Dependencies should also be identified as PHPMailer can be used in web applications, Rails in other SaaS platforms.
  3. Limit access to diagnostic tools (like MRLG) and collaboration platforms (like Zimbra) to only trusted networks or users.
  4. Use network segmentation via firewalls and access control lists to minimize unnecessary exposure of services to the internet.

Frankie Sclafani, Director of Cybersecurity Enablement at Deepwatch:

The recent addition of four older, yet actively exploited vulnerabilities (CVE-2014-3931, CVE-2016-10033, CVE-2019-5418, CVE-2019-9621) to the United States Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog highlights a critical, often underestimated aspect of modern cybersecurity: the persistent danger of long-standing, unpatched flaws. Organizations cannot afford to dismiss a vulnerability listed on the KEV solely based on its discovery date. The KEV catalog provides a crucial indication that even deeply embedded, older flaws are being actively weaponized. Despite being between five and 10 years old, these four vulnerabilities represent opportunities for a variety of threat actors, ranging from financially motivated cybercriminals to sophisticated state-sponsored groups such as Earth Lusca, identified by Trend Micro.

The age of a vulnerability can actually amplify the threat, due to the increased likelihood of unpatched instances across various systems. Older vulnerabilities, even those dating back years, can still pose a significant threat to organizations for several reasons. Most notably, once a vulnerability is disclosed and a CVE ID is assigned, detailed information, particularly exploitation proof-of-concept (PoC) code, often becomes readily available shortly thereafter. This means that even less-skilled attackers can easily find vulnerable systems and use these exploits. Cybercriminals also often create and share toolkits, automated scanning tools that specifically look for these well-known, unpatched vulnerabilities, making it easy to identify vulnerable organizations. There have been many examples over the years including the Equifax data breach in 2017, which was attributed to a failure to patch a known vulnerability (CVE-2017-5638) in the Apache Struts framework, which had a fix available months prior.

https://www.securitymagazine.com/articles/101758-4-critical-known-exploited-vulnerabilities-added-to-kev-catalog