Threat research from Sophos details a recent encounter with the ransomware group known as RansomHub. The research reports that the attack was unsuccessful; however, researchers were able to analyze the attack and discovered the use of an EDR-killing tool. The research has labelled this utility the EDRKillShifter. 

John Bambenek, President at Bambenek Consulting, comments, “At present, only RansomHub is using the tool. However, as it was sold on the dark web, it is more than likely that other groups could purchase it as well. Threat actors trying to kill EDR agents on systems before going further in their chain of attacks is not news, however, security teams should keep tight controls on drivers being installed to avoid this tool.”

How the EDR-killing tool works

EDRKillShifter is described as a “bring your own vulnerable driver” (BYOVD) tool, requiring three steps to execute. 

1. The EDRKillShifter must be executed with a command line including a password string; with the correct password, an embedded resource named BIN is decrypted and executed. 
2. The final payload is unpacked and executed by the BIN code. 
3. The final payload drops and leverages one vulnerable, legitimate driver from a range of drivers in order to gain privileges to disarm an EDR tool’s protection. 

Bambenek states, “BYOVD is a technique where an attacker loads a legitimate driver that has vulnerabilities so they can overwrite the code near the kernel to execute privileged functions. The danger here is that the kernel driver isn’t malicious, so detection is more difficult. Once a driver is loaded, you have much deeper access to the system and are able to have a wider range of privileges to manipulate a system.”

How security leaders can defend their organizations

Security leaders are encouraged to monitor endpoint security, encourage strong organizational cyber hygiene and keep systems updated. Craig Jones, Vice President of Security Operations at Ontinue, explains, “The situation with the EDRKillShifter tool is indeed concerning. From what we can gather, the cybercriminal group behind this operation remains unidentified, but their use of the RansomHub ransomware suggests they’re experienced and determined. The fact that they’re employing this new tool, designed specifically to disable endpoint detection and response (EDR) software, is a clear indicator of their sophistication.

“The danger here is significant. Once EDR is out of the picture, these attackers can operate on compromised systems with much less risk of being detected, giving them a wider window to deploy ransomware or other malicious payloads.

“For security teams, the emergence of EDRKillShifter emphasizes the constantly evolving tactics used by threat actors. First, it’s crucial to ensure that all drivers on your network are up-to-date and regularly audited for known vulnerabilities. Additionally, implementing strict allowlisting policies for drivers can help prevent unauthorized or vulnerable drivers from being used, this is time consuming and fraught with complexity.

“Security is a moving target, and this latest tool is a reminder that attackers are always looking for ways to outmaneuver even the most advanced defenses.”

https://www.securitymagazine.com/articles/100947-ransomhub-threat-actors-observed-using-edr-killing-tool

Ago 20, 2024 Stefano Silvestri Gestione dati, News, Tecnologia, Vulnerabilità 0

---

GitHub è una delle piattaforme più utilizzate al mondo per lo sviluppo software. Essendo ampiamente utilizzata da team di sviluppo e organizzazioni per collaborare alla scrittura, gestione e revisione del codice sorgente di software, la sicurezza è un tema di particolare importanza.

Nel 2018, Microsoft ha acquisito GitHub, integrandolo ulteriormente nel proprio ecosistema di sviluppo software. Il che aiuta a comprendere perché la nuova funzionalità appena aggiunta al suo già ampio arsenale di strumenti per la sicurezza del codice si chiami Copilot Autofix.

Questo servizio, basato sull’intelligenza artificiale, è stato sviluppato per analizzare le vulnerabilità presenti nel codice e fornire suggerimenti immediati per la loro correzione.

Lanciato ufficialmente come parte del servizio GitHub Advanced Security (GHAS), Copilot Autofix si propone di rendere la correzione delle vulnerabilità un processo più veloce e meno gravoso per gli sviluppatori.

“Copilot Autofix analizza le vulnerabilità nel codice, spiega perché sono importanti e offre suggerimenti di codice che aiutano gli sviluppatori a correggere le vulnerabilità non appena vengono individuate”, ha dichiarato GitHub in un annuncio ufficiale.

Questa nuova funzionalità è già disponibile per i clienti GHAS su GitHub Enterprise Cloud, i quali la troveranno attivata di default nelle impostazioni di scansione del codice.

