@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:16px;margin-top:16px;margin-bottom:16px}
.w3-leftbar{border-left:6px solid #386994!important}
.w3-color,.w3-hover-color:hover{color:#386994!important;background-color:#eaf1f7!important}
.w3-large{font-size:20px!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif}
.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}

Military experience and mentorship can enhance a career in security

Candice Frost’s first steps into the security field happened when she was in high school. When in a conversation with her high school guidance counsellor, Frost was encouraged to pursue a future at The U.S. Military Academy at West Point.

“I was incredibly fortunate to be able to attend,” Frost says while reflecting on that experience. “And that’s really what started the dive into the security field.”

Her fascination with the field led her to rise through the ranks of the military, living anywhere from New York to Arizona or Hawaii to Kentucky. She was involved with overseas deployments to Bosnia, spent two years of her life in Afghanistan, and most recently, spent the past seven years in Washington, D.C.

On her military career path, Frost says, “It’s been a total blast. The career path has taken me from leading small units and airborne units where we jumped out of airplanes, all the way to working to create opportunities to collect great intelligence in forward deployed areas. It then moved me along to spaces where I was preparing General Milley for his chairmanship into the Joint Chiefs of Staff with the intel insights that I could give him. So, it’s been a path I could never have predicted. It’s been a wonderful, wild ride.”

Career transitions

With decades of military experience under her belt, Frost decided to venture down a new career path. She accepted an assignment to the United States Cyber Command as a Joint Intelligence Operations Center (JIOC) Commander. Here, Frost spearheaded the delivery of precise, timely and complete intelligence to U.S. Cyber Command. This pivot opened the door for her to take her first steps into the corporate cybersecurity world.

“I’ve told people I’m a fox with hedgehog tendencies, it really allows me to dive into areas where my insatiable curiosity takes me to different fields,” Frost says. “For example, for those in cyber, it really helps me to speak to a multitude of audiences. My engineering degree helps me speak to technical experts. My degree in public administration helps on Capitol Hill here. And my degree in security studies has allowed me to shape my military work for years. So, having those different perspectives truly has allowed me to almost shapeshift in different areas, but also has allowed me to speak to different audiences to really understand the criticality of the importance of cybersecurity.”

In addition to her career in cybersecurity, Frost also teaches as an Adjunct Professor at Georgetown University. There, she is involved with the university’s Security Studies Program, where she mentors the next generation of scholars, analysts and policymakers on national security, international security and foreign policy issues.

On her experiences as an instructor, Frost says, “I was very fortunate to be raised by a long lineage of teachers, and so teaching is 100 percent in my blood.”

From the military to the corporate world to universities, Frost has remained engaged with the field of cybersecurity.

“I think what I like most about the cyber field, especially in security, is that every day is a new adventure,” she says.

The value of character and mentorship on a security career

Frost shares her insights for those looking to dive into the field of cybersecurity, saying, “Don’t think when you start out that you need every single certification — you have to start the journey itself. And there are so many free resources and courses that are available out there, you just have to begin. Don’t get intimidated to think that you have to check every box — you just have to really dive in.”

She also emphasizes the importance of character and mentorship in one’s security career. In terms of mentorship, Frost advises individuals to seek someone with shared similarities in order to establish an early connection. She believes that the benefits a good mentor can provide for a person’s career cannot be discredited.

“In the field of real estate, the motto is location, location, location. And I use that akin to mentoring in the fact that it is connection, connection, connection,” Frost says. “And you would be amazed at how many times a mentor can open doors for you.”

Frost also believes there are qualities that prospective security leaders should foster within themselves. Two of the key qualities she emphasizes are patience and selflessness, as a career in security requires dedication and an ability to appreciate a mission that is larger than oneself.

She states that it’s never too late to change one’s career path. “You know, careers are not ladders, they’re lattices,” Frost says. “And you can move from one side to the next. You don’t always have to jump from rung to rung above you. Enjoy the ride.”

https://www.securitymagazine.com/articles/100806-candice-frost-women-in-security-2024

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:16px;margin-top:16px;margin-bottom:16px}
.w3-leftbar{border-left:6px solid #386994!important}
.w3-color,.w3-hover-color:hover{color:#386994!important;background-color:#eaf1f7!important}
.w3-large{font-size:20px!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif}
.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}

Fostering curiosity in cybersecurity

Curiosity is what compelled Quratulann “Annie” Jamshed to explore the world of cybersecurity.

When discussing how the field of cybersecurity inspires curiosity, Jamshed references the depth of the industry.

“I compare it with an ocean,” she says. “There are so many things that you can do within cybersecurity.”

Jamshed started her career with a bachelor in Electrical Engineering. As she was studying, she found herself growing curious about how systems and data were secured during a computer networks course.

“I suppose I had the security mindset from the beginning,” Jamshed says. “Because I was asking these questions.”

After she graduated, she found that there was a lack of opportunities in her home country, and she was unable to find a job within the electrical engineering field. Instead, she started a teaching career, which she stayed with for three years. However, she soon realized that this wasn’t the path for her.

“I just wasn’t interested in electrical engineering anymore,” Jamshed says.

