The Microsoft Threat Analysis Threat Center reports that a sophisticated Russian disinformation campaign is attempting to undermine the Paris Olympic Games. These campaigns are also targeting France, French President Emmanuel Macron and the International Olympic Committee (IOC). 

The report states that two Russian disinformation groups are at the heart of this campaign: Storm-1679 and Storm-1099. As the Olympics draw closer, it is likely that the actions of these disinformation groups will increase in intensity. 

Secuity leaders weigh in

Patrick Tiquet, Vice President, Security & Architecture at Keeper Security:

“The recent Microsoft report underscores the significant cyber threats posed by Russian actors to the Paris Olympics. By combining AI capabilities with all the other tools in their arsenals, threat actors could unleash a multifaceted assault involving anything from sophisticated misinformation campaigns to cyber espionage and even potential disruptions to critical infrastructure. However, while these threats loom large, they also present an opportunity for event organizers to bolster their cybersecurity defenses. By embracing advanced encryption methods, implementing stringent access controls and conducting regular security audits, organizers can effectively mitigate many of the risks being posed to the Games.”

Patrick Harr, CEO at Pleasanton, Calif.-based SlashNext Email Security+:

“Emotions run high during high profile events, such as the Olympics, and hackers will quickly take advantage of the predictability of fans falling prey to malicious content that leads to data breaches. With this popular sporting event, it’s easy for hackers to prey on the excitement. 

“The sophistication of phishing threats is becoming more difficult to detect, especially for users. With the Olympics nearly upon us, Olympic-themed phishing sites will pop up to steal credentials for future corporate-based attacks or commit credit card fraud. Organizations must educate their employees and, most importantly, be proactive in securing BYOD. With the increased use of BYOD and dual-purpose devices, it’s important to avoid giving away login credentials or accidentally adding malicious browser extensions which can be used to breach corporate assets.

“Protect your organization by encouraging users to exercise extreme caution when participating in anything related to the Olympics. Most importantly, have the right security tools in place, including real-time mobile, browser and email security solutions.”

Andrew Harding, Vice President, Security Strategy at Menlo Security:

“I’ve worked on the cyber defenses associated with the Olympics in the past, and the kind of attack varies. The focus has tended to be on the newest technology or the weakest area of defense. In the Beijing 2008 Olympics, there was concern about Wi-Fi being compromised — and over privacy. In Soichi, during the 2014 Winter Games, sophisticated network defenses protected the games-related infrastructure — and the Russian government monitored all web traffic to defend against terrorist threats. While these defenses prevented attacks, some objected to the monitoring, retention and analysis of all that user data. But the worries many had over DDoS attacks on the games were largely managed with effective defenses. Much has changed in the last four to eight years.

“As threat actors have adopted more adaptable and evasive techniques, I worry that traditional controls might not be able to stop phishing attacks and ransomware delivery. Without a secure enterprise browsing a solution, impostor web sites or sites that smuggle malware onto computers or phones can slip through defenses. Research from Menlo shows these attacks increasing greatly, and it’s supported by the Cisco Talos Threat Intelligence, which shows that these tactics increased 20% in the first half of 2024. Any target of consequence has to worry about these new tactics. Whether the goal is notoriety to advance a cause or financial cybercrime, targets don’t get much bigger than the Summer Olympics. As in past games, private companies and governments must work together to prevent a cyberattack, but it’s worrisome that new tactics have emerged and are growing in use and effectiveness as we approach such an important event. 

“The scale and significance of the event make it an attractive target for cybercriminals, hacktivists and even nation-state actors. Therefore, robust cybersecurity measures are essential to safeguard the integrity, security and smooth functioning of the Olympic Games.”

JT Keating, Senior Vice President of Strategic Initiatives at Zimperium:

“Today, mobile security and education in the enterprise is more crucial than ever. In most cases, mobile devices represent a significant, unaddressed attack surface for enterprises. No matter if they are corporate-owned or part of a BYOD strategy, the need to implement proper security controls and educate end-users about potential threats is critical.

“Without defenses in place to stand up against these growing threats — especially during events like the Olympics — enterprises and their employees are left at risk. However, education is only part of the solution. Attackers are becoming increasingly sophisticated and are always developing new tactics and techniques to undermine employees that have undergone some level of anti-phishing training. Technology is available today that can help fill in the gaps, minimizing the risk and attack surface presented by threat actors.

