Research from Proofpoint shows the growth of a new malware campaign called “Voldemort.” The research asserts that the campaign began on August 5, 2024, and has since impacted more than 70 organizations worldwide with more than 20,000 emails.

More than half of the intended targets are a part of the insurance, transportation, aerospace and education sectors. While the threat actor behind Voldemort is currently unknown, the research claims cyber espionage is the goal of this campaign. 

Security leaders weigh in 

Jason Soroko, Senior Fellow at Sectigo:

“The threat is unusual due to its use of uncommon command and control (C2) methods like Google Sheets, and its combination of various tactics, techniques and procedures (TTPs). Voldemort’s use of Google Sheets for C2 poses risks because it blends malicious activity within legitimate services, making detection more challenging. Organizations can mitigate this by monitoring outbound traffic for unusual patterns, implementing strict application access controls, and using threat intelligence to detect abnormal use of legitimate platforms for C2 purposes.

“Companies can protect against personalized phishing attacks by enhancing email filtering systems, training employees to recognize and report suspicious emails, employing strong multi-factor authentication (MFA), and regularly updating and auditing the visibility of their publicly available information to reduce exposure.

“Organizations can verify the authenticity of communications from government agencies by using direct communication channels, such as official government websites or contacts, to confirm legitimacy. Implementing email authentication protocols like DMARC, SPF and DKIM can also help prevent impersonation-based attacks, as well as S/MIME certificates for ensuring the legitimacy of email sender identities within an organization.”

Mr. Mayuresh Dani, Manager, Security Research, at Qualys Threat Research Unit:

“This attack utilizes Google Sheets for command and control (C2) communications and the use of files laced with malicious Windows search protocol to lure the victim to download the malware. The malware then uses a legitimate version of WebEx software to load a DLL that communicates with the C2 server.

“Organizations should take reactive and proactive means of protecting employee data. They should use spam filters — with strict settings for certain users at risk. AI and LLMs’ spam and language filters should be employed for first time email senders from unknown/untrusted domain names. They should also enforce user education that will help weed out any spurious emails that are eventually delivered. As a reactive means, they should monitor leaks sources for key resources in the company and have them scrubbed.”

Omri Weinberg, Co-founder and CRO at DoControl: 

“The Voldemort campaign stands out due to its unique combination of sophisticated and unconventional techniques. Using Google Sheets for command and control is quite innovative. The attack chain also abuses the Windows saved search file format in an unusual way we haven’t seen before. At the same time, the high volume of messages and tax authority lures are more typical of cybercrime campaigns. This blend of APT and cybercrime characteristics makes it an intriguing threat.

“Using Google Sheets for C2 poses serious detection challenges. It’s a legitimate service that many organizations use, so it’s difficult to block outright. The encrypted HTTPS traffic also makes inspection tricky. To detect this, companies need robust network monitoring that can identify suspicious access patterns to Google services. 

“Defending against APTs like Voldemort requires a multi-layered approach, with Exposed Data Intelligence as a foundational element. First, organizations need comprehensive visibility across their environment — you can’t protect what you can’t see or don’t know is exposed. This includes monitoring SaaS applications and understanding what sensitive data might already be out in the wild.

“Exposed data intelligence is crucial here. It supplies you with information about what data from your organization is already exposed, allowing you to better anticipate potential attack vectors and strengthen your defenses accordingly. This might involve additional monitoring of known exposed accounts or extra protection for systems handling sensitive data that attackers might target based on the exposed intelligence.

“Beyond that, companies should implement robust endpoint detection and response (EDR) tools, network segmentation, and data loss prevention (DLP) solutions. Regular threat hunting exercises, informed by your Exposed Data Intelligence, can help identify any attackers that slip through initial defenses.

“Ensuring all systems are patched and properly configured is fundamental. But don’t forget — your security posture should be continuously adjusted based on the insights from your Exposed Data Intelligence. This dynamic approach, powered by up-to-date knowledge of your exposed data, is key to staying ahead of sophisticated APTs that leverage this information for their attacks.”

https://www.securitymagazine.com/articles/101011-a-new-malware-named-voldemort-may-be-a-cyber-espionage-campaign

Federal prosecutors on Thursday unsealed an indictment charging six Russian nationals with conspiracy to hack into the computer networks of the Ukrainian government and its allies and steal or destroy sensitive data on behalf of the Kremlin.

The indictment, filed in US District Court for the District of Maryland, said that five of the men were officers in Unit 29155 of the Russian Main Intelligence Directorate (GRU), a military intelligence agency of the General Staff of the Armed Forces. Along with a sixth defendant, prosecutors alleged, they engaged in a conspiracy to hack, exfiltrate data, leak information, and destroy computer systems associated with the Ukrainian government in advance of the Russian invasion of Ukraine in February 2022.

Targeting critical infrastructure with WhisperGate

The indictment, which supersedes one filed earlier, comes 32 months after Microsoft documented its discovery of a destructive piece of malware, dubbed WhisperGate, had infected dozens of Ukrainian government, nonprofit, and IT organizations. WhisperGate masqueraded as ransomware, but in actuality was malware that permanently destroyed computers and the data stored on them by wiping the master boot record—a part of the hard drive needed to start the operating system during bootup.

In April 2022, three months after publishing the report, Microsoft published a new one that said WhisperGate was part of a much broader campaign that aimed to coordinate destructive cyberattacks against critical infrastructure and other targets in Ukraine with kinetic military operations waged by Russian forces. Thursday’s indictment incorporated much of the factual findings reported by Microsoft.

“The GRU’s WhisperGate campaign, including targeting Ukrainian critical infrastructure and government systems of no military value, is emblematic of Russia’s abhorrent disregard for innocent civilians as it wages its unjust invasion,” Assistant Attorney General Matthew G. Olsen of the National Security Division said in a statement. “Today’s indictment underscores that the Justice Department will use every available tool to disrupt this kind of malicious cyber activity and hold perpetrators accountable for indiscriminate and destructive targeting of the United States and our allies.”

Later in the campaign, the Russian operatives targeted computer systems in countries around the world that were providing support to Ukraine, including the United States and 25 other NATO countries.