After moving to the United States, she discovered that the University of Houston in Houston, Texas was offering a master’s degree in Cybersecurity. So, she enrolled in the university, obtained her Master’s degree, and took her first steps into the world of cybersecurity.

Venturing into the world of cybersecurity

Jamshed gained more than a degree during her time at the University of Houston. Though a friend, she learned of the Women in CyberSecurity (WiCyS) conference. After looking into the conference, she decided to attend, where she had the opportunity to experience women-led keynotes and workshops.

“It was just amazing,” Jamshed says. “I got to see so many women that had already overcome [many challenges].”

While at the conference, Jamshed learned that WiCyS had a goal to start student chapters at universities. Inspired by the time she’d spent there, Jamshed returned to the University of Houston and founded the student chapter at her school. Even after her graduation, she maintained a close connection with the student chapter in order to support and sustain it.

After graduating, Jamshed was offered a position in Governance, Risk and Compliance (GRC). However, starting off her career in GRC didn’t feel like the right path.

“Right away, you do want to get hands-on experience, and that you’re going to get from the security operations center,” Jamshed says.

So, Jamshed instead sought a security operations center analyst position, which she found through Schlumberger. Although she began as a Cybersecurity Operations Center Analyst, she spent the next four years rising through the ranks.

She gained valuable skills during this time, citing various tools and experiences she gained along the way.

“I used to do incident response, I worked with various tools like security incident and event management tool, vulnerability management tool endpoint security tool, so it gave me a lot of exposure,” Jamshed says while recounting her previous work experience. “I became a threat intelligence champion during that time as well. And we would do forensics, so it was very hands-on.”

This experience led her higher up the security career ladder. Eventually, she earned her current role as Vice President — Security Architect at JPMorgan Chase & Co. Although her role isn’t as hands-on as her previous positions, she still finds value in those experiences to this day.

“I can I can go into the system very confidently, and I feel like a lot of people get intimidated [at the thought of] breaking things, whenever you’re working with a new tool,” Jamshed says. “I don’t have that fear in me. And I think that’s because of the experience that I gained from the security operation center.”

Building her cybersecurity career is not the end of Jamshed’s story, however. After gaining experience in the industry, she was inspired to begin building something new. She decided to establish the Houston Affiliate for WiCyS.

While discussing her decision to create the WiCyS Houston Affiliate, she said, “I think it just made more sense for me to start something that was more for the professionals, because now I had been in the industry for two years.”

After reaching out to former students of the University of Houston and members of the student affiliate, Jamshed constructed a team to establish the Houston affiliate.

“Whether it was starting the student chapter, or whether it was starting the affiliate, you need to have like-minded individuals who are also interested in doing the same thing,” Jamshed says. “You need those leaders.”

Today, Jamshed is the President at the WiCyS Houston Affiliate, where they strive for women to be recruited, retained and advanced into the world of cybersecurity. Jamshed emphasizes the roles that cooperation and teamwork played in the successful establishment of the WiCyS Houston Affiliate, saying, “Thankfully, I had those women around me,” Jamshed says, “and that’s how we started the Houston affiliate.”

Valuable insights for prospective cybersecurity leaders

“So what advice would I give to someone who is looking to get into the cybersecurity field? The very first one I will say is, be curious,” Jamshed says. “Be curious and explore cybersecurity.”

Jamshed believes that curiosity is a key element in a fulfilling and successful cybersecurity career. She mentions that many people seem to have preconceived ideas about what the field of cybersecurity looks like, and so they never investigate it further.

“I think the first thing that comes to their mind is, ‘it’s a hacker sitting behind a computer in a dark, and he’s trying to hack,’” she says. “That’s not the only thing that you can do in cybersecurity. There’s so many things that you can do.”

Another point Jamshed emphasizes is that a degree in cybersecurity isn’t always required to get a job in the field. Instead, she encourages those interested in the field to consider entry-level certifications that may get their foot in the door.

“If you look back 20 years or 30 years, at that time, there were no degrees that were even being offered for cybersecurity. And so, a lot of the professionals that we see here — senior professionals — they don’t have degrees in in cybersecurity.”

She emphasizes the importance of research and preparing for the role you want, stating, “Once you come across something that really interests you, I would recommend looking up that role. And find out whatever those requirements [are]. What are the tools that are required as a part of that job?”

Finally, Jamshed highlights the value of mentorship. She believes that those who network with leaders in an industry or role they desire will see a lot of benefits.

“I realized the importance of mentors, and I was fortunate that I found these mentors,” she says. “So having mentors that can guide you and can be there to give you advice helps and goes a long way.”

https://www.securitymagazine.com/articles/100808-quratulann-annie-jamshed-women-in-security-2024

.w3-panel:after,.w3-panel:before { content: “”; display: table; clear: both } .w3-panel { padding: 16px; margin-top: 16px; margin-bottom: 16px } .w3-leftbar { border-left: 6px solid #386994!important } .w3-color,.w3-hover-color:hover { color: #386994!important; background-color: #eaf1f7!important } .w3-large { font-size: 20px!important } .w3-sans-serif { Nunito Sans’,Arial,sans-serif } .w3-opacity,.w3-hover-opacity:hover { opacity: 0.60 }

Keeping future generations safe online

Zinet Kemal immigrated to the U.S. from Ethiopia 10 years ago, deciding to pivot from her decade-long legal career while raising her four children. Once in the U.S., Kemal completed an additional undergraduate degree in computer science, which first introduced her to security.

