@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #F4F5F6; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content:; display: block; text-align: center; font-size: 18px; color: #404144; }
.w3-bar{width:100%;overflow:hidden}.w3-center .w3-bar{display:inline-block;width:auto}
.w3-bar .w3-bar-item{padding:8px 16px;float:left;width:auto;border:none;display:block;outline:0}
.w3-bar .w3-button{white-space:normal}
.w3-bar:before,.w3-bar:after{content:””;display:table;clear:both}
.w3-button{border:none;display:inline-block;padding:8px 16px;vertical-align:middle;overflow:hidden;text-decoration:none;color:inherit;background-color:inherit;text-align:center;cursor:pointer;white-space:nowrap;border-radius: 10px;}
.w3-red,.w3-hover-red:hover{color:#fff!important;background-color:#A72428!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif;font-size:12px;}

Continue learning throughout your security career

Robert Grant’s career began with 25 years in the FBI. Grant traveled around the country — Tennessee, Washington, California, New York — working in various departments from financial crime to public corruption and terrorism.

His interest in the FBI began early, when the father of his childhood best friend allowed Grant to join them at a FBI picnic. “I was so impressed by the agents. That became my passion from that point forward, to get through college and compete and try to get into the FBI,” Grant says.

Interested in a change, Grant worked for the Walt Disney Company as the Vice President of Global Security. Not wanting to uproot his family from Chicago, Grant worked hard to split his time between work and home. The transition was rough, as the consistency found within the FBI was vastly different from that of a corporation.

Following his time with Walt Disney, Grant took on investigative work. Grant helped to investigate current and previous Catholic priests who may have been involved in inappropriate relationships with minors. “We had to do these investigations based on records, not based on interviews of priests or others. It was all based on what’s inside the files in the Catholic Church. Now, if any organization documents more than the FBI, it’s the Catholic Church,” Grant says.

Currently, Grant works as the Senior Director of Global Security at Hollister, and not the denim company. Hollister is a medical devices organization that was just starting to build out their security presence when Grant signed on. “We’d never had global security. So this is probably one of the hardest jobs I’ve ever had, because they had to build from scratch, introducing concepts that they weren’t familiar with, introducing technology they weren’t familiar with,” Grant says, “When I came to the Hollister, we didn’t have a presence overseas, and 70% of our employees are employed outside the United States. My first order of business was to hire somebody in Europe, which is where the vast majority of our employees are located.”

When the job became repetitive, when I was in Groundhog Day, I say that’s usually when you know to start looking around for another hill to climb.

Grant also discovered the differences in working for an organization focused on security and safety, such as the FBI, and an organization with a different end goal, such as Disney. “Because security wasn’t generating revenue for the company, we were not considered the prime part of the organization. We were considered a necessary evil of an investment. And in the FBI, you are the prime investigators of the Department of Justice. So anything from cybersecurity, to political corruption, to financial corruption, to terrorism, to espionage, the FBI is the lead and primary agency. Making that transition was an adjustment,” Grant says.

“At Disney, we were precluded by HR from even using the term active shooter. That was kind of surprising to me, that it was HR’s attempt to preserve the brand, preserve the happiest place on earth and not even give the suggestion that we could be concerned about active shooters. And so they did not want us to discuss it with the employees. The phrase they made us use was imminent risk. Of course, nobody knew what imminent risk. The first question we had was what is imminent risk? We realized they were talking about active shooter,” Grant says.

Grant also spent time developing Hollister’s workplace violence prevention program. It was a different challenge from Disney, which had to account for the additional risks of thousands of daily visitors. “We want to make sure we manage these cases smartly, but also consistently. The risk could be at the highest levels of the corporation down to the mailroom administrator, we want to make sure when we process and manage these risks, we’re doing it thoughtfully and consistently and on a scientific basis. So we use what’s called Waiver 21,” Grant says.

Grant’s advice for security leaders is to know when it’s time to make a change. “There are people who aspire to go to the top. From the very end, they met their career all the way through. I know people like that. And some of them are very good, some are just overly ambitious, and not necessarily all that skilled. I enjoyed doing things and when the job became repetitive, when I was in Groundhog Day, I say that’s usually when you know to start looking around for another hill to climb,” Grant says.