Un aspetto particolarmente interessante di Copilot Autofix è la sua capacità di analizzare e generare correzioni per una vasta gamma di vulnerabilità comuni, come l’iniezione SQL e il cross-site scripting.

Gli sviluppatori possono quindi decidere se ignorare, modificare o confermare queste correzioni direttamente nella loro pull request, semplificando notevolmente il processo di sviluppo e riducendo il margine di errore umano.

Durante la fase di beta pubblica, avviata a marzo, GitHub ha registrato risultati importanti. Gli sviluppatori che hanno utilizzato Copilot Autofix sono riusciti a risolvere le vulnerabilità del codice oltre tre volte più velocemente rispetto a coloro che hanno proceduto manualmente, dimostrando l’efficacia dell’intelligenza artificiale nel migliorare la produttività e la sicurezza nello sviluppo software.

A partire da settembre, GitHub renderà disponibile Copilot Autofix gratuitamente nelle pull request dei progetti open source, una mossa che potrebbe avere un impatto significativo sulla sicurezza di numerosi progetti utilizzati in tutto il mondo.

---

---

---

https://www.securityinfo.it/2024/08/20/arriva-copilot-autofix-lia-di-github-per-la-sicurezza-del-codice/?utm_source=rss&utm_medium=rss&utm_campaign=arriva-copilot-autofix-lia-di-github-per-la-sicurezza-del-codice

https://www.securitymagazine.com/blogs/14-security-blog/post/100945-small-businesses-need-to-secure-data-before-tapping-into-ai

A Windows zero-day vulnerability recently patched by Microsoft was exploited by hackers working on behalf of the North Korean government so they could install custom malware that’s exceptionally stealthy and advanced, researchers reported Monday.

The vulnerability, tracked as CVE-2024-38193, was one of six zero-days—meaning vulnerabilities known or actively exploited before the vendor has a patch—fixed in Microsoft’s monthly update release last Tuesday. Microsoft said the vulnerability—in a class known as a “use after free”—was located in AFD.sys, the binary file for what’s known as the ancillary function driver and the kernel entry point for the Winsock API. Microsoft warned that the zero-day could be exploited to give attackers system privileges, the maximum system rights available in Windows and a required status for executing untrusted code.

Lazarus gets access to the Windows kernel

Microsoft warned at the time that the vulnerability was being actively exploited but provided no details about who was behind the attacks or what their ultimate objective was. On Monday, researchers with Gen—the security firm that discovered the attacks and reported them privately to Microsoft—said the threat actors were part of Lazarus, the name researchers use to track a hacking outfit backed by the North Korean government.

“The vulnerability allowed attackers to bypass normal security restrictions and access sensitive system areas that most users and administrators can’t reach,” Gen researchers reported. “This type of attack is both sophisticated and resourceful, potentially costing several hundred thousand dollars on the black market. This is concerning because it targets individuals in sensitive fields, such as those working in cryptocurrency engineering or aerospace to get access to their employer’s networks and steal cryptocurrencies to fund attackers’ operations.”

Monday’s blog post said that Lazarus was using the exploit to install FudModule, a sophisticated piece of malware discovered and analyzed in 2022 by researchers from two separate security firms: AhnLab and ESET. Named after the FudModule.dll file that once was present in its export table, FudModule is a type of malware known as a rootkit. It stood out for its ability to operate robustly in the deep in the innermost recess of Windows, a realm that wasn’t widely understood then or now. That capability allowed FudModule to disable monitoring by both internal and external security defenses.

Rootkits are pieces of malware that have the ability to hide their files, processes, and other inner workings from the operating system itself and, at the same time, control the deepest levels of the operating system. To work, rootkits must first gain system privileges and go on to directly interact with the kernel, the area of an operating system reserved for the most sensitive functions. The FudModule variants discovered by AhnLabs and ESET were installed using a technique called “bring your own vulnerable driver,” which involves installing a legitimate driver with known vulnerabilities to gain access to the kernel.

Earlier this year, researchers from security firm Avast spotted a newer FudModule variant that bypassed key Windows defenses such as Endpoint Detection and Response, and Protected Process Light. Microsoft took six months after Avast privately reported the vulnerability to fix it, a delay that allowed Lazarus to continue exploiting it.