The six defendants are:

• Yuriy Denisov, a colonel in the Russian military and commanding officer of Cyber Operations for Unit 29155
• Vladislav Borokov, a lieutenant in Unit 29155 who works in cyber operations
• Denis Denisenko, a lieutenant in Unit 29155 who works in cyber operations
• Dmitriy Goloshubov, a lieutenant in Unit 29155 who works in cyber operations
• Nikolay Korchagin, a lieutenant in Unit 29155 who works in cyber operations
• Amin Stigal, an alleged civilian co-conspirator, who was indicted in June for his role in WhisperGate activities

Federal prosecutors said the conspiracy started no later than December 2020 and remained ongoing. The defendants and additional unindicted co-conspirators, the indictment alleged, scanned computers of potential targets around the world, including in the US, in search of vulnerabilities and exploited them to gain unauthorized access to many of the systems. The defendants allegedly would then infect the networks with wiper malware and, in some cases, exfiltrate the stored data.

Thursday’s charges came a day after Justice Department officials announced the indictments of two Russian media executives accused of funneling millions of dollars from the Kremlin to a company responsible for creating and publishing propaganda videos in the US that racked up millions of views on social media. Federal prosecutors said the objective was to covertly influence public opinion and deepen social divisions, including over Russia’s war in Ukraine.

Also on Wednesday, federal officials took other legal actions to counter what they said were other Russian psychological operations. The actions included seizing 32 Internet domains they said were being used to spread anti-Ukraine propaganda, sanctioning Russian individuals and entities accused of spreading Russian propaganda and indicting two individuals accused of conspiring to aid a Russian broadcaster violating US sanctions.

Unit 29155 is a covert part of the GRU that carries out coup attempts, sabotage, and assassinations outside Russia. According to WIRED, Unit 29155 recently acquired its own active team of cyberwarfare operators in a move that signals the fusing of physical and digital tactics by Russia more tightly than in the past. WIRED said that the unit is distinct from others within the GRU that employ more recognized Russian-state hacking groups such as Fancy Bear or APT28, and Sandworm.

The Justice Department announced a $10 million reward in exchange for any of the suspects’ locations or cyber activity. The wanted poster and Thursday’s indictment displayed photos of all six defendants. The move is intended to limit the travel options for the men and discourage other Russians from following their example.

https://arstechnica.com/?p=2047689

It’s no secret that government IT can be a huge bummer. The records retention! The security! So government workers occasionally take IT into their own hands with creative but, err, unauthorized solutions.

For instance, a former US Ambassador to Kenya in 2015 got in trouble after working out of an embassy compound bathroom—the only place where he could use his personal computer (!) to access an unsecured network (!!) that let him log in to Gmail (!!!), where he did much of his official business—rules and security policies be damned.

Still, the ambassador had nothing on senior enlisted crew members of the littoral combat ship USS Manchester, who didn’t like the Navy’s restriction of onboard Internet access. In 2023, they decided that the best way to deal with the problem was to secretly bolt a Starlink terminal to the “O-5 level weatherdeck” of a US warship.

They called the resulting Wi-Fi network “STINKY”—and when officers on the ship heard rumors and began asking questions, the leader of the scheme brazenly lied about it. Then, when exposed, she went so far as to make up fake Starlink usage reports suggesting that the system had only been accessed while in port, where cybersecurity and espionage concerns were lower.

Rather unsurprisingly, the story ends badly, with a full-on Navy investigation and court-martial. Still, for half a year, life aboard the Manchester must have been one hell of a ride.

<a href="https://cdn.arstechnica.net/wp-content/uploads/2024/09/starlink-manchester.jpg" class="enlarge" data-height="1000" data-width="1580" alt="A photo included in the official Navy investigation report, showing the location of the hidden Starlink terminal on the USS Manchester.”><img alt="A photo included in the official Navy investigation report, showing the location of the hidden Starlink terminal on the USS Manchester.” src=”https://rassegna.lbit-solution.it/wp-content/uploads/2024/09/after-seeing-wi-fi-network-named-stinky-navy-found-hidden-starlink-dish-on-us-warship-1.jpg” width=”640″ height=”405″ srcset=”https://rassegna.lbit-solution.it/wp-content/uploads/2024/09/after-seeing-wi-fi-network-named-stinky-navy-found-hidden-starlink-dish-on-us-warship-3.jpg 2x”>

One stinky solution

The Navy Times has all the new and gory details, and you should read their account, because they went to the trouble of using the Freedom of Information Act (FOIA) to uncover the background of this strange story. But the basics are simple enough: People are used to Internet access. They want it, even (perhaps especially!) when at sea on sensitive naval missions to Asia, where concern over Chinese surveillance and hacking runs hot.

So, in early 2023, while in the US preparing for a deployment, Command Senior Chief Grisel Marrero—the enlisted shipboard leader—led a scheme to buy a Starlink for $2,800 and to install it inconspicuously on the ship’s deck. The system was only for use by chiefs—not by officers or by most enlisted personnel—and a Navy investigation later revealed that at least 15 chiefs were in on the plan.

The Navy Times describes how Starlink was installed:

The Starlink dish was installed on the Manchester’s O-5 level weatherdeck during a “blanket” aloft period, which requires a sailor to hang high above or over the side of the ship.

During a “blanket” aloft, duties are not documented in the deck logs or the officer of the deck logs, according to the investigation.

It’s unclear who harnessed up and actually installed the system for Marrero due to redactions in the publicly released copy of the probe, but records show Marrero powered up the system the night before the ship got underway to the West Pacific waters of U.S. 7th Fleet.

This was all extremely risky, and the chiefs don’t appear to have taken amazing security precautions once everything was installed. For one thing, they called the network “STINKY.” For another, they were soon adding more gear around the ship, which was bound to raise further questions. The chiefs found that the Wi-Fi signal coming off the Starlink satellite transceiver couldn’t cover the entire ship, so during a stop in Pearl Harbor, they bought “signal repeaters and cable” to extend coverage.

Sailors on the ship then began finding the STINKY network and asking questions about it. Some of these questions came to Marrero directly, but she denied knowing anything about the network… and then privately changed its Wi-Fi name to “another moniker that looked like a wireless printer—even though no such general-use wireless printers were present on the ship, the investigation found.”

Marrero even went so far as to remove questions about the network from the commanding officer’s “suggestion box” aboard ship to avoid detection.

