Private security staff help protect communities, businesses, public services, events, VIPs, residences and infrastructure. And the need is growing. Global spending on private security is projected to double from $241B in 2016 to $496B in 2028. In the United States, more than 1.2 million individuals work as security guards; globally, nearly 7.9 million do. 

However, there’s a significant shortage of these trained professionals, and it’s unlikely to get better. Precise information is hard to come by, but many companies say they’re unable to hire as many professionals as they need and are experiencing 100%-300% turnover yearly, meaning there is no opportunity to get ahead of the curve. While salaries certainly play a factor in retaining staff, employees may also feel unsafe and depart for jobs in less risky industries, such as e-commerce or food service. 

Physical security companies can use technology to augment human capabilities, helping meet the rising need for talent, skills and services. Technology can help scale the capabilities of small teams, minimize the risks security guards encounter on the job and empower them to do their jobs more efficiently and effectively. It could also help security companies attract and retain staff, as employees feel more protected as they work and can defend themselves against unwarranted accusations. 

Physical security companies that may have paused IT investments should rest assured that hardware is no longer as expensive as it once was, due to fast-paced development, market competition, global supply chains, and innovative SaaS pricing models. Meanwhile, software can help drive recurring revenue, providing rapid ROI and boosting margins.

Capabilities every physical security company should have 

If they haven’t already, security company leaders will want to consider:

Equipping guards with body cameras

Widely used by police forces, body cameras provide high-definition video and audio footage, even in low-light conditions, such as in dark buildings. They’re also being adopted by security companies and industry firms, such as retailers, experiencing more conflictual encounters with the public. Employees wearing body cameras are more accountable for their actions, which they know are being recorded. Body cameras also help de-escalate conflicts, as would-be aggressors know their footage can be used for criminal cases. They further help prevent or end lawsuits, as a visual audit trail with time and date stamping and an audio narrative vanquish spurious claims.

Deploying AI-powered surveillance

It may not always be practical to deploy human talent for monitoring and surveillance. For example, organizations with large campuses or remote locations may not be able to field a full security field force — or want to. Commercial development projects may require protection but may not provide the needed infrastructure for on-site staff. And at concerts or sporting events, a small team may be responsible for the safety of tens of thousands. AI-powered surveillance capabilities can expand security’s reach. These systems apply image recognition and computer vision to video feeds from stationary cameras, such as unauthorized intrusions, suspicious behavior or other incidents. With these capabilities, lean teams can focus on the highest risks and threats while leaving routine monitoring to technology. 

Integrating hardware and software

Integrated hardware and software enable security companies to gain the best new features as functionality and upgrades are rolled out over the air. SaaS-like upgrades also extend hardware lifespans, improving their ROI. 

Replacing and augmenting human roles

Extending human talent may not always be an option if companies can’t hire enough staff, maintain continuity across shifts and accounts or work in extremely high-risk areas. In these instances, replacing humans with technology may be the best option. Security companies are:

Deploying drones and robots

Drones provide an eye in the sky, patrolling airspace over facilities, which can be invaluable for military installations, remote physical infrastructure such as oil rigs, and companies with valuable intellectual property or those that support national security missions. Drones with thermal imaging cameras can patrol large areas and detect intruders in poor-visibility conditions, such as at night. Teams monitoring their feeds can then direct security teams to the affected areas with pinpoint precision.

Enabling remote monitoring and control

Many organizations operate valuable unmanned physical infrastructure, such as utility substations, telecommunication cable stations, bridges and more. Leaders may want to protect these assets but not deploy local security forces. They can leverage 24/7 AI-powered monitoring services. For example, at utility substations, remote monitoring extends access controls and searches for unauthorized intruders; it rapidly detects emergency conditions such as smoke, fire, arcing or potential overheating events, alerting first responders.  

Navigating ethical and legal considerations

As security companies adopt more technology, they must consider ethical and legal considerations. Technology such as body cameras, drones, and robots capture and store real-time, extended video and audio footage of individuals, crowds, and actions in various locations. While individuals at large-scale public venues and events likely expect to be monitored, individuals working on the job or residing in communities may not.

Addressing privacy concerns

Organizations using security technology should consider placing public notices that sites are under surveillance and caution that individuals entering accept those conditions. If securing private areas, leaders will likely want to communicate in writing with residents and other community members. These communiques should include how technology is used and how video and audio footage is stored, accessed and secured. 