Whereas Lazarus used “bring your own vulnerable driver” to install earlier versions of FudModule, group members installed the variant discovered by Avast by exploiting a bug in appid.sys, a driver enabling the Windows AppLocker service, which comes preinstalled in Windows. Avast researchers said at the time the Windows vulnerability exploited in those attacks represented a holy grail for hackers because it was baked directly into the OS rather than having to be installed from third-party sources.

Gen, a conglomerate comprising brands Norton, Norton Lifelock, Avast, and Avira, among others, didn’t provide critical details, including when Lazarus started exploiting CVE-2024-38193, how many organizations were targeted in the attacks, and whether the latest FudModule variant was detected by any endpoint protection services. There are also no indicators of compromise. Representatives of the company didn’t respond to emails.

https://arstechnica.com/?p=2044100

The Trump campaign was hacked, compromising some internal communications. Trump campaign spokesperson, Steven Cheung, stated, “These documents were obtained illegally from foreign sources hostile to the United States, intended to interfere with the 2024 election and sow chaos throughout our Democratic process. On Friday, a new report from Microsoft found that Iranian hackers broke into the account of a ‘high ranking official’ on the U.S. presidential campaign in June 2024, which coincides with the close timing of President Trump’s selection of a vice presidential nominee.”

Preparing for election threats

Although the campaign asserts that Iran is to blame, no threat actor has been officially verified. Whether or not the threat actor turns out to be a foreign state actor or a domestic actor, political campaigns are encouraged to prepare for the possibility of foreign threats. 

Aleksandr Yampolskiy, CEO of SecurityScorecard, comments, “Foreign state actors and adversaries will inevitably try to infiltrate political campaigns. Therefore, adopting a resilience mindset — instead of robustness mindset — is essential. 

“Assume that an attacker will sooner or later break into your campaign’s infrastructure, but make it difficult for hackers to extract valuable information. One effective tactic is using “decoy documents” to trigger alerts when an unauthorized user accesses them or to confuse hackers by blending decoys with real data.

“Securing the IT infrastructure of state governments is crucial for maintaining election integrity, especially in battleground states. Unfortunately, public sector systems are often complex and slow to secure. Attackers only need one weak spot to exploit, while defenders must secure every potential vulnerability.

“Many attacks rely on sophisticated phishing emails or deepfake audio and video to trick campaign staff into divulging sensitive information or infecting their computers. As the saying goes, ‘What you can’t measure, you can’t improve.’ It’s vital for the public sector to use security KPIs to measure and manage risk effectively.”

Increasing election security vigilance 

As the elections draw closer, government entities and election officials must increase vigilance. Max Gannon, Cyber Intelligence Team Manager at Cofense, remarks, “Government targets always need to be well protected, but around election time security becomes even more important as threat actors often target them more than usual. This is particularly a problem for smaller county-level government employees who may not have the resources or training that members of larger political campaigns often do. While compromising a target like a local government employee may not seem like a threat to large-scale political campaigns, it gives threat actors access to a verified .gov email account which can enable them to produce significantly more effective spear phishing emails when they attack their primary targets. The tactic of using a hyperlink to direct traffic to a threat actor-controlled domain that steals credentials and then redirects to the legitimate website is not new but it is a tactic that is far more effective than simply ending the attack chain with a 404 like threat actors used to do.”

https://www.securitymagazine.com/articles/100944-security-leaders-weigh-in-on-the-trump-campaign-hack

Cyberattacks targeted towards cybersecurity executives were analyzed in a recent report by GetApp. The report found that 72% of surveyed cybersecurity professionals in the U.S. have been targeted by cyberattacks in the past 18 months. The report also found that AI-generated deepfakes have been involved in 27% of the attacks.

Over a third (37%) of companies globally do not provide specialized cybersecurity training to their senior executives, leaving a critical gap in their defenses. Sixty-nine percent of US companies that have previously had attacks report an increase in attacks over the past three years – above the global average of 58%. 

Over half (54%) of US companies have experienced at least one identity fraud incident affecting a senior executive over the last 18 months, which is 13 points higher than the global average of 41%.

