Elon Musk’s Department of Government Efficiency (DOGE) has been feeding sensitive federal information into artificial intelligence (AI), according to a new report. The information in question is sensitive data from the United States Department of Education, including internal financial data and personally identifiable information (PII) for individuals managing grants. The data is being input into AI in order to investigate the agency’s programs and spending. 

According to the report, the DOGE team is leveraging AI software within Azure, Microsoft’s cloud computing platform, to probe the information. 

Below, cybersecurity leaders discuss the implications of DOGE inputting federal data to AI. 

Security leaders weigh in

Casey Ellis, Founder at Bugcrowd:

On one hand, it’s a pretty logical use of AI: Using AI to interrogate raw, disparate, and presumably vast datasets to speed up “time to opinion” makes a lot of sense on a purely technical and solution level. 

On the other hand, of course, it raises some serious questions around privacy and the transit of sensitive data, and the governance being applied to how data privacy is being managed, especially for personnel files, project/program plans, and anything impacting intelligence or defense.

Satyam Sinha, CEO and Co-Founder at Acuvity:

Given the extensive use of GenAI services by countless enterprises, the use by government agencies does not come as a surprise. However, it’s important to note that GenAI services represent a completely new risk profile due to its ongoing rapid evolution. The risk of data exfiltration across GenAI services is very real, especially given the value of such sensitive government agencies’ financial data to our adversaries and bad actors. While many providers adhere to requirements such as GovCloud and Fedramp, not all providers do. We have to exercise an abundance of caution and an additional layer of security.

J Stephen Kowski, Field CTO at SlashNext Email Security+:

The processing of sensitive government or any organization’s data through AI tools raises important cybersecurity considerations, particularly since this data includes personally identifiable information and financial records from the Department of Education. Modern AI-powered security controls and real-time threat detection should be standard practices when handling such sensitive information, especially given the potential for data exposure to foreign adversaries or cybercriminals. Organizations working with government systems should implement comprehensive security measures that combine AI safeguards with human oversight to protect sensitive information while maintaining operational efficiency.

https://www.securitymagazine.com/articles/101372-doge-inputs-federal-data-to-ai-cyber-leaders-discuss-implications

A bipartisan congressional bill has been proposed, which would prohibit the use of the Chinese artificial intelligence software, DeepSeek, on government devices.

The bill, introduced by United States Representatives Josh Gottheimer (D-NJ) and Darin LaHood (R-IL), has been proposed on the grounds of national security, citing concerns of espionage. 

Dave Gerry, CEO at Bugcrowd, comments, “Scrutiny of DeepSeek appears warranted given the likely connections back to the Chinese Communist Party (CCP), continued concerns around data privacy and leakage, and a recent security incident. Unsurprisingly, government and corporate leaders alike are looking at options to, at a minimum, temporarily remove access while additional reviews are done.”

Below, more security leaders share their thoughts on this proposed bill. 

Security leaders weigh in

Satyam Sinha, CEO and Co-Founder at Acuvity:

For the U.S. government, espionage is a daily challenge and exposing workers to GenAI services such as DeepSeek, which clearly state that data will reside in China and will be used to improve the models and services, is an obvious risk. The move to block the mobile application and website is clearly a recommended approach.

However, the issue at hand is much bigger than just DeepSeek. First, there are several other apps with similar origins and risks as DeepSeek — for example Qwen. Focusing on the trending GenAI service is just a stopgap. What we should be thinking about is the overall categories of risk. Second, GenAI services, regardless of their origin, are under constant cyberattack. And it only takes one successful attack for sensitive information such as login credentials to be stolen in mass.  

What I would like to see is for us to take a stronger stance on security of GenAI application usage across the board and start requiring an extra layer of cybersecurity. By moderating the information that is initially shared, we can reduce the risk associated with GenAI applications, whether those risks stem from intended design or cyberattacks.

