@import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content:; display: block; text-align: center; font-size: 18px; color: #404144; }

The cybersecurity industry has a longstanding reputation of having a perpetual “Help Wanted” sign on display. While it is true that there remains a need for cybersecurity professionals at many organizations, the reality is more nuanced as we navigate a period in which hiring is slowing, according to ISACA’s State of Cybersecurity research.

“It’s pretty tough,” assessed Jeff Combs, cybersecurity recruiter and career coach, in a recent interview with global digital trust association ISACA. “There are a lot of people in the market and there are fewer roles available. And the practices that companies use to recruit people are not very transparent and are creating a lot of FUD (fear, uncertainty, and doubt) and confusion. That said, everything is cyclical and I’m starting to see signs that things are starting to pick up again, and now is the time to retool and get ready for what’s coming in the next couple of years.”

In a tighter hiring market, it is even more important for candidates to find ways to differentiate themselves and demonstrate they are equipped to be assets to the organization. Here are some strategies that cybersecurity professionals can use to stand out.

One tried-and-true way to differentiate yourself is to achieve industry certifications that are aligned with the specific roles a candidate is pursuing. Earning respected industry credentials is a clear way for jobseekers to demonstrate an investment in their career and a commitment to gaining deep expertise in their domain.

While many certifications test a candidate’s knowledge, others, like the new Certified Cybersecurity Operations Analyst (CCOA) credential from ISACA, also have a hands-on component that validates the technical expertise that is especially in-demand for many organizations. As Combs noted, there is no shortcut to gaining the deep, technical understanding of the systems practitioners are charged with defending.

“If you really are invested in a technical career path, that means you’ve got to dig the foundation, and that means getting dirty and learning those hard skills,” Combs said.

CCOA helps early-career practitioners prove they can evaluate threats, identify vulnerabilities and counteract cyber incidents, and is a useful precursor to more senior-level security credentials such as the Certified Information Security Manager (CISM). CISM is focused on management and is tailored for those looking to develop and manage an enterprise information security program. There are many other options, too, such as credentials that focus on more specialized areas such as ethical hacking and cloud security. Jobseekers should identify which type of security role they are most interested in and research which industry credentials will best validate that they are serious about excelling in that role.

In a tighter hiring market, it is even more important for candidates to find ways to differentiate themselves and demonstrate they are equipped to be assets to the organization.

Additionally, in a job interview, the ability to reference a recent professional development course with an emerging technology focus — and especially learning that ties in with the specific role that the candidate is applying for — can go a long way toward positioning the candidate as somebody who recognizes the importance of keeping pace with the evolving threat landscape.

Some areas to focus on include:

• Artificial Intelligence and Machine Learning: Understanding how AI and ML can be used for cybersecurity applications, like threat detection and response, is becoming increasingly important.
• Blockchain Technology: With its growing use in various sectors, understanding blockchain’s security implications can give professionals an edge.
• Cloud Security: As organizations continue to migrate to the cloud, knowledge in cloud security practices and tools is invaluable.

While achieving certifications and being attuned with emerging tech puts candidates in solid shape when it comes to substance, many strong candidates are overlooked for roles if they are unable to effectively frame why they are the right person for the job. In other words, substance matters, but so does style — or at least presentation. Talent acquisition professionals are stretched thin and often lack the deep subject matter expertise to know exactly what they are looking for in a cybersecurity professional.

It is important for applicants to ensure their résumés, cover letters, and LinkedIn presences accentuate the most valuable skills and experience they have to offer. Career expert Caitlin McGaw recommends creating and highlighting a master list of top projects and accomplishments that align with the role.

“Build your résumé to guide interviewers to ask about the work you really want to tell them about, the experience that sells you for the role,” McGaw writes. “By doing this, you will have brilliantly created — in advance — a path for the interviewer to follow.”

Although the security job environment may not be as favorable for candidates as it was a couple of years ago, there are still opportunities to enter and advance in the profession. The cyber threat landscape remains precarious, and smart organizations know they need robust, well-prepared security teams to safeguard their organization’s data and reputation. By recognizing the value of pertinent industry certifications, becoming knowledgeable about how emerging technology is reshaping the enterprise landscape, and being intentional in how they communicate their qualifications, there are promising paths for professionals to enter and advance in the cybersecurity field.

In this ever-evolving field, staying proactive, adaptable and continuously learning are the keys to standing out and achieving career success in cybersecurity.

https://www.securitymagazine.com/articles/101363-how-security-professionals-can-stand-out-in-a-tighter-market

Security teams are overwhelmed. That’s not an exaggeration — it’s just a statement of fact. Talk to security professionals at any organization, from small businesses to Fortune 500 companies, and you’ll hear the same story. SecOps and security engineering teams are stretched thin, with their attention divided across cloud, automation, AI, containers, scalable environments, and dozens of other “urgent” priorities. What’s more, the number of security controls in place has increased dramatically over the past several years, resulting in a never-ending flood of alerts to analyze and incidents to investigate.

