Krishna Vishnubhotla is the Vice President Product Strategy at Zimperium. Image courtesy of Vishnubhotla 

https://www.securitymagazine.com/blogs/14-security-blog/post/100819-attending-the-olympics-watch-out-for-these-mobile-threats

Digital risk was analyzed in a recent report by AuditBoard. The report found that 78 percent of organizations are tracking artificial intelligence (AI) as an emerging risk while simultaneously adopting the technology themselves. More than half of enterprises surveyed reported using AI to improve efficiency and enhance their digital risk posture. 

Two-thirds of organizations prioritize AI risk assessment using existing internal processes (65%) and/or guidance and best practices from professional organizations (63%). Another 55% say they use current and pending laws/regulations to prioritize risk.

Over half of organizations surveyed use AI to improve team productivity (57%) and enhance threat detection (56%). Nearly half say they use it in reporting (48%) and automating action and response plans (42%).

Nearly half of respondents describe their risk tolerance towards AI as very high (17%) or high (29%), while only 12 percent report a low (9%) or very low (3%) AI risk tolerance.

Eighty-seven percent of companies use reportable metrics to manage digital risk. Of this group, 97% consider their metrics to be effective, with 59% saying the metrics they use are very effective.

Read the report.

https://www.securitymagazine.com/articles/100820-78-of-organizations-are-tracking-ai-risks

Lug 02, 2024 Marina Londei Approfondimenti, Attacchi, News, RSS 0

Le coperture assicurative contro i cyberattacchi stanno diventando sempre più importanti, tanto che le aziende stanno migliorando le proprie difese proprio per sfruttarle: secondo la ricerca “Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders” di Sophos, il 76% delle organizzazioni sta migliorando il proprio assetto di sicurezza per accedere alle cyberassicurazioni.

Il 67% delle aziende intervistate ha investito sul potenziamento delle difese anche per ridurre i premi delle , mentre un 30% per migliorare le condizioni delle polizze.

Pixabay

“Il fatto che il 76% delle aziende abbia investito in cyberdifese per poter accendere una polizza cyberassicurativa dimostra come le compagnie assicuratrici stiano costringendo i clienti a implementare alcune di queste misure essenziali: ciò sta facendo la differenza e sta avendo un impatto più ampio e positivo sulle aziende in generale” ha affermato Chester Wisniewski, director, global Field CTO. “Tuttavia, anche se le cyberassicurazioni sono vantaggiose per le aziende, esse rappresentano solo una componente di un’efficace strategia di mitigazione del rischio. Le aziende devono ancora lavorare sul rafforzamento delle loro difese. Un cyberattacco può avere impatti profondi dal punto di vista sia operativo che reputazionale, e in questo una cyberassicurazione non può essere d’aiuto“.

La ricerca ha infatti evidenziato che solo l’1% di chi ha richiesto un risarcimento ha ottenuto il 100% dei costi sostenuti per rimediare alle conseguenze dell’incidente. La ragione principale dietro questa mancata copertura totale dei costi è data dal superamento del tetto risarcibile: secondo la ricerca The State of Ransomware 2024 di Sophos, lo scorso anno i costi di ripristino in seguito ad attacchi ransomware sono aumentati del 50%, toccando in media i 2.73 milioni di dollari.

Il 99% delle aziende intervistate che hanno potenziato le loro difese a scopi assicurativi ha affermato di aver conseguito anche vantaggi più ampi in termini di sicurezza, come maggior protezione, alleggerimento delle risorse IT e diminuzione delle segnalazioni di allerta.

“Gli investimenti a favore delle cyberdifese sembrano avere un effetto domino in termini di vantaggi producendo risparmi sui premi assicurativi che possono essere quindi dedicati ad altre difese per migliorare globalmente la postura di sicurezza. Col diffondersi delle polizze di cyberassicurazione si spera dunque che la sicurezza delle aziende continui a migliorare. Le cyberassicurazioni non faranno scomparire gli attacchi ransomware, ma potranno essere tranquillamente una parte della relativa soluzione” ha concluso Wisniewski.

