A judge in Ohio has issued a temporary restraining order against a security researcher who presented evidence that a recent ransomware attack on the city of Columbus scooped up reams of sensitive personal information, contradicting claims made by city officials.

The order, issued by a judge in Ohio’s Franklin County, came after the city of Columbus fell victim to a ransomware attack on July 18 that siphoned 6.5 terabytes of the city’s data. A ransomware group known as Rhysida took credit for the attack and offered to auction off the data with a starting bid of about $1.7 million in bitcoin. On August 8, after the auction failed to find a bidder, Rhysida released what it said was about 45 percent of the stolen data on the group’s dark web site, which is accessible to anyone with a TOR browser.

Dark web not readily available to public—really?

Columbus Mayor Andrew Ginther said on August 13 that a “breakthrough” in the city’s forensic investigation of the breach found that the sensitive files Rhysida obtained were either encrypted or corrupted, making them “unusable” to the thieves. Ginther went on to say the data’s lack of integrity was likely the reason the ransomware group had been unable to auction off the data.

Shortly after Ginther made his remarks, security researcher David Leroy Ross contacted local news outlets and presented evidence that showed the data Rhysida published was fully intact and contained highly sensitive information regarding city employees and residents. Ross, who uses the alias Connor Goodwolf, presented screenshots and other data that showed the files Rhysida had posted included names from domestic violence cases and Social Security numbers for police officers and crime victims. Some of the data spanned years.

On Thursday, the city of Columbus sued Ross for alleged damages for criminal acts, invasion of privacy, negligence, and civil conversion. The lawsuit claimed that downloading documents from a dark web site run by ransomware attackers amounted to him “interacting” with them and required special expertise and tools. The suit went on to challenge Ross alerting reporters to the information, which ii claimed would not be easily obtained by others.

“Only individuals willing to navigate and interact with the criminal element on the dark web, who also have the computer expertise and tools necessary to download data from the dark web, would be able to do so,” city attorneys wrote. “The dark web-posted data is not readily available for public consumption. Defendant is making it so.”

The same day, a Franklin County judge granted the city’s motion for a temporary restraining order against Ross. It bars the researcher “from accessing, and/or downloading, and/or disseminating” any city files that were posted to the dark web. The motion was made and granted “ex parte,” meaning in secret before Ross was informed of it or had an opportunity to present his case.

In a press conference Thursday, Columbus City Attorney Zach Klein defended his decision to sue Ross and obtain the restraining order.

“This is not about freedom of speech or whistleblowing,” he said. “This is about the downloading and disclosure of stolen criminal investigatory records. This effect is to get [Ross] to stop downloading and disclosing stolen criminal records to protect public safety.”

The Columbus city attorney’s office didn’t respond to questions sent by email. It did provide the following statement:

The lawsuit filed by the City of Columbus pertains to stolen data that Mr. Ross downloaded from the dark web to his own, local device and disseminated to the media. In fact, several outlets used the stolen data provided by Ross to go door-to-door and contact individuals using names and addresses contained within the stolen data. As has now been extensively reported, Mr. Ross also showed multiple news outlets stolen, confidential data belonging to the City which he claims reveal the identities of undercover police officers and crime victims as well as evidence from active criminal investigations. Sharing this stolen data threatens public safety and the integrity of the investigations. The temporary restraining order granted by the Court prohibits Mr. Ross from disseminating any of the City’s stolen data. Mr. Ross is still free to speak about the cyber incident and even describe what kind of data is on the dark web—he just cannot disseminate that data.

Attempts to reach Ross for comment were unsuccessful. Email sent to the Columbus mayor’s office went unanswered.

As shown above in the screenshot of the Rhysida dark web site on Friday morning, the sensitive data remains available to anyone who looks for it. Friday’s order may bar Ross from accessing the data or disseminating it to reporters, but it has no effect on those who plan to use the data for malicious purposes.

https://arstechnica.com/?p=2046614

The Cybersecurity and Infrastructure Security Agency (CISA) partnered with the National Association of Secretaries of State (NASS) and National Association of State Election Directors (NASED) to host a tabletop security exercise to improve election security. This exercise, titled Tabletop the Vote, has been held in previous years. This year marks its seventh annual exercise. 