In response to these escalating threats, businesses are encouraged to implement comprehensive cybersecurity strategies that include ongoing training, use of advanced security tools like multi-factor authentication (MFA) and data encryption. Proactive measures, like regularly updating software, monitoring network activity, and preparing for emerging threats like deepfakes, are also vital.

Read the report.

https://www.securitymagazine.com/articles/100946-72-of-cybersecurity-leaders-faced-a-cyberattack-in-last-18-months

A man from Nashville, Tennessee, has been charged for his attempts to generate revenue for North Korea’s illicit weapons program. The man is charged with conspiracy to damage protected computers, conspiracy to commit wire fraud, conspiracy to launder monetary instruments, and conspiracy to cause the unlawful employment of aliens. He has also been charged with intentional damage to protected computers and aggravated identity theft. 

Craig Jones, Vice President of Security Operations at Ontinue, comments, “This case sheds light on a concerning tactic that North Korean threat actors have been using with increasing frequency. By infiltrating companies through seemingly legitimate means, these operatives are able to gain access to sensitive systems and data without raising immediate suspicion. This really illustrates the lengths to which these groups are willing to go. Setting up “laptop farms” to facilitate these operations is a clear indication of the sophistication and determination behind these efforts. North Korean threat actors set up “laptop farms” as part of their broader strategy to mask the origins of their operations and to evade detection by authorities. It’s not just about getting hired; it’s about embedding themselves within organizations in a way that allows them to operate covertly for extended periods.” 

This incident, following the attempted hacking of KnowBe4, emphasizes the importance of vigilance among organizations. Jones says, “The KnowBe4 incident serves as a critical warning. I salute their openness, this candid account is incredibly useful for raising awareness in the industry. Even companies with strong security awareness can be duped by these increasingly sophisticated methods. The use of AI to enhance images and stolen identities shows the level of detail and planning that goes into these operations. For organizations, the takeaway is clear: vigilance must extend beyond the usual cybersecurity protocols. Background checks, identity verification and continuous monitoring of employee activity are essential in countering these threats.” 

As North Korean threat actors continue to deploy such tactics, HR departments are encouraged to be aware and diligent in vetting potential hires. Guy Rosenthal, Vice President, Product, at DoControl, states, “This case is a wake-up call for HR departments and tech companies everywhere. The global talent shortage in tech is real, however, it can’t come at the expense of security and due diligence.” 

Even companies with stringent security procedures must remain alert, as many of these North Korean operations are advanced. Rosenthal remarks, “What’s particularly alarming here is the sophistication of these North Korean operations. They’re not just sending out resumes — they’re setting up entire fake identities, complete with AI-enhanced photos. It’s a stark reminder that our adversaries are constantly evolving their tactics.” 

Expanding on HR screening processes

In order to better secure against these threats, HR departments are advised to expand upon the normal vetting processes. 

“For HR teams, this means going beyond the usual background checks. We need to be implementing robust identity verification processes, especially for remote hires,” Rosenthal declares. “This could include video interviews, real-time identity checks and even AI-powered tools to detect potential identity fraud.”

However, HR is not the only part of an organization that needs to remain alert. Rosenthal states, “Let’s be clear — this isn’t just an HR problem. It’s a cybersecurity issue that needs to be on every CISO’s radar. These North Korean IT workers aren’t just looking for a paycheck — they’re potential insider threats with access to sensitive systems and data. The bottom line is this: in today’s digital landscape, your security is only as strong as your weakest link. And increasingly, that weak link is the human element. Companies need to be investing in both technology and training to stay ahead of these evolving threats.” 

Responding to the wake-up call

As threats such as these grow more sophisticated, security leaders are emphasizing the importance of raising security standards across the board. 

Mr. Saran Gopalakrishnan, Vice President at Netenrich, says, “This is certainly a wake-up call for the cybersecurity industry and a reminder of how sophisticated and advanced these threats have become.

“We need to raise the bar across the board. The days of relying on traditional security measures are long gone. We’re now in the realm of advanced threat intelligence and real-time monitoring — it’s not just a nice to have anymore; it’s essential. Breaking down the silos is important. HR, IT and security can’t operate in isolation. They need to work together, especially when it comes to vetting processes. And, as this demonstrates, those vetting processes need a serious overhaul.

