There’s been some encouraging growth in the last five years for women working in tech, representing 33% of the sector’s workforce. However, since 2020, there has only been a .2% increase, that there is still much work to be done. This is especially true in cybersecurity — with women making up one-fourth of the workforce. While women continue to chip away at the glass ceiling to succeed in a field that has historically been dominated by men, the reality is that doors are still the last to be knocked on. 

Spread awareness at higher education 

Higher education is one of the most pivotal times for young adults to discover what they want to do in their careers. These formative years are when they discover their passions, set their path, and dive headfirst into planning their futures. With this in mind, it’s incredibly important to give young women the whole picture and not just the career boxes that society often puts them in. 

It starts with the universities. Campuses must offer more programs, courses, clubs and job fairs to educate women about the career path and support them if they choose to pursue it. More importantly, they should bring in more female cybersecurity leaders who can speak to their experiences. Early access to meeting other women in technology fields provides students with real examples that they can aspire to. 

Cybersecurity practitioners have the unique opportunity to influence the next generation of workers in our trade. It is their job to educate younger generations on what they do, what a career in the industry can look like, and what’s possible for young women in this field. 

Employers should create programs tailored to women 

Deciding to pursue the career is just the first step. Sticking with that decision and persevering through the hardships to come will be the true challenge. Employers can help. Dedicated programs tailored to helping women feel supported as they navigate the field can make the difference between a company having equal representation or continuing the status quo. 

These extended programs should empower women to prioritize both their careers and their personal aspirations, such as being able to temporarily step away for maternity (or the broader parental) leave without the fear of falling behind. Encourage your employers to spread awareness and make sure they’re primed with the tools to coach teams on how they can be more supportive. 

Policies and procedures within workplaces should support everyone and it’s the duty of leaders to make sure they’re creating an inclusive environment.

Become a role model 

Mentors are one of the most important parts of one’s career. The right one is someone that can provide career and personal support. For women, having a role model that reflects what they see in the mirror can make or break this potentially career-shaping bond. 

They don’t call it ‘girl power’ for nothing. Having a female leader that a young woman can turn to for advice is imperative. Our personal experiences are what shapes our advice. A woman who has clawed her way to the top likely has a different outlook than her male counterpart on how to have your voice heard by peers or bosses. 

https://www.securitymagazine.com/articles/100909-improving-pathways-for-women-in-cybersecurity

Ago 02, 2024 Marina Londei Attacchi, News, Phishing, RSS 0

---

I ricercatori di Guardio Labs hanno scoperto una massiccia campagna che ha sfruttato il servizio di protezione e-mail di Proofpoint per inviare milioni di e-mail di phishing. Chiamata “EchoSpoofing“, la campagna ha colpito gli utenti di compagnie molto note in tutto il mondo, tra le quali Disney, IBM, Nike, Best But e Coca-Cola.

“Gli attaccanti hanno inviato con successo milioni di e-mail che sembravano provenire da brand e compagnie conosciute, tutte firmate e autenticate, con l’obiettivo di sottrarre le carte di credito” scrivono i ricercatori.

In un esempio condiviso sul blog, gli attaccanti hanno inviato una mail dal dominio legittimo disney.com in cui si avverte l’utente che il suo account della piattaforma Disney+ è scaduto. In fondo alla mail un pulsante per l’estensione della durata dell’account rimanda a una pagina falsa della piattaforma che offre all’utente un’offerta per rinnovare il suo abbonamento. Procedendo, alla vittima viene richiesto di inserire le proprie informazioni personali e finanziarie per continuare a usufruire del servizio; questi dati vengono usati poi dagli attaccanti per sottrarre denaro all’utente.

Tornando all’e-mail di phishing, si nota che il dominio disney.com è correttamente presente negli header e c’è anche il logo originale: la mail è compliant con le misure di autenticazione e di sicurezza ed è stata firmata con la chiave autentica del dominio. Analizzando il percorso delle e-mail, i ricercatori hanno scoperto che dietro questo flusso c’era una configurazione errata di Proofpoint.

E-mail di phishing tramite i server Proofpoint

Tutte le e-mail analizzate venivano gestite da un server Proofpoint che le inviava ai diversi destinatari. Il server utilizza la soluzione di sicurezza per e-mail della compagnia che agisce come una sorta di “firewall” per gestire i messaggi in entrata e in uscita e offrire alle imprese un unico punto di controllo.

Il problema sta nel fatto che il server Proofpoint è in grado di inviare le e-mail per conto dei mittenti, aggiungendo la firma per l’autenticazione al posto dei brand che utilizzano il servizio; ciò significa che un attaccante deve solo trovare un modo per inviare le e-mail di phishing attraverso il relay Proofpoint, e a quel punto il server autenticherà le comunicazioni.

