The reputation of an organization can be built, or destroyed, through a single event. This is especially true for arenas and stadiums, who hold the reputation of a sports team, a city and often an artist in their hands. These arenas are frequently tied to organizations in other industries that have a high investment in protecting these events. 

Take the following organizations as an example: 

• AT&T 
• Bank of America 
• Mercedes-Benz 
• Kroger 
• Tropicana 
• Gillette 
• State Farm 

On paper, these organizations don’t have much in common. Some are financial institutions, some are service providers or grocery stores. However, all of these companies have an event space in their name. If an incident were to occur, their brand would be involved in headlines, associating them with whichever scandal has occurred. For those companies without public-facing retail locations, this event space is the only time consumers are interacting directly with their employees. 

Poor planning can lead to stressed out staff, displeased executives and disappointed guests, damaging an organization’s reputation on multiple levels. Even if the issues are rectified, the loss in trust is hard to repair. Previously overworked staff may be reluctant to help, and guests may refuse to attend if all they can remember is long lines, cold food or extreme temperatures. 

More important than the aesthetics of an event is the event’s safety. Event incidents such as the bombing at an Ariana Grande concert in Manchester leave long-lasting impressions on the community. Employees may quit, and rehiring will be difficult unless their safety can be guaranteed. Concert venues have the additional concern of navigating talent concerns. If over-eager fans are able to jump over barricades and bypass security, artists will hesitate to agree to work in that space. 

Even if staffing issues have been resolved, security leaders have to be prepared to work to rebuild their consumers’ trust. Guests need to feel safe entering or sending their children into a space. Even if the events are unrelated, such as a sports game or a concert, with entirely different security teams, consumers often won’t know the difference. An organization needs to ensure that not only their security teams are fully prepared, but any security team that enters their perimeter. 

“It is very important to ensure that there is a legal contract in place to protect the agency from any liability issues. Ensuring that the organizer has insurance, and who is responsible for security is also extremely important,” Chief Arnaldo Bernabe, Director of Public Safety at The City University of New York, Hostos Community College, says. If an outside security team is entering an event space, that organization takes responsibility for how that event unfolds. 

“The first step in securing an event involves getting to know more. Important considerations include: What is the event about? What type of event is it? Has it been held at the location before? Have there been any issues with the event at previous venues? How many people will it attract? Who will make up the majority of the audience, (young people, professional business people, older crowd, etc.) Will there be any elected officials, or other high profile VIPs, entertainers, influencers at the event? How has the event been advertised?” Bernabe says. 

What physical safety measures (turnstiles, security cameras, alarms, mobile and fixed posts, panic alarms) are in place? Systems like these not only reduce the number of employees that need to be in specific locations, but also can provide an additional sense of security for guests. 

This is where collaboration can really come in handy. Security leaders can prepare for an artist touring in their city by seeing how preceding concert venues handled the artists’ arrival. How was traffic redirected to reduce the likelihood of car accidents? If alcohol is involved, how were underage guests identified from those 21 and older? Could nearby public transit stations handle the increase in volume? Where does rideshare normally pick up, and does that location need to be changed? Is there a plan for guests who have a medical emergency? Are people waiting outside in the sun or the shade? How will minors be supervised throughout the event? 

These partnerships can involve local law enforcement, state partners and nearby organizations. A sports arena may be dealing with stadium employees alongside those working for the visiting team. Clear communication is essential to ensure everyone is on the same page both during the event and in case of an emergency. 

Even if they only happen once a year, events can leave a lasting impression — good or bad — to a company’s reputation. Securing them needs to be just as important as building security into everyday operations.

https://www.securitymagazine.com/articles/100756-event-safety-how-one-day-can-affect-a-companys-reputation

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #9C48B0; } .w3-panel:after,.w3-panel:before { content: “”; display: table; clear: both } .w3-panel { padding: 16px; margin-top: 16px; margin-bottom: 16px } .w3-leftbar { border-left: 6px solid #386994!important } .w3-color,.w3-hover-color:hover { color: #386994!important; background-color: #eaf1f7!important } .w3-large { font-size: 20px!important } .w3-sans-serif { Nunito Sans’,Arial,sans-serif } .w3-opacity,.w3-hover-opacity:hover { opacity: 0.60 }

Artificial intelligence (AI) is many things to many people. For some, it’s the hyped-up future of everything. To others, it’s just big data and analytics in a shiny new box. But regardless of where one falls on the AI spectrum, there’s no denying one thing: AI is causing big changes, and it’s already changing how organizations secure their physical infrastructure.

AI does this by sensing when something is outside the normal state-of-affairs, which enables it to identify actual threats rather than non-existent ones. This is a breakthrough capability because humans may not look for all the signs of criminal behavior, or they may have some issues preventing them from doing their jobs well — they may be tired, or sick, or have some personal problem causing them to be distracted.