Finding the stench

Ship officers heard the scuttlebutt about STINKY, of course, and they began asking questions and doing inspections, but they never found the concealed device. On August 18, though, a civilian worker from the Naval Information Warfare Center was installing an authorized SpaceX “Starshield” device and came across the unauthorized SpaceX device hidden on the weatherdeck.

Marrero’s attempt to create fake data showing that the system had only been used in port then failed spectacularly due to the “poorly doctored” statements she submitted. At that point, the game was up, and Navy investigators looked into the whole situation.

All of the chiefs who used, paid for, or even knew about the system without disclosing it were given “administrative nonjudicial punishment at commodore’s mast,” said Navy Times.

Marrero herself was relieved of her post last year, and she pled guilty during a court-martial this spring.

So there you go, kids: two object lessons in poor decision-making. Whether working from an embassy bathroom or the deck of a littoral combat ship, if you’re a government employee, think twice before giving in to the sweet temptation of unsecured, unauthorized wireless Internet access.

Update, Sept. 5, 3:30pm: A reader has claimed that the default Starlink SSID is actually… “STINKY.” This seemed almost impossible to believe, but Elon Musk in fact tweeted about it in 2022, Redditors have reported it in the wild, and back in 2022 (thanks, Wayback Machine), the official Starlink FAQ said that the device’s “network name will appear as ‘STARLINK’ or ‘STINKY’ in device WiFi settings.” (A check of the current Starlink FAQ, however, shows that the default network name now is merely “STARLINK.”)

In other words, not only was this asinine conspiracy a terrible OPSEC idea, but the ringleaders didn’t even change the default Wi-Fi name until they started getting questions about it. Yikes.

https://arstechnica.com/?p=2047581

Set 05, 2024 Marina Londei Approfondimenti, Attacchi, Attacchi, Minacce, Minacce, News, RSS 0

---

Cresce il numero di minacce informatiche contro il settore dell’istruzione: secondo l’ultimo rapporto di Check Point Research, quest’anno il numero di attacchi contro il comparto è aumentato del 37% rispetto al 2023.

La media mondiale di attacchi settimanali per organizzazione si attesta sui 3.086; in Italia la media sale a 4.730, il 53,2% in più rispetto a quella globale. La regione più bersagliata al mondo è l’APAC, con 6.002 attacchi settimanali per organizzazione, e l’India è il Paese più colpito a causa della rapida adozione dell’apprendimento a distanza e dalla digitalizzazione dell’istruzione. Anche la Germania e il Portogallo hanno registrato aumenti degni di nota, entrambe con un +66% di attacchi informatici rispetto al 2023.

In generale, la proliferazione di piattaforme di apprendimento online rivolte non solo ai giovani ma anche a bambini in età prescolare e professionisti in pensione ha aumentato il rischio di minacce. Nella maggior parte dei casi, inoltre, le scuole e le università non danno priorità alla sicurezza informatica e si ritrovano con reti vulnerabili.

Poiché ci sono diversi gruppi coinvolti nelle reti educative, tra cui studenti, insegnanti e genitori, la superficie di attacco si amplia ulteriormente ed espone numerosi punti deboli per accessi non autorizzati e diffusione di malware.

I cybercriminali sono attratti dagli istituti scolastici perché contengono un enorme numero di dati personali: oltre a quelli dei dipendenti amministrativi e degli insegnanti, ci sono quelli degli studenti e dei loro genitori. Poiché inoltre gli studenti non sono dipendenti vincolati a linee guida aziendali sull’accesso alle reti, portando con sé i propri dispositivi nelle scuole e nei campus e collegandosi al Wi-Fi pubblico si espongono a rischi di sicurezza molto elevati.

In vista dell’inizio del nuovo anno scolastico, Check Point ha individuato la creazione di 12.234 nuovi domini relativi al mondo dell’istruzione, un incremento del 9% rispetto all’anno precedente; tra questi, 1 dominio su 45 si è rivelato dannoso o sospetto.

A luglio 2024 la compagnia ha individuato anche diverse campagne di phishing negli Stati Uniti che usano nomi di file legati ad attività scolastiche per attirare le vittime, come note di debito o documenti per richiedere benefici finanziari.

“Con il settore dell’istruzione che ha registrato un volume di attacchi senza precedenti quest’anno, è evidente che scuole, college e università sono in prima linea nell’agenda dei criminali informatici“ ha affermato Cristiano Voschion, Country Manager di Check Point. “Questa impennata illustra la necessità critica di misure di cybersecurity robuste e di una maggiore consapevolezza all’interno degli istituti scolastici per salvaguardare i dati sensibili e mantenere l’integrità operativa“.

---

---

---

https://www.securityinfo.it/2024/09/05/il-settore-dell-istruzione-e-tra-i-principali-bersagli-degli-attacchi-informatici/?utm_source=rss&utm_medium=rss&utm_campaign=il-settore-dell-istruzione-e-tra-i-principali-bersagli-degli-attacchi-informatici

The Federal Trade Commission (FTC) will require security camera firm Verkada to develop and implement a comprehensive information security program to settle allegations the company failed to use appropriate information security practices, which allowed a hacker to access customers’ security cameras.

Under a proposed order, which must be approved by a federal judge before it can go into effect, Verkada will also be required to pay a $2.95 million monetary penalty to settle allegations the company inundated prospective customers with commercial emails in violation of the CAN-SPAM Act, the largest penalty obtained by the FTC for a CAN-SPAM violation.

A complaint alleged that Verkada failed to use appropriate information security practices to protect consumers’ personal information, which allowed a hacker to access internet-connected security cameras and view patients in psychiatric hospitals and women’s health clinics. The complaint also charged that Verkada was aware that employees and a venture capital investor posted positive ratings and reviews of Verkada and its products but failed to disclose their association or current employment status with Verkada. 

The complaint also alleged that Verkada violated the CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography and Marketing) by flooding prospective customers with a barrage of commercial emails and failing to include the option to unsubscribe or opt-out, honor opt-out requests, and provide a physical postal address in the emails.

