UK businesses face a huge hidden cyber risk that’s driving security practitioners mad: employees keeping quiet about cyber attacks.

More than one-third of office workers (39%) said they wouldn’t tell their cybersecurity team if they thought they had been the victim of a cyber attack – and it's not for a lack of security awareness.

A survey of 4,500 workers across EMEA by data security and management firm Cohesity found that British employees are more aware of cyber threats, such as ransomware, than their counterparts in France and Germany.

Almost half (43%) of UK employees know exactly what ransomware is, compared with just 28% of workers in France and 30% in Germany. Four-in-five (79%) said they were confident that they could identify a malicious cyber attack.

“Staying silent if they suspect a malicious cyber attack is quite possibly the worst thing an employee could do, particularly when they claim to know the dangers,” said Olivier Savornin GVP Europe at Cohesity.

"This reluctance to speak up leaves organizations in the dark and vulnerable to serious damage to the business."

So why are employees keeping quiet? According to the survey, 17% wouldn’t want people to think it was their fault, with the same number worried they'd get into trouble. One-in-eight said they were afraid of causing an unnecessary fuss.

This desire to hush things up is so serious that 11% said they would even try to fix the problem themselves, rather than seek official help from the company experts.

Drop the blame game, improve culture

Savornin noted that the research shows a big cultural change is needed to support workers and ultimately improve broader transparency in business.

“We need to create a workplace culture where people feel comfortable raising the alarm and are properly trained on how to recognize a cyber threat and the correct action to take - no matter how small the issue might seem," said Savornin.

Earlier this year, a survey from managed services company IT.ie found that 43% of office workers believed that they were at risk of causing a cybersecurity incident in the next 12 months.

Six-in-ten of these people blamed incomplete or non-existent cybersecurity training, with 31% blaming poor communication from management regarding cyber risks.

This isn't the first time that a reluctance to report incidents has been reported. In October last year, for example, Arctic Wolf's 2024 Human Risk Behavior Snapshot report found that a quarter of workers were too scared to report security problems.

They may have good reason for this fear, however, with a report from security firm Egress last year finding that just over half of employees caught out by phishing attacks were disciplined as a result.

Notably, four-in-ten were fired following an incident, and this only exacerbates long-term issues with reporting.

In some cases, staff have even been told not to disclose a breach. A 2023 survey from Bitdefender showed a cover-up culture had emerged at many enterprises.

The poll of 400 IT and security professionals found that nearly half of cybersecurity practitioners were told to keep data breaches under wraps by senior management figures.

Meanwhile, three-in-ten said they actively avoided disclosing a breach themselves despite specific processes being in place.

MORE FROM ITPRO

• Almost a third of workers are covertly using AI at work
• Employee phishing training is working – but don’t get complacent
• Remote work is still causing security headaches for CISOs

Nearly half of enterprises are trying to "shift left" in a bid to shore up software security, but developers are reporting significant issues with the strategy.

False positives, the faster pace of development thanks to AI, and challenges integrating tools are hampering progress.

That's according to research by AI security firm Pynt that focused on the adoption of shift left practices — referring to a strategy of spotting flaws and security issues earlier in the software development cycle when they're easier to fix.

The survey of 250 security professionals found 47% of organizations had implemented a shift left approach to software development, with a further 27% working to do so.

But a quarter of developers felt overwhelmed by the volume of vulnerabilities, and more than a third saw false positives as the main challenge to implementing a successful shift-left strategy, followed by integration issues and vulnerability overload.

The study raises serious questions over whether this approach to software development is actually reducing overall risks, or merely increasing complexity, according to Pynt chief executive Tzvika Shneider.

"Everyone talks about shifting left, but few are seeing the security gains they expected," said Shneider. "Most organizations have tools in place, but they still struggle with noise, process friction, and developer resistance."

"AI accelerates how software is developed and shipped, forcing security to keep pace, Shneider added.

The research also found that the vast majority of companies that had shifted left had turned to software tools to help the process, but 31% said that integrating those tools within development workflows continued to be a major barrier.

The most popular tools are Static Application Security Testing (SAST), Software Composition Analysis (SCA) and Dynamic Application Security Testing (DAST), with each used by about a third of respondents.

Software security priorities are causing friction

Two-thirds of respondents said they prefer to fix bugs in app code rather than with rules in post-production, highlighting friction between developers and security teams. The former prioritize feature development and see security as a burden, while the latter wants to see flaws fixed rapidly.

"Shift right is easier since it doesn’t require extensive coordination between multiple teams, whereas Shift Left demands a collaborative effort across development, security, and testing teams,” the report noted.

"Shift Left was meant to improve security, but many organizations are finding that execution challenges are holding them back," added Shneider. "Security leaders must rethink their approach to reduce friction between security and development teams while maintaining effective risk management."

Pynt said that automation in security testing could help, and called for improved collaboration between security and development teams, including integrating security into testing phases.

Europeans are ahead adopting shift left practices, the survey found, with Germany and the UK both at 52%. Developer teams in the US, however, aren't quite up to scratch in this regard, researchers found, with just 42% of enterprises having adopted the approach.

