Each year, Security magazine highlights the careers and impact of women within the physical and cybersecurity industry with our Women in Security program. These women represent the highest caliber of security leadership, dedication and skill within the industry. See this year’s honorees. 

While combing through the multiple nominations for the awards and conducting interviews with the awardees, I’ve noticed that many women in the security profession face similar challenges as they attempt to break into or advance their careers in the industry. Recently, I had the opportunity to speak with Lynn Dohm, Executive Director of nonprofit organization Women in Cybersecurity (WiCyS), which has more than 9,800 members with representation in 99 countries. 

“Our mission is to recruit, retain and advance women in cybersecurity,” Dohm says. “The impact of the WiCys organization is going strong, and it’s important to note that we’re not a woman’s only organization. We’re a community of women, men and non-binary individuals that are concerned about the critical workforce shortage that we’re in.” 

Recent studies have reported that about 4 million cybersecurity workers are needed to ensure assets are secured effectively. 

During our conversation, Dohm discussed the 2023 State of Inclusion in Cybersecurity Report released earlier this year as well as themes of exclusion that women face in the cybersecurity industry. The report, completed in collaboration with DEI firm Aleria, collected data from just over 1,000 employees including approximately 35% men and 65% women, representing more than 20 different organizations. 

“It’s our corporate and social responsibility to create the inclusive spaces in order for us to solve the cybersecurity workforce challenges,” Dohm says. “We realized that inclusion isn’t talked about as often as diversity, because inclusion is a feeling, and it’s only felt when you’re excluded. That’s what led us on this journey of doing this State of Inclusion Report. In order for us to bring awareness to cybersecurity leaders about the state of inclusion, and really elevate the conversation of inclusivity and inclusive spaces, we also had to bring that awareness to cybersecurity leaders.” 

Those participating in the survey shared experiences that caused them to feel excluded. The report revealed that women were excluded at a rate two times higher than men with top areas of exclusion including respect, career and growth, access and participation, and recognition. The report also highlighted that women were five times more likely to cite their direct managers and peers as sources of that exclusion. 

“When you’re getting passed up for promotion opportunities and you’re seeing your peers get promoted, it gets a little discouraging,” Dohm says. “It tends to lead to like death by a thousand paper cuts, all those little reoccurring themes that women experience every step of the way, leads to them maybe potentially either leaving that position within an organization or switching careers altogether.” 

Recounting a recent conversation with a CISO, Dohm says the most important thing organizations can do to improve inclusion in the workplace is just to “pay attention.” The CISO had mentioned he had 35% women on his cybersecurity team (while recent studies reveal women represent just 24% of the cybersecurity workforce), so Dohm asked about his approach and what he was doing differently. 

“He just shared with me that he was paying attention, he said if something wasn’t working within his organization, then it must be broken,” Dohm continues. “And he wanted to pay more attention to it to see what how he could mitigate some challenges and barriers across the way.” 

This included going through and updating employment descriptions and requirements to be more inclusive and include gender-neutral language. They also made a conscious decision that they were going to train new employees on company tools and protocols. 

“They were willing to invest into the industry and in the human capital of the individuals that they were hiring themselves, and it paid off,” Dohm says. “It really boils down to paying attention.” 

https://www.securitymagazine.com/articles/100847-the-importance-of-inclusion

In the realm of executive protection, the necessity to expect and defuse potential threats is paramount. Whether tasked with safeguarding high-profile individuals, corporate leaders or dignitaries, professionals in this field must possess a versatile skill set that transcends mere physical security measures. Among the array of skills they carry, the skill to conduct thorough investigations emerges as a cornerstone in optimizing executive protection. Drawing inspiration from the realm of investigative work and armed with resources like “Security Investigations: A Professional’s Guide,” co-authored by this writer, executive protection specialists can significantly bolster their ability to ensure the safety and security of their clientele.

Seasoned investigators, drawing upon their wealth of experiences and expertise, emphasize the importance of nurturing an investigative mindset. This involves cultivating attributes such as critical thinking, mindfulness and ethical considerations — qualities that are as indispensable in executive protection as they are in the field of investigations. Just as investigators meticulously plan their investigation, executive protection professionals must craft comprehensive security plans tailored to the unique needs and potential risks of their clients.

A fundamental principle shared between both domains is the pivotal role of documentation. Detailed reports serve as the foundation of investigative efforts, guaranteeing accountability and facilitating informed decision-making. Likewise, within executive protection, thorough documentation of security protocols, threat assessments and incident reports are essential for effectively managing risks and adapting security measures as circumstances evolve.

Effective interviewing skills also stand out as a critical facet emphasized in investigative practices. Executive protection specialists must adeptly engage with clients, staff and relevant stakeholders to extract valuable insights and evaluate potential threats. By fostering trust and skillfully extracting information, they can proactively identify vulnerabilities and tailor security strategies accordingly.

Moreover, the importance of leveraging diverse sources of information cannot be overstated. In today’s digital age, executive protection professionals can harness a plethora of online research tools and databases to gather intelligence and comprehensively assess potential risks. Additionally, employing surveillance techniques, photography and video documentation can provide invaluable insights into emerging threats or suspicious activities, empowering security teams to proactively mitigate risks.

