The recent Snowflake attack is an important reminder that data remains king when it comes to cyberattacks, and identities are the gateway for threat actors to access this coveted information. While in the event of an attack, service providers typically take the brunt of the blame. In this case, Snowflake reflected that it was actually how the company’s customers — including major companies like Ticketmaster and Advanced Auto Parts — chose to leverage its SaaS product that created the risk.

The implication is that because the victims failed to enable multi-factor authentication (MFA), they left themselves open to attacks such as phishing, credential stuffing and credential theft. Although the accusations might not have been off base, finger-pointing at customers rarely builds trust or regains loyalty. Instead, this is an opportunity to foster collaboration and discuss the importance of shared responsibility between SaaS service providers and customers to prevent future incidents. 

All businesses can take away lessons on the critical importance of understanding and utilizing a shared responsibility model for better SaaS security. This model is pivotal for effectively managing and mitigating SaaS security risks, especially in cloud environments where responsibilities are distributed between service providers and customers. But what should both service providers and their customers know for successful implementation?

The solution for proper SaaS identity security

The Snowflake attack underscores how poor identity hygiene leaves companies vulnerable. This incident leveraged compromised credentials and exploited weak security practices in SaaS environments, and it has had a negative impact on 165 customers to date.

According to Verizon’s 2024 Data Breach Investigations Report, the number one way a hacker gains access to a system in a web-based application attack is through stolen credentials (77% of the time). This challenge grows more complex as organizations grapple with the explosion of SaaS apps in modern environments. Today it is common for businesses to use multiple apps in order to increase productivity and streamline workflows. Because of this, there are many points of entry into organizations, making these common workplace tools a potential security risk. 

A shared responsibility model is essential to combat such threats. In this model, the SaaS provider and users play active roles in maintaining robust security. Shared responsibility is pivotal for effectively managing and mitigating risks, especially in cloud environments, where responsibilities should be distributed between service providers and customers. Putting the onus on only one party is ineffective and only solves only half the problem, which is why sharing responsibilities is the key to robust identity management. 

But who is the customer in the shared responsibility model? It’s the business leaders downloading and implementing SaaS tools within organizations. To be most effective, these business leaders need to adopt a secure business-led IT mindset. Business-led IT is the idea that employees are empowered to make their own decisions when it comes to work-related tools or apps they would like to use and download, without approval from IT. It helps increase productivity and innovation by giving them autonomy over solutions to enhance their workflow, but also creates risk within companies. As leaders in different departments — marketing, security, finance, etc. — adopt SaaS tools to be more efficient, they need to also share the burden created by the risk and champion “secure business-led IT.” This is how the shared responsibility model becomes effective. 

Breaking down the shared responsibility model for SaaS security

Both parties should be clear on expectations for proper security and to avoid the blame game if an incident occurs. By understanding who owns what responsibilities, companies will be better equipped to identify gaps and improve protocols on their end, while collaborating with providers to ensure that they are playing their roles in proper security hygiene.

The responsibilities should be broken down as the following:  

Service provider responsibilities

• Securing the underlying cloud infrastructure. Providers must ensure that their infrastructure complies with relevant regulatory standards and certifications, facilitating a secure customer environment.
• Ensuring that the cloud infrastructure is continually monitored, updated and compliant with security standards.
• Offering tools and guidance to help customers secure their data and applications.
• Producing software that is free from defects and known software vulnerabilities that could lead to unauthorized access. 

Customer responsibilities

• Securing access to their apps and having processes and identity security tools in place to manage user access.
• Securing their data, including implementing robust encryption, access controls and backup procedures.
• Implementing robust security practices (including enforcing MFA and regular user access audits) and ensuring that all apps and accounts are accounted for, configured securely and promptly offboarded when no longer needed.

The importance of proper identity hygiene

The Snowflake attack is a lesson in the importance of proper identity hygiene. To prevent similar incidents, companies should align their SaaS security strategies with their service providers so that everyone is clear on what role they should play in mitigating threats. While not all threats can be avoided, being proactive can dramatically reduce risk to ensure that critical data is safe and identities don’t become easy entry points for bad actors. 

https://www.securitymagazine.com/articles/100921-lessons-from-the-snowflake-breach-saas-security-needs-collaboration

Professional cycling has, in its recent history, been prone to a shocking variety of cheating methods and dirty tricks. Performance-enhancing drugs. Tacks strewn on race courses. Even stealthy motors hidden inside of wheel hubs.