As a result of these security failures, the complaint alleges, the company experienced at least two security breaches between December 2020 and March 2021. In the March 2021 breach, the hacker had access to over 150,000 live Verkada customer cameras as well as other customer information, such as physical addresses, audio recordings, and customer WiFi credentials.

https://www.securitymagazine.com/articles/101008-ftc-cites-verkada-for-alleged-can-spam-violations

Set 05, 2024 Marina Londei Approfondimenti, Attacchi, Attacchi, In evidenza, Minacce, News, RSS, Software 0

---

Gli attacchi di furto di account (account takeover) sono ancora molto diffusi e la ragione per cui hanno successo è legata alle debolezze insiste nei browser. I browser sono ricchi di punti ciechi che gli attaccanti possono sfruttare per sottrarre le credenziali delle vittime e prendere il controllo degli account.

In un recente report, LayerX ha analizzato questo tipo di attacchi sottolineando che la diffusione delle moderne applicazioni SaaS ha reso più semplice prendere il controllo degli account cloud-based rispetto alla controparte on-premise. “Le applicazioni basate su SaaS si trovano nel cloud, al di fuori del perimetro fisico dell’organizzazione, dove non sono protette da alcun perimetro, consentendo così l’accesso diretto da qualsiasi parte del mondo” si legge nell’analisi.

Alle applicazioni SaaS si può accedere da qualsiasi browser; essendo i browser pieni di vulnerabilità, gli attaccanti hanno la strada (quasi) spianata per sottrarre le credenziali degli utenti ed eseguire nuovi attacchi da una posizione privilegiata.

Le tecniche e tattiche dietro il furto di account

Uno dei metodi più usati dagli attaccanti per prendere il controllo degli account delle vittime è il phishing. Esistono diversi modi per eseguire questo attacco, ma l’obiettivo è sempre lo stesso: il furto di credenziali per accedere agli account. In questo caso i cybercriminali abusano del flusso di esecuzione delle pagine web per presentare agli utenti finte pagine di login o per intercettare l’esecuzione di una pagina legittima (attacchi man-in-the-middle).

Le soluzioni di Security Service Edge (SSE) o i firewall non sono in grado di bloccare questi attacchi: questi servizi analizzano il traffico cifrato, ma non sono in grado di individuare i componenti malevoli della pagina; in questo modo, il codice malevolo riesce a entrare nel perimetro dell’organizzazione e venire eseguito dal browser.

Un’altra tattica ampiamente usata dagli attaccanti per sottrarre le credenziali utente è l’abuso delle estensioni del browser, in particolare quelle con permessi elevati. I cybercriminali pubblicano un’estensione malevola sullo store di Chrome o ne acquistano una esistente per inserirvi il codice malevolo; una volta installata, l’estensione è in grado di accedere allo storage di credenziali e raccogliere password, cookie e token.

In questo caso, le piattaforme di protezione degli endpoint (EPP/EDR) considerano affidabili tutti i processi dei browser, comprese le estensioni, e gli permettono di eseguire senza limitazioni; ciò rende i plug-in un altro punto cieco dei browser.

Una volta ottenute le credenziali in uno o nell’altro modo, l’attaccante può accedere all’account della vittima, prenderne il controllo ed eseguire ulteriori attacchi. L’autenticazione multi-fattore è in grado di limitare questi accessi, ma, come sappiamo bene, non è ancora diffusa come dovrebbe.

“Le percentuali di successo degli attacchi di account takeover indicano chiaramente che l’attuale approccio alla sicurezza dell’identità semplicemente non funziona” si legge nel report. Il browser è il punto più rischioso che consente l’esecuzione degli attacchi; per questo è fondamentale affidarsi a una piattaforma per la sicurezza del browser.

Questo tipo di soluzioni offrono maggiore visibilità sul flusso di esecuzione del browser e sono in grado di analizzare il singolo componente coinvolto, identificando eventualmente quelli legati a operazioni di phishing e bloccandone il caricamento in pagina. La piattaforma si occupa inoltre scansionare periodicamente le estensioni del browser, identificare quelle più rischiose sulla base dei permessi che hanno e disabilitare automaticamente quelle malevole.

Infine, la soluzione monitora le credenziali salvate nel browser e si integra con i provider di identità per fare in modo che l’utente possa accedere solo dal proprio browser, riducendo così il rischio di abuso di credenziali compromesse.

In questo modo, spiega LayerX, il browser non è più un elemento critico, ma diventa un’arma per contrastare gli attacchi di furto di account, furto di credenziali e abuso di identità.

---

---

---

https://www.securityinfo.it/2024/09/05/proteggersi-dal-furto-di-account-rendendo-piu-sicuro-il-browser/?utm_source=rss&utm_medium=rss&utm_campaign=proteggersi-dal-furto-di-account-rendendo-piu-sicuro-il-browser

Da tempo, l’evoluzione delle minacce informatiche occupa una posizione primaria nelle agende di governi e organizzazioni internazionali, portando ad una crescente produzione legislativa in materia, intesa a creare un contesto omogeneo e un ambiente affidabile per operatori e investimenti.

In particolare, le istituzioni europee negli ultimi anni si sono spese per l’adozione di normative avanzate a protezione di dati, infrastrutture e cittadini dell’Unione Europea, perseguendo la duplice finalità di uniformare le regole per chi opera in UE e innalzare il livello complessivo della sicurezza di reti e sistemi a salvaguardia di informazioni e servizi.

In tale contesto, tra le principali novità normative in via di applicazione vi è sicuramente il Digital Operational Resilience Act, più noto con la sigla DORA.

Origini e scopi del Regolamento DORA

Il DORA è stato pubblicato sulla Gazzetta Ufficiale dell’UE il 27 dicembre 2022 come Regolamento Europeo 2022/2554 relativo alla resilienza operativa digitale per il sistema finanziario. In quanto Regolamento, il DORA è da considerarsi in vigore in tutti gli stati membri dell’UE dal 17 gennaio 2023 e risulterà pienamente applicabile a partire dal 17 gennaio 2025. Ne deriva che i soggetti coinvolti hanno a disposizione ancora qualche mese per adeguarsi a una cornice giuridica vincolante circa la gestione del rischio informatico e la capacità di fronteggiare incidenti, che potrebbero compromettere reti e sistemi, a discapito della sicurezza delle informazioni e dell’erogazione dei servizi finanziari.

Del resto, nelle intenzioni del legislatore comunitario, la nuova normativa “accresce il livello di armonizzazione delle varie componenti della resilienza digitale” e “introduce requisiti in materia di gestione dei rischi informatici e segnalazione di incidenti connessi alle TIC più rigorosi rispetto a quelli contenuti nell’attuale normativa dell’Unione”, così migliorando la resilienza operativa e la sicurezza delle organizzazioni finanziarie.