“As technology evolves to address new business challenges and needs, the modern mobile era has ushered in a new category of security to help combat current threats. Organizations can and should continue to use Mobile Device Management (MDM) — but only if they are tying it to a Mobile Threat Defense (MTD) solution, which can detect and prevent mobile device, network, phishing and malicious app attacks.”

https://www.securitymagazine.com/articles/100784-russian-disinformation-campaign-attempts-to-disrupt-the-paris-olympics

Security professionals angling for top jobs in the industry often focus on the role of Chief Security Officer. Is that the best job search strategy? 

The job title “Chief Security Officer” became an ANSI standard in 2009 and has been revised on occasion to refine and update responsibilities. Developed by ASIS International, the original concept of the CSO role envisioned the position as having responsibility for the strategy and governance of security related risks facing organizations. The standard supported the concept of convergence with the role serving as a single point of accountability in pursuit of a broader view. 

While some companies do have converged security programs, it is also common to have a separation between the corporate security function and that of information- or cyber-security. The CSO might have a broader mandate while the Chief Information Security Officer, or CISO, might be more narrowly focused. 

But is a CSO or CISO always the senior-most security role? Job titles vary widely across organizations and not every top security job is a CSO. Naming conventions differ across industries and that adds to the mix. Someone looking for a senior security role will find more opportunities by casting a wider net instead of searching only for a job titled CSO or CISO. 

For instance, the top security job in one company might be considered a vice-presidential role while in another, it could be simply titled “Security Director.” Organizations often have naming conventions for positions. Job titles are kept in parity with other departments in the company and may not be an exact reflection of the responsibilities of roles. CSO might not be a job title they can use. 

It is also helpful to research the reporting relationships in companies you are interested in working for. Gain an understanding of where the security function reports within the organization. The top security job could report to the CEO or board of directors. Or it might report through the legal or information security organization chart. 

And do not be surprised if the role you are interested in is not “global.” Job titles that have the word “global” are not always accountable for worldwide programs. Very often the term simply means the position is part of the organization’s global security program. Your responsibilities may be local or regional while being part of the worldwide program. 

More variations on the top security job title occurs on social media job search platforms. Very often companies who post jobs there are instructed to simplify their advertised job titles to fit within specific algorithms the platform’s software uses to match candidates to positions. This makes it difficult to identify what level a job is or what its actual accountabilities are. 

Recognition that organizational and cultural changes are ongoing will help you be open to more job opportunities. 

The success of any senior security executive is not necessarily measured by job title. Instead, it is your ability to build credibility with leadership and positively affect the security and risk management programs of an organization. Regardless of what your title is. 

https://www.securitymagazine.com/articles/100771-do-security-job-titles-affect-your-job-search-strategy

Security is known to be a fast-paced field, and security leaders often find themselves in vastly different positions than they held a few decades ago. Oftentimes, this includes a shift between public and private sector careers. Two security leaders discuss their experience moving out of public security and law enforcement and into the private sector.

Scott Ashworth, Global Security and Resilience Leader at Google

Transitioning away from law enforcement proved to be a challenging decision. With a deep passion for my work, especially as a young Investigations Lieutenant experiencing a rapid ascent, I found myself at a pivotal crossroads. It was a moment where I grappled with the choice of either capitalizing on the momentum of my career within the force or strategically shifting gears into the corporate realm. 

My decision to shift careers stemmed from a desire for new challenges and opportunities for growth. After years of serving in law enforcement, I felt the need to explore a different avenue where I could apply my skills and expertise in a new context. Corporate security presented itself as the perfect blend of my law enforcement background and a fresh professional environment. 

One of the most significant challenges I faced during this transition was adapting to the corporate culture. Law enforcement operates within a strict hierarchical structure, whereas corporate environments often emphasize collaboration and flexibility. Learning to navigate this change required me to cultivate a new set of interpersonal skills and adopt a more nuanced approach to leadership. 

However, my experience in law enforcement provided me with a solid foundation for success in corporate security. The critical thinking, problem-solving and crisis management skills honed in the field are invaluable assets in the corporate world. My ability to remain calm under pressure and make quick, informed decisions has proven invaluable in handling security threats and emergencies within a corporate setting. 