“Adaptability is key. The threat landscape shifts constantly, so our defenses need to keep pace. This is where AI and machine learning can make a big impact. They’re radically improving how we detect and respond to threats. Insider threats are a major concern. Whether it’s an employee who’s been compromised or an outsider who’s wormed their way in, we need robust systems to flag unusual behavior quickly.

“So, what’s the game plan for companies? Here are some critical steps:

1. Revamp those vetting processes. We need to go much deeper than the standard background checks.
2. Foster cross-team collaboration. Those departmental walls need to come down and teams need to collaborate more.
3. Embrace cutting-edge technology. Some of the new AI-driven security solutions are truly impressive.
4. Implement thorough user monitoring. Continuous vigilance is non-negotiable.
5. Prioritize ongoing training. A security-aware culture is your first line of defense.

“As cybercriminals evolve their tactics, we need to stay ahead of the curve. It’s challenging, but it’s what keeps our field dynamic and vital.”

https://www.securitymagazine.com/articles/100942-nashville-man-charged-with-aiding-north-korean-laptop-farms

Ago 19, 2024 Stefano Silvestri Attacchi, Malware, Minacce, News, Phishing, RSS, Tecnologia 0

---

Nell’ultima settimana, il Centro Nazionale di Risposta alle Minacce Informatiche per la Pubblica Amministrazione (CERT-AGID) ha condotto un’intensa attività di monitoraggio e analisi delle minacce cyber nel panorama italiano. L’indagine ha portato all’identificazione di 35 distinte campagne malevole.

Tra queste campagne, 16 sono state classificate come mirate specificamente a entità italiane. Le rimanenti 19, sebbene di natura più globale, hanno comunque mostrato potenziali ripercussioni sul territorio italiano, sottolineando la natura transnazionale delle minacce informatiche.

In risposta a queste minacce, il CERT-AGID ha estratto e catalogato 357 indicatori di compromissione (IOC). Questi indicatori, che possono includere indirizzi IP, domini, hash di file malevoli e altri dati tecnici, sono stati successivamente condivisi con gli enti accreditati.

I temi più rilevanti della settimana

Nel corso dell’ultima settimana, il panorama delle minacce informatiche in Italia ha mostrato 13 distinti temi sfruttati per veicolare campagne malevole.

Tra i principali vettori d’attacco, il tema dei Pagamenti si è rivelato particolarmente insidioso, essendo stato utilizzato per diffondere una varietà di malware pericolosi come Quasar RAT, un Remote Access Trojan che permette il controllo remoto dei sistemi infetti. Questo tema è stato usato anche per diffondere SmokeLoader, un downloader noto per la sua capacità di scaricare ulteriori payload malevoli.

Infine, i Pagamenti sono stati anche il veicolo di Remcos, altro RAT con funzionalità avanzate di spionaggio e controllo. Oltre ai malware, sono state osservate campagne di phishing mirate agli utenti di servizi popolari come Netflix e Mailchimp, sfruttando la fiducia degli utenti in questi brand riconosciuti.

Le campagne nell’ambito Webmail hanno preso di mira diversi servizi, tra cui cPanel con attacchi generici di phishing verso gli utenti di questa piattaforma, e Roundcube, con una campagna specifica italiana rivolta agli utenti di questo client di posta open-source. Sono stati rilevati anche attacchi di phishing non brandizzato, che non sfruttano marchi specifici ma puntano a ingannare gli utenti con tattiche più subdole.

Il tema della mancata consegna (Undelivered) è stato sfruttato per campagne di phishing sia generiche che specificamente italiane, con gli attaccanti che hanno impersonato servizi come Poste Italiane e e di cPanel per ingannare gli utenti.

La tematica degli Ordini è stata utilizzata per veicolare una serie di malware pericolosi come AgentTesla, un keylogger avanzato e stealer di informazioni, Formbook, noto per le sue capacità di furto di credenziali e registrazione di tasti, e Guloader, un downloader utilizzato per distribuire ulteriori payload malevoli.

Un’attenzione particolare la merita le recente campagna su larga scala che utilizza il trojan Quasar RAT, un evento piuttosto raro nel panorama italiano. I cybercriminali stanno impiegando una strategia avanzata che consiste nell’invio di email ingannevoli con l’oggetto “Pagamenti Fattura,” mirate a convincere le vittime a scaricare un file eseguibile nocivo. Una volta eseguito, il malware compromette il sistema, consentendo ai malintenzionati di prendere il controllo remoto del dispositivo.