In tale quadro, la regolamentazione da un lato deve rivolgersi a una maggiore varietà di soggetti attivi sui mercati finanziari, mentre dall’altro è tenuta a considerare nuove tipologie di Threat Actor e strumenti sempre più sofisticati a loro disposizione, senza trascurare l’estensione della superficie di attacco legata al frequente ricorso a fornitori di servizi ICT a supporto delle funzioni essenziali e importanti erogate dai soggetti a perimetro.

DORA e NIS2

Il DORA non è l’unica norma in materia di cybersecurity a livello europeo. Nei Considerando del Regolamento viene infatti richiama la Direttiva UE 2016/1148, già dedicata a stabilire criteri minimi di cybersicurezza per gli operatori di servizi essenziali, abrogata dalla più recente 2022/2555 (nota come NIS2), che ne amplia il perimetro di applicazione.

L’intersezione fra le prescrizioni del Regolamento DORA e le indicazioni della direttiva NIS2 è certamente significativa: la governance e la centralità della gestione del rischio e degli incidenti informatici ne costituiscono forse gli esempi più evidenti.

Tuttavia, il DORA prevede requisiti più rigorosi per le entità finanziarie ed è pertanto da considerarsi lex specialis rispetto alla direttiva (UE) 2022/2555 (cfr. Considerando 15-16 del Regolamento) e quindi su di essa prevalente laddove applicabile.

Chi è interessato dal Digital Operational Resilience Act?

Se la direttiva del 2016 si rivolgeva a tre sole tipologie di entità finanziarie (enti creditizi, sedi di negoziazione e controparti centrali), il DORA amplia notevolmente la platea dei propri destinatari.

Vi rientrano infatti, accanto alle istituzioni finanziarie “tradizionali” – come le banche o le società di investimento – anche realtà emerse solo da pochi anni, quali i gestori di piattaforme di crowdfunding o i vari attori del mondo delle criptovalute.

Un’ulteriore innovazione è rappresentata dal coinvolgimento, diretto o indiretto, di quelle terze parti che, pur non essendo strettamente del settore, rivestono un ruolo rilevante nella catena di valore dei mercati finanziari: tra questi, a mero titolo di esempio, citiamo i fornitori di servizi Cloud nonché le aziende che svolgono attività di Data Analytics o di rating che, qualora identificate come fornitori terzi critici, potranno essere sottoposti alla supervisione delle autorità di vigilanza.

Le prescrizioni del Regolamento DORA

A tutte le entità che rientrano nel suo campo di applicazione il DORA richiede innanzitutto di:

• definire un’organizzazione interna che preveda un quadro di governance della sicurezza informatica, in grado di garantire una gestione efficace dei rischi, l’approvazione di contromisure e controlli adeguati, nonché la loro effettiva applicazione
• pianificare la gestione dei rischi per tecnologie e servizi ICT, mediante l’adozione di un framework di risk management a supporto della definizione di una strategia di resilienza digitale, che garantisca la continuità operativa e una adeguata capacità di affrontare scenari di crisi
• classificare gli incidenti, ivi inclusi gli incidenti correlati ai fornitori terzi di servizi ICT, e le minacce che potrebbero insidiare la sicurezza informatica dell’entità finanziaria
• predisposizione di un sistema di segnalazione degli incidenti informatici, dal monitoraggio alla comunicazione, laddove previsto, alle autorità competenti e agli stakeholder potenzialmente coinvolti: si rendono necessari piani per la gestione degli incidenti (IRP) per contenerne l’impatto e accelerare il ripristino dei servizi coinvolti.
• pianificare lo svolgimento di Threat Lead Penetration Test (TLPT) mirati a valutare, con frequenza almeno triennale, la resilienza delle infrastrutture informatiche rispetto al mutato panorama delle minacce

• gestire i rischi informatici correlati a fornitori, mediante l’identificazione di servizi e processi che prevedano il coinvolgimento di soggetti terzi e la conseguente definizione di clausole contrattuali, che garantiscano un livello di sicurezza adeguato e strumenti di monitoraggio dei servizi forniti.

I requisiti del Regolamento implicano pertanto la necessità di:

• ricorrere a framework di sicurezza di riconosciuta affidabilità ed efficacia (es. ISO/IEC 27001) per garantire un approccio sistemico e coerente alla gestione della sicurezza delle informazioni
• adottare configurazioni sicure per i sistemi e le reti, facendo riferimento alle best practice internazionali (in particolare a quelle del NIST);
• valutare la criticità dei componenti ICT e documentare le dipendenze esistenti a livello di sistemi, processi e third party provider (TPP), prevedendo adeguate misure a protezione degli asset più critici.

Si impone altresì l’adozione di robusti framework di gestione dei rischi ICT, che includano:

• l’uso di metodologie avanzate per identificare e valutare i rischi, come l’analisi delle minacce (threat modeling) e la periodica valutazione delle vulnerabilità (vulnerability assessment)
• il ricorso a strumenti di controllo e mitigazione delle minacce quali firewall avanzati, sistemi di prevenzione delle intrusioni (IPS) o soluzioni di crittografia end-to-end
• l’implementazione di sistemi di monitoraggio continuo per rilevare e rispondere tempestivamente a comportamenti anomali e potenziali incidenti di sicurezza.

Il DORA richiede poi che le organizzazioni prevedano piani dettagliati di continuità operativa che comporteranno:

• l’esecuzione di Business Impact Analysis (BIA) per identificare le funzioni critiche e determinare l’impatto di possibili interruzioni operative
• lo sviluppo di piani di recupero dettagliati che comprendano il backup dei dati, il ripristino dei sistemi (Disaster Recovery) e le procedure di failover
• lo svolgimento di regolari test sui piani e protocolli così definiti, per assicurarne l’efficacia e garantirne il loro costante aggiornamento.

Il Regolamento enfatizza l’importanza del monitoraggio continuo e della capacità di rispondere rapidamente agli eventuali incidenti informatici. Tali requisiti sono attuabili tramite:

• l’utilizzo di Security Information and Event Management (SIEM) per aggregare e analizzare i log di sicurezza, fornendo visibilità in tempo reale su tutti gli eventi rilevanti;
• l’integrazione di feed di intelligence sulle minacce per migliorare la capacità di rilevamento e risposta agli attacchi emergenti;
• l’adozione di soluzioni di Security Orchestration, Automation and Response (SOAR) per ridurre drasticamente i tempi di reazione agli incidenti.