J Stephen Kowski, Field CTO at SlashNext Email Security+:

While DeepSeek’s AI capabilities are impressive, security researchers have identified multiple vulnerabilities that could allow malicious actors — whether nation-states or cyber criminals — to exploit the application as a delivery mechanism for credential theft and data exfiltration. The discovery of hidden code capable of transmitting login credentials to China Mobile servers highlights how AI chatbots can become unwitting conduits for cyberattacks, which is particularly concerning given that millions of users have already downloaded and integrated these tools into their daily workflows. The rapid response by Australia, Italy, Taiwan and South Korea to implement bans demonstrates the seriousness of these security gaps, especially since advanced threat detection could have identified these concealed communication channels before they put sensitive data at risk. Modern organizations need real-time protection that can detect and block sophisticated technical threats hiding within seemingly innocent AI applications, regardless of their country of origin.

Casey Ellis, Founder at Bugcrowd:

This is as much about geopolitics and trust as it is about technical vulnerabilities. The ban is a defensive move in a much larger strategic competition. While it’s a step in the right direction, it also underscores the need for a proactive, rather than reactive, approach to securing U.S. technology and data.

This proposed ban on DeepSeek is a classic example of the intersection between cybersecurity, geopolitics and national security. The concerns raised by LaHood and Gottheimer about the app’s potential for espionage align with a broader pattern of scrutiny around Chinese-affiliated technologies. The underlying issue here isn’t just about DeepSeek itself but the broader risk posed by software and hardware tied to entities that operate under CCP influence.

From a cybersecurity perspective, the concern is valid. Apps like DeepSeek, particularly those with access to sensitive data or device-level permissions, can be weaponized for surveillance or data exfiltration. The U.S. government has been increasingly cautious about this, as seen with prior actions against companies like Huawei and TikTok. The fear isn’t just theoretical — there’s precedent for adversarial nation-states leveraging technology for espionage.

That said, this isn’t just a technical issue, it’s a trust issue. The challenge is that even if DeepSeek’s developers claim no affiliation with the CCP or no malicious intent, the opacity of Chinese corporate governance and the potential for state influence make it difficult to verify. This is why the U.S. government is erring on the side of caution.

The broader takeaway here is that this isn’t just about banning one app. It’s about recognizing the systemic risk posed by foreign-controlled technologies in critical environments. The U.S. needs to continue investing in its own tech ecosystem to reduce reliance on potentially compromised foreign solutions. At the same time, fostering collaboration with the global cybersecurity community — particularly ethical hackers and researchers — can help identify and mitigate these actual technical risks before they become crises.

https://www.securitymagazine.com/articles/101369-lawmakers-propose-deepseek-ban-on-government-devices

Vercara announced the results of its second-annual Consumer Trust & Risk Report. The survey found that breaches in 2024 had less impact on consumers’ trust in brands compared to the previous year (a 6.5% decrease from 62% in 2023 to 58% in 2024). The research reveals that consumers are unaware of the impact of insider threats, and instead assume bad actors are to blame for most attacks.

Research found that more than half (58%) of consumers believe brands that get hit with a data breach are not trustworthy, and 70% would stop shopping with a brand that suffered a security incident. Generation Z is the most likely to be unfazed by security incidents, whereas Baby Boomers are most likely to shift their shopping habits.

One-third (30%) of consumers report having their data exposed after shopping online. Survey respondents believe that the top four causes of breaches are:

• Bad actors hacking into a company’s system – 36% (with 67% of Generation Z holding this belief)
• A company having extremely poor security measures – 33%
• Bad actors breaking into physical offices – 8%
• Insider threats – 5%

Additionally, 21% of consumers report that they use the same passwords across work and online shopping accounts and that 57% are comfortable using their work devices for personal shopping, doing so regularly, which opens companies to even more risk.

https://www.securitymagazine.com/articles/101357-data-breaches-affect-consumer-trust

Genetec shared the results of their 2025 State of the Physical Security Report, including hybrid-cloud security, artificial intelligence (AI), and staff concerns.