Furthermore, my background in law enforcement has equipped me with a deep understanding of risk assessment and mitigation strategies. Whether it’s implementing access control measures, conducting security audits or developing emergency response protocols, my law enforcement experience has been instrumental in designing comprehensive security solutions tailored to the unique needs of corporate environments. 

Transitioning from law enforcement to corporate security has also allowed me to leverage my expertise in law and regulations to ensure compliance with legal requirements and industry standards. From overseeing internal investigations to liaising with law enforcement agencies, my legal background has been an asset in maintaining the integrity and security of corporate operations. 

Moreover, the transition has provided me with the opportunity to broaden my professional network and collaborate with individuals from diverse backgrounds. Building relationships with stakeholders across departments has not only enhanced communication and collaboration but also enriched my overall professional experience.

In hindsight, while the transition from law enforcement to corporate security posed its challenges, it has been a rewarding journey of personal and professional growth. My background in law enforcement has provided me with a unique perspective and skill set that I’ve successfully applied to my roles in protecting professional athletes and now leading tech industry security teams to ensure the safety for the staff and customers of a Fortune 10 company. As I continue to navigate this dynamic field, I’m excited about the opportunities for further learning and development that lie ahead.

Ryan Schonfeld, Founder & CEO, Hivewatch

Being a police officer was one of those childhood dreams of mine, where I decided in first grade and never wavered from there. I entered the police academy after college and began specializing in fraud-related crimes, but one thing that frustrated me was how far behind we were from the criminals we were trying to apprehend. Ultimately, that frustration led me to a master’s degree in IT and system design and eventually led me to focus efforts on addressing computer-related crimes. 

My career led me to work for the U.S. State Department as a consultant where I was sent overseas and tasked with training law enforcement. I realized then that there were a lot of opportunities in the private sector that were law enforcement-adjacent that still revolved around helping people and solving big problems without having to physically fight people and take on more risk. 

My later career took me to a large guarding company, where I was tasked with learning how to use technology to make our jobs more efficient. Later, when I ran Global Security Technology for Fox Entertainment, the technology around building a cohesive command center was my focus and I began to realize the growth the industry still needed. Through building a consulting firm dedicated to helping security professionals navigate the technology side of the business and later starting a software company, HiveWatch, each step in my public sector career has allowed me to build on the knowledge base I have and continue to grow. 

As more and more law enforcement officers contemplate a transition, the question of tenure, retirement, and pensions becomes top-of-mind. What I’ve found is that the private sector offers more opportunity for growth, better compensation and benefits packages, and potentially can give you more long-term growth and earnings comparatively. 

It’s also a way to build something that the world needs. If you’re interested in entrepreneurship, go do it. Find an idea and make mistakes. No one gets it completely “right” the first time and making mistakes and figuring things out is part of the amazing journey and the process of creating change. 

The bottom line is: whether you’re looking to transition or contemplating life after law enforcement, there’s fun, excitement, and a need in the private sector. Start to build your network through platforms like LinkedIn, have conversations about the state of security or public safety, and leverage the vast amount of knowledge you have to begin your journey. 

https://www.securitymagazine.com/articles/100770-how-law-enforcement-can-prepare-for-a-career-in-the-private-sector

The Occupational Safety and Health Administration (OSHA) has determined that a crane and rigging services provider violated federal law by firing a company truck driver on June 5, 2020, for refusing to exceed safe driving limits set by the Federal Motor Carrier Safety Administration.

An investigation determined the driver employed by Crane Masters Inc. told their employer that, after working 19 hours on June 4, 2020, it would be unsafe for them to operate a commercial vehicle as they had not gotten the legally required amount of time off before returning to work. The Houston company responded by terminating the driver.

OSHA found the company fired the employee illegally for exercising their protected rights under the federal Whistleblower Protection Program, and the department’s Regional Solicitor in Dallas presented its case during a formal hearing in Houston on Oct. 14, 2022.

On May 13, 2024, the judge issued a decision upholding OSHA’s findings and ordered Crane Masters to pay the former truck driver $14,945 in back pay, interest and compensatory damages. The company must also expunge the former employee’s record and post a notice to employees.

https://www.securitymagazine.com/articles/100788-osha-determines-construction-whistleblower-was-wrongfully-terminated

KnowBe4 has released its 2024 Phishing by Industry Benchmarking Report. This report measures the likelihood that an organization’s employees would fall for a phishing or social engineering scam, assessing the status of security preparedness and awareness across global industries such as government, healthcare and critical infrastructure. 