Now, for those who fail to download a software patch for their gear shifters—yes, bike components now get software updates—there may be hacker saboteurs to contend with, too.

At the Usenix Security Symposium earlier this week, researchers from UC San Diego and Northeastern University revealed a technique that would allow anyone with a few hundred dollars of hardware to hack Shimano wireless gear-shifting systems of the kind used by many of the top cycling teams in the world, including in recent events like the Olympics and the Tour de France. Their relatively simple radio attack would allow cheaters or vandals to spoof signals from as far as 30 feet away that trigger a target bike to unexpectedly shift gears or to jam its shifters and lock the bike into the wrong gear.

The trick would, the researchers say, easily be enough to hamper a rival on a climb or, if timed to certain intense moments of a race, even cause dangerous instability. “The capability is full control of the gears. Imagine you’re going uphill on a Tour de France stage: If someone shifts your bike from an easy gear to a hard one, you’re going to lose time,” says Earlence Fernandes, an assistant professor at UCSD’s Computer Science and Engineering department. “Or if someone is sprinting in the big chain ring and you move it to the small one, you can totally crash a person’s bike like that.”

Here’s a video demonstration of the researchers’ hacking technique:

[embedded content]

The researchers’ technique exploits the increasingly electronic nature of modern high-end bicycles, which now have digital components like power meters, wireless control of fork suspensions, and wireless shifters. “Modern bicycles are cyber-physical systems,” the researchers note in their Usenix paper. Almost all professional cyclists now use electronic shifters, which respond to digital signals from shifter controls on the bike’s handlebars to move a bicycle’s chain from gear to gear, generally more reliably than mechanical shifting systems. In recent years, those wired electronic shifters have transitioned again to wireless versions that pair via Bluetooth, such as the popular Di2 wireless shifters sold by the Japanese cycling component firm Shimano, which the researchers focused on.

https://arstechnica.com/?p=2043094

In 2024 alone, $700+ million worth of cargo shipments were stolen. Modern heists bear little resemblance to the dramatized versions on shows like The Sopranos or Goodfellas. Today’s hijackers don’t need guns or elaborate schemes; all they require are login credentials to access billions of dollars in global shipments. While technology has revolutionized global logistics and helped meet growing customer expectations, it can also make shippers and manufacturers more vulnerable to losing massive amounts of cargo each year. 

The supply chain is no stranger to major disruptions (like the Francis Scott Key Bridge collapse and the ongoing Houthi rebel attacks in the Red Sea) that cause millions in lost revenue a year. These losses can often be mitigated by technology that gives users access to global shipping schedules on high-traffic routes. However, it can also make companies a target. Port operator DP World was the victim of a breach that forced operations to be suspended for three days last November, resulting in major delays for over 30,000 shipping containers. Companies relying on the supply chain hold a treasure trove of information cybercriminals want. By accessing critical data through a breach, these cybercriminals can pinpoint the exact location of valuable shipments and steal them directly from ports, railyards and airports, putting the global supply chain industry at immense risk.

Where logistics companies are vulnerable

One of the most significant vulnerabilities in any organization is its personnel. Cybercriminals frequently exploit human error to gain access to sensitive information. Whether it’s an employee loading cargo onto a container ship or a C-Suite executive analyzing shipment performance, all personnel are equally susceptible to falling victim to cybercriminals through various schemes.

• Phishing: On average, 30% of adults fall for phishing schemes in the United States. Despite company trainings and technology to block email scams, phishing remains a prevalent threat to business security and revenue. Cybercriminals often impersonate company leaders or colleagues, often targeting new hires, to lure employees into divulging their login credentials. Executive new hires can be the perfect target for these types of attacks. Their high-level clearance offers cybercriminals greater access to confidential information and logistics systems. By gaining these credentials, cybercriminals can infiltrate the logistics software suite and monitor a shipment’s movement from point A to point B, leading to potential theft.
• Stolen credentials and session tokens: Clicking on malicious links can lead to stolen session tokens that go unnoticed by the employee. Once an employee enters their login information on a compromised site, cybercriminals can capture and use these credentials to access company systems, a valuable shipment’s precise location and even the ETA of cargo. This unauthorized access can be prolonged, allowing cybercriminals to gather insights over an extended period without being detected.