Life360 was impacted by a data breach, which they announced in early June. The malicious actors behind the data breach have appeared to target systems associated with Tile, a Life360 subsidiary. Possibly compromised information may include client names, phone numbers, addresses, email addresses and identification numbers for tile devices. 

Security leaders weigh in 

Piyush Pandey, CEO at Pathlock:

“In this instance, it appears that access was given using the admin credentials of a former Tile employee, which points to a key tenant of identity security — the ability to have proactive visibility to the access and entitlements of users throughout the joiner, mover and leaver portions of the identity lifecycle. It also seems that there was a lack of multi-factor authentication, which may have thwarted access being granted with just a username and password. This breach also points to the criticality of securing service account access in addition to the primary line-of-business applications.”

Anne Cutler, Cybersecurity Evangelist at Keeper Security:

“Admin account security must be prioritized by organizations, as evidenced by the recent data breach affecting Life360. Attackers exploiting compromised credentials to gain access to a Tile customer support platform emphasizes the need for robust cyber defenses. This includes implementing stringent password policies, securing privileged credentials and enforcing least privilege access. Admin accounts should only be granted minimal access necessary to their roles, significantly reducing the risk of cybercriminals gaining access to sensitive data and systems if an admin account is compromised. To further enhance admin account security, organizations should also prioritize continuous monitoring and auditing of admin activities. This proactive stance can help organizations detect and swiftly respond to suspicious behavior. 

“Implementing multi-factor authentication (MFA) across all accounts adds a critical second layer of security by requiring multiple forms of authentication to access sensitive systems. Additionally, robust employee education about cybersecurity best practices, including how to recognize phishing attempts and the importance of strong password practices, strengthens the organization’s ability to withstand most breaches. 

“It’s crucial for organizations to understand this isn’t a one-time task but an ongoing effort. Regularly reviewing and updating access permissions based on job roles and responsibilities is essential to protect your organization’s crown jewels from unauthorized access attempts.

“While the data leaked in this breach did not include highly sensitive information such as login credentials or financial details, users may feel violated knowing their personal information and device identification numbers are now in the hands of cybercriminals. All organizations have an inherent obligation to protect their users and their users’ data. When a company is a custodian of personal information, it requires a much higher bar for security and monitoring than other types of organizations. Companies should regularly audit their data inventory to not only ensure compliance, but to also make sure that they are only retaining the sensitive data that is required.”

Callie Guenther, Senior Manager, Cyber Threat Research at Critical Start:

“The data breach involving Life360’s Tile customer support platform highlights significant threat intelligence implications. 

• Targeted extortion: This is when hackers use stolen data to demand a ransom. Example: In the 2020 Garmin ransomware attack, hackers demanded $10 million. Impact: Financial loss and operational disruption.
• Supply chain vulnerabilities: These occur when attackers exploit weaknesses in a company’s suppliers. Example: The SolarWinds incident saw attackers infiltrate numerous organizations through compromised vendor software. Impact: Widespread access to multiple organizations’ networks.
• Data sensitivity: Even non-sensitive personal information can be used for phishing and social engineering attacks. Example: In the 2013 Target breach, attackers used stolen customer data for fraud. Impact: Increased risk of identity theft and financial fraud.
• Incident response: Effective measures to detect and respond to breaches are crucial. Example: Maersk’s rapid recovery from the NotPetya attack due to robust incident response strategies. Impact: Minimizes downtime and potential damage.

“These examples underscore the necessity for comprehensive security frameworks, vigilant monitoring and effective incident response strategies across all organizational platforms and subsidiaries. To better protect administrator accounts, teams can implement the following measures:

1. Multi-factor authentication (MFA): Require MFA for all admin accounts to add an extra layer of security.
2. Strong password policies: Enforce the use of strong, unique passwords and regular password changes.
3. Least privilege principle: Grant admin rights only to those who absolutely need them, minimizing the number of users with high-level access.
4. Regular audits and monitoring: Continuously monitor and audit admin account activities to detect and respond to suspicious behavior promptly.
5. Security awareness training: Educate employees on recognizing phishing attempts and the importance of safeguarding credentials.