---

---

https://www.securitymagazine.com/articles/100956-robert-grant-most-influential-people-in-security

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #F4F5F6; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content:; display: block; text-align: center; font-size: 18px; color: #404144; }
.w3-bar{width:100%;overflow:hidden}.w3-center .w3-bar{display:inline-block;width:auto}
.w3-bar .w3-bar-item{padding:8px 16px;float:left;width:auto;border:none;display:block;outline:0}
.w3-bar .w3-button{white-space:normal}
.w3-bar:before,.w3-bar:after{content:””;display:table;clear:both}
.w3-button{border:none;display:inline-block;padding:8px 16px;vertical-align:middle;overflow:hidden;text-decoration:none;color:inherit;background-color:inherit;text-align:center;cursor:pointer;white-space:nowrap;border-radius: 10px;}
.w3-red,.w3-hover-red:hover{color:#fff!important;background-color:#A72428!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif;font-size:12px;}

Protect and serve

When it comes to entering the security industry, Josh Phillips says a lot of people either get into it on purpose or fall into it “accidentally”.

“I’m in the latter category,” he says with a laugh.

After high school, Phillips knew he would need to work his way through college and started looking for available jobs and discovered the local Walmart had an in-store loss prevention associate job opening.

“I decided to apply for it because it sounded cool and ended up really liking it,” Phillips says. “And I’ve been in the security asset protection industry — in some form or fashion — pretty much ever since. Phillips has led security or asset protection teams for Fortune 500 companies, being promoted into the roles both times. Throughout his career, Phillips has held a variety of roles from a medic in the Indiana Air National Guard to senior and executive level asset protection titles with Liz Claiborne, Bath & Body Works, and most recently with Chipotle Mexican Grill.

Phillips enjoys working in the security field and the ability to help people on a daily basis is a driving force in his career.

“I really love protecting people, I get a lot of satisfaction out of knowing that we have created a safe workplace where people can come and do their best work,” Phillips says. “The tagline mission statement of our team is that ‘We create safe spaces where people can thrive’, that’s our mission and I take that very seriously.”

I really love protecting people, I get a lot of satisfaction out of knowing that we have created a safe workplace where people can come and do their best work.

In his current role as Senior Director; head of Global Security & Resilience at Chipotle, Phillips is the global security and business continuity function leader reporting to the CFO and supporting more than 3,500 restaurants and 120,000 people worldwide. Phillips oversees a growing security operations center, executive people protection, travel, event, and corporate security capability, fraud and threat investigations, and a field asset protection team as well as the organization’s workplace violence prevention and business continuity programs.

“The thing I love about security is the grey areas,” Phillips says. “In our industry there is a lot of our jobs that are black and white — the store has to be locked, the money has to be over here — and if you create processes that keep those things locked down, and black and white, and you can really put your energy into the gray area and that’s where security gets creative, where you’re tackling novel challenges. You have to partner closely with the business leaders to come up with a solution for a unique problem. I think from the outside people would think our job is all black and white and quite simple and I think any security leader practitioner would tell you, it’s the opposite. The fact that you have to stay on your toes is what keeps me in it.”

Supporting the community

In addition to his role with Chipotle, Phillips believes it is important to give back to the community and support other within the security industry. To that end, Phillips has been a volunteer leader with various employee affinity and resource groups and currently serves as a board member of the Restaurant Loss Prevention and Security Association (RLPSA). Phillips is also the executive sponsor of Chipotle’s pride resource group and serves as committee chair on the Global Security Pride committee with OSAC.

“Global Security Pride is specifically focused on creating more inclusive workplaces within the security field for LGBTQIA+ security professionals,” he says. “I’ve been overwhelmed by how important this organization is to security practitioners around the world, it’s a place for them to feel comfortable sharing and being themselves within the security landscape.”

Providing support, working with other security leaders and mentorship are key elements to growing talent in the security industry Phillips says.

“You can’t know everything, you can’t know all of the threats that exist to your business so having a network of people you can lean on is really important,” he says. “I think to be a good mentor, you’ve got to listen to the other person and help guide their thought process rather than just giving advice.”

---

---

https://www.securitymagazine.com/articles/100961-josh-phillips-most-influential-people-in-security

Networking hardware-maker Zyxel is warning of nearly a dozen vulnerabilities in a wide array of its products. If left unpatched, some of them could enable the complete takeover of the devices, which can be targeted as an initial point of entry into large networks.