Securing the supply chain: What the future holds

The reliance on passwords continues to be a major security flaw for the logistics industry. Studies show that over 50% of employees use the same password across multiple work-related accounts. Each employee builds a unique ecosystem of third-party tools and vulnerable access points, so it’s not far-fetched for cybercriminals to gain access to all accounts with a single compromised password. Although multi-factor authentication (MFA) can mitigate some risks, even some MFA methods are not phish resistant.

• Enterprise-wide single sign-on (SSO): SSO is an authentication method that allows users to log into multiple enterprise applications using one set of enterprise-managed credentials. Users will typically see this type of security at an enterprise level when adopting a supply chain visibility platform. For companies, SSO offers the advantage of unified login for all connected applications, mandatory use of various MFA methods and the ability to quickly disable employee access to all connected systems in the event of a breach or employee departure. This centralized control ensures that access to sensitive information is managed appropriately, enhancing overall security.
• Passwordless sign-in: Another emerging solution is passwordless sign-in, which leverages device verification codes. This method sends a unique code to an employee’s mobile phone, eliminating the need for a password. Employees only need to enter their username or email address and then verify the on-screen code (which expires after a short period) with their mobile device. This reduces the risk of password-related breaches, as there is no static password for cybercriminals to steal and reuse. This method of MFA is also considered phishing resistant because the MFA code is typed into the mobile device, not the site the user is logging into. 
• Device binding: This method works by binding corporate-issued devices to the corporate identity management system making company resources only accessible with these bound devices. Combining this with SSO and MFA essentially makes an account phishing resistant because even if the user credentials are compromised, the cybercriminal lacks the device necessary to complete the login verification, making user credentials effectively useless to cybercriminals. 

Protecting valuable assets

As cargo theft becomes increasingly sophisticated, companies must adapt by implementing advanced security measures and fostering a culture of vigilance. Training employees to recognize phishing attempts and employing robust authentication methods like advanced MFA, passwordless sign-in, SSO or device binding are crucial steps in safeguarding the global supply chain. By addressing the weakest links and reinforcing security protocols, organizations can better protect their valuable assets and revenue from being stolen.

https://www.securitymagazine.com/articles/100908-supply-chain-cybersecurity-and-modern-day-cargo-theft

Attackers have the information advantage

From SOC analysts to threat actors, everyone benefits from understanding the exposures existing in an organization’s external risks. While the SOC analysts’ benefits are more … wholesome, it is often found that adversaries have a more comprehensive understanding of an organization’s vulnerabilities. Leaked credentials, exposed documents, vulnerable hosts and hard-coded secrets frequently go unnoticed by organizations for months or years. Cyber adversaries consistently demonstrate their information advantage when it comes to discovering these exposures.

Why do attackers often have the information advantage?

Cybercriminals have developed effective strategies to maintain their information advantage. 

Knowing where to look

Cyber adversaries are adept at finding data leaks and exposed credentials because they know exactly where to search. They have an intimate understanding of where sensitive information might be exposed, whether in SaaS platforms, internet scanners, cloud storage solutions or public code repositories. A misplaced sense of passion and curiosity can be found in cybercrime communities, whether fueled by ideological causes or an insatiable lust for ill gotten gains, and it often manifests itself in developing and sharing creative new techniques for finding the information they are looking for. Given the sheer volume of third-party leaks that impact a variety of corporations (either directly or indirectly) and appear on cybercrime forums, we can see that cyber adversaries understand the modern attack surface better than many organizations themselves. They seem to appreciate the fact that the modern attack surface spreads far beyond any traditional notion of a perimeter and extends to the many disparate SaaS tools, data storage solutions, consultants, contractors and subcontractors that an organization uses in addition to the traditional hosts and on-premise web applications that make up the well understood organizational attack surface.

Dedicated time and resources

Adversaries dedicate significant time to reconnaissance. Generally, threat actors benefit from front-loading their campaigns with reconnaissance, allowing them to understand and probe at possible attack paths in detail. In recent years, more complex attack paths have been left in the past, favoring finding data accidentally exposed in a public place, an increasingly common phenomenon in the era of SaaSification — where an attacker can find exposed data on a third party SaaS tool that doesn’t have the ability to centrally log. And what better way for a criminal to find their crown jewel than by walking in through the front door? Unlike their corporate targets, who may be preoccupied with a new EDR deployment or writing log parsers for obscure cloud microservices, attackers can focus on studying their target’s attack surface and automating their collection strategies.