54 million simulated phishing tests were analyzed in the report. These tests involved more than 11.9 million individuals from 55,675 organizations across 19 industries. Through this analysis, the report found that without security awareness training, 34.3% of users were likely to click on malicious links or follow through with scam requests. When phishing tests are integrated into regular security awareness training, organizations see this number decline to 18.9% within 90 days. After a year of regular training, it declines to 4.6%. 

The report reinforces the importance of managing the human element in order to properly secure an organization. 

https://www.securitymagazine.com/articles/100781-untrained-users-are-the-greatest-weakness-in-a-cyber-defense-plan

.pod { width: 100%; border: solid 3px #C72026; background-color: #f4bdbf; padding: 7px; margin: 20px 0; justify-content: center; } h3 { font-weight: bold; font-size: 18px; color: #C72026; }

In this episode of The Security Podcasts featuring Scott McHugh, retired CSO at LyondellBasell Chemical Company and Faculty at Rice University, we discuss the challenges security leaders face when navigating political polarization in the workplace.

“This is actually not a new phenomenon,” Scott McHugh says. “It really started in the late ’90s, in the Clinton administration, and it’s just been manifesting itself through the years ever since then. And it’s become much more of a problem in the workplace, because these political polarization discussions have become a zero sum game, in which one side feels they haven’t been able to win if the other side didn’t lose. And that’s not really what you’re seeking as far as workplace conversations.”

Or check it out on our Apple Podcasts or Spotify channels. Don’t forget to like, follow, and rate and review our podcasts!

https://www.securitymagazine.com/articles/100682-navigating-political-polarization-in-the-workplace

Giu 12, 2024 Marina Londei Attacchi, News, RSS, Vulnerabilità 0

---

Secondo l’ultima analisi del Threat Hunter Team di Symantec, il gruppo Cardinal, dietro il ransomware Black Basta, avrebbe sfruttato una vulnerabilità di Windows prima che venisse patchata.

Il bug in questione (CVE-2024-26196) è una vulnerabilità di privilege escalation presente nell’Error Reporting Service di Windows. Microsoft ha risolto il bug lo scorso 12 marzo e aveva affermato che non c’erano prove di exploit collegati a esso; ora, tre mesi dopo la patch, i ricercatori di Symantec hanno trovato alcuni indizi di exploit precedenti alla patch da almeno un gruppo criminale.

Il team di ricerca ha trovato e analizzato un tool usato in alcuni attacchi ransomware recenti scoprendo che sfruttava la vulnerabilità dell’Error Reporting Service per creare un eseguibile con cui avviare una shell con privilegi di amministratore. Dall’analisi è emerso inoltre che le tattiche, tecniche e procedure (TTP) usate negli attacchi erano molto simili a quelle descritte in un recente report di Microsoft sulle attività di Black Basta.

Nel dettaglio, il gruppo ha abusato di Quick Assist, ha usato EvilProxy per sottrarre le credenziali e ha usato script batch che si fingevano aggiornamenti software, tutte tecniche che, secondo i ricercatori, rimandano al modus operandi di Cardinal.

Gli attaccanti non sono riusciti a eseguire il payload di Black Basta durante gli attacchi, ma vista la facilità con cui è possibile sfruttare la vulnerabilità è consigliabile installare il prima possibile la patch del servizio Windows.

Black Basta è apparso nel 2022 e la sua attività è stata sempre strettamente legata alla botnet Qakbot, considerato il suo vettore d’infezione primario. Dopo lo smantellamento della botnet le operazioni del gruppo ransomware sono calate, ma negli ultimi tempi Cardinal ha ripreso con l’esecuzione di nuove campagne, usando in particolare il loader DarkGate.

Dal momento che le campagne ransomware non accennano a diminuire, è essenziale che le organizzazioni si preoccupino di proteggere tutti i dispositivi e le applicazioni esposti in rete, mantenerli aggiornati e implementare l’autenticazione multi-fattore per tutti i servizi.