Recognizing the evolving security landscape, executive protection professionals must also equip themselves with a basic understanding of specialized areas such as financial and cyber investigations. As executive protection increasingly intersects with cyber threats and financial crimes, proficiency in these domains is essential for safeguarding clients against a spectrum of risks.

By continually improving their knowledge base and integrating these principles into their practices, executive protection professionals can enhance their effectiveness in safeguarding clients and mitigating potential risks. Instead of solely focusing on physical safety and security, they can embrace an initiative-taking approach grounded in comprehensive threat assessments, strategic planning and diligent investigative endeavors.

The integration of investigative techniques into executive protection practices serves as a cornerstone in navigating today’s intricate security environment. Leveraging their expertise in executive protection, professionals can elevate their capabilities, thereby ensuring the safety, security and peace of mind of their clients in an ever-evolving threat landscape.

With the emergence of increasingly sophisticated threats in today’s world, the importance of executive protection professionals mastering investigative methods cannot be overstated. In an era where security risks are diverse and dynamic, these professionals serve as the first line of defense for their clients, requiring them to be not only reactive but also proactive in their approach.

One of the key advantages of integrating investigative methods into executive protection is the ability to anticipate and mitigate risks before they materialize. Traditional security measures often focus on reacting to immediate threats, such as physical attacks or breaches of security protocols. While these measures are essential, they may not always address the root causes of threats or identify potential risks in advance. By incorporating investigative techniques, executive protection professionals can delve deeper into the underlying factors contributing to security vulnerabilities, whether they be personal, corporate or geopolitical in nature. This proactive approach enables them to identify potential threats early on, allowing for preemptive action to be taken to neutralize or mitigate them.

Moreover, the utilization of standard investigative methods enables executive protection professionals to gather intelligence from a wide range of sources. In today’s interconnected world, threats can emanate from various sources, including online forums, social media platforms and dark web marketplaces. By leveraging investigative techniques such as open-source intelligence (OSINT) gathering, digital forensics and network analysis, executive protection professionals can monitor and assess potential threats in real-time. This comprehensive approach to threat intelligence ensures that no stone is left unturned in identifying and neutralizing potential risks to their clients.

Another benefit of incorporating investigative methods into executive protection is the ability to conduct thorough background checks on individuals and organizations. Whether it be prospective employees, business partners, or clients conducting due diligence is essential to mitigating the risk of insider threats or reputational damage. By employing investigative techniques such as background investigations, asset tracing and financial analysis, executive protection professionals can uncover any red flags or potential liabilities that may pose a risk to their clients. This preemptive approach to risk management enables them to make informed decisions and respond appropriately to safeguard their clients’ interests.

Furthermore, the integration of investigative methods into executive protection allows for a more holistic and integrated approach to security management. Rather than viewing security as a siloed function, executive protection professionals can collaborate with other stakeholders, such as legal, compliance and risk management teams, to develop comprehensive security strategies that address a wide range of potential threats. By leveraging their investigative expertise, executive protection professionals can provide valuable insights and recommendations to help their clients navigate complex security challenges and achieve their objectives safely and securely.

The integration of investigative methods into executive protection is essential for staying ahead of evolving security threats in today’s world. By adopting a proactive approach to security management, leveraging diverse sources of intelligence, conducting thorough background checks and collaborating with other stakeholders, executive protection professionals can enhance their ability to safeguard their clients and mitigate potential risks effectively. As the security landscape continues to evolve, mastering investigative methods will be crucial for executive protection professionals to adapt and thrive in an increasingly complex and uncertain environment.

https://www.securitymagazine.com/articles/100779-unleashing-the-potential-of-investigative-techniques

Lug 11, 2024 Marina Londei Approfondimenti, Minacce, News, RSS 0

---

Sempre più organizzazioni stanno scegliendo il cloud ibrido e la containerizzazione per gestire processi e dati, e di conseguenza aumenta la necessità di scegliere soluzioni di sicurezza adeguate.

Secondo una ricerca congiunta di Kaspersky e ISG che ha coinvolto 310 dirigenti aziendali, tra cui CISO e CTO, le imprese vogliono migliorare le proprie capacità cloud-native, sfruttando sia le infrastrutture on-premise che quelle cloud e ampliando le strategie di containerizzazione. Il 71% delle aziende usa già piattaforme di cloud pubblico e il 96% prevede di adottare tecnologie cloud-native nei prossimi due anni.

Lo sviluppo di queste soluzioni è innegabile, ma le opzioni di cybersecurity fanno fatica a tenere il passo con le nuove sfide di protezione. La metà degli intervistati afferma di essere alle prese con problemi relativi alla protezione e alla conformità dei dati, e l’investimento in strumenti di sicurezza per i workload cloud è una priorità assoluta per il 54% degli intervistati.

Tre intervistati su cinque sottolineano l’urgenza di monitorare e gestire in modo proattivo le configurazioni errate, e il 49% di essi prevede un reporting personalizzato dei profili delle minacce; inoltre, il 51% considera prioritarie le soluzioni in tempo reale per rilevare violazioni do conformità e condividere gli avvisi coi team di sicurezza.

Con l’affermarsi della containerizzazione, il 51% dei dirigenti prevede di investire in soluzioni che consentono di monitorare in real time le violazioni, mentre il 43% vuole dare priorità agli investimenti nei protocolli di sicurezza shift-left.