The most serious vulnerability, tracked as CVE-2024-7261, can be exploited to “allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device,” Zyxel warned. The flaw, with a severity rating of 9.8 out of 10, stems from the “improper neutralization of special elements in the parameter ‘host’ in the CGI program” of vulnerable access points and security routers. Nearly 30 Zyxel devices are affected. As is the case with the remaining vulnerabilities in this post, Zyxel is urging customers to patch them as soon as possible.

But wait… there’s more

The hardware manufacturer warned of seven additional vulnerabilities affecting firewall series including the ATP, USG-FLEX, and USG FLEX 50(W)/USG20(W)-VPN. The vulnerabilities carry severity ratings ranging from 4.9 to 8.1. The vulnerabilities are:

CVE-2024-6343: a buffer overflow vulnerability in the CGI program that could allow an authenticated attacker with administrator privileges to wage denial-of-service by sending crafted HTTP requests.

CVE-2024-7203: A post-authentication command injection vulnerability that could allow an authenticated attacker with administrator privileges to run OS commands by executing a crafted CLI command.

CVE-2024-42057: A command injection vulnerability in the IPSec VPN feature that could allow an unauthenticated attacker to run OS commands by sending a crafted username. The attack would be successful only if the device was configured in User-Based-PSK authentication mode and a valid user with a long username exceeding 28 characters exists.

CVE-2024-42058: A null pointer dereference vulnerability in some firewall versions that could allow an unauthenticated attacker to wage DoS attacks by sending crafted packets.

CVE-2024-42059: A post-authentication command injection vulnerability that could allow an authenticated attacker with administrator privileges to run OS commands on an affected device by uploading a crafted compressed language file via FTP.

CVE-2024-42060: A post-authentication command injection vulnerability that could allow an authenticated attacker with administrator privileges to execute OS commands by uploading a crafted internal user agreement file to the vulnerable device.

CVE-2024-42061: A reflected cross-site scripting vulnerability in the CGI program “dynamic_script.cgi” that could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. The attacker could obtain browser-based information if the malicious script is executed on the victim’s browser.

The remaining vulnerability is CVE-2024-5412 with a severity rating of 7.5. It resides in 50 Zyxel product models, including a range of customer premises equipment, fiber optical network terminals, and security routers. A buffer overflow vulnerability in the “libclinkc” library of affected devices could allow an unauthenticated attacker to wage denial-of-service attacks by sending a crafted HTTP request.

In recent years, vulnerabilities in Zyxel devices have regularly come under active attack. Many of the patches are available for download at links listed in the advisories. In a small number of cases, the patches are available through the cloud. Patches for some products are available only by privately contacting the company’s support team.

https://arstechnica.com/?p=2047312

OPSWAT and Dark Survey collaborated on a survey revealing IT and corporate leadership concerns about organizational preparedness. Survey responses indicate a lack of preparedness for evolving cybersecurity threats, as only 25% of respondents feel their organization is fully equipped to manage DDoS attacks. For threats such as botnets, Advanced Persistent Threats (APTs), API security issues and zero-day malware, the expressed preparedness level is even lower. 

Many respondents report experiencing attacks as well. These include: 

• 24% experienced a compromised contractor, vendor or other third party. 
• 28% experienced unauthorized account access or credential theft. 
• 35% experienced a malware breach. 

Furthermore, IT leaders report feelings of inadequate support from organizations. These feelings often stem from budget shortages, poor staff training, inadequate technical partnerships, contrasting security ecosystems and vendors, and lacking attention from management. 

https://www.securitymagazine.com/articles/101002-only-25-of-organizations-are-prepared-to-manage-a-ddos-attack

Set 04, 2024 Marina Londei Attacchi, Minacce, News, RSS 0

---

I ricercatori di Unit42 di Palo Alto Networks hanno scoperto che un gruppo di cybercriminali sta usando istanze false di GlobalProtect, il software VPN della compagnia, per distribuire una variante di WikiLoader.

Gli attaccanti sfruttano il SEO poisoning per portare gli utenti a visitare siti web fraudolenti e scaricare falsi installer di GlobalProtect contenenti il loader con l’obiettivo di eseguire altri payload malevoli.

I cybercriminali sfruttano soprattutto annunci pubblicitari per attirare l’attenzione delle vittime e clonano siti web di business legittimi, compreso quello di Palo Alto Networks, per far scaricare l’installer malevolo. L’eseguibile, chiamato GlobalProtect64.exe, è in realtà una copia rinominata di una nota applicazione di share trading che gli attaccanti usano per effettuare il sideloading del primo componente di WikiLoader. Una volta eseguito il primo componente, viene caricato il modulo malevolo per l’esecuzione del malware.