According to the report, 43% of end users envision hybrid deployments as their preferred approach within the next five years, compared to 18% favoring fully cloud-based implementations and 17% planning to remain fully on-premises. This preference for hybrid-cloud is echoed by consultants and channel partners, with 66% of consultants planning to recommend hybrid deployments in the next five years.

The report also found that 49% of end users delayed projects in 2024 and 45% in 2023. However, in 2023 supply chain issues were the main reason, but in 2024 the cause was economic uncertainties.

Since 2021, both end users and channel partners have consistently reported staffing issues. And the outlook for 2025 points to ongoing concerns. Seventy-two percent of channel partners expect to continue to have hiring challenges while only 6% believe it will improve, according to the report.

The report states that 77% of end users say physical security and information technology (IT) departments now work collaboratively. Additionally, IT departments are taking on an increasing role in the buying process, with more than 50% of end users, systems integrators, and consultants reporting that IT teams are now actively involved in physical security purchasing decisions.

The report reveals a significant rise in the interest toward AI adoption in physical security, with 37% of end users planning to implement AI-powered features in 2025, up from just 10% in 2024. This heightened interest aligns with a strategic, purpose-driven approach. With 42% of end users seeing AI as a tool to streamline security operations, organizations are focusing on practical applications, such as refining threat detection and automating routine processes, with intelligent automation as the ultimate goal.

https://www.securitymagazine.com/articles/101355-economic-stress-was-the-leading-cause-of-project-delays-in-2024

Nel cuore dell’innovazione tecnologica europea, la Quantum Cybersecurity emerge come elemento cruciale per proteggere le infrastrutture digitali del continente dalle minacce dei computer quantistici, capaci di decifrare i sistemi crittografici tradizionali e compromettere la sicurezza dei dati sensibili.

La rapida evoluzione delle tecnologie quantistiche stanno creando nuove sfide significative per la sicurezza delle comunicazioni digitali. In particolare, l’avvento dei computer quantistici minaccia di compromettere i sistemi crittografici attualmente in uso, rendendo vulnerabili dati sensibili e infrastrutture critiche. Un recente studio suggerisce che entro il 2026 esiste una probabilità del 14% che i computer quantistici riescano a violare i sistemi crittografici più diffusi, percentuale che potrebbe salire al 50% entro il 2031, con implicazioni devastanti per la sicurezza informatica.

L’impatto rivoluzionario della computazione quantistica sulla sicurezza digitale

Nel panorama delle minacce alla cybersecurity, la computazione quantistica rappresenta una sfida unica e particolarmente insidiosa. A differenza dei tradizionali attacchi informatici, dove le vulnerabilità scoperte possono essere corrette con patch o aggiornamenti, l’impatto del quantum computing sulla crittografia è fondamentale e richiede anni di preparazione per implementare contromisure efficaci. La peculiarità dei computer quantistici risiede nella loro capacità di manipolare bit quantistici (qubit) che possono esistere simultaneamente in stati 0 e 1, permettendo di esplorare molteplici configurazioni contemporaneamente.

Questa caratteristica rivoluzionaria non rappresenta semplicemente un incremento di velocità computazionale, ma un cambio di paradigma che richiede lo sviluppo di una nuova “immunità cibernetica” basata su crittografia quantum-safe e protocolli di comunicazione quantistica. La sfida non è solo tecnologica ma anche organizzativa: le aziende devono valutare attentamente la “shelf-life” delle informazioni sensibili, considerando che i dati crittografati oggi potrebbero essere decifrati in futuro da computer quantistici sufficientemente potenti.

Una delle preoccupazioni più urgenti riguarda i cosiddetti attacchi “harvest now, decrypt later“, in cui gli aggressori raccolgono oggi informazioni crittografate per decifrarle in futuro quando avranno accesso a computer quantistici sufficientemente potenti. Questa minaccia è particolarmente rilevante per documenti classificati europei che seguono regole di declassificazione dopo 20-50 anni. Un avversario dotato di capacità quantistiche potrebbe potenzialmente accedere a questi contenuti sensibili molto prima della loro naturale declassificazione, compromettendo seriamente la sicurezza nazionale e degli interessi strategici europei.