Secondo l’analisi, le organizzazioni che stanno passando ad ambienti cloud ibridi e alle tecnologie di containerizzazione beneficeranno di una soluzione di sicurezza completa, con meccanismi predittivi aggiornati basati su IA e ML.

“Le soluzioni di sicurezza cloud specifiche per il settore sono consigliate per soddisfare richieste uniche, garantendo la conformità ai quadri normativi e assicurando il successo delle imprese nelle iniziative di cloud computing” spiega Anton Rusakov-Rudenko, Product Marketing Manager, Cloud & Network Security Product Line di Kaspersky,

Il team di Kaspersky spiega che scegliere una piattaforma unificata è essenziale per proteggere endpoint, server e carichi di lavoro cloud. Questa soluzione dovrebbe inoltre integrare la gestione centralizzata delle identità e i cloud access security broker. Infine, per i servizi di cloud ibrido è essenziale integrare feed personalizzati di threat intelligence per accedere ad analisi in tempo reale dei percorsi delle minacce negli ambienti cloud, con approfondimenti su provenienza, tattiche, tecniche e procedure.

---

---

---

https://www.securityinfo.it/2024/07/11/ladozione-del-cloud-aumenta-ma-anche-le-sfide-di-sicurezza/?utm_source=rss&utm_medium=rss&utm_campaign=ladozione-del-cloud-aumenta-ma-anche-le-sfide-di-sicurezza

Il Cybersecurity Lab di ZTE Italia, inaugurato nel 2019, è un pilastro fondamentale nella strategia dell’azienda per garantire la sicurezza informatica a livello globale. Situato a Roma, questo laboratorio è uno dei tre laboratori di sicurezza informatica di ZTE nel mondo, con gli altri due situati a Nanjing e Düsseldorf. L’obiettivo principale del laboratorio è fornire una piattaforma di collaborazione tra ZTE, istituzioni, università e altri stakeholder, mirata a migliorare la sicurezza dei prodotti e dei servizi di ZTE tramite test indipendenti e audit di conformità.

Struttura e Collaborazioni

Il laboratorio di Roma è equipaggiato con una serie completa di attrezzature 4G/5G che consentono la simulazione di scenari di rete reali utili ad eseguire test di sicurezza approfonditi. Una delle collaborazioni chiave è con il Consorzio Nazionale Interuniversitario per le Telecomunicazioni (CNIT), un’ente non-profit che riunisce 37 università italiane. Questa partnership si concentra sulla supervisione delle attività tecniche e sperimentali necessarie per l’analisi e la verifica dei requisiti di sicurezza informatica su dispositivi, hardware/software e piattaforme digitali.

Attività del Laboratorio

Il Cybersecurity Lab svolge diverse attività cruciali, tra cui:

• Test di Sicurezza dei Prodotti: I prodotti ZTE vengono sottoposti a rigorosi test di sicurezza per garantire la conformità agli standard richiesti dalle normative italiane ed europee.
• Ricerca sulla Sicurezza Applicata: Parte del tempo del laboratorio è dedicato alla ricerca avanzata su vari temi di sicurezza, tra cui la sicurezza delle reti e dell’hardware.
• Certificazione: Supportare le linee di prodotto nell’ottenimento delle certificazioni di sicurezza come il CC (Common Criteria) per dimostrare la sicurezza dei prodotti ZTE.
• Collaborazione con Partner Esterni: Collaborare con terze parti per condividere le migliori pratiche di sicurezza, esperienze e metodologie ti attacco.

Il laboratorio, fin dalla sua creazione, ha testato numerosi prodotti ZTE, inclusi prodotti wireless, wired, Fixed Wireless Access (FWA) e Customer Premises Equipment (CPE). Inoltre, coerentemente con i valori trasparenza di ZTE, il Cybersecurity Lab condivide attivamente i risultati dei test con i clienti, comunicando costantemente con loro. Infine, il lab si impegna anche nel supportare i vari team di sviluppo nell’ottenimento di certificazioni di sicurezza come CC (Common Criteria) e NESAS (Network Equipment Security Assurance Scheme).

Case Studies e Ricerca Avanzata

Tra i principali protagonisti delle attività del laboratorio ci sono Luca Bongiorni, Direttore del Cyber Security Lab, e il Prof. Giuseppe Bianchi, Direttore del NAAM (Network Assurance and Monitoring) Lab del CNIT.

Luca Bongiorni ha una vasta esperienza in test di sicurezza offensiva. Tra i suoi contributi più rilevanti ci sono:

• Offensive Hardware Implants: creazione e implementazione di impianti hardware offensivi utilizzati per penetrare le difese di varie infrastrutture IT/OT, migliorando così le contromisure di sicurezza.
• IoT Hacking: test su dispositivi Internet of Things per identificare e mitigare vulnerabilità specifiche a questo tipo di tecnologia.
• Attacchi su Reti Radio: esame della sicurezza delle reti radio, un’area critica dato l’aumento dell’uso delle comunicazioni wireless.
• Forensic Analysis di Dispositivi IIoT: analisi forense di dispositivi Industrial Internet of Things e sviluppo di tecniche per identificare e risolvere attacchi cyber in ambienti industriali.