Data auditability

Technology should be kept in good working order, providing clear video and audio feeds and date and time stamps. Leaders will want to define video monitoring and archive policies, such as whether humans and AI or only AI review footage and how long footage is stored. Security companies serving high-conflict or litigious industries will want to preserve footage longer for court cases, while those in residential areas may delete footage within 30 days. 

Working together to protect communities and businesses 

Technology can free security teams from the drudgery of foot patrols while directing their talents to issues that do need investigation. Similarly, technology can help small teams make a bigger impact. And as legal risks and threats grow, videotaping events can often be the best defense: helping defray tense situations and reminding all parties involved that there is a true record of what transpired. 

https://www.securitymagazine.com/articles/100964-better-together-humans-and-tech-scale-physical-security-capabilities

Phishers are using a novel technique to trick iOS and Android users into installing malicious apps that bypass safety guardrails built by both Apple and Google to prevent unauthorized apps.

Both mobile operating systems employ mechanisms designed to help users steer clear of apps that steal their personal information, passwords, or other sensitive data. iOS bars the installation of all apps other than those available in its App Store, an approach widely known as the Walled Garden. Android, meanwhile, is set by default to allow only apps available in Google Play. Sideloading—or the installation of apps from other markets—must be manually allowed, something Google warns against.

When native apps aren’t

Phishing campaigns making the rounds over the past nine months are using previously unseen ways to workaround these protections. The objective is to trick targets into installing a malicious app that masquerades as an official one from the targets’ bank. Once installed, the malicious app steals account credentials and sends them to the attacker in real time over Telegram.

“This technique is noteworthy because it installs a phishing application from a third-party website without the user having to allow third-party app installation,” Jakub Osmani, an analyst with security firm ESET, wrote Tuesday. “For iOS users, such an action might break any ‘walled garden’ assumptions about security. On Android, this could result in the silent installation of a special kind of APK, which on further inspection even appears to be installed from the Google Play store.”

The novel method involves enticing targets to install a special type of app known as a Progressive Web App. These apps rely solely on Web standards to render functionalities that have the feel and behavior of a native app, without the restrictions that come with them. The reliance on Web standards means PWAs, as they’re abbreviated, will in theory work on any platform running a standards-compliant browser, making them work equally well on iOS and Android. Once installed, users can add PWAs to their home screen, giving them a striking similarity to native apps.

While PWAs can apply to both iOS and Android, Osmani’s post uses PWA to apply to iOS apps and WebAPK to Android apps.

The attack begins with a message sent either by text message, automated call, or through a malicious ad on Facebook or Instagram. When targets click on the link in the scam message, they open a page that looks similar to the App Store or Google Play.

ESET’s Osmani continued:

From here victims are asked to install a “new version” of the banking application; an example of this can be seen in Figure 2. Depending on the campaign, clicking on the install/update button launches the installation of a malicious application from the website, directly on the victim’s phone, either in the form of a WebAPK (for Android users only), or as a PWA for iOS and Android users (if the campaign is not WebAPK based). This crucial installation step bypasses traditional browser warnings of “installing unknown apps”: this is the default behavior of Chrome’s WebAPK technology, which is abused by the attackers.

The process is a little different for iOS users, as an animated pop-up instructs victims how to add the phishing PWA to their home screen (see Figure 3). The pop-up copies the look of native iOS prompts. In the end, even iOS users are not warned about adding a potentially harmful app to their phone.

After installation, victims are prompted to submit their Internet banking credentials to access their account via the new mobile banking app. All submitted information is sent to the attackers’ C&C servers.

The technique is made all the more effective because application information associated with the WebAPKs will show they were installed from Google Play and have been assigned no system privileges.

So far, ESET is aware of the technique being used against customers of banks mostly in Czechia and less so in Hungary and Georgia. The attacks used two distinct command-and-control infrastructures, an indication that two different threat groups are using the technique.

