Byline: Chris Jenkins, Principal Chief Architect at Red Hat 

The evolution of containers and hybrid cloud technologies has brought significant benefits to the enterprise. These platforms democratize access to new applications and technologies, enabling teams to work more seamlessly together and facilitate increased innovation within the organization. Over the last few years, IT leaders have been championing migrations from on-premises based virtual machines to containers and the hybrid cloud accordingly, with almost three quarters (73%) of enterprises now using a hybrid cloud strategy.  

As is the case whenever technology evolves, organizations must also adapt cybersecurity and compliance strategies to mitigate potential risks associated with this new approach. For example, perimeter-based security, which took a ‘castle and moat’ approach to protecting the internal network is no longer entirely fit-for-purpose, as certain operations will be taking place using, for example, external public cloud infrastructure.  

As a result, cybersecurity teams must adopt practices that can manage and adapt to more multifaceted attack surfaces. New approaches have been developed with the hybrid cloud environment in mind, including layered, defense-in-depth security, secure by design principles, and the Zero Trust Model.  

In this article, I’ll summarize the current hybrid cloud cyber-threat landscape and explain how and why modern security practices must adapt and scale. I’ll conclude by exploring the real-world benefits of these new approaches, including the value of an innovative DevSecOps culture, and the significant real-world commercial and reputational impacts on the organization.  

The hybrid cloud cyber-threat landscape

The expansion of cloud technologies has seen the global cyber-threat landscape adapt accordingly. This year, IBM uncovered two in five (40%) data breaches involved data stored across multiple environments, including public clouds. When breached data was stored in public clouds, it incurred the highest average breach cost at USD $5.17 million. In this new context, security teams must evolve their approach to keep ahead of protection gaps, compliance requirements, tools, and architectural changes.  

Traditional security practices alone can no longer manage modern security risks because they simply weren’t designed to reflect the modern environment’s complexity. The strategic way to best protect your container and hybrid cloud based environments is to take a defense-in-depth approach to security, which requires a single-pane view of the organization.

 

Defense-in-depth with a single-pane view 

 Centralization for a single-pane view 

The first step of an organization’s hybrid cloud security approach must be centralization and visibility—because you can’t protect what you can’t see. Hosted and managed hybrid cloud platforms, like Red Hat OpenShift, are purpose-built to support disparate cloud environments, helping to provide a centralized, consistent experience for users, simplifying security and compliance.  

A layered, defense-in-depth approach 

A concurrent step is to make security an integral part of every stage of the infrastructure and application stack and lifecycle; design, build, run, manage, and adapt. It cannot be seen as an afterthought or tick-box exercise. Robust security should be built into applications, which must then be deployed onto hardened platforms.  

As security and compliance requirements change, automation and management infrastructure must be able to seamlessly adapt. Therefore, authorization between people and systems should be explicit instead of assumed. Additionally, people and automated processes should align to facilitate early threat detection and maintain compliance. This can reduce manual workloads and stop a security threat before it becomes a bigger problem. 

To bring this to life, security measures can be layered across the infrastructure and application lifecycle, which fortifies environment-wide defenses. For example, reflecting that modern environments are complex and constantly evolving, Red Hat software prioritizes in-depth defense strategies that reassures organizations that they’re never just relying on a single security layer.  

Breaking down a system into the operating system, the platform layer and application components and connectivity will enable teams to have confidence in the security and regulatory compliance of each level and hence the entire system as a whole. 

Secure By Design principles 

“Secure by design” is an approach to software development where security is integrated from the very beginning of the design process rather than being added as an afterthought. This principle emphasizes the importance of building security features and considerations into the architecture and design phases of development, ensuring that potential vulnerabilities are addressed before they can become problems. This approach involves practices such as threat modeling, secure coding standards, and regular security testing. By considering security early and often, developers can create systems that are resilient against attacks, reducing the likelihood of exploitable vulnerabilities. 

The benefits of a secure by design approach are significant. First, it reduces the cost and effort associated with addressing security flaws later in the development lifecycle or after the product has been deployed. Early identification and mitigation of security issues prevent costly patches and reduce the risk of security breaches that could damage a company’s reputation and lead to legal liabilities. 

Zero Trust principles 

Red Hat also designs its security architecture on ‘Zero Trust’ principles, which should be adopted by organizations to replace traditional perimeter-based security thinking. The Zero Trust Model argues every interaction, internal and external, begins in an untrusted state. Traditional security architectures on the other hand determines trustworthiness based on whether communication starts inside a firewall, or may rely on implicit trust models and one-time authentication, which is no longer appropriate in a hybrid cloud environment. Key Zero Trust principles include microsegmentation (limiting user permissions to specific applications and services which prevents lateral movement across hybrid clouds) and continuous user validation.  

DevSecOps: The future of secure development

Ultimately, humans are an organization’s last line of defense, so fostering a security-first mindset can help fortify technology and reduce breaches caused by human error. Additionally, building a culture that prioritizes both security and innovation must happen concurrently to setting the environment up with technology built for secure success. A key part of this is the facilitation of DevSecOps, an evolution of DevOps.  

DevOps originally fused the disciplines of software development and IT Operations into a new collaborative way of working. DevSecOps builds on this, highlighting security as a top concern and makes considering, and applying, application and infrastructure security throughout the development process a best practice. This also includes automating security operations to keep productivity high in DevOps teams. This approach plays a critical role in building modern, secure applications that operate on safe and compliant platforms.  

Given the evolved threat landscape impacting hybrid clouds and containers, developers have greater responsibility when it comes to managing workloads and ensuring security. Fostering a DevSecOps culture also pairs security teams with developers, meaning they can provide them with the right tools, feedback, and insights on known threats to code securely. When developers build on platforms that combine managing the application life cycle with built-in security features and a trusted software supply chain, like Red Hat OpenShift, they can implement security at every step of the process.  

Of course, it’s not practical to turn every developer into a security expert, and most developers don’t want to read through the details of a CVE report and exploitation process. This is where Red Hat Advanced Cluster Security for Kubernetes excels, because it shows developers how to remediate issues without them becoming security experts. 

Real-world impacts and business benefits

Trustworthy, reliable business infrastructure that can facilitate growth and innovation relies on two fundamental factors: having a centralized single-pane view of the operating environment and strong security practices. Good security can only be beneficial to your business; it directly translates to reduced downtime, cost savings, and more efficient operations.  

For example, when Red Hat customer VDAB decided to containerize 65% of its application landscape a year ago, the team combined Red Hat OpenShift and DevSecOps principles to enable them to go to market faster, and release more easily and continuously. The team estimates this process has led to a business efficiency uptick of 10%. 