Un esempio significativo delle attività del lab è la gestione delle vulnerabilità. Ad esempio, la scoperta da parte di ricercatori esterni di una vulnerabilità nella libreria XZ su GitHub ha visto il laboratorio avviare immediatamente un’indagine interna per identificare se e quali prodotti fossero impattati, prima che lo strumento commerciale Black Duck, utilizzato per tracciare le vulnerabilità a livello di build del software, venisse aggiornato a livello globale.

Il laboratorio si impegna anche nella ricerca su attacchi specifici, come l’implementazione dell’attacco di downgrade e reindirizzamento LTE, che rappresenta una minaccia principale nell’industria delle telecomunicazioni. Questi studi permettono al laboratorio di replicare e comprendere le vulnerabilità esistenti, migliorando così la sicurezza dei prodotti.

Il Prof. Giuseppe Bianchi ed i ricercatori del CNIT collaborano con il laboratorio per migliorare le capacità di sicurezza in diversi modi, tra cui:

• Governance della Sicurezza: supportando l’identificazione e la definizione dei metodi di testing e la supervisione delle relative attività del laboratorio.
• Analisi delle Vulnerabilità delle Reti Open Source: test sulla sicurezza delle reti open source, grazie ai quali ha scoperto che molti di questi sistemi non considerano adeguatamente la sicurezza, un problema rilevante poiché alcune aziende commercializzano queste reti come soluzioni private.
• Test delle Reti Commerciali: Bianchi e il suo team lavorano attivamente per portare questi test alle reti core commerciali, un passo cruciale per la certificazione e la sicurezza delle reti 5G.

Progetti Futuri

Il Cyber Security Lab di ZTE Italia non si ferma qui. Tra i progetti futuri c’è l’intenzione di espandere le capacità del laboratorio per includere test su reti commerciali. Questo progetto prevederà la collaborazione con partner esterni per testare la sicurezza delle reti 5G, un passo fondamentale per garantire che le reti private locali rispettino gli standard di sicurezza più elevati.

Conclusione

Il Cyber Security Lab di ZTE Italia rappresenta un esempio di eccellenza nella sicurezza informatica, combinando ricerca avanzata, collaborazioni strategiche e un impegno costante per la conformità e la trasparenza. Con l’espansione delle sue attività e l’approfondimento delle sue collaborazioni, il laboratorio continuerà a giocare un ruolo cruciale nella protezione delle infrastrutture digitali e nella promozione della sicurezza informatica a livello nazionale e internazionale.

https://www.ictsecuritymagazine.com/notizie/il-cybersecurity-lab-di-zte-italia-un-centro-allavanguardia-per-la-ricerca-e-il-testing-in-ambito-di-sicurezza/

Lug 11, 2024 Marina Londei In evidenza, News, RSS, Vulnerabilità 0

---

Dopo RegreSSHion, un’altra vulnerabilità colpisce OpenSSH: tracciato come CVE-2024-6409, il bug permette di eseguire codice da remoto a causa di una race condition.

La vulnerabilità è presente nel processo figlio di privsep e in particolare nelle operazioni di signal handling. A scoprire il bug è stato il ricercatore di sicurezza Alexander Peslyak, il quale ha spiegato che, a differenza di regreSSHion, il processo viene eseguito con privilegi ridotti e quindi l’impatto immediato è inferiore.

In ogni caso, se si utilizza una versione di OpenSSH non patchata, un attaccante può sfruttare a suo piacimento una delle due vulnerabilità per compromettere l’intero sistema e prenderne il controllo, installando malware od ottenendo dati sensibili. “Potrebbe anche essere possibile creare un exploit che funzioni contro una delle due vulnerabilità in modo probabilistico, il che potrebbe ridurre la durata dell’attacco o aumentare la percentuale di successo” aggiunge il ricercatore.

Mentre regreSSHion è stata già sfruttata dagli attaccanti, al momento i ricercatori non sono a conoscenza di tentativi di sfruttamento di questa nuova vulnerabilità.

Peslyak ha contattato i ricercatori di Qualys per comunicargli la scoperta e il team ha confermato l’esistenza e la natura della vulnerabilità.

Le versioni vulnerabili sono la 8.7 e la 8.8. Poiché la race condition alla base dei bug è la stessa, è consigliabile installare il prima possibile le patch disponibili. Rimangono valide anche le indicazioni sulla segmentazione di rete e sull’implementazione di soluzioni per il monitoraggio di attività sospette.

---

---

---

https://www.securityinfo.it/2024/07/11/una-nuova-vulnerabilita-openssh-consente-lesecuzione-remota-di-codice/?utm_source=rss&utm_medium=rss&utm_campaign=una-nuova-vulnerabilita-openssh-consente-lesecuzione-remota-di-codice

Il mondo funziona grazie ai dati.

Indipendentemente dal settore (sanità, finanza, PA, istruzione, ecc.) tutte le organizzazioni lavorano con i dati.

Anche tutti gli attacchi informatici funzionano con i dati. Che la fonte sia esterna o interna, sofisticata o meno, le minacce hanno bisogno di dati per rubare un’identità o un segreto aziendale, compromettere una rete o condurre un attacco denial-of-service.