Infine, non può essere trascurato l’aspetto documentale: il Regolamento richiede alle entità finanziarie di definire dettagliate politiche di sicurezza e procedure operative standard (SOP) per la gestione del rischio informatico.

RTS, ITS e regolamenti delegati

Il DORA affida alle autorità europee di vigilanza (le AEV: EBA, ESMA, EIOPA) la definizione di norme tecniche di regolamentazione (RTS) e di attuazione (ITS) che contengano indicazioni puntuali riguardo gli aspetti più rilevanti e delicati. Le norme che ne derivano sono adottate dall’UE mediante atti (o regolamenti) delegati della Commissione Europea.

Al riguardo citiamo:

• il regolamento delegato (UE) 2024/1772, che sancisce i criteri primari e secondari da adottare per la classificazione degli incidenti informatici sulla base dei servizi impattati, del profilo dei clienti coinvolti, della perdita di dati, nonché dell’impatto reputazionale, economico e dell’ambito geografico. Il regolamento stabilisce per ogni criterio una soglia intesa a supportare l’individuazione degli incidenti da considerarsi gravi e, dunque, da notificare alle autorità di settore
• il Regolamento delegato (UE) 2024/1773, che riporta i principi che dovranno comparire nelle politiche di gestione dei contratti per l’acquisizione di servizi ICT da terze parti a supporto di funzioni essenziali e importanti dell’Entità Finanziaria. Tali politiche dovranno definire ruoli e responsabilità nell’ambito dell’organizzazione e garantire la definizione di clausole che consentano di stabilire il livello dei servizi forniti dalla terza parte, il rapporto con eventuali sub-fornitori, i requisiti di sicurezza delle informazioni, i diritti di audit e le strategie di uscita a cui poter ricorrere.
• Il Regolamento delegato (UE) 2024/1774, che delinea le politiche di risk management per l’identificazione e la valutazione dei rischi a cui sono esposti tecnologie e servizi ICT, al fine di individuare e attuare le misure di sicurezza tecniche e organizzative necessarie, quali politiche per la gestione delle chiavi crittografiche, vulnerability management, asset management, politiche per la gestione degli ambienti di produzione, testing e sviluppo, politiche per l’acquisizione e sviluppo di applicazioni software da integrare con i sistemi ICT dell’Entità Finanziaria.

Il set di atti delegati non è ancora da considerarsi completo: altri ne sono attesi entro la fine del 2024.

“Il DORA – secondo Guido Arrigoni, Cybersecurity compliance manager di 7Layers – è da considerarsi una normativa in divenire e, come tale, richiede una verifica costante delle sue evoluzioni unitamente a una valutazione delle indicazioni fornite dalle autorità di settore, sia a livello europeo sia a livello nazionale”.

Il ruolo dei fornitori di servizi ICT

Come accennato, il DORA presenta implicazioni non trascurabili per i fornitori di servizi ICT a supporto dell’attività delle Entità Finanziarie incluse nel perimetro di applicazione del Regolamento, che dovranno redigere un registro dei contratti stipulati con i TPP (cfr. DORA, art. 23). Coerentemente con le prescrizioni del Regolamento, i requisiti in capo alle Entità Finanziarie si tradurranno in clausole a cui i fornitori dovranno essere capaci di rispondere esprimendo una security posture tale da soddisfare le esigenze dei propri clienti.

I fornitori più rilevanti potranno essere classificati come critici dalle autorità di vigilanza europee sulla base dei criteri indicati dall’art. 31 del Regolamento e dettagliati dal Discussion Paper pubblicato dalle AEV, per stabilire il percorso che porterà a identificare i CTPP (Critical Third Party Provider) sulla base della continuità, della qualità dei servizi forniti e del possibile impatto sistemico che potrebbe derivare da un eventuale incidente che comprometta la sicurezza del fornitore.

DORA: implicazioni per la Cyber Security

L’implementazione del Regolamento DORA richiede senz’altro risorse significative, che andranno indirizzate verso:

• investimenti in tecnologie avanzate di sicurezza, come sistemi di rilevamento delle intrusioni (IDS), soluzioni di crittografia e strumenti di monitoraggio continuo;
• formazione continua del personale sulle migliori pratiche di cybersecurity e la gestione dei rischi ICT;
• definizione di una chiara governance della sicurezza informatica, che individui ruoli e responsabilità legati alla gestione degli incidenti nonché ai relativi obblighi di documentazione e reportistica di eventuali incidenti.

Conclusioni

Oltre a garantire la necessaria compliance, l’adeguamento alle nuove regole porterà maggiore trasparenza, responsabilità e innovazione presso le aziende e gli enti interessati, uniformando i livelli di resilienza digitale dei servizi finanziari sul mercato europeo.

Sebbene l’implementazione del DORA possa presentare delle sfide, è prevedibile che nel lungo termine i costi siano compensati dall’accresciuto valore derivante dalla maggiore affidabilità e sicurezza garantite ai propri clienti e dalla capacità di affrontare scenari in grado di arrivare a compromettere l’intero mercato finanziario europeo se non adeguatamente gestiti.

https://www.ictsecuritymagazine.com/notizie/regolamento-dora-tempi-contenuti-e-implicazioni-di-cybersecurity-7layers-in-prima-fila/

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #F4F5F6; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content: ; display: block; text-align: center; font-size: 18px; color: #404144; }
.w3-bar{width:100%;overflow:hidden}.w3-center .w3-bar{display:inline-block;width:auto}
.w3-bar .w3-bar-item{padding:8px 16px;float:left;width:auto;border:none;display:block;outline:0}
.w3-bar .w3-button{white-space:normal}
.w3-bar:before,.w3-bar:after{content:””;display:table;clear:both}
.w3-button{border:none;display:inline-block;padding:8px 16px;vertical-align:middle;overflow:hidden;text-decoration:none;color:inherit;background-color:inherit;text-align:center;cursor:pointer;white-space:nowrap;border-radius: 10px;}
.w3-red,.w3-hover-red:hover{color:#fff!important;background-color:#A72428!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif;font-size:12px;}

The importance of connections in security

Arian Avila started their career in academia, studying criminology and public policy. Avila’s grandfather was the Chief Forensic Pathologist for San Mateo County, California.