I messaggi malevoli sono stati inviati da vari tenant Microsoft 365 compromessi, controllati degli attaccanti. Questi tenant accettavano i messaggi di phishing e li inviano all’infrastruttura dei brand affinché passassero poi per il relay di Proofpoint.

Come spiegano i ricercatori, i controlli di Sender Policy Framework erano troppo permissivi e ciò ha consentito a qualsiasi account Microsoft 365, anche non verificato, di inviare e-mail per conto dei brand e autenticarle, rendendole legittime agli occhi degli utenti.

L’impatto di EchoSpoofing

I ricercatori spiegano che la campagna è iniziata a gennaio 2024 e, secondo l’analisi, da quel momento sono state inviate circa 3 milioni di e-mail di phishing al giorno, con picchi di 14 milioni.

La tecnica usata dagli attaccanti gli ha permesso di colpire brand noti e di farlo su scala mondiale e massiccia: i relay Proofpoint non solo autenticano le email per conto del mittente, ma consentono anche di inviare un elevato numero di messaggi al giorno.

I ricercatori hanno contattato Proofpoint a maggio, non appena hanno scoperto la campagna. La compagnia ha specificato che era a conoscenza delle attività malevole da fine marzo e aveva già provveduto ad avvisare i suoi clienti del problema. Nonostante però Proofpoint abbia avvisato Microsoft degli account Office 365 compromessi, questi account sono rimasti attivi per oltre 7 mesi.

Il team di Guardio Labs ha confermato l’impegno di Proofpoint nel proteggere i suoi consumatori: la compagnia ha aiutato i suoi clienti a modificare le impostazioni del relay con istruzioni scritte e in formato video, ha creato una pagina dedicata sul portale della community e spiegato gli impatti dell’attacco e delle configurazioni errate.

“Non appena abbiamo cominciato a bloccare l’attività degli spammer, gli attaccanti hanno accelerato i propri test e si sono spostati velocemente su altri consumatori. Abbiamo stabilito un processo continuo per identificare i nuovi clienti colpiti di giorno in giorno, ridefinendo le priorità per sistemare le configurazioni” ha spiegato Proofpoint sul suo blog.

Per arginare il problema, Proofpoint ha proposto l’utilizzo dell’header X-OriginatorOrg specifico per ogni vendor che viene inserito in tutte le e-mail in uscita, incluse quelle che sono passate per il relay. L’header contiene l’account name di Office365 e viene usato per verificare la sorgente delle e-mail, garantendo che solo i tenant autorizzati possano inviare e-mail autenticate.

---

---

---

https://www.securityinfo.it/2024/08/02/server-proofpoint-usati-per-inviare-milioni-di-e-mail-di-phishing/?utm_source=rss&utm_medium=rss&utm_campaign=server-proofpoint-usati-per-inviare-milioni-di-e-mail-di-phishing

HID has released its 2024 State of Physical Access Control Report, revealing five notable trends that may indicate the future of access control technology. The five key trends shown in the report are: 

1. Digital ID and mobile access are predicted to be universal.
2. Open standards are driving more converged security solutions.
3. Sustainability has a greater impact on business decisions. 
4. The use of artificial intelligence analysis is increasing. 
5. Biometrics are becoming more prominent, particularly in contactless solutions.

Breaking down the key trends 

Digital ID and mobile access are predicted to be universal

According to the report, 39% of organizations actively utilize mobile identities. Contactless solutions (48%) and mobile access (44%) were the two greatest trends respondents noted. 

Open standards are driving more converged security solutions

48% of organizations have badge scanning or similar access control systems in place, and 43% of respondents declared smart buildings and flexible workplaces to be within the top trends shaping the future of access control. 

Sustainability has a greater impact on business decisions

63% cite sustainability experts as either partially or fully consulted when upgrading physical control access systems.

The use of artificial intelligence analysis is increasing

38% intend to incorporate AI technology with physical access control systems, while only 23% reported having no plans to do so.

Biometrics are becoming more prominent, particularly in contactless solutions

The biometrics market is predicted to reach $136.18 billion by 2031. 

https://www.securitymagazine.com/articles/100905-new-report-identifies-top-5-trends-in-physical-access-control

Ago 02, 2024 Marina Londei Attacchi, In evidenza, News, RSS 0

---

Il BlackBerry Research and Intelligence Team ha scoperto una nuova campagna del gruppo APT indiano SideWinder che ha colpito diversi porti e infrastrutture marittime nell’Oceano Indiano e nel Mar Mediterraneo per scopi di intelligence.

Conosciuto anche come Razor Tiger, Rattlesnake e T-APT-04, il gruppo è attivo almeno dal 2012 ed è uno degli APT più longevi. Fin dall’inizio i cybercriminali hanno colpito aziende e obiettivi militari e governativi, soprattutto in Pakistan, Afghanistan, Cina e Nepal.

