Article | April 22, 2020
According to a Gartner study in 2018, the global Cybersecurity market is estimated to be as big as US$170.4 billion by 2022. The rapid growth in cybersecurity market is boosted by new technological initiatives like cloud-based applications and workloads that require security beyond the traditional data centres, the internet of things devices, and data protection mandates like EU’s GDPR.
Cybersecurity, at its core, is protecting information and systems from cyberthreats that come in many forms like ransomware, malware, phishing attacks and exploit kits. Technological advancements have unfortunately opened as many opportunities to cybercriminals as it has for the authorities. These negative elements are now capable of launching sophisticated cyberattacks at a reduced cost. Therefore, it becomes imperative for organizations across all industries to incorporate latest technologies to stay ahead of the cybercriminals.
Table of Contents:
- What is the cybersecurity scenario around the world?
- Driving Management Awareness towards Cybersecurity
- Preparing Cybersecurity Workforce
- Cybersecurity Awareness for Other Employees
What is the cybersecurity scenario around the world?
Even as there has been a steady increase in cyberattacks, according to the 2018 Global State of Information Security Survey from PwC: 44% companies across the world do not have an overall information security strategy, 48% executives said they do not have an employee security awareness training program, and 54% said they do not have an incident response process.
So, where does the problem lie?
Many boards still see it as an IT problem.
Matt Olsen, Co-Founder and President of Business Development and Strategy, IronNet Cybersecurity.
The greater responsibility of building a resilient cybersecurity of an organization lies with its leaders. There is a need to eliminate the stigma of ‘risk of doing business lies solely with the technology leaders of an organization. Oversight and proactive risk management must come under CEO focus. According to the National Association of Corporate Directors' 2016-2017 surveys of public and private company directors, very few leaders felt confident about their security against cyberattacks, perhaps due to their lack of involvement into the subject.
Driving Management Awareness towards Cybersecurity
• Gain buy-in by mapping security initiatives back to business objectives and explaining security in ways that speak to the business
• Update management about your current activities pertaining to the security initiatives taken, recent news about breaches and resolve any doubts.
• Illustrate the security maturity of your organization by using audit findings along with industry benchmarks such as BSIMM to show management how your organization fares and how you plan to improve, given their support.
• Running awareness program for your management regarding spear-phishing, ransomware and other hacking campaigns that aim for executives and teach how to avoid them.
The bottom line is that leaders can seize the opportunity now to take meaningful actions designed to bolster the resilience of their organizations, withstand disruptive cyber threats and build a secure digital society.
The bottom line is that leaders can seize the opportunity now to take meaningful actions designed to bolster the resilience of their organizations, withstand disruptive cyber threats and build a secure digital society..
READ MORE: WEBROOT: WIDESPREAD LACK OF CYBERSECURITY BEST PRACTICES
Preparing Cybersecurity Workforce
Hackers are able to find 75% of the vulnerabilities within the application layer. Thus, developers have an important role to play in the cybersecurity of an organization and are responsible for the security of their systems. Training insecure codingis the best way to raise their cybersecurity awareness levels.
Raising Cybersecurity Awareness in Developers:
• Training developers to code from the attackers’ point of view, using specific snippets from your own apps.
• Explain in-depth about vulnerabilities found by calling remedial sessions.
• Find ways to make secure coding easier on developers, like integrating security testing and resources into their workflow and early in the SDLC/
• Seek feedback from developers on how your security policies fit into their workflow and find ways to improve.
Cybersecurity Awareness for Other Employees
According to the Online Trust Alliance’s2016 Data Protection and Breach Readiness Guide, employees cause about 30% of data breaches. Employees are the weakest link in the cybersecurity chain. But that can be changed by creating awareness and educating them on the risks surrounding equipment, passwords, social media, the latest social engineering ploys, and communications and collaboration tools.Make standard security tasks part of their everyday routine, including updating antivirus software and privacy settings, and taking steps as simple as covering cameras when they end a video conference call.
The technological advancements are moving faster than anF-16, so the measure are by no means exhaustive. The important thing is to keep pace with numerous cybersecurity measures to not fall prey to a cyberattack. Every organizational level plays an important role in achieving a matured security infrastructure, thus making awareness and participation mandatory.
Organizations should consider a natively integrated, automated security platform specifically designed to provide consistent, prevention-based protection for endpoints, data centers, networks, public and private clouds, and software-as-a-service environments
READ MORE: A 4 STEP GUIDE TO STRONGER OT CYBERSECURITY
Article | August 30, 2021
Global leaders want to carve out specific areas of critical infrastructure to be protected under international agreements from cyber-attacks. But where does that leave others?