Tuttavia, nonostante i dati siano al centro delle operazioni aziendali e delle violazioni, le aziende continuano a pagare milioni per prodotti e servizi di rilevamento delle minacce che faticano a rispondere a domande importanti quando si verifica un incidente. Domande come… “Sono stati rubati dati?”

Varonis protegge prima di tutto i dati e l’offerta Managed Data Detection and Response (MDDR) è un servizio gestito per il monitoraggio e la protezione dei dati critici 24 ore su 24, 7 giorni su 7, 365 giorni all’anno.

Cos’è Varonis MDDR e come funziona?

Sin dalla fondazione di Varonis nel 2005, il rilevamento delle minacce è stato un componente fondamentale della sua Data Security Platform.

Varonis MDDR combina la tecnologia di rilevamento delle minacce leader del settore con il team di threat hunters di livello mondiale, con gli analisti forensi e gli addetti alla risposta agli incidenti che valutano, indagano e rispondono agli avvisi, così non deve farlo il cliente.

Questo servizio incorpora anche l’analisi comportamentale, l’apprendimento automatico, l’automazione basata su IA, decenni di esperienza nella security e un’esclusiva telemetria dei metadati per proteggere i clienti Varonis dalle minacce e dai percorsi di attacco che i servizi XDR ed EDR non possono rilevare.

MDDR è data-centric

I tradizionali servizi di rilevamento e risposta tendono ad essere incentrati sugli attori delle minacce. Rispondono a domande del tipo: “Chi era l’autore della minaccia? Quale CVE ha sfruttato? Quali strumenti sono stati utilizzati?”

Si tratta di domande importanti a cui rispondere, ma quando si tratta di comprendere l’impatto sui dati, si presentano in breve tempo e aumentano di settimane il tempo medio per rilevare una violazione.

A differenza dei tradizionali servizi XDR ed EDR, Varonis MDDR si concentra sui dati dell’azienda, quindi non ottiene solo informazioni incentrate sull’attore di un attacco.

Varonis può fornire informazioni su quali file sono stati interessati, se sono state prese di mira informazioni personali o proprietà intellettuale e altro ancora, per arrivare alla risposta principale: se i dati sono stati rubati e se la violazione deve essere segnalata.

Senza questo focus sui dati, le organizzazioni con stack di sicurezza avanzati possono comunque cadere vittime di violazioni da parte di minacce interne e attaccanti che aggirano i controlli degli endpoint e della rete.

Investigazioni AI-driven

Quando viene rilevata un’attività anomala, Varonis esegue un’indagine iniziale per aggiungere un contesto critico sull’utente (i suoi colleghi, i dati con cui lavora, le tendenze degli avvisi, i dispositivi coinvolti e gli orari di lavoro generali) e attiva le risposte automatiche necessarie. Gli avvisi critici vengono inoltrati al team di esperti Varonis per ulteriori indagini e mitigazioni.

Nell’interfaccia Varonis, i clienti vedono su quali avvisi stanno lavorando gli analisti, leggono le loro note e rimangono aggiornati. I casi verranno inoltrati solo quando necessario.

Un avviso di ransomware, ad esempio, attiverà l’intelligenza artificiale di Varonis per indagare. Se i risultati indicano un vero positivo, l’analista MDDR viene coinvolto rapidamente per esplorare l’avviso e arrivare a una soluzione il prima possibile.

Le indagini Varonis basate sull’intelligenza artificiale rendono possibile mantenere lo SLA leader del settore, consentendo di rispondere agli avvisi di ransomware entro 30 minuti e ad altri avvisi entro 120 minuti. Il servizio include anche la ricerca proattiva delle minacce e valutazioni mensili della sicurezza per garantire che il livello di sicurezza dei dati aziendali sia in costante miglioramento.

Threat hunting proattivo

Il team di Varonis Threat Labs (VTL) ricerca in modo proattivo tendenze, minacce informatiche emergenti, autori di minacce e altro ancora, che prendono di mira determinati settori verticali.

Questi risultati vengono inclusi nelle valutazioni mensili sullo stato di sicurezza per i clienti MDDR, con gli ultimi aggiornamenti in tempo reale di intelligence sulle minacce per ridurre continuamente la superficie di attacco.

Leggi l’ultima ricerca di VTL.

Varonis MDDR in azione

Nel 2018, Varonis ha costituito la sua organizzazione di risposta agli incidenti (IR) che ha ispirato l’offerta MDDR. Fin dalla sua nascita, Varonis IR ha indagato su oltre 10.000 incidenti.

Recentemente, presso un istituto sanitario, Varonis ha identificato tentativi di intrusione da parte del gruppo ransomware BlackCat, noto anche come ALPHV, e ha impedito la possibilità di un evento di crittografia malevolo. Dopo aver avvisato rapidamente il cliente, Varonis ha identificato il dispositivo vulnerabile e assistito con la mitigazione.

Varonis MDDR aiuta inoltre i clienti a combattere le minacce interne. In un caso, per esempio, la funzionalità EDR ha avvisato un cliente di un’attività insolita e il cliente ha contattato il team Varonis per indagare e identificare un file sospetto sulla rete.

