@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #9C48B0; } figure { padding: 4px; margin: auto; } figcaption { background-color: #f8f8f8; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content:; display: block; text-align: center; font-size: 18px; color: #404144; }

Acquiring the right assets is essential to developing a proper security posture. There are many assets that could benefit an organization, but there is one asset in particular that is of great priority and value across the board: the security team.

An efficient security team is a key pillar to any organization’s security posture. As exciting as the newest security technology may be, it is only as effective as the team that deploys it. By constructing an organized, cooperative team, security leaders can lay the foundation their organization’s defense is built upon.

Creating a successful security team isn’t something that can be done in the blink of an eye. Gathering, cultivating and retaining talent may require months of diligent, consistent work.

Meirav Malter, the Director of Intelligence at Seerist, remarks on the distinct challenges of building an international security team. “Having an international team that covers developments across the globe in real time is a major asset to organizations with a large global footprint, but a big challenge of this team structure is the time zone factor,” Malter says. “It is up to security leaders to make sure that everyone on the team is getting attention, resources and nurturing. No matter where a team member is located, they should still get the opportunity to progress and build their skills.”

While managing an international security team can come with unique difficulties, managing a team of any location and size is bound to come with challenges.

“A lot of teams struggle with securing enough budget to build a strong team in the first place,” Malter remarks. “It can be difficult for security teams to demonstrate why they need a greater budget or more resources.”

Starting a security team

Given the challenges that may come with building an effective security team, it is important for security leaders to make the most of what they can find. When seeking new team members, security leaders should be selective about the talent they bring to the team. Renuka Nadkarni, Chief Product Officer at Aryaka, believes that deep understanding of how appliances and systems work is essential.

“An in depth, detailed understanding of how things work is an absolute must to figure out how to secure it,” Nadkarni states. “When hiring people, it’s important to ensure their subject matter expertise is not just at a superficial level. They must have the ability to learn and go to the next level of detail.”

While understanding the finer details is important, team members should also be able to step back and see the bigger picture.

By constructing an organized, cooperative team, security leaders can lay the foundation their organization’s defense is built upon.

“It’s important to have people whose focus is not just building capabilities and products and features,” Nadkarni insists. “Security leaders also need professionals whose focus is on looking at all these things from outside. Teams must take themselves out of these processes and wonder, ‘what are all of the different things that can go wrong?’”

Even professionals with limited experience in the security industry will have valuable skills that security leaders should seek.

“Strong critical thinking skills are key,” Malter says. “You’re asking for people to be very attuned to different security situations and developments, so it’s important that they would be able to think critically about the situations they may encounter.” Malter continues, “Excellent writing and comprehension skills are also important. The baseline of this job is coherently — and often concisely —communicating ideas and analysis.”

One of the more crucial qualities security leaders should seek in potential hires is the ability to collaborate.

“There are some cases where people are working in teams that are more siloed, or maybe they won’t talk at all due to the structure or size of an organization. Still, a lot of the work for security teams, whether physical, strategic intelligence, or cyber does start to overlap, so having someone who’s a good team player and wants to take initiative and work closely with their peers is important. It really strengthens the whole organization.”

Cultivating an effective security team

Once a security team is built, it must be sustained. By allowing individuals on the team to continuously improve their skills, security leaders can ensure that their team does not become stagnant.

When it comes to motivating individuals to develop their skills, Malter points out, “It depends at what stage someone is at within the team. But as people are showing interest in developing certain skills, I help move them to the next level on the team, giving them a project to own that will also strengthen their skillset.”

Yet, it is equally important to not heap too much responsibility on team members, which may lead to burnout and discontent.

“The security industry is vast, and it’s easy for people to feel overwhelmed. When you throw too many tasks or information at people, it can be counterproductive,” Nadkarni explains. “They become overloaded and less effective, struggling to focus on their actual responsibilities.”

When pushing team members to grow their skillset, security leaders must be mindful of this delicate balance. Offering a team member the opportunity to take on a project they are passionate about can help them to develop skills, confidence and dedication to their role. Failing to acknowledge when a team member is ready to take that next step may cause them to feel unappreciated on the team. Meanwhile, pressuring a team member to take on more responsibility than they can handle may cause them to feel exhausted and unsupported on the team.

Therefore, security leaders should do their best to understand each team member as a person, gaining an appreciation for that individual’s career journey and helping them to take the necessary steps to be an effective, enthusiastic member of the team.

While all of this may sound complex, it comes down to one simple point: the best way to build a great team is to be a great leader.

“You have to think past yourself,” Malter states. “Instead, think on behalf of the team and do what benefits them.”

https://www.securitymagazine.com/articles/101077-how-to-build-an-effective-security-team

Enterprise security departments face a plethora of risks. One of the most significant threats that has emerged in recent years is that of deepfakes.

These sophisticated artificial intelligence-powered manipulations of audio and video content seem rather innocuous on paper, but their creation and dissemination are exemplars of a broader large-scale organizational threat. As far as security departments are concerned, implementing a comprehensive deepfake awareness training program has become critical for forward-thinking executives managing enterprise risk and security compliance.

The deepfake dilemma

Deepfakes utilize advanced AI techniques to convincingly create or alter audio and video content with worrying realism. People often find it difficult to distinguish between fake and real content, given that individuals portrayed in deepfakes appear to say or do things that they never did. 

It can be argued that methodical, supervised and ethical use of AI images and content is reasonable and beneficial. AI-generated images and content are becoming increasingly common in legitimate business applications, from marketing to product design. 

However, when AI deepfakes proliferate across the web with relative ease, it illustrates a wider security problem. This duality underscores the importance of nuanced training that helps employees navigate the complex landscape of AI-enhanced media. 