AI, on the other hand, never has these problems and is excellent at doing the same thing over and over again. Because of this, it can be a superior approach to monitoring thousands of hours of videotape and finding the “needle in the haystack.”

AI makes proactive security possible

Working with humans, AI can be a powerful supplemental tool. It can provide perfect repeatability, while humans can provide the judgment that is needed to properly respond to an event. For example, AI can alert humans to an activity in progress without them having to stare at a screen waiting for something to happen. And humans can verify that a crime is happening and respond appropriately.

By working in this way, AI can spare humans from running down rabbit holes chasing false-positive alerts. This achieves the ultimate goal of security surveillance: drastically reducing the need for humans to waste time chasing down bogus alerts.

From the vendor operational side of things, particularly from those organizations that offer remote video monitoring (RVM) services, AI is a valuable tool because it lets one person in the surveillance operations center do the jobs of many people (after all, if there are fewer rabbits to chase, organizations also need fewer people to chase the rabbits). This is especially important in today’s labor crunch, where it can be difficult to find enough people with the skills to work in a surveillance operations center.

For customers of RVM vendors, AI makes proactive security possible. Proactive security is important because it deters crime before it happens, without police intervention. This is cheaper for everyone and eliminates the risk of someone getting hurt. AI-enabled video does this by activating visual and audio deterrents to drive would-be criminals off the property.

Also, AI-enabled video enables security vendors to provide affordable security services that otherwise would be cost-prohibitive and inferior. Without AI, it would be near impossible to reliably catch crimes in process, relegating video to its traditional role of providing after-the-fact evidence for legal and insurance claims.

AI must be trained

No two organizations are the same. This means AI must “understand” what it is protecting and the specific location where it is being used. It must understand hours of operation and know when to expect people on premises and when not to. It must distinguish between criminal and normal behavior. And it needs to understand its immediate surroundings so, for example, it can recognize a deer or some other wildlife visiting from nearby woods, rather than mistakenly identifying any large moving object as a human.

To optimize AI for a specific location, it must be trained to filter out innocent distractions so it only alerts for incidents worth investigating. It can do this when properly trained because it has “seen” things thousands of times. It stands to reason: anything — human or machine — that has seen an environment and activities occurring on it many times will be much more accurate in identifying behavior or conditions that fall outside the norm. This is why there is no such thing as “out of the box” AI — it first must be trained in its specific environment to be effective.

Once AI has been trained on what is normal, it can also be used for purposes that extend beyond security. AI-enabled video can alert on anomalous weather — like snow or rain — to give decision-makers better situational awareness. It can also tell whether or not someone is wearing a hard hat or some other piece of mandated clothing to reduce exceptions and possible serious incidents. In short, it can issue notifications on anything it sees that is abnormal.

Most organizations, however, will take a security first approach to AI-enabled video. It has come a long way since the days of closed-circuit television and IP-based video, which were after-the-fact tools. AI makes video active, so crime can be deterred before it happens. And unlike the “pie in the sky” predictions about how AI will be used in the future, AI-enabled video for physical security is in use today and providing countless benefits — security and otherwise.

https://www.securitymagazine.com/articles/100758-ai-hits-prime-time-for-physical-security

A critical vulnerability in the PHP programming language can be trivially exploited to execute malicious code on Windows devices, security researchers warned as they urged those affected to take action before the weekend starts.

Within 24 hours of the vulnerability and accompanying patch being published, researchers from the nonprofit security organization Shadowserver reported Internet scans designed to identify servers that are susceptible to attacks. That—combined with (1) the ease of exploitation, (2) the availability of proof-of-concept attack code, (3) the severity of remotely executing code on vulnerable machines, and (4) the widely used XAMPP platform being vulnerable by default—has prompted security practitioners to urge admins check to see if their PHP servers are affected before starting the weekend.

When “Best Fit” isn’t

“A nasty bug with a very simple exploit—perfect for a Friday afternoon,” researchers with security firm WatchTowr wrote.

CVE-2024-4577, as the vulnerability is tracked, stems from errors in the way PHP converts unicode characters into ASCII. A feature built into Windows known as Best Fit allows attackers to use a technique known as argument injection to pass user-supplied input into commands executed by an application, in this case, PHP. Exploits allow attackers to bypass CVE-2012-1823, a critical code execution vulnerability patched in PHP in 2012.

“While implementing PHP, the team did not notice the Best-Fit feature of encoding conversion within the Windows operating system,” researchers with Devcore, the security firm that discovered CVE-2024-4577, wrote. “This oversight allows unauthenticated attackers to bypass the previous protection of CVE-2012-1823 by specific character sequences. Arbitrary code can be executed on remote PHP servers through the argument injection attack.”