I ricercatori spiegano che SideWinder utilizza lo spear-phishing via email e tecniche di DLL side-loading per eludere i controlli di sicurezza. Il gruppo invia documenti malevoli alle vittime mascherandoli da file legittimi, inserendo loghi, nomi e temi usati dall’azienda in cui lavorano gli utenti.

Il titolo e il contenuto dei documenti gioca su un senso di urgenza e sull’instillare la paura negli utenti, in modo che aprano immediatamente il file. In un esempio riportato dai ricercatori, il file era un rapporto su un presunto caso di molestie sessuali per il quale l’utente era indagato; in altri casi, i documenti parlavano di possibili licenziamenti o tagli di salario.

Leggendo il contenuto del file, le vittime erano talmente distratte che non notavano eventi strani sul dispositivo, come popup che si aprivano all’improvviso o un aumento elevato dell’uso della CPU, segnali di un’infezione malware.

I documenti creati dal gruppo sfruttano una tecnica di remote template injection basata sulla CVE-2017-0199, una vulnerabilità nota e risolta di Microsoft Office. “La patch per questa CVE è disponibile dal 2017, quindi gli attaccanti stanno scommettendo sul fatto che molte grandi organizzazioni con infrastrutture obsolete, frammentate o antiquate potrebbero avere degli endpoint non patchati adeguatamente” scrivono i ricercatori.

Una volta aperto il file, viene scaricato un file RTF che sfrutta la CVE-2017-11882 per eseguire una shellcode, la quale controlla se il sistema è un ambiente virtuale o “reale”. La shellcode controlla inoltre il tipo di processore e prosegue con la catena d’infezione solo se è Intel o AMD. Se le promesse sono favorevoli, la shellcode prosegue con l’esecuzione di BlackBerry Research and Intelligence Teamodice JavaScript che imposta la connessione col server C2 degli attaccanti al quale inviare le informazioni raccolte.

Il gruppo ha colpito strutture in Pakistan, Egitto, Sri Lanka, Bangladesh, Myanmar, Nepal e nelle Maldive. I ricercatori del BlackBerry Research and Intelligence Team spiegano che il gruppo sta migliorando la propria infrastruttura per colpire nuove vittime e spostarsi in nuove regioni, quindi nel prossimo futuro ci si aspettano nuove campagne a opera di SideWinder.

Per proteggersi da questi attacchi i ricercatori consigliano di applicare le patch disponibili per software e sistemi, implementare soluzioni per il filtraggio delle email e investire sulla formazione del personale contro gli attacchi di phishing.

---

---

---

https://www.securityinfo.it/2024/08/02/lapt-sidewinder-ha-attaccato-diversi-porti-nelloceano-indiano-e-nel-mar-mediterraneo/?utm_source=rss&utm_medium=rss&utm_campaign=lapt-sidewinder-ha-attaccato-diversi-porti-nelloceano-indiano-e-nel-mar-mediterraneo

.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:16px;margin-top:16px;margin-bottom:16px}
.w3-leftbar{border-left:6px solid #502d52!important}
.w3-color,.w3-hover-color:hover{color:#502d52!important;background-color:#ecdeed!important}
.w3-large{font-size:20px!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif}
.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}

What are the most important qualities, skills or experiences to seek when looking to advance a career in security? When asking security leaders this question, the responses are endless.

Curiosity is a common answer. “Stay thirsty,” says Jordan Avnaim, Chief Information Security Officer at Entrust. “Ask questions, listen, and learn from others’ experiences. Be daring. Safely experiment and be comfortable making mistakes.”

The ability to constantly learn and ask questions is another. In a world of frequently emerging threats, knowing when to ask questions is a valuable skill to acquire.

John Anthony Smith, Founder and CSO of Conversant Group, says, “Never take anything at face value. Because at the end of the day, humans are fallible and we make mistakes. As security professionals, it is our duty to question all things that are stated as truth to make sure that they truly are, in fact, secure.”

Communication is another useful quality the security professionals find useful.

“Communication is critical,” says George Jones, Chief Information Security Officer at Critical Start. “Being able to take all of the technical pieces of cybersecurity and digest it into something that an executive or a senior leader can better process so that they’ll understand how things impact the business is critical.”

All of these qualities are excellent for security professionals to develop. Although answers may vary on what skills security professionals should practice, there is one consistent recommendation among most security leaders: find a mentor.

“Mentorship is invaluable to advance a security career,” Jones says.

Security leaders often discuss the value that finding a mentor can have on a career. Establishing a connection with a mentor can build a professional’s network, expand their skillset, open doors to new opportunities and more.