This democratization of technology, while innovative, opens new avenues for potential fraudulent and malicious use. A recent incident in Hong Kong saw a finance worker transfer $25 million to scammers after participating in a video conference with someone they believed to be their company’s CEO. In reality, a sophisticated deepfake of this individual was created, thus draining this worker and organization of staggering sums of money.

Risks to enterprise security

Deepfakes and AI misuse present various threats to organizational security. It’s fair to say that they are multifaceted, where one fraudulent deepfake can present a whole host of issues:

1. Reputational damage: Videos of ‘executives’ making controversial, hyperbolic or sensationalist statements can go viral, and if the deepfake is convincing enough, cause immediate and lasting damage to the individual and company they represent.
2. Financial fraud: As demonstrated by the Hong Kong case, deepfakes can be used to authorize fraudulent transactions and facilitate money laundering schemes. 
3. Operational disruption: False information disseminated through deepfakes can lead to misguided decision-making and disrupt company operations that affect their stakeholder and customer relationships.
4. Data breaches: Deepfakes could be used in phishing and social engineering attacks to gain unauthorized access to sensitive customer or financial information. This information can then be sold on the black market or used to propagate illegal activity by malicious actors.
5. Penalties and fines: Companies may face legal and regulatory consequences if deepfakes created using their brand or executives cause harm to third parties. It could also cause a company’s accreditation to be revoked.

The case for deepfake awareness training

Given these notable risks, the importance of deepfake awareness training cannot be understated. 

Training equips employees — regardless of position or seniority — with the skills to identify potential deepfakes and mitigate cyber threats from infiltrating their organizations. This includes (but is not limited to) recognizing visual or auditory anomalies, red flags and suspicious wording that may indicate manipulation. Awareness programs encourage healthy skepticism and reinforce the importance of questioning content validity and authenticity, particularly when it comes to strategic decisions and sensitive information dissemination.

Training can help organizations establish clear procedures and channels for reporting and incident response, thus minimizing risk and potential damage (both financial and reputational). When organizations implement proactive measures for detection and containment, they reinforce to their stakeholders and customers that their digital security posture remains intact. Furthermore, regulations around AI — while constantly evolving — already mandate strong due diligence and risk management compliance, and training helps organizations maintain this.

Implementing effective deepfake awareness training

To create a robust deepfake awareness program, consider the following elements:

1. Diverse curriculum: Explore the technology behind deepfakes and their common use cases, from the benign to the malicious. Extend the curriculum to include detection and response techniques and protocols.
2. Tabletop exercises: Provide interactive sessions where employees can apply real-world training to real-world deepfake identification scenarios. This will help to build confidence and competence in detection.
3. Updates: Enhance training programs with new modules to address emerging threats and new attack vectors, to expand team knowledge.
4. Enroll across departments: Deepfake awareness training should be rolled out across the entire organization, not exclusively IT and security teams. 
5. Ethical simulations: Conduct simulated deepfake attacks to test employee readiness and response strategies. Identify areas for improvement and refine approaches accordingly.

It’s clear that deepfakes are a growing threat that organizations cannot afford to overlook. They must address this problem proactively if they want to preserve their integrity and safeguard their operations, data and customer relationships. As a next step, organizations should consider impartially assessing security infrastructure and measures and seeking out comprehensive training program providers to create a bespoke program tailored to their needs, regulatory constraints, and risk profile.

https://www.securitymagazine.com/articles/101085-the-deepfake-dilemma-the-importance-of-deepfake-awareness-training

Attackers are actively exploiting a critical vulnerability in mail servers sold by Zimbra in an attempt to remotely execute malicious commands that install a backdoor, researchers warn.

The vulnerability, tracked as CVE-2024-45519, resides in the Zimbra email and collaboration server used by medium and large organizations. When an admin manually changes default settings to enable the postjournal service, attackers can execute commands by sending maliciously formed emails to an address hosted on the server. Zimbra recently patched the vulnerability. All Zimbra users should install it or, at a minimum, ensure that postjournal is disabled.

Easy, yes, but reliable?

On Tuesday, Security researcher Ivan Kwiatkowski first reported the in-the-wild attacks, which he described as “mass exploitation.” He said the malicious emails were sent by the IP address 79.124.49[.]86 and, when successful, attempted to run a file hosted there using the tool known as curl. Researchers from security firm Proofpoint took to social media later that day to confirm the report.

On Wednesday, security researchers provided additional details that suggested the damage from ongoing exploitation was likely to be contained. As already noted, they said, a default setting must be changed, likely lowering the number of servers that are vulnerable.

Security researcher Ron Bowes went on to report that the “payload doesn’t actually do anything—it downloads a file (to stdout) but doesn’t do anything with it.” He said that in the span of about an hour earlier Wednesday a honey pot server he operated to observe ongoing threats received roughly 500 requests. He also reported that the payload isn’t delivered through emails directly, but rather through a direct connection to the malicious server through SMTP, short for the Simple Mail Transfer Protocol.

“That’s all we’ve seen (so far), it doesn’t really seem like a serious attack,” Bowes wrote. “I’ll keep an eye on it, and see if they try anything else!”

In an email sent Wednesday afternoon, Proofpoint researcher Greg Lesnewich seemed to largely concur that the attacks weren’t likely to lead to mass infections that could install ransomware or espionage malware. The researcher provided the following details:

• While the exploitation attempts we have observed were indiscriminate in targeting, we haven’t seen a large volume of exploitation attempts
• Based on what we have researched and observed, exploitation of this vulnerability is very easy, but we do not have any information about how reliable the exploitation is
• Exploitation has remained about the same since we first spotted it on Sept. 28th
• There is a PoC available, and the exploit attempts appear opportunistic
• Exploitation is geographically diverse and appears indiscriminate
• The fact that the attacker is using the same server to send the exploit emails and host second-stage payloads indicates the actor does not have a distributed set of infrastructure to send exploit emails and handle infections after successful exploitation. We would expect the email server and payload servers to be different entities in a more mature operation.
• Defenders protecting  Zimbra appliances should look out for odd CC or To addresses that look malformed or contain suspicious strings, as well as logs from the Zimbra server indicating outbound connections to remote IP addresses.