“We expect more copycat applications to be created and distributed, since after installation it is difficult to separate the legitimate apps from the phishing ones,” Osmani said.

https://arstechnica.com/?p=2044637

New research from Cado Security reveals that malicious actors are imitating tech companies in an effort to compromise corporate systems. Researchers discovered a typosquatting threat, in which malicious actors register domains that closely mimic an already existing domain. This is often done by replacing symbols with other, similar looking ones, such as swapping the letter ‘I’ for a lowercase ‘L.’ This subtle difference can deceive users into believing the fraudulent domain is the legitimate one, possibly luring users to a malicious site. 

Researchers identified a fraudulent domain posing as Cado Security. However, the false domain was redirecting users to the organization’s legitimate domain, suggesting that malicious actors were likely setting it up for a future phishing attack. 

Additionally, the malicious actors created an X (formerly Twitter) account associated with the domain to establish the appearance of authenticity. This included purchasing a Gold Checkmark, following users related to the organization and adding followers. 

Researchers found that Cado was not the only tech company impersonated. Security leaders are encouraged to monitor domain registrations. 

https://www.securitymagazine.com/articles/100953-new-research-malicious-actors-are-imitating-tech-companies

National Public Data, a background checking organization, experienced a breach potentially affecting 2.9 billion individuals. The breach exposed personally identifiable information (PII) such as names, phone numbers, mailing addresses, email addresses and Social Security numbers. 

“Organizations rely on the exchange of data for their vitality,” says Clyde Williamson, Product Management, Innovations at Protegrity. “Consumers share their personal identifiable information (PII) like Social Security numbers and emails with the expectation that businesses will protect this data and comply with privacy laws to prevent unauthorized access. In this case, National Public Data (NPD) scraped individuals’ PII from public sources for use in background checks, leaving people unaware if their data was accessed and emphasizing growing concerns regarding customer trust in businesses and their ability to secure their data.” 

National Public Data states they experienced an attempted hacking in December of 2023. The organizations believes this attempt may be related to subsequent data leaks in April 2024 and in later months of 2024. 

Regarding National Public Data’s announcement of the breach, Williamson remarks, “Notably, this breach wasn’t announced for a week; it only came to light and led to a lawsuit earlier because the company didn’t disclose it. Further, it’s still unclear whether they intentionally avoided sharing details of this breach or just discovered it themselves. This highlights the inadequacy of United States laws in handling citizens’ personal data, which are not equipped for the challenges of the 21st century. Data brokers like the NPD also aren’t held to the same regulatory standards as institutions like the Payment Card Industry (PCI), where they’re obligated to conduct annual audits and controls around credit card data. As things stand now, the U.S. has no such obligations.”

Protecting Social Security numbers 

National Public Data states it is cooperating with law enforcement on the matter. The organization advises individuals take preventative measures to protect their data, such as monitoring financial statements and credit reports.

With potentially 2.9 billion individuals impacted, everyone is encouraged to take preventative measures. Still, it is possible that certain demographics may be at higher risk. 

Williamson states, “Most likely, a lot of the stolen data set is from one of our most vulnerable demographics: senior citizens and their families. A popular scam has a threat actor pretending to be a lawyer with bad news for the senior — their family member is in trouble and needs money. And why wouldn’t a grandparent believe them if they had valid PII to validate their credibility? These scammers don’t have to open credit in someone’s name to ruin lives. They just need to know how to use the information stolen to empty a caring family member’s bank account.”

Not only should individuals take steps to secure their data; organizations must also act. Williamson comments, “As breaches and attack surfaces continue to grow, relying on class action lawsuits for negligence cannot be the best option. Organizations must prioritize transparency and enhance their efforts to de-identify sensitive data to protect consumer information. They need to move beyond traditional defense mechanisms and adopt regulator-recommended data protection strategies like encryption and tokenization. These methods render data useless to attackers, making it impossible to steal and use maliciously. By implementing these protections, businesses can diminish the value of stolen data and mitigate the long-term effects of ransomware attacks or fraudulent activities.” 

Security leaders weigh in 

Kiran Chinnagangannagari, Chief Product & Technology Officer, Securin: 

“In the wake of the staggering National Public Data breach, which compromised millions of records on U.S. citizens, the silence from the company until the breach included leaked social security numbers is nothing short of alarming. This breach not only underscores the profound risks posed by mass data aggregation but also shines a harsh light on the glaring gaps in corporate responsibility when it comes to managing and communicating such incidents. The fact that such enormous volumes of personal data are accessible to companies, private investigators, and now the deep and dark web raises serious doubts about how well-protected our information truly is. This breach lays bare the minimal oversight over who gains access to this data —
and what happens to it afterward. 