Unfortunately, this comes at a time when staffing pressures are at an all-time high. Before the COVID-19 pandemic, organizations invested heavily in security solutions — but recent economic pressures, staffing reductions, and management demands are making it difficult for security and IT teams to keep pace with the evolving threat landscape. With new vulnerabilities emerging faster than security teams can keep up with, many are being forced to pick and choose which exposures to address and which to set aside. This isn’t just leaving organizations open to potential attacks — it’s fatiguing security professionals and leaving them prone to burnout. As we kick off 2025, organizations will need to reevaluate how they approach security. 

Embracing simplicity and automation  

Two key trends have begun to emerge as organizations consider how to address the increasingly perilous security landscape. First, a growing number of organizations are embracing a “back to basics” approach to security, focusing on essential security controls and best practices and reducing the number of extraneous security solutions in place. The idea here is to reduce the security stack to a leaner, more effective toolkit. This can be a good idea — if done carefully. With so many security solutions on the market, organizations may have overlapping controls in place without even knowing it. By validating their security solutions and determining which ones are actually necessary, organizations can save money while also reducing the volume of redundant alerts security teams receive.  

The second trend is no surprise: as AI and automation capabilities become more advanced, organizations are increasingly seeking to leverage autonomous security solutions. Those solutions have primarily been focused in two key areas: threat detection and response and exposure management. Today’s threat detection and response solutions tend to utilize endpoint detection and response (EDR), Security Information and Event Management (SIEM) systems, and other orchestration tools to collect data, analyze it, identify key threats, and respond accordingly. Exposure management, on the other hand, consolidates vulnerabilities and misconfigurations, prioritizing recommended actions based on unified security metrics and allowing organizations to more effectively determine which issues are critical and which can be safely deferred.  

Keeping security teams focused on what matters

These growing trends are having a meaningful impact on security and IT personnel, helping to ease the burden placed upon them while also allowing them to be more effective. At a time when the ongoing cybersecurity skills shortage has made it difficult for many organizations to hire experienced security professionals, this is a significant development. The truth is, security professionals enter the field because they enjoy problem solving. They want the opportunity to think laterally, solve problems, and make a difference for their organization. Security teams don’t mind being busy — they just don’t want to be bogged down in busywork. When skilled employees are stuck performing repetitive tasks or engaging in fruitless investigations, burnout tends to come quickly.  

By automating the more tedious elements of security and reducing the number of frivolous tickets and alerts, organizations are increasingly keeping their IT and security teams engaged with their work. While limiting the number of security solutions in use might seem risky, it is often the best approach. By prioritizing complementary solutions rather than overlapping ones, organizations can limit the number of duplicate alerts and ensure that security teams are focused on only the most pressing threats. This reduces response times, limiting attackers’ ability to operate freely and expand their footprint within the network. Instead of investigating perceived vulnerabilities that turn out to safely covered by compensating controls, security teams can quickly snap into action remediating actual threats and exposures.    

Getting back to basics 

As AI capabilities continue to improve and automated solutions become more reliable, we can expect the trend toward automation to continue into 2025. Coupled with the trend toward a more streamlined security stack, we are likely to see security teams become leaner and meaner in the coming years, becoming increasingly effective using a smaller number of more purpose-driven solutions. Organizations are beginning to recognize that simply layering the newest, most “cutting edge” solutions atop one another isn’t always the answer — often, the best solution is the simplest one. It’s likely that organizations will look to embrace “back to basics” approach this year, and modern, automated security solutions will help provide them with the capacity and bandwidth to do it.  

https://www.securitymagazine.com/articles/101378-automation-and-a-back-to-basics-approach-will-shape-cybersecurity-in-2025

Feb 12, 2025 Marina Londei Hacking, In evidenza, News, RSS 0

---

La polizia thailandese ha arrestato quattro hacker europei accusati di aver causato danni per circa 16 milioni di dollari tramite campagne con il ransomware Phobos.

L’ “Operation PHOBOS AETOR“, guidata dalle autorità thailandesi, svizzere e statunitensi, si è conclusa a Phuket, in Thailandia, con la cattura di due uomini e due donne che avrebbero colpito oltre 1.000 vittime in tutto il mondo col proprio ransomware.

“La polizia ha sequestrato oltre 40 prove, compresi telefoni cellulari, laptop e portafogli digitali” si legge su Khaosod, una testata giornalistica thailandese. “I sospetti sono accusati di cospirazione per aver commesso reati contro gli Stati Uniti e cospirazione per aver commesso frodi telematiche“.