Proofpoint has explained that some of the malicious emails used multiple email addresses that, when pasted into the CC field, attempted to install a webshell-based backdoor on vulnerable Zimbra servers. The full cc list was wrapped as a single string and encoded using the base64 algorithm. When combined and converted back into plaintext, they created a webshell at the path: /jetty/webapps/zimbraAdmin/public/jsp/zimbraConfig.jsp.

https://arstechnica.com/security/2024/10/attackers-exploit-critical-vulnerability-recently-patched-in-zimbra-servers/

Ott 02, 2024 Marina Londei Approfondimenti, Minacce, Minacce, News, Off Topic, RSS 0

---

Grazie al machine learning, il Global Research and Analysis Team (GReAT) di Kaspersky ha registrato un aumento del 25% della capacità di rilevamento di minacce APT. Con le nuove tecniche di analisi il team è riuscito a individuare migliaia di nuove minacce avanzate che hanno preso di mira i settori governativo, finanziario, aziendale e delle telecomunicazioni.

I modelli di machine learning usati dalla compagnia usano tecniche quali la Ransom Forest e la Term Frequency Inverse Document Frequency per elaborare velocemente grandi quantità di dati, consentendo un rilevamento più efficiente delle minacce nascoste.

La combinazione di questi metodi permette di individuare gli indicatori di compromissione che i sistemi tradizionali non sempre riescono a rilevare, portando quindi a un riconoscimento più preciso delle anomalie e al miglioramento complessivo delle capacità di identificazione delle minacce.

“I risultati hanno superato le nostre aspettative. Queste tecnologie migliorano l’accuratezza del rilevamento e promuovono strategie di difesa proattive, aiutando le organizzazioni a stare al passo con l’evoluzione delle minacce informatiche. Il futuro della sicurezza informatica risiede nello sfruttamento etico di questi strumenti per garantire un ambiente digitale più sicuro per tutti” ha commentato Amin Hasbini, Head of the META Research Center di Kaspersky’s GReAT.

I modelli di machine learning di Kaspersky vengono aggiornati costantemente per continuare a individuare efficacemente le nuove minacce APT. La compagnia approfondirà questi e altri risultati della ricerca in occasione del GITEX 2024, uno degli eventi tech più noti al mondo, previsto per il 14 ottobre a Dubai.

---

---

---

https://www.securityinfo.it/2024/10/02/il-machine-learning-di-kaspersky-aumenta-la-capacita-di-rilevamento-di-minacce-apt/?utm_source=rss&utm_medium=rss&utm_campaign=il-machine-learning-di-kaspersky-aumenta-la-capacita-di-rilevamento-di-minacce-apt

Ransomware group Vanilla Tempest, formerly known as DEV-0832, is reportedly targeting healthcare providers in the United States by deploying the the INC ransomware service. 

Security leaders weigh in 

John Bambenek, President at Bambenek Consulting:

“This research focuses on a group that uses various ransomware strains as opposed to focusing on one toolset. The use of INC specifically dates to 2023, and several other security companies have reported on both the tool and its use against health care organizations. This report is a deeper dive on the threat actors, as opposed to tooling, and gives us better insight into what this group is thinking.”

Patrick Tiquet, Vice President, Security & Architecture at Keeper Security:

“The rise of Vanilla Tempest, particularly with its latest INC ransomware attacks, marks a continuation of the healthcare sector’s growing vulnerability to ransomware-as-a-service (RaaS) operations. While the tactics used — like lateral movement through RDP and the deployment of legitimate tools — are not groundbreaking, what stands out is the persistent focus on healthcare. Threat actors like ALPHV/BlackCat have long exploited the sector’s aging infrastructure and critical dependence on sensitive data, and Vanilla Tempest is following suit with similar, albeit diverse, ransomware strains.

“In the larger threat environment, Vanilla Tempest’s focus on healthcare fits into a broader pattern of attackers leveraging increasingly sophisticated ransomware strains to exploit the sector’s vulnerabilities. Threat actors like ALPHV/BlackCat have shown that the industry’s aging infrastructure and heavy reliance on sensitive data make it an attractive target. For security teams, this signals that while the techniques may not be new, the diversity and persistence of attackers are growing. Prioritizing stronger network segmentation, real-time monitoring and full compliance with regulations like HIPAA is crucial to staying ahead of these evolving threats.

“Given the resource limitations that healthcare facilities often face, investing in scalable, cost-effective solutions like zero trust Privileged Access Management (PAM) can make a big difference. These tools allow organizations to enforce strict access controls, minimizing risk by preventing unauthorized lateral movement during an attack. By offering granular control over user permissions and detecting suspicious activity early, PAM solutions help healthcare organizations mitigate the impact of ransomware while maintaining smooth operations.”

Mr. Balazs Greksza, Threat Response Lead at Ontinue:

“Microsoft reported that Vanilla Tempest gains access to healthcare sector victims through Storm-0494 via Gootloader — typically through drive-by-compromise and search ads. Gootloader’s techniques are well documented, typically involving malicious Javascript, and maintaining persistence through scheduled tasks. In the most recent campaigns, defenders can expect the use of RDP or AnyDesk, and MEGA uploads and try detection and mitigating measures.