The report follows earlier research that suggests enterprise security teams are struggling to keep up with the adoption of AI tools. Similar research found showing the rise in AI coding tools may actually be slowing down development thanks to the security headaches it causes.

MORE FROM ITPRO

• Anthropic’s new AI model could be a game changer for developers
• 30% of Microsoft's code is now AI-generated, and that's bad news for devs
• Java might’ve just turned 30, but it’s still going strong and here to stay

The UK government plans to spend £1.9 million on cyber resilience projects across the country, the Department for Science, Innovation and Technology (DSIT) has revealed.

With planned investment in more than 30 projects, the money will help improve the UK’s cyber resilience for both businesses and consumers, and boost national cyber skills.

Some projects set to receive funding include ‘CyberSecurityAId: Empowering Small Businesses with Cyber Security Skills,’ ‘Cybersecurity Angel Investor Network,’ and ‘First Steps to a Cyber Security Career - North West.’

The funding boost comes amid growing concerns over cybersecurity skills shortages across the country. Almost half of UK firms report a deficit in this regard, according to the DSIT, and these projects will help fill current gaps and meet growing demand.

Under the scheme, people across the country will be able to pursue new, high-level career opportunities as a result, DSIT added.

“By upskilling small businesses and individuals, investing in workforce development, and encouraging neurodiverse talent, government and industry partners are fostering robust and diverse cyber communities for the future,” said Jonathan Ellison, director for national resilience and future technology at the National Cyber Security Centre (NCSC).

“This is vital for protecting our digital economy, creating new opportunities for secure innovation, and helping make the UK the safest place to live and work online,” Ellison added.

The UK’s minister for cybersecurity, Feryal Clark, also commented, saying strong defenses are needed for the country’s growing digital economy, which is worth billions of pounds.

“Attempts to disrupt the technologies and services we rely on daily continue to grow, so we’re leaving no stone un-turned to make sure our communities have the skills to rise to the challenge,” Feryal said.

Cyber investment is a good start, but does it go far enough?

While the move has been welcomed by industry stakeholders, some experts have questioned the scope of the initiative.

Socura CEO Andy Kays said a key concern is the “size of investment relative to the scale of its ambition”, suggesting that the volume of projects set to be awarded funding could dilute the overall investment.

“30 new projects slated for 2025 and beyond across multiple regions means that this money will be thinly spread across the UK,” Kays said.

“The concern is that this money won’t go far enough to have the level of impact needed. It is, however, a good start,” he added.

Kays said it was “only right” that the UK invest more money to develop its regional cyber skills in places like Wales, the North East of England, and Northern Ireland.

Jake Moore, global cybersecurity advisor at ESET, welcomed the investment scheme, adding that the initiative will help strengthen the country’s overall cyber resilience and futureproof communities.

“Upskilling workforces is crucial for safeguarding our digital economy, unlocking opportunities to secure innovation, and ensuring the UK remains protected from constant attacks,” Moore said.

“However, this isn’t the first time we have seen a shake-up in the UK’s skills shortage so it is vital that the initiative will continue to be funded and pushed to the next level where more roles are filled,” he added.

Acronis' Cyber Protect Cloud (CPC) amalgamates cybersecurity, data backup, and disaster recovery into one easily managed product. Available from a choice of Acronis MSPs, it delivers a raft of protection measures, and the entire suite requires only a single host agent installed on each endpoint.

On the security side, you get advanced malware protection using Acronis' AI-based behavioral detection engine, web content filtering, patch management, vulnerability assessments, and device controls. We've reviewed the Cyber Protect cloud backup service previously and have been impressed with its excellent data protection and recovery tools.

Acronis offers a range of optional packs for CPC so you can keep costs under control by adding only those you need. The advanced security pack with endpoint detection and remediation (EDR) provides event correlation, threat containment, incident investigation, kill chain analysis, and endpoint rollback recovery.

Pricing is based on workloads or the amount of cloud storage required, with the latter offering the best value. Protection for one workstation with 100GB of cloud backup storage, patch management, and the EDR pack included costs £16 per month.

Acronis Cyber Protect Cloud review: Deployment

CPC offers an extensive range of agent deployment options, and you can do it yourself or let your MSP do it for you. Platform support includes Windows, macOS, and Linux systems, while the backup component also looks after iOS and Android mobiles, the most popular business apps including MS365 and Google Workspace, and all the main virtualization hosts. 

Not only does CPC use a single client agent, but all security and backup settings can be managed within the same protection profile. These are assigned to agent groups and include all backup requirements, enabling EDR, real-time malware scanning and agent self-protection, scheduling vulnerability assessments and patch management tasks, applying web filtering using up to 44 URL categories, and enforcing removable device controls.

Monitoring plans are a new feature and let you keep a close eye on key endpoint hardware metrics including CPU and memory usage, CPU/GPU temperatures, network activity, disk space and transfer rates, and warnings if the client's anti-malware services are disabled. Remote support services can be controlled with management plans that enable NEAR and RDP technician connections to selected client groups, allow file transfer, and use H.264 hardware encoding.