All’operazione ha partecipato anche l’Interpol, contattata dalle autorità svizzere e statunitensi che hanno richiesto un mandato di cattura internazionale per i cybercriminali.

Phobos, individuato per la prima volta nel 2019, viene distribuito tramite connessioni RDP sui dispositivi delle vittime. Basato ampiamente su Dharma (o CrySis), il ransomware cifra non solo i file del disco locale, ma anche le cartelle di rete condivise. Stando all’analisi di ThreatDown di Malwarebytes, il malware sfrutta numerosi meccanismi di persistenza e ciò lo rende molto aggressivo, permettendogli di infettare il dispositivo più volte; inoltre, può cifrare i file senza connessione a Internet.

La nota del riscatto viene creata non appena inizia la routine di cifratura. Nel messaggio gli attaccanti indicano la possibilità alle vittime di inviare cinque file per farli decifrare gratuitamente, purché non siano più grandi di 10Mb, non siano archivi compressi e non contengano informazioni di valore per l’organizzazione.

Secondo quanto rivelato dalle autorità, gli hacker hanno colpito 17 organizzazioni con sede in Svizzera dal 30 aprile 2023 al 26 ottobre 2024. Il gruppo richiedeva un riscatto in criptovalute e minacciava di pubblicare i dati sottratti in caso di mancato pagamento. I riscatti venivano poi riciclati su piattaforme di Coin Mixer per nascondere le transazioni.

Al momento i sospetti si trovano in custodia giudiziaria e le loro identità non sono state rivelate, mentre le indagini proseguono per comprendere la reale estensione del gruppo.

---

---

---

https://www.securityinfo.it/2025/02/12/arrestati-quattro-hacker-dietro-il-ransomware-phobos/?utm_source=rss&utm_medium=rss&utm_campaign=arrestati-quattro-hacker-dietro-il-ransomware-phobos

A recent report by Cognyte analyzed the results of a survey of law enforcement security threats. The report found that 79% of law enforcement agencies (LEAs) struggle to unlock the insights they need. 

Twenty-seven percent of LEAs are faced with growing ties between criminal networks and terror groups, and 39% of LEAs are unable to resolve their investigations in a reasonable timeframe

Nearly half of LEAs put predictive analytics and GenAI-powered data exploration and analysis at the top of the list of most impactful technologies for 2025. According to the report, 46% of LEAs report challenges with both gathering data for court-admissible evidence as well as then analyzing it to generate intelligence and insights. Thirty-three percent of LEAs indicate that analyzing the data is the most challenging part of the process.

Read the report.

https://www.securitymagazine.com/articles/101375-39-of-law-enforcement-agencies-unable-to-timely-solve-investigations

Deepfake technology is a new and unsettling reality. When embedded within phishing emails and collaboration chats, deepfakes represent a vicious and growing threat. To combat deepfakes, organizations urgently need to implement fresh approaches to both employee education and cybersecurity.

To convey the gravitas of the situation, in February of 2024, a Singapore-based company lost $25 million due to deepfake impersonation of the firm’s CFO and other high-level executives. An employee mistakenly believed the deepfake ruse and sent funds to an illegitimate account.  

Similarly, in the second half of 2024, a North Korean deepfake threat actor convinced KnowBe4, the cybersecurity company, to hire him. That’s correct — a deepfake fooled a cybersecurity company. 

The aforementioned examples point to threat actors deliberate and effective attempts to dupe employees and to infiltrate global organizations with ties to the supply chain. Motives range from financial gain to espionage.

Addressing responsibility 

One of the key issues in combating deepfake threats is that we’re still missing some of the cybersecurity protective technologies. It has not yet been determined as to which security provider, and which mechanisms are responsible for protection. Is it the endpoint security? Is it the telecommunications platform?

The ambiguity means that organizations need to be proactive about deepfake prevention, initially focusing on employee awareness and employee training. Organizations should also ensure that they deploy best-in-class technologies for their cybersecurity stack — from email, to endpoint, to mobile security — to block attackers from infiltrating and then impersonating both employees and business partners. As I mentioned in my 2025 cyber predictions, hackers won’t just steal your data or your access credentials, they’ll disrupt financial transactions, corporate decisions, and brand reputation. 

For example, if the attackers’ send a meeting bridge via email, advanced email security is likely to identify a potential impersonation attempt, and can block the email before it even reaches the employee.

Mastering the mind

As a society, by-and-large, we are used to trusting what we see with our eyes and what we hear with our ears. Many people continue to trust rich media; video and audio. However, with deepfake technologies all of that can be faked. Thus, we need to tell our employees to be more suspicious and to provide our employees with new heuristics with which to assess input. 