Il divario strategico nella sicurezza quantistica tra USA e UE

Gli Stati Uniti hanno assunto un ruolo guida nella transizione verso la crittografia post-quantum. Dal 2016, il National Institute of Standards and Technology (NIST) ha avviato un processo di standardizzazione degli algoritmi crittografici resistenti agli attacchi quantistici, con l’obiettivo di completare gli standard entro il 2024. Inoltre, gli USA hanno implementato politiche concrete come il Quantum Cybersecurity Preparedness Act del 2022 e hanno incluso la protezione dagli attacchi quantistici come obiettivo strategico nella National Cybersecurity Strategy del 2023.

L’approccio europeo, invece, si è concentrato principalmente sulla distribuzione quantistica delle chiavi (QKD) attraverso il progetto EuroQCI, che mira a creare una rete di comunicazione quantistica sicura entro il 2027. Questo progetto ha visto nel 2021 la prima comunicazione quantistica interstatale tra Trieste, Lubiana e Zagabria, coprendo una distanza di 100,5 km. Tuttavia, questa focalizzazione rischia di trascurare le minacce immediate come gli attacchi “harvest now, decrypt later“. È significativo notare che 13 dei 19 ricercatori coinvolti negli algoritmi selezionati dal NIST sono affiliati a istituzioni di ricerca europee, evidenziando il paradosso di un’Europa leader nella ricerca ma in ritardo nell’implementazione pratica.

Quantum Cybersecurity: l’urgenza di una risposta europea coordinata

Per affrontare queste sfide, l’Europa necessita di un Piano d’Azione Coordinato che definisca obiettivi chiari e tempistiche per la migrazione verso sistemi crittografici post-quantum. Tale piano dovrebbe colmare il divario tra l’obiettivo a lungo termine di EuroQCI e le esigenze immediate di sicurezza, considerando anche le significative disparità tra gli Stati membri in termini di risorse e competenze nel campo della Quantum Cybersecurity.

L’UE potrebbe facilitare il coordinamento sia a livello tecnico che politico. Sul fronte tecnico, è necessario affrontare le lacune nella ricerca sulle tecnologie quantum-safe, come lo sviluppo di nodi quantistici per connessioni a lungo raggio. A livello politico, l’UE dovrebbe promuovere una transizione armonizzata verso la crittografia post-quantum, supportando gli Stati membri nella creazione di inventari crittografici e nell’identificazione delle priorità di migrazione.

Implementazione e prospettive future

La creazione di un nuovo gruppo di esperti all’interno dell’ENISA, con esperti nazionali distaccati, potrebbe facilitare lo scambio di buone pratiche e stimolare l’elaborazione di piani di migrazione nazionali. Inoltre, l’esplorazione di sandbox per accelerare lo sviluppo di applicazioni quantum-safe potrebbe seguire l’esempio americano, adattandolo alle esigenze europee.

Il programma IRIS2, parte dell’infrastruttura GOVSATCOM, rappresenta un passo importante verso la realizzazione di una rete di comunicazione quantistica spaziale, che potrebbe diventare un programma spaziale di punta insieme a Copernico e Galileo. Tuttavia, la sua efficacia dipenderà dalla capacità dell’UE di integrare queste tecnologie con soluzioni di crittografia post-quantum.

Le sfide poste dal computing quantistico alla cybersecurity europea richiederanno un approccio multiforme che combini innovazione tecnologica, coordinamento politico e cooperazione internazionale. Solo attraverso un’azione tempestiva e coordinata l’Europa potrà mantenere la sua sovranità digitale e proteggere efficacemente i suoi interessi strategici nell’era quantistica.

https://www.ictsecuritymagazine.com/articoli/quantum-cybersecurity-europa/

La crittografia quantistica rappresenta una frontiera promettente per la sicurezza delle comunicazioni, ma recenti analisi hanno evidenziato vulnerabilità significative in alcuni protocolli di distribuzione quantistica delle chiavi (QKD). Questa scoperta solleva interrogativi importanti sulla sicurezza dei sistemi crittografici quantistici, dimostrando come anche le tecnologie più avanzate possano presentare debolezze inaspettate.