“Implementing these measures can significantly reduce the risk of unauthorized access to critical systems.”

https://www.securitymagazine.com/articles/100818-security-leaders-weigh-in-on-life360-data-breach

Introduzione

L’email security è un’area della cyber security che coinvolge un insieme di metodologie, procedure e tecnologie il cui scopo è quello di proteggere le comunicazioni che avvengono tramite email prevenendo l’esecuzione di potenziali malware, URL malevoli ed esfiltrazione di informazioni sensibili. Ogni minaccia e rischio per la sicurezza che viene veicolato tramite la posta elettronica verso uno o più utenti deve quindi essere prontamente analizzato ed eventualmente. Il rischio di subire un attacco ransomware e/o malware tramite email è molto elevato basti pensare che, stando alla “The Definitive Email Cybersecurity Strategy Guide” di Proofpoint, oltre il 90% delle minacce per le aziende vengono veicolate o iniziano tramite email. Inoltre, osservando la top ten dei più diffusi Cyber Attacks nel 2023:

1. Malware
2. Phishing
3. Denial-of-Service (DoS) Attacks
4. Code Injection Attacks
5. IoT-Based Attacks
6. Identity-Based Attacks
7. Supply Chain Attacks
8. Spoofing
9. Insider Threats
10. DNS Tunneling

si può notare che la posta elettronica è uno dei principali vettori di attacco utilizzato dai cyber criminali. Nell’ultimo rapporto del Clusit 2024 si conferma tale tendenza in merito anche alla “severity” degli attacchi informatici, infatti, si afferma che “rimane costante la gravità degli attacchi che fanno uso di Phishing / Social Engineering” e che gli attacchi basati su “phishing e social engineering” in Italia riguardano ormai l’87% in valore assoluto.

Social engineering e threat intelligence

Tra le principali metodologie per la costruzione di mail malevole verso specifici target ci sono dunque:

• La Social engineering
• L’OSINT (Open-source intelligence)

La social engineering è una tecnica di manipolazione che fa leva sulle caratteristiche umane per ottenere informazioni private, credenziali di accesso o dati di interesse. Nell’ambito del cybercrimine, queste tecniche sono anche note come “human hacking” e hanno come obiettivo quello di adescare gli ignari utenti inducendoli a esporre dati riservati, a diffondere malware o a concedere l’accesso a sistemi riservati. Questi attacchi possono avvenire online, di persona o attraverso altre interazioni. Tra le caratteristiche di un attacco di social engineering ci sono:

• Le emozioni come la paura, la curiosità, la rabbia, la tristezza ecc.
• L’Urgenza della richiesta.
• L’indurre sicurezza e fiducia nell’interlocutore per fargli compiere azioni a suo svantaggio.

L’Open-Source Intelligence (OSINT) invece fa riferimento a tutte quelle informazioni e risorse disponibili in rete come, media (giornali, radio, televisioni ecc), pubblicazioni accademiche, conferenze e dati pubblici (report governativi e simili) che sono a disposizione di tutti e che quindi potrebbero rappresentare un rischio per la sicurezza. In base al tipo di informazione si parla di:

• GEOINT, Geospatial Intelligence.
• SIGINT, Signals Intelligence.
• HUMINT, Human intelligence (collezione di informazioni relative a una persona e/o un gruppo, tendenzialmente di potenziali criminali).

La threat intelligence si occupa quindi di collezionare i dati “non strutturati” raccolti dalla rete o altre fonti per poi, a seguito di apposite analisi, renderli “strutturati” e utilizzabili per comprendere eventuali possibili attacchi e definire potenziali “threat actors”. Ovviamente, lato attaccante, la threat intelligence può invece essere utilizzata per effettuare azioni malevoli ad aziende e/o piattaforme aiutandoli a definire il “profilo” del target che si intende colpire. In figura 1 si può osservare il processo sin qui descritto.

Tra le principali fonti OSINT ci sono i social network (Facebook, Instagram, Tik Tok e simili), i motori di ricerca (Google, DuckDuckGo, Bing ecc) e le piattaforme come Shodan, che consentono di ricercare e individuare server o altri sistemi, come webcam ecc, esposti in rete.