---

---

---

https://www.securityinfo.it/2024/06/12/la-gang-di-black-basta-sospettata-di-aver-sfruttato-un-bug-di-windows-prima-della-patch/?utm_source=rss&utm_medium=rss&utm_campaign=la-gang-di-black-basta-sospettata-di-aver-sfruttato-un-bug-di-windows-prima-della-patch

Research has revealed the development of a new ransomware variant called Fog. The research, conducted by Arctic Wolf Labs, was observed in multiple cases and displayed similar elements throughout. The targets of Fog’s ransomware activity were predominantly in the United States, with 80% focused on the education sector and 20% on the recreation industry. 

The research refers to Fog as a ransomware variant rather than a ransomware group in order to differentiate between entities that construct the encryptor software and those that carry out the attacks. At this time, the structure of the group or groups deploying Fog ransomware is unknown. The research notes that as more details on Fog emerge, more nuances may be added to the research. 

Currently, the research has shown that threat actors in investigated cases gained access to target environments by exploiting compromised VPN credentials. Two separate VPN gateway vendors were leveraged for remote access. To date, the last documented activity occurred on May 23, 2024.

https://www.securitymagazine.com/articles/100780-research-reveals-new-ransomware-variant-called-fog

Il problema della fragilità del reperto informatico, data l’estrema capacità di modificazione che lo connota, ha interessato i giuristi anche con riguardo al tema della ripetibilità o irripetibilità delle relative operazioni.

In particolare, ci si è chiesti se tali fasi siano assistite dalle tutele previste dall’art. 360 c.p.p. e debbano dunque essere considerate accertamenti irripetibili^[1], con la necessità di ricorrere alle conseguenti garanzie procedurali, oppure se siano riconducibili all’art. 359 c.p.p. e quindi da considerarsi accertamenti ripetibili^[2]. Ci si è domandati, insomma, se e quali attività debbano essere assistite dalle garanzie proprie degli atti irripetibili (e quali invece no).

Premesso che in determinate situazioni la scelta della modalità attuativa potrebbe essere influenzata dalla tipologia di supporto informatico attenzionato e in altre imposta da un’urgenza improrogabile, che non consentirebbe l’instaurazione del contraddittorio ex art 360 c.p.p., occorre evidenziare una prima distinzione che potrebbe delinearsi tra momento dell’estrazione in copia forense dal supporto originale (fase di acquisizione tout court) – dove la linea di demarcazione tra accertamento ripetibile e irripetibile è meno nitida – e momenti successivi all’estrazione della copia forense, con riguardo agli atti compiuti sulle copie stesse.

Per quanto riguarda questo secondo caso, non sembra esserci dubbio in merito alla ripetibilità delle operazioni: una volta cristallizzate le digital evidence è possibile creare molteplici “cloni da lavoro” direttamente dalla beat stream image stessa, dalla quale si potrà quindi partire per svolgere (e ripetere) tutti gli accertamenti successivi necessari al completamento delle investigazioni, così salvaguardando il supporto originale che potrà essere impiegato per attuare verifiche sulla sua integrità.

La questione diventa più intricata nel momento dell’estrazione della prima copia, che avviene – per l’appunto – direttamente dal supporto originale; momento in cui qualunque errore, anche involontario, potrebbe irrimediabilmente compromettere il contenuto digitale del sistema da acquisire, così falsando inevitabilmente l’acquisizione. Un momento, dunque, dove l’instaurazione del contraddittorio propria degli accertamenti tecnici irripetibili consentirebbe alla difesa di partecipare a tutela dell’indagato.

Esclusi dunque quei casi di assoluta urgenza, nei quali l’esigenza di procedere si paleserebbe improrogabile a causa di situazioni di rischio che non consentirebbero di dilazionare le operazioni in attesa della difesa, occorre capire se le forme contemplate dall’art. 359 c.p.p. siano idonee a salvaguardare la posizione della persona sottoposta alle indagini e, più in generale, il corretto andamento del processo.

Sul piano giuridico, si tratta di capire se l’acquisizione delle digital evidence rientri nella categoria degli “accertamenti tecnici”, cioè quelle operazioni che comportano un’opera di studio critico, valutazione o giudizio dei reperti; oppure se si tratti piuttosto di un’attività di mero “rilievo tecnico”, attinente la semplice individuazione, raccolta e acquisizione del materiale^[3].