There's a lot going on inside CPC and the web portal dashboard presents a clear overview of your security posture and protection status. It uses a multitude of table, graph, and chart widgets that can be personalized by deleting some, adding others, and dragging them around the console.

Incoming alerts are viewed from the portal's monitoring page or the Protection section, which provides more detail with lists of all incidents filtered by severity and mitigation status. Selecting an incident takes you to an investigation page, which provides a kill chain diagram, details of how the attack developed, and what processes it interacted with.

For unmitigated incidents, you can open an investigation, apply response actions such as adding a malicious URL to a block list, and provide notes on support activities. Entire incidents comprising multiple threats can be remediated by CPC using quarantine actions and rollback of Registry and file changes using the client's local agent cache or backup image.

Businesses concerned about the cost and complexity of separate cybersecurity and data backup solutions will love Acronis Cyber Protect Cloud. It's only available from MSPs, but deployment is simple, everything is accessible from one cloud portal and the EDR pack provides slick automated threat remediation and recovery services.

This content originally appeared on ITPro's sibling magazine PC Pro. For more information and to subscribe, please visit PC Pro's subscription site. 

Over a third (37%) of breaches were caused by human error, and 40% of breaches took more than 72 hours to report, research has found.

An analysis of nearly 100,000 data breaches (99,460) reported to the UK Information Commissioner’s Office (ICO) from April 2019 to December 2022 has found a lengthy gap between the breach and the report, despite the ICO taking a more robust line.

The length of the gap demonstrates the challenges faced in identifying a threat. For 18% of breaches, more than a week passed until the ICO was notified. 

The costs of breaches can be high, dwarfing fines, with research finding the 33 most notable breaches cost organizations more than £13.5 billion, of which only 6% were made up by global regulatory fines.

In this instance, ‘notable’ refers to actual data breaches rather than organizations maliciously abusing data themselves or were reported by white-hat hackers with no damage occurring.

The most common causes of the breaches in the research weren’t cyber attacks. Only a third (33%) of breaches reported were due to malware or phishing, with all breaches caused by threats from outside an organization accounting for 35% of reports. Insider threats, however, came to 40%. 

Human error accounted for more – 23% were caused by data being shared with the wrong person, while 11% was due to lost or stolen data. This includes, for example, stolen devices or paperwork being left in an unsecured location.

Terry Ray, SVP, data security GTM and field CTO of Imperva, noted the ICO’s tougher stance but worries organizations are prioritizing measures that demonstrated compliance on paper, over genuine data security. 

“In many cases, initiatives that meet the letter of compliance will not in fact prevent organizations from suffering the financial impact of a data breach, such as from customer churn and reputational damage, which can dwarf any potential fines,” he said.

Data breaches are rising by more than a third (34%) annually, according to Ray, and he expressed concern that – due to a lack of clear metrics – businesses were unsure their data security investments are paying off.

The ICO has averaged £14.7 million per year in fines issued since it began issuing fines under GDPR rules, compared to £1.5 million levied in the 12 months before GDPR rules came into effect. This increase doesn’t compare favorably with the average cost of the 33 most notable breaches, which was approximately £410 million. “At present,” said Ray, “it would take the ICO 28 years to fine organizations the equivalent of just one of the ‘most notable’ data breaches.”

Software development has been transformed since the introduction of the Biden administration’s executive order (EO) to improve cyber security across the US.

The EO was designed to bolster defenses against cyber attacks and was primarily focused on federal agencies and contractors. However, research has shown that it has impacted organizations in both the US and UK.

A key tenet of the order was a requirement for companies to implement a software bill of materials (SBOM) to ensure robust cyber security hygiene.

More than three-quarters (76%) of enterprises surveyed in the UK and US have since adopted an SBOM, and 16% plan to in the future, Sonatype revealed in its latest research. 

Only 4% reported that an SBOM had been adopted more than three years ago, indicating how rapidly things have changed.

SBOMs are also becoming an essential procurement requirement, underlined by 60% of respondents reporting that they were required to complete business deals. Just over a third (37%) said they plan to add the requirement in the future.

The survey results, from 217 cyber security directors in companies with revenues of more than £50 million or $50 million in the UK and the US respectively, showed that proper security hygiene is increasingly tied to commercial opportunities as well as government work.

However, the figures also indicated nearly a quarter of respondents are yet to adopt SBOMs.

The reasons for this were varied; almost half said they needed to gain a better understanding of how to implement them or their benefits, while others noted concerns around cost, and nearly a third (32%) reported that they simply needed more staff.

Brian Fox, CTO and co-founder at Sonatype, described SBOMs as just the first step to cyber resilience and noted that more work would be needed, including investment in software composition analysis tools. 

What is a software bill of materials?

An SBOM lists everything that goes into a particular application. As well as the components themselves, it also includes information such as the license version and type, such as open-source or commercial, for example.

Spreadsheets and manual files have also been used but are prone to human error and are unsuitable for larger projects that would benefit more greatly from an automated approach - potentially as part of the CI/CD pipeline.