“Only The Paranoid Survive”
[Andy Grove]

Esistono inoltre fonti OSINT più strutturare che consentono alla cyber defense di reagire prontamente alle nuove minacce, tra cui:

• CVSS (Common Vulnerability Scoring System (CVSS)) utilizzato per misurare qualitativamente la “severity” (low, medium, high, critical) di una minaccia. Consente alle organizzazioni di valutare le caratteristiche di una vulnerabilità e la sua gravità mediante un punteggio numerico utilizzando tre componenti:
  • Base: rappresenta le caratteristiche intrinseche della vulnerabilità e che non variano nel tempo. Considera l’impatto della vulnerabilità in caso questa venga sfruttata.
  • Temporale, tiene conto di come la vulnerabilità possa variare nel tempo valutando anche le possibili mitigazioni.
  • Ambientale, dipendente dal sistema in cui si andrà ad operare, si valutano i vari asset di interesse e se ne calcoleranno i danni e i potenziali effetti collaterali.

Di seguito la tabella con i relativi score con le due ultime versioni a confronto:

Le vulnerabilità vengono collezionate dal NIST e pubblicate nell’NVD “national vulnerability database” a disposizione di chiunque ne abbia bisogno.

Mitre Att&ck framework: è una knowledge-base che consente di usufruire della “conoscenza” acquisita dalla security community in termini di tattiche, tecniche e procedure (TTPs) utilizzate dagli attaccanti, documentandone il “comportamento” (adversary behaviors) e le modalità d’interazione con gli elementi del sistema target. Questo tipo di minacce sono anche note come APT (Advanced persistence threat) e consentono di stabilire una presenza illecita e duratura all’interno di una rete aziendale. I target tipici di questi attacchi sono gli enti governativi e/o aziende per le quali le conseguenze dell’intrusione vanno dal furto di brevetti industriali, alla compromissione di informazioni personali di impiegati o pazienti, fino ad arrivare al sabotaggio di intere infrastrutture critiche e siti produttivi (si veda ad esempio Stuxnet).

Questo articolo è stato estratto dal white paper “Email Security: Intelligenza Artificiale, Protocolli e Best Practice Contro gli Attacchi Informatici” disponibile in maniera libera e gratuita al seguente link: https://www.ictsecuritymagazine.com/pubblicazioni/email-security-intelligenza-artificiale-protocolli-e-best-practice-contro-gli-attacchi-informatici/

Articolo a cura di Fabrizio Giorgione

Profilo Autore

Fabrizio Giorgione è nato a Napoli (NA) nel 1992. Si è laureato in ingegneria informatica presso l’università degli studi del Sannio il 17 dicembre del 2018 con una tesi dal titolo: “Analisi della superficie di un sistema SCADA”. Ha sviluppato, presso il laboratorio ISWATlab, un’applicazione Android denominata “Privacy Guard” la quale valuta il rischio di privacy leakage, ovvero il furto di informazioni, sugli smartphone (http://www.iswatlab.eu/?page_id=499). Ha effettuato il tirocinio presso lo “ZLab” di “Cse Cyber Sec” nell’ambito “SOC”, “Forensic” e “Malware Analysis”. Attualmente lavora presso la società di “NTT DATA” come “Cyber security Analyst” nel SOC di Napoli. Il suo compito è quello di effettuare analisi di log, di malware e di prevenire minacce interne ed esterne alla sua azienda e ai clienti della società. Si è occupato, inoltre, del montaggio e della gestione di sonde IDS/IPS presso Telecom Italia nella sede di Roma (RM).

https://www.ictsecuritymagazine.com/articoli/email-security-social-engineering-e-threat-intelligence/

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:16px;margin-top:16px;margin-bottom:16px}
.w3-leftbar{border-left:6px solid #386994!important}
.w3-color,.w3-hover-color:hover{color:#386994!important;background-color:#eaf1f7!important}
.w3-large{font-size:20px!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif}
.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}

Prioritizing education in security

Confidence Staveley’s security career began with an interest in technology as a whole. Staveley earned her bachelor’s degree in Information Technology and Business Information Systems. While completing a master’s in Information Technology Management, an elective on cryptology piqued her interest.