Several years ago, when text message scams ramped up and began to impersonate commonly used services, like UPS, FedEx or the bank, we learned to avoid trusting text messages. We will need to do the same with video and audio in order to prevent the hijacking of our perceptions. 

Within organizations, in relation to cybersecurity training, teach employees to think in terms of “zero trust”. Encourage employees to suspect and question everything that they see. 

It is imperative that we train employees to implement a mental two-factor authentication, where they verify any request through a trusted and independent channel — one that a hacker is unlikely to compromise.

Furthermore, employees need to consider what they are being asked to do and how they can verify that it is genuine. It could be as simple as a phone call to the person after taking their number from a separate and verified source.

Comprehensive and advanced

Organizations not only need comprehensive cybersecurity, as mentioned previously, but also need advanced technology to prevent deceptive threats. 

For example, AI-based stylometry can detect attacks that would bypass human observation. Attacks may involve email or documents that look ordinary, but that are actually inauthentic. A person wouldn’t be able to distinguish the fake from the real, but a software solution would.

More information

Experts anticipate that, over time, communication platforms will improve their security, as to be able to detect and block deepfakes. I foresee, that in a year or two, we’ll see more of these technologies embedded into the telecommunication platforms.

Further, communications platforms will likely increase their capacities to confirm real identities while blocking impersonators. That said, additional security from cybersecurity vendors will prove critical, as historically, default security hasn’t stopped sophisticated and targeted attacks. 

A deep-dive into DLP

Over the last decade, we’ve seen an increase in DLP technology adoption, especially when it comes to monitoring sensitive content in cloud-based repositories. According to Statista’s projection, the DLP market will experience almost a 65% increase, growing from $1.24 billion in 2019 to $3.5 billion by 2025. 

However, implementing DLP inside live conversations is still a challenge. Additionally, it’s not clear as to what the value and experience would be. It has yet to be seen as to whether enterprise customers will look to expand DLP capabilities into live conversations. 

Nonetheless, this may represent a strategic approach that can protect employees from sharing sensitive content, should they fall victim to a deepfake scam.

Further thoughts

As deepfake technology continues to advance, organizations not only need to track trends, but also need to stay flexible and adaptable in relation to cybersecurity strategies. 

By focusing on a combination of employee training, comprehensive security measures and agile security tooling, businesses will be better able to protect themselves from sophisticated AI and deepfake threats. 

https://www.securitymagazine.com/blogs/14-security-blog/post/101377-will-deepfake-threats-undermine-cybersecurity-in-2025

Com’è noto, oggi la sanità digitale e gli Healthcare Providers affrontano sfide sempre più complesse in tema di sicurezza informatica.

Il settore sanitario, infatti, rientra da anni tra i più colpiti da attacchi e incidenti cyber: una tendenza preoccupante, che impone di individuare soluzioni adeguate a garantire la continuità dei servizi e la protezione dei dati sensibili coinvolti.

Non stupisce, allora, che uno dei primi atti dell’Unione Europea per il 2025 sia dedicato proprio al potenziamento delle risorse a difesa delle infrastrutture sanitarie.

Il Piano d’azione europeo per sanità e Healthcare Providers: tempistiche e obiettivi

Nello scorso gennaio la Commissione ha annunciato un Piano d’azione mirato a proteggere le infrastrutture sanitarie europee dagli attacchi informatici, la cui implementazione è prevista nell’arco dei prossimi due anni.

Una prima fase di natura consultiva avrà luogo nel 2025; il risultato atteso è una serie di raccomandazioni che contribuiranno a definire organi e procedure per attuare le misure individuate entro la fine del 2026.

L’obiettivo – definito dalla Presidente von der Leyen come una priorità chiave del suo nuovo mandato, che terminerà nel 2029 – è creare un ambiente più sicuro per pazienti e professionisti sanitari, promuovendo politiche e meccanismi volti a potenziare la cybersecurity delle strutture ospedaliere nonché, più in generale, di ogni tipologia di “healthcare provider”.

Il Piano trova la propria ragion d’essere nel contesto di crescente digitalizzazione che caratterizza la sanità moderna.

Se infatti l’innovazione tecnologica ha sicuramente portato enormi benefici, ad esempio in termini di diagnostica di precisione o accesso alle cure, allo stesso tempo ha esposto il settore a nuovi e concreti rischi sul fronte della sicurezza.

A complicare il quadro contribuisce la crescente complessità dell’Healthcare Supply Chain: analogamente ad altri settori, infatti, anche nella sanità i fornitori esterni, spesso non adeguatamente protetti, rappresentano la strada più semplice attraverso cui gli attaccanti possono arrivare al cuore delle infrastrutture.