Another illustration would be Red Hat customer Agile Defense, that helps the U.S. government prevent cybercriminals from accessing government systems. Many breaches that occur are a result of configuration errors, whereby regular audits to identify these errors become crucial. However, the audit process is repetitive, resource-intensive and costly. As a result, Agile Defense has leveraged the Red Hat Ansible Automation platform to reduce company time spent on audits by 98%.  

Leveraging secure, stable platforms can also foster innovation within DevSecOps teams. Fewer security incidents keeps developers focused on impactful work rather than constant firefighting. 

Red Hat and hybrid cloud security

Red Hat works with the open source community to build applications that support organizations to operate across the hybrid cloud environment more securely, including enabling them to centralize visibility over the business. Having a technology foundation that enables a layered, in-depth approach to security, alongside a security-first culture, helps ensure the entire infrastructure and application stack are fortified against the growing cyber threat.  

All of Red Hat’s offerings, including Red Hat Enterprise Linux, Red Hat OpenShift, Red Hat Advanced Cluster Security for Kubernetes, and Red Hat Ansible Automation are secure, constantly tested, and enterprise-ready. If you’re keen to find out more about Red Hat’s solutions and engage with Red Hat thought leaders, customers, partners, and technologies, join us at the forthcoming Summit Connect event on Oct 9. 

Red Hat also partners with leading cloud providers like AWS, Microsoft Azure, and Google Cloud to offer solutions for whichever platform the organization is using. Visit our blog to learn more about how we reduce risk in any environment and across the open source ecosystem.

https://www.securitymagazine.com/articles/101029-maximizing-business-benefits-with-robust-hybrid-cloud-security

Today’s IT security landscape is more complex than ever before, and will only continue to evolve. The rapid adoption of new technologies, the shift to hybrid work environments, and the proliferation of third-party applications have introduced new risks and expanded attack surfaces for organizations worldwide.

The increased use of these third-party applications, particularly on dispersed endpoints (i.e. laptops), can expose an organization to significant vulnerabilities. For example, dispersed endpoints leave a risk of a bad actor acquiring access to a network through an unpatched security gap in the application.

Neglecting to patch third party applications and loose endpoints often has both financial and operational costs for organizations across multiple industries. According to a report from IBM, breaches can cost about an average cost of $4.90 million, resulting from attack vectors including cloud misconfiguration, unpatched vulnerabilities — including those already known to the organization — phishing attacks, and other tactics that are seen in businesses’ day-to-day operations.

Not only are data breaches costly, but they can be time-consuming, requiring multiple teams and working hours to address the risk effectively. Case in point, the Ponemon Institute reports that 88% of companies surveyed say they must coordinate across multiple teams to patch vulnerabilities, adding an average of 12 days to the process. This delay in patching impairs an organization’s overall security posture, leaving devices, applications, and software vulnerable to bad actors.

This makes robust patch management more critical than ever. 

The necessity of effective third-party patch management 

Despite the financial and operational threats that successful cyberattacks can lead to, unpatched vulnerabilities can be found in a wide range of devices, endpoints and applications. For example, according to the Ponemon Institute, 60% of respondents cited an unpatched vulnerability as a source of data leakage.

The reliance on firewalls alone is no longer sufficient, and the number of software and applications needed to keep business operations going creates more updates and patches. In a hybrid and multi-cloud environment, a single unpatched endpoint can compromise an entire network. 

This further highlights that organizations can no longer rely solely on traditional network security measures. The reality is that as the number of devices and cloud-based applications in an organization increases, the attack surface increases and therefore the risk of a breach becomes higher. Thus, third-party patch management becomes essential to maintain the integrity of an organization’s operating systems.

Biggest mistakes in patch management

Organizations often make two common mistakes in patch management, which can have serious implications for their overall security posture. Understanding and addressing these pitfalls is crucial for maintaining a robust and secure IT environment.

The first is running software that has reached its end of life or end of support. Some IT teams may consider it safe to simply continue running the software past the end of support; however, it’s one of those small mistakes that can lead to costly consequences. Proactive IT departments will insist on replacing such software with an alternative that addresses the same need but is also being actively maintained and supported. By keeping track of the applications that an organization uses, security teams will have the insight to know when support for that application’s software has ended and how to pivot so that their organization can continue operating efficiently.

The second mistake organizations make is ignoring the communication component of third-party patch management. Just as patch management depends on systems communicating with one another, it also depends on people communicating with one another.

Establishing a work culture where scheduled patching can take place — with some room for exceptions — is crucial. It’s necessary for department heads to follow the guidance of IT and security teams, invite collaboration across departments, and agree to the organization’s policies, for patch management to not only be successful but effective.

How to effectively patch loose endpoints and third party applications

To address current and emerging security threats, organizations need to consider patch management as a core component of their IT strategy. Key steps include:

1. Conducting an inventory of devices and application landscape: Start by gaining a clear understanding of the types of devices, applications and software within the environment. Security begins with knowing the potential risks and entry points for hackers seeking to exploit an unpatched vulnerability within an operating system.
2. Identifying a baseline secure state: With the diversity of technology used in businesses, it’s integral for teams to unify patch levels across all devices and consolidate end-user computing groups. In short, establishing a standard security state of their organization.
3. Developing an patch management security roadmap and strategy: After assessing the potential vulnerabilities within a system, create a roadmap for a patch management process that meets the organization’s unique needs. Part of developing this roadmap should include understanding who is owning each business process so that everyone is involved in actionable steps to take.
4. Consistently checking the patch catalog and automating patch management: Given the heightened frequency of end-of-life in software and escalations of cybercrime, organizations that fall behind in patching will find their security posture lacking. Organizations should consider investing in solutions that help automate this patching process, both to stay up-to-date and reduce the workload of IT teams.

Ultimately, all of these important steps require organizations to ensure that their patching process matches their business needs, rather than the other way around. This starts with empowering key decision-makers to have a buy-in on the process and incorporating these needs into the budget.

With the diversity of endpoints and applications, and the increasing adoption of hybrid and multi-cloud environments, organizations need a holistic, adaptable approach to navigate the expanded attack surface. This comes in the forms of constant and automated patch management to ensure that IT teams have a leg up on any potential vulnerabilities, reduce team burnout, and that the organization is not compromised due to a third party.

https://www.securitymagazine.com/articles/101070-modernizing-patch-management-in-an-evolving-it-security-landscape

Officials in Ireland have fined Meta $101 million for storing hundreds of millions of user passwords in plaintext and making them broadly available to company employees.