While SBOMs are not a new concept, the high-profile vulnerability in the popular Java logger Log4j highlighted the importance of knowing what is in one’s software supply chain and being prepared to deal with or mitigate the potential impact of breaches.

Despite the signing of the executive order and the implementation of SBOMs by some enterprises, the Log4j vulnerability demonstrated that there remains work to do in order to ensure software supply chain security. 

The US has continued to work to bolster security and published the National Cybersecurity Strategy in March 2023. The EU proposed its own Cyber Resilience Act in 2022, highlighting the importance placed on security in both regions.

The Canonical Kernel Team is abandoning its update cadence in favor of a four-week cycle, and will add an additional update every two weeks for the most urgent fixes.

A move to a four-week cycle with a midpoint update will result in regular upstream stable updates, including security patches, bug fixes, and feature requests coming every four weeks. Critical fixes that can’t wait will arrive on a two-week cadence.

In the past, the Canonical team worked to a three-week kernel update cycle. This, according to Kleber Souza, Linux kernel engineering manager at Canonical, made for reasonable responsiveness but was “prone to interruptions from urgent CVEs, urgent customer requests and regressions found in -updates or during testing.”

The result was that the cycle tended to be extended, and delivering CVE fixes promptly was challenging.

Souza noted that OEM kernels would follow a more flexible schedule in terms of their deadlines for the acceptance of new patches.

Ubuntu is one of the most popular Linux distributions, and the changes will interest engineers charged with maintaining fleets of hardware running the operating system - on-premises or in the cloud - in light of the pace of vulnerability discovery and patching.

The move was described by one user on the company’s forums as “ambitious” and comes in the wake of a relatively easy-to-exploit privilege escalation vulnerability disclosed recently.

The vulnerability in the OverlayFS module used in Ubuntu was documented in CVE-2023-2640 and CVE-2023-32629 and was exclusive to the operating system following changes made by the Canonical team in 2018.

CVE-2023-2640 permits an unprivileged user to set privileged extended attributes on mounted files. CVE-2023-32629 is a local privilege escalation vulnerability where permission checks are skipped.

Those changes only became an issue in 2020 when a security vulnerability patched in the Linux kernel did not make it into Ubuntu due to the earlier changes.

One report stated that the vulnerability could affect 40% of Ubuntu cloud workloads. Ubuntu fixed the vulnerabilities on 24 July 2023, and users were instructed to update their kernels.

With the revised cycle schedule, Souza said: “The Canonical Kernel Team is expecting to deliver more predictable updates with quicker turnaround for time-sensitive fixes”.

New research into cyber attacks in the cloud has shown that on average it takes less than ten minutes to launch an attack after first discovering credentials.

The finding concerned targeted attacks, where cyber criminals chose their targets for a specific reason, such as having a misconfiguration in their cloud environment that could be exploited.

Of the ten minutes it took from finding a working credential to launching the attack, five of them were dwell time.

When cyber criminals can enter a cloud environment and launch an attack at such pace, it becomes extremely difficult for defenders to detect the intrusion and prevent the attack from taking place.

During opportunistic attacks - those without a specific target - it took cyber criminals on average less than two minutes to find a publicly exposed credential after scanning for a vulnerability, like a misconfiguration. It then took an average of 21 minutes for them to initiate an attack.

Researchers at Sysdig attributed the speed of attacks to the weaponization of automation, warning that attackers are focusing on identity and access management (IAM) with evolving techniques for credential access, privilege escalation, and lateral movement.

While the time from credential discovery to starting an attack was measured in minutes, the team noted that attackers could need hours to identify a suitable target - depending on motive and visibility.

Getting hold of a secret was highly dependent on the storage location. For example, with AWS S3 buckets, an attacker might have to spend several days searching for a specific public name.

The increasing emphasis on ‘everything as code’ in the cloud environment has contributed to the difficulties defenders face. The report noted: “A syntax error while writing code for appropriate access and privileges could be the only thing standing between you and front‑page news”.

Serverless function code and infrastructure-as-code (IaC) software such as CloudFormation and Terraform were said to be of particular interest to attackers since the files can contain credentials or secrets but might be overlooked by security scans.

What is in your supply chain?

Researchers also considered the state of containers. The nature of the technology - essentially a package to deliver an application with everything required built-in - can make them an ideal delivery mechanism for malicious code. 

After analyzing 13,000 Docker hub images, researchers found 819 were malicious. However, 10% of those were undetectable, thanks to advanced techniques to hide malicious code. Only at runtime could the threat be detected.

Performing a static scan of the contents of a container will only go so far and is not enough to assure safety.

Researchers cited an example of a threat actor that created 11 accounts, all hosting 30 of the same container images. The image itself looked benign but launched a disguised cryptominer when it was run.

A runtime threat detection tool is therefore required, as well as static image analysis and vulnerability scanning. 

What are the targets and what are the goals?

Nearly two-thirds (65%) of cloud attacks target the telecommunications and finance sectors specifically. 

The researchers didn’t comment on why these sectors were targeted so often, but they are among the most valuable in the world, both holding highly sensitive information.