Gli esperti Varonis hanno identificato rapidamente l’autore del file – un amministratore IT scontento – e hanno esaminato la sua attività sulla rete. È stato scoperto che non solo aveva creato il file sospetto, ma aveva anche creato oggetti non autorizzati per sfruttare probabilmente la persistenza nella rete, oltre ad accedere ai file delle risorse umane relativi a un partner che stava affrontando un’azione disciplinare verso l’organizzazione.

Ciò che era iniziato come un incidente EDR si è evoluto in un’indagine sulle minacce interne molto più ampia e, senza l’attenzione del team IR di Varonis sui dati e sulla reale portata della minaccia, avrebbe portato a un risultato molto diverso.

Non attendere che si verifichi una violazione

Senza un monitoraggio continuo dei dati, le organizzazioni aumentano il rischio di esposizione quando si verifica una violazione. Varonis MDDR è la soluzione che fornisce il monitoraggio dei dati 24x7x365. Per saperne di più: https://www.varonis.com/it/

A cura di Mike Thompson, Security Architect Manager, Varonis

https://www.ictsecuritymagazine.com/notizie/cose-managed-data-detection-and-response-mddr/

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #F4F5F6; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: left; } .w3-panel:after,.w3-panel:before { content: “”; display: table; clear: both } .w3-panel { padding: 16px; margin-top: 16px; margin-bottom: 16px } .w3-leftbar { border-left: 6px solid #386994!important } .w3-color,.w3-hover-color:hover { color: #386994!important; background-color: #eaf1f7!important } .w3-large { font-size: 20px!important } .w3-sans-serif { Nunito Sans’,Arial,sans-serif } .w3-opacity,.w3-hover-opacity:hover { opacity: 0.60 }

The cannabis industry is experiencing exponential growth as more regions legalize its use for both medicinal and recreational purposes. This expanding market presents unique opportunities but also comes with unique challenges in the realms of security and compliance.

Compliance and security in the cannabis industry, while closely related, address different aspects of operational integrity. Compliance focuses on adhering to local and state regulations to ensure legal and safe production and distribution, whereas security involves protecting the physical and digital assets of the business (including inventory, cash and personnel) from theft, diversion and cyber threats.

Unique security challenges

Gone are the days of carrying backpacks full of cash to pay licensing fees and other obligations (yes, that really happened), but safety concerns surrounding cash transactions, product transport, and foremost, the safety of staff, remain paramount.

• High-value inventory: Cannabis products, both in raw and processed forms, are highly valuable, not just monetarily, but also from a possession perspective. Carry limits are in place so that no one individual has access or control of large amounts of inventory with the intent to sell to minors or undeveloped markets. This makes them attractive targets for theft and diversion to be distributed in what is called the “gray” market. 
• Cash-intensive operations: Most operators have access to a bank of some sort for their business, but most transactions with consumers take place with cash. This means that security measures must be in place for handling and storing large amounts of cash. 
• Employee safety: Cannabis businesses are subject to stringent regulatory oversight. These measures have laid the foundation to ensure necessary protocols are in place to protect employees from a variety of pitfalls or situations that exist as they work with cannabis and cash. 
• Stringent oversight: Regulatory oversight has laid the foundation to ensure compliance and security protocols are in place. While some security measures may seem extreme, such as checking in every person who is accessing limited access facilities, escorting visitors, transport safety measures and more cameras than you can count, they are all necessary when working in the cannabis space. 

Implementing robust security measures

To address these challenges, cannabis businesses must implement comprehensive security strategies. Key components include physical security, employee training and cybersecurity.

Physical security encompasses surveillance systems, secure storage facilities, and stringent access controls. High-resolution cameras, alarm systems and reinforced vaults are essential to safeguard valuable inventory and cash reserves.

Additional safety measures come into play, even when hiring cannabis employees. Each state has its one set of rules for who can work in cannabis, but strict and repetitive background screens take place for every employee before someone can be trusted to work in cannabis. This helps weed out the bad actors.

Employee training is equally important. Employees must be trained to recognize and respond to security threats. This includes understanding protocols for handling cash, managing inventory and ensuring the integrity of the supply chain. Regular training sessions ensure that all staff are up-to-date on the latest security practices and are equipped to handle potential threats.

In 2024, cybersecurity cannot be overlooked — or overstated. As with any modern business, cannabis companies must protect their digital assets along with environmental control systems that live in the cloud. This involves safeguarding customer data, securing online transactions and preventing cyberattacks or hacking into system databases.

The importance of compliance

Compliance in the cannabis industry is multifaceted, involving local and state rules. Key areas of focus include:

Licensing: Obtaining and maintaining the necessary licenses is fundamental to operating a legal cannabis business. This process can be complex and requires meticulous attention to detail. Businesses must navigate an evolving regulatory landscape, submit comprehensive documentation and often undergo rigorous inspections. The cost of non-compliance can be severe, including hefty fines, license suspension or permanent closure.

Product testing and labeling: Product testing and labeling are critical components of compliance. Cannabis products must meet stringent safety standards to ensure they are free from contaminants such as pesticides, heavy metals and microbial impurities. Accurate labeling is equally important, providing consumers with essential information about the product’s potency, ingredients and usage instructions. This transparency helps build consumer trust and ensures safety for products that hit the store shelves.