Meta disclosed the lapse in early 2019. The company said that apps for connecting to various Meta-owned social networks had logged user passwords in plaintext and stored them in a database that had been searched by roughly 2,000 company engineers, who collectively queried the stash more than 9 million times.

Meta investigated for five years

Meta officials said at the time that the error was found during a routine security review of the company’s internal network data storage practices. They went on to say that they uncovered no evidence that anyone internally improperly accessed the passcodes or that the passcodes were ever accessible to people outside the company.

Despite those assurances, the disclosure exposed a major security failure on the part of Meta. For more than three decades, best practices across just about every industry have been to cryptographically hash passwords. Hashing is a term that applies to the practice of passing passwords through a one-way cryptographic algorithm that assigns a long string of characters that’s unique for each unique input of plaintext.

Because the conversion works in only one direction—from plaintext to hash—there is no cryptographic means for converting the hashes back into plaintext. More recently, these best practices have been mandated by laws and regulations in countries worldwide.

Because hashing algorithms works in one direction, the only way to obtain the corresponding plaintext is to guess, a process that can require large amounts of time and computational resources. The idea behind hashing passwords is similar to the idea of fire insurance for a home. In the event of an emergency—the hacking of a password database in one case, or a house fire in the other—the protection insulates the stakeholder from harm that otherwise would have been more dire.

For hashing schemes to work as intended, they must follow a host of requirements. One is that hashing algorithms must be designed in a way that they require large amounts of computing resources. That makes algorithms such as SHA1 and MD5 unsuitable, because they’re designed to quickly hash messages with minimal computing required. By contrast, algorithms specifically designed for hashing passwords—such as Bcrypt, PBKDF2, or SHA512crypt—are slow and consume large amounts of memory and processing.

Another requirement is that the algorithms must include cryptographic “salting,” in which a small amount of extra characters are added to the plaintext password before it’s hashed. Salting further increases the workload required to crack the hash. Cracking is the process of passing large numbers of guesses, often measured in the hundreds of millions, through the algorithm and comparing each hash against the hash found in the breached database.

The ultimate aim of hashing is to store passwords only in hashed format and never as plaintext. That prevents hackers and malicious insiders alike from being able to use the data without first having to expend large amounts of resources.

When Meta disclosed the lapse in 2019, it was clear the company had failed to adequately protect hundreds of millions of passwords.

“It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data,” Graham Doyle, deputy commissioner at Ireland’s Data Protection Commission, said. “It must be borne in mind, that the passwords, the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”

The commission has been investigating the incident since Meta disclosed it more than five years ago. The government body, the lead European Union regulator for most US Internet services, imposed a fine of $101 million (91 million euros) this week. To date, the EU has fined Meta more than $2.23 billion (2 billion euros) for violations of the General Data Protection Regulation (GDPR), which went into effect in 2018. That amount includes last year’s record $1.34 billion (1.2 billion euro) fine, which Meta is appealing. https://arstechnica.com/?p=2053118

Anyone who has been surfing the web for a while is probably used to clicking through a CAPTCHA grid of street images, identifying everyday objects to prove that they’re a human and not an automated bot. Now, though, new research claims that locally run bots using specially trained image-recognition models can match human-level performance in this style of CAPTCHA, achieving a 100 percent success rate despite being decidedly not human.

ETH Zurich PhD student Andreas Plesner and his colleagues’ new research, available as a pre-print paper, focuses on Google’s ReCAPTCHA v2, which challenges users to identify which street images in a grid contain items like bicycles, crosswalks, mountains, stairs, or traffic lights. Google began phasing that system out years ago in favor of an “invisible” reCAPTCHA v3 that analyzes user interactions rather than offering an explicit challenge.

Despite this, the older reCAPTCHA v2 is still used by millions of websites. And even sites that use the updated reCAPTCHA v3 will sometimes use reCAPTCHA v2 as a fallback when the updated system gives a user a low “human” confidence rating.

Saying YOLO to CAPTCHAs

To craft a bot that could beat reCAPTCHA v2, the researchers used a fine-tuned version of the open source YOLO (“You Only Look Once”) object-recognition model, which long-time readers may remember has also been used in video game cheat bots. The researchers say the YOLO model is “well known for its ability to detect objects in real-time” and “can be used on devices with limited computational power, allowing for large-scale attacks by malicious users.”

After training the model on 14,000 labeled traffic images, the researchers had a system that could identify the probability that any provided CAPTCHA grid image belonged to one of reCAPTCHA v2’s 13 candidate categories. The researchers also used a separate, pre-trained YOLO model for what they dubbed “type 2” challenges, where a CAPTCHA asks users to identify which portions of a single segmented image contain a certain type of object (this segmentation model only worked on nine of 13 object categories and simply asked for a new image when presented with the other four categories).

Beyond the image-recognition model, the researchers also had to take other steps to fool reCAPTCHA’s system. A VPN was used to avoid detection of repeated attempts from the same IP address, for instance, while a special mouse movement model was created to approximate human activity. Fake browser and cookie information from real web browsing sessions was also used to make the automated agent appear more human.

Depending on the type of object being identified, the YOLO model was able to accurately identify individual CAPTCHA images anywhere from 69 percent of the time (for motorcycles) to 100 percent of the time (for fire hydrants). That performance—combined with the other precautions—was strong enough to slip through the CAPTCHA net every time, sometimes after multiple individual challenges presented by the system. In fact, the bot was able to solve the average CAPTCHA in slightly fewer challenges than a human in similar trials (though the improvement over humans was not statistically significant).

The battle continues

While there have been previous academic studies attempting to use image-recognition models to solve reCAPTCHAs, they were only able to succeed between 68 to 71 percent of the time. The rise to a 100 percent success rate “shows that we are now officially in the age beyond captchas,” according to the new paper’s authors.

But this is not an entirely new problem in the world of CAPTCHAs. As far back as 2008, researchers were showing how bots could be trained to break through audio CAPTCHAs intended for visually impaired users. And by 2017, neural networks were being used to beat text-based CAPTCHAs that asked users to type in letters seen in garbled fonts.

Now that locally run AIs can easily best image-based CAPTCHAs, too, the battle of human identification will continue to shift toward more subtle methods of device fingerprinting. “We have a very large focus on helping our customers protect their users without showing visual challenges, which is why we launched reCAPTCHA v3 in 2018,” a Google Cloud spokesperson told New Scientist. “Today, the majority of reCAPTCHA’s protections across 7 [million] sites globally are now completely invisible. We are continuously enhancing reCAPTCHA.”

Still, as artificial intelligence systems become better and better at mimicking more and more tasks that were previously considered exclusively human, it may continue to get harder and harder to ensure that the user on the other end of that web browser is actually a person.