“Left to our own devices, we’re only as good as our own creativity and what we’re able to find in a Google search,” Smith says. “And I would say many of the softer and finer skills can’t be honed that way. It requires interaction with human beings.”

Receiving mentorship is not the only way to grow a security career. While learning from a mentor is a beneficial experience, many security leaders have also found that offering mentorship is equally advantageous.

“Good mentorship is bidirectional. It’s not just one way. I’ve learned a lot from my mentees, and I’ve helped my mentors with a few things along the way as well,” Avnaim says. “It’s a mutually beneficial relationship.”

Each mentorship relationship can present an opportunity to learn something new.

“I get something out of every person that I work with,” Jones says. “I think that’s helpful as a mentor. It’s an opportunity for me to give and to stay connected with emerging trends, continuously develop my leadership skills, and foster that collaborative relationship.”

Mentorship connections can also give security professionals the ability to sharpen preexisting skills.

“You know the old saying that iron sharpens iron? I fervently believe that saying kind of applies here,” Smith says. “I believe that folks need peer groups or mentors that they can bounce ideas off of, that they can learn from and that they can hone their skills against.”

Good mentorship — whether given or received — doesn’t just benefit a person’s career in the short-term. It is something that sticks with them as they continue to grow as a professional.

“I’ve been fortunate to have several mentors who have significantly shaped my career,” Jones reflects. “One in particular taught me the importance of people. As a young manager, I didn’t really know what I was doing. And this person that I still occasionally speak with today taught me how to connect with my staff, and to really understand them and serve them in order to get the most out of them.”

Engaging in mentorship can provide more than just professional development opportunities, it can also provide an opportunity to embark on a rewarding journey.

“Having had and continue to have so many great mentors in my life, I recognize the value of mentorship and continue to look to provide that same value to others. It’s very rewarding for me to do so,” Avnaim says.

There is not a singular, specific path that security professionals must follow in order to find a mentor (or a mentee). However, one of the most effective ways to find a mentor is to engage in networking.

Networking comes in many forms, and all of them can lead to a valuable mentor relationship.

“First and foremost, I would always recommend looking inside your organization and finding that leader that that you admire the most in your organization,” Jones suggests.

Although meeting other professionals at conferences or industry events can be fruitful, it may also be overwhelming. Security leaders warn against trying to rush into a mentorship relationship, and instead advise that professionals allow the relationship to develop organically.

“Undoubtedly, relationships will be forged over time,” Avnaim assures. “Once nurtured a bit, it takes a little effort to help develop into a good mentor and mentee relationship.”

Mentorship is a valuable career-building experience, but it is also so much more. It is an opportunity to form connections, understand new perspectives and gain better insights into the security world. Perhaps the most convincing argument in favor of mentorship is that it provides value not just for the mentor and the mentee, but the entire security industry.

“We need more security professionals,” Smith says. “And we need good ones.”

https://www.securitymagazine.com/articles/100878-mentorship-advances-security-careers

As part of today’s blockbuster prisoner swap between the US and Russia, which freed the journalist Evan Gershkovich and several Russian opposition figures, Russia received in return a motley collection of serious criminals, including an assassin who had executed an enemy of the Russian state in the middle of Berlin.

But the Russians also got two hackers, Vladislav Klyushin and Roman Seleznev, each of whom had been convicted of major financial crimes in the US. The US government said that Klyushin “stands convicted of the most significant hacking and trading scheme in American history, and one of the largest insider trading schemes ever prosecuted.” As for Seleznev, federal prosecutors said that he has “harmed more victims and caused more financial loss than perhaps any other defendant that has appeared before the court.”

What sort of hacker do you have to be to attract the interest of the Russian state in prisoner swaps like these? Clearly, it helps to have hacked widely and caused major damage to Russia’s enemies. By bringing these two men home, Russian leadership is sending a clear message to domestic hackers: We’ve got your back.

But it also helps to have political connections. To learn more about both men and their exploits, we read through court documents, letters, and government filings to shed a little more light on their crimes, connections, and family backgrounds.

Vladislav Klyushin

In court filings, Vladislav Klyushin claimed to be a stand-up guy, the kind of person who paid for acquaintances’ medical bills and local monastery repairs. He showed, various letters from friends suggested, “extraordinary compassion, generosity, and civic and charitable commitment.”

According to the US government, though, Klyushin made tens of millions of dollars betting for and against (“shorting”) US companies by using hacked, nonpublic information to make stock trades. He was arrested in 2021 after arriving in Switzerland on a private jet but before he could get into the helicopter that would have taken him to a planned Alps ski vacation.

Klyushin never met his father, he said, a man who drank “excessively” and then was killed during a car theft gone bad when Klyushin was 14. Klyushin’s mother was only 19 when she had him, and the family “occasionally had limited food and clothing.” Klyushin tried to help out by joining the workforce at 13, but he managed to graduate high school, college, and even graduate school, ending up with a doctorate.