This tabletop security exercise unites private sector partners as well as federal, state and local officials to enhance election security efforts. Participants in the exercise shared best practices for incident planning, preparation, identification, response and recovery for both cyber and physical incidents. 

CISA Director Jen Easterly, and the Election Infrastructure Subsector Government Coordinating Council (EIS-GCC) Executive Committee issued a joint statement on the collaborative exercise: 

“Tabletop the Vote provides an opportunity for the election community as a whole to plan for potential scenarios and improve our response plans within the safety of a training environment. Exercises like this allow us to prepare for incidents that occur before, during, and after an election and better understand response and recovery efforts. They also assist us in identifying how to best tackle today’s increasingly complex threat environment by refining communication and intelligence sharing practices, and identifying potential process improvements. Tabletop the Vote is just one example of the ongoing efforts of state and local election officials and the federal government to ensure the security and resilience of America’s most critical democratic process.”

The group concludes, “Elections are run by the thousands of state and local election officials nationwide who work diligently to administer elections that are secure and resilient. It is because of their hard work Americans can have confidence in our nation’s elections.”

https://www.securitymagazine.com/articles/100994-cisa-and-partners-host-security-exercise-to-improve-election-security

Professionals in the cybersecurity field recognize September 1, 2024, as International Women in Cyber Day. 

“Celebrating women in cyber is an important way to recognize the invaluable contributions women make to the cybersecurity industry,” says Lynn Dohm, Executive Director of Women in Cybersecurity (WiCyS). “We’ve made tremendous progress in training and mentoring women in cybersecurity. Now, the industry must work to create inclusive environments that enable women to succeed and advance in cybersecurity roles.”

Progress has been made to elevate women in the field of cybersecurity; yet, there are still challenges in the industry for women. Dohm explains, “Women bring outstanding skills and knowledge to cybersecurity, frequently outperforming their colleagues in all seven NICE categories and at all experience levels. Unfortunately, it is estimated that the number of women in cyber is in the range of just 20% to 25%, a percentage that hasn’t changed in years. Even more concerning, women experience a significant lack of advancement opportunities, and the exclusion rate is higher than in most industries. Indeed, women hit a glass ceiling just six to ten years into their cybersecurity career, despite outperforming peers in communications and network security (60.6%), cyber workforce training and awareness (62.3%), cyber/IT leadership and management (64%), and cyber/IT policy and governance (64.3%).”

The importance of representation in cybersecurity

“Throughout my cybersecurity career, I’ve learned that focusing on skills and knowledge is far more impactful than focusing on gender. My approach has always been to deepen my expertise, ensuring my work speaks for itself,” remarks Isabel Castillo, Cloud Security Analyst at Lastwall. “What’s crucial, though, is visibility and representation in the industry.”

Visibility and representation sends a quiet yet clear message about who the industry accepts in cyber roles. When women are underrepresented, it is implied that women are not welcomed.

Castillo says, “The underrepresentation of women in tech-related fields sends a subtle yet powerful message about who belongs in these roles. To challenge this, the industry must actively highlight and celebrate the achievements of women in cybersecurity. This effort isn’t just for the benefit of young girls; it’s equally important for boys to see women thriving in these spaces. By doing so, we can shift perceptions and foster an environment where everyone, regardless of gender, is encouraged and supported to pursue careers in tech. The future of cybersecurity depends on diverse perspectives, and this begins with changing the narrative around who can excel in this field.”

How to dismantle gender inequality in cybersecurity 

While gender inequality in a professional field cannot be deconstructed overnight, there are ways for security professionals to act against it. No matter how influential one is in their organization, they can still acknowledge and address gender bias in the workforce. Nicole Sundin, CPO at Axio, breaks down some ways cyber professionals can recognize and respond to gender inequality in the workplace. 