Per rendere più credibile la finta installazione di GlobalProtect, alla fine dell’infezione il loader mostra un messaggio d’errore che comunica all’utente che c’è stato un problema durante l’installazione del programma; in questo modo, la vittima non si chiede come mai il software non è presente sul suo computer.

WikiLoader installa anche una backdoor per permettere agli attaccanti di mantenere il controllo sul dispositivo. Per eludere i controlli, la backdoor viene cifrata usando come chiave il nome della cartella dove è contenuto il suo eseguibile.

WikiLoader sotto le spoglie di GlobalProtect

WikiLoader, un “loader for rent”, è attivo almeno da fine 2022 e inizialmente veniva distribuito tramite tecniche di phishing. Secondo i ricercatori di Palo Alto Networks, il malware è legato a un gruppo cybercriminale noto come TA544. Lo scorso anno il malware ha colpito anche numerose aziende in Italia, nella maggior parte dei casi per aprire la strada all’esecuzione di ransomware.

Non è ancora chiaro come mai gli attaccanti siano passati dal phishing al SEO poisoning per distribuire WikiLoader; una delle ipotesi è che sia subentrato un altro gruppo a TA544, ma è anche possibile che i cybercriminali abbiano modificato le proprie tecniche di distribuzione dopo un diffuso miglioramento dei servizi di protezione degli endpoint.

“Anche se il SEO poisoning non è una tecnica nuova, continua a essere un modo efficace per distribuire un loader tramite endpoint. Lo spoofing di software di sicurezza affidabili è utile per aggirare i controlli degli endpoint nelle organizzazioni che si affidano all’elenco dei permessi basato sui nomi dei file” spiegano i ricercatori di Unit42.

Stando all’analisi del team, questa campagna sta colpendo per lo più realtà dei settori dei trasporti e dell’educazione universitaria negli Stati Uniti, ma l’uso del SEO poisoning ha quasi certamente ampliato il raggio d’azione degli attaccanti.

Il team consiglia ai clienti di Palo Alto Networks di installare i servizi di firewall e XDR messi a disposizione dall’azienda e sfruttare il Cloud Security Agent di Prisma Cloud per individuare l’eventuale presenza dei binari di WikiLoader.

---

---

---

https://www.securityinfo.it/2024/09/04/cybercriminali-usano-software-globalprotect-falsi-per-distribuire-il-malware-wikiloader/?utm_source=rss&utm_medium=rss&utm_campaign=cybercriminali-usano-software-globalprotect-falsi-per-distribuire-il-malware-wikiloader

Set 04, 2024 Marina Londei In evidenza, Minacce, News, Prodotto, RSS 0

---

I cybercriminali stanno traendo molti vantaggi dall’intelligenza artificiale e negli ultimi anni gli attacchi e le frodi basati su questa tecnologia sono aumentati costantemente. Per aiutare le imprese a proteggersi dalle nuove minacce, Trend Micro ha annunciato nuove funzionalità per contrastare deepfake e attacchi basati su IA.

Stando all’ultima analisi della compagnia, i tool basati sulle nuove tecnologie sono sempre più economici e accessibili e permettono a qualsiasi cybercriminale di sferrare attacchi su vasta scala, senza particolari sforzi o conoscenze.

“La nostra analisi più recente ha rivelato strumenti deepfake di nuova generazione che consentono a qualsiasi cybercriminale di orchestrare truffe sofisticate e attacchi di ingegneria sociale, eludendo i sistemi di sicurezza più avanzati” ha dichiarato Alessio Agnello, Direttore Tecnico di Trend Micro Italia.

Sono soprattutto i deepfake a spaventare le persone: il 71% degli intervistati da li vede in modo negativo e ritiene che vengano usati per lo più nelle frodi. Trend Micro sottolinea che questa tecnologia di manipolazione è un rischio molto serio per imprese e individui: un deepfake ben realizzato può causare danni finanziari, perdita di posti di lavoro, danni alla reputazione, furti d’identità e anche problemi di salute mentale e fisica.

Per rilevare e fermare più facilmente queste minacce, Trend Micro ha annunciato una nuova tecnologia di rilevamento di deepfake già disponibile nella versione consumer di Trend Micro Deepfake Inspector e a breve anche nella piattaforma Trend Vision One. Deepfake Inspector viene usato nelle conversazioni video per capire se uno o più dei partecipanti usa la tecnologia deepfake ed eventualmente notificarlo agli altri utenti.