“In some sense, a good captcha marks the exact boundary between the most intelligent machine and the least intelligent human,” the paper’s authors write. “As machine learning models close in on human capabilities, finding good captchas has become more difficult.”

https://arstechnica.com/?p=2053063

New York City mayor Eric Adams was stopped on the street by the FBI after an event in November 2023. Agents had a warrant for his electronic devices, which they seized. At the time, Adams made clear that he had nothing to hide, saying in a statement, “As a former member of law enforcement, I expect all members of my staff to follow the law and fully cooperate with any sort of investigation—and I will continue to do exactly that.”

Thanks to this week’s federal indictment (PDF) of Adams—the first for a sitting NYC mayor, and one that alleges bribery from Turkish sources—we now have the same story from the government’s perspective. It sounds quite a bit different.

According to the feds, agents seized not one but two cell phones from Adams on November 6, 2023—but neither of these was Adams’ “personal” phone, which he was not carrying. It was the personal phone that Adams allegedly used “to communicate about the conduct described in this indictment.”

The next day, November 7, Adams turned in his personal cellphone “in response to a subpoena,” but the phone was locked with a passcode. Passcodes are not unusual—indeed, they are recommended for nearly all users—but in this case there was a hitch. Adams, who continued to pledge his full cooperation, told the FBI that he couldn’t remember the code.

This might sound suspicious, but Adams said that it was actually a result of his attempts to preserve the phone and its data for the FBI. Two days earlier, on November 5, Adams had gotten wind of the investigation into his finances after the FBI raided one of his associates. When he heard this, he changed his personal cell phone passcode, increasing its length from four digits to six.

According to Adams, this was done to “prevent members of his staff from inadvertently or intentionally deleting the contents of his phone” so that Adams could “preserve the contents of his phone due to the investigation.”

Unfortunately, Adams told the FBI, he couldn’t remember this new password he had set just two days before. And so the pristinely preserved personal phone was locked and without a key.

The government does not explicitly say what it thought of the truthfulness of this explanation, but the indictment against Adams includes the anecdote under the subheading, “ADAMS and His Co-Conspirators Attempt to Conceal Their Criminal Conduct.”

Deleting apps from the bathroom

It wasn’t just Adams who had some “issues” with digital devices. As part of its investigation, the FBI asked if one of his staffers would speak to them in a voluntary interview. The woman agreed, and she then “falsely denied the criminal conduct of herself and ADAMS,” says the indictment.

But the most interesting bit was her behavior. In the middle of the interview, the staffer left to use the bathroom “and, while there, deleted the encrypted messaging applications she had used to communicate with ADAMS, the Promoter, the Turkish Official, the Airline Manager, and others.”

Others in Adams’ orbit were a bit more careful. When an Adams employee met with the mayor to talk about Turkish issues, he and Adams “left their cellphones outside the room in which they met so that it would be ‘safe’ to talk.”

Another staffer who worked on booking subsidized Turkish travel once texted Adams, “To be o[n the] safe side Please Delete all messages you send me.” Adams replied, “Always do.”

This sort of care extended even to the creation of bogus PowerPoint presentations. At a 2023 fundraiser held in a Manhattan hotel, the FBI claims that a “promoter” putting together illegal foreign donations for Adams actually “provided a PowerPoint presentation billing the event as a dinner hosted by ‘International Sustainability Leaders’ with the subject ‘Sustainable Destinations’ and an attendance price of $5,000.” This was despite the fact that the event was listed on Adams’ private calendar as “Fundraiser for Eric Adams 2025.”

https://arstechnica.com/?p=2053030

Precious metal theft has become rampant for public, private and government organizations. Some precious metals are relatively common — like copper, aluminum and steel — while others are more exotic, like palladium and rhodium. But the bottom line is this: they all have prices, which makes them vulnerable to theft by criminals who seek to monetize stolen precious metals.

Most precious metals are fairly obvious — for example, it’s long been known that copper is a commonly stolen metal. It is also ubiquitous, so thieves may be so brazen as to steal copper wire from live electrical grids and cause widespread power outages. Catalytic converters from automobiles are another highly publicized source of precious metals. They contain platinum, palladium and rhodium, all of which can return a high price. There are also metals that people don’t think of as “precious” that can fetch a pretty price: aluminum components, stainless steel and just about any fabricated metal.

How do thieves monetize all this stolen metal? Mostly they trade it in for money at scrap yards and recycling centers that do not check the ID of the person selling them the metal. There is legislation to combat this practice, but criminals know which organizations don’t check IDs and they use them to monetize their ill-gotten precious metals. They also will cash in at multiple facilities to avoid detection.

Scrap yards and recycling centers tend to store precious metals until they achieve “critical mass” to process them. This means they tend to have large amounts of unrecycled metals on hand, which causes they themselves to become targets.

Trends fueling the crime spree

There are a number of trends that have caused the precious metals scourge. As mentioned earlier, the most common traditional reason is also valid today: the price metals can fetch on the open market. It stands to reason that criminals see more risk/reward from a stolen metal that commands a high price than those that don’t. 

Metals prices have soared since the pandemic and still are high when compared to historical norms. This has fueled the current crime spree, which includes stealing metal antennas from cell phone stations, aluminum and other components off construction sites, copper from electrical companies, and even the recent report of a thief stealing metal plaques from a New York City cemetery. 

The electrification of society is another trend that is causing an upswing in metals theft. The construction of facilities to expand the power grid to meet the demands of electrification has become a major source of copper and other metals for thieves. They are also attacking live grids and causing power outages by stealing the copper wire that normally delivers electricity to customers.

Another common target is catalytic converters. It only takes two minutes for someone to duck under a car and saw off the catalytic converter, which contains precious metals such as platinum, palladium and rhodium. The move to electrical vehicles (EVs) may seem like a cure for this, since they don’t use catalytic converters, but EVs have their own expensive components to attract thieves, including charging cables, which are rich in copper.

Add it all up, and precious metals theft causes billions of dollars in damage each year. There are not only the damages incurred by replacing the metal itself, but also the costs of service delays and installing a replacement part — and in the case of cell phone tower antennas, electrical grids, or EV charging stations, the replacement needs to be done as quickly as possible, which is expensive.

Protecting precious metals

Organizations need to realize that their precious metals are at risk and protect them as they would other critical equipment. This is easier said than done, because metals may be in areas that are difficult to secure, like construction or mobile worksites. Or they might be in fixed locations like scrapyards, auto dealerships or parking lots. And, in many cases, the metal is already deployed and in use, like in power grids or buildings.

In any case, the first step for an organization is to take inventory of where precious metals are. Once this is accomplished, organizations can determine which precious metal components would cause the most damage, delays and disruption if stolen. 