“Growing up, I was always fascinated by how he was able to figure out how someone died and how people could use that information to prevent others from dying. What ultimately got me into the field was my desire to help others and keep people safe,” Avila says.

Three years into their Ph.D. program, Avila was hired as a crime analyst for a national bank. Avila was the first to fill this position, expanding the role to include protest monitoring and building out an intelligence and analysis team for various U.S. regions.

“Prior to working in corporate security, I spent 10 years working in retail branches and banking centers. Working the frontline taught me the value of customer service and people engagement and got me comfortable with uncertainty, never knowing what transaction I was going to have to conduct or what financial need I could help solve for. Like security, no day in a banking center is ever the same,” Avila says.

Avila then began working with the non-U.S. team, managing analysts all over the world. She was responsible for regional analytics involving crime, terrorism, geopolitics, travel security and more. “During this time, I had the opportunity to lead a global project focused on standardization and connection of four global security operation centers (GSOCs),” Avila says. “From there I was promoted to Global Intelligence Director which included leading the two teams I previously managed, Travel Safety, Strategic Initiatives, the Fusion Center and a 24/7/365 event monitoring team.”

After this, Avila went on to become the Chief Operating Officer (COO) for Global Corporate Security. In this role, Avila led business operations, strategy, governance and global intelligence. Avila transitioned into leading safety strategy, including background screening and life safety. They managed OSHA governance and oversaw workplace violence training alongside insider threat prevention.

What ultimately got me into the field was my desire to help others and keep people safe.

“Just as that was picking up steam, COVID-19 happened and I was appointed to be the Corporate Security Lead on the enterprise COVID taskforce where I stood up a monitoring and reporting team, providing executive and board level updates and built the company’s health and safety framework that drove return to office and travel decisions,” Avila says.

Currently, Avila serves as the Vice President of Security Operations and Solutions at Capital One. Their position included security technology, executive protection, threat management and their global security operations center (GSOC). “When I joined corporate security, intelligence was a relatively novel function, having to continuously show the value of the program with little to no budget. This forced creativity, problem solving, salesmanship and working through others. I learned how to navigate for resources, pitch to stakeholders, and create leverage,” Avila says.

Avila works to improve the safety of security leaders as well. She’s worked on trauma training and awareness, knowing that security leaders are often at the forefront of stressful and potentially dangerous situations.

“I will participate in an upcoming GSX panel on Mental Health and Wellbeing called Guarding the Guardians,” Avila says.

Avila encourages prospective security leaders to avoid comparison. “We don’t celebrate failures or challenges as much as we should or my resume would be chalked full of them. The focus is not on the fail but on what that fail led to — innovation, resilience, and growth,” Avila says.

---

---

https://www.securitymagazine.com/articles/100954-arian-avila-most-influential-people-in-security

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #F4F5F6; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content:; display: block; text-align: center; font-size: 18px; color: #404144; }
.w3-bar{width:100%;overflow:hidden}.w3-center .w3-bar{display:inline-block;width:auto}
.w3-bar .w3-bar-item{padding:8px 16px;float:left;width:auto;border:none;display:block;outline:0}
.w3-bar .w3-button{white-space:normal}
.w3-bar:before,.w3-bar:after{content:””;display:table;clear:both}
.w3-button{border:none;display:inline-block;padding:8px 16px;vertical-align:middle;overflow:hidden;text-decoration:none;color:inherit;background-color:inherit;text-align:center;cursor:pointer;white-space:nowrap;border-radius: 10px;}
.w3-red,.w3-hover-red:hover{color:#fff!important;background-color:#A72428!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif;font-size:12px;}

 Desire for the greater good

Edward Levy entered the military directly after college. His time in the military spanned more than two decades, in which he rose through the ranks of the United States Army to the rank of Lieutenant Colonel as a Military Police officer.

“I had a diverse military career,” Levy reflects. “Partway through my military career, I started migrating toward assignments that were heavily focused on leading security and antiterrorism programs.”

Throughout the course of his expansive military career, Levy developed an appreciation for what he calls “the greater good.” This passion for continuing to uphold a service to others fueled his interest to continue in the security field after Army retirement.

“I believe most persons going into the military have a sense of service which further grows while learning the deep history and experiencing the traditions for duty and honor,” Levy states. “Obviously, people don’t go into the military to make a lot of money. What partly drives folks into the military is that desire to serve, whether on the home-front or around the globe. They want to serve a greater role that extends beyond just themselves.”

As a commissioned military police officer, Levy developed an understanding and appreciation for taking care of people.

“The roles I had in the military gave me a better appreciation for what it means to protect people, communities, organizations and critical assets.” Levy declares, “There are people out there that want to harm other people, nations who want to harm Americans and our allies. Being a protector gives me a great sense of fulfillment.”

Levy’s desire to protect made his transition from the military to private sector corporate positions a natural one. After leaving the military, Levy joined Shearer & Associates as a Senior Security Analyst. His career only grew from there, as he climbed to positions such as Director of Security Operations for Pfizer, Head of Security for Thomson Reuters, Vice President of Workplace Security at MetLife, Chief Security Officer at Lone Star Funds, and more.

In this culture, whether you’re an operator, a practitioner or you’re on the service side, most people have the same desire to do the right thing with you.

Today, Levy is the Director of Critical Infrastructure at Noble Supply & Logistics, which he considers a positive shift from his previous private sector roles. “It’s a shift from being a security leader or security practitioner,” he says, “but I wouldn’t call it a total shift, especially from part of my past experiences in the military.”

Levy remarks that his current role has brought him “full circle” from in-part of his career path in the military. “I spent three years working in the Pentagon and was part of the Army’s program for the research, development, and acquisition of anti-terrorism and security equipment for the Army worldwide. Now, I’m able to help shape and deliver security and antiterrorism protective systems into the private sector.”

With such an extensive career journey, Levy has grown to love many aspects of the industry. There are two in particular that he focuses on as his favorite parts of working in security.

The first aspect he mentions is the strong, supportive culture within the security industry. “In this culture, whether you’re an operator, manufacturer or on the service side, most people have the same desire for teamwork and the same protective mindset.”