Contesto e contenuti del Piano: prevenzione dei cyber attacchi nella sanità

In merito la Commissione cita i report dell’ENISA, evidenziando come gli attacchi informatici rivolti al mondo Healthcare – la maggior parte di tipo ransomware – possano determinare serie conseguenze, che spaziano dalla perdita di dati sensibili al ritardo nella formulazione delle diagnosi; fino ad arrivare talvolta al blocco degli accessi ai servizi d’emergenza, con effetti potenzialmente letali per i pazienti.

La Direttiva NIS2, il Cyber Resilience Act (CRA) e il Cyber Solidarity Act (CSA) sono richiamati nel Piano a riprova dell’impegno verso la creazione di uno spazio digitale europeo più sicuro.

L’iniziativa della Commissione si presenta, perciò, come un ulteriore sforzo per proteggere le infrastrutture critiche comunitarie, contribuire alla creazione di un solido European Health Data Space (EHDS) e garantire i diritti delle persone entro un panorama di minacce in costante evoluzione.

A tali scopi vengono individuati quattro principali filoni d’azione:

1. Enhanced Prevention. Il Piano aiuterà a rafforzare le capacità difensive del settore sanitario, fornendo linee guida e risorse (anche finanziarie) per diffondere le migliori pratiche di cybersecurity al fine di irrobustire i livelli di maturità degli operatori europei, nonché di uniformare la preparazione del personale attivo nei differenti sistemi nazionali rispetto alla prevenzione degli attacchi informatici.
2. Better detection and identification of threats. Entro il 2026 si prevede l’istituzione (in seno all’ENISA) di un Cybersecurity Support Centre specificamente dedicato ad ospedali e altri fornitori di servizi sanitari, a cui spetterà la gestione di un sistema comunitario di alert sulle minacce più rilevanti per il settore.
3. Response to Cyberattacks to minimise impact. Nel Piano rientra la creazione di un apposito “rapid response service” per il comparto sanitario, basato sui meccanismi di cooperazione previsti dal Cyber Solidarity Act. Inoltre, gli Stati sono incoraggiati a chiedere alle entità colpite di riportare tempestivamente gli attacchi informatici e di collaborare alle indagini svolte dalle autorità nazionali.
4. Deterrence: protecting European healthcare systems. Al fine di disincentivare i cyber threat actors dai loro intenti di attacco contro il settore sanitario è raccomandato il ricorso al Cyber Diplomacy Toolbox, che prevede di mettere in campo una serie di risposte (sul piano sia diplomatico, sia penale) alle attività malevole condotte nel dominio cyber.

Prevenzione, dialogo e cooperazione: verso l’implementazione del Piano europeo

Nelle parole di Henna Virkkunen (Executive Vice-President for Tech Sovereignty, Security and Democracy) “Prevention is better than cure, so we need to prevent cyber-attacks from happening. But if they happen, we need to have everything in place to detect them and to quickly respond and recover”.

A fronte di tali obiettivi la definizione in dettaglio del Piano d’azione, così come la sua successiva implementazione, richiederà un costante dialogo e confronto con gli operatori del settore, individuati in “healthcare providers, Member States and the cybersecurity community”.

La Commissione ha dichiarato di voler istituire un Health Cybersecurity Advisory Board composto da rappresentanti di alto livello della sicurezza e della sanità, che avrà funzioni consultive per il Cybersecurity Support Centre istituito presso l’ENISA; assumendosi inoltre l’impegno di avviare quanto prima una consultazione pubblica “open to all citizens and stakeholders”.

Alla luce dei sempre più frequenti attacchi informatici rivolti al mondo Healthcare – nonché delle loro conseguenze potenzialmente devastanti per la salute, la privacy e la stessa vita dei cittadini – il Piano sembra rappresentare un positivo passo in avanti in merito all’armonizzazione e alla messa in sicurezza del settore sanitario europeo.

https://www.ictsecuritymagazine.com/articoli/healthcare-providers/

“It’s a man’s world out there. You better know your stuff before you step your foot out.”

Yvette Freeman could have been talking about life as a woman in the security industry. Instead, she was reflecting on her years as an actor and director — most notably in her role as Nurse Haleh Adams on the series ER between 1994 and 2009. More specifically, Freeman was commenting on the limited opportunities for women to direct films.

Now she has her chance, having recently been tapped to helm The WOMEN IN SECURITY Documentary, a trailer for which dropped this month and can be viewed here. The parallels between Freeman’s struggles and those of females in the security profession are not lost on her.

Despite several successful decades in Hollywood as an actress and theater director, Freeman has found film directing jobs to be elusive. That’s a common complaint among women in Hollywood. Determined to upskill, Freeman attended the Directing Workshop for Women (DWW) at the American Film Institute, where she collaborated with other aspiring female directors. Other well-known DWW graduates include Maya Angelou, Anne Bancroft, and Cicely Tyson, among many more. Freeman sees the same drive and spirit of cooperation among female security professionals, hoping to elevate and inspire their colleagues.