Once this has been determined, deploying active security can make it much more difficult for criminals to practice their trade. Traditional security cameras are only reactive and are not intended to stop crime. They are fine at providing evidence after the fact for insurance claims and police reports. But this is of little comfort to customers — all they know is they can’t access the cell tower, or get electricity over the grid, or charge their EV, etc. 

To avoid service disruptions, project delays and to reduce costs, active security is the preferred solution. This enables crime to be stopped before it happens. It traditionally has been achieved by hiring security guards — but they tend to be quite expensive, post-pandemic staffing problems are rampant and a guard can only be in one place at a time, so multiple guards have to be hired for large facilities.

An alternative solution is available by using remote video monitoring (RVM) services to provide active security. They use surveillance cameras as “sensors” that send the video feed back to a security operations center where, once a criminal is identified, virtual security guards can trigger local deterrents to scare criminals away. These deterrents are usually speakers issuing pre-recorded messages to get off the premises, along with strobe lights. Both let criminals know they have been detected and are being watched. This serves to actually stop crime before it happens, saving the would-be victim large costs from crime damage, as well as preserving revenue from outages and delays that would otherwise have occurred. These solutions are also available in mobile units that require no electricity or internet connectivity, so they can be used in temporary environments or other remote, hard-to-secure areas.

Precious metals are under criminal assault, and it is up to their owners to protect them. One of the reasons for the crime spree is that they are rarely protected by security, because it doesn’t occur to organizations that they often have precious metals making up their most important assets.

By taking the same steps they would with other valuable items, organizations can protect precious metals and avoid becoming a victim.

https://www.securitymagazine.com/articles/101058-precious-metals-in-the-crime-crosshairs-trends-and-protection

As the number of connected devices continues to grow, so does the vulnerability of networks to cyber-attacks. The rise of the Internet of Things (IoT) and the Industrial Internet of Things (IIoT) has exponentially expanded the attack surface for cybercriminals. Traditional perimeter-based security models are no longer sufficient in this environment, leading to the adoption of a more comprehensive security framework: zero trust.

What is zero trust?

At its core, zero trust operates on a simple principle: “Never trust, always verify.” Unlike traditional security models that assume trust within a network perimeter, zero trust requires continuous verification of every user, device and application attempting to access a network, regardless of whether inside or outside the organization’s perimeter. Zero trust ensures that no entity is granted blanket access to network resources; instead, access is granted on a need-to-know basis.

To illustrate, consider how airports handle security. After passing through initial security checks, passengers are often free to explore different terminals, shops and gates without further scrutiny. Traditional network security works similarly: users can roam around the network once access is granted. This model allows attackers to exploit vulnerabilities, escalate privileges and access sensitive data.

However, in a zero trust model, the airport scenario changes. Travelers can only access the specific terminal, gate or plane for which they have authorization, and their identity and credentials are re-evaluated every step of the way. This limited, context-aware access makes zero trust very effective at minimizing security risks.

Core components of zero trust

Zero trust security is built upon three foundational pillars:

1. Continuous authentication and authorization: Every attempt to access a network resource must be authenticated and authorized. User identity, location, device health and other contextual factors are continually evaluated.
2. Least privilege access: Users and devices are given the minimum level of access necessary to perform their functions. This minimizes the potential damage of compromised credentials or insider threats.
3. Micro-segmentation and network segmentation: Zero trust networks are designed to limit lateral movement by segmenting the network into small zones, each protected by its access controls. Even if attackers breach one segment, they cannot move freely across the network.

Extending zero trust to cloud and hybrid environments

As organizations shift toward cloud-first and hybrid cloud strategies, the need for zero trust becomes even more critical. In these environments, resources are often spread across multiple locations, and employees access data from various devices and locations. Zero trust helps secure these dynamic environments by controlling access to cloud resources, ensuring data privacy and securing API communications.

For example, Identity and Access Management (IAM) tools can enforce least privilege access in the cloud, while micro-segmentation can prevent unauthorized lateral movement within and across cloud environments. Organizations can better manage security across complex, multi-cloud infrastructures by implementing zero trust principles.

Leveraging AI and machine learning for zero trust

Organizations increasingly turn to artificial intelligence (AI) and machine learning (ML) to enhance zero trust capabilities. These technologies can analyze vast amounts of data in real-time to detect anomalies, identify potential threats and automate responses. For instance, AI-driven analytics can flag unusual behavior, such as an employee accessing sensitive data from an unfamiliar location, triggering additional verification or blocking access altogether.

AI and ML can also support continuous monitoring and automated policy enforcement, reducing the burden on IT teams and ensuring a more robust security posture.

Zero trust in the era of remote and hybrid work

The shift to remote and hybrid work has expanded the traditional network perimeter, increasing cyber-attack risk. Zero trust is crucial in this new landscape as it continuously validates remote workers’ identity, device posture, and location. Zero trust helps protect against phishing, ransomware and insider threats by requiring stronger, context-aware authentication for higher-risk access requests.

Adaptive authentication techniques, such as multi-factor authentication (MFA) or risk-based authentication, help balance security and user experience by only requiring additional verification when the context is unusual or risky.

Applying zero trust to operational technology (OT) networks

Zero trust is not limited to traditional IT environments; it is increasingly applied to Operational Technology (OT) networks in critical infrastructure sectors such as energy, water and transportation. Many OT networks are composed of legacy systems that are not designed with security in mind, making them particularly vulnerable to cyber-attacks.

Implementing zero trust principles, such as micro-segmentation and continuous monitoring, can help organizations ensure that only authorized communications occur between devices and control systems. This approach helps protect against cyber threats that could have physical consequences, such as disrupting power grids or transportation systems.

Zero trust and regulatory compliance

Zero trust also offers significant benefits in regulatory compliance. With increasing pressure to meet data protection regulations like GDPR or HIPAA, zero trust provides a structured approach to securing data and access controls. By continuously validating all entities accessing sensitive information, zero trust helps organizations demonstrate compliance and reduce the risk of costly data breaches.

The future of zero trust

As cyber threats continue to evolve and expand, zero trust represents a fundamental shift in how organizations think about security. It offers a more proactive approach to cybersecurity, ensuring every user, device, and application is continuously verified and validated. Zero trust is quickly becoming the gold standard in cybersecurity frameworks, whether applied to cloud environments, remote work, OT networks, or regulatory compliance.