Another aspect of security Levy appreciates is the ability to attain fulfilling and measurable results. “I really like getting to see the results, as an individual and as a member of a team. Whether it’s protecting against an unwanted event, comforting victims, or responding to humanitarian incidents, when it comes to safeguarding the people or organizations that we’re a part of, there’s a strong sense of giving back and achievement.”

The idea of giving back is central to Levy’s sense of accomplishment within his career. Upon reflecting on his greatest professional accomplishment, Levy states, “I would probably say my greatest career accomplishment is being able to promote, support, coach, mentor and train the next generation as others have done for me.”

For the next generation of security professionals, Levy advocates the importance of continuing education, professional development, and volunteerism. “My advice is to seek opportunities for education, training, networking and taking on new and progressive opportunities as you navigate your career.” He also advises, “Peer groups are important, because they’re all about learning and growing.”

To security professionals at any juncture in their career journey, Levy offers the following advice: “Being a part of values-based organizations and a value-based cultures has kept my interest and drawn me into the security industry. Being a part of companies that have strong value systems that match your own is important, as practitioners and leaders, as we navigate the industry.”

---

---

https://www.securitymagazine.com/articles/100959-edward-m-levy-most-influential-people-in-security

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #F4F5F6; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content:; display: block; text-align: center; font-size: 18px; color: #404144; }
.w3-bar{width:100%;overflow:hidden}.w3-center .w3-bar{display:inline-block;width:auto}
.w3-bar .w3-bar-item{padding:8px 16px;float:left;width:auto;border:none;display:block;outline:0}
.w3-bar .w3-button{white-space:normal}
.w3-bar:before,.w3-bar:after{content:””;display:table;clear:both}
.w3-button{border:none;display:inline-block;padding:8px 16px;vertical-align:middle;overflow:hidden;text-decoration:none;color:inherit;background-color:inherit;text-align:center;cursor:pointer;white-space:nowrap;border-radius: 10px;}
.w3-red,.w3-hover-red:hover{color:#fff!important;background-color:#A72428!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif;font-size:12px;}

 Growing with the security industry

With more than 20 years of security experience, the ever-evolving nature of the security industry is what interests Jeremy Rodrigues, CPP the most.

“The security field is constantly evolving, with changes being a constant factor, and as security professionals, we’re trying to stay aware of new risks and challenges” he says. “But it’s also an opportunity for us to develop innovative solutions to complex problems that each of our companies face.”

Rodrigues, currently the Senior Director of Enterprise Security at Excelerate Energy, started his career in the U.S. Coast Guard as a Port Security Specialist. He served on active duty for six years, deploying as part of Law Enforcement Detachments onboard U.S. and allied warships conducting counternarcotics operations throughout Latin America and is also a veteran of Operation Enduring Freedom. He then worked as a Border Patrol Agent at U.S. Customs and Border Protection before using his GI Bill to attend San Diego State University, where he earned degrees in International Security and Conflict Resolution, as well as in Homeland Security. From there, he took on the role of Homeland Security Project Manager at Lawrence Livermore National Laboratory before serving as a Foreign Affairs Officer at the U.S. Department of State’s Bureau of Diplomatic Security, overseeing private sector threat warning at the Overseas Security Advisory Council (OSAC).

In 2016, Rodrigues transitioned into the private sector and has since held senior security leadership positions at The Boeing Company and Pratt & Whitney before the move to Excelerate Energy in 2022. He is an active member of the International Security Management Association (ISMA) and serves on the advisory council for Hostage US. In addition, Rodrigues also teaches homeland security studies at Arizona State University’s School of Public Affairs and serves as a member of the school’s advisory board. He retired from the Coast Guard Reserve in 2021 after 20 years of service of enlisted and commissioned service.

I’ve been shaped by people who’ve taken an interest in me and my career aspirations and I try to give back whenever possible.

In his role at Excelerate Energy, Rodrigues is the head of enterprise security. This includes maritime security compliance, executive protection, physical security, travel risk management, crisis management and the security technology employed by the company around the world. Rodrigues is also responsible for geopolitical risk analysis.

“I have a unique role at Excelerate that allows me to help our executives make informed decisions by evaluating how events taking place around the world impact our company,” he explains. “Excelerate is a relatively small company, but we operate in a fascinating component of the energy sector. We have a fleet of 10 specialized ships called Floating Storage and Regasification Units that can re-gasify liquefied natural gas (LNG) at sea, so we’re essentially a floating LNG terminal to aid countries in their energy transition, and they are employed everywhere from places like Argentina and Brazil, to Pakistan, Bangladesh, the United Arab Emirates, Finland, and soon, Germany. We also have corporate offices around the world as well. So, it’s been an interesting journey from government into aerospace and now into the energy sector and getting to use my past experiences to protect our people and assets at Excelerate.”

When looking back on his career, Rodrigues credits his successes to a desire to always learn something new either through traditional education or from the expertise of others. Rodrigues recently graduated from the Thunderbird School of Global Management, where he earned an advanced degree alongside a cohort of mid-career professionals at Thunderbird’s Washington, DC campus.

“There needs to be a willingness to learn — continuous education — and a willingness to go beyond your comfort zone,” he notes. “If there is something I don’t have subject matter expertise in, or a background in, it’s important to rely upon others in my organization, people on my team to help me come up to speed quickly, and ultimately fulfill the goals of the organizations.”

Supporting security professionals

When offering advice to those entering the security industry or seeking to advance their careers, Rodrigues emphasizes the importance of curiosity. “Stay curious, seek out diverse experiences, and continuously build your network,” he adds. “Having a broad understanding of different security disciplines will make you more versatile and valuable to organizations.” He also stresses the evolving nature of the security landscape, noting that future security leaders may come from varied backgrounds such as IT or human resources. According to Rodrigues, supporting other security professionals — whether through formal or informal mentorship — is an important way to advance and grow the security industry.

“I’ve been shaped by people who’ve taken an interest in me and my career aspirations, and I try to give back whenever possible,” he says. “It has taught me a lot personally, it’s helped me give back to my industry and to the organizations that I’ve been a part of. I’m imparting the knowledge that I received from the mentors that I’ve had throughout my career with people coming up. It’s extremely fulfilling!”

---

https://www.securitymagazine.com/articles/100962-jeremy-rodrigues-most-influential-people-in-security