Record-keeping: Detailed records must be kept for all aspects of the business, from seed to sale. Traceability and accountability become paramount when a product is recalled or needs to be investigated for product safety.

Building a company culture of compliance

Creating a culture within a cannabis organization requires commitment from all levels of the business. Compliance and security are everyone’s jobs! Senior management must lead by example, while all employees need to embrace the importance of compliance. Regular training sessions and clear communication of policies are essential. Additionally, this is not a one-time effort but an ongoing process. Businesses must stay abreast of changing regulations and continuously refine their practices — rules can change overnight to be implemented the next day.

Partnering with experts

Given the complexities of security and compliance, partnering with experts can be invaluable. Security consultants, legal advisors and compliance specialists can provide the insights and support needed to navigate the regulatory landscape and implement effective security measures.

The cannabis industry is at a critical juncture, with enormous potential for growth and innovation. However, the risks associated with security and compliance should not be underestimated. The adage “You’re only as strong as your weakest link” is particularly relevant in the cannabis industry. It is critical to build a company-wide culture of compliance and security, ensuring that every member of the organization is aware of their role in maintaining these standards. By prioritizing these aspects, businesses can not only protect their assets and reputation but also build a foundation for long-term success.

https://www.securitymagazine.com/articles/100844-the-crucial-role-of-security-and-compliance-in-the-cannabis-industry

As technology moves forward at seemingly break-neck speed — and as bad actors invent new ways to attempt to thwart it — companies are showing an increased willingness to invest in more solutions for both physical and cybersecurity needs. But as with anything else, not all solutions are created equal, so it is important to choose wisely, and for the right reasons.

On the physical front, AI and cloud based solutions are driving a lot of decisions today.

For example, a study conducted by Harris found that 70 percent of security professionals believe their organization plans to increase spending on physical security systems in 2025. More than 90 percent thing the future of physical security will be cloud-based, with three quarters looking to transition to the cloud in the next year. 

The report, commissioned by Verkada, surveyed more than 1,500 IT and physical security leaders to gather insights on the state of cloud physical security. It also looked at attitudes on the cyber front and AI, finding that 90 percent of professionals surveyed think that cloud security is now more effective at protecting against data leaks and unauthorized access; while 80 percent think AI-based analytics will play a large role in future physical security solutions.

Another report, from HID, also looked at the state of physical security, particularly access control. Specific to smart buildings, the report found that open standards have become a key driver, allowing for more converged solutions that can help organizations make not only security but also business decisions — with nearly a third saying integration with other business functions a top trend. 

When asked about AI, just 23 percent had no plans to incorporate some form of the technology. 

On the cyber side, there is also recent evidence that budgets are expanding.

A report by Optiv found that cyber budgets have increased by almost 60 percent year-over-year. But the details are a big more nuanced.  While organizations with more than 5,000 employees spent an average of $26 million on cybersecurity investments in 2024, just 36 percent cited a “formal” approach to establishing those budgets, and many were a possible direct result of a rise in incidents rather than a proactive one.

More than 60 percent cited experiencing a cybersecurity event within the past two years, and 55 percent had experienced at least four incidents. 

The report also suggested that simply throwing technology at the problem may not be as effective, with 40 percent of respondents saying their organization had “too many” technologies, leading to a decrease in effectiveness overall. 

However, another study from Titania shows that some organizations are thinking more proactively, with 70 percent saying they are increasing spending on proactive cybersecurity solutions such as attack surface and risk-based vulnerability management. According to the study these investments are outpacing those in preventative and reactive solutions. 

This research also highlighted the importance of consolidating proactive security tools such as attack surface visibility and management, increased security control optimization and better manpower productivity.

https://www.securitymagazine.com/articles/100848-the-right-technology-for-the-job

With AI-powered cyber threats growing by the day, the cyber skills gap reached 4 million people in 2023. Gardner theorizes that by 2028, the adoption of GenAI will significantly reduce that gap, removing the need for specialized education from 50% of entry-level cybersecurity positions. This would alleviate a major challenge facing the cybersecurity community… but what about today?

Most businesses are anxious to embrace the power of generative AI, but only a small proportion currently feel they have the technology, funding, culture and skills in place to support its adoption — and the cybersecurity skills gap is at the heart of this deficit, which is why the industry is already seeing changes in how we work to create a safer world.

The AI cyber revolution has just begun 

When computers first shifted into the mainstream, many feared the new technology would steal their jobs. While some roles did indeed become obsolete, most simply evolved and adjusted — and today, it’s hard to imagine doing our work without computers, let alone smartphones.

Now, AI and GenAI are promising to augment work to be even more productive. 

Eventually, they will become as second nature as using laptops, but currently, society is still in the Wild West of this technology. By exploring this new frontier and learn how to use AI wisely, knowledge and best practices on it will grow. There will be more regulations and additional security KPIs around utilizing it. 

As with all technology, AI could very well replace some aspects of some security roles. The cybersecurity industry will also continue to evolve and adjust — and the changes are already coming, fast. 

How AI is changing cybersecurity roles, today

Perhaps the most buzzed-about change in cybersecurity is the CISO’s ever-increasing responsibilities, which were only bolstered by the recent SEC regulations. Instead of working in the trenches as they once did, today’s CISOs are starting to take on broader business-related responsibilities as they are increasingly reporting directly to the CEO and becoming more actively involved in board decisions.