L’Evoluzione della Sicurezza nei Protocolli Quantistici e le Sfide Emergenti

La storia della crittografia è costellata di protocolli ritenuti inizialmente sicuri ma successivamente compromessi da attacchi innovativi. Nel campo della crittografia quantistica, nonostante la sua relativa novità, si stanno già manifestando vulnerabilità simili. Un esempio significativo riguarda il protocollo QKD basato sugli stati Greenberger-Horne-Zeilinger (GHZ), che pur non richiedendo comunicazione classica, si è dimostrato vulnerabile a un attacco man-in-the-middle quantistico. Questo scenario evidenzia come l’assenza di comunicazione classica, inizialmente considerata un vantaggio per la sicurezza, possa paradossalmente creare nuove opportunità per potenziali attaccanti.

Guarda il video intervento su “Come si dimostra la sicurezza dei Protocolli di Distribuzione Quantistica delle Chiavi (QKD)“:

Analisi Tecnica dell’Attacco EPR Man-in-the-Middle nei Protocolli di Distribuzione Quantistica delle Chiavi (QKD)

L’attacco sfrutta coppie EPR (Einstein-Podolsky-Rosen) create dall’attaccante per intercettare e manipolare la comunicazione. Nel protocollo GHZ, l’attaccante (Eve) cattura il qubit inviato da Alice a Bob, creando poi una propria coppia di qubit in stato EPR. Questo permette a Eve di decodificare i messaggi scambiati senza essere rilevata, a condizione che possa determinare la base utilizzata per la comunicazione. La sofisticatezza dell’attacco risiede nella capacità di Eve di mantenere la coerenza quantistica durante l’intero processo di intercettazione e sostituzione, sfruttando le proprietà dell’entanglement quantistico per mascherare la sua presenza.

Implementazione e Limitazioni della Sicurezza nei Protocolli Ping-Pong

Il protocollo ping-pong di Boström e Felbinger, così come la sua variante proposta da Cai, presentano vulnerabilità simili. In questi casi, l’attacco richiede che Eve possa intercettare sia il canale quantistico che quello classico. La peculiarità dell’attacco sta nella capacità di Eve di sostituire i qubit originali con quelli da lei generati, mantenendo la coerenza della comunicazione senza essere individuata. L’efficacia dell’attacco è particolarmente rilevante in scenari di rete ad alto traffico, dove le imperfezioni nella trasmissione possono mascherare le attività dell’attaccante.

Implicazioni per lo Sviluppo di Futuri Protocolli di Sicurezza Quantistica

La scoperta di queste vulnerabilità non invalida le prove di sicurezza esistenti per questi protocolli, ma evidenzia come possano esistere metodi di attacco non previsti dai progettisti. Questo sottolinea l’importanza di un approccio olistico alla sicurezza dei protocolli quantistici, che consideri non solo gli attacchi teorici ma anche le vulnerabilità pratiche derivanti dall’implementazione. La sfida principale consiste nel bilanciare l’efficienza computazionale con la robustezza contro attacchi sofisticati, mantenendo al contempo la praticabilità dell’implementazione in sistemi reali.

Considerazioni sulla Resilienza dei Protocolli Quantistici agli Attacchi Moderni

La vulnerabilità fondamentale risiede nell’impossibilità per Alice e Bob di rilevare che i qubit ricevuti fanno parte di una coppia intrecciata creata da Eve. Indipendentemente dall’operatore sigma utilizzato (X o Z), Eve può replicare le azioni di Bob senza essere individuata. Questo suggerisce che qualsiasi protocollo basato sulla manipolazione e il ritorno di qubit intrecciati potrebbe essere vulnerabile a questo tipo di attacco. La situazione è ulteriormente complicata dalla necessità di implementare questi protocolli in reti reali, dove le imperfezioni nella trasmissione e gli errori naturali possono mascherare le attività di un attaccante.