“This breach should also serve as a wake-up call, emphasizing the critical need for organizations to rigorously evaluate the cybersecurity practices of their partners and third-party vendors. It’s no longer enough to trust that data handlers have robust defenses in place — organizations must proactively ensure that every entity in their supply chain is equipped to prevent such catastrophic breaches. It’s time for stricter regulations and better enforcement. Companies must be held accountable, not just for their own cybersecurity practices but for those of every entity they do business with. The stakes are too high to allow this kind of negligence to continue.” 

Chris Hauk, Consumer Privacy Champion at Pixel Privacy:

“Unfortunately, data brokers like National Public Data collect and sell personal data for use in background checks, criminal record research and more, putting people’s personal data at risk. Sadly, we will continue to see cyberattacks like this to be on the rise.

“Stronger regulations are needed to protect consumers’ data from being stored by data brokers against their will. Also, all data in data brokers’ databases should be required to be encrypted. All of the data, not just certain information. Data brokers should also be required to provide information about when and where the data in their databases was obtained from.

“While the barn door is already open in the case of the NPD data being exposed, there is something people can do to remove their data from brokers’ databases. Users can contact each data broker and manually request to have their data removed. Data brokers are required to remove information from their files when requested to. Unfortunately, this is a time-consuming request.”

Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“Background check companies like National Public Data collect as much identifiable information as possible about everyone they can, then sell it to whomever will pay for it. It collects much of the data without the knowledge or consent of data subjects, most of whom have no idea what National Public Data is or does. I hope the forthcoming class-action lawsuit will set a precedent that forces NPD and other background check companies to inform data subjects when their info is added to a database, limit web scraping, and allow data subjects to see, modify, and delete data. NPD should be required to show data subjects where their info was sourced from so that they can take proactive steps to secure their privacy at the source. Furthermore, the compromised data should have been encrypted. The fact that it wasn’t shows just how little NPD cares about, well, pretty much everyone.”

Eric Avigdor, Chief Product Officer at Votiro: 

“The recent NPD breach highlights several critical issues regarding data security in both public and commercial organizations. In this case credentials to the company’s website and backend were posted in a file hosted on a publicly available website. There are multiple cybersecurity flaws here including poor credential management and weak security processes. The incident apparently started late in 2023 and continued with 2 additional data exfiltration events in April and June 2024. This seems like the cybersecurity architecture is fundamentally missing visibility, detection and tracking of data-related incidents. The company took a very long time to even realize they had been breached. 

“This breach highlights the importance of protecting data as it moves within an organization. Even if bad actors obtain credentials and view data, the scale of a breach becomes much larger when there are no controls on data as it moves through an organization and a significant amount of data can be exfiltrated quickly. Putting controls of where data is allowed to go and who can access it, should have prevented such a breach.  

“Ultimately, it is up to CISO’s and IT teams to modernize the technologies they deploy to prevent the loss of private Data. Hackers have realized legacy approaches to protecting private data are no longer effective and a significant amount of the IT budget is lost in traditional antiquated paradigms. Now is the time for IT professionals to stop hitting the snooze button on modernizing data security.”

https://www.securitymagazine.com/articles/100951-security-leaders-discuss-the-national-public-data-breach

Ago 21, 2024 Stefano Silvestri Attacchi, Intrusione, Minacce, News, Phishing, Vulnerabilità 0

---

I risultati di una recente indagine condotta da Barracuda Networks, leader nel campo delle soluzioni di sicurezza cloud-first, rivelano che le grandi aziende con migliaia di dipendenti e infrastrutture tecnologiche complesse sono diventate il target primario del phishing laterale.

Si tratta di una forma di attacco e-mail avanzata che sfrutta account interni compromessi per diffondere minacce all’interno dell’organizzazione.

Secondo lo studio, svolto tra giugno 2023 e maggio 2024, il 42% degli attacchi mirati via e-mail contro le grandi imprese (con oltre 2.000 dipendenti) si avvale di questa tattica. La dimensione e la complessità di queste realtà offrono agli aggressori numerose opportunità di accesso.