“I was participating in an extracurricular activity within my college; it was a cyber defense competition. That’s when I got exposed to the world of cybersecurity and security and I began working on security certifications,” Kemal says.

Kemal’s first security role was with the Minnesota state government, doing information security auditing within the organization. Six months later, Kemal was promoted to Senior Information Security Engineer at the state government where she worked in application security at the state government before moving to the cloud space, where she currently works as a Cloud Security Engineer at Best Buy.

“What I do in a nutshell high level is making sure that we’re collaborating with other engineers from the same organization to make sure that the cloud migration is done securely. A lot of the challenges within cloud security is misconfiguration, or things that could be preventable if the right guard rails are implemented in the security environment that we’re operating,” Kemal says.

When the pandemic hit, Kemal turned to writing. She’s published three children’s books since 2020, two of which focus on cybersecurity awareness.

“I published my first children’s book, ‘Proud in her Hijab’ in 2021. That was about empowering girls, and Muslim girls who choose to wear the hijab to be proud of who they are in their identity. But then six months later, something happened at my home. My kids are all online gamers, and they got hacked on two different scenarios. You know, out of the four kids, two of them got hacked. That really gave me the wakeup call to write my second book. What are we really doing as parents and even educators? We don’t have cybersecurity education in schools. So what are we really doing besides arming kids with all the tablets and computers and gadgets and connecting them to the internet?” Kemal says.

In her second book, ‘Oh No…Hacked Again!’, Kemal stresses the importance of both online kindness alongside more traditional lessons around multi-factor authentication and maintaining online privacy. The internet can become dangerous for children very quickly, and Kemal wanted to ensure both children and their parents felt confident to keep themselves safe. Kemal took the lessons of this book to several speaking engagements, spreading awareness around protecting children in an online world.

“The other book is called ‘See Yourself in Cybersecurity’. That one is for middle and high school students to introduce and expose cybersecurity what it is as a career,” Kemal says.

The inspiration for this book came from Kemal’s LinkedIn, where she receives numerous questions from aspiring cybersecurity professionals.

“Growing up, I’ve never heard any kid who says that I want to be in cybersecurity. Long term planning for shrinking that workforce gap is making sure that our kids have those options; that the kids who look like me — look like us — are represented in this in this field. I think the industry could benefit a lot from having diverse voices and perspectives when solving the sophisticated problems that we continue to face in the industry,” Kemal says.

Kemal recently received her master’s in cybersecurity from Georgia Tech University, which she attended virtually while residing in Minnesota. After learning about security towards the end of her undergraduate career, Kemal wanted to expand her cybersecurity knowledge.

“The field that we’re in, it’s always a continuous learning,” Kemal says.

Kemal also participates in several lecturing and education experiences. Her TEDx talks and LinkedIn learning courses provide career development assistance for other cybersecurity professionals. Kemal’s advocacy centers on closing gaps within the industry. While encouraging young people to consider cybersecurity as part of their career paths, Kemal also works with current professionals to increase diversity within the field. She uses her experiences as an immigrant, a Black woman, a mother and a professional to educate and uplift others within the industry.

https://www.securitymagazine.com/articles/100810-zinet-kemal-women-in-security-2024

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:16px;margin-top:16px;margin-bottom:16px}
.w3-leftbar{border-left:6px solid #386994!important}
.w3-color,.w3-hover-color:hover{color:#386994!important;background-color:#eaf1f7!important}
.w3-large{font-size:20px!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif}
.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}

Falling down isn’t failure

Throughout her decades-long career, security professional Christina has seen it all and has learned that failure isn’t an option. Over the years she has held various roles in security, safety, facilities management and profit protection. She has also worked on the technology vendor side — at companies such as Lucent Technologies and Avaya — and security systems integrators, starting at the internship entry level and gradually progressing to senior management roles.

“Each step allowed me to learn, adapt and contribute to my organization’s goals. To quote the ancient Greek philosopher, Socrates, ‘Falling down is not a failure. Failure comes when you stay where you have fallen’,” Alexandropoulou says. “My growth can be attributed to continuous learning, networking, and embracing new technologies. Building strong relationships with stakeholders and demonstrating tangible results have also been crucial.”

Growing up in a military family, Greek-American Alexandropoulou is no stranger to travel. Although born in New Jersey, Alexandropoulou has lived all over Europe including Dubai and most recently Greece where she currently serves as Cluster Manager for Security & Market Safety in South East Europe for Philip Morris International (PMI). In this role, Alexandropoulou oversees security and market safety across multiple countries within the region with responsibilities ranging from risk assessment, strategy implementation, and incident response and ensuring compliance with safety standards.