CVE-2024-4577 affects PHP only when it runs in a mode known as CGI, in which a web server parses HTTP requests and passes them to a PHP script for processing. Even when PHP isn’t set to CGI mode, however, the vulnerability may still be exploitable when PHP executables such as php.exe and php-cgi.exe are in directories that are accessible by the web server. This configuration is set by default in XAMPP for Windows, making the platform vulnerable unless it has been modified.

One example, WatchTowr noted, occurs when queries are parsed and sent through a command line. The result: a harmless request such as http://host/cgi.php?foo=bar could be converted into php.exe cgi.php foo=bar, a command that would be executed by the main PHP engine.

No escape

Like many other languages, PHP converts certain types of user input to prevent it from being interpreted as a command for execution. This is a process known as escaping. For example, in HTML, the < and > characters are often escaped by converting them into their unicode hex value equivalents < and > to prevent them from being interpreted as HTML tags by a browser.

The WatchTowr researchers demonstrate how Best Fit fails to escape characters such as a soft hyphen (with unicode value 0xAD) and instead converts it to an unescaped regular hyphen (0x2D), a character that’s instrumental in many code syntaxes.

The researchers went on to explain:

It turns out that, as part of unicode processing, PHP will apply what’s known as a ‘best fit’ mapping, and helpfully assume that, when the user entered a soft hyphen, they actually intended to type a real hyphen, and interpret it as such. Herein lies our vulnerability—if we supply a CGI handler with a soft hyphen (0xAD), the CGI handler won’t feel the need to escape it, and will pass it to PHP. PHP, however, will interpret it as if it were a real hyphen, which allows an attacker to sneak extra command line arguments, which begin with hyphens, into the PHP process.

This is remarkably similar to an older PHP bug (when in CGI mode), CVE-2012-1823, and so we can borrow some exploitation techniques developed for this older bug and adapt them to work with our new bug. A helpful writeup advises that, to translate our injection into RCE, we should aim to inject the following arguments:

-d allow_url_include=1 -d auto_prepend_file=php://input

This will accept input from our HTTP request body, and process it using PHP. Straightforward enough – let’s try a version of this equipped with our 0xAD ‘soft hyphen’ instead of the usual hyphen. Maybe it’s enough to slip through the escaping?

POST /test.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
Host: {{host}}
User-Agent: curl/8.3.0
Accept: */*
Content-Length: 23
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive  

Oh joy—we’re rewarded with a phpinfo page, showing us we have indeed achieved RCE.

The vulnerability was discovered by Devcore researcher Orange Tsai, who said: “The bug is incredibly simple, but that’s also what makes it interesting.”

The Devcore writeup said that the researchers have confirmed that XAMPP is vulnerable when Windows is configured to use the locales for Traditional Chinese, Simplified Chinese, or Japanese. In Windows, a locale is a set of user preference information related to the user’s language, environment, and/or cultural conventions. The researchers haven’t tested other locales and have urged people using them to perform a comprehensive asset assessment to test their usage scenarios.

CVE-2024-4577 affects all versions of PHP running on a Windows device. That includes version branches 8.3 prior to 8.3.8, 8.2 prior to 8.2.20, and 8.1 prior to 8.1.29.

The 8.0, 7, and 5 version branches are also vulnerable, but since they’re no longer supported, admins will have to follow mitigation advice since patches aren’t available. One option is to apply what are known as rewrite rules such as:

RewriteEngine On
RewriteCond %{QUERY_STRING} ^%ad [NC]
RewriteRule .? - [F,L]

The researchers caution these rules have been tested only for the three locales they have confirmed as vulnerable.

XAMPP for Windows had yet to release a fix at the time this post went live. For admins without the need for PHP CGI, they can turn it off using the following Apache HTTP Server configuration:

C:/xampp/apache/conf/extra/httpd-xampp.conf

Locating the corresponding lines:

ScriptAlias /php-cgi/ "C:/xampp/php/"

And comment it out:

# ScriptAlias /php-cgi/ "C:/xampp/php/"

Additional analysis of the vulnerability is available here.

https://arstechnica.com/?p=2029943

A survey reveals that a majority of organizations plan to increase spending on physical security systems in 2025. The survey, conducted by The Harris Poll on behalf of Verkada, recorded the responses of 1,518 security professionals in the United States.

The results found that 7 in 10 security professionals anticipate that their organization will increase spending in 2025 for physical security systems. Additionally, more than 90% of security leaders believe that the future of physical security will involve cloud-based solutions, and 75% plan to transition to the cloud within the next 12 months. 