Automation

Automation plays a crucial role in maintaining the information advantage. Attackers use automated tools to continuously monitor their sources for new exposures, such as leaked credentials, exposed API keys, vulnerable subdomains, misconfigured services, etc. This allows them to react quickly in a variety of situations — like automatically attempting a new RCE exploit on public hosts with a specific software version running on them, or monitoring an organization’s public github for accidental commits that contain hard coded secrets using a scanner, and attempting access using the API keys before they can be rotated.

Collaborative ecosystem

Cybercriminals benefit from a robust ecosystem that facilitates the sharing of new techniques, exposed files, discovered credentials and other sensitive information. Platforms like Telegram and dark web forums are used to disseminate stolen data rapidly, giving typically hundreds to thousands of cybercriminals access to the same information. For example, Telegram hosts a variety of stealer log channels. The owner of the channel will host a stealer malware campaign that posts its infected devices stored browser credentials, cookies and other sensitive data to the channel, making them available to the groups members shortly after infection.

How can you gain the information advantage?

To level the playing field, organizations need to adopt a proactive approach to understanding their external attack surface and minimizing exposures.

Automated reconnaissance

Just as attackers use automation to exploit vulnerabilities at scale, organizations should employ automated tools to scan for exposures. The same tools professionals should employ here are those leveraged regularly by red teams for penetration tests. This includes monitoring for leaked credentials or leaked secrets in the public code locations organizations know their development teams use, scanning web applications for undocumented or misconfigured API endpoints or vulnerabilities, etc. The philosophy to follow here is that security professionals want to be running the reconnaissance phase of a penetration test on a regular cadence, as opposed to learning of exposures during a bi-annual penetration test. Once professionals understand the locations they are searching for exposures within, they can begin to automate the more manual steps. For example, if security professionals are manually Google dorking for exposed files which contain the organization’s internal file footer, e.g. “Property of Acme Corp. Company Confidential,” they can leverage the Google JSON Search API to quickly notify them when new files emerge, so they can determine if the files are indeed confidential or contain any revealing metadata. This may save security teams the hassle, and potential time delay, of manually dorking periodically for leaked files. Automations like these will enable organizations to exceed (or at worst, keep up with) the speed with which adversaries discover exposures, allowing companies to mitigate before damage can be inflicted.

Adversarial techniques

Organizations should use the same techniques that adversaries use. This includes leveraging offensive security tools for enumeration and reconnaissance that can reveal potential exposures. By adopting an adversarial mindset, defenders can anticipate where attackers typically look. Or, by monitoring their channels, defenders can anticipate where attackers are starting to look and secure those areas first. A great way to adopt the attacker’s mindset is to monitor dark web news sources like Daily Dark Web or Dark Web Informer to understand how threat actors communicate, what they are talking about lately and their jargon.

Collaboration and intelligence sharing

Participate in threat intelligence sharing with other organizations and security communities. By staying informed about the latest threats and exposures discovered by others, organizations can quickly apply that knowledge to your own security posture. Many industries have ISACs, which are member-driven threat sharing programs for companies in like-industries. These groups openly share threat intelligence indicators and evolving adversarial techniques (like new reconnaissance techniques) relevant to the group.

Regain and maintain the information advantage

Attackers don’t have to have the information advantage. By understanding the attack surface better than the adversaries, leveraging automation, adopting adversarial techniques and collaborating on threat intelligence, security professionals can regain and maintain the information advantage.

https://www.securitymagazine.com/articles/100907-reclaim-the-information-advantage-from-cyber-criminals

Ago 14, 2024 Marina Londei In evidenza, News, RSS, Vulnerabilità 0

---

I ricercatori di Oligo hanno reso nota l’esistenza di una vulnerabilità che colpisce tutti i principali browser e consente a un attaccante di sfruttare servizi locali, sistemi operativi e reti interne per scopi malevoli, come l’esecuzione di codice da remoto.