“The encrypted files with .inc extension have been padded with a footer that reveals information about the encryption modes used (full or partial). Depending on the mode, it may be possible to recover some files without the need of a decryptor.

“On the recent RaaS offer, the INC encryptor was advertised using the aes-ctr-128 /curve25519-donna cryptographic algorithms for encryption, both of which are somewhat dated.”

https://www.securitymagazine.com/articles/101084-security-leaders-discuss-inc-ransomware-attacks-targeting-healthcare

The use of artificial intelligence (AI) by information technology (IT) professionals in the U.S. was analyzed in a recent report by GetApp. The report finds that 64% of IT and security professionals see AI as a vital defense against the growing sophistication of cyberattacks.

According to the report, 45% of U.S. respondents have identified AI solutions for network and cloud security as their top investment priorities for the coming year. In response to the rising complexity of threats, 80% of them anticipate increasing their cybersecurity budgets in 2025.

Survey insights prove the widespread adoption of AI-assisted cybersecurity tools, with 90% of U.S. companies using them in some capacity. AI-driven threat detection and monitoring stand out as the most used features, ahead of automation. Top functionalities include real-time monitoring (48%), advanced malware detection (46%), threat intelligence integration (43%), and routine task automation (41%).

To help IT leaders capitalize on AI’s full potential, the report offers three key recommendations for integrating AI into cybersecurity strategies:

• Plan around AI’s cyberthreat prevention strengths: Clearly define the goals for AI usage and prioritize areas where AI can enhance protection, such as network security, cloud security, and threat detection.
• Prioritize human-in-the-loop (HITL) approaches: While AI can automate tasks and enhance protection, human intervention is necessary to avoid errors and ensure compliance with ethical AI principles. Provide sufficient security training to empower staff to effectively use AI tools.
• Get data AI-ready: Ensure the availability of quality data to train AI systems. Decide whether to use public or proprietary data sets and focus on data management and governance to organize data in a readable and error-free format.

Read the report

https://www.securitymagazine.com/articles/101078-90-of-us-companies-admit-to-using-ai-in-some-capacity

Nel contesto dell’era digitale, le minacce informatiche rappresentano una delle sfide più complesse per le aziende. Non si tratta più soltanto di proteggere i dati, ma di garantire la continuità operativa di intere organizzazioni in un panorama globale sempre più interconnesso. Il Threat Landscape 2024 di ENISA, l’Agenzia Europea per la Cybersecurity, traccia una panoramica dettagliata delle minacce informatiche attuali, analizzando tendenze, attori malevoli e soluzioni per la difesa.

Dal report emerge come ormai la cybersecurity non è più solo una preoccupazione tecnica, ma una parte fondamentale della strategia aziendale. Con l’aumento degli attacchi informatici e la loro crescente sofisticazione, le aziende devono essere pronte a difendersi in un contesto che cambia rapidamente.

Panoramica delle Minacce Informatiche

Nel 2024, le minacce informatiche sono aumentate sia in termini di volume che di sofisticazione. Attacchi come il ransomware, il malware e i Distributed Denial of Service (DDoS) stanno colpendo duramente settori critici come la sanità, la finanza e la pubblica amministrazione. Secondo ENISA, le minacce informatiche principali che le aziende devono affrontare includono ransomware, malware, attacchi di ingegneria sociale, violazioni di dati e attacchi alla supply chain.

Le 7 Principali Minacce Informatiche del 2024

1. Ransomware: Una delle Maggiori Minacce Informatiche

Il ransomware rimane una delle minacce informatiche più gravi per le aziende e continua a essere uno dei principali vettori di attacco nel 2024, con tecniche sempre più raffinate e dannose. L’evoluzione di questi attacchi ha portato a un aumento delle strategie di doppia e tripla estorsione, in cui gli attaccanti non solo criptano i dati delle vittime, ma minacciano anche di rilasciarli pubblicamente o di attaccare nuovamente se il riscatto non viene pagato. Gli attacchi ransomware hanno colpito in particolare settori come i servizi sanitari e finanziari, dove i dati sensibili e le operazioni critiche sono bersagli perfetti per estorsioni di alto profilo.

Dal punto di vista tecnico, gli attacchi ransomware spesso sfruttano vulnerabilità nei sistemi legacy o approfittano di credenziali compromesse. I vettori di accesso iniziali più comuni includono phishing mirato (spear phishing), exploit di vulnerabilità note e accesso ottenuto tramite broker di accessi iniziali (IAB). Una volta dentro la rete, gli attori malevoli utilizzano tecniche avanzate di Living Off The Land (LOTL) per sfruttare strumenti di sistema legittimi, evitando di essere rilevati dalle soluzioni di sicurezza tradizionali.

Mitigazione del Rischio Ransomware

Per difendersi da questo tipo di attacchi, le organizzazioni devono implementare una serie di misure preventive:

• Backup regolari e testati: Gli attacchi ransomware puntano a compromettere i dati, quindi backup frequenti e separati dalla rete principale sono fondamentali.
• Segmentazione della rete: Suddividere la rete in segmenti separati riduce l’impatto potenziale di un attacco e limita la capacità degli attaccanti di muoversi lateralmente all’interno della rete.
• Autenticazione multifattore (MFA): Limitare l’accesso agli asset critici utilizzando autenticazioni multiple, impedendo così agli attori malevoli di accedere ai sistemi solo con credenziali compromesse.

2. Malware: L’Ascesa del Malware-as-a-Service (MaaS)

Il malware resta uno dei metodi più comuni di attacco, ma il panorama si è evoluto significativamente. L’ascesa di modelli di business come il Malware-as-a-Service (MaaS) ha abbassato la barriera d’ingresso per i cybercriminali meno esperti, che possono acquistare e distribuire malware personalizzati su misura per le loro vittime.