The survey also uncovered security leaders’ attitudes about cyber readiness and artificial intelligence (AI). It found that 9 in 10 security professionals think cloud security has improved in the last five years and is more effective at protecting against data leakage and unauthorized access. Furthermore, the survey discovered that more than 80% of security leaders believe AI-based video analytics will have a large influence on the future of proactive physical security solutions. 

https://www.securitymagazine.com/articles/100760-7-in-10-organizations-will-spend-more-on-physical-security-systems

There are two main objectives that organizations typically focus on while reducing cyber risk. First, reducing the frequency of cyber incidents materializing, which usually comprises traditional cybersecurity measures and risk mitigation activities. Second, reducing financial loss and other impacts to the organization when they occur, which is where cyber resilience comes in. In achieving both these objectives, cyber simulation exercises play a central role because people have a major role to play in preventing, detecting, responding and remediating cyber incidents.

In certain high-risk environments, organizations may find it impractical to solely prioritize prevention and detection. In such cases, it is beneficial to shift focus towards building resilience, including response, containment and recovery of incidents. Equipping all stakeholders in the organization to handle these challenging situations should be a priority, and allocating time efforts, and resources towards this strategy is advisable. Now, let’s delve into the key elements required to design simulation exercises aimed at enhancing cyber resilience.

1. Preparedness

The element of preparedness is similar to the French culinary concept of “mise en place,” which describes the notion of being well prepared in advance for a hostile and dynamic work environment: the setup, the ingredients, the tools needed for cooking. This can also apply to cyber exercises — understanding the organization’s systems, processes, security approaches, and vulnerabilities; designing realistic scenarios based on specific security concerns (i.e., ransomware, supply chain attacks, DDoS, advanced persistent threats) and measuring how various stakeholders respond and react to different situations.

2. Relevance

The scenarios and tests being conducted must be relevant and contextual for the audience that is participating and must be tailored to the organizational objectives. For example, while dealing with the security team, simulations should be more focused on individuals that are operating a SOC (security operations center) or security analysts responsible for managing endpoints and cloud environments. Ensure that the exercise aligns with the organization’s culture, technology, and security expectations. The exercise should be designed in a way that supports the organization’s technology and security strategies, ultimately meeting the desired objectives by the end of the exercise.

3. Immersion

Simulation exercises must be immersive enough so that participants believe they are dealing with a real-life incident. To create a scenario that’s more realistic, facilitators can seek participation from key internal and external stakeholders. Internal stakeholders are basically employees while external stakeholders can include customers, suppliers, business partners and insurers.  

4. Challengingness

“Challengingness” is meant to express the quality or degree of something that is challenging. Simulation exercises should be engaging, intellectually stimulating and competitive. One way to achieve this is by implementing the exercises as dynamic games using custom applications. External stakeholders, such as actors playing the roles of media or government representatives, can provide real-time feedback to participants. The idea is to challenge the audience, pushing them to test their quick-thinking, decision-making, communication, delegation, stakeholder management, incident coordination and other skills needed for an effective cyber response. 

5. Responsiveness

There’s a famous quote, “No battle plan ever survives first contact with the enemy.” It means that regardless of how much preparation is done, or how well documented a processes or the playbooks are, security leaders are never quite know for sure whether people will perform exactly how they’d expect them to, particularly when dealing with a lot of uncertainty. Security leaders need to test and test regularly; they need to test with various audiences and test how the audience responds even to the most unlikely or adverse cyber conditions. They also need to look at how the organization transitions from response to containment, all the way through recovery and resumption.

Cyber simulation isn’t just resilience, it’s also cyber assurance                 

It’s important to appreciate and understand that a cyber simulation exercise is just one of many assurance activities to perform within an organization to infer how ready an organization is for a major cyber incident. Just like conducting a security audit, a controls gap analysis, a business continuity test, pen testing, red team, blue team, purple team testing etc. a cyber simulation exercise is also complementary to other assurance activities. Again, the results of other assurance activities will influence and shape how these cyber simulation exercises should be designed and how they should be run for the respective audiences. When looking at the observations and findings from these exercises, it’s often very clear that there are several implications for organizations, both in their ability to respond to a major cyber incident as well as long term risk implications.

Instead of waiting for a crisis to strike and then scrambling or panicking, it is advisable that organizations adopt a process of preparation and improvement. Working with an outside partner that is independent of office dynamics and workplace politics may be the best option. Cyber simulation exercises are about future-proofing cyber resilience, serving as an assurance activity to assess an organization’s readiness for cyber incidents.                          

https://www.securitymagazine.com/articles/100762-5-key-elements-of-cyber-simulation-exercises-to-boost-cyber-resilience

It’s a dangerous world out there, and that is why more companies are investing in cybersecurity insurance to protect themselves against threats from data breaches, phishing attacks, identity theft, malware and ransomware. Cyber policies insure their holders against losses from direct data breaches and network attacks, or from liability due to attacks which compromise third-party data.