After various jobs, including a stint at the Moscow State Linguistic University, Klyushin took a job at M-13, a Moscow IT company that did penetration testing and “Advanced Persistent Threat emulation”—that is, M-13 could be hired to act just like a group of hackers, probing corporate or government cybersecurity. Oddly enough for an infosec company, M-13 also offered investment advice; give them your money and fantastic returns were promised, with M-13 keeping 60 percent of any profits it made.

This was not mere puffery, either. According to the US government, the M-13 team “had an improbable win rate of 68 percent” on its stock trades, and it “generated phenomenal, eight-figure returns,” turning $9 million into $100 million (“a return of more than 900 percent during a period in which the broader stock market returned just over 25 percent,” said the government).

But Klyushin and his associates were not stock-picking wizards. Instead, they had begun hacking Donnelly Financial and Toppan Merrill, two “filing agents” that many large companies use to submit quarterly and annual earning reports to the Securities and Exchange Commission. These reports were uploaded to the filing agents’ systems several days before their public release. All the M-13 team had to do was liberate the files early, read through them, and buy up stocks of companies that had overperformed while shorting stocks of companies that had underperformed. When the reports went public a few days later and the markets responded to them, the M-13 team made huge returns. Klyushin himself earned several tens of millions of dollars between 2018 and 2020.

To avoid consequences for this flagrantly illegal behavior, all Klyushin had to do was stay in Russia—or, at least, not visit or transit through a country that might extradite him to the US—and he could keep buying up yachts, cars, and real estate. That’s because Russia—along with China and Iran, the largest three sources of hackers who attack US targets—doesn’t do much to stop attacks directed against US interests. As the US government notes, none of these governments “respond to grand jury subpoenas and rarely if ever provide the kinds of forensic information that helps to identify cybercriminals. Nor do they extradite their nationals, leaving the government to rely on the chance that an indicted defendant will travel.”

But when you have tens of millions of dollars, you often want to spend it abroad, so Klyushin did travel—and got nabbed upon his arrival in Switzerland. He was extradited to the US in 2021, was found guilty at trial, and was sentenced to nine years in prison and the forfeiture of $34 million. It is unclear if the US government was able to get its hands on any of that money, which was stashed in bank accounts around the world.

Klyushin’s fellow conspirators have wisely stayed in Russia, so with his release as part of today’s prisoner swap, all are likely to enjoy their ill-gotten gains without further consequence. One of Klyushin’s colleagues at M-13, Ivan Ermakov, is said to be a “former Russian military intelligence officer” who used to run disinformation programs “targeting international anti-doping agencies, sporting federations, and anti-doping officials.”

https://arstechnica.com/?p=2040698

On July 23, 2024, KnowBe4 announced that a North Korean hacker attempted to infiltrate its systems. According to the statement, the hacker constructed a believable identity by leveraging a valid yet stolen identity based in the United States and using an AI-enhanced image. After interviews were conducted, the hacker passed background checks and reference checks and received the job. The hacker was sent a company device, and they began to load malware onto it. Once the SOC recognized something was amiss, the device was contained and the hacker’s infiltration attempts were unsuccessful. The announcement asserts that this incident is a part of an organized, state-sponsored criminal ring. 

Security leaders weigh in 

Stephen Kowski, Field CTO at SlashNext Email Security+:

“The KnowBe4 incident reveals how state-sponsored attackers are evolving to create convincing fake identities. It’s clear we need to rethink our approach to security. This means implementing more rigorous vetting, constant monitoring and fostering seamless collaboration across HR, IT and security teams. By harnessing the power of machine learning and behavioral analysis, we can stay one step ahead of these sophisticated threats and safeguard our digital ecosystems.” 

Mr. Piyush Pandey, CEO at Pathlock:

“This incident at KnowBe4 is a great example as to why organizations need to establish continuous controls monitoring capabilities to detect and respond to suspicious activities promptly. Regular audits of employee access activities can help identify anomalies early, allowing them to initiate identity threat response protocols before a breach becomes too widespread.

“Also, strict access controls layered with technologies, such as data masking and dynamic access controls, can limit access to sensitive information. This is an important component of least privilege, ensuring employees only have access to the data necessary for their role.” 

Callie Guenther, Senior Manager, Cyber Threat Research at Critical Start:

“North Korean operatives are increasingly infiltrating Western companies by posing as legitimate IT workers, using sophisticated methods to bypass hiring processes. They create fake identities, use proxies and exploit remote work trends to avoid detection. Companies can identify potential threats by scrutinizing resumes, verifying identities and monitoring for unusual behavior. Federal agencies like the FBI, CISA, DOJ and the Treasury Department can assist businesses by providing guidance, intelligence and legal support. The geopolitical threat includes generating revenue for North Korea’s regime, facilitating cyber espionage and straining international relations, particularly with China’s implicit support. Businesses must adopt stringent security practices and collaborate with federal agencies to mitigate these risks.” 