“The fascinating world of information security, commonly known as cybersecurity, instantly captivated me. I was enthralled by the idea of safeguarding technological advancements, ensuring societal security and promoting innovation within a secure framework,” Staveley says.

Advancing her knowledge through self-study, Staveley became increasingly passionate about cybersecurity. Staveley found that the “dynamic nature” of the field kept her engaged, as she was able to learn more and more as the years went on. As her career developed, Staveley moved through a variety of cybersecurity positions, including Cybersecurity Architect, Chief Information Security Officer and Cybersecurity Board Member.

Currently, Staveley is the founder of the CyberSafe Foundation. The non-profit, started in 2019, focuses on advancing cybersecurity awareness and education within underserved communities. The organization’s CyberGirls Fellowship is Africa’s largest cybersecurity training and mentorship program targeted towards young women.

“The fellowship provides a life-changing opportunity for girls and young women across Africa to acquire the skills they need to launch successful cybersecurity careers ultimately leading to increased economic prosperity for themselves, their families, and their communities,” Staveley says.

By focusing on young women and girls, Staveley aims to close the gender gap in security. Her work focuses on education, skills development and general exposure to potential career paths.

Staveley recently became a published author with the release of her book “API Security for White Hat Hackers”.

“In this book, I help readers uncover offensive defense strategies and master security API implementation. The book was written for cybersecurity professionals, ethical hackers, penetration testers, developers and software engineers,” Staveley says.

Staveley also makes use of her social media to promote cybersecurity education with a YouTube series “API Kitchen” to help explain API security concepts. In addition, Staveley volunteers as a judge for a variety of cybersecurity organizations.

When thinking about women looking to enter the security field, Staveley’s advice is to “embrace continuous learning”. The nature of cybersecurity means that things are constantly changing, as threats and technology grow more advanced by the day. There’s always something to learn in cybersecurity, making it a perfect career for individuals wanting an interesting career. Staveley also stresses the importance of soft skills, which can often be overlooked in technology-focused fields. Staveley wants women who discovered security during adulthood to know that they have options to enter the field, regardless of their degree or prior experience.

“Remember, cybersecurity is broad with many specializations. Identify your interests and strengths and focus on an area that excites you,” Staveley says. “Use the support of organizations that champion women in cybersecurity, such as CyberSafe Foundation and WiCyS. Take advantage of scholarships, mentorship programs, and other initiatives aimed at increasing diversity in the field.”

Finally, Staveley reminds women to network and build connections with one another. Her advocacy spans from child education to adulthood, encouraging women working in security to help those looking to join.

“Attend industry events, join forums and participate in online communities. Networking actively and seeking mentorship from experienced professionals can significantly aid your career,” Staveley says. At the center of Staveley’s work is the importance of building connections. She works to increase the number of available opportunities for women at all levels, from elementary school to the board room.

https://www.securitymagazine.com/articles/100809-confidence-staveley-women-in-security-2024

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:16px;margin-top:16px;margin-bottom:16px}
.w3-leftbar{border-left:6px solid #386994!important}
.w3-color,.w3-hover-color:hover{color:#386994!important;background-color:#eaf1f7!important}
.w3-large{font-size:20px!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif}
.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}

Growth and cyber awareness are vital to a cybersecurity career

Dr. Iretioluwa Akerele earned her master’s in Information Security and Computer Forensics in 2013, and just two months after graduating, earned a position as a senior analyst at a Nigerian private professional service organization. Since then, her career has only grown.

While reflecting on her career path over the past decade, Dr. Akerele says, “I mean, in the last 10 years, I’ve done a lot. I have had the opportunity to work as a consultant for several organizations. I have supported more than 50 organizations to date, to align to best practice requirements like the ISO 27001 standard. I have also worked in the industry as an information security manager.”

With many professional accomplishments under her belt, there is one in particular that Dr. Akerele considers to be her greatest accomplishment: her Ph.D. in Information Systems Security.

“It’s not an easy feat to start a Ph.D. and complete it,” Dr. Akerele says. “So, this is a very big deal for me, and I consider it my greatest accomplishment so far.”

She believes that her Ph.D. complements the industry experience she has developed over the years, providing her with unique experiences in research.