Cyber insurance serves as a valuable instrument to effectively transfer business risk – but only if policyholders can demonstrate effective security controls and IT resilience to support their claims when the time comes. Those who do not follow their policy terms of agreement for network safeguards may find their claims rejected – and they will have to shoulder the full cost of a breach or other cybersecurity incident. 

Coverage depends on meeting certain requirements set out in each policy, and failure to meet those specific requirements can lead to application denials, higher premiums, or even to costly claims denials. The insurer requirements address a range of concerns involving network security controls, vulnerability assessments, endpoint protection, patch management, and identity and access management. Other aspects of cyber insurance focus on disaster recovery and incident response plans for IT organizations, and security awareness training programs for employees. Such periodic trainings keep the workforce updated about the latest human threats from social engineering attacks, and how to defend themselves by recognizing suspicious messages. 

The rise of the hybrid workforce and mobile computing has only increased the threat level for IT and security teams, as network attack surfaces have continued to expand with the addition of each new online device and cloud application. As the rate of complexity accelerates, it becomes even more critical to read and follow the fine print in cyber insurance contracts.

Policyholders are responsible for accurately reflecting all the information about network devices and security protocols that are represented in their policies. If an organization has misrepresented what assets are managed on its network, or it cannot give a clear assessment of user authentication procedures, then certain claims are likely to be denied. 

Another main reason that cybersecurity claims are denied stems from a lack of necessary security controls, or misstating the level of security controls that are in place at the time of a breach. For instance, insurance claims may be denied in cases where the policy clearly states that multifactor authentication (MFA) is required to protect digital assets, yet no MFA systems can be verified. 

There are also “excluded events,” which involve the kinds of underlying situations that are – and are not – covered by cyber insurance policies. In some cases, losses will not be covered if they can be attributed to an act of war carried out by a nation-state, in which case any liability may attach to the U.S. national security apparatus, not the insurer.

Gaining IT visibility can reduce the threat of cyber exposure

If security leaders cannot identify harmful conditions related to security vulnerabilities on an IT network, there is no way to mitigate the problem. That is where network monitoring and management automation can provide needed visibility to certify defensible cyber insurance policy claims.

Over the past year, the process for organizations to obtain comprehensive cyber insurance coverage took longer and cost more as insurers sought to reduce their exposure to avoidable and uncontrollable circumstances, according to Delinea’s 2023 State of Cyber Insurance report. As a result, the report described a “cyber insurance gap” in which organizations did not pay adequate attention to the details of their cyber insurance policies. Many just wanted to obtain some proof of coverage, without closely reviewing how their policy terms had changed upon renewal. 

More than two-thirds of survey respondents (67%) reported that their insurance rates had increased by 50% to 100% upon policy application or renewal. Additionally, the report found that insurers were adding to their list of exclusions to make cyber insurance coverage void. Such exceptions included a lack of adequate security protocols (for 43% of respondents), human errors (38%), acts of war (33%), and not following proper compliance procedures (33%). 

On a positive note, more organizations reported investments in cybersecurity solutions to meet the growing requirements for cyber insurance. As a result, 81% of respondents received the budget needed for their cyber insurance policies, and more than two-thirds of respondents (36%) noted that their Boards of Directors and executive management teams were requiring cyber insurance protections. 

Again, it is a bedrock rule of security that no one cannot protect what they cannot see. A lack of visibility can result in catastrophic breaches that lead to huge financial losses and lasting harm to a brand reputation. Systematic network monitoring is a part of the solution, not only by identifying performance problems related to breaches and account takeovers, but also by storing useful data to meet cyber policy requirements for network management and security.

Cyber insurance requirements help to incentivize security best practices that organizations should be doing anyways. But when that unexpected time comes to utilize the financial safety net of a cyber insurance policy, it pays to have systems in place for effective network transparency to support and validate any claims for compensation.

https://www.securitymagazine.com/articles/100764-enhancing-cyber-insurance-value-with-network-visibility

Technology continues evolving and advancing at a rapid speed, ringing in unparalleled opportunities, but also creating new vulnerabilities. With this comes the demand for a workforce equipped with up-to-date skills to counter emerging threats. However, the pace of skill acquisition often lags the evolving threat landscape – opening organizations to increased risks. 

According to a Statista report looking at global talent shortages, 54% of organizations experienced a skills shortage in tech in 2023. Yet this skills gap does not have to be a death knell for an organization’s cybersecurity strategy. By upskilling their workforce, cultivating a culture of security, and exploring options for outsourcing technology, business leaders can implement viable solutions to ensure proper IT representation and secure systems despite the current skills gap. 