Prospettive Future e Soluzioni Proposte

La ricerca “Vulnerabilities in Quantum Key Distribution Protocols” realizzata da D. Richard Kuhn evidenzia come la sicurezza nella crittografia quantistica richieda non solo robuste basi teoriche ma anche una attenta considerazione delle vulnerabilità pratiche. La continua evoluzione delle tecniche di attacco sottolinea l’importanza di sviluppare protocolli che incorporino meccanismi di autenticazione e verifica più sofisticati, combinando elementi della crittografia classica con le proprietà uniche dei sistemi quantistici. Particolarmente promettenti appaiono gli approcci che integrano multiple layer di sicurezza, includendo sia meccanismi quantistici che classici per la verifica dell’integrità della comunicazione.

La comunità scientifica sta già lavorando su nuove generazioni di protocolli che potrebbero resistere a questi tipi di attacchi, esplorando approcci innovativi come l’uso di stati quantistici più complessi e l’implementazione di tecniche di verifica multiple. Queste ricerche potrebbero portare allo sviluppo di sistemi di comunicazione quantistica intrinsecamente più sicuri, capaci di resistere anche ad attacchi sofisticati come quello man-in-the-middle con coppie EPR.

https://www.ictsecuritymagazine.com/articoli/qkd-distribuzione-quantistica-delle-chiavi/

Research from SecurityScorecard highlights the prominence of third-party risks in the insurance industry. The report, which reviews the breach histories of the top 150 insurance companies worldwide, shows that 59% included third-party attack vectors. According to the report, this is the highest rate observed so far. Furthermore, it is more than two times greater than the global cross-industry average (29%).

28% of insurance companies reported breaches, surpassing those reported by S&P 500 (21%) and the United States energy industry (14%). In the past two years, 56% of companies experienced at least one compromised credential, and in the past year, 17% were impacted by malware infections and device compromises.  

The research found that insurance carriers were disproportionately impacted by third-party incidents. Carriers, comprising 27% of the sample, accounted for 50% of the companies affected by third-party breaches. 

https://www.securitymagazine.com/articles/101367-59-insurance-sector-breaches-caused-by-third-parties

The rise of DeepSeek has led to malicious actors attempting to exploit its prominence. Positive Technologies researchers have discovered two information-stealing packages on the Python Package Index (PyPI), mimicking developer tools for DeepSeek. These information-stealers are designed to take the data of the developers that utilize them. When executed on the device, the payload will steal target data, system data, and environment variables (such as database credentials, API keys, and infrastructure access tokens). 

Below, security leaders discuss the implications of these findings. 

Security leaders weigh in 

Jason Soroko, Senior Fellow at Sectigo:

Positive Technologies’ report details a threat where malicious actors injected infostealer malware into the PyPI repository by disguising it as DeepSeek. The findings confirm that attackers exploit trusted naming conventions and the open-source ecosystem’s reliance on authentic package sources. Although the report was published from a Russian domain, which may limit accessibility, the technical evidence underscores a growing risk in software supply chains. Organizations should enforce strict package verification and monitor repository activity to mitigate potential breaches.

Mike McGuire, Senior Security Solutions Manager at Black Duck:

In the early days of open source software, we were taught to treat the packages we used with inherent trust. We’re now in the era of having to treat every package that we download or use with a reasonable level of scrutiny. While this attack involved the name DeepSeek, it’s important to note that this had nothing to do with the company, or with AI at all. Rather, it has everything to do with attackers seeing opportunity in the popularity of AI tools in the development community. 

In their eagerness to leverage DeepSeek in their tasks, many developers missed the “red flag” that they were downloading packages from an account with a limited, poor reputation, and had their environment variables and secrets compromised as a result. This emphasizes the importance of leveraging all of the metrics made available for open source packages before including them into projects. While it seems obvious by now that dependencies with security vulnerabilities should be excluded, component provenance, health, and operational factors should also serve as inclusion criteria; those with little to no history, concerning changes from one version to the next, questionable owners, poor community support, etc… should be flagged for further review and scrutiny. 