Il bug colpisce Chromium, Firefox e Safari e consente a siti web esterni di comunicare e potenzialmente sfruttare software che vengono eseguiti localmente su macchine macOS e Linux; i sistemi Windows, invece, non sono impattati dalla vulnerabilità. Nel dettaglio, i siti web pubblici possono comunicare con i servizi in esecuzione su localhost usando l’indirizzo 0.0.0.0; da qui il nome che i ricercatori hanno dato al bug.

Scegliendo una qualsiasi porta, un sito web può inviare richieste malevole che vengono processate dai servizi interni. “Quando i servizi utilizzano localhost, presuppongono un ambiente con restrizioni” spiegano i ricercatori. “Questo presupposto, che può (come nel caso di questa vulnerabilità) essere errato, si traduce in implementazioni di server non sicure“.

La vulnerabilità dei browser che ha 18 anni

I ricercatori di Oligo sottolineano che questo bug era già stato segnalato per la prima volta 18 anni fa, quando un utente di Firefox aveva affermato che dei siti web pubblici avevano attaccato il router nella sua rete interna. Il bug, segnalato come issue di sicurezza, è tuttora in stato “Open” ed è stato sfruttato più volte dagli attaccanti.

La issue è stata chiusa e riaperta più volte e i mantainer del progetto non sempre hanno concordato sulla natura della segnalazione, discutendo se fosse o no una vulnerabilità e se fosse specifica di Firefox o meno.

Prima della scoperta di Oligo, Chrome aveva cercato di risolvere il problema delle richieste provenienti da siti web esterni introducendo il Private Network Access (PNA), uno standard che si occupa proprio di limitare la capacità dei siti web di inviare richieste a server che si trovano su reti private. Il PNA distingue tra reti pubbliche, private e locali e impedisce alle pagine caricate in un contesto meno sicuro di comunicare con quelle in contesti più sicuri, prevenendo l’invio delle richieste.

Il problema, spiegano i ricercatori di Oligo, è che l’IP 0.0.0.0 non è inserito nella lista di indirizzi considerati privati o locali; effettuando una prova, il team è riuscito a inviare una richiesta all’IP locale da un dominio esterno e ottenere una risposta.

Il team di Oligo ha eseguito una serie di test usando applicazioni reali eseguite in locale, come Ray per l’esecuzione di workload di IA o istanze Selenium Grid: in entrambi i casi è stato possibile inviare richieste alle applicazioni locali.

Come proteggersi

Grazie al report di Oligo, le società dietro i principali browser hanno rilasciato dei fix per bloccare 0.0.0.0 come IP target nelle richieste.

In ogni caso, è bene proteggere le applicazioni locali a prescindere, senza attendere le patch dei browser. I ricercatori consigliano di implementare gli header PNA, aggiungere un livello anche minimo di autorizzazione per le applicazioni che vengono eseguite in locale, usare HTTPS quando possibile, implementare i token CSRF anche sulle applicazioni locali e verificare l’header HOST delle richieste per proteggersi da attacchi di DNS rebinding.

---

---

---

https://www.securityinfo.it/2024/08/14/0-0-0-0-day-la-vulnerabilita-maggiorenne-che-colpisce-tutti-i-principali-browser/?utm_source=rss&utm_medium=rss&utm_campaign=0-0-0-0-day-la-vulnerabilita-maggiorenne-che-colpisce-tutti-i-principali-browser

Artificial intelligence (AI) threat readiness was analyzed in a recent report by Pluralsight. The findings show that 56% of security professionals are concerned about AI-powered threats.

Over half of surveyed technologists are either extremely concerned or moderately concerned about AI-powered threats, with 6% saying they are not worried. According to the report, 40% of organizations have formal structured training and instruction for AI, and 74% of IT professionals worry that AI tools will replace their roles.

Over 75% of respondents indicated that threat intelligence and reverse engineering are the most valuable advanced cybersecurity skills of today, while 24% noted threat hunting among these skills.

Over a third (34%) of respondents suggested that Cybersecurity Data Scientists will become more mainstream in the near term and 22% indicated that exploit developers will also grow in popularity. Other rising cybersecurity roles include DevSecOps (16%), red team operators (12%), threat hunters (10%) and ICS/SCADA security engineers (4%).