Questi software malevoli sono progettati per compromettere la riservatezza, l’integrità e la disponibilità dei sistemi attaccati. Esempi di malware comuni includono trojan bancari, spyware e worm, tutti progettati per sottrarre dati sensibili o propagarsi all’interno delle reti aziendali.

Tecniche di Difesa Contro il Malware

• Monitoraggio continuo: Implementare soluzioni di endpoint detection and response (EDR), che forniscono una visibilità avanzata su ciò che accade su ogni endpoint della rete.
• Patching tempestivo: Il malware spesso sfrutta vulnerabilità conosciute nei sistemi software. È essenziale implementare una gestione rigida delle patch per chiudere queste falle prima che possano essere sfruttate.
• Threat intelligence: L’utilizzo di servizi di threat intelligence in tempo reale può aiutare a identificare e mitigare potenziali minacce prima che colpiscano.

3. Ingegneria Sociale: Il Fattore Umano Come Vettore di Attacco

Nonostante le difese tecnologiche avanzate, il fattore umano rimane uno degli anelli deboli della sicurezza informatica. Le tecniche di ingegneria sociale, come il phishing, lo spear phishing e gli attacchi Business Email Compromise (BEC), sfruttano l’errore umano per accedere a informazioni sensibili. Questi attacchi possono ingannare i dipendenti a divulgare credenziali o a eseguire azioni dannose come trasferimenti di denaro non autorizzati.

Prevenzione degli Attacchi di Ingegneria Sociale

• Formazione e sensibilizzazione: È essenziale educare continuamente i dipendenti sui rischi degli attacchi di ingegneria sociale, inclusi i segnali di phishing e altre tecniche di manipolazione.
• Simulazioni di attacchi: Le simulazioni regolari di phishing aiutano a preparare i dipendenti a riconoscere le minacce reali, migliorando la resilienza dell’organizzazione.

4. Minacce alla Disponibilità: Gli Attacchi DDoS e la Resilienza della Rete

Gli attacchi Denial of Service (DoS), in particolare i Distributed Denial of Service (DDoS), continuano a rappresentare una grave minaccia per le aziende, interrompendo i servizi e causando danni finanziari e reputazionali significativi. Questi attacchi sovraccaricano i sistemi con richieste illegittime, impedendo agli utenti legittimi di accedere ai servizi.

Difesa Contro gli Attacchi DDoS

• Infrastrutture scalabili: Utilizzare servizi di mitigazione DDoS basati su cloud che possano assorbire e neutralizzare il traffico malevolo prima che raggiunga l’infrastruttura aziendale.
• Architetture di rete distribuite: La distribuzione dei servizi su una rete globale di data center può ridurre l’impatto di un attacco DDoS, permettendo di deviare il traffico malevolo verso nodi meno vulnerabili.

5. Violazioni dei Dati: Difendere il Patrimonio Informativo

Le minacce ai dati, comprese le violazioni e le fughe di dati, sono tra le problematiche più critiche per le aziende nel 2024. Le violazioni dei dati non solo espongono informazioni sensibili, ma possono anche portare a pesanti sanzioni normative, in particolare nell’Unione Europea, dove il GDPR impone requisiti stringenti sulla protezione dei dati.

Misure per Proteggere i Dati dalle Minacce Informatiche

• Crittografia dei dati: Assicurarsi che tutti i dati sensibili, sia in transito che a riposo, siano adeguatamente crittografati per prevenire l’accesso non autorizzato.
• Gestione rigorosa delle autorizzazioni: Implementare controlli di accesso basati sui ruoli (RBAC) per limitare l’accesso ai dati sensibili solo al personale autorizzato.

6. Manipolazione dell’Informazione: Il Cyber Espionaggio e l’Interferenza Straniera

Il 2024 ha visto un aumento delle campagne di manipolazione delle informazioni, spesso utilizzate come strumento di disinformazione e interferenza elettorale. Queste campagne sono spesso condotte da attori statali e mirano a destabilizzare società o manipolare opinioni pubbliche a fini politici.

Contromisure per la Manipolazione dell’Informazione

• Monitoraggio dei media e dei social media: Implementare strumenti che rilevino rapidamente attività di disinformazione e che possano rispondere in modo proattivo con contro-narrative.
• Collaborazione intersettoriale: Lavorare con altre organizzazioni e agenzie governative per identificare e mitigare rapidamente queste minacce.

7. Attacchi alla Supply Chain: La Debolezza nei Sistemi Esterni

Gli attacchi alla supply chain sono emersi come una delle minacce informatiche più insidiose nel 2024. Questi attacchi mirano a compromessi nelle componenti software o hardware utilizzate da più organizzazioni. Un esempio notevole è il caso di compromissioni in progetti open-source, come XZ Utils, che ha visto l’introduzione di backdoor attraverso il social engineering verso i manutentori del progetto.

Difesa Contro gli Attacchi alla Supply Chain

• Verifica delle forniture: Implementare un processo rigoroso di verifica dei fornitori per garantire che i componenti software e hardware provengano da fonti affidabili.
• Monitoraggio continuo delle vulnerabilità: Mantenere un’attenzione costante sugli aggiornamenti dei software e sulle vulnerabilità potenzialmente sfruttabili nella catena di fornitura.

Attori delle Minacce

ENISA identifica quattro principali categorie di attori delle minacce:

• Attori collegati agli Stati: Questi gruppi, ben finanziati e con risorse significative, operano spesso per finalità di spionaggio o sabotaggio su larga scala.
• Cybercriminali: Gruppi che operano principalmente per profitto finanziario, utilizzando attacchi opportunistici per massimizzare il danno economico.
• Attori del Settore Privato Offensivo (PSOA): Aziende private che sviluppano e vendono cyberarmi avanzate.
• Hacktivisti: Gruppi motivati da cause politiche o sociali, che utilizzano attacchi informatici per promuovere il cambiamento.