Malware della settimana

Nel corso dell’ultima settimana, il panorama delle minacce informatiche in Italia ha visto l’emergere di sei distinte famiglie di malware.

Tra le campagne più significative, AgentTesla si è distinto per una campagna italiana incentrata sul tema “Ordine” e in due campagne generiche focalizzate sul settore bancario. Gli attaccanti hanno sfruttato email contenenti allegati in formati diversi come XLSX, XLAM e VBS.

Remcos, un altro malware di rilievo, ha fatto la sua comparsa in due distinte campagne. La prima, mirata specificamente al contesto italiano, ha sfruttato il tema dei “Pagamenti” diffondendosi attraverso email con allegati in formato GZ. La seconda, di natura più generica, ha utilizzato il pretesto delle consegne (“Delivery”) per distribuire il malware tramite allegati ZIP.

SmokeLoader ha puntato anch’esso sul tema dei “Pagamenti” in una campagna italiana, utilizzando email con allegati XLSX come vettore di diffusione. Degna di nota è stata la campagna italiana che ha visto protagonista Quasar, un malware relativamente insolito nel panorama nazionale. Anche in questo caso, il tema dei “Pagamenti” è stato sfruttato come esca, con il malware distribuito attraverso email contenenti allegati ZIP.

FormBook ha fatto la sua comparsa in una campagna generica incentrata sul tema “Ordine”, diffondendosi tramite email con allegati ZIP. Infine, Guloader è stato identificato in una campagna italiana che ha sfruttato nuovamente il tema “Ordine”, questa volta utilizzando email con allegati in formato 7Z.

Phishing della settimana

Sono 12 i brand coinvolti nelle campagne di phishing questa settimana. Per quantità spiccano le campagne a tema Poste Italiane, cPanel e Unieuro, ma ancor di più le campagne Webmail che mirano a rubare dati sensibili agli utenti.

Nel corso dell’ultima settimana, il panorama delle minacce informatiche ha visto un’intensa attività di phishing che ha coinvolto ben 12 marchi noti. Tra le campagne più prolifiche, quelle che hanno preso di mira Poste Italiane hanno mostrato una particolare intensità. Questo fenomeno non sorprende, considerando il ruolo centrale che l’azienda svolge nella vita quotidiana di milioni di italiani, offrendo servizi bancari e postali essenziali.

Analogamente, cPanel, una piattaforma utilizzata per la gestione di siti web e servizi di hosting, è stata oggetto di numerosi attacchi di phishing. La compromissione delle credenziali di accesso ai sistemi di gestione web apre potenzialmente la strada a minacce su larga scala.

Unieuro è emersa anch’essa come bersaglio frequente, probabilmente sfruttando l’interesse dei consumatori per offerte e sconti su prodotti tecnologici. Tuttavia, la minaccia più pervasiva si è manifestata nelle campagne di phishing incentrate sui servizi di webmail. Queste operazioni, che mirano direttamente alle caselle di posta elettronica degli utenti, rappresentano un rischio particolarmente elevato per i motivi facilmente comprensibili.

Formati e canali di diffusione

Durante la settimana analizzata, sono state identificate 7 diverse estensioni di file utilizzate nelle campagne malevole. I file ZIP sono stati impiegati in tre occasioni, mentre le estensioni XLSX sono state rilevate in due casi. Per quanto riguarda le estensioni VBS, XLAM, XLS, GZ e 7Z, ciascuna è stata utilizzata una sola volta.

Per quanto concerne i metodi di diffusione, l’email tradizionale si è confermata il principale veicolo di propagazione, con 33 episodi distinti. I messaggi di testo (SMS) e le PEC sono stati utilizzati una sola volta ciascuno per la diffusione di contenuti malevoli.

---

---

---

https://www.securityinfo.it/2024/08/19/cert-agid-10-luglio-16-agosto-cpanel-webmail-sotto-attacco/?utm_source=rss&utm_medium=rss&utm_campaign=cert-agid-10-luglio-16-agosto-cpanel-webmail-sotto-attacco

Effective physical security is essential to any brick-and-mortar establishment, but it is even more crucial in the commercial real estate industry. Securing a workplace involves more than simply monitoring the entryway to the building — so how can security leaders ensure they are being proactive about defending their offices? 