Security business is not show business, however, and Freeman is quickly getting up to speed on the roles and experiences of the women whose journeys she is chronicling. “It’s a tall order, but it is a rewarding one because these ladies are truly inspirational,” she says.

Spotlighting the careers of several female security professionals, the documentary will demonstrate how women have played an outsized role in the industry, from responding to the Boston Marathon bombing to joining the security industry in the aftermath of 9-11. The film will also capture female security professionals’ day-to-day challenges, successes, and indignities, including being asked to attend business meetings in strip clubs and having colleagues comment on their anatomy.

The documentary has been in the making for almost five years. It is the brainchild of Richard Ticho, who got to know many extraordinary female security leaders as part of the production team for ASIS events worldwide between 1995 and 2016. 

“It’s a gaping hole in the historical record that the role of women in security hasn’t been well documented or told,” explains Ticho. “This production addresses that oversight, but, more importantly, it aims to inspire new generations of women to enter our field, celebrate achievements of women in security, recruit talented professionals to the industry and empower them, and strengthen the profession by virtue of new and diverse skill sets.” 

“It’s also a testament to the fortitude and persistence of these women that they succeeded despite the many impediments in their way,” adds Freeman. 

More than just a sequence of talking heads, the documentary contains recreations of significant incidents, archival keynotes and interviews, podcast segments, and rare footage.

Among those featured are:

• Angela White, Past President, Electronic Security Association
• Andrea Chedas, Head of Corporate Security, Wealthsimple
• Bonnie Michelman, MBA, MS, CPP, CHPA, Vice President/Chief Security Officer, Mass General Brigham
• Constance Matthews Reynolds, Founder & CEO, ReynCon
• Danielle Weddepohl, Canadian Chapter Young Professional Liaison, The Institute of Strategic Risk Management (ISRM)
• Karen Gispanski, Senior Director of Enterprise Cyber Security, Privacy, and Information Officer (CISO), Millennium Healthcare
• Linda Florence, Ph.D., CPP, Director of Security & Business Continuity, Planned Parenthood, Orange & San Bernardino Counties ~ CA
• Lynn Dohm, Executive Director, WiCyS
• Mackenzie Phillips, MBA, LPC, Senior Manager, Security & Loss Prevention, Amazon
• Marene Alison, Advisor, The Cybersphere Group, and Former Chief Information Security Officer, Johnson & Johnson
• Melissa Mack, CPP, CPRW, CIC, Director, Pinkerton
• Mindy M. Pretzman, US Secret Service (ret.), Secret Service Agency, President to the Federal Law Enforcement Officers Association (Emeritus)
• Niamh Vianney Muldoon, Global Innovation Lead and EMEA CISO, BNY Mellon
• Nicole Buratovich, Sr. Manager, Program Management | Culture & Wellness, Amazon
• Stacey Champagne, Founder & CEO, Hacker in Heels
• Stephanie Carter, Principal, Compliance Advisory
• Tia Hopkins, Chief Cyber Resilience Officer & Field CTO, eSentire
• Valerie Lyons, Executive Director, BH Consulting

As a member of the film’s advisory board, last summer I attended a two-day event that combined a conference on women in security with interviews for the documentary.  The energy and excitement at the event were palpable, feeding off keynotes by Michelman, Dohm, Hopkins, and Pretzman, as well as panel sessions on critical topics.

The struggle for recognition and acceptance is far from over, but acknowledging the role and accomplishments of women in security through this film is a step in the right direction. Learn more about the film here.

https://www.securitymagazine.com/articles/101362-women-in-security-documentary-finds-kindred-spirit-to-direct

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’);
@import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’);
h3 { font-weight: bold; font-size: 18px; color: #9C48B0;
}
figure { padding: 4px;margin: auto;
}
figcaption { background-color: #f8f8f8; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center;
}
.highlight { padding: 3%; border-top: 8px solid #207BBC; border-bottom: 3px solid #207BBC; width: 100%; Nunito Sans’,Arial,sans-serif; font-size: 16px; background-color: #EAF1F7;
}

With just a few days left before students were to head out for winter break, the country was hit with yet another tragic school shooting event. On Dec. 16, 2024, a 15-year-old female student opened fire at Abundant Life Christian School in Madison, Wisc. The incident left one teacher and two students dead, including the shooter.

According to sources, the K-12 school, which serves about 420 students, did not have a resource officer however, local law enforcement arrived three minutes after a teacher called 911 to report the shooting. The shooting marked the 39th school shooting of 2024 that resulted in injuries of deaths.