How security leaders can act

Security leaders can use their authority in the workplace to support and uplift the women they work alongside. Sundin states, “It’s sad to say, but the pay discrepancy between men and women still exists. As a leader in your organization, you must ask for transparency around this issue, advocate for others and hold management accountable.”

In addition to advocating for equal pay, those in a position of authority can leverage it to ensure women are given equal professional development opportunities.

“Women mentoring women is one of the best ways to help equalize leadership in the workplace,” Sundin asserts. “Women in leadership have an obligation to mentor other women, guide and listen to problems and help elevate them in the workforce.”

How individuals can act

For those who do not currently find themselves in a leadership position, there are still ways to promote gender equality in cyber professions. Sundin comments, “Every woman has been in a position where their ideas or point of view is either co-opted or restated for credit by one a male counterpart. Call it out and take credit for your work and ideas.”

Recognizing International Women in Cyber Day

This International Women in Cyber Day is a chance for cyber professionals to recognize the progress made for women in the industry while acknowledging the setbacks they still face. 

Dohm concludes, “International Women in Cyber Day is an opportunity to call attention to the many skills women bring to the table, acknowledge the issues they face and identify ways the industry can become more inclusive. Adding diverse perspectives to the cybersecurity field will enable us to address evolving threats and close an ongoing workforce gap. We all succeed by having allies who actively disrupt the status quo and advocate for diverse talent in the field. To effectively guide women on their cybersecurity journey, we must focus on building connections, sharing knowledge and learning from experienced professionals already in the field to make a significant impact in this industry.”

https://www.securitymagazine.com/articles/100993-challenges-and-victories-women-see-in-cybersecurity

Ago 30, 2024 Marina Londei Approfondimenti, Attacchi, Attacchi, In evidenza, News, RSS 0

---

La diffusione dell’intelligenza artificiale sta cambiando il mondo del lavoro e offrendo nuove opportunità di innovazione, ma anche ampliato la superficie di attacco: i cybercriminali non si sono fermati un attimo e negli ultimi due anni hanno ideato nuovi exploit e tecniche di attacco che sfruttano le vulnerabilità dei chatbot e altri tool di IA.

In un post sul suo blog, il ricercatore di sicurezza wunderwuzzi ha illustrato un exploit contro Microsoft 365 Copilot che, a partire dalla prompt injection, permette di esfiltrare i dati sensibili di un utente.

Il ricercatore ha spiegato che il copilota di produttività è vulnerabile a prompt injection da contenuti di terze parti, per esempio quando deve processare email e documenti. Nel dettaglio, l’attaccante ha condiviso col chatbot un documento Word con comandi specifici per trasformare Copilot in “Microsoft Defender per Copirate”, uno strumento di scam ampiamente usato.

In uno degli esempi condivisi, il ricercatore mostra il testo di un’email che viene fatto analizzare dal chatbot in cui si ordina al tool di cercare un’email con titolo “Slack confirmation code” per poi inviare il risultato a una pagina controllata dall’attaccante.

Ottenuto il controllo del tool, l’attaccante può sfruttare una nuova tecnica chiamata “ASCII Smuggling” che usa caratteri Unicode speciali simili agli ASCII ma non visibili nell’interfaccia utente; ciò significa che il cybercriminale può fare in modo che il chatbot scriva questi caratteri invisibili in risposta all’utente e li integri in link cliccabili. A questo punto, se l’utente clicca sul link, i dati vengono inviati al server malevolo.

Wunderwuzzi ha individuato la catena di attacco a inizio anno e ha contattato immediatamente Microsoft condividendogli tutti i dettagli dell’exploit, reso noto solo ora. Attualmente l’exploit non funziona più, anche se Microsoft non ha chiarito come ha risolto il problema. Il ricercatore ha sottolineato però che Copilot è ancora vulnerabile ad attacchi di prompt injection. 