Read the report.

https://www.securitymagazine.com/articles/100940-75-of-security-leaders-say-threat-intelligence-is-most-valuable-skill

https://www.securitymagazine.com/blogs/14-security-blog/post/100902-how-to-transform-the-defenders-dilemma-into-the-defenders-advantage

While remote working offers many benefits to employees, it can be a real headache for employers trying to secure their digital assets. After all, remote employees are accessing corporate resources from various locations and using a broad range devices, which makes safeguarding against unauthorized access even more tricky that what it already was. Fortunately, most of these challenges can be addressed by adhering to the following best practices: 

Conduct regular security awareness training

As organizations transition to a hybrid work environment, it’s crucial to educate teams on the importance of secure work practices. This knowledge is essential to ensure they’re equipped to recognize and mitigate the potential threats that come with flexible work arrangements. Regular participation in security awareness training programs is also essential. You will need to tailor the training content to address unique security challenges, roles, locations and regulatory requirements. 

Training programs should include content relating to the following areas:

• Password policies
• Phishing methods and recognition techniques
• Mobile device security
• VPN usage and rationale

To make training programs more fun, engaging and effective, security leaders can encourage employees to complete training modules by offering rewards, including leaderboards. Additionally, using a variety of training formats can help cater to different learning styles, making the material more accessible and enjoyable. For example, training modules can include videos and animations, interactive simulations and quizzes and live webinars with Q&A sessions.

Use multi-factor authentication (MFA) whenever possible

As the lines between work and personal life blur in a hybrid work environment, ensuring the security and integrity of company assets is more crucial than ever. One highly effective safeguard in this regard is the implementation of multi-factor authentication (MFA). By combining something an individual knows, such as their username and password, with something they have, such as their phone, MFA verifies not only their identity but also the health of their device, providing an additional layer of protection against unauthorized access. This not only safeguards the company’s assets but also provides peace of mind for employees, knowing that their access to company resources is only accessible to authorized individuals.  

Use a VPN to secure remote access

A common approach to enabling secure access to a company’s IT environment is to use a Virtual Private Network (VPN). A VPN creates a safe and encrypted tunnel between users and applications, ensuring that only authorized personnel can access company resources, regardless of their location. This helps maintain a secure and productive hybrid work environment, while ensuring that an organization’s data remains protected and compliant with industry standards.

It should be noted, however, that using a VPN can provide a false sense of security. While they can significantly improve online security, they can’t protect from all vulnerabilities, especially those that stem from personal mistakes. For example, even with a VPN, individuals are still vulnerable to hacking if they use weak and predictable passwords. Additionally, if a person forgets to connect to a VPN server, their activity may not be encrypted, leaving them exposed to potential risks.     

Block malicious traffic

To prevent malicious traffic from entering a network, security leaders should start by safeguarding their network at the DNS (Domain Name System) layer, where malicious domains are identified and blocked before they can even reach the organization’s perimeter. Security professionals may want to consider adopting a Next-Generation Firewall. Unlike traditional Firewalls, a Next-Generation Firewall is designed for high-performance networks, and are able to handle large volumes of data and traffic. Below are some of the most notable benefits of adopting a Next-Generation Firewall:   

• Performance: They are optimized for real-world traffic environments, including decryption of SSL traffic and simultaneous inspection of multiple layers. There are no compromises on performance and protection, unlike traditional firewalls. 
• Visibility: They provide real-time, cross-platform sharing and correlation of threat intelligence across the network. They can scale across distributed networks, including physical and virtual domains, IoT and multi-cloud environments. They will also provide granular visibility into users, devices and cloud applications. 
• Automation: A Next-Generation Firewall provides automated real-time detection and isolation of compromised devices and malware. They provide real-time deep inspection and use AI to anticipate attacks, and automate threat response and forensic analysis.

Apply the zero trust methodology

Many companies are adopting a zero trust approach which adds an additional layer of protection against account compromise, verifying trust and never assuming it. This approach ensures that remote connections are secure and users can only access resources after undergoing rigorous authentication and authorization protocols.

Adopting a zero trust approach will help to: 

• Minimize the attack surface and safeguard against potential data breaches.
• Provide fine-grained access control to safeguard cloud and container environments.
• Reduce the impact of a successful attack, minimizing downtime and financial losses.
• Meet regulatory compliance obligations. 