“More specifically, in my ‘day to day’ duties I supervise the development, implementation and continuous improvement of Security and Market Safety systems and programs and our Fleet Safety initiatives, by controlling and preventing fleet related crashes, injuries or fatalities to employees and third parties,” Alexandropoulou says. “I support our function’s strategy, objectives, plans and budget execution, ensuring the execution complies with PMI’s and local OHS and fleet safety regulatory requirements while performing the local security, market and fleet safety risk assessment and execution, providing input for the risk mitigation action plan, performing annual risk assessment review and gap analysis.”

Alexandropoulou also actively contributes to the production and the maintenance of local security and market safety guidelines, procedures and market emergency response plans.

“A crucial part of my role is to also engage with local law enforcement agencies and other relevant external security stakeholders to develop a strong information sharing network,” she says. “But the most important part is to bring people together to achieve our common goals – for in security, we can only succeed as a team.”

Success for the Future

The dynamic nature of the security field is something that has kept Alexandropoulou passionate throughout her career.

“It requires constant vigilance, adaptability, and problem-solving skills,” she says. “The challenge of safeguarding people, assets, corporate reputation and information motivates me. I have a passion for building strong, inclusive and empathetic teams. I’m on a journey for continuous improvement, I never stop learning and I have a sincere willingness to evolve. I take calculated risks and this has shaped my own unique leadership style. I want my team members to grow and thrive and their development and wellbeing are my priority.”

In addition to her passion and continuous drive towards self-improvement, Alexandropoulou credits her success – in no small part – to her support system.

“This is comprised of colleagues, mentors, and family – my 15-year-old twin girls are my greatest supporters and my husband, a professional basketball coach in the Greek Elite League division, inspires me daily to focus on creating winning teams that flourish,” she says.

In the often male-dominated security industry, Alexandropoulou hopes that by paying it forward, through mentoring and volunteering, she will help others break down barriers and reach their goals.

“Every role in my 20-year journey has taught me something valuable. Whether it’s crisis management, team leadership, or technology adoption, I’ve grown by learning from both successes and challenges,” she says. “I have evolved as a manager and a leader by being able to embrace my own vulnerabilities and grow as a professional – never forgetting my beginning and the allies that have helped me and mentored me along the way.”

At her current company, Alexandropoulou takes part in PMI’s “Elevate” development program along with 40 women leaders from all areas of operations. The six-month program empowers Alexandropoulou and her female colleagues to drive their careers in ways that are right for them. The program focuses on building upon strengths and taking the time to invest in development and personal growth.

In addition, Alexandropoulou also takes part in PMI’s global mentoring program “iGrow”, while also being the program Ambassador for Greece.

“Mentoring is more important than ever, as most employees are connecting via a computer screen and human-centric relationships are back at the forefront of business,” Alexandropoulou says. “Mentoring drives authenticity, psychological safety, and inclusion… As someone who has worn both the Mentee and Mentor hats, I can attest to the fantastic feeling of fulfilment and enrichment that mentorship brings.”

Strong analytical skills, adaptability, empathy, and the ability to collaborate across functions are critical to success in the security field. Offering advice to others looking to grow and advancing within the security industry, Alexandropoulou says curiosity is key.

“Stay curious, learn from diverse sources, and seek mentorship,” she says. “Adaptability, integrity, and resilience are essential traits. This industry requires round the clock availability and non-traditional working hours. Mental health and wellbeing, especially caring for your work life balance, is a must. Work-life balance is a key responsibility. Even if a role expects a lot of your time, it is on you to create that boundary between your work and personal life.”

https://www.securitymagazine.com/articles/100811-christina-alexandropoulou-women-in-security-2024

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:16px;margin-top:16px;margin-bottom:16px}
.w3-leftbar{border-left:6px solid #386994!important}
.w3-color,.w3-hover-color:hover{color:#386994!important;background-color:#eaf1f7!important}
.w3-large{font-size:20px!important}
.w3-sans-serif{Nunito Sans’,Arial,sans-serif}
.w3-opacity,.w3-hover-opacity:hover{opacity:0.60}

The experience of security

When it comes to her career, security professional Claire Campbell says her path certainly didn’t take the typical linear projection. Throughout her career in the U.S. Federal government, Campbell served as a Counterterrorism Analyst at Department of Defense (DoD), Counterdrug Analyst at the Defense Intelligence Agency (DIA), and Transnational Threats Team Lead at the Department of Homeland Security (DHS). While some in the security industry choose to stick to a federal career start-to-finish, after 10 years Campbell decided to make the leap to the private sector.

“All I can say is that my career path has been a product of me saying ‘yes’ to opportunities that I didn’t initially think were in my plan,” Campbell says. “It’s been the best choice to explore those unexpected events or offers as they arise because they’ve all materialized into something incredibly fulfilling and challenging in a good way.”

After transitioning from her government career, Campbell took on the role of Senior Security Intelligence Analyst at Cargill, then Principal Security Intelligence Analyst at Mayo Clinic, until her most recent role as Chief Security Officer at London-based financial services company Moneycorp.

As the company’s first CSO, Campbell has been excited for the opportunity to build a security program from the ground up.