“Siamo in prima linea nella lotta contro queste minacce e, grazie alle nostre nuove funzionalità per il rilevamento dei deepfake e altre frodi basate sull’AI, permettiamo ai nostri clienti di rimanere sempre al sicuro. Come abbiamo sempre fatto, monitoriamo attentamente le evoluzioni nel panorama delle minacce e del mondo IT. Oggi, ci siamo impegnati a proteggere l’intelligenza artificiale e abbiamo dimostrato di essere all’altezza della sfida” ha concluso Agnello.

Per rafforzare la protezione contro gli attacchi di IA, Trend Micro ha rilasciato inoltre nuove funzionalità per Vision One progettate per centralizzare la gestione dell’accesso e dell’uso di GenAI, ispezionare le richieste per prevenire fughe di dati, filtrare i contenuti GenAI e difendersi dagli attacchi basati su LLM.

---

---

---

https://www.securityinfo.it/2024/09/04/da-trend-micro-nuove-funzionalita-per-contrastare-i-deepfake/?utm_source=rss&utm_medium=rss&utm_campaign=da-trend-micro-nuove-funzionalita-per-contrastare-i-deepfake

The Cybersecurity and Infrastructure Security Agency (CISA) announced its Voluntary Cyber Incident Reporting portal is now live. This portal is part of an ongoing effort to support cyber incident reporting, providing users with resources to help them understand who should report cyber events, when and why these incidents should be reported, what to report, and how to report. Additionally, CISA is providing resources to help entities reduce cyber risk. 

Callie Guenther, Senior Manager, Cyber Threat Research at Critical Start, comments, “The launch of CISA’s Voluntary Cyber Incident Reporting portal marks a critical step in enhancing the United States’ cybersecurity efforts by encouraging organizations to report incidents proactively. This portal addresses the long-standing challenge of underreporting, driven by concerns over reputational damage and regulatory repercussions. By offering a secure and voluntary reporting mechanism, CISA aims to collect real-time data that will improve threat intelligence and incident response. 

“The portal fosters trust between the public and private sectors, making entities more likely to participate and share valuable information. The necessity of this portal is underscored by the increasingly complex cyber threat landscape, where timely reporting can significantly impact national security. Additionally, the portal may influence future regulatory frameworks, encouraging organizations to report incidents now to stay ahead of potential compliance requirements. Overall, this tool is crucial for improving both immediate responses to cyber incidents and long-term strategic planning.” 

Although this portal by the CISA is intended to improve incident reporting, some security experts question how effective it will truly be. Heath Renfrow, Co-founder or Fenix24, remarks, “I appreciate what CISA is trying to do. With the majority of cyberattacks never being publicly disclosed, there is a lot of intelligence being missed. However, I do not believe there will be much use for this portal due to legal liability and reputational concerns. This database will be a big target for threat actors who want to embarrass the federal government. Imagine being able to breach a database where companies anonymously share their cyberattack details, and a threat actor threatening to leak that info to the world. The incident response community has all the same information CISA has and consists of the experts brought into cyber incidents (lawyers, data forensics, negotiations, communications and recovery). These are probably the partners CISA should be looking to for intelligence, rather than the everyday victim.”

Nonetheless, many security leaders believe this is a step in the right direction. Mr. Agnidipta Sarkar, Vice President CISO Advisory at ColorTokens, states, “One of the key challenges we face is the lack of transparency amongst the affected organizations and the lack of clarity on how an attack happened and what could be done to address it foundationally. For example, when we reviewed the top 5 OT cyber-attacks, we realized that almost every company was compelled to shut down their systems as a first response, for some, it was planned, and for most others, it was the first thing their collective intelligence could think about. Today we know that if they had planned for cyber defense and become breach-ready by intelligently zoning and micro-segmenting, they could have continued business operations while quarantining the cyber-attack as a planned action. 

“We laud this initiative by CISA, and we hope that affected organizations can learn from each other to form a larger community to build breach readiness as an inherent capability to take the first step to combat the cyber attacking economy. This initiative can succeed only if Federal and non-Federal agencies come together to build breach-ready cyber defense capabilities that can positively impact the economy, public health, and national security.”

https://www.securitymagazine.com/articles/101000-security-experts-discuss-cisas-cyber-incident-reporting-portal

Ransomware threats were analyzed in a recent report by Searchlight Cyber. The report shows how one of the biggest ransomware groups (BlackCat) ceased operations, a new gang (RansomHub) emerged in February and quickly established itself as the third most prolific ransomware group, and outlines the effects of devastating attacks executed against organizations.