---

---

---

https://www.securityinfo.it/2024/08/30/alcune-vulnerabilita-di-microsoft-copilot-portano-al-furto-di-dati-sensibili/?utm_source=rss&utm_medium=rss&utm_campaign=alcune-vulnerabilita-di-microsoft-copilot-portano-al-furto-di-dati-sensibili

The world of technology is abuzz with the potential of quantum computing — a report estimates the quantum computing market to balloon from $10.13 billion in 2022 to a staggering $125 billion by 2030, reflecting a powerful 36%+ compound annual growth rate (CAGR). These powerful machines promise to revolutionize fields like materials science, drug discovery and artificial intelligence. However, amidst the excitement lies a potential threat: quantum computers have the ability to break current encryption standards. This vulnerability has many organizations scrambling to find solutions.

While the threat from quantum computing is real, organizations should prioritize practical security measures with a focus on achieving quantum-resistant postures. Machine identity management, the process of managing the digital identities of devices and applications on a network, plays a vital role in this endeavor. By focusing on effective machine identity management practices that incorporate post-quantum cryptography wherever possible, organizations can build a strong foundation for security in both the present and the quantum future.

Addressing immediate security concerns 

While quantum computing holds immense potential, many organizations face more pressing security threats on a daily basis. Cyberattacks (including malware, ransomware, phishing attempts and denial-of-service attacks) are a constant menace. Traditional security measures like firewalls and intrusion detection systems are crucial, but they are not enough. This is where machine identity management comes in.

Machine identities, often in the form of digital certificates like Transport Layer Security (TLS) and code signing certificates, are the foundation of cybersecurity. They act as a digital ID, verifying the authenticity of software and applications on the Internet, cloud, network and device. When a device or application attempts to connect to a network resource, its machine identity is presented. The network then verifies the authenticity of this identity using cryptography. If the identity is valid, the connection is allowed. If not, the connection is denied. The same is when your mobile phone or cloud computer attempts to run an application. The machine identity is authenticated allowing the application to run. 

However, the effectiveness of this process hinges on securing machine identities. Weak or improperly managed machine identities can be exploited by attackers to gain unauthorized access to sensitive data or disrupt critical systems. For instance, an attacker could steal a valid certificate and use it to impersonate a legitimate cloud service, gaining access to confidential information or manipulating transactions.

By ensuring only authorized entities can access sensitive data, strong machine identity management practices significantly reduce the risk of unauthorized access and data breaches. Machine identity management goes beyond simply issuing certificates; it encompasses the entire lifecycle of a machine identity, from creation and deployment to renewal and revocation. This includes:

• Provisioning: Securely generating and issuing machine identities, ensuring they are unique and tamper-proof.
• Deployment: Distributing machine identities to devices and applications in a controlled manner.
• Lifecycle management: Renewing certificates before they expire and revoking them if they are compromised.
• Auditing and monitoring: Tracking machine identity usage and identifying potential security risks.

Effective machine identity management practices not only improve present-day security but also lay the groundwork for a smoother transition to post-quantum cryptography when it becomes necessary.

Building a foundation for the quantum era with post-quantum cryptography 

The arrival of large-scale quantum computers may not be imminent, but organizations cannot afford to be caught unprepared. Quantum computers have the theoretical capability to break current encryption standards, rendering them useless. This is why a proactive approach that embraces quantum-resistant cryptographic algorithms is essential.

Organizations can prepare for the quantum future by implementing strong automation and governance practices for their machine identities, with a specific focus on integrating PQC algorithms. Automation can streamline the process of issuing, renewing and revoking certificates that leverage PQC, freeing up security personnel to focus on more strategic tasks. Clear governance policies ensure consistent and secure management of these critical assets, specifically addressing PQC implementation. These policies should address issues such as:

• Who is authorized to request and issue quantum-resistant machine identities?
• What approval process is required for issuing high-risk certificates, especially those using PQC algorithms?
• How long are PQC-based certificates valid before they need to be renewed?
• What procedures should be followed if a machine identity is compromised, considering the potential for new attack vectors with PQC?

By laying this groundwork today, organizations will be better positioned to adapt to new post-quantum cryptography standards when they become necessary. The transition process will likely be complex, but organizations that have already established strong machine identity management practices with a focus on PQC will be at a significant advantage.