“What I’m fortunate to be able to do is to use all of this cutting-edge technology and tradecraft that’s emerged in the last 10 years – AI, machine learning, real-time incident alerting – and really apply it in the best way possible for the company,” she says. “I’m really excited to take all of that and everything available to us to really start from scratch with what I hope is going to become a center of excellence for private sector security. Because I’m traditionally an intelligence professional, and not an operations or physical security professional, our focus is to use an intelligence-driven decision making process to support our business development and risk mitigation practices, and use the data and analytics and the tradecraft to help determine where we should apply our assets and our resources for our duty of care.”

A people person

A key part of Campbell’s personality and her success in the security industry has been her interest in others and her willingness to help where she can.

“I once had a very honored and respected colleague say, ‘you don’t meet Claire, you experience her’,” Campbell recalls with a laugh. “And I thought, ‘Is that a compliment?’ which he replied that it was the highest compliment he can pay anyone and I thought, ‘Oh, thank goodness!’.

“I’m always willing to help out a colleague, if requested for no quid pro quo, or expected favor in return,” Campbell continues. “I believe it is our duty of care and we as a community do better when we all help each other.”

Campbell gives a lot of credit for her career development and trajectory to the mentors who have provided guidance throughout her career. Because of this, helping others within the security industry is one of her passions.

Campbell believes mentorship is an incredibly important part of the security industry. In addition to her role at Moneycorp, Campbell is also a Career Coach at the National Security Career and Leadership Institute where, for the last three years, she’s specialized in helping others gain insight into government and private sector security and intelligence roles by working with them on career search strategies, resume and cover letter preparation and interview skills.

“If people in the more senior levels aren’t taking the time to mentor they should, because we learn just as much by being mentors, as our mentees do in the process,” she says. “The most important parts of mentorship are empathy, honesty, understanding why someone needs help, and just giving encouragement that it is possible.”

Adapt and overcome

When offering advice to others looking to get into the security field, Campbell says tenacity, resilience and curiosity are huge traits for a long, successful career within the industry.

“My favorite motto — and anyone who works with me has heard me proclaim this on a hard day — ‘adapt and overcome’,” Campbell says. “You have to be curious, because if you think you know everything, you’re not going to get very far either in your job search, interviews, or in your career.”

Having a strong support network is another part of an effective security career Campbell adds.

“I think the reason I’m in the role I’m in now and I’ve had the career I’ve had is because I’ve garnered a really wonderful network of friends and colleagues in this field,” she says. “We all have the same values and goals to support each other, to make the world a safer place and because we enjoy the challenge of trying to keep our friends, colleagues, and clients as safe as possible.”

https://www.securitymagazine.com/articles/100805-claire-campbell-women-in-security-2024

Vulnerabilities that went undetected for a decade left thousands of macOS and iOS apps susceptible to supply-chain attacks. Hackers could have added malicious code compromising the security of millions or billions of people who installed them, researchers said Monday.

The vulnerabilities, which were fixed last October, resided in a “trunk” server used to manage CocoaPods, a repository for open source Swift and Objective-C projects that roughly 3 million macOS and iOS apps depend on. When developers make changes to one of their “pods”—CocoaPods lingo for individual code packages—dependent apps typically incorporate them automatically through app updates, typically with no interaction required by end users.

Code injection vulnerabilities

“Many applications can access a user’s most sensitive information: credit card details, medical records, private materials, and more,” wrote researchers from EVA Information Security, the firm that discovered the vulnerability. “Injecting code into these applications could enable attackers to access this information for almost any malicious purpose imaginable—ransomware, fraud, blackmail, corporate espionage… In the process, it could expose companies to major legal liabilities and reputational risk.”

The three vulnerabilities EVA discovered stem from an insecure verification email mechanism used to authenticate developers of individual pods. The developer entered the email address associated with their pod. The trunk server responded by sending a link to the address. When a person clicked on the link, they gained access to the account.

In one case, an attacker could manipulate the URL in the link to make it point to a server under the attacker’s control. The server accepted a spoofed XFH, an HTTP header for identifying the target host specified in an HTTP request. The EVA researchers found that they could use a forged XFH to construct URLs of their choice.

Normally, the email would contain a valid link posting to the CocoaPods.org server such as:

The researchers could instead change the URL to lead to their own server:

This vulnerability, tracked as CVE-2024-38367, resided in the session_controller class of the trunk server source code, which handles the session validation URL. The class uses the sessions_controller.rb mechanism, which prioritizes the XFH over the original host header. The researchers’ exploit code was:

POST /api/v1/sessions HTTP/1.1
Host: trunk.cococapods.org
Content-Type: application/json; charset=utf-8
Accept: application/json; charset=utf-8
User-Agent: CocoaPods/1.12.1
Accept-Encoding: gzip, deflate
X-Forwarded-Host: research.evasec.io
Content-Length: 78 { "email":"research@evasec.io", "name":"EVAResearch", "description":null
}

A separate vulnerability tracked as CVE-2024-38368 allowed attackers to take control of pods that had been abandoned by their developers but continue to be used by apps. A programming interface allowing the developers to reclaim their pods remained active almost 10 years after it was first implemented. The researchers found that anyone who found the interface to an orphaned pod could activate it to gain control over it, with no ownership proof required.