While this sounds like a time consuming task, there is no shortage of tools on the market that do this automatically and build directly into the software development lifecycle. 

https://www.securitymagazine.com/articles/101366-deepseek-impersonating-malware-is-stealing-data-research-finds

The C-suite agenda is ever-changing, always adapting to the operational status of the business, wider market shifts, and the turbulence of the geopolitical landscape. With global events, be it man-made or human, becoming increasingly unpredictable, the operational resilience of each organization is fast becoming a top priority. Business leaders are searching for answers to how they can predict, adapt and manage new and evolving risks. 

Russia’s invasion of Ukraine and tensions between the U.S. and China continue to exacerbate global stability, while the increasing rate of natural disasters, most recently with Hurricane Milton, have put businesses on high alert, with operational resilience rising to the top of priorities.

In its 27^th Annual Global CEO Survey, PwC affirmed that “geopolitical threats are still among the top concerns for CEOs in Central and Eastern Europe, as well as the Middle East,” noting that many firms are taking steps to “insulate themselves from the effects of some conflicts.”  

For many, that process has involved an extensive evaluation of operations, networks, and overall business models, with firms investing in everything from cybersecurity and data privacy to supply chain adaptations and integrated risk management. Notably, EY’s CEO Outlook Pulse survey from July 2023 revealed that an overwhelming 99% of respondents are proactively reallocating strategic investments in response to geopolitical challenges. 

There is widespread recognition that global enterprises need to find a way of being able to adapt in real-time to whatever risks come their way. The question is — how can they effectively achieve this? 

Who does the resilience responsibility fall to?

Before anything else, it is vital that organizations clearly define exactly who is responsible for building and managing resilience.

Enterprises’ increasing interconnectedness of workforces, operations and global systems means all departments will be affected should an emergency situation arise. Therefore, it is crucial that the entire C-suite — and ideally the wider business — understand what resilience means for them.  

Businesses with operational resilience rightfully placed as a top priority have often distributed responsibility to familiar C-suite roles, from the CEO and COO to CSO and CISO. However, a shift is occurring — we are beginning to see the appointment of a dedicated Chief Resilience Officer to lead resilience initiatives coming to the fore, catalysed by an acknowledgement of the increasing volume of risk considerations occurring across the world.

This role is not the same as that of the Chief Risk Officer, whose focus is on corporate risk and regulatory compliance. Instead, Chief Resilience Officers typically take a wider view, collaborating across departments to solidify processes and analysis from crisis management and preparedness to business continuity and disaster recovery.  

Three foundations to stronger resilience 

Once these responsibilities have been defined, either via a distributed approach or through a dedicated Chief Resilience Officer, businesses are well-placed to implement processes that will have a tangible impact on their resilience. 

1. Evaluate risk exposure: Companies should regularly assess their global operations to identify existing and emerging vulnerabilities. By understanding where risks may arise, chiefly through the ingestion of real-time threat source data, organizations can make proactive and informed decisions to prevent potential problems or disruptions from arising and escalating.  
2. Perform scenario planning exercises: To reduce the risk of unpreparedness from unpredictable emergencies, organizations must stay one step ahead and can do so via scenario simulation exercises. These efforts will help organizations to more easily and effectively respond to several different challenges, should they arise.  
3. Enhancing people visibility: Speed of response is highly dependent on a company’s ability to track and manage its people and assets. Organizations need an acute understanding of the individual situations and locations of their employees as, from here, they can manage the response to crises and critical situations faster, with a greater deal of certainty, and the opportunity to mitigate risks before they develop. 

The role of a dedicated resilience platform 

Modern resilience platforms can be a game-changing asset, streamlining risk management and providing real-time insights as well as predictive capabilities.  

With the right platform on side, enterprises can expand their strategies beyond basic crisis response, laying the foundations for comprehensive, proactive operational resilience for faster action and response, minimised business disruptions, and improved employee safety. 