Al contrario, nelle piccole aziende con un massimo di 100 dipendenti, il phishing laterale rappresenta solo il 2% delle minacce, mentre il phishing esterno colpisce il 71% di queste realtà.

Il phishing laterale non è però l’unica preoccupazione. Lo studio di Barracuda evidenzia come le piccole imprese siano tre volte più vulnerabili agli attacchi estorsivi rispetto alle grandi aziende, con il 7% degli incidenti mirati che sfruttano questa tipologia di minaccia, contro il 2% per le realtà più grandi.

Invece, la compromissione delle e-mail aziendali (BEC) e il conversation hijacking mostrano una prevalenza relativamente uniforme indipendentemente dalle dimensioni dell’organizzazione.

Olesia Klevchuk, director product marketing di Barracuda, sottolinea la necessità di adattare le strategie di difesa in base alle caratteristiche di ciascuna azienda: “Tutte le imprese, grandi o piccole, sono vulnerabili alle minacce via e-mail, ma in modi diversi. Le realtà più grandi offrono più potenziali punti di accesso agli aggressori, mentre le piccole aziende spesso mancano delle risorse e competenze interne necessarie per una adeguata configurazione delle difese”.

Per mitigare questi rischi, Barracuda raccomanda un approccio proattivo alla cybersecurity, che comprenda formazione continua dei dipendenti sul phishing laterale e l’implementazione di difese avanzate basate sull’intelligenza artificiale.

Per le piccole imprese, che possono avere difficoltà a disporre di risorse interne sufficienti, il ricorso a fornitori di servizi gestiti (MSP) può rappresentare una soluzione efficace per rafforzare la propria postura di sicurezza.

Sia le grandi che le piccole aziende devono quindi rimanere vigili e investire in tecnologie e formazione per proteggere i propri asset digitali in un panorama di sicurezza sempre più complesso.

---

---

---

https://www.securityinfo.it/2024/08/21/phishing-laterale-minaccia-crescente-grandi-aziende/?utm_source=rss&utm_medium=rss&utm_campaign=phishing-laterale-minaccia-crescente-grandi-aziende

As the adage goes, an organization is only as secure as its weakest link. With the growing emphasis on software integration, B2B SaaS companies are adding many links to their chains, creating new access points for attackers. The Crowdstrike tech outage demonstrates just how interdependent systems are, and the SolarWinds hack in 2020 highlighted the vulnerabilities in supply chain security and the potential consequences of large-scale cyberattacks.

Third-party attacks accounted for nearly 30% of all breaches in 2023, and 98% of organizations have business ties to a third-party vendor that has experienced a breach. Yet integrations are imperative to a successful technology platform as customers increasingly demand cohesive tech stacks. Developers must find a way to secure these integrations. 

Common security pitfalls

Unfortunately, despite their best efforts, the growing integration ecosystem prevents organizations from achieving complete security. Several factors can introduce additional security vulnerabilities. 

• Third-party vendor vetting: Failure to properly evaluate a vendor’s security posture creates significant gaps in protection. 
• Misconfigurations: Integration builders can create complex integrations without fully understanding the implications for security and data integrity.
• APIs: Securing APIs is incredibly difficult due to their complex nature and extensive data exposure. While APIs are not currently hackers’ prime target, it’s likely only a matter of time before that changes. 
• Developer awareness: Fast-paced developer workflows and rapidly changing technologies can contribute to a lack of security awareness from developers, resulting in inadvertent vulnerabilities.

Only connect with trusted sources

Vetting a third party before connecting is foundational to building secure integrations. Customers’ data must be exchanged exclusively through trusted and verified applications. Unsigned or unverified third-party apps anywhere in the ecosystem create risk. 

SOC 2 reports should be a baseline requirement for vendors. Compliance with these rigorous security standards demonstrates a company’s ability to handle data securely and responsibly. Other frameworks, including ISO 27001 and the NIST (National Institute of Standards and Technology) Cybersecurity Framework, also provide security reassurance. 

Beyond certification, evaluate the SaaS providers’ additional security efforts, such as audits and penetration tests. 

Strategies for integration security

Organizations must set realistic goals. Achieving complete security is challenging, and substantial risk mitigation can be costly. First and foremost, dev teams should work to prevent inevitable attacks from turning into full-blown breaches. They can achieve this with layered security controls using the following practices.