The importance of automation in machine identity management for a quantum-proof future

Automation plays a critical role in effective quantum-resistant machine identity management. Manual processes are slow, error-prone and difficult to scale. By automating tasks such as certificate issuance, renewal and revocation, especially for certificates leveraging PQC, organizations can improve efficiency and reduce the risk of human error during the transition to PQC. Additionally, automation can free up security personnel to focus on more strategic tasks, such as identifying and mitigating new security threats that may emerge in a post-quantum world.

The benefits of strong governance for quantum-proof machine identities

Governance policies provide a framework for managing machine identities in a consistent and secure manner, especially critical during the migration to quantum-resistant cryptography. These policies should address key areas such as:

• Role-based access control (RBAC): Defines who is authorized to perform different actions related to machine identities, such as requesting, issuing or revoking certificates. This ensures that only authorized personnel can access and modify critical machine identities.
• Separation of duties (SoD): Ensures that no single individual has complete control over the machine identity lifecycle. For example, the person who requests a certificate should not be the same person who approves it. This reduces the risk of fraud or abuse during the migration to PQC.
• Auditing and logging: Requires that all actions related to machine identities are logged and monitored. This allows for identification and investigation of potential security incidents. Additionally, audit logs can be used to demonstrate compliance with regulations.
• Inventory and discovery: Organizations need to have a complete and accurate inventory of all their machine identities. This includes knowing what devices and applications exist on the network, as well as the machine identities associated with them. Regular discovery processes help identify unauthorized devices or applications that may be using machine identities.

By implementing strong governance policies, organizations can ensure that their machine identities are managed securely and in accordance with best practices. This both improves present-day security and positions organizations for a smoother transition to a post-quantum future. Strong governance practices create a foundation of trust and accountability, essential for managing the complex ecosystem of machine identities in a secure and efficient manner.

https://www.securitymagazine.com/articles/100992-preparing-for-a-post-quantum-future-amid-machine-identities

Texas Dow Employees Credit Union (TDECU) experienced a data breach in which the personal information of more than 500,000 members was leaked. The breach occurred when a third-party vendor used for transferring data, MOVEit, was compromised on May 31, 2023. This breach impacted more than 20 million individuals.

TDECU states it investigated shortly after but found no evidence of a compromise. Then, on July 30, 2024, the organization discovered the loss of the files. The files in question contained information such as: 

• Birth dates
• Driver’s licenses and/or government IDs
• Credit or debit card numbers 
• Taxpayer identification numbers 
• Financial account numbers 
• Social Security numbers 

Security leaders weigh in 

Ken Dunham, Cyber Threat Director at Qualys Threat Research Unit:

“The MOVEit managed file transfer (MFT) software vulnerability (CVE-2023-34362) continues to be discussed in the news due to widespread exploitation and the depth of exploitation. Groups including the infamous Cl0p ransomware group quickly took advantage of this zero-day opportunity to exploit targets of interest for high-payouts. In the case of ransomware, involving double-extortion tactics, techniques and procedures (TTPs), it is common for a wealth of data to be stolen to force payout. Ransomware continues to be one of the most common and also highest impact threats facing every organization in 2024. 

“While we may tire from hearing about MOVEit updates in the news, it is critical to apply lessons learned to each organization — what can an organization do to proactively move to the “left of boom” to avoid exploitation, rapidly identify and remediate threats if an incident occurs, and best manage a disaster should one occur? Readiness is more than planning on paper, it requires regular testing, demonstrating TTPs and defensive measures, testing for operational excellence and gaps. It also requires running drills — blackbox, graybox and whitebox — to continually prepare and adjust to dynamic global threatscape risks to an organization.”

Darren Guccione, CEO and Co-Founder at Keeper Security:

“The sheer scope of the MOVEit breach is concerning, but what’s even more alarming is that the breach at Texas Dow Employees Credit Union (TDECU) went undetected for more than a year. This significant delay not only underscores the need for continuous monitoring and robust cybersecurity practices but also has severe implications for victims. The extended exposure of sensitive personal information — while victims remained unaware — significantly raises the risk of identity theft and financial fraud.