Establish unified security

Unifying security infrastructure is key to achieving seamless protection and simplified management. By integrating all security products and infrastructure within a single, unified platform, security professionals can eliminate the need for fragmented security solutions and disjointed user experiences. This allows security leaders to effortlessly manage and maintain their organization’s security posture, ensuring that the entire attack surface — including cloud, corporate and personal devices — is protected by uniform data security policies. This will enable the organization to set policies once and apply them effortlessly across all devices and cloud applications, where employees are working with sensitive data, ensuring that your data is protected wherever it goes.

Monitor everything!

As they say, people can’t control what they can’t see. In order to adequately secure the hybrid work environment, it is imperative that security leaders monitor all activity on your network. This includes monitoring all privileged account access, interactions with sensitive data and traffic flows throughout the network. Solutions are available that provide 24/7 monitoring of critical assets across a broad range of environments, including both on-premise and cloud-based platforms. These solutions will send real-time notifications to the relevant personal when suspicious activity is detected. Likewise, organizations should also implement an Intrusion Detection and Prevention System (IDPS) which monitors network traffic and other relevant system activities, analyzing patterns and anomalies and alerting security personnel to potential threats.        

Maintaining a secure hybrid environment

To maintain a secure hybrid environment, data security must be prioritized for both corporate and employee-owned devices, and data security teams must unify policy coverage across different channels, including email, cloud, web, network and endpoints to ensure visibility regardless of the employee’s location or device being used. Additionally, robust threat protection solutions are essential to protect employees from emerging threats, such as sophisticated zero-day attacks, phishing attacks and more.

https://www.securitymagazine.com/articles/100901-hybrid-workplace-vulnerabilities-ways-to-promote-online-safety

These days, everyone knows the importance of backing up their data. Everything needs to be backed up — from a laptop to the cloud platform on which many businesses rely. It feels fairly simple. 

Unfortunately, with bad actors finding new ways to attack businesses every day, nothing is ever that easy. Threat actors know good backups are the cheat code to not paying the ransomware, giving victims the ability to rewind the clock to before the attack. With that in mind, the bad guys have begun to actively target backups first.

With all of this in mind, here are a few things IT leaders should keep in mind to ensure their data is protected, and their business keeps on running — no matter what.

All businesses are at risk

The number one mistake a business could make is assuming that they won’t be the victim of a ransomware attack. Hackers have proven time and time again that there is no business too big or small to attack, nor are any industries off limits. 

Every business needs to assume they’re at risk and design their security posture accordingly. This doesn’t just involve ensuring there are tools to detect and mitigate an attack but writing a plan for how to recover quickly and efficiently. 

Basic backup isn’t enough

Organizations are more prone to business downtime now than ever before. Disruptions from cyberattacks, natural disasters, equipment failures, power outages, and other incidents have escalated in frequency and severity in recent years, and organizations continue to bear the brunt of it. While considering the productivity loss and reputational damage that businesses face in addition to financial consequences, downtime can be a death knell for businesses, especially for small and midsize businesses.

To mitigate potential damages and eliminate downtime in the event of an IT disaster, organizations need to have a proactive plan rather than a reactive one. However, most SMBs cannot afford to spend the money, time and resources required to research, implement and test disaster recovery plans. That is why Disaster-Recovery-as-a-Service (DRaaS) is swiftly gaining prominence. It allows an organization to back up its data (along with IT infrastructure configurations and disaster recovery runbook) in a third-party cloud computing environment. When a disaster strikes, the cloud service provider will provide the business with the DR orchestration necessary to regain access and functionality to the IT infrastructure.

Cloud isn’t immune to cyberattacks

While cloud service providers and platforms (like Microsoft Azure), ensure the security of their infrastructure and network with robust measures, the shared responsibility model of cloud security places the onus of data protection on the respective users and organizations. In today’s rapidly expanding threat landscape, it is thus critical for organizations to secure their data with a powerful third-party backup solution. It will help them comprehensively protect their cloud data while eliminating the single-cloud vulnerabilities and other potential pitfalls associated with leveraging cloud-native services for data backup.