Having been a Madison resident myself, this incident particularly struck a chord with me, especially with acquaintances of mine having school-aged children in the area. Recently, I connected with some security professionals with a variety of experience in the education security industry for their thoughts on the recent incident and what lessons can be gleaned from these tragic events and I will be sharing their knowledge throughout the year in this column.

Here, we start the series with an interview with Kristen Devitt, a former city of Madison Police Officer, current Director of Campus Safety at Oak Park & River Forest High School in Oak Park Illinois, and a 2023 Women in Security honoree. Devitt also served as the Director of the Office of School Safety at the Wisconsin Department of Justice from 2018-2022.

Security: Often, after an event like an active shooter, there can be a public outcry for immediate changes or action to a security program. What advice do you have for security professionals in the K-12 space when faced with this?
Devitt: There are a few very important things to consider after a major incident. First, the most important is to make sure that the school community has the time and resources needed to heal. I have unfortunately seen schools in a hurry to ‘get back to normal’ and fail to effectively address the needs of the students, faculty, and staff in the aftermath. This can cause irreparable harm to those impacted by the incident, and the reputation of the school in the community. Leadership needs to understand that the ‘old normal’ does not exist anymore, and the ‘new normal’ has to be the focus.

Second, as an emotional reaction to a school safety crisis, leadership can be susceptible to vendors who will promise the world but significantly under deliver. It is important to make all school safety decisions from a data informed perspective, and a nationally recognized best practices lens. There are several companies who will promise that their ‘newest technology’ is the only thing that will keep your kids safe, when statistically we know that the most effective measure of preventing an assailant from gaining access to a classroom full of children is a locked door.

Finally, while we may not be able to prevent all school attacks, many attackers follow a discernable pathway of thinking. This gives us opportunities for intervention. All schools should have multidisciplinary Behavioral Threat Assessment teams that are properly trained, meet on a regular basis, and focus on constant information sharing so that new concerning or prohibited student behavior does not get trapped in a silo.

Security: What are the pros and cons to this reactionary mind-set versus a proactive approach?
Devitt: Having a reactionary mindset means you are OK with a major incident happening, you just want to prepare for the aftermath. Clearly that is not acceptable when it come to the safety of our schools. All schools should seek to be proactive in providing training to students, employees, and parents on how to identify concerning/threatening behaviors and how to report them. All community stakeholders should understand that reporting information is not ‘snitching’, it is seeking help for someone who is struggling. And all reporters should feel confident that when they report a concern, someone will address it. The more trust the school community has that leadership will be proactive, and address concerns appropriate, the more likely it is that important information will be reported.

Security: How can security leaders balance fostering a welcoming school environment while maintaining a secure campus?
Devitt: It is very important to not rely on technology to prevent violence in schools. The human factor is irreplaceable when it comes to recognizing and addressing the emotional state of our students. There is no AI, camera system, or metal detector that can identify a significant change in a student’s behavior. There is no digital mapping service that can connect with a student and be perhaps the only positive trusting relationship that student has with an adult. Your presence at the door, greeting students as they come into the building not only makes your students feel welcome, but gives us the opportunity to recognize who may be struggling as they enter the building that morning. Of course, we keep our exterior doors locked, we keep our classroom doors locked while we are teaching, we make sure everyone in the building wears an ID, and we continuously train on our emergency response protocols.

Security: What steps can schools take to ensure staff and students feel safe after a high-profile security incident?
Devitt: Feeling safe and being safe can often be two different things. It may be difficult to feel safe after a violent incident happens in our community. We need to make sure that we provide resources for our students and employees to address their concerns and have the support they need. It may also be a good idea to review your safety/security protocols, reporting procedures, and emergency operations plans. If any opportunity for improvement is discovered, it should be addressed immediately.

Security: What role does mental health and behavioral threat assessment play in the overall security approach for schools?
Devitt: Mental health services, trauma informed practices and social emotional learning programs should be available universally in a school to remove the stigma attached to the need for help. A key component of Behavioral Threat Assessment is identifying what risk factors may exist that could escalate someone toward violence and identifying what services may be available to mitigate that risk. Often a school psychologist, social worker, or counselor can be the ideal resource for a student desperately in need of an intervention. It is also important to understand that the pathway to violence does not always include a mental health disorder. It can begin with being the perpetrator of dating violence, stalking, sexual assault, or other concerning / criminal behaviors. Again, behavioral health resources can be leveraged to mitigate concerning/criminal behaviors, but law enforcement intervention may be needed. In order to know when it is appropriate for law enforcement to take action, it is important for schools to partner with local authorities in the behavioral threat assessment practices.

https://www.securitymagazine.com/articles/101361-what-lessons-can-be-learned-following-a-school-shooting

[embedded content]

Google Gemini: Hacking Memories with Prompt Injection and Delayed Tool Invocation.