“The fact that TDECU’s breach remained undetected for so long highlights the critical importance of rigorous and continuous patch management. Multiple patches were released following the MOVEit breach, and with any breach of this scope, it is imperative that they be applied promptly. However, applying patches is just one part of the solution — systems must also be continuously monitored for any signs of unusual activity.”

“The MOVEit breach must remain top of mind for all security teams in the near future and should serve as a stark reminder of the importance of cybersecurity investment and prioritization. The extensive impact and the prolonged detection issues at TDECU highlight the need for ongoing attention to known vulnerabilities. Securing data transfers, particularly with third-party vendors, is vital, but so are strong internal security measures.

“To enhance long-term data protection, security teams should adopt a zero-trust architecture and implement comprehensive monitoring and detection capabilities. Limiting data collection to only essential information and enforcing strict access controls can reduce exposure and the likelihood of a breach. Additionally, a Privileged Access Management (PAM) platform can further safeguard against breaches (and reduce impact if they do happen) by closely monitoring privileged accounts, enforcing fine-grained authentication and preventing lateral movement within the network.”

Adam Gavish, Co-Founder and CEO at DoControl:

“The TDECU notification is yet another reminder of the far-reaching impact of the MOVEit breach. We’re likely to see these ripple effects continue for months, if not years. This long tail has two critical aspects we need to consider.

“First, there’s the ongoing vulnerability. Despite widespread awareness, we’re still seeing organizations slowly patching their MOVEit deployments. This creates a persistent risk, as attackers continue to probe for unpatched systems. Security teams need to prioritize identifying and patching any remaining vulnerable MOVEit instances immediately.

“Second, and perhaps more concerning, is the potential for delayed data leaks. Many organizations may not even realize their MOVEit deployment was compromised. This stolen data could surface on dark web forums or be used in targeted attacks months or even years down the line. It’s a ticking time bomb of potential breaches.

“The security of your data doesn’t end at your network perimeter. Companies need to conduct thorough audits of what data they’ve been transferring through MOVEit or similar file transfer services. Understanding what sensitive information might have been exposed is crucial for risk assessment and mitigation.

“Moving forward, security teams need to prioritize comprehensive visibility and control over their entire SaaS ecosystem. This includes not just the apps they directly use, but also the interconnected web of third-party services and data transfers. But it’s not just about tools. This incident highlights the need for a shift in mindset. Security teams need to operate under the assumption that breaches will happen, and focus on minimizing the potential impact. This means implementing strict data access controls, enforcing the principle of least privilege and continuously monitoring for unusual data movement or access patterns.

“The long tail of the MOVEit breach serves as a stark reminder: in today’s interconnected digital landscape, your security is only as strong as your weakest link. It’s time for a more proactive, data-centric approach to security that keeps pace with the realities of modern SaaS adoption and third-party data handling.”

https://www.securitymagazine.com/articles/100990-breach-exposed-information-of-more-than-500-000-credit-union-members

Research from Abnormal Security shows increased cybercrime activity in the educational sector, coinciding with the oncoming academic year. The data reveals more than 650,000 records across various educational institutions have been exposed in the last 60 days. 

The research describes key cyber incidents occurring throughout June and July: 

• June 13: Data breach exposes the information of data of 46,169 university students in the United States. 
• June 13: 576,735 elementary school teachers’ records were exposed. 
• July 10: 27,000 records (including stent and staff information) were posted online. 
• July 19: A $200 million IT system was breached, affecting 25,000 individuals. 

According to the research, the primary threat vector is phishing. Within the breaches noted, emails were a common target. As educational institutions begin a new academic year, remaining vigilant against potential mail threats is encouraged. 

https://www.securitymagazine.com/articles/100989-more-than-650-000-education-records-exposed-in-the-past-60-days

Managed service providers (MSP) security was analyzed in a recent report by Netwrix.