Il Threat Landscape 2024 di ENISA mette in evidenza un panorama delle minacce in continua evoluzione, dove le tecnologie avanzate e le tattiche di attacco sempre più sofisticate richiedono un approccio proattivo e multilivello alla sicurezza informatica. Le aziende devono adottare misure integrate che includano tecnologie all’avanguardia, formazione costante del personale e strette collaborazioni con enti governativi e fornitori. Solo così sarà possibile affrontare con successo le sfide che la cybersecurity continuerà a presentare nel futuro prossimo. Solo con un approccio integrato sarà possibile mitigare l’impatto delle minacce informatiche sul lungo termine.

https://www.ictsecuritymagazine.com/notizie/minacce-informatiche-2024/

Ott 02, 2024 Redazione Mercato, News, RSS, Tecnologia 0

---

Tra le minacce alla sicurezza aziendale, l’errore umano rappresenta uno dei pericoli principali: che siano o meno intenzionali, alcune azioni di dipendenti e utenti possono portare a violazioni significative che impattano negativamente le aziende. Dal download di allegati sospetti all’uso di password facili da indovinare, i punti deboli dei dipendenti sono molti e per questo è necessario investire su un’adeguata gestione del rischio umano.

A questo scopo Mimecast, fornitore di soluzioni di cybersecurity per le aziende, ha presentato una piattaforma di gestione Human Risk (HRM) completa e integrabile per aiutare le imprese a migliorare la gestione del rischio legato alla componente umana.

La soluzione si basa su un motore di rischio centralizzato per prevenire le minacce che sfruttano l’errore umano. Grazie a controlli preventivi e azioni dirette, la piattaforma mitiga il rischio associato ad azioni pericolose quali il click su un link malevolo, l’apertura di un allegato illecito o la condivisione involontaria di documenti interni.

La proposta di Mimecast riduce l’eventualità che gli utenti diventino vittime di attacchi come quelli di Business E-Mail Compromise (BEC) o phishing, problemi che le soluzioni di sicurezza tradizionali faticano a risolvere.

Visibilità e integrazione per la gestione del rischio umano

La piattaforma di HRM offre ai team di sicurezza una dashboard con indicazioni su punteggi e visibilità del rischio basati su eventi tracciati sia dalle metriche native di Mimecast che da quelle di strumenti di terze parti. La soluzione assegna un punteggio di rischio agli utenti, permettendo così agli esperti di cybersecurity di individuare i dipendenti più vulnerabili e formarli per proteggerli dai pericoli a cui sono esposti, ricorrendo anche a misure tecnologiche speciali che possono essere implementate di caso in caso.

La dashboard, inoltre, quantifica i fattori di attacco misurando la frequenza e la gravità delle minacce in ingresso tramite un’analisi di indicatori quali, ad esempio, i tentativi di phishing, i malware bloccati o i contenuti web dannosi caricati dalle pagine visitate. Avendo la totale visibilità su queste informazioni e potendo integrarle con i dati di tool di terze parti, le imprese riescono a investire su formazione mirata, sensibilizzare gli utenti meno esperti e capire se ci sono campagne mirate in atto.

Oltre a offrire ampia visibilità, la soluzione di Mimecast consente di analizzare a fondo la postura di sicurezza aziendale incrociando il rischio tecnologico con quello umano, anche al fine di ottenere un maggior numero di informazioni pertinenti per eseguire azioni correttive.

L’intelligenza artificiale al servizio dei criminali è un rischio, ma anche un’alleata per chi difende

La diffusione dell’intelligenza artificiale anche nel mondo del cybercrimine ha permesso agli attaccanti di migliorare le proprie strategie e creare campagne difficili da contrastare. L’IA viene usata in particolare per creare modelli di phishing e automatizzare le campagne di social engineering e se finora l’impatto dell’IA sul cybercrimine è stato relativamente limitato, le promesse di una trasformazione profonda ci sono tutte. Per questo è necessario evolvere gli strumenti di sicurezza. In questo senso, l’IA diventa un supporto fondamentale per migliorare le difese aziendali e anticipare efficacemente le minacce.

La piattaforma di Mimecast sfrutta l’intelligenza artificiale per supportare la threat intelligence e conoscere a fondo aggressori e tattiche emergenti. Il livello di automazione potenziato dall’IA consente di proteggere automaticamente i sistemi dalle minacce, per esempio bloccando e-mail o altre comunicazioni sospette prima che arrivino ai dipendenti. Il livello di insight offerto dalla tecnologia, inoltre, permette ai team di rimanere aggiornati sul panorama del cybercrimine e prepararsi ai nuovi attacchi.

“Gli strumenti e le tecnologie emergenti come l’IA e i deepfake, insieme alla proliferazione delle piattaforme di collaborazione, stanno cambiando il modo in cui gli attori delle minacce operano; nonostante questo le persone rimangono la più grande barriera alla protezione delle Imprese dalle minacce informatiche” – ha spiegato Marc van Zadelhoff, CEO di Mimecast. “I Team di IT e cyber security devono lavorare col management per dare priorità alla comprensione del rischio umano. Con gli strumenti e la formazione giusti, le Imprese possono proteggersi“.

I vantaggi economici della soluzione di Mimecast

Riuscire a bloccare le minacce prima che abbiano impatti sul business porta a una serie di vantaggi economici non indifferenti. Nel dettaglio, la piattaforma HRM di Mimecast riduce le perdite associate ai costi delle violazioni, alle interruzioni dell’attività e alla perdita di fatturato; secondo uno degli ultimi report di Forrester, in tre anni il rafforzamento della sicurezza nelle aziende porta benefici medi di 1,1 milioni di dollari.