There are ‘four or five steps you could take that could significantly mitigate this risk,’ Falk said. These are patching, multifactor authentication and all the stuff in the Australian Signals Directorate's Essential Eight baseline mitigation strategies. …”
Back in April of this year, a BBC News headline read, "The ransomware surge ruining lives."
And that was before the cyber-attacks on critical infrastructure sectors like Colonial Pipeline, meat-processing giant JBS, the Irish Health Service and so many others.
And when President Biden met with Russian President Putin last month in Geneva, he declared that certain critical infrastructure should be “off-limits” to cyber-attacks.
“We agreed to task experts in both our countries to work on specific understandings about what is off-limits,” Biden said. “We’ll find out whether we have a cybersecurity arrangement that begins to bring some order.”
As an initial positive step forward, this cyber defense policy makes sense. In fact, most global experts applaud these moves and efforts to better protect and clarify international crimes in cyberspace.
Previous administrations going back to George W. Bush have taken aggressive steps to ensure critical infrastructure is protected in the U.S. and around the world through actions involving people, process and technology, both offline and online. The 16 critical infrastructure sectors identified by DHS/CISA can be found here.
Still, many questions remain regarding this new policy: Will all global governments actually agree on the wording? More importantly, even if they do agree, how will the agreements be enforced? Also, what happens if some countries continue to allow criminals to attack these critical infrastructure sectors from their soil?
And my main question goes further: Even if all of these agreements and actions are 100 percent agreed upon and enforced, which most people don’t believe will happen, does this imply that every organization not covered under these 16 critical infrastructure sectors can be openly attacked without a response? Is this giving into cyber criminals for everyone else?
For example, would K-12 schools or small businesses be “fair game” and not off limits? Could this actually increase attacks for any organization not considered on the CISA list?
No doubt, some will say that schools are a part of government, and yet there are private schools. In addition, if we do cover all others somehow, perhaps as a supplier of these 16 sectors, doesn’t that make the “off-limits” list essentially meaningless?
Essentially, where is the line? Who is included, and what happens when some nation or criminal group crosses the line?
These questions became more than an intellectual thought exercise recently when the Kaseya ransomware attack impacted more than 1,500 businesses, without, in their words, impacting critical infrastructure.
CBS News reports, “Still, Kaseya says the cyber-attack it experienced over the July 4th weekend was never a threat and had no impact on critical infrastructure. The Russian-linked gang behind the ransomware had demanded $70 million to end the attack, but CNBC reported that the hackers reduced their demands to $50 million in private conversations.
"The Miami-based company said Tuesday that it was alerted on July 2 to a potential attack by internal and external sources. It immediately shut down access to the software in question. The incident impacted about 50 Kaseya customers.”
OTHER RECENT RANSOMWARE NEWS
Meanwhile, in a bit of a surprise, ransomware group REvil disappeared from the Internet this past week, when its website became inaccessible.
As Engadget reported, “According to CNBC, Reuters and The Washington Post, the websites operated by the group REvil went down in the early hours of Tuesday. Dmitri Alperovitch, former chief technology officer of the cyber firm CrowdStrike, told The Post that the group's blog in the dark web is still reachable. However, its critical sites victims use to negotiate with the group and to receive decryption tools if they pay up are no longer available. Visitors to those websites now see a message that says ‘A server with the specified host name could not be found.’"
CNBC reported: “There are 3 main possibilities for the criminal gang’s disappearance — each of which carries good and bad news for U.S. efforts to combat the ransomware scourge emanating from Russia.
The Kremlin bent under U.S. pressure and forced REvil to close up shop.
U.S. officials tired of waiting for Kremlin cooperation and launched a cyber operation that took REvil offline.
REvil’s operators were feeling the heat and decided to lay low for a while.
"This situation may send a message to some of the players that they need to find a less-aggressive business model, which could mean avoiding critical infrastructure, or it could mean avoiding U.S. targets.”
Also, the Biden administration announced several other measures to combat ransomware: “The Biden administration will offer rewards up to $10 million for information leading to the identification of foreign state-sanctioned malicious cyber activity against critical U.S. infrastructure — including ransomware attacks — and the White House has launched a task force to coordinate efforts to stem the ransomware scourge.
"It is also launching the website stopransomware.gov to offer the public resources for countering the threat and building more resilience into networks, a senior administration official told reporters.”
And yet, many experts are still predicting that ransomware will continue to grow in the near future. For example, TechHQ wrote that “identifying the culprits often isn't as big an obstacle as apprehending them.”
To show recent growth of ransomware attacks, Fox Business offered details on a Check Point report this past week that “ransomware attacks surge, growing 93 percent each week.”