A simple curl request that contained the pod name was all that was required:

# Curl request for changing ownership of a targeted orphaned pod
curl -X 'POST' \ -H 'Host: trunk.cocoapods.org' \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-binary 'owner[name]=EVA&email=research@evasec.io' --data-binary 'pods[]=[TARGET_UNCLAIMED_POD]&button=SEND' 'https://trunk.cocoapods.org/claims'

The third vulnerability, CVE-2024-38366, allowed attackers to execute code on the trunk server. The trunk server relies on RFC822 formalized in 1982 to verify the uniqueness of registered developer email addresses and check if they follow the correct format. Part of the process involves examining the MX record for the email address domain as implemented by this RFC822 implementation.

https://arstechnica.com/?p=2034866

https://www.securitymagazine.com/blogs/14-security-blog/post/100752-the-power-of-partnership-in-mitigating-cyber-risk-a-cfos-perspective

The Occupational Safety and Health Administration (OSHA) announced additional funding for workplace safety initiatives.

The grants aim to advance job quality for the U.S. workforce by providing instructor-led training for workers, supervisors and employers in small businesses; industries with high injury, illness and fatality rates; and vulnerable, underserved workers, many of whom have limited English proficiency or are employed in temporary jobs.

Funds will support the delivery of training and education on hazard awareness, avoidance and controls; and inform workers of their rights and employers of their responsibilities under the Occupational Safety and Health Act. Grants will be awarded in the following categories:

• Targeted Topic Training: For programs that identify and prevent workplace hazards. Applicants must conduct training on OSHA-designated workplace safety and health hazards.
• Training and Educational Materials Development: For the development of quality, classroom-ready training and educational materials in which workplace hazards and prevention methods are identified.
• Capacity Building: For assessing needs and formulating plans to create full-scale safety and health education programs, expand capacity to provide existing occupational safety and health training, education and related assistance to workers and employers.

Eligible grant applicants include qualifying labor unions; community-based, faith-based, grassroots organizations; employer associations; Native American tribes, tribal organizations, Alaska Native entities, Native Hawaiian organizations, and native-controlled organizations that are not an agency of a state or local government; and public/state-controlled institutions of higher education.

https://www.securitymagazine.com/articles/100817-osha-announces-additional-workplace-safety-initiatives

Lug 01, 2024 Marina Londei Approfondimenti, Attacchi, Campagne malware, News 0

---

Gli attacchi DDoS sono in aumento in tutto il mondo, ma il trend è particolarmente marcato nell’area EMEA dove questo tipo di attacchi sta crescendo a un tasso molto più rapido rispetto ad altre zone.

Secondo l’ultimo rapporto di ricerca di Akamai, più di un terzo di tutti gli attacchi DDoS a livello globale si verifica nell’area EMEA, e l’aumento è costante dal 2019. Regno Unito (26%), Arabia Saudita (22,3%) e Germania (9,1%) sono i tre Paesi con il maggior numero di attacchi subiti.

Il segmento verticale con il numero più alto di attacchi DDoS di livello 3 e 4 (rete e trasporto) è il settore finanziario, mentre per gli attacchi di livello 7 (applicativo) il più colpito è il settore del commercio, il quale conta il 30% di tutti gli attacchi sferrati nell’area EMEA.

“Gli attacchi DDoS a livello di applicazione, come gli attacchi HTTP flood, sono più frequenti nel settore del commercio probabilmente per i potenziali notevoli ricavi che questi attacchi offrono ai criminali” spiegano i ricercatori di Akamai. Questi tipi di DDoS possono avere conseguenze importanti per le organizzazioni commerciali perché in grado di rendere inaccessibile un negozio online o disabilitare i sistemi di prenotazione, portando a una significativa perdita di entrate.

Non è solo il numero degli attacchi DDoS ad aumentare, ma anche la quantità di vettori usati per sferrare gli attacchi; tra i più comuni ci sono il DNS Flood, l’UDP Fragment e l’NTP Reflection.

Dall’inizio del 2019, gli attacchi sono diventati anche più lunghi: DDoS prolungati ostacolano la produttività e la capacità delle imprese di preservare la continuità operativa. La maggiore durata e l’uso di diversi vettori d’attacco sono due strategie efficaci per i criminali, in quanto gli consentono di esaurire meglio le risorse prese di mira.

Il nuovo obiettivo dei DDoS è il DNS

Akamai evidenzia che tra tutti i tipi di attacchi DDoS, i più diffusi sono quelli sferrati contro il DNS, a causa dell’impatto che il traffico dannoso ha su questo servizio fondamentale. “Un attacco DNS riuscito ha il potenziale per distruggere letteralmente la presenza di un’azienda su Internet” si legge nel report.

Nel dettaglio, gli attacchi NXDOMAIN, conosciuti anche come attacchi di sottodominio pseudocasuale o DNS Water Torture, inondano l’infrastruttura DNS con richieste di domini inesistenti. L’elaborazione di una richiesta di dominio inesistente è un’attività complessa che richiede molte operazioni ed esaurisce la capacità di risposta dei sistemi.