La piattaforma riduce inoltre il tempo dedicato a gestire gli attacchi basati sulle e-mail del 24% e offre un risparmio di tempo del 50% nella gestione della piattaforma di posta elettronica. I team di sicurezza e IT, beneficiando della soluzione di Mimecast, possono così dedicarsi a compiti di maggior valore, portando a un aumento di produttività del valore mediamente stimato in 337.000 dollari.

Ancora maggiore è il miglioramento della produttività vista in settori aziendali diversi da quello IT. Riducendo drasticamente il numero di e-mail di phishing che ogni dipendente riceve, infatti, non si spreca il tempo necessario a gestirle garantendo un aumento produttivo che Forresterha stimato in una media di 727.000 dollari in tre anni.

La ricerca ha evidenziato infine che la piattaforma di HRM di Mimecast ha contribuito non solo a evitare le perdite economiche, ma anche a proteggere il marchio da eventuali crolli di reputazione e pubblicità negativa.

“Investire nella cyber security è ora un imperativo aziendale, ma le Imprese hanno difficoltà a identificare fornitori che offrano soluzioni complete, flessibili e con risultati comprovati” ha continuato van Zadelhoff. “Il nostro studio di Forrester Consulting quantifica il valore che le soluzioni avanzate di Mimecast portano ai nostri Clienti; siamo impegnati a continuare a innovare e ampliare le nostre offerte per garantire che le Imprese possano rimanere all’avanguardia nel mutevole panorama delle minacce senza sacrificare il loro risultato finale e la loro reputazione“.

La soluzione è disponibile anche in Italia distribuita da Ingecom Ignition, compagnia specializzata in soluzioni di sicurezza IT, OT/ICS, IoT e IoMT e cyber intelligence. Lo scorso 21 maggio Mimecast ha siglato un accordo di distribuzione con Ingecom Ignition per ampliare il proprio business in Italia, Spagna e Portogallo.

---

---

---

https://www.securityinfo.it/2024/10/02/rischio-umano-con-mimecast-si-minimizzano-i-rischi-di-attacchi-a-dipendenti-e-manager/?utm_source=rss&utm_medium=rss&utm_campaign=rischio-umano-con-mimecast-si-minimizzano-i-rischi-di-attacchi-a-dipendenti-e-manager

In today’s digital world, enterprises face unprecedented cyber threats from sophisticated actors who exploit the vulnerabilities of a complex and dynamic IT environment. As organizations adopt cloud computing, artificial intelligence and other emerging technologies to enhance their business capabilities and competitiveness, they also expose themselves to new attack vectors and risks. 

According to a report by IBM, the global average cost of a data breach in 2024 — a 10% increase over last year and the highest total ever. Moreover, 75% of the increase in the average breach costs was the result of the cost of lost business and post-breach response activities.

Enterprises need to rethink their cybersecurity strategy and adopt a zero trust mindset that assumes no user, device or network is inherently trustworthy. Zero trust is not a product or a solution, but a holistic approach that leverages multiple security controls and technologies to verify every request, enforce granular policies, and monitor all activities across the organization. 

What leaders should understand is that the zero trust approach is more than just an IT project. It is a business imperative necessary to ensure that the enterprise has the security it needs to both survive and thrive in today’s environment. By implementing zero trust frameworks, enterprises can reduce their attack surfaces, improve their visibility and detection, and enhance their resilience and recovery capabilities. 

How to gain alignment and support for zero trust

While the benefits of zero trust are clear, many enterprises face barriers and resistance when it comes to implementing it across the organization. A successful zero trust transformation requires not only technical changes, but also cultural and organizational changes that involve multiple stakeholders, including the C-suite, the board of directors, and the employees. Therefore, security and risk leaders need to communicate effectively and persuasively the value proposition, the roadmap, and the cyber resilience and business growth outcomes of zero trust to gain alignment and support from these stakeholders. 

A key step to achieve this is to align the zero trust strategy with the business objectives and priorities of the organization. Security leaders need to demonstrate how zero trust can help the organization achieve its goals, such as increasing customer satisfaction, enhancing innovation, or reducing costs. For example, by adopting zero trust, an organization can improve its customer trust and loyalty by ensuring the privacy and security of their data, which can lead to higher retention and revenue rates. Further, an organization can foster a culture of innovation and experimentation by enabling secure access to cloud-based resources and applications, which can accelerate the development and delivery of new products and services. 

Getting to a zero trust framework is a multi-year project, one that requires trusted partners, and the entire organization, to build their framework on a solid foundation. organization. Leaders must gain alignment and support for zero trust to successfully implement it throughout the organization.

To do this, leaders must quantify and measure the impact and return on investment (ROI) in order to communicate security posture in a way that C-Suite and board members will understand. Security leaders need to establish metrics and indicators that can track and evaluate the performance and effectiveness of zero trust, such as the number and severity of incidents, the time and cost of detection and response, the user experience and satisfaction, or the compliance and regulatory status. By collecting and analyzing data and evidence, security leaders can showcase the tangible and intangible benefits of zero trust, such as the reduction of risk, the improvement of efficiency, or the enhancement of reputation.

Additionally, by measuring and reporting the progress and results of zero trust, security leaders can justify the budget and resources needed to sustain and scale the initiative, as well as identify and address any gaps or challenges that may arise along the way. Security leaders need to establish metrics and indicators that can track and evaluate the performance and effectiveness of zero trust, such as the number and severity of incidents, the time and cost of detection and response, the user experience and satisfaction, or the compliance and regulatory status. By collecting and analyzing data and evidence, security leaders can showcase the tangible and intangible benefits of zero trust, such as the reduction of risk, the improvement of efficiency, or the enhancement of reputation. Additionally, by measuring and reporting the progress and results of zero trust, security leaders can justify the budget and resources needed to sustain and scale the initiative, as well as identify and address any gaps or challenges that may arise along the way. 