• Use complex authentication: Setting up unique API keys with specific scopes for each company and user accessing the integration is an adequate safeguard, but OAuth 2.0 is more secure. This framework uses authentication tokens from an authorization server to grant limited access to specific resources. Each company and individual user should receive unique OAuth 2.0 credentials. 
• Store credentials separately from source code and data: Code, data and credentials should never mix. There have been several instances of private API keys published in hard code, opening the integration up to serious risk. Managing the many credentials and API keys for multiple integrations requires dedicated vaults with proper access management.
• Validate all inputs: To ensure data integrity, establish a comprehensive validation process for all API interactions. This effort includes defining strict input requirements in the API documentation and implementing rigorous checks within the integration to enforce these rules.
• Implement the principle of least privilege: Every integration module should only have access to the information and resources necessary to run successfully. Restricting access protects sensitive information, decreases potential vulnerabilities and contains damage from compromised modules. Security leaders can turn this principle inward to address risks posed by low-code/no-code environments by limiting users’ ability to create, modify or delete integrations.
• Monitor and log system metadata: Observing system activity can flag potential attacks, and system logs pinpoint the source of the problem. However, the recorded data should only include metadata about integrations and their executions, not the user information passing through.

Implementing multiple security controls at various levels — data, application and user — creates a formidable defense strategy. These multi-layered approaches act as speed bumps, giving organizations time to detect and contain an attack. Dev teams should have a response plan in place, such as shutting down layers or systems to prohibit bad actors from accessing additional data or applications. Once the threat is neutralized, teams can eradicate the issue and install new protections.

Regular audits and education

Integration strategies and security threats evolve. A comprehensive audit approach combining automated tools, manual review and ongoing security testing is essential for maintaining the integrity and security of APIs and the development process.

Developer education is also imperative. Even experienced programmers may not always be aware of the latest ways attackers can manipulate systems. Training them to always follow secure design principles and creating awareness of new vulnerabilities allows them to be cognizant of best practices in their development.  

Despite best efforts, organizations cannot entirely avoid risk exposure from third-party integrations. Prioritizing multi-layered security strategies, building containment and recovery strategies and continuous code and process evaluation gives an organization the best chance of protecting its software from a major breach. Building resilience into the development strategy will allow organizations to provide customers with convenience and security. 

https://www.securitymagazine.com/articles/100958-the-integration-security-paradox-strategies-to-protect-data

Research has shown that Microsoft Entra ID (formerly Azure AD), a cloud identity and access management solution, can be manipulated to bypass security measures. Malicious actors can manipulate the credential validation process, transforming the pass-through authentication (PTA) agent into a tool allowing malicious actors to log in as any AD user. As a result, malicious actors could potentially gain access to a global admin user. 

Security leaders weigh in

Sarah Jones, Cyber Threat Intelligence Research Analyst at Critical Start:

“A critical vulnerability exists within the PTA agent, a critical component of the Azure AD environment. This vulnerability allows malicious actors with local administrative privileges on the PTA agent server to bypass authentication controls, gaining unauthorized access to any synchronized Active Directory user. Such compromised access facilitates lateral movement within the network and potentially elevates privileges to the level of a Global Administrator, if such an account exists. While this vulnerability does not inherently grant global administrative rights, it provides a pathway for attackers to exploit existing privileged accounts. To mitigate this risk, organizations must implement stringent security measures including restricted access to PTA agent servers, robust password policies and mandatory multi-factor authentication.”

Rom Carmel, Co-Founder and CEO at Apono:

“What we are seeing more than ever over the last few years are what vulnerability research calls logical bugs. Unlike stack overflows or other “technical” bugs, logical bugs are typically harder to find with fuzzers or automated tools. Therefore, these bugs are often discovered by attackers or researchers (hopefully the latter). Logical bugs are faults in “decisions” (path of codes) are directed and therefore can be validation faults or inconsistencies. (i.e., a function that fails to validate correctly in certain scenarios).

“In terms of the specific reference in the research that ‘this could potentially grant access to a global admin user if such privileges were assigned, regardless of their original synced AD domain,’ I believe this means an attacker could elevate privileges, themselves, to that of a global admin user by using the same credentials. It sounds like this could be caused by an out-of-sync error in which the on-prem Active Directory (AD) and the Azure AD (Entra) perceive the same identity (credentials) in different ways. This is just my interpretation, however, since I have not researched this bug.”