For the telecommunication sector, as well as harvesting personal information, data collected can potentially be used for SIM swapping - effectively taking over a victim’s mobile device and permitting authentication through two-factor authentication (2FA) into other important accounts. 

After the telecommunications and finance sectors, healthcare and defense trailed at 5% and 1%, respectively. The finding surprised researchers, considering the type of data that could be stolen.

Other goals include resource hijacking, where an attacker will seek to quickly monetize an asset by spinning up cryptomining instances and leveraging existing instances to launch new attacks.

Mitigation and trends

Defending against and mitigating attacks requires a multi-pronged approach, researchers said. 

For example, vendors such as AWS will scan GitHub for any AWS credentials and attach a quarantine policy to limit potential damage. According to the report, GitHub is also examing commits for several secret formats and can reject them automatically.

However, it is essential to recognize the determination of a user to bypass protections put in for their safety.

As the cloud continues to move toward everything-as-code and container technologies, complexity will continue to increase, and attackers will take advantage of any mistakes made. 

The report cited the rapid development of new cloud services giving new opportunities to attackers despite continual improvements in security by vendors. Although attack timelines are unlikely to reduce from the pace observed, the attacks themselves will continue to evolve with automation becoming more prevalent.

Research has shown that controls within Google Cloud Platform (GCP) are the most commonly misconfigured of the big three cloud service provider (CSP) environments, making them more vulnerable to cyber attackers.

Researchers at Qualys looked at cloud misconfiguration issues and found GCP leading the way with an average failure rate of 60% when run against the Center for Internet Security’s (CIS) benchmarks. Azure was close behind, with an average failure rate of 57%, and AWS stood at 34%.

GCP services of particular concern, according to the CIS benchmarks, were BigQuery, DataProc, and Logging.

The CIS Benchmarks comprise more than 100 secure configuration guidelines for more than 25 product families. The intent is to provide recommendations for hardening technology against cyber attacks.

While the platforms themselves are not inherently insecure, the figures highlight the issue of misconfiguration, which amplifies the risk of breaches and unauthorized access. 

Misconfigurations can be caused by anything from a simple lack of expertise and human error to rapid deployment, where security considerations drop down the list of priorities compared to a business need.

Encryption, identity management, and external-facing assets were noted as some of the most impactful misconfigurations that are commonly made, potentially leading to exploits and cyber attack.

Encryption is hugely important for protecting an organization’s data. However, despite most Cloud Service Providers (CSP) making its implementation as simple as selecting a configuration option, the report found that it was not universally deployed.

Nearly all (99%) of the Azure disks scanned lacked encryption or a customer managed key (CMK). On GCP, researchers found 97.5% of virtual machine disks for critical VMs lacked encryption using customer-supplied encryption keys (CSEKs).

As with encryption, identity and access management (IAM) was poorly implemented by customers of all three CSPs. 

Among the most significant IAM misconfigurations were console passwords not having multi-factor authentication (MFA) enabled. Nearly half (44%) of IAM cases on AWS had the industry-standard security control deployed.

Additionally, scans for Enabling Authentication and configuring Client Certificates within Azure App Service failed 97% of the time.

Finally, external-facing assets can present attackers with multiple opportunities. The report noted that 31% of S3 buckets are publicly accessible, exposing them to an array of possible vulnerabilities.

The report noted: “A common misconfiguration by users of all major cloud providers is inadvertently leaving data publicly accessible”. Doing so can impact the effectiveness of other cloud services. Public S3 buckets, for example, can hold more than just sensitive data; access keys, credentials, or backup files can also be found in them, meaning the potential compromise of other services, such as EC2 instances.

“The convenience of - say, working on cloud assets from anywhere without having to use a VPN - suddenly transforms into a potential breach just waiting to happen.”

Log4Shell lingers

The report noted the risk of weaponized vulnerabilities, particularly the ongoing danger of Log4Shell.

Log4Shell was first detected in December 2021 and exploits functionality in Log4j, an open-source logging framework used in many Java applications, to execute arbitrary code.

Despite being a well-known vulnerability, figures have shown that the Log4j flaw is proving difficult to mitigate. In this instance, the challenge is partly due to the scale and complexity of cloud environments. Many make extensive use of open-source software, such as Log4j, and are publicly exposed.

The Qualys team noted that it had detected 1 million Log4Shell vulnerabilities. Only 30% had been successfully fixed, leaving 70% unpatched. The average remediation time stood at 136 days, which researchers attributed to the complexity involved.

Lambda: another exploitation threat

While the CIS hardening benchmark lacks controls specifically for AWS Lambda, researchers found issues when looking at permissions provided to Lambda functions. 

In terms of hardening, some checks on Lambda functions - including for monitoring and execution limits - recorded a more than 90% fail rate. Others, such as a check that Lambda environment variables at rest were encrypted with CMK, had a fail rate of 58%. 

A failure around the hardening stance has the potential to give access to attackers.

Lambda has been specifically targeted by the Denonia malware strain, a crypto-miner that will burn through expensive compute cycles once it has achieved a foothold. Since Lambda - and other serverless technologies - are relatively new, security measures have tended to be overlooked.