In proposito parte della dottrina, in ottica garantista e sul presupposto dell’inesistenza di una previsione che comporti l’inutilizzabilità del dato digitale ottenuto in violazione delle best practices, ha prospettato come soluzione migliore quella del ricorso alle procedure imposte dall’art. 360 c.p.p., annoverando l’acquisizione nella categoria degli accertamenti tecnici irripetibili^[4].

Effettivamente, in tal maniera alla difesa sarebbe consentito di assistere alle procedure di estrazione: così, da un lato, si tutelerebbero quanto più possibile i diritti difensivi e, dall’altro, si imprimerebbe ai dati informatici acquisiti una certa attendibilità, conferita proprio dal contraddittorio instaurato tra le parti, eventualmente alla presenza di un consulente tecnico nominato dalla difesa^[5].

Di impostazione diametralmente opposta, tuttavia, la giurisprudenza maggioritaria.

Per orientamento consolidato della Suprema Corte di Cassazione, infatti, la formazione del contraddittorio nel momento dell’estrazione della copia forense non è condizione essenziale per l’espletazione delle operazioni di digital forensics, giacché la creazione della bit stream image, qualora venisse fatto ricorso a metodi atti ad impedire alterazioni e danneggiamenti dei dati, deve essere ricompresa nella categoria dei semplici “rilievi”. Ciò poiché l’estrazione di dati digitali non presupporrebbe attività valutative o di giudizio critico, non ponendosi quindi problemi in relazione alla ripetibilità ex art. 359 c.p.p.^[6].

In buona sostanza, «ciò che sposta il confine tra atto ripetibile e atto irripetibile è l’attenta acquisizione dei dati dal supporto originale e la possibilità di provare successivamente a livello scientifico che i dati della copia effettuata siano identici (in senso informatico) a quelli originali e che il supporto originale nel frattempo o durante le operazioni non sia stato modificato o alterato»^[7].

Il quadro descritto, tuttavia, potrebbe assumere tratti di incertezza allorché da una parte la giurisprudenza ammette la ripetibilità dell’acquisizione della copia forense – a patto che sia stata ottenuta con procedure che tutelino l’integrità dei dati – mentre dall’altra parte, come visto con il caso Vierika, accetta di far pervenire all’attenzione del giudice elementi ottenuti in omissione del rispetto delle best practices internazionali richiamate dalla legge n. 48/2008. Nuovamente, quindi, si correrebbe il rischio di lasciare al giudice il compito di valutare un materiale probatorio che potrebbe essere frutto di una raccolta erronea, lasciando alla difesa l’onere di dover “smontare” un quadro accusatorio costituito da elementi informatici, già per loro natura estremamente fragili, acquisiti senza la sua partecipazione.

Note

^[1] Per accertamenti irripetibili si fa riferimento a quel tipo di accertamento da eseguire su «persone, cose o luoghi il cui stato è soggetto a modificazioni» (art. 360, co. 1, c.p.p.). Si tratta pertanto di quegli accertamenti che, sussistente un rischio concreto di modificazione, non consentono di essere rinviati ad altro momento, o che possono essere eseguiti una volta sola e che per poter essere espletati necessitano della messa in essere di dettagliate procedure poste a garanzia della difesa, prima fra tutte l’instaurazione del contraddittorio.

^[2] Per accertamenti ripetibili ci si riferisce a quelle attività consistenti in «accertamenti, rilievi segnaletici, descrittivi o fotografici e ad ogni altra operazione tecnica per cui sono necessarie specifiche competenze tecniche…» (art. 359 c.p.p.) che possono essere ripetuti più volte e che pertanto non necessitano della formazione del contraddittorio per essere espletati.

^[3] Una simile distinzione tra il concetto di accertamenti tecnici e rilievi tecnici è stata formulata dalla Suprema Corte già a partire dai primi periodi di vita dell’attuale codice di procedura penale, con un orientamento pressoché costante, anche con riferimento alla prova scientifica. Per una delle prime pronunce si veda Cass. Pen., Sez. I, n. 301 del 14 marzo 1990. Tra le altre, anche Cass. Pen., Sez. I, n. 239101 del 16 gennaio 2008 e Cass. Pen., Sez. IV, n. 637 del 14 aprile 2004.

^[4] Tra le altre voci in tal senso si veda F. GIUNCHEDI, op. cit., pp. 828 e 829, dove il ricorso alla procedura dell’accertamento tecnico non ripetibile viene descritta come una via «precauzionale».