Based on lessons learned previously, developers had already trained Gemini to resist indirect prompts instructing it to make changes to an account’s long-term memories without explicit directions from the user. By introducing a condition to the instruction that it be performed only after the user says or does some variable X, which they were likely to take anyway, Rehberger easily cleared that safety barrier.

“When the user later says X, Gemini, believing it’s following the user’s direct instruction, executes the tool,” Rehberger explained. “Gemini, basically, incorrectly ‘thinks’ the user explicitly wants to invoke the tool! It’s a bit of a social engineering/phishing attack but nevertheless shows that an attacker can trick Gemini to store fake information into a user’s long-term memories simply by having them interact with a malicious document.”

Cause once again goes unaddressed

Google responded to the finding with the assessment that the overall threat is low risk and low impact. In an emailed statement, Google explained its reasoning as:

In this instance, the probability was low because it relied on phishing or otherwise tricking the user into summarizing a malicious document and then invoking the material injected by the attacker. The impact was low because the Gemini memory functionality has limited impact on a user session. As this was not a scalable, specific vector of abuse, we ended up at Low/Low. As always, we appreciate the researcher reaching out to us and reporting this issue.

Rehberger noted that Gemini informs users after storing a new long-term memory. That means vigilant users can tell when there are unauthorized additions to this cache and can then remove them. In an interview with Ars, though, the researcher still questioned Google’s assessment.

“Memory corruption in computers is pretty bad, and I think the same applies here to LLMs apps,” he wrote. “Like the AI might not show a user certain info or not talk about certain things or feed the user misinformation, etc. The good thing is that the memory updates don’t happen entirely silently—the user at least sees a message about it (although many might ignore).”

https://arstechnica.com/security/2025/02/new-hack-uses-prompt-injection-to-corrupt-geminis-long-term-memory/

The Microsoft Threat Intelligence team has issued a warning about observed code injection attacks leveraging publicly available ASP.NET machine keys. These actions have been carried out by an unknown threat actor and are used to deliver malware.

Through investigation, the research team discovered an insecure developer practice, in which a variety of public ASP.NET machine keys from publicly accessible resources (like code repositories and documentation) were incorporated. This could allow a threat actor to deploy malicious acts on target servers.

Currently, research has identified more than 3,000 exposed keys that could be used for such attacks. These are referred to as ViewState code injection attacks

Security leaders weigh in 

Tim Mackey, Head of Software Supply Chain Risk Strategy at Black Duck:

At its core, this is a misconfiguration of a system where that misconfiguration enables malicious activity. For this scenario, the ViewState would contain the malicious payload which was encrypted using a key published on the internet. Such a key might’ve originated from sample code or from demo code provided to a developer attempting to learn a new API or coding topic. That key was provided as an example by the original author with an expectation that someone using the sample code would replace the demo key with one that’s unique to their environment. The problem is that someone using sample code might not understand all the rules resulting in the sample code being copied directly into the application. 

For a developer who is simply learning a new API this isn’t the end of the world because a production system shouldn’t be using any hardcoded configuration. In the case of this report, the attack vector requires hardcoded keys, which then implies the application in question either isn’t fully configurable or that the configuration itself contains hardcoded elements. While reviewing the contents of the applications’ configuration file against Microsoft’s list of public keys is a good idea, DevOps teams should use tooling that detects hard coded secrets to ensure that any hardcoded items present in their application are properly addressed.  

Eric Schwake, Director of Cybersecurity Strategy at Salt Security:

Microsoft’s alert regarding the use of publicly available ASP.NET machine keys brings attention to a significant security risk linked to poor coding practices in application and API development. Developers frequently turn to public resources and code snippets for ease, but this approach can unintentionally create vulnerabilities, particularly when developing applications or APIs that manage sensitive data and integrate critical systems. In this scenario, the use of publicly disclosed machine keys puts applications and their associated APIs at risk of attacks, as malicious individuals can easily access these keys. 

To mitigate such risks, developers must prioritize secure coding practices by refraining from utilizing publicly disclosed secrets and ensuring that all third-party libraries and components are up-to-date and free from known vulnerabilities. This precaution is especially vital for APIs, which are frequently exposed online and can be easily targeted by attackers. Furthermore, extensive security training is essential to inform developers about secure coding practices, particularly in relation to API development and the dangers of using publicly accessible resources. This situation emphasizes the necessity of adopting a security-first ethos in software development, especially when creating and deploying APIs. By committing to secure coding practices and maintaining awareness of potential vulnerabilities, organizations can greatly lower their risk of breaches.

https://www.securitymagazine.com/articles/101373-malicious-actors-exploiting-exposed-aspnet-keys-to-deploy-malware