How zero trust maturity helps the business grow and increase cyber resilience 

Achieving zero trust maturity requires constant adaptation and improvement. As the threat landscape and the business environment evolve, enterprises need to update and refine their zero trust framework to ensure it remains relevant and effective. However, this process is not only a defensive measure, but an opportunity to drive business growth and increase cyber resilience. By reaching higher levels of zero trust maturity, enterprises can unlock several benefits that can enhance their competitive advantage and sustainability. 

Zero trust maturity enables enterprises to expand their business opportunities and reach new markets. By implementing a zero trust framework, enterprises can securely enable remote and mobile workforces, as well as collaborate with customers, partners and other stakeholders across different locations and platforms. This can increase the productivity, flexibility and agility of the organization, as well as improve the customer experience and loyalty. Furthermore, by adopting a zero trust framework, enterprises can comply with the increasing and varying regulatory and industry standards that govern data protection and privacy, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). This can reduce the legal and reputational risks, as well as open up new avenues for business growth and expansion. 

Another benefit of zero trust maturity is that it strengthens the enterprise’s ability to withstand and recover from cyberattacks. By implementing a zero trust framework, enterprises can minimize their attack surface, detect and respond to threats faster, and isolate and contain the impact of incidents. This can reduce the operational and financial losses, as well as the reputational and legal consequences of a breach. 

By implementing a zero trust framework, enterprises can enhance their recovery and restoration capabilities, as well as their readiness and preparedness for future incidents. This can improve the confidence and trust of the organization, as well as its stakeholders, in its ability to survive and thrive in the face of adversity. While data breaches will continue to increase, when done correctly, zero trust security can significantly increase the business continuity capabilities of enterprises for current and future threats.

https://www.securitymagazine.com/articles/101083-zero-trust-a-business-imperative-for-the-digital-age

Federal prosecutors have charged a man for an alleged “hack-to-trade” scheme that earned him millions of dollars by breaking into the Office365 accounts of executives at publicly traded companies and obtaining quarterly financial reports before they were released publicly.

The action, taken by the office of the US Attorney for the district of New Jersey, accuses UK national Robert B. Westbrook of earning roughly $3.75 million in 2019 and 2020 from stock trades that capitalized on the illicitly obtained information. After accessing it, prosecutors said, he executed stock trades. The advance notice allowed him to act and profit on the information before the general public could. The US Securities and Exchange Commission filed a separate civil suit against Westbrook seeking an order that he pay civil penalties and return all ill-gotten gains.

Buy low, sell high

“The SEC is engaged in ongoing efforts to protect markets and investors from the consequences of cyber fraud,” Jorge G. Tenreiro, acting chief of the SEC’s Crypto Assets and Cyber Unit, said in a statement. “As this case demonstrates, even though Westbrook took multiple steps to conceal his identity—including using anonymous email accounts, VPN services, and utilizing bitcoin—the Commission’s advanced data analytics, crypto asset tracing, and technology can uncover fraud even in cases involving sophisticated international hacking.”

A federal indictment filed in US District Court for the District of New Jersey said that Westbrook broke into the email accounts of executives from five publicly traded companies in the US. He pulled off the breaches by abusing the password reset mechanism Microsoft offered for Office365 accounts. In some cases, Westbrook allegedly went on to create forwarding rules that automatically sent all incoming emails to an email address he controlled.

Prosecutors alleged in one such incident:

On or about January 26, 2019, WESTBROOK gained unauthorized access to the Office365 email account of Company-1 ‘s Director of Finance and Accounting (“Individual-!”) through an unauthorized password reset. During the intrusion, an auto-forwarding rule was implemented, which was designed to automatically forward content from lndividual-1 ‘s compromised email account to an email account controlled by WESTBROOK. At the time of the intrusion, the compromised email account of Individual-I contained non-public information about Company-1 ‘s quarterly earnings, which indicated that Company-1 ‘s sales were down.

Once a person gains unauthorized access to an email account, it’s possible to conceal the breach by disabling or deleting password reset alerts and burying password reset rules deep inside account settings.

Prosecutors didn’t say how the defendant managed to abuse the reset feature. Typically such mechanisms require control of a cell phone or registered email account belonging to the account holder. In 2019 and 2020 many online services would also allow users to reset passwords by answering security questions. The practice is still in use today but has been slowly falling out of favor as the risks have come to be more widely understood.

By obtaining material information, Westbrook was able to predict how a company’s stock would perform once it became public. When results were likely to drive down stock prices, he would place “put” options, which give the purchaser the right to sell shares at a specific price within a specified span of time. The practice allowed Westbrook to profit when shares fell after financial results became public. When positive results were likely to send stock prices higher, Westbrook allegedly bought shares while they were still low and later sold them for a higher price.

The prosecutors charged Westbrook with one count each of securities fraud and wire fraud and five counts of computer fraud. The securities fraud count carries a maximum penalty of up to 20 years’ prison time and $5 million in fines The wire fraud count carries a maximum penalty of up to 20 years in prison and a fine of either $250,000 or twice the gain or loss from the offense, whichever is greatest. Each computer fraud count carries a maximum five years in prison and a maximum fine of either $250,000 or twice the gain or loss from the offense, whichever is greatest.

The US Attorney’s office in the District of New Jersey didn’t say if Westbrook has made an initial appearance in court or if he has entered a plea.

https://arstechnica.com/?p=2053721