Dr. Akerele serves as an advisory board member of the Cybersafe Foundation, an organization with a mission to defend the most vulnerable from cyberattacks. A key role that Dr. Akerele plays in this organization is supporting the CyberGirls Fellowship, which is a one-year program equipping women between the ages of 18 and 28 with skills in cybersecurity. The program is free and helps to get the attending women certification-ready and prepared for a career in cybersecurity. The goal of the CyberGirls Fellowship is to close the gap of gender disparity in cybersecurity so that women in underserved African communities can improve their socio-economic status.

Dr. Akerele is also the Co-Founder of CyBlack, an organization that unites industry professionals, educators and advocates in order to overcome financial barriers and support individuals while they pursue their cybersecurity aspirations.

“We usually require mentors to support some of the things that we do at CyBlack,” Dr. Akerele says, “So one of the key things I do is having to identify the right talents who can work with us and help us to also achieve our mission at CyBlack.”

Mentorship is a significant part of Dr. Akerele’s professional life, as she has and continues to support individuals seeking a career in cybersecurity.

I think every security leader should mentor people who are coming to the cybersecurity field,” Dr. Akerele says.

The importance of cyber growth and awareness

“With cybersecurity, there’s always an opportunity to grow,” Dr. Akerele says. For those who have a “get rich quick” mindset toward cybersecurity, Dr. Akerele recommends a different perspective.

“Don’t do cybersecurity, because by the next month, or by the next quarter, you want to start making lots of money,” she says. “It does not work that way.”

Furthermore, she encourages those looking into cybersecurity simply because it is a buzzword to look elsewhere, as the industry can be challenging if there is not true passion behind one’s interest in cybersecurity.

“If you’re not interested in it, you’re not going to go far in the field. So the interest is important,” Dr. Akerele says. “Another thing to keep in mind is that when it gets tough, it’s your interest that will keep you going.”

Moreover, Dr. Akerele emphasizes the importance of spreading awareness about cybersecurity threats and best practices — even to those who aren’t interested in pursuing a cybersecurity career.

“When it comes to education and awareness in cybersecurity, it is very important. It has to be continuous; we need to continually let people know the importance of cybersecurity,” she says.

A passion for cybersecurity

Dr. Akerele’s passion for cybersecurity has not only fueled her career growth, but it has also been a driving force behind her mentorship. Her passion has inspired her to develop ideas and initiatives that have propelled herself and others higher into the cybersecurity field.

“I call myself an idea bank,” Dr. Akerele says. “I have been able to create great initiatives for the cybersecurity community, which has also contributed immensely to my career in this field.”

She cites the ever-changing nature of cybersecurity as the main reason behind her passion. “It’s always exciting to know that what was obtainable seven to eight years ago is different from the conversations we are having today. For example, in today’s landscape when it comes to cybersecurity, we are talking about cloud, we are talking about AI, we are talking about machine learning, we are talking about threat intelligence.”

Dr. Akerele’s passion for cybersecurity has driven her to develop a strong commitment to the cybersecurity landscape. From building her career to engaging in mentorship, she has turned her passion into a professional path.

“Within the cybersecurity field, there’s always something to look forward to,” she says.

https://www.securitymagazine.com/articles/100807-dr-iretioluwa-akerele-women-in-security-2024

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:16px;margin-top:16px;margin-bottom:16px}
.w3-leftbar{border-left:6px solid #386994!important}
.w3-color,.w3-hover-color:hover{color:#386994!important;background-color:#eaf1f7!important}
.w3-large{font-size:20px!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif}
.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}

Thriving in security

When Ava Turner Leone first entered the workforce as an officer manager for an import customs brokerage firm, she couldn’t have imagined where her career would take her over the next 26 years.

“Early on my career really was happenstance, it was completely kind of unplanned in terms of what direction that I was going, I didn’t know what I wanted to do or where I was headed,” Turner Leone says.

Her first job at the import customs brokerage firm really sparked her interest in learning about trade compliance, a complicated and specialized industry.

“It was a pretty fascinating industry to me — international business, global trade — and it actually turned into another career opportunity,” Turner Leone says.