Thales has reached an agreement with software investment firm Thoma Bravo to acquire application security provider Imperva for $3.6 billion.

One of the largest software investors in the world, Thoma Bravo bought Imperva for $2.1 billion in 2019, saying at the time its aim was to build a “market-leading data and application security company”. Imperva’s sale to Thales marks an addition of $1.5 billion in value to Imperva in the last four years. 

With more than $127 billion in assets under management, Thoma Bravo invests in growth-oriented, innovative companies in the software and technology sectors. 

Over the last couple of years, the company has been on an acquisition spree, snapping up a host of businesses – including Coupa Software, UserTesting, ForgeRock, SailPoint, Ping Identity, and more. Imperva is one of just a small number of businesses to be sold by Thoma Bravo in the past three years.

Seth Boro, managing partner at Thoma Bravo, said Imperva differentiated itself under its ownership through “accelerated growth and innovation” and its “unique approach” to end-to-end application and data security.

“During this time, the company successfully executed three acquisitions which strengthened its product offerings and capabilities to better protect clients’ critical data and applications,” he said.

Thales’ plans for Imperva

Upon completion of its acquisition, Thales said Imperva will enable growth in data security, as well as its entry into the application security market. 

The firm expects Imperva’s integration to add around $500 million of revenue, as well as “significantly expand” its data and application security offering. Overall, Thales said its cyber security business will generate more than €2.4 billion ($2.65 billion) in revenue.

“The acquisition of Imperva marks a major milestone in Thales’ cyber security strategy,” said Patrice Caine, chairman and CEO at Thales. “With this acquisition, we are seizing a unique opportunity to accelerate our cyber security capabilities and are taking an important step towards our ambition to build a world-class global cyber security integrated player, providing a comprehensive portfolio of products and services.”

The freshly combined operations of the two businesses will create a cyber security portfolio structured around three areas: identity, data security, and application security. 

Thales said increased capabilities are expected in the fields of protecting data at rest and data in use, while the pair’s “strong complementarity and cultural fit” is expected to yield “significant commercial opportunities”. 

Imperva will sit within the global security products section of Thales’ offering, which focuses on the CipherTrust Data Security Platform, the SafeNet Trusted Access Identity & Access Management as a service solution, as well as the broader cloud protection & licensing offerings.

“Imperva and Thales share the same vision and the same DNA,” Caine added. “We look forward to welcoming Imperva to Thales to further enhance our cyber security solutions, and help customers address their most important digital security challenges.”

Thales has placed a significant focus on cyber security in recent times. Last month, the company announced an agreement to acquire Tesserent in a move designed to bolster its cyber security services family of products and services, as well as extend its presence in Australia and New Zealand.

From January 2024, Thales said it plans to regroup all its civil cyber activities within its digital identity and security (DIS) segment to strengthen its position as a provider of civil cyber security products.

Following the acquisitions of Imperva and Tesserent, Thales added that global cyber security products and services will represent 44% of its DIS segment sales in 2024 –a 60% increase. 

What is Imperva?

Headquartered in San Mateo, California, Imperva’s aim is to protect critical applications, APIs, and data at scale, with an approach that combines edge, application security, and data security. 

The company has a global footprint in the Americas, Asia Pacific, as well as EMEA, and monitors threats across 180 countries.

Imperva’s portfolio includes its web application firewall (WAF), as well as its Data Security platform that helps to enhance the visibility of a company’s data to prevent breaches and avoid compliance issues. 

The platform provides data discovery and classification, data security governance, data access monitoring, AI-powered risk analysis, intrusion detection, and more.

Security experts have issued a warning over a significant increase in cryptojacking attacks as threat actors seek to ‘diversify’ their tactics. 

The volume of cryptojacking attacks surged by 788% in Europe during the first half of the year, with attacks in North America also rising by 345%. 

Globally, the volume of cryptojacking attacks has increased by around 399%, according to research from SonicWall. 

This increase marks the highest year-on-year record for global cryptojacking attacks, the firm said, and highlights a shift away from traditional ransomware attacks in favor of “stealthier means of malicious activities”. 

“Cyber criminals are diversifying and expanding their skill sets to attack critical infrastructure, making the threat landscape even more complex and forcing organizations to reconsider their security needs,” the company said in a statement. 

This rise comes amid a decline in global ransomware attempts, which have dropped by 41% since the beginning of the year. However, the research indicated an upward trend in other attack methods, such as IoT malware (+37%) and encrypted threats (+22%).

Bobby Cornwell,  vice president of product security at SonicWall, said the evolving tactics witnessed in recent months show a desire among threat actors to harness techniques that are low-cost, but often deliver high returns. 

“SonicWall intelligence suggests that bad actors are pivoting to lower-cost, less risky attack methods with potentially high returns, like cryptojacking,” he said. 

“It also explains the reason we’re seeing higher levels of cyber crime in regions like Latin America and Asia. Hackers search for the weakest points of entry, with the lightest possible repercussions, limiting their risk and maximizing their potential profits.”

High-priority targets

Globally, SonicWall found that ransomware attacks on a host of industries saw a decline during the first half of the year, reflecting a broader dip in ransomware activity. 