Upskilling the workforce and boosting employee retention

An organization’s current employees are one of their most powerful assets in mitigating the IT skills gap – and investing time and resources in those employees can make a world of difference. According to LinkedIn’s Workplace Learning Report 2024, 70% of employees say learning improves their sense of connection to their organization, and 80% say it adds a sense of purpose to their work. Fortunately, leaning into an employee’s desire to learn benefits the greater organization both in uncovering ways to help employees upskill and retaining talent long-term. Providing educational resources and regular training are two examples of effective ways to invest in current employees.  Employers should consider hosting quarterly workshops with an external IT expert and providing online courses in a variety of IT sectors to enhance employees’ skillsets. They should also encourage employees to participate in LinkedIn trainings by identifying the most relevant ones ahead of time and sharing information on them, as well as promoting (and covering the costs of) certification programs to help employees advance their career. 

Empowering employees to stay updated on the latest skills and trends in the IT industry is just as important as providing educational resources. Knowledge of the current landscape can help inform better decision making and sharing of ideas among employees. Because significant thought goes into educational resources and training, and determining the deployment of such resources may take some time, the most current trends and skills may not always be conveyed at the same pace as they are emerging. To encourage employees to remain up to speed, organizations should encourage employees to stay on top of business, cybersecurity, compliance, and IT news, or consider circulating a weekly newsletter or digest dedicated to the latest threats, trends, and news stories within the industry. 

A company’s culture and recognition from management is just as important to an employee’s satisfaction, retention, and work ethic as providing upskilling opportunities is. In fact, a study from Quantum Workplace showed that 69% of employees would increase their work effort if they were acknowledged more.  Creating a positive work environment, offering career growth opportunities, and acknowledging contributions through incentives and recognition can help boost both employee work effort and retention, therefore preventing a broadening of the skills gap.

Cultivating a culture of security 

Where IT departments may be overwhelmed with responsibilities and a lack of manpower, fostering cross-departmental collaboration to encourage a company-wide emphasis on security can have a large impact and alleviate some of this burden. Organizations should implement security education across several different business mediums, making it a constant reminder and educational concept across all departments. 

There are several opportunities where business leaders can cultivate this company-wide engagement around security best-practices, such as webinars and events, office hours, including security and IT best practices into corporate newsletters, regular phishing tests, and more. According to the IBM’s Cost of a Data Breach Report 2023, 16% of breaches started from phishing, and the average cost of data breaches with insider initial attacks cost $4.9M. With widespread knowledge of what phishing scams look like, businesses can mitigate risk and limit the potential for a breach before it inflicts monetary damage on the organization.

It’s also important to encourage security accountability throughout an organization. Business leaders should reward employees who demonstrate great security practices and provide additional guidance and training for those who don’t. For example, businesses could implement mandatory training for those who click on phishing scams sent out for training purposes. As an incentive for improving security posture and awareness, leaders could consider offering an entry into a prize pool for completing security training modules for a chance to win a universally valuable prize, such as a gift certificate. 

Explore external resources 

Utilizing external resources is another way for businesses to enhance their IT skillset and close the looming gap. Outsourcing technology and security provides a support system for the existing internal team and assures that all IT and security needs are taken care of.  Outsourcing also provides a potential for cost savings, rather than hiring several additional full-time employees, therefore providing the ability to focus more resources on core business activities. In recent years, several companies have started to outsource. In fact, a Radix report revealed that 66% of U.S. businesses outsource at least one department and more than 75% of executives said they would outsource IT services in 2024, specifically showing interest in IT infrastructure services, app and software development, and cybersecurity.

For some businesses, outsourcing a full IT team is not financially feasible. In this case, there is the opportunity to consider a vCISO, a security expert who utilizes years of industry experience to help organizations strengthen their security posture. This option allows for flexibility, with organizations able to tap the expertise and assistance of a security expert as needed without a full-time commitment. 

Despite the skills gap, businesses are obliged to continue IT and security best practices, or otherwise face dire consequences. Whether it be putting more investment into current employees, considering external options, or a combination of both, all organizations should work towards building strong technology support. The important next step is evaluating and finding the most viable solution to do so.

https://www.securitymagazine.com/articles/100763-overcoming-the-it-skills-gap-and-maintaining-a-secure-business

Although RansomHub is a relatively new Ransomware-as-a-Service (RaaS), it has quickly grown into one of the most prolific ransomware groups currently active. New research suggests that RansomHub may be a rebranded version of an older ransomware known as Knight. 