Turner Leone advanced through her career from a customs brokerage to working for an importer to eventually working at Boeing. Her career at the global aerospace company ultimately led from compliance as a Global Trade Control Specialist/Trainer to supply chain security as the Global Supply Chain Security Program Manager.

“My career essentially took off from there as my structured and experienced security approaches in a highly government regulated industry were highly desired in the ever-growing technology industry,” Turner Leone says.

From Boeing, Turner Leone continued her security career taking on the Corporate Security Manager and Prototype Security Program Manager roles with Amazon, Head of Intellectual Property & Confidentiality Protection, Global Product Security at Meta, and most recently Supply Chain Security Manager at quantum computing company IonQ.

“I’m the type of person that likes a challenge, security is one of those industries where I am always solving new problems and the landscape is always changing,” Turner Leone says. “I just love that aspect of security, embarking on something new, and being able to have the opportunity to solve real world, complex issues. Security to me is not always as cut and dry as some people may think it is. There’s a lot of gray and I think I thrive in that gray, because it breeds flexibility, less monotony and great ideas are born.”

Turner Leone says her current role at IonQ is perfect for her as it blends her love for supply chain, new technology and risk management.

“ IonQ is using revolutionary trapped ion technology in computing to solve some of the world’s most complex problems and we have a competitive advantage when it comes to performance, scalability and manufacturability. With that advantage requires strong partnerships with our third parties in which we have an alignedand effective security culture to enable and protect this amazing work. We are in a new frontier of the productization of quantum computing; therefore, companies must ensure they have full knowledge of their hardware and software supply chains and they are aligned with, if not shaping, government regulation around requirements of this key technology,” she says.

Success in security

When thinking back on her success in the security industry, Turner Leone gives credit to emotional intelligence, adaptability, and being an integrator.

“Emotional Intelligence, I think makes all the difference in terms of how you’re able to get things done in a way that’s more productive, I think you will feel more connection to your work and the people around you,” she says. “The adaptability portion is that you have to be able to be flexible in this industry, you’re going to get thrown so many curveballs and you’re going to be forced to be in situations that you’re going to have to solve problems that no one has ever solved before and you need to be able to move from one thing to another and prioritize very quickly. As an integrator, security requires bringing people together to help them understand their value, understand the importance of caring about protecting themselves and their work and helping to find the motivation to want a healthy security culture for themselves and each other because, ultimately, effective security enables strong business growth and provides a breeding ground for great innovation.”

Offering advice to other women looking to grow and advance within the security industry, Turner Leone says it is important to “protect your peace”.

“Always protect your peace and ensure that you’re pouring just as much into yourself, as you are into the security industry,” she says. “It is important to ensure that you are continuously building up your own self-confidence and self-esteem in the process and always know and never forget your worth.”

Mentoring others is a big part of success within the security industry and Turner Leone thanks every one of the leaders that took the time to answer her questions and give her guidance throughout her career. Now, she’s paying it forward with security professionals within and outside organizations she’s worked for. One important lesson Turner Leone shares for other mentors is to be honest about the realities of the industry.

“You need to be vulnerable and share your mistakes and your lessons learned,” she says. “To me, if you’re truly open and honest about the mistakes that you made, it just makes you more connected, and more relatable. The other aspect is listening and allowing them to open up and understand what they want for themselves. Don’t try to project what you would do or what you necessarily would want them to do, but try to guide them in a way where you’re trying to find what’s best for them. And so that takes a lot of active listening and understanding who that person is and so you can help support them on the quest to find what their ultimate goal is and help them get there.”

https://www.securitymagazine.com/articles/100804-ava-turner-leone-women-in-security-2024

Rachelle Blair-Frasier
Editor in Chief

Rachelle Blair-Frasier is Security magazine’s Editor in Chief. Blair-Frasier handles eMagazine features, as well as writes and publishes online news and web exclusives on topics including physical security, risk management, cybersecurity and emerging industry trends. She helps coordinate multimedia content and manages Security magazine’s social media presence, in addition to working with security leaders to publish industry insights. Blair-Frasier brings more than 15 years of journalism and B2B writing and editorial experience to the role.

https://www.securitymagazine.com/articles/100802-securitys-women-in-security-2024