John Bambenek, President at Bambenek Consulting:

“Ensuring employees, and especially contractors, has been a weak spot in corporate security for as long as there have been businesses. The World Bank / Satyam debacle is probably the most extreme example. Unfortunately, this problem has gotten significantly worse since the pandemic with many companies remaining fully remote. However, the 100% in-office workplaces are far from immune. There just aren’t good answers except trying to find the obvious bad actors up front and maintaining vigilant behavioral monitoring of key employees in the workplace looking for problematic activities.” 

https://www.securitymagazine.com/articles/100899-north-korean-hacker-tries-to-access-knowbe4-security-leaders-react

On July 19, CrowdStrike, one of the largest endpoint security providers, issued an update to Windows servers globally that caused them to enter a “crash loop,” resulting in the infamous Blue Screen of Death (BSOD). CrowdStrike explained the issue was caused by a “defect found in a single content update for Windows hosts.” The downstream impact of this bug resulted in one of the largest and broadest outages in history.

When situations like this occur, everyone is scrambling — vendors and CISOs alike — trying to uncover what happened and determine a way to fix or contain the impact before threat actors catch on and try to exploit a vulnerability. While the spotlight is on the vendor to provide a mitigation method or fix, companies often can’t wait long due to the impacts on their day-to-day and the enormous pressure placed on CIOs and CISOs whenever a business impact occurs — making situations like this even more critical. 

What exactly happened?

While the story is still developing, a poorly formatted update file appears to have caused CrowdStrike’s top-level drivers to crash. This affected any customer using Windows machines that undergo automatic updates and caused mass outages globally, affecting industries ranging from healthcare and automotive to airlines and banks.

Typically, vendors release staged or rolling updates, which allow companies time to test and incrementally deploy over time to a subset of machines to ferret out any issues before the update affects everyone. However, in this case, there wasn’t an option for that level of due diligence for customers who pre-selected the “auto-update” function. This raises an important question: Are auto-updates worth it?

To automatically update… or not?

There is undoubtedly a great deal of pressure on security vendors, CISOs and CIOs to stay one step ahead of threat actors, especially as AI and emerging technologies have expanded attack surfaces. The pressure on security leaders leads them to emphasize speed and choose automatic updates for all computers over manual (picking the time), staged (not rolling to every system) or versioned (remaining on N-1 or N-2 version behind) software updates.

Automatic updates are encouraged across the industry for heightened security. Still, the reality is that it is very rare for there to be a significant leap in the ability to protect and secure the organization between new versions of the agents. Further, unless companies carefully create policies to stage auto-updates to a subset of “test” machines first, they risk propagating problems to everyone, forcing a subsequent impact and need to roll back the deployment (if they can).   

While customers can opt into manual or staged updates, many companies also choose auto-updates for ease — ease on the IT and security teams to not expend the effort to push updates manually. Unfortunately, that “ease” comes at a tradeoff. It doesn’t allow customers to test and validate updates before rolling them out to all systems.

There is a baked-in fear within security and IT teams that performing manual updates may cause them to miss a critical security update and require them to stay abreast of every vendor’s update. Further, it requires teams to develop deployment strategies, which they often don’t have the team or resources to do — especially for smaller organizations — making them more reliant on a single vendor.  

While there may be an incremental benefit to an auto-update — staying as current as possible — this doesn’t become more important than being stable, available and accurate. This latest outage of Microsoft machines tells the industry that there needs to be an industry shift. It should always be best practice to stage and test updates prior to deploying them against critical infrastructure. 

Prioritizing speed over availability 

Information security teams have long preached that the C-I-A triad represents the foundational pillars of cybersecurity (Confidentiality, Integrity, Availability). Unfortunately, the industry focuses on “staying one step ahead of the bad guys” and emphasizes the ‘C,’ often at the expense of the ‘I’ and ‘A.’ There is also, at times, an unhealthy tension between technology and security teams, with technology wanting exclusive ownership of the ‘I’ and ‘A’ while security teams focus on the ‘C.’ 

Instead, it is essential that vendors, as well as the CIOs and CISOs of their customers, carefully balance each letter of the triad. CISOs need to care more about the ‘I’ and ‘A,’ and CIOs need to care more about the ‘C.’ If there is anything to learn from the CrowdStrike incident, it might be that while speed is important, people need to take more time to ensure that integrity and availability are not compromised. They need to wait to deploy updates to a time of their choosing and stage and test updates before they broadly deploy them to everyone.