Organizations that have yet to adopt zero trust should begin planning now. As more industries and governments embrace zero trust, those who lag will be at increased risk of cyber-attacks and regulatory penalties. The future of cybersecurity is clear: trust no one, verify everything.

https://www.securitymagazine.com/articles/101074-zero-trust-the-next-evolution-in-cybersecurity

Nell’era digitale, la sicurezza email è diventata una priorità imprescindibile per organizzazioni e individui. Questo articolo offre una guida all’Email Forensics utile ad analizzare e difendere le comunicazioni via email da minacce informatiche illustrando metodologie e strumenti all’avanguardia per individuare messaggi sospetti o dannosi.

Il testo si propone come risorsa fondamentale per chi desidera potenziare le proprie difese, fornendo best practice, indicatori chiave da monitorare e una panoramica degli strumenti più efficaci per l’analisi forense: dall’esame degli header alla verifica degli allegati, vengono trattati tutti gli aspetti critici per implementare una strategia di protezione completa.

In un contesto in cui le minacce veicolate via email diventano sempre più sofisticate, questa guida offre competenze essenziali per proteggere dati sensibili e infrastrutture IT. Per un’analisi più approfondita sull’intersezione tra sicurezza email e tecnologie emergenti, vi invitiamo a consultare il precedente articolo “Email Security e Intelligenza Artificiale“, che esplora le ultime innovazioni nel settore.

Email Forensics, come realizzare un’analisi approfondita

Quando si analizza un’email ci sono diversi fattori da tenere in considerazione:

• Verifica dell’header from, se quindi il sender è noto oppure sconosciuto facendo caso anche ad eventuali “errori” nel dominio e/o nel nome dell’indirizzo. Questo potrebbe essere un primo chiaro segnale di una mail potenzialmente malevola.
• Se il contenuto della mail cerca di far leva sulle nostre emozioni per ottenere delle informazioni
• Analisi degli URL: un primo sintomo di una mail malevola riguarda l’uso del protocollo “http” invece dell’uso di un protocollo più sicuro e protetto come “https”.
• Analisi degli allegati, utili per infettare una macchina e/o eseguire un malware, ad esempio, aprendo un file word/excel se come prima azione viene richiesto di “attivare le macro”. L’attivazione di macro di un file office è uno dei modelli d’attacco più utilizzati da molteplici malware, tra cui Emotet e da altri ransomware, per infettare le macchine destinatarie. Quest’operazione quindi in moltissimi casi è sintomo che l’allegato possa essere malevolo. Si invita quindi a non aprire e/o eseguire allegati provenienti da mittenti sconosciuti e in cui si chieda di “abilitare” le macro. Altri file da cui si consiglia di porre maggior attenzione sono gli eseguibili “.exe” e i file con estensione “.bat”.

Un’analisi più approfondita può essere effettuata tramite analizzando l’header. Quest’analisi consentirà di individuare molteplici IoC (Indicator of compromise) che aiuteranno a comprendere se effettivamente la mail risulta essere malevola. Tra le informazioni più rilevanti estraibili dall’header di un email ci sono:

• “Connections” come sender IP da cui è partita la mail e relativi hostname/relay attraversati;
• Envelope information (Sender e Recipient);
• Header From, to, subject e data;
• Return-Path;
• SPF, DKIM e DMARC e relative configurazioni;
• Message-ID, univoco per ogni mail;
• MIME- Version;
• X-Spam Status;

Per estrarre l’header di una mail è sufficiente seguire i seguenti passi:

• Aprire la mail tramite Outlook, Thunderbird o altro software simile
• File -> Info -> Properties -> Internet headers

Nota. Per effettuare una corretta analisi dell’header è fondamentale che la mail NON sia stata “forwadata” ma che la segnalazione ricevuta sia invece allegata nella mail. Ciò consentirà di non perdere tutte le informazioni relative alle connessioni e comunicazioni avvenute tra il sender sospetto e il recipient.

Una volta selezionato il contenuto “dell’internet headers” sarà possibile procedere all’analisi di tutti i vari campi di interesse sin qui elencati. Tra i tool a supporto per analizzare un header si segnalano:

• MxToolbox: https://mxtoolbox.com/EmailHeaders.aspx
• Google Admin Toolbox: https://toolbox.googleapps.com/apps/messageheader/
• Analyze mail header: https://mailheader.org

MxToolbox fornisce una vasta gamma di informazioni relative a:

• Blacklist di un IP e/o dominio
• “Delivery information”: SPF, DKIM e DMARC
• “Relay information” con tutte le informazioni di interesse relative al flusso della mail (dal sender al recipient finale). Tramite quest’area sarà infatti possibile osservare se la mail ha attraversato qualche relay e/o hostname malevolo.

Cliccando sul tasto blacklist e poi successivamente su “Detail” l’analista potrà osservare in quali di queste l’IP è stato inserito e perché quell’IP è stato classificato come malevolo da quella specifica blacklist:

Non è sempre detto che se una mail proviene da un IP in blacklist sia necessariamente malevola; tuttavia, questo potrebbe essere un primo segnale di allarme per un analista.

Per effettuare ulteriori analisi degli IP estratti dall’header è possibile utilizzare diversi tool tra cui:

• Talos: effettua analisi di IP fornendo informazioni come: ‘country, domain reputation ecc e blacklist.
• AbuseDB: che fornisce informazioni anche sul “behavior monitoring” nel web.
• DMarcian & Wise: che consentono l’analisi dei record SPF, DKIM e DMARC

In merito all’analisi degli URL si segnalano invece i seguenti tool:

Mentre per l’analisi degli allegati/URL si segnalano diverse sandbox tra cui:

Infine, tra i tool più noti a tutti gli analisti si segnala anche Virustotal (https://www.virustotal.com/gui/home/upload):

le cui capacità spaziano dall’analisi di IP, URL, Hash all’analisi di file. Virustotal possiede una collezione di antivirus a cui sottoporre l’evidenza e come risultato produce un report con i risultati dell’analisi. Qualora presenti, fornirà anche informazioni relative ad eventuali “whois” degli IP sottoposti e riferimenti a potenziali attività malevole correlate. Possiede, infine, anche una sezione relativa alla community in cui ogni analista potrà fornire il proprio contributo in merito all’evidenza sottoposta. Si veda figura 16 per tutti i dettagli.

Note. Si tenga presenta che Virustotal non è in grado di individuare minacce sconosciute e/o zeroday.

Di seguito, infine, in figura 17 è possibile osservare ulteriori tool per le analisi:

Si fa presente, comunque, che ogni analisi va suffragata e approfondita, non è sempre detto che un file/IP/dominio ritenuto “pulito” lo sia effettivamente, anzi. Si invitano quindi tutti i lettori a non dare per assolute tutte le evidenze che i tool online forniranno ma di usare sempre un pensiero critico e di incrociare più fonti per avere maggiore contezza dell’analisi. È opportuno quindi porsi sempre domande, soprattutto se ci sono dei sospetti di attività malevole dai “raw logs” e i tool non ne segnalano.