Here, we talk with Security talks with Andrew Campagnola about emerging threats in office building security and how security leaders can address these concerns. 

Security magazine: Tell us about your title and background.

I am Vice President of Strategic Initiatives at VTS, the commercial real estate industry’s leading technology platform. Throughout my career, I have worked in many sectors of the industry, from integration to engineering, sales, business development and beyond. Prior to VTS, I held roles at leading access control and security companies including Chamberlain Group, Johnson Controls and LenelS2, which allowed me to gain experience in effectively guiding organizations to navigate the rapidly evolving landscape of security technology. In my current role, I leverage my background in physical security and business development to help ensure that VTS’ property technology (PropTech) solutions are designed with cutting-edge access control use cases that creates seamless and secure office experiences for VTS’ customers.

Security magazine: What are some emerging threats in office building security, and what proactive measures can be taken to mitigate risks?

There are many threats to workplace security today, including acts of violence or aggression, natural disasters, cyberattacks and so on. However, when listening to feedback from both leaders of commercial real estate companies and their tenants, it became clear that their priority is ensuring that employees are not only physically safe in an office building, but more so feel as though they are coming to a safe environment. Creating a feeling of safety and security throughout a facility is just as important as implementing security itself.

Part of the answer here includes ensuring security not only within individual office buildings but also in the transitional spaces between them, such as parking garages or common areas such as lounges, conference rooms or kitchens. Organizations can do this effectively by integrating various systems like access control, Physical Identity and Access Management (PIAM) solutions, and tenant management software. Tightly coupled solutions create a true ‘street-to-suite’ experience that allows employees to move seamlessly between different areas of the office complex while maintaining a consistent level of security. This approach not only enhances physical safety but also contributes to a sense of well-being and confidence among employees when navigating spaces throughout their office building. 

Security magazine: How can access control systems play a role in modern security strategies for today’s office buildings?

Think of access control as the foundational element that enables various other security strategies to work more effectively. Not only do they simply control access, but they simultaneously provide valuable data related to occupancy and the building itself — including access frequency and more. From there, these insights can be used to inform decisions on investing in additional security measures, such as increased lighting in parking lots at night or deploying extra security personnel during peak times, as well as identifying and securing areas of vulnerability.

Furthermore, the integration of mobile access reduces reliance on traditional access methods like keycards, which are susceptible to being lost, stolen or copied. While mobile access has been around for about 10 years, we as an industry are finally starting to see mainstream adoption because large consumer companies are starting to take notice of its benefits. By tying an individual’s identity directly to their mobile device, access control systems enhance security while also streamlining the authentication process for users.

Security magazine: Are there compliance considerations and industry standards for access control technologies that security leaders should be aware of?

The first thing that comes to mind is the use of biometrics in access control. When using biometrics, deploying organizations need to be aware of things like bias, training models, etc. However, it’s important to note that the landscape of standards in the security industry is still evolving. While there are no universally recognized standards, there are certain industry best practices and guidelines that companies may adhere to.

When it comes to standards, some large companies have proprietary technologies that have achieved widespread adoption, acting as a de facto standard within the industry. While this ultimately hampers system compatibility, the good news is there are software solutions available that sit on top of multiple access systems to enable interoperability. This offers a temporary workaround that not only enhances the end user experience but provides a viable solution until an industry-wide standard emerges.

Security magazine: What are the best practices for implementing access control technology?

Start by considering the long-term implications of the system or solution you are selecting. With hundreds of available systems and technologies, it’s tempting to opt for a niche solution to solve an immediate operational problem. However, this approach can potentially lock you into a technology that is difficult to update or integrate with other systems in the future. Evaluate systems based on factors such as data ownership, licensing terms and hardware compatibility to ensure your system isn’t just built for the ‘right now’ but for the future. If you’re not sure where to start, either partner with a technology leader who provides consultative services or consult with a subject matter expert who will provide unbiased guidance.