With that said, not all resilience platforms are made equal. Indeed, the most effective and advanced platforms offer some key capabilities that are worth keeping an eye out for: 

• Real-time location tracking: With geolocation tracking technologies, businesses can gain real-time visibility into their global operations, enabling them to assess potential impacts right down to individual personnel and assets. Of course, there is no silver bullet to managing location, however, leveraging multiple sources of location data in a combined approach enables true intelligence that can be acted upon confidently.  
• Dynamic risk monitoring: Predictive algorithms can be leveraged to forecast potential impacts on employees and/or assets, ensuring that proactive mitigation measures can be put in place, coupled with appropriate actions and plans. 
• Open integration ecosystem: Integrating multiple third-party risk data allows businesses to have the flexibility of choice, understand their full exposure to threats, enhance decision-making, and improve response. This enables companies to have comprehensive intelligence and adapt quickly to dynamic threats while ensuring consistent operational safety and stability. 

Amidst heightened geopolitical risks, such capabilities are crucial to achieving the necessary level of resilience. 

By clearly defining roles, adopting structured risk management strategies, and embracing advanced technologies, companies can protect themselves holistically against a landscape rife with uncertainties and rapidly changing environments, ensuring they are better placed to protect what matters, no matter the challenges the future may bring. 

https://www.securitymagazine.com/articles/101368-operational-resilience-in-the-c-suite-agenda-a-path-to-asset-safety

Feb 07, 2025 Marina Londei Attacchi, In evidenza, News, RSS, Vulnerabilità 0

---

Un bug critico e noto di Outlook è stato sfruttato in alcuni attacchi: a dirlo è stata la CISA, aggiungendo la vulnerabilità alla lista di quelle attivamente utilizzate nelle campagne di cyberattacchi.

La vulnerabilità, tracciata come CVE-2024-21413, era stata individuata dai ricercatori di Check Point un anno fa, proprio a febbraio. Si tratta di un bug di validazione errata degli input quando un utente apre con Outlook un’email che contiene dei link malevoli.

Il client di posta di Microsoft utilizza un meccanismo di protezione che, quando l’utente prova ad aprire un link non riconosciuto, mostra un avviso di sicurezza e richiede la conferma specifica da parte dell’utente per navigare su link.

Modificando però l’indirizzo, in particolare con l’uso del protocollo file:// per l’apertura di documenti remoti, e aggiungendo un punto esclamativo in fondo al link, insieme a del testo randomico, è possibile eludere le restrizioni di Outlook e far accedere l’utente alla risorsa remota senza approvazione esplicita. 

Dopo che l’utente naviga al link inserito, gli attaccanti possono sottrargli le credenziali NTLM ed eseguire codice arbitrario sfruttando documenti Office malevoli, creati appositamente per lo scopo.

La vulnerabilità colpisce Outlook 2016 e Outlook 2019, ma anche diversi prodotti della suite Office come LTSC 2021 e Microsoft 365 Apps for Enterprise.

Microsoft aveva rilasciato il fix per la vulnerabilità pochi giorni dopo aver ricevuto l’avviso da Check Point e al tempo non c’erano indicazioni su exploit che la sfruttavano; ieri invece la CISA ha confermato che il bug è stato usato in alcuni attacchi, anche se non ha specificato né le campagne in cui è stato sfruttato, né se ci sono informazioni sull’identità degli attaccanti.

“Questi tipi di vulnerabilità sono vettori di attacco frequenti per i cyberattaccanti e rappresentano rischi significativi per l’organizzazione federale” ha specificato la CISA nell’avviso, invitando le compagnie ad aggiornare il prima possibile i prodotti vulnerabili con le patch di Microsoft.

---

---

---

https://www.securityinfo.it/2025/02/07/un-bug-critico-di-outlook-e-stato-sfruttato-in-degli-attacchi/?utm_source=rss&utm_medium=rss&utm_campaign=un-bug-critico-di-outlook-e-stato-sfruttato-in-degli-attacchi