Akamai ha rilevato molti attacchi brevi di questo tipo. In genere, in una prima fase vengono usati per sondare l’infrastruttura DNS dell’obiettivo, per poi tornare e sferrare un attacco in piena regola. Stando ai risultati di un’indagine condotta dai 50 principali clienti finanziari della compagnia, questo tipo di richieste ha costituito quasi il 60% del traffico Internet a marzo 2024.

Oltre agli attacchi di DNS Flood, l’altro gruppo diffuso di minacce è costituito dagli attacchi di amplificazione DNS che includono attacchi di riflessione e spoofing degli indirizzi IP creati dai cybercriminali per inviare un gran numero di richieste DNS e paralizzare le risorse dei sistemi.

Non è solo l’impatto sui servizi a spingere i criminali a prendere di mira il DNS: gli attacchi di questo tipo sono facili da eseguire, perché la maggior parte del traffico usa il protocollo UDP che permette di falsificare gli indirizzi IP.

Gli attacchi DDoS prendono di mira l’EMEA

Secondo i ricercatori di Akamai, gli attacchi DDoS sono aumentati in EMEA principalmente per le attuali tensioni geopolitiche che hanno portato alla diffusione di attività criminali sostenute dai governi e all’hacktivismo in risposta alle guerre; oltre a ciò, bisogna considerare le elezioni in Europa e altri imminenti eventi importanti che sono di particolare interesse per gli attaccanti. Gli attacchi DDoS, efficaci e a basso costo, sono il mezzo perfetto per colpire le organizzazioni politiche e le infrastrutture critiche dei Paesi.

Akamai riporta che gruppi di hacktivisti come Anonymous Sudan, Noname057(16) e Killnet sono diventati i nomi più diffusi nel mondo del cybercrimine dopo l’invasione dell’Ucraina da parte della Russia.

Killnet è stato il primo gruppo a emergere e a partire da ottobre 2021 ha iniziato a offrire servizi DDoS-for-hire. La gang ha attaccato agenzie governative, aziende sanitarie, società di media e altre organizzazioni considerate dal gruppo alleati dell’Ucraina.

NoName057(16), considerato anch’esso un gruppo filorusso, sta ampiamente usando gli attacchi DDoS basati su HTTP e Anonymous Sudan ha iniziato a sferrare attacchi DDoS dall’inizio del 2023 contro entità situate in Danimarca, Svezia, Stati Uniti e altri Paesi.

A giugno 2023 molti gruppi criminali, tra i quali ReVIL, Killnet e Anonymous Sudan, hanno cominciato a colpire infrastrutture bancarie critiche sfruttando il caos provocato dalla guerra russo-ucraina. Di recente, Anonymous Sudan ha inoltre rivendicato la responsabilità dell’attacco a Telegram come parte dell’attacco DDoS sferrato contro la rete interministeriale statale del Paese.

Anche la guerra tra Israele e Hamas ha provocato un significativo aumento degli attacchi DDoS, in particolare quelli sferrati contro il Mossas, l’agenzia di intelligence nazionale israeliana, e contro il sito web e gli account Facebook del primo ministro israeliano e dei siti filoisraeliani.

Molti attacchi DDoS nell’area EMEA fanno parte di operazioni a tripla estorsione (RDDoS o Ransom DDoS) nelle quali i cybercriminali, oltre a crittografare i dati dei sistemi con i ransomware e minacciarne la pubblicazione o la vendita, usano le tecniche DDoS per ostacolare le attività della vittima.

L’uso di attacchi DDoS nelle campagne di estorsione serve sia a distrarre i team addetti alla sicurezza informatica, sia per aumentare la pressione sulle vittime. Il settore più colpito dagli attacchi a tripla estorsione è quello sanitario.

Oltre a LockBit, gruppo filorusso tra i primi a sperimentare gli RDDoS, anche gang come Darkside, Lazarus, AvosLocket e BlackCat hanno cominciato a utilizzare in maniera efficace gli attacchi a tripla estorsione.

Proteggersi dagli attacchi DDoS

Per proteggersi e contrastare efficacemente gli attacchi DDoS, le imprese devono implementare solide misure di sicurezza, valutare regolarmente la robustezza delle proprie soluzioni di protezione e disporre piani di continuità operativa e di disaster recovery.

Seguendo le indicazioni della direttiva NIS2 e il DORA per la gestione di fornitori e soggetti terzi, le organizzazioni dovrebbero seguire un modello Zero Trust, applicando controllo degli accessi granulare e sensibile al contesto. Seguendo il concetto del privilegio minimo, inoltre, si segmentano gli utenti a cui è consentito l’accesso.

Oltre a seguire le misure legislative attuali e scegliere soluzioni Zero Trust, i ricercatori di Akamai consigliano di seguire tre strategie per combattere gli attacchi DDoS:

• prepararsi in modo proattivo con un sistema di protezione per le risorse digitali. Ciò comprende controlli di mitigazione per gli indirizzi IP pubblici e per le sottoreti più importanti, un sistema di protezione on-premise integrato con una piattaforma ibrida, controlli di sicurezza proattivi tramite firewall di rete cloud e soluzioni WAF, usare una CDN per memorizzare i contenuti nella cache e l’introduzione di un team SOCC per alleggerire la pressione sulle risorse internet;
• proteggere la propria infrastruttura DNS tramite una piattaforma ibrida di sicurezza che esamina tutto il traffico Internet in entrata, mitigando e filtrando quello relativo agli attacchi prima che raggiunga le applicazioni, le API e l’infrastruttura;
• infine, scegliere soluzioni robuste e complete. La scelta delle soluzioni di sicurezza non dovrebbe dipendere solo dai requisiti e dal budget a disposizione, ma soprattutto dai risultati degli stress test. I test dovrebbero includere documentazione degli incidenti, processi e runbook.