However, popular target sectors such as healthcare, government, and education all faced an increase in cryptojacking attacks. 

Cryptojacking attempts against educational institutions surged by 320% while government-related attacks also increased by 89%. 

“The seemingly endless digital assault on enterprises, governments, and global citizens is intensifying, and the threat landscape continues to expand,” said SonicWall president and CEO Bob VanKirk. 

“Threat actors are relentless, and our data indicates they are more opportunistic than ever, targeting schools, state and local governments, and retail organizations at unprecedented rates.

What is cryptojacking?

Cryptojacking is a type of attack that harnesses a victim’s desktop or laptop device to mine cryptocurrency. 

This form of attack has grown in popularity among threat actors alongside the rise of cryptocurrencies in recent years, and is typically initiated when a victim unwittingly installs malware on their device. 

Phishing attacks are frequently leveraged to initiate this type of attack, prompting users to click on a malicious link in email correspondence, or even on a webpage. 

Victims of cryptojacking often might not be aware they’ve even fallen prey to cyber criminals, enabling the attacker to fly under the radar and mine cryptocurrency for extended periods. 

There are telltale signs, however. One of the main signs of cryptojacking is decreased device performance due to the increased use of processing power. 

Similarly, for laptop devices, a rapidly decreasing battery capacity can also be a telltale sign that a user has been compromised and their device is being used to mine currencies. 

IT services provider NTT Data has announced the launch of its new managed detection and response (MDR) service for security management.

The offering will be rolled out in Japan this month, while a broader global release is expected before the end of March 2024, the company said.

With the new service, advanced security engineers will provide support to clients that either don’t have the in-house talent to manage a security function or simply find it easier or more cost-efficient to pay for a managed service.

NTT Data said these engineers will act on behalf of clients by executing a “comprehensive set of measures” to identify the cause of an incident, implement emergency response measures, maximize recovery efforts, and work to prevent a recurrence.

“To support client companies that find it difficult to manage security on their own, NTT DATA will start providing MDR services utilizing the design, construction, and operational know-how cultivated through its Global Zero Trust Security Service, along with the experience for more than 20 years and expertise of NTTDATA-CERT, its advanced security specialist organization,” the company said in an announcement.

The service will provide businesses with fully integrated, cross-sectional, and multilingual support. It will start with the introduction of an incident response framework, through to detection, response, and recovery in an incident – as well as continual elevation and improvement of the introduced framework, the firm said.

To help develop talent that can drive its MDR services, NTT Data will also launch a new talent development program for advanced security engineers. 

The firm said it aims to expand the structure from the current level of 100 engineers to 500 globally by the end of March 2026.

The program is based on the expertise of NTT Data’s incident response organization and has been built to incorporate knowledge from NTT locations around the world, while its curriculum has been developed in collaboration with NTT Data Intellilink Corporation. Upon completion of the online program, engineers will be certified as MDR Services Specialists.

MDR market

MDR services provide customers with modern security operations center (SOC) functionality to help detect and disrupt security threats. The security as a service model allows organizations to outsource their security operations to overcome hurdles such as staff shortages and skills gaps.

According to a recent report from market data provider ReportLinker, the global MDR market is currently valued at approximately $3.3 billion in 2023 – and is projected to grow to around $9.5 billion by 2028, at a compound annual growth rate of 23.3%.

Factors helping to drive the market’s expansion are said to include an uptick in business email compromise, ransomware, as well as cryptojacking threats. Adoption of MDR services has also been fueled by the industry’s cyber security skills gap.

With the positive forecast for the market over the coming years, NTT said it’s aiming to take its annual global sales from security management to over 200 billion Japanese Yen (approximately USD 1.4 billion) by March 2026, mainly in zero trust services.

Victims of ransomware that did not involve law enforcement paid an average of $470,000 more in breach costs in 2023 than those that did, according to a new report released by IBM.

Conducted in partnership with Ponemon Institute, the firm’s annual Cost of a Data Breach Report analyzed data breaches experienced by 553 organizations around the world between March 2022 and March 2023.

The study found that participating organizations that did not involve law enforcement experienced breach life cycles that were 33 days longer on average than those that did reach out – at an average cost of $470,000.

Despite ongoing efforts by law enforcement to collaborate with ransomware victims, 37% of surveyed organizations still chose not to engage them, while 47% reportedly paid the ransom.

For those that did, the total time to identify and contain a ransomware breach stood at 273 days, compared with 306 days for those who didn’t – an 11.4% reduction. 

The mean time to contain a breach was 63 days - 23.8% shorter with law enforcement involvement compared to 80 days without.

Overall, the global average cost of a data breach saw a 15% increase over the last three years, rising to $4.45 million in 2023 – an all-time high for the report, which has been conducted annually for the previous 18 years.

Detection and escalation costs also jumped 42% over the same period, representing the highest portion of breach costs, which IBM says signifies a shift towards more complex breach investigations.

IBM Cost of Data Breach Report: Paying the ransom

Organizations that decided to pay the ransom during an attack were found to achieve just a 2.2% difference in total cost, coming in at $5.06 million compared to the $5.17 million total for those that did not. 