Tal Mandel Bar, Product Manager at DoControl: 

“The recent vulnerabilities in Microsoft Entra ID are concerning, but not entirely surprising. As cloud identity services become more central to enterprise operations, they’re naturally becoming prime targets for attackers. It’s like finding the master key to an entire building — once you’ve got it, you can access everything. In this case, the Cymulate researchers have essentially found a way to turn a trusted component — the PTA agent — into a backdoor. It’s a classic case of abusing legitimate functionality for malicious purposes.

“What’s particularly worrying is how this vulnerability could enable lateral movement across different on-premises domains. In a complex enterprise environment with multiple subsidiaries or departments, an attacker could hop from one domain to another, potentially compromising the entire organization. This discovery, along with the other recent Entra ID issues, highlights the critical importance of robust SaaS security measures. 

“The takeaway here is clear: while cloud identity services offer tremendous benefits in terms of streamlining access and management, they also create new security challenges. Organizations need to be proactive in monitoring and securing these critical systems, because they’ve become the keys to the kingdom in our cloud-first world.”

https://www.securitymagazine.com/articles/100950-authentication-bypass-discovered-in-microsoft-entra-id

Security’s Top 5 from Security magazine showcases the top stories and new developments from across the security industry throughout June.

Security Leaders Respond to Ticketmaster Breach

The ShinyHunters threat operation has claimed to hack Ticketmaster, and security leaders are sharing their thoughts.  

Four Ways Cybercriminals Can Hack Passwords

Learn about four techniques hackers usually employ to hack usernames and passwords, as well as tips to bolster password defense. 

Research Reveals New Ransomware Variant Called Fog

Research has revealed the development of a new ransomware variant called Fog.  

The Cybersecurity and Geopolitical Discussion — Changing global influence in a year of elections — Episode 21

In episode 23 of the Cybersecurity & Geopolitical Discussion, our trio of hosts debate pull apart the scenario of the upcoming UK election to uncover what the impact could be on national and global security. 

Russian disinformation campaign attempts to disrupt the Paris Olympics

The Microsoft Threat Analysis Threat Center reports that a sophisticated Russian disinformation campaign is attempting to undermine the Paris Olympic Games. These campaigns are also targeting France, French President Emmanuel Macron and the International Olympic Committee (IOC).

https://www.securitymagazine.com/articles/100968-securitys-top-5-june-2024

A survey of 1,000 Americans has revealed attitudes and concerns toward AI technology. The survey found that most Americans cannot tell the difference between AI voices and real voices — when asked whether a human voice was real or AI-generated, 2 out of 3 respondents incorrected identified the authentic human voice as AI. Moreover, 81% of Americans are concerned about potential implications of AI voice cloning.

The top threats Americans are concerned about include: 

• Manipulation and deception (69%) 
• Identity theft (60%) 
• Privacy concerns (47%) 
• Data misuse (44%) 
• Job displacement (27%) 

26% of Americans are wary about AI voice technology; additionally, more and more Americans worrying that AI may influence elections. Perhaps as a result, 64% of those surveyed believe AI education should be added into school curriculums. 

https://www.securitymagazine.com/articles/100948-2-out-of-3-americans-cannot-distinguish-ai-voices-from-real-voices

Cybersecurity threats were analyzed in a recent report by Fastly. The report found that 91% of cyberattacks – up from 69% in 2023 – targeted multiple customers using mass scanning techniques to uncover and exploit software vulnerabilities.

According to the report, 91% of attacks originating from NLX sources targeted multiple customers; 19% targeted over 100 different customers. This is a significant increase from Q2 2023 insights, where 69% of NLX sources targeted multiple customers.

A significant amount of global internet traffic is attributed to requests generated by automation tools; approximately 36% of traffic originated from bots, while the remaining 64% came from human users.

High tech remains top industry targeted, accounting for 37% of attacks, although slightly down from last year at 46%. Other top industries for 2024 include media & entertainment (21%) and financial services (17%).

Read the report

https://www.securitymagazine.com/articles/100949-36-of-global-internet-traffic-originated-from-bots