While there are a handful of companies and organizations working to create standards initiatives, there is no clear winner yet. For this reason, it is important to stay up to date with such initiatives and each manufacturers’ preferred format. By aligning your access control implementation with emerging standards and best practices, you can ensure greater interoperability, flexibility and scalability for your system over time. 

https://www.securitymagazine.com/articles/100929-the-future-of-security-and-access-control-for-office-spaces

Schools have been experiencing a growing number of cyberattacks with last year, marking a record high of 105% increase in ransomware attacks. Securin research found that over the last three years, 50% of cyberattacks against educational institutions have spiraled into full-blown ransomware attacks. These attacks have led to prolonged operational shutdowns, significant financial losses and a growing distrust in the education system’s cybersecurity defenses.

Aside from the financial ramifications, the children whose data gets leaked from these attacks have much more at stake. Files posted to the dark web can include sensitive information about students, such as school schedules, social security numbers, addresses, phone numbers and more. Having that data exposed on the dark web can lead to identity theft, financial fraud and severe emotional trauma for the affected students.

As they stand now, schools are not equipped to defend against the ever evolving and sophisticated cyberattacks looming at their doorstep. The best thing that school systems can do is to put themselves in a position where that data is much harder to access and, should that data be compromised, have a plan of action to deal with the leak swiftly. 

So, with the new school year on the horizon, it’s crucial for school boards to prioritize strengthening their cybersecurity strategies. As an essential item on their checklist, ensuring robust cybersecurity measures is vital for safeguarding against cyber threats. Here are four key areas of security that educational institutions should focus on to protect themselves, their staff and their students.  

Patch vulnerabilities 

Vulnerabilities in software or computer networks can be exploited by cybercriminals to gain unauthorized access and compromise sensitive data, leading to cyber extortion. Due to the education sector being a vast database of highly sensitive and personal information, it is a hot target for ransomware groups and other bad actors. To avoid attackers gaining access and stealing data or credentials, security teams need to rapidly fix holes in their security by implementing necessary patches and updates to their network. This is a continual process to fortify security defenses against ransomware and other cyber threats. As a place to start, IT leaders can and should familiarize themselves with The Common Vulnerabilities and Exposures (CVE) Program from the National Vulnerability Database to understand the details and statuses vulnerabilities that need patching. 

Connected devices 

More devices mean more points of access for attackers. They often exploit connected devices to deploy malware and botnets, infiltrating a school’s network under the radar. This can lead to a messy problem, where an entire network of devices and computers are infected with malicious software, making them inaccessible to users. This can result in spam distribution, credential stuffing or even a DDoS attack. 

Exposures in third-party software 

Often overlooked, third-party applications can also be an entry point for malicious actors. This can include management applications, progress monitoring tools, internet plugins and more. While these external vendors are useful and necessary for the classroom, critical vulnerabilities in these applications can grant attackers widespread access to overtake school websites as well as access student and faculty data. To combat this, educational institutions should perform regular vulnerability assessments, install the latest patches and educate both students and staff about the risks associated with these applications. 

Exposures introduced by misconfigurations 

When configuring assets or system parameters, mistakes can compromise databases and lead to costly consequences. Misconfigured certificates or access can leave gaps that allow malicious actors to infiltrate an institution’s network. Once inside, attack groups can obtain access to credentials and private information. Conducting a thorough scan of network assets and risk assessments can help organizations identify vulnerabilities so they can be promptly handled. 

Safeguarding schools 

Cybersecurity is an ongoing process, and cybercriminals are not wasting any time to plunder the treasure trove of sensitive information in schools. Typically known for slow to no response, the education sector’s cybersecurity teams have an opportunity to change the narrative. By keeping up with advisories like the K-12 Cybersecurity Act and the Cybersecurity Infrastructure Security Agency (CISA) Known Exposure and Vulnerability catalog, security teams at schools can stay abreast of threats and provide prompt patching to their systems. They can also educate their staff with regularly updated security training materials on how to recognize and respond to attacks. 

However, security teams require robust support from school boards to secure adequate funding, resources and defenses for continuous monitoring and regular testing of their networks for vulnerabilities. In addition to implementing immediate remedial actions, these teams must develop comprehensive contingency plans to effectively respond to cyberattacks. By proactively taking these measures, security teams can fortify their digital infrastructure and ensure a safer school environment year-round.

https://www.securitymagazine.com/articles/100937-preparing-for-cybersecurity-challenges-ensuring-a-safe-school-year