The research notes similarities between RansomHub and Knight. These similarities include: 

• Payloads are written in Go, and the ransom notes left are similar in verbatim.  
• Most variants are obfuscated with Gobfuscate. Furthermore, both operations deploy a unique obfuscation technique in which important strings are encoded with unique keys then decoded at runtime. 
• Code overlap is so great that it can be challenging to differentiate between them. 
• The help menus on the command line are almost identical, with the sole difference being RansomHub’s addition of a sleep command.

The research also noted a difference between RansomHub and Knight, which is the commands run through cmd.exe. Still, while the commands are different, the manner in which they are called is the same. 

Despite their similarities, the research suggests that it is unlikely that RansomHub is being run by Knight’s creators. Instead, the research believes that Knight’s source code was purchased and updated for use with RansomHub. 

https://www.securitymagazine.com/articles/100757-new-research-provides-insight-into-ransomhub

Alla Cyber Crime Conference 2024, Lucas Balaclav, Product Specialist di NinjaOne, ha descritto come è possibile ottimizzare la resilienza informatica attraverso l’automazione e la gestione unificata dell’IT, descrivendo l’importanza della resilienza informatica in risposta alle sfide che le aziende stanno affrontando.

Guarda il video completo dell’intervento:

Impatto degli Attacchi Cyber in Italia e Importanza della Resilienza Informatica

Lucas ha sottolineato il ruolo primario che la resilienza informatica gioca nel contesto della cyber security specialmente alla luce dei recenti dati che indicano l’Italia, per il terzo anno consecutivo, come il primo paese in Europa per numero di attacchi cyber e il quarto a livello mondiale, dopo Giappone, Stati Uniti e India. Ha rivelato che il 76% delle aziende ha subito almeno un’interruzione a causa di un attacco cyber, con un costo medio per attacco nel 2023 stimato in 3,5 milioni di euro, includendo perdite da fermo produttivo, spese per investigazioni e ripristini, costi legali, pagamenti di riscatti e danni reputazionali.

Cyber Resilienza: Business Continuity e Recupero Efficiente Post-Attacco

La presentazione ha approfondito il concetto di cyber resilienza, descritto come la capacità di un’azienda di prepararsi a un attacco cyber, continuare a operare normalmente in caso questo si verifichi, recuperare l’operatività normale e adattare i propri processi in seguito a un incidente informatico. Ha spiegato che la resilienza informatica non si limita solo all’adozione di strumenti e tecnologie, ma include anche un ampio spettro di processi e persone insieme all’importanza di investire in una cultura aziendale basata sulla consapevolezza e sulla sicurezza informatica.

L’Automazione come Pilastro della Resilienza Informatica

Uno dei pilastri della resilienza informatica che il relatore ha condiviso con il pubblico è l’automazione. Citando uno studio condotto in collaborazione con Omdia – una società di analisi e consulenza di mercato nel settore IT – che ha intervistato circa un miliardo di aziende chiedendo quali fossero le principali sfide tecnologiche che stavano affrontando, ha raccontato come le risposte si soffermassero sulla necessità di migliorare l’efficienza del personale IT attraverso l’automazione, sul bisogno di rafforzare la sicurezza dell’infrastruttura IT e massimizzare la produttività degli utenti finali.

Modello a Cinque Livelli per una Gestione Ottimale degli Endpoint

La centralizzazione della gestione degli endpoint è stata un altro tema chiave trattato da Lucas, che ha presentato un modello a cinque livelli per ottimizzare questa pratica:

• visibilità sugli endpoint;
• hardening dei dispositivi;
• gestione delle patch;
• sicurezza delle applicazioni;
• backup e piani di recupero.

Ha inoltre sottolineato l’importanza di una strategia olistica che includa non solo la prevenzione, ma anche soluzioni per il recupero dei dati e della normale operatività in tempi rapidi.

Soluzione Unificata di Gestione degli Endpoint di NinjaOne

Concludendo, il relatore ha evidenziato come NinjaOne offra una soluzione di gestione unificata degli endpoint che centralizza i flussi di lavoro e automatizza la gestione attraverso un’unica piattaforma. Questo aiuta i provider di servizi gestiti e i dipartimenti IT a migliorare l’efficienza e aumentare il livello di protezione, supportando la creazione di una cultura di prevenzione attraverso il monitoraggio proattivo.

In sintesi, la presentazione di Lucas alla 12a Cyber Crime Conference ha offerto una panoramica dettagliata su come le aziende possono affrontare le sfide della cybersecurity moderna attraverso l’automazione e la gestione unificata dell’IT, sottolineando l’importanza della resilienza informatica in un mondo sempre più connesso e digitale.