SaaS vendors are under a lot of pressure to rush new releases as quickly as possible — that pressure comes from customers and security teams — and sometimes, quick updates are necessary for cybersecurity. Fast updates are an essential measure to protect against attackers. When informed about a threat, an attack technique, or a vulnerability being exploited, a quick update is sometimes the best remedy. If that update can be sent before the attack, it can prevent and stop the attack.

But rapid release at the expense of availability and integrity comes at a cost. Speed completely conflicts with the safety measures expected from enterprise software. People expect rigorous QA and gradual rollout. These inherently slow down the updates. Being fast and easy to deploy, confidentiality improvements can’t overpower the assurance of accuracy (integrity) and stability (availability) of the update. 

An alternative approach going forward

Reaching the balance between speed and integrity is very, very difficult. However, choosing to perform manual updates on critical systems puts customers in control of how and when their systems are updated. While change is the father of uncertainty, organizations and security teams all need to commit to doing more to ensure that there are certain changes and updates that will only have a positive impact. Manual updates might not be possible for everything, but at least put that in place for critical systems.

As security professionals reflect on the lessons from the CrowdStrike incident, they must collectively prioritize a balanced approach to cybersecurity, one that harmonizes innovation with trust, safety and resilience. In the end, the true measure of cybersecurity prowess lies not in how fast things are done, nor in the ability to innovate, but in the capacity to endure. Security leaders must embrace those proven patterns of change management that have served organizations so well in the past, but they also must evolve. 

https://www.securitymagazine.com/articles/100904-balancing-trust-and-safety-lessons-from-the-crowdstrike-incident

Ago 01, 2024 Marina Londei Approfondimenti, Minacce, News, Prodotto, RSS 0

---

Con l’aumento costante delle minacce, i team di sicurezza devono affrontare un carico di lavoro molto elevato; il rischio è di non riuscire a rilevare correttamente i cyberattacchi e proteggere quindi la propria organizzazione. I team hanno a che fare in particolare con un gran numero di falsi positivi: secondo il report di analisi MDR di Kaspersky, nel 2023 il team SOC della compagnia ha esaminato 431.512 avvisi di sicurezza, ma solo 32.294 sono stati identificati come risultato di 14.160 incidenti segnalati ai clienti.

Per ridurre il carico di lavoro del team di cybersecurity e migliorare il rilevamento di incidenti, Kaspersky sottolinea l’importanza di affidarsi a soluzioni automatizzate di intelligenza artificiale. In particolare, il modello Autoanalyst basato su IA usato nell’MDR ha esaminato in media quasi il 30% dei falsi positivi nel 2023, riducendo il carico del team SOC di circa il 25%.

L’applicazione più comune dell’IA nella cybersecurity, in particolare del machine learning, è il rilevamento degli attacchi, dove possono essere usati sia l’apprendimento supervisionato che non supervisionato. Nel primo caso, il modello viene addestrato sui dati relativi all’attività degli attaccanti con l’obiettivo di identificare comportamenti dannosi simili; nel secondo caso, il modello profila il comportamento legittimo dei sistemi e servizi per rilevare eventuali anomalie.

“Conoscendo bene l’aspetto degli attacchi moderni e sapendo che il loro rilevamento spesso si traduce in un grande volume di avvisi, i SOC stanno studiando come ridurre il carico di lavoro degli analisti con l’aiuto del ML, come migliorare l’efficienza del triage, filtrando i falsi positivi nel flusso di avvisi generato e spostando le operazioni di automazione dal semplice rilevamento degli attacchi al filtraggio delle attività legittime” ha dichiarato Sergey Soldatov, Head of Security Operation Center di Kaspersky. “La soluzione al problema del filtraggio dei falsi positivi è Autoanalyst basato sull’IA. Questo modello di machine learning supervisionato impara dagli avvisi elaborati dal team SOC e cerca quindi di replicarne il comportamento in modo indipendente“.

Grazie all’IA, Autoanalyst permette di ridurre di almeno un quarto il numero di avvisi che richiedono un’indagine da parte del SOC e gestisce gli alert più comuni e di routine, preservando le risorse del team e consentendogli di concentrarsi sui casi più interessanti.

IA per i SOC: i vantaggi per la tecnologia MDR

Per ridurre al minimo il numero di incidenti non rilevati i team SOC creano un numero crescente di regole di detection, comprese quelle basate su IA. Questo approccio però genera un numero elevato di avvisi che chiedono l’attenzione degli esperti, causa un maggior numero di falsi positivi e riduce la capacità di reazione del sistema di rilevamento.

La sfida è bilanciare la qualità del rilevamento con la trasformazione della logica di rilevamento: da una parte, se si cerca di rilevare tutto, si rischia di essere sommersi dai falsi positivi; dall’altra, con meno falsi positivi, si rischia di perdere alcuni attacchi.