When looking for a cloud data protection solution, be sure it includes the same robust features previously required on-prem. For example,

• Automated recovery testing: Guarantees the recoverability of data through automated testing without impacting production environments.
• Granular restoration: Offers the flexibility to restore entire systems or specific files, ensuring critical data is quickly accessible when needed.
• Ransomware detection: Employs advanced threat detection to identify and alert potential ransomware activities, safeguarding backups from malicious attacks.

https://www.securitymagazine.com/articles/100941-calling-for-backup-the-importance-of-disaster-recovery

Despite the joy younger generations derive from poking fun at the older cohorts of the population, the inevitable retirement of these veteran professionals — particularly in technical roles like network engineers, IT, cybersecurity, etc. — will create serious security implications.

A 2023 study of this impending wave of retirements (aptly dubbed the Great Resignation) surveyed CIOs and network engineers in multiple Western countries, discovering that 86% of US-based CIOs expect that at least 25% of their network engineers will retire in the next five years. 

The loss of these experienced individuals will compromise an organization’s ability to adequately manage networks, highlighting the need for greater network resilience and process automation. 

Why shorthanded network teams can be a security risk  

Experienced network professionals, due to their proximity and understanding of the network’s potential weaknesses, are the most qualified to optimize uptime and minimize downtime. However, with these network engineers retiring in droves, 95% of CIOs report that this shortfall has negatively affected their remaining people’s ability to manage networks. In addition to improper setups and other inefficiencies, a shortage of human oversight can make networks more susceptible to cybercriminal exploitation. 

If cybercriminals successfully infiltrate a business environment, there could be network outages. During cyberattack-induced network downtime, employees will be unable to access critical services and applications, nor will they be able to connect with each other and their customers. Every second that diminished networking teams struggle to restore operations is lost revenue and void productivity, not to mention degraded customer and partner relations as well as employee burnout and turnover.  

Safeguarding network security with out-of-band management

Businesses must do what they can to assist their remaining network personnel. One method is implementing solutions like out-of-band (OOB) management to help bolster network resilience. OOB management provides a secure, remote connection to IT network environments, allowing engineers to manage and remediate network assets from any location. Specifically, network engineers can use serial console servers to open up an alternative path through a separate management plane, enabling them to access physical and virtually connected network devices even during outages or disruptions from cyberattacks. 

Moreover, OOB management permits engineers to lock down affected network elements and restrict access. For example, should malware or ransomware cause a breach, engineers can utilize the console port to disable access to impacted network equipment. Likewise, they can shut down servers and disconnect wide-area network connections to isolate a breach. The console port even allows engineers to rebuild and reconfigure devices to factory default. 

Improving everyday process and supporting remote workforces 

If the mass retirement of veteran engineers and IT professionals wasn’t challenging enough, figures indicate companies today struggle to find technical talent. According to a Deloitte survey, almost 90% of technology industry leaders say recruiting and retaining talent is a moderate or major challenge. Unsurprisingly, the study of the Great Resignation points out that 98% of surveyed engineers said they had to achieve more with fewer resources. With feelings of burnout on the rise, businesses need a way to protect their teams from getting overwhelmed. 

Thankfully, depleted engineering teams can leverage OOB management to not only boost network resilience against cyberattacks but also automate various networking processes such as configurations, first-day deployments and day-to-day operation of network infrastructure. Automating everyday management tasks is particularly vital for under-pressure engineers, easing the large load left on their shoulders from the departure of their more experienced coworkers. 

Because OOB management allows for the remote deployment, monitoring and management of networking devices, it reduces the need for engineers to visit remote sites to perform manual remediation amid cyberattacks. These remote remediation tools and capabilities provide opportunities for upskilling and — more importantly — support remote and hybrid working practices, which is ideal for expanding recruiting efforts. 

Cybersecurity is a perennial challenge  

Returning to that analysis of the Great Resignation, one will find that 22% of US-based CIOs anticipate that 75% of their workforce will retire within the next several years, which was much higher than any other surveyed country. As experienced and skilled professionals retire across positions, cybercrime continues to grow in the number of victims and the amount of money stolen each year.   

With less personnel available to devote to cybersecurity, it is paramount that companies invest in emerging technologies like artificial intelligence tools and 5G-powered networks. To that end, businesses must find and deploy an OOB management solution capable of incorporating and streamlining these advanced technologies not only to strengthen security but also to enhance everyday network efficiency. 

https://www.securitymagazine.com/articles/100896-network-security-implications-of-the-great-resignation