The report reveals that 76% of MSPs spotted a cyberattack on their infrastructure within the last 12 months, similar to the results among organizations overall (79%). Among those that were attacked, every second MSP (51%) had to deal with unplanned expenses to fix the security gaps. Moreover, 31% experienced a loss of competitive edge, and 27% faced compliance fines compared to 20% and 17% across other verticals.

For the MSP sector, each second security incident in the cloud (49%) was associated with user account compromise, while 46% of attacks on premises were ransomware or other malware attacks.

Read the report

https://www.securitymagazine.com/articles/100987-76-of-msps-faced-an-infrastructure-cyberattack-in-last-12-months

Ago 29, 2024 Marina Londei Approfondimenti, In evidenza, Minacce, Minacce, News 0

---

I rischi dei dispositivi obsoleti e non più supportati dai produttori vengono spesso sottovalutati, ma rappresentano in realtà una minaccia molto pericolosa e piena di sfaccettature.

Márk Szabó, autore per WeLiveSecurity, spiega che proprio quando il produttore di un device smette di rilasciare aggiornamenti, gli attaccanti trovano terreno fertile per sfruttare le vulnerabilità del dispositivo ed eseguire diversi tipi di attacchi.

Generalmente i device obsoleti vengono usati per creare delle botnet, reti di dispositivi zombie che eseguono i comandi dei cybercriminali, i quali mirano a ottenere informazioni sensibili, interrompere l’esecuzione di un servizio e potenzialmente danneggiare fisicamente le vittime.

Anche se i produttori indicano quali dispositivi non sono più supportati, gli utenti di solito continuano a usarli, in parte per una scarsa conoscenza dei rischi a cui si espongono e in parte perché non possono permettersi di acquistare subito un device sostitutivo.

Considerando che al momento ci sono circa 17 milioni di dispositivi IoT, un numero in crescita, e un terzo di essi diventerà obsoleto entro i prossimi cinque anni, è facile immaginarsi l’impatto delle campagne dei cybercriminali.

Negli ultimi anni si sta inoltre diffondendo un trend preoccupante dal punto di vista della sicurezza: molte persone hanno cominciato a riutilizzare vecchi dispositivi come iPad o smartphone trasformandoli in device IoT quali controller smart home o cornici smart per foto. Ciò non fa che incrementare la superficie di attacco a disposizione degli attaccanti: questi dispositivi non andrebbero connessi a internet proprio perché sono obsoleti e quindi vulnerabili.

I vecchi dispositivi contengono ancora informazioni sensibili che andrebbero eliminate non appena si smette di utilizzarli. Anche seguendo questa buona pratica di sicurezza si è comunque esposti ad attacchi DDoS: se connessi al web, i vecchi device possono comunque entrare a far parte di una botnet e spianare la strada agli attaccanti.

Szabó ricorda che le buone pratiche di sicurezza vanno applicate durante ogni fase del ciclo di vita di un dispositivo: mentre è in uso, ancora manutenuto dal produttore, vanno sempre installate le patch e gli aggiornamenti; in fase di dismissione o riutilizzo, è fondamentale cancellare qualsiasi dato sensibile ancora in memoria e possibilmente trovargli un uso che non richieda la connessione a internet.

---

---

---

https://www.securityinfo.it/2024/08/29/i-rischi-dei-dispositivi-iot-obsoleti-e-non-supportati/?utm_source=rss&utm_medium=rss&utm_campaign=i-rischi-dei-dispositivi-iot-obsoleti-e-non-supportati

As open-source AI tools become more accessible, ransomware attacks are growing increasingly sophisticated. Scammers are now using AI in targeted spear phishing attacks, where highly personalized information is used to gain access to medical or financial information. 

Financial service organizations are particularly at risk when it comes to these kinds of attacks — not only do they hold and exchange large sums of money, they also store and process highly sensitive information of their customers. 

The good news is that there are many steps that financial institutions can take to safeguard the data they store and protect their customers. AI is changing social engineering attacks, including the most common types of attacks on financial institutions, so following best practices can help ensure an organization is compliant and its customers can trust that their information is secure. 