“In generale, è possibile trovare un equilibrio tra questi estremi, ottenendo un rilevamento di alta qualità degli attacchi nascosti e riducendo contemporaneamente il numero di falsi positivi. Uno strumento per ottenere questo “interruttore” è Autoanalyst. Quando aumenta il livello di filtraggio, con una conseguente riduzione del carico di lavoro per il team SOC, cresce la probabilità di errore di classificazione” ha spiegato Soldatov.

Kaspersky evidenzia che, utilizzando Autoanalyst, il margine di errore (ovvero il tasso di falsi positivi) non supera il 2%; ciò significa una riduzione del volume di avvisi, ma non della qualità dei controlli. Nel caso il margine di errore superi il 2% a causa di un “sovraccarico”, il modello viene riqualificato per ridurre nuovamente il tasso di falsi positivi.

---

---

---

https://www.securityinfo.it/2024/08/01/usare-lia-nei-soc-per-ridurre-il-carico-di-lavoro-del-team/?utm_source=rss&utm_medium=rss&utm_campaign=usare-lia-nei-soc-per-ridurre-il-carico-di-lavoro-del-team

Research from Zimperium has unveiled a sophisticated campaign stealing SMS messages. The research refers to this campaign as the SMS Stealer, revealing that the malicious software has been identified in more than 105,000 samples. This suggests the SMS Stealer has a notable reach. 

Key findings from the research include:

Security leaders weigh in 

Jason Soroko, Senior Vice President of Product at Sectigo:

“The integration of pre-embedded phone numbers in nearly 4,000 samples, coupled with the use of 13 C&C servers and more than 2,600 Telegram bots, underscores the complexity and scale of this operation. We have seen SMS redirection malware in the past, however, the ability of SMS Stealer to intercept OTPs, facilitate credential theft, and enable further malware infiltration poses severe risks. This includes ransomware attacks and financial fraud. This campaign underscores the urgent need for enhanced mobile security strategies, emphasizing robust application permissions management and continuous threat monitoring to safeguard digital identities and enterprise integrity.”

Stephen Kowski, Field CTO at SlashNext Email Security+:

“The SMS Stealer malware’s ability to intercept one-time passwords, and target more than 600 global brands, highlights a critical vulnerability in current security frameworks and demonstrates the sophisticated nature of mobile threats today. Implementing a multi-layered security approach that leverages advanced behavioral analysis, machine learning and real-time threat intelligence is essential to enhance detection and combat these threats effectively. Robust mobile threat defense solutions, proactive defense strategies and continuous security updates play a pivotal role in identifying and neutralizing hidden malware, protecting against financial loss and identity theft, and maintaining the integrity of mobile networks and sensitive user information.”

Ken Dunham, Cyber Threat Director at Qualys Threat Research Unit:

“Subversion of mobile phones is of increasing interest to bad actors seeking to subvert weakly defended one-time password accounts and other sensitive information that can be compromised via SMS malware. Text messages increasingly contain a wealth of sensitive information that can be used for secure authentication as well as extortion of a victim. SMS malware, when combined with other identity access broker data, becomes a toxic cocktail for victims targeted by sophisticated adversaries.”

Darren Guccione, CEO and Co-Founder at Keeper Security:

“The SMS Stealer threat is a stark reminder of the evolving tactics of cybercriminals to exploit unsuspecting victims. This insidious malware leverages fake ads and Telegram bots posing as legitimate services to gain access to victims’ SMS messages, including one-time passwords (OTPs).

“The transmission of stolen SMS messages — and OTPs in particular — is highly concerning. OTPs are a key component of Multi-Factor Authentication (MFA), an important security measure designed to protect accounts. By intercepting these messages, cybercriminals can bypass those MFA protections, gain unauthorized access to accounts and potentially cause very real harm. It’s important to recognize that not all forms of MFA offer the same level of security.

“The impact of SMS Stealer is multifaceted. The malware can intercept and steal OTPs and login credentials, leading to complete account takeovers. With these stolen credentials, attackers can infiltrate systems with additional malware, amplifying the scope and severity of their attacks. They can also deploy ransomware, which encrypts data so they can demand financial payment for recovery. Furthermore, attackers can make unauthorized charges, create fraudulent accounts and execute significant financial theft and fraud. 

“To mitigate such threats, individuals and organizations must remain vigilant and adopt robust security practices. This includes being wary of ads and suspicious messages, regularly updating software and security systems and considering alternative authentication methods that do not rely solely on SMS-based OTPs.”

https://www.securitymagazine.com/articles/100898-security-leaders-respond-to-a-sophisticated-sms-stealing-campaign