Other highlights of the report include:

• A 56% increase in the number of active ransomware groups compared to H1 2023, reflecting a diversification of the ransomware landscape.
• LockBit has retained its top position in spite of the disruption of Operation Cronos, though its number of listed victims has decreased compared to H1 2023.
• BlackCat and Cl0p have forfeited their top five rankings, with Play, RansomHub, BlackBasta, and 8Base filling the top slots behind LockBit.
• The emergence of RansomHub, a new ransomware group that quickly established itself as the third most prolific group, despite it emerging in February.
• A decline in the overall number of listed ransomware victims compared to H2 2023, indicating that law enforcement operations may be beginning to curb ransomware activities.
• The continued dominance of the Ransomware-as-a-Service (RaaS) model among the most active groups.

Read the report

https://www.securitymagazine.com/articles/101003-there-was-a-56-increase-in-ransomware-groups-in-h1-2024

In the dynamic world of cybersecurity, identity and access management (IAM) is a pivotal foundation. Ensuring that only authorized individuals and systems can access company resources is imperative. Unfortunately, while many organizations excel at managing human identities, they often need to pay more attention to a growing and potentially more hazardous category of digital actors known as non-human identities (NHIs). These unseen entities, which include service accounts, APIs, bots, and more, are rapidly multiplying, leading to an extensive attack surface that is largely overlooked and thus inadequately safeguarded.

The rise and risks of non-human identities

An NHI is a digital identity that represents machines, applications or services within a digital environment. These identities are integral to machine-to-machine communication, which powers everything from IT automation to cloud services. Unlike human identities, NHIs operate based on predefined algorithms and scripts, often without direct human supervision. This autonomy allows them to perform tasks at speeds and scales far beyond human capability, but it also amplifies the risks associated with their compromise.

Technological advances such as cloud computing, DevOps methodologies and the Internet of Things (IoT) are responsible for the growing number of NHIs. Each new service, device or application added to the enterprise environment typically brings with it a new set of NHIs. This rapid expansion has made it nearly impossible for organizations to keep track of all their non-human entities, resulting in an environment where NHIs often operate in the shadows — out of sight and out of mind.

Cybersecurity implications

NHIs present unique challenges that differ significantly from those of human identities. One significant challenge is that NHIs often have deeper and broader access to critical systems, making them high-value targets for attackers. Adding to that risk is the fact that many NHIs rely on static credentials, such as API keys or passwords, that are rarely updated. This increases the likelihood of a bad actor exploiting these credentials.

The velocity at which NHIs operate also increases the potential for damage. Once compromised, an NHI can move laterally across a network, executing tasks and accessing data at a speed that human responders may struggle to counteract. The automated and continuous nature of NHI operations means that the window of opportunity for attackers is much larger than it is for human identities, which are typically active only during defined work hours.

Moreover, NHIs often exist in environments where they are not closely monitored. This lack of visibility presents a significant risk factor, as detecting a compromised NHI can be challenging. Consequently, organizations face a growing “shadow IT” problem, where they are often unaware of the full extent of their NHI footprint, let alone how to secure it effectively.

Compliance and reputational risks

In addition to the cybersecurity risks, NHIs also pose serious compliance challenges. Regulatory frameworks such as GDPR, HIPAA and Sarbanes-Oxley mandate strict identity and access management controls. However, these regulations were primarily designed with human identities in mind. As a result, organizations that fail to extend these controls to NHIs risk falling out of compliance, which can lead to hefty fines and reputational damage.

High-profile breaches involving NHIs have already demonstrated the potential consequences. For example, the 2023 Cloudflare breach exposed the vulnerabilities associated with poor NHI management. Attackers gained access to sensitive data by compromising service accounts (a type of NHI), highlighting the urgent need for more stringent controls and monitoring of these identities.