Alongside this, there are often new technologies, terms and categories coined by thought leaders. Despite pervasive fears of job loss, the cybersecurity community has yet to see any roles become obsolete. Instead, the community is seeing roles evolve and expect a whole new sphere of AI security specialist roles to emerge.

With a reduction in manual analyst tasks and responsibilities, for example, analysts are now learning to manage AI-driven cybersecurity technologies. As the technology becomes more powerful, professionals foresee the introduction of more AI security analyst roles or Machine Learning Engineers who will verify and train AI-derived models and technologies.

Whatever the future holds, with 3.5 million unfilled cybersecurity expected to remain unfilled through 2025, the need for cybersecurity talent must be addressed now. While AI isn’t expected to dramatically reduce that number, it is already augmenting work and enhancing and accelerating training and education — which is why 86% of CISOs agree it will alleviate security skills gaps and talent shortages.

Managing today’s skills gap

Even as new capabilities and roles in cyberspace emerge, the cybersecurity community must be prepared to handle today’s escalating threats. Taming this new Wild West of AI requires holistic, collaborative approaches that involve government, academia and the private sector. 

To attract, train and retain skilled workers, for example, the industry needs more than simple certification programs. It needs novel solutions like the Department of Defense (DoD) Cyber Service Academy, which covers academic expenses in return for service with the DoD after graduating, and the Women in Apprenticeship and Nontraditional Occupations Grant Program, which addresses a significant underrepresentation. 

In addition to luring in new talent, we must ensure our education keeps pace. That means that instead of relying on university faculty for research in this field, we must turn to experts working on the frontlines of the industry to keep our programs in sync with real-world needs. 

With their guidance, offerings like university SOC labs can prepare students for the pace of cyber jobs by mimicking real-world experiences. Industry leaders can also serve as guest speakers or offer targeted courses that go beyond how AI is shaping emerging threats to also provide hands-on training and lectures about how AI technologies are being developed to more-rapidly address cyber threats and attacks.

Both government and private sectors can also help support the wealth of amazing associations committed to helping cybersecurity workers upskill.

Looking to the future

In the face of this critical struggle, the cybersecurity community will continue to lean into our tradition of collaborating and sharing best practices — and thankfully, the efforts of the Cybersecurity Infrastructure Security Agency (CISA) and the billions of dollars allocated to cyber in Biden’s proposed 2025 budget reflect the government’s commitment to keeping us safe. 

Even as the industry upskills its workforce to manage the cybersecurity skills gap and learn how to harness and protect its businesses and customers with AI, that very technology is the key to empowering today’s workers to do more. Instead of a defined shift, cybersecurity roles and AI are tied together in a continuum. The future is happening now. 

https://www.securitymagazine.com/articles/100761-will-the-ai-revolution-collapse-the-cybersecurity-skills-gap

The groundwork for success in your security career lies in careful consideration of your goals, your drive and your ability to reach them. Every security professional goes through this complex process at some point in their career.

Effective career management is the opposite of chance. It is based on accurate analysis of your situation, skills, and attributes followed by action you take to improve your position to succeed. The only person who has all this information and can use it to affect change is you. 

A complete picture of you is essential to the creation of an effective resume or CV as well as any online employment profiles. It takes time and effort to think through this, but the exercise is an investment in yourself. It helps set up your best security career direction and gives you control over how potential employers evaluate and perceive you. 

Think about your current employment circumstances. There are lots of reasons to be variously happy or unhappy in your current job. List the pluses and minuses, then consider the role your family situation plays in your career decisions. A partner’s employment, children, aging parents or other family dynamics including financial well-being all have an impact. 

Create a complete list of every job you have ever held, including any military service, internships, summer or part-time employment. Not everything will make it onto your resume or CV, but it will outline directionally where you have been. It can also help identify those things you genuinely enjoyed, may want to revisit and set a direction for. 

Analyze how you chose participation or memberships in business, professional and social associations. If you held office or served on committees, you demonstrated and excelled at leadership. Achievement of certifications, licenses or clearances through organizations reflects commitment. 

Look at your formal education. Include any added non-degree-related work. Would you take a different direction if you were to begin those programs now? Most organizations support lifelong learning. Would literally changing course or seeking additional training put you on a more preferable path? 

Recognition of lifetime achievements is key. Naming what they are will help clarify your personal strengths and preferences. Look for achievements within the scope of normal activities. Think about instances where you were highly motivated and enjoyed what you were doing. Past successes like these indicate interest, talent, ability and potential. 

Even after this reflection, you may not be completely clear about your goals. No job is perfect, and a description of your ideal job and organization can be hard to pin down. What are your immediate objectives including compensation requirements? Are there adverse factors or barriers to you achieving these goals, and how can you overcome them? 

Finally, consider what you want to see in the rear-view mirror when you are at the end of your career. Re-examine your personal value system as it underlies the decisions you make about both your life and career. Staying true to yourself is not always the easy road, but odds are you will be more confident in your career decisions. 

Regardless of where you are in your security career, laying initial or more groundwork for your success is always a worthwhile investment.

https://www.securitymagazine.com/articles/100845-effective-security-career-management