Also: “'The ransomware business is booming. We’re seeing global surges in ransomware across every major geography, especially in the last two months,' said Lotem Finkelstein, head of threat intelligence at Check Point Software. 'We believe the trend is driven by scores of new entrants into the ransomware business.'"
For more background on this hot topic, a few weeks back I appeared on MiTech News to discuss the ransomware crisis.
I’d like to close with this article which offers a slightly different perspective on ransomware from ZDNet Australia:
“The threat of ransomware dominates the cyber news right now, and rightly so. But this week Rachael Falk, chief executive officer of Australia's Cyber Security Cooperative Research Centre, made a very good point.
Ransomware is ‘Totally foreseeable and preventable because it's a known problem," Falk told a panel discussion at the Australian Strategy Policy Institute (ASPI) on Tuesday.
‘"It's known that ransomware is out there. And it's known that, invariably, the cyber criminals get into organisations through stealing credentials that they get on the dark web [or a user] clicking on a link and a vulnerability," she said.
‘We're not talking about some sort of nation-state really funky sort of zero day that's happening. This is going on the world over, so it's entirely foreseeable.’"
Article Orginal Source:
Article | November 25, 2020
I would like to share my experience with you and talk about viruses created for Mac devices and how to deal with them. You may say that there are no Mac viruses as Apple does not allow it. However, I may say that there are plenty of nasty malware types like adware that open new tabs in your browser, redirect you to irrelevant pages and show numerous popups.
Yes, these are not real viruses. Adware like Search Marquis cannot clone itself and infect other connected devices. It cannot encrypt your files or cause any other harm. Its activity is related only to web redirects and excessive advertising. At the same time, who knows which rogue websites adware may land you on next time. It may happen that you end up on a phishing website where cyber crooks harvest personal information that leads to identity theft.
I strongly recommend removing all adware that penetrated your device. But there is a problem here. If you want to get rid of Mac adware, you cannot quickly find a solution. If you go to google and search there how to get rid of Mac malware, you will see that all top results offer you to buy and install some shady software. In reality, these Mac antiviruses do nothing, as we know that the Apple ecosystem does not allow apps to access other apps' data. No antivirus can really scan and check your files.
How to remove Mac malware
If your system is infected with adware and you do not know how to get rid of it, you may try to call Apple and ask what to do. You can find their phone number here: support.apple.com/en-gb/HT201232#us-ca.
Another option is to try your luck on Apple communities. Thousands of tech enthusiasts help uses with their problems there. Here is a sample thread: discussions.apple.com/thread/8226644.
There are other options too. Apple operating systems are not very difficult to use, and any person can remove adware manually by going through step-by-step guides posted on numerous malware removal websites. Here is a guide by BitAdvisors.com on how to remove Search Marquis malware.
Most rogue software works by exploiting bugs and vulnerabilities in your computer's operating system. And macOS has its own bugs too. To fix these vulnerabilities, Apple periodically releases operating system updates. To date, macOS has not proved attractive enough for cybercriminals and evil developers to flood it with malware.
To stays away from any surprises, it is recommended to update your OS as well as all apps installed regularly.
You should never install apps from unofficial app stores not controlled by Apple.
One of the ways for adware to penetrate your Mac computer is through bundled installs. You download and install a very useful app that is often free, but in reality, you get several apps. People never read user agreements written in small print. There it can be noted that you agree to install additional tools and provide some rights to them. Whenever you install something, be careful and read user agreements, and do not miss additional unnecessary software.
Do not install any software without urgent necessity. Any additional software widens the attack surface.
To be able to do bad things, current Mac malware requires users to perform some actions – grant rights. So, be careful with allowing any app to access your data, change settings, etc.
One more wise move is to make backups. iCloud or ordinary flash drives will help you not lose your data in case of a system glitch or malware attack.
Final advice - do use VPNs. Your connection will be encrypted, and attackers will not be able to find where you are actually located or what data your traffic consists of.
Article | February 20, 2020
Technology is reshaping society – artificial intelligence (AI) is enabling us to increase crop yields, protect endangered animals and improve access to healthcare. Technology is also transforming criminal enterprises, which are developing increasingly targeted attacks against a growing range of devices and services. Using the cloud to harness the largest and most diverse set of signals – with the right mix of AI and human defenders – we can turn the tide in cybersecurity. Microsoft is announcing new capabilities in AI and automation available today to accelerate that change. Cybersecurity always comes down to people – good and bad. Our optimism is grounded in our belief in the potential for good people and technology to work in harmony to accomplish amazing things. After years of investment and engineering work, the data now shows that Microsoft is delivering on the potential of AI to enable defenders to protect data and manage risk across the full breadth of their digital estates.