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } .w3-panel:after,.w3-panel:before { content: “”; display: table; clear: both } .w3-panel { padding: 16px; margin-top: 16px; margin-bottom: 16px } .w3-leftbar { border-left: 6px solid #386994!important } .w3-color,.w3-hover-color:hover { color: #386994!important; background-color: #eaf1f7!important } .w3-large { font-size: 20px!important } .w3-sans-serif { Nunito Sans’,Arial,sans-serif } .w3-opacity,.w3-hover-opacity:hover { opacity: 0.60 }

Protecting your community during a disaster

Anjanette Hebert was born and raised in Louisiana. Her first security job was as a mall security officer, until she moved into private investigations before eventually settling as a hospital security officer.

“It didn’t take me long to figure out that I really enjoyed it; I felt like that was my place. I ended up staying in that organization for 28 years. In 2002, I took on the role as the coalition lead, a seven-parish region of Louisiana. The coalition leader’s responsibility was to coordinate all of those hospitals in their preparedness and response efforts,” Hebert says. “I think it took me maybe two weeks of working in a hospital to recognize how different it is. With security in the mall, or at a bar, or a ballgame, or whatever, everybody’s there to have a good time. They made a choice to be there. People in a hospital, for the most part, do not want to be there, whether you’re the patient, or the family, or whatever. And so there’s a lot of emotion, and it’s difficult for people to be able to control all of that comes at you at once.”

Hebert experienced a learning curve while working in healthcare, both personally and among her colleagues.

“I’ve seen young people come out of nursing school, 22-23 years old, having lived very sheltered lives. When they’re put in a hospital and experience a family who looks different than them for the very first time, experiencing grief in a way they’ve never experienced, it frightens them,” Hebert says. “They want to call security and tell security to make them stop. You have to have a security officer who understands the dynamic of that, and is able to convey that to the caregiver or the employee or whomever.”

One of Hebert’s largest challenges in healthcare came when Hurricane Katrina hit in August of 2005. A few years prior, healthcare systems in the southern U.S. had campaigned to transition anti-terrorism funding towards natural disasters, as that threat seemed far more likely.

“By the time we got to 2005, we had developed a really robust system of preparedness. We didn’t have the assets to do it, we had never practiced it, but we had a plan, and we knew our players,” Hebert says. “Where I am located in Louisiana, we did not feel the hurricane at all, we did not get a single drop of rain as New Orleans and the west side of Mississippi were being inundated. The next morning is when all hell broke loose because the first levee broke. That’s when it got really real for everybody. That’s when the coalition got activated. And then Hurricane Rita came a few weeks afterwards, which hit on the other side of Lafayette. So, Katrina came in to New Orleans, on the east side, and then Rita came in through Lake Charles on the west side. We had storms that moved on both sides of us, and eventually had evacuees from both of those that we were housing in Louisiana, in the Lafayette area,” Hebert says.

Hebert’s role shifted between facilitating communication between hospitals, to working with federal partners and evacuation teams. Hebert facilitated daily conference calls between more than 40 hospitals, ensuring bed availability and evacuation information was always up to date.

“I could tell you at any given time, that this hospital has five ICU beds and that if I had evacuees that needed an ICU bed, this is where I could put them. I could tell you that this hospital was willing to shelter people who weren’t immutable, but were too sick to be in a general shelter,” Hebert says.

“We received busload after busload — it’s making me emotional as I remember it — of people arriving. That had been literally living on the top of their roof, surrounded by water for four or five days. We had people who had refused to be rescued because the rescue that had shown up wouldn’t allow them to take their dog. They were like ‘this is my family. I’m not leaving my dog,’ so they waited for the next rescuer to come,” Hebert says. “Now it’s routine that whenever you’re setting up evacuation centers, there’s evacuation centers for pets as well, or for people to go with their pets.”

Hebert’s life and work experience helped influence her decision making. She learned to work through a crisis and plan for as many emergencies as possible.

“I was actually born in the middle of hurricane Betsy, which before Katrina was one of the biggest hurricanes we’d ever had. So I think it was like fate that I would end up doing that kind of work,” Hebert says.

https://www.securitymagazine.com/articles/100803-anjanette-hebert-women-in-security-2024