^[5] Ibidem, dove ci si sofferma sul verbo “assistere” utilizzato dall’art. 360 c.p.p. e al significato da attribuirvi in sede di acquisizione. Per l’autore, in particolare, quando si procede ad acquisizione di dati digitali «Il punto è chiarire il significato da attribuire al verbo «assistere» ed in particolare se poterlo ritenere quale prologo al successivo diritto di formulare osservazioni e riserve. Se, infatti, lo si intende come attività di osservazione passiva, volta sul piano processuale a verificare la regolarità del compimento degli atti, è ovvio che il diritto di difesa risulta seriamente compromesso; diverso è il caso in cui l’accertamento tecnico ex art. 360 c.p.p. sia da assimilarsi per analogia alla perizia; qui il termine assistenza va letto in termini più ampi – di contraddittorio – e in correlazione logica con i diritti successivamente assicurati (partecipazione agli accertamenti, formulazione di osservazioni e riserve). L’art. 226, co. 2 c.p.p. prevede, infatti, un contraddittorio nella formulazione dei quesiti («Il giudice formula quindi i quesiti, sentiti il perito, i consulenti tecnici, il pubblico ministero e i difensori presenti»)».

^[6] Fra le altre pronunce che aderiscono all’orientamento maggioritario si vedano Cass. Pen., Sez. I, n. 14511 del 5 marzo 2009; Cass. Pen., Sez. V, n. 11905 del 16 novembre 2011; Cass. Pen., Sez. I, n. 23035 del 30 aprile 2009. Più recentemente anche Cass. Pen., Sez. V, n. 8736 del 16 gennaio 2018 e Cass. Pen., Sez. VII, n. 11066 del 10 febbraio 2021 dove si legge che «i dati di carattere informatico contenuti in un computer rientrano tra le prove documentali e per l’estrazione di questi dati non occorre alcuna particolare garanzia; di conseguenza ogni documento acquisito liberamente ha valore di prova, anche se privo di certificazione; sarà poi il giudice a valutarne liberamente l’attendibilità».

^[7] D. CURTOTTI, “Attività di acquisizione della digital evidence: ispezioni, perquisizioni e accertamenti tecnici”, in “Cyber forensics e indagini digitali Manuale tecnico-giuridico e casi pratici”, cit., p. 445, dove l’autrice, dopo aver analizzato la massima pronunciata da Cass. Pen., Sez. V, n. 11905 del 16 novembre 2011, elabora il passaggio su riportato a sua volta citando S. ATERNO, op. cit., pp. 775 e ss.

Articolo a cura di Francesco Lazzini

https://www.ictsecuritymagazine.com/articoli/atti-ripetibili-e-irripetibili-nella-digital-forensics/

Security leaders’ cybersecurity preparedness was analyzed in a recent report by Coro. According to the survey, 73% of SME security professionals have missed, ignored or failed to act on critical security alerts, with respondents noting a lack of staff and a lack of time as the top two reasons.  

The report found the following concerns among cybersecurity professionals: 

• 35% of respondents admitted to having missed a security alert at work. 
• 31% turned down the sensitivity on a security tool 
• 26% muted a security alert entirely 
• 25% have failed to act on a high-priority alert, and 22% have ignored a security alert entirely. 

Respondents gave feedback on the most time-consuming parts of their day, including: 

• monitoring security platforms 
• managing and updating endpoint devices and agents 
• vulnerability management or patching 
• installing, configuring and integrating new security tools. 

According to the report, respondents spend an average of four hours and 43 minutes managing their cybersecurity tools every day, with an average 11.55 tools in their security stack. Fifty-two percent of respondents said the most time-consuming task was monitoring security platforms, followed by vulnerability patching. 

Respondents estimated it takes 4.22 months for a new cybersecurity tool to become operational; with equal time spent on installation, configuration, training staff and integration with their existing security stack. On average, respondents manage 2029.91 end point security agents installed across 655.92 endpoint devices. Fifty-three percent of respondents must deal daily or weekly with vendors’ updates of these endpoint agents. Eighty-five percent of respondents say they are looking to consolidate their tools in the next 12 months. The most important benefit cited was improving their security posture. 

Read the report

https://www.securitymagazine.com/articles/100769-22-of-cybersecurity-professionals-have-ignored-an-alert