“A causa della moltitudine di vettori di attacco DDoS e dei numerosi percorsi disponibili tra i livelli di rete, trasporto e applicazione, è fondamentale utilizzare una combinazione di soluzioni per fornire una protezione completa da questo problema. Questo tipo di difesa è essenziale per contrastare al meglio gli attacchi DDoS in aumento nell’area EMEA” concludono i ricercaotir.

---

---

---

https://www.securityinfo.it/2024/07/01/gli-attacchi-ddos-sono-in-aumento-nellarea-emea/?utm_source=rss&utm_medium=rss&utm_campaign=gli-attacchi-ddos-sono-in-aumento-nellarea-emea

Congressional hearings regarding the UnitedHealth cyberattack that occurred earlier this year revealed that the massive security incident could cost the company a total of $1.6 billion. During testimony, UnitedHealth CEO revealed that hackers infiltrated its systems through a remote portal that wasn’t protected by multifactor authentication and other safeguards the company had in place that were designed to prevent and detect also failed. Unfortunately, there are many companies that find themselves victims of cybercrimes like this every year.    

While a lot of the conversation is focused on breach prevention, this should be only one part of a company’s overarching data protection strategy. One often overlooked area that is just as important as detection and prevention capabilities is the ability to recover data at scale across your organization when bad things happen. Breaches and ransomware attacks happen, and unfortunately, tools and processes designed to detect and prevent do not catch everything. Which is why having strong recovery capabilities and a disaster recovery plan are so important for defense-in-depth. Here’s a look at recovery point objectives, or RPOs. Measured in seconds, minutes, hours or days, RPOs help a company define the maximum amount of data loss that can occur in the event of a cyberattack.

When RPOs are set prior to a data-loss emergency, normal business operations can resume far more quickly than if a company hasn’t set RPOs. With RPOs, organizations set the parameters for data loss risk that are aligned with their risk tolerance. For instance, if an organization can’t afford to lose more than an hour’s worth of work, set the RPO to an hour or less. That means a cloud backup solution should back up files every hour at a minimum. 

Determining RPO intervals

RPOs and data recovery capabilities are foundational to a solid disaster recovery plan and support a strong data resilience posture. The first step is determining RPO thresholds — starting with critical functions of the business where sensitive data needs additional protection and then rolling up to the organization as a whole.   

Here’s a primer on how to determine RPOs:

• If operations are critical and losing data isn’t an option, set the RPO to every 15 minutes. 
• If operations are semi-critical and can withstand losing up to four hours of data without seriously impacting business, set the RPO between 15 minutes and four hours.
• For departments managing important, but non-critical data and can tolerate losing a full day’s data without negative business implications, set the RPO between four and 12 hours.
• For departments that manage semi-important data the RPO can be set between 13 and 24 hours.

RPO best practices

It’s best practice to avoid setting an RPO for longer than 24 hours. But there are other considerations that factor into defining an RPO. Think about the operational needs of the business and risk tolerance and select systems that take those needs into account. Rather than focusing on how quickly data can be recovered, consider how quickly it needs to be recovered.

And don’t forget about recovery time objectives (RTO). For instance, if you need to recover a week’s worth of data, an RPO of once an hour and ultra-fast backup solutions are likely overkill. However, if data needs to be recovered very quickly, choose fast backup and recovery solutions that can restore the data at lightning speed.

What and where to backup

Backup and recovery solutions deliver an automated solution for creating, managing and restoring data. They enhance data resilience by protecting many file types, but the most common are documents, videos, databases, photos and music. Additionally, they safeguard data housed in a variety of storage locations including servers, the clou and endpoints.

Features of strong backup solutions

There are a wide variety of backup technology is available including full backup software, incremental backup software and differential backup software. The features to look for in a strong backup solution are: 

• Automated backups on a set schedule that don’t require manual actions.
• Easy to recover data at scale if a cyberattack or other disaster strikes.
• Cloud-based technology that offers multiple backup locations with control over geographical locations — cloud based and off-site.
• Platforms that are configurable to meet the varying organizational needs.
• Software that meets the security and compliance needs of the organization.

No let up in sight

Malicious actors and cyberattacks continue to proliferate going forward. According to the SANS Institute, ransomware attacks increased by almost 73% from 2023.

If a healthcare giant like UnitedHealth is vulnerable, so are many organizations across a wide range of industries. Having RPOs and a strong backup solution can mean the difference between having to pay a ransom to retrieve valuable company data and stripping bad actors of their leverage.

https://www.securitymagazine.com/articles/100754-recovery-point-objectives-101-planning-for-cyberattacks