Best practices for managing NHIs

Given the unique risks and challenges associated with NHIs, organizations must adopt a proactive approach to managing these identities. The following best practices can help mitigate the risks:

1. Comprehensive inventory and visibility: The first step in managing NHIs is to gain complete visibility into their presence and activity within the enterprise. This involves conducting regular audits of directory services and maintaining an up-to-date inventory of all NHIs. Specialized tools can assist in discovering and cataloging these identities, making tracking and managing them easier.
2. Lifecycle management and automation: NHIs often have different life cycles than human identities, with some existing only temporarily. Organizations should implement automated processes for the creation, management and de-provisioning of NHIs. This reduces the risk of orphaned identities and ensures that permissions are revoked when no longer needed. Lifecycle management must include a strategy for defining ownership of each NHI so that the reason the NHI exists is understood and accountability for who controls the NHI is established.
3. Privileged access management (PAM): NHIs frequently require elevated permissions to perform their tasks, but these privileges should be tightly controlled. A PAM solution can enforce the principle of least privilege, ensuring that NHIs only have access to what they need when they need it. PAM can also automate credential rotation and implement Just-In-Time (JIT) access, further reducing the risk of credential misuse.
4. Zero trust architecture: Applying a zero trust approach to NHIs involves continuously validating their access rights based on contextual factors such as time, location, and behavior. This ensures that NHIs are not granted perpetual access and that their activities are closely monitored for any signs of compromise.
5. Policy and governance frameworks: To ensure consistency in NHI management, organizations should integrate NHI-specific policies into their broader identity governance frameworks. This includes assigning clear ownership of NHIs, defining approval workflows and establishing naming conventions that facilitate easy identification and control.

The time to act

As the digital landscape continues to evolve, the proliferation of non-human identities will only accelerate. Organizations that fail to recognize and address the unique risks these invisible actors pose do so at their peril. By adopting a comprehensive approach to NHI management — including visibility, accountability, PAM, zero trust and strong governance — enterprises can mitigate the risks and strengthen their overall cybersecurity posture. The time to act is now… before the invisible dangers of NHIs become the next headline-grabbing breach.

https://www.securitymagazine.com/articles/101001-managing-the-invisible-risk-of-non-human-identities

There’s long been a debate in baseball circles about the respective benefits and drawbacks of using wood bats versus metal bats. However, there are relatively few scientific studies on the topic that focus specifically on young athletes, who are most likely to use metal bats. Scientists at Washington State University (WSU) conducted their own tests of wood and metal bats with young players. They found that while there are indeed performance differences between wooden and metal bats, a batter’s skill is still the biggest factor affecting how fast the ball comes off the bat, according to a new paper published in the Journal of Sports Engineering and Technology.

According to physicist and acoustician Daniel Russell of Penn State University—who was not involved in the study but has a long-standing interest in the physics of baseball ever since his faculty days at Kettering University in Michigan—metal bats were first introduced in 1974 and soon dominated NCAA college baseball, youth baseball, and adult amateur softball. Those programs liked the metal bats because they were less likely to break than traditional wooden bats, reducing costs.

Players liked them because it can be easier to control metal bats and swing faster, as the center of mass is closer to the balance point in the bat’s handle, resulting in a lower moment of inertia (or “swing weight”). A faster swing doesn’t mean that a hit ball will travel faster, however, since the lower moment of inertia is countered by a decreased collision efficiency. Metal bats are also more forgiving if players happen to hit the ball away from the proverbial “sweet spot” of the bat. (The definition of the sweet spot is a bit fuzzy because it is sometimes defined in different ways, but it’s commonly understood to be the area on the bat’s barrel that results in the highest batted ball speeds.)

“There’s more of a penalty when you’re not on the sweet spot with wood bats than with the other metal bats,” said Lloyd Smith, director of WSU’s Sport Science Laboratory and a co-author of the latest study. “[And] wood is still heavy. Part of baseball is hitting the ball far, but the other part is just hitting the ball. If you have a heavy bat, you’re going to have a harder time making contact because it’s harder to control.”

Metal bats may also improve performance via a kind of “trampoline effect.” Metal bats are hollow, while wood bats are solid. When a ball hits a wood bat, the bat barrel compresses by as much as 75 percent, such that internal friction forces decrease the initial energy by as much as 75 percent. A metal bat barrel behaves more like a spring when it compresses in response to a ball’s impact, so there is much less energy loss. Based on his own research back in 2004, Russell has found that improved performance of metal bats is linked to the frequency of the barrel’s mode of vibration, aka the “hoop mode.” (Bats with the lowest hoop frequency will have the highest performance.)

https://arstechnica.com/?p=2046697