“Se qualcosa può andar male, lo farà” [Legge di Murphy]

Di seguito verranno mostrati alcuni scenari di mail malevole che potrebbero essere utilizzati dagli aggressori con potenziali subject:

• Tipologia: Malware veicolato tramite email:
  • Potenziali subject malevoli:
    • “Fattura allegata”
    • “Il protocollo del certificato medico”
    • “Domanda per la nuova indennità COVID-19”
  • Descrizione: email proveniente da un fornitore o un servizio noto contente un allegato che dichiara essere una fattura e/o un certificato medico. L’allegato contiene un file dannoso che, se aperto, può infettare il sistema con un malware e/o ransomware.

Esempio:

• Tipologia: Phishing/Spoofing/BEC:
  • Potenziali subject malevoli:
    • “Importante: Aggiornamento della Password Richiesto”
    • “Cambio di Conto Bancario per i Pagamenti”
    • “Urgente: Problemi con il tuo account bancario”
    • “Il tuo account è stato compromesso”
  • Descrizione: email proveniente da un servizio noto contenente un messaggio che avvisa l’utente di un presunto accesso non autorizzato oppure di una password scaduta. Si chiede quindi all’utente di cliccare su un link per aggiornare la password e/o inserire informazioni sensibili (informazioni bancarie e simili). Il link porterà a un sito di phishing dove verranno catturare le informazioni inserite.

Esempio:

Alcune mitigazioni e analisi possibili:

• Segnalazione della mail al team di competenza.
• Tramite email secure gateway, verificare se è in corso una campagna malevola oppure se fa riferimento a pochi casi isolati. Per fare ciò bisognerà incrociare informazioni legate al sender email/IP/domain e subject ad esempio.
• Blocco del sender e di eventuali IP/domini malevoli.
• Attivare il rewriting URL così da bloccare eventuali accessi a link malevoli.
• Far uso di sandbox per analizzare gli allegati.
• Analisi dell’header e delle connessioni per verificare la reale provenienza della mail.

Questo articolo è stato estratto dal white paper “Email Security: Intelligenza Artificiale, Protocolli e Best Practice Contro gli Attacchi Informatici” disponibile in maniera libera e gratuita al seguente link: https://www.ictsecuritymagazine.com/pubblicazioni/email-security-intelligenza-artificiale-protocolli-e-best-practice-contro-gli-attacchi-informatici/

Articolo a cura di Fabrizio Giorgione

https://www.ictsecuritymagazine.com/articoli/email-forensics-sicurezzamail/

Set 27, 2024 Marina Londei In evidenza, News, RSS, Vulnerabilità 0

---

I ricercatori di Wiz hanno scoperto una vulnerabilità critica in NVIDIA Container Toolkit, un insieme di strumenti che consentono di creare applicazioni di IA in container con accesso alle risorse GPU. Il bug permette a un attaccante che controlla l’immagine del container eseguita dal toolkit di uscire dal contesto del container e prendere il controllo del sistema host.

Il toolkit proposto da NVIDIA consente di condividere una singola GPU tra diversi carichi di lavoro e potenzialmente tra diversi utenti. I driver e gli strumenti contenuti nel toolkit consentono di abilitare l’uso nativo della GPU anche all’interno degli ambienti containerizzati; negli ultimi anni, questo insieme di strumenti è diventato molto usato pe le applicazioni di intelligenza artificiale.

Come riporta NVIDIA nel suo advisory di sicurezza, la vulnerabilità, tracciata come CVE-2024-0132, è un bug di Time-of-check Time-of-use, un tipo di race condition sul controllo dello stato di una risorsa. “Un exploit riuscito della vulnerabilità può portare all’esecuzione di codice, all’interruzione di servizio, all’escalation dei privilegi, alla pubblicazione di informazioni e alla modifica di dati” spiega la compagnia.

Per sfruttare l’exploit, un attaccante deve creare un’immagine malevola specifica per sfruttare la vulnerabilità. Dopo aver eseguito l’immagine sulla piattaforma target, l’attaccante ottiene i pieni permessi di lettura sull’host e di conseguenza la completa visibilità dell’infrastruttura sottostante.

Dopo aver ottenuto questo accesso, l’attaccante può prendere il controllo delle socket Container Runtime Unix ed eseguire comandi sull’host con privilegi di root, di fatto prendendo il controllo della macchina.

L’impatto della vulnerabilità NVIDIA

La vulnerabilità mette a rischio chiunque utilizzi NVIDIA Container Toolkit, ma i più a rischio sono gli ambienti che consentono l’esecuzione di immagini o modelli di IA di terze parti, sia internamente che in modalità as-a-service.

I ricercatori di Wiz spiegano che, nel caso di un exploit in un ambiente orchestrato e condiviso come Kubernetes, un attaccante che ha i permessi di eseguire un container potrebbe ottenere dati e segreti di altre applicazioni che sono in esecuzione sullo stesso nodo o nello stesso ambiente.

Questo scenario diventa ancora più pericoloso nel caso in cui i provider di servizi IA consentono ai propri clienti di eseguire le loro immagini: un attacco di successo permetterebbe ai cybercriminali di usare i segreti della macchina host per prendere il controllo dell’intero sistema di servizi cloud.

Secondo le stime dei ricercatori, il 33% degli ambienti cloud è esposto alla vulnerabilità. “La ricerca evidenzia, non per la prima volta, che i container non sono una barriera di sicurezza forte e non si dovrebbe fare affidamento su di essi come unico mezzo di isolamento. Quando progettiamo applicazioni, soprattutto quelle multi-tenant, dovremmo sempre “presumere una vulnerabilità” e progettarle in modo da avere almeno una forte barriera di isolamento, come la virtualizzazione” sottolinea il team di Wiz.

Il bug colpisce tutte le versioni di NVIDIA Container Toolkit fino alla 1.16.1 (compresa). I ricercatori consigliano alle aziende che usano il toolkit di aggiornarlo il prima possibile alla versione 1.16.2.