Il programma completo della Cyber Crime Conference 2024 è disponibile al seguente link: https://www.ictsecuritymagazine.com/eventi/cybercrimeconference2024#programma

Iscriviti alla nostra newsletter per rimanere aggiornate sulle nostre iniziative: https://www.ictsecuritymagazine.com/newsletter/

https://www.ictsecuritymagazine.com/cybersecurity-video/migliorare-la-resilienza-informatica-con-lautomazione-it-lucas-balaclav/

Durante la Cyber Crime Conference 2024, Roberto Vincenzo Veca, Head of Cyber Security presso Cyberoo, ha condiviso un’analisi dettagliata sugli attacchi cyber del 2023 e sulle risposte di difesa adottate. Iniziando il suo intervento intitolato “L’IMPREVEDIBILE CERTEZZA DELLE MINACCE INFORMATICHE: COME ESSERE UN PASSO AVANTI AL CYBERCRIME” con il riferimento al report del World Economic Forum, ha sottolineato come la “Cyber Insecurity” sia riconosciuta come uno dei principali rischi globali, posizionata addirittura prima del rischio di guerre.

Guarda il video completo dell’intervento:

Ruolo e Impatto di Cyberoo nel Panorama della Cybersecurity

Veca ha delineato l’attività di Cyberoo, evidenziando la sua posizione come primo vendor di Cyber Security quotato alla Borsa Italiana e il suo ruolo all’interno della rete CERT del Trusted Introducer. Ha poi presentato dati raccolti dall’Osservatorio Cyberoo nel 2023, basandosi su un campione di 725 clienti mid-size italiani per illustrare le minacce più significative e le tendenze emergenti.

Cyber Threat 2023: Dati e Analisi da Cyberoo

Nel 2023, Cyberoo ha gestito 8,5 triliardi di eventi di sicurezza, che hanno portato a 23.000 allarmi, 10.000 casi di correlazioni di allarmi e 4.000 casi rilevanti. Questa analisi ha permesso di identificare e rispondere a scenari di rischio critico, offrendo un’immagine chiara del panorama delle minacce.

Ransomware e BEC Fraud tra le Principali Cyber Minacce del 2023

Tra le principali minacce identificate, il Ransomware è emerso come il pericolo predominante, seguito da attacchi di tipo “BEC Fraud” e attacchi ai servizi, inclusi quelli al perimetro esterno e ai servizi Cloud. Gli attacchi di tipo Stealer, Malware finalizzati al furto di informazioni, sono stati anch’essi significativi, dimostrando la continua evoluzione e specializzazione dei cyber criminali.

Tesla, njRAT, Remcos: Panoramica dei Malware più Diffusi secondo l’Osservatorio di Cyberoo

Il relatore ha anche descritto specifici Malware identificati con maggiore frequenza dall’Osservatorio di Cyberoo: Tesla, njRAT, Remcos, Redline e RisePro. Questi malware, spesso dei RAT (Remote Access Trojans), hanno mostrato la capacità degli hacker di ottenere un controllo completo sui sistemi compromessi.

Vulnerabilità Software e Exploitation

La discussione ha anche toccato le vulnerabilità critiche nel software di grandi aziende come Fortinet, Citrix e Ivanti, sottolineando come queste siano state sfruttate dai cyber criminali per infiltrarsi nei sistemi aziendali. Ha raccontato come il ricorso al phishing, in particolare, ha mostrato un trend in crescita rispetto al 2022, con campagne di email fraudolente incentrate sulla fatturazione.

Managed Detection and Response: Integrazione di AI e Machine Learning nella Cybersecurity

Veca ha sottolineato l’importanza di un approccio olistico alla cyber security, facendo riferimento alla “Piramide del Dolore” per illustrare come le diverse strategie di difesa possano impattare gli attaccanti. Ha raccomandato un modello di Managed Detection and Response (MDR) che integri tecnologie di Machine Learning e Intelligenza Artificiale combinato con un monitoraggio h24 e un team dedicato alla remediation e alla gestione delle risposte agli incidenti.

Protezione delle Infrastrutture Critiche e delle Informazioni Aziendali: Strategie di Cybersecurity Avanzate e Proattive

In conclusione, la presentazione ha fornito una panoramica comprensiva su come affrontare le sfide della cybersecurity in un ambiente digitale in rapida evoluzione, mettendo in luce l’importanza di sistemi di risposta avanzati e proattivi per proteggere le infrastrutture critiche e le informazioni aziendali.

Il programma completo della Cyber Crime Conference 2024 è disponibile al seguente link: https://www.ictsecuritymagazine.com/eventi/cybercrimeconference2024#programmazione

Iscriviti alla nostra newsletter per rimanere aggiornate sulle nostre iniziative: https://www.ictsecuritymagazine.com/newsletter/

https://www.ictsecuritymagazine.com/cybersecurity-video/limprevedibile-certezza-delle-minacce-informatiche-come-essere-un-passo-avanti-al-cybercrime-roberto-vincenzo-veca/