How AI is changing social engineering attacks

Social engineering attacks have almost doubled in recent years, accounting for 17% of all data breaches. Historically, email phishing attempts have been easy to spot because they are often riddled with spelling and grammatical errors and the email address they come from does not always look like it’s from the respective organization. Now, using generative AI like ChatGPT, attackers can create phishing emails that look very credible and are unlikely to be caught by spam filters. 

In even more sophisticated scams, attackers can use deepfakes to imitate someone’s colleagues or trusted partners. Earlier this year, a finance worker at a multinational firm in Hong Kong was duped into transferring $25 million to scammers who used deepfakes to pose as the company’s chief financial officer in a video call. 

Data breaches, account hacking, online banking fraud and phishing scams are the most common forms of cyber attacks on financial institutions and they are only increasing in frequency and becoming more advanced with AI. Ensuring a business is compliant with the most up-to-date security regulations is the best way to safeguard the highly sensitive data of customers. 

How compliance automation protects data

Regulatory guidelines and industry standards like ISO 27001:2022, PCI DSS 4.0.1 and NIST CSF 2.0 can help companies establish strong internal security controls and processes that reduce the likelihood of cyber attacks. Compliance activities, such as risk assessments and security awareness training, help keep employees informed about critical business risks. These activities also assist in identifying procedural redundancies and ensure that all staff members are properly trained to protect sensitive data.

Compliance automation can significantly accelerate tasks that will build and maintain a strong security posture such as evidence collection, centralizing compliance data and monitoring security controls. Many compliance automation tools also flag vulnerabilities and failing controls, enabling proactive remediation. This is particularly critical for financial institutions, as catching and fixing vulnerabilities quickly means saving highly sensitive data from being exposed.  

How third-party risk management can improve security posture

Financial firms often rely on third-party service providers, which can improve operational efficiency, but also expose the firm to attacks. 77% of financial organizations detected a cyberattack in the last year alone. Practicing due diligence, continuous monitoring and creating vendor management policies can help ensure all vendors are complying with strict cybersecurity protocols.

When considering whether to work with a new vendor, security leaders should ask them about their encryption practices or use of an intrusion detection system (IDS) to better understand their security practices. Leaders should also ask about client offboarding processes to understand how data will be disposed of once the vendor relationship concludes. After these assessments, rank vendors based on the sensitivity of the data they handle so more control can be used with high-risk vendors.

Creating sound vendor management policies will help ensure vendors are aligned with an organization’s security requirements, risk tolerance and compliance standards. Every vendor’s contract should include security requirements, incident reporting protocols and compliance obligations. 

How AI and automation can help prevent cyber attacks

Even though AI is increasingly used in social engineering attacks, it can also be used to protect against them. Organizations that use security AI and automation were able to identify and contain a data breach an average of 108 days faster and saw cost savings of nearly $1.8 million compared to companies that do not use AI or automation for security at all.

AI can analyze emails to identify phishing attempts and monitor user behavior to detect social engineering attacks in progress. Additionally, it can customize security awareness training for individual users based on their roles, behaviors and past interactions with potential threats, thereby enhancing the effectiveness of security training.

However, while AI and automation can be incredibly useful in cybersecurity, it’s important to note that the compliance process cannot be entirely automated. Much of the evidence collection, policy management and other tasks required by a compliance framework can be automated. However, security threats are extremely nuanced and complex, necessitating the involvement of a security expert.

Human experts are your the valuable resource when it comes to defending against security threats. A security team brings contextual understanding to incidents because they know the significance of certain events based on the organization’s infrastructure and threat history. A security team should always check the work of any automated solution. 

As a financial institution, being proactive about cybersecurity is the only way to protect a business and its customers. By ensuring that both humans and technology are part of the defense plan, organizations can preserve customer trust, no matter how sophisticated cyber attacks become.  

https://www.securitymagazine.com/articles/100988-protecting-financial-institutions-in-the-era-of-ai-driven-threats