---

---

---

https://www.securityinfo.it/2024/09/27/una-vulnerabilita-critica-di-nvidia-permette-di-prendere-il-controllo-di-interi-ambienti-cloud/?utm_source=rss&utm_medium=rss&utm_campaign=una-vulnerabilita-critica-di-nvidia-permette-di-prendere-il-controllo-di-interi-ambienti-cloud

In today’s fast-paced and unpredictable world, organizations must be prepared to manage crises that can arise unexpectedly. Whether facing a natural disaster, product failure or fraud, a leader’s ability to respond effectively in high-stakes situations can determine the organization’s future. Crisis management, guided by the investigative standards of P.L.A.N. (Preparation, Learning, Analysis, and Notification) as outlined in Security Investigations: A Professional’s Guide by Larry Nicholson, Ph.D., and Alan Saquella, CPP, CPE, is crucial. Additionally, implementing a robust business continuity plan, a standard by the NFPA 1600 from the National Fire Protection Association, is essential. When these strategies are executed correctly, they protect the organization from long-term damage and ensure resilience.

The value of relationships with leaders and decision-makers

Crisis management is not a solo endeavor; it requires the coordinated effort of various stakeholders, including leaders and decision-makers who have the authority to steer the organization through turbulent times. The value of strong relationships with these individuals cannot be overstated. Establishing and maintaining these relationships is part of the “Preparation” phase of the P.L.A.N. approach.

Having established relationships with key leaders ensures open communication lines and mutual trust. In a crisis, decisions need to be made swiftly and accurately. If there is a pre-existing rapport, there is less room for misunderstandings or hesitations that could delay critical decisions. Leaders who trust their crisis management team are more likely to support and act on recommendations without unnecessary delays, allowing for a more efficient response.

Moreover, relationships built on trust enable candid conversations. During a crisis, it’s essential to be honest about the severity of the situation, potential risks, and the best course of action. Decision-makers who feel they can trust their crisis management team will be more receptive to hearing bad news and taking the necessary steps to mitigate further damage.

The role of emotional intelligence

Emotional intelligence (EQ) plays a significant role in effective crisis management. EQ is the ability to understand and manage your emotions, as well as the emotions of others. During a crisis, emotions can run high — fear, anger, and anxiety are common. Leaders with high EQ can navigate these emotional waters with empathy and understanding, which is crucial for maintaining morale and ensuring that the team remains focused on resolving the issue at hand.

One aspect of EQ that is particularly valuable in crisis management is empathy. Empathy allows leaders to understand the perspectives of all stakeholders, from employees to customers, and even the media. By acknowledging and addressing the concerns and emotions of others, leaders can foster a sense of solidarity and cooperation. This aligns with the “Learning” phase of P.L.A.N., where understanding and interpreting the emotional and psychological states of those involved can inform better decision-making.

In addition to empathy, self-regulation is another critical component of EQ. Crisis situations often require leaders to remain calm and composed, even when under immense pressure. Leaders who can regulate their emotions are less likely to make rash decisions or escalate tensions. Instead, they can think clearly and strategically, setting a tone of calm that can permeate throughout the organization.

The importance of a calm demeanor

A calm demeanor is essential in crisis management because it sets the tone for the entire response. When a leader remains calm, it reassures others that the situation is under control, even if the full scope of the crisis is not yet understood. This calmness can prevent panic, which is crucial for maintaining order and ensuring that everyone can perform their duties effectively.

A calm demeanor also aids in clear communication. In a crisis, information must be conveyed quickly and accurately. If a leader is agitated or flustered, it can lead to miscommunication or mixed messages, which can exacerbate the crisis. On the other hand, a calm leader can deliver information in a clear and concise manner, ensuring that everyone is on the same page and that the response is coordinated.

Furthermore, a calm leader is better equipped to handle the unexpected. Crises are, by nature, unpredictable, and they often require leaders to make decisions on the fly. A leader who can remain calm under pressure is more likely to make sound decisions that are based on logic and reason, rather than on emotion or panic.

The value of business continuity planning

While it’s impossible to predict every crisis, thorough planning can significantly improve an organization’s ability to respond effectively. This is where Business Continuity Planning (BCP) plays a crucial role, intertwined with the “Preparation” and “Analysis” phases of P.L.A.N.

The first step in BCP is to conduct a risk assessment to identify potential threats to the organization. This could include anything from cybersecurity breaches to natural disasters. Once potential risks are identified, the next step is to develop response plans for each scenario. These plans should outline the steps to be taken, the individuals responsible for each task, and the resources required.

Another critical component of planning is communication. In a crisis, communication must be swift, accurate, and consistent. Planning should include the development of communication protocols that specify who will communicate with internal and external stakeholders, what information will be shared, and how it will be disseminated.

Regular drills and simulations are also an essential part of planning. These exercises allow the crisis management team to practice their response and identify any weaknesses in the plan. By regularly reviewing and updating the crisis management and business continuity plans, organizations can ensure that they are prepared to respond effectively to any situation that arises.

The investigative process: Applying P.L.A.N.

Once a crisis emerges, the investigative process becomes a cornerstone of crisis management. The goal of this process is to gather facts, understand the root cause of the crisis, and inform the decisions that will guide the response. This aligns with the “Learning” and “Analysis” phases of P.L.A.N.

The investigative process begins with fact-finding. This involves gathering all available information about the crisis, including what happened, when it happened, who was involved, and the impact on the organization. This information is critical for understanding the scope of the crisis and determining the appropriate response.

Once the facts are gathered, the next step is to analyze them to identify the root cause of the crisis. Understanding the root cause is essential for preventing future crises and for communicating with stakeholders about what went wrong and how the organization is addressing the issue.

Throughout the investigative process, it’s important to maintain transparency through informing key stakeholders and producing written reports. This is part of the “Notification” phase of P.L.A.N. Stakeholders, including employees, customers, and the public, want to know that the organization is taking the crisis seriously and is committed to addressing the issue. By being transparent about the investigative process and the steps being taken to resolve the crisis, organizations can maintain trust and credibility.

The interplay of planning, relationships and emotional intelligence

Effective crisis management requires a combination of careful planning, strong relationships with leaders and decision-makers, emotional intelligence, and a calm demeanor. These elements work together to create a framework that allows organizations to respond swiftly and effectively to crises, minimizing damage and protecting their reputation. By incorporating the P.L.A.N. investigative standards into this framework, organizations can ensure that their crisis response is both structured and adaptable, allowing for real-time learning and adjustment as the situation evolves.

The investigative process is a critical component of this framework, providing the information needed to make informed decisions and communicate transparently with stakeholders. By investing in these areas before a crisis occurs, organizations can position themselves to navigate any challenge that comes their way with confidence and resilience.

In the end, the true test of crisis management is not just how an organization responds to a crisis, but how it emerges from it. Organizations that prioritize Business Continuity Planning, relationships, emotional intelligence, and the P.L.A.N. standards are better equipped to not only survive a crisis but to learn and come out stronger on the other side.

https://www.securitymagazine.com/articles/101053-proper-crisis-management-is-a-cornerstone-of-business-continuity