However, IBM said that calculation does not take into consideration the ransom fee itself and, due to their hefty totals, those that did pay were likely to have spent more overall. 

Additionally, the data revealed that paying a ransom has also become less beneficial, with an 82.5% decline in savings since last year’s report.

IBM Cost of Data Breach Report: Detection and escalation

Overall costs have risen and so too have the costs associated with detection and escalation. 

IBM said these costs include activities that enable an organization to “reasonably detect a breach” and can include forensic and investigative activities, assessment and audit services, crisis management, as well as communications to executives and boards.

In 2022, the category became the costliest of the data breach expenses, suggesting that investigations had become more complex and time-consuming. This year, it remained on top of the pile, rising 9.7% from $1.44 million to $1.58 million.

IBM Cost of Data Breach Report: Data breach lifecycle

As for the data breach lifecycle, the report found that the time taken to identify and contain a data breach “held steady” at 277 days – or approximately nine months – in 2023. 

That’s consistent with the average over the last seven years of reported data, which ranges from a low of 257 days in 2017 to a high of 287 in 2021.

Shorter data breach lifecycles also continue to be linked to lower data breach costs, with lifecycles under a 200-day threshold clocking an average cost of $3.93 million. By comparison, longer lifecycles of more than 200 days cost an average of $4.95 million – a 23% difference.

IBM Cost of Data Breach Report: Cost mitigation

From a pool of 27 key cost factors, the adoption of a DevSecOps approach was the most effective at mitigating overall costs. According to the data, breaches at organizations that had implemented a DevSecOps approach had an average cost that was $249,278 less than the average of $4.45 million.

Employee training and incident response planning and testing rounded out the top three, with average cost reductions of $232,867 and $232,008 respectively.

As for cost amplifiers, the top three culprits were found to be security system complexity (+$240,889), security skills shortage (+$238,637), and noncompliance with regulators (+$218,915). The average cost of a breach for organizations with high levels of security skills shortage was $5.36 million.

Commenting on the findings, Chris McCurdy, general manager at Worldwide IBM Security Services, said that time is the “new currency” in cyber security for both defenders and attackers.

“As the report shows, early detection and fast response can significantly reduce the impact of a breach,” he said. “Security teams must focus on where adversaries are the most successful and concentrate their efforts on stopping them before they achieve their goals. 

“Investments in threat detection and response approaches that accelerate defenders speed and efficiency – such as AI and automation – are crucial to shifting this balance.”

Security researchers have uncovered a vulnerability, tracked as CVE-2023-38408, in the secure networking suite OpenSSH which would allow hackers to remotely execute code using simple commands.

Exploitation of the vulnerability makes use of a commonly-used helper program in OpenSSH called ssh-agent, which holds a user’s private keys for use in frequent, often automated, SSH public key authentication.

Administrators managing remote servers often enable ‘ssh-agent forwarding’, which enables the ssh-agent to be accessed from a chosen server so that local SSH keys to be used without storing keys on the server itself.

Qualys researchers discovered that when a forwarded agent is set up using default settings, with PKCS11 enabled, it’s possible for a threat actor with a connection to the same remote server to load and unload shared libraries on a victim’s machine with malicious side effects.

Security researchers used this technique to achieve one-shot, remote code execution (RCE) by combining just four side effects of loading and unloading common shared libraries.

Once an attacker has achieved RCE, a host of malicious actions can be undertaken including the installation of malware, carrying out a data breach, or total system takeover.

“This newly uncovered ssh-agent vulnerability underlines the continuous need for rigorous security measures and immediate response,” wrote Saeed Abbasi, manager, Vulnerability Signatures at Qualys.

“Even robust systems can harbor hidden vulnerabilities, as demonstrated by the shortcomings of the ssh-agent. Proactively rectifying such vulnerabilities through actions such as implementing patches is critical to maintaining the integrity of digital assets.”

OpenSSH is a widely-used solution for encrypted data transfer and remote logins, particularly by administrators seeking to easily manage SSH keys. It is used worldwide for secure connections.

Researchers found the default installations of Ubuntu Desktop 22.04 and 21.10 to be vulnerable and warned that other Linux distributions or operating systems could also be exploited if left unpatched.

Vulnerable OpenSSH releases include:

• 1:7.9p1-10+deb10u2
• 1:7.9p1-10+deb10u1
• 1:8.4p1-5+deb11u1
• 1:9.2p1-2
• 1:9.3p1-1

The issue has been fixed as of version 1:9.3p2-1.

OpenSSH noted that the flaw can only be exploited if specific libraries are present in the victim’s system, and that if agents are not forwarded to a hacker-compromised network, attacks cannot be achieved remotely.

Zero trust data security specialist Rubrik has announced the appointment of former Zscaler channel director Sean Sullivan as its new director of alliances for EMEA. 

The specially created role will see the seasoned channel veteran take charge of developing Rubrik’s partnership capabilities, with a focus on supporting major telecoms and internet service providers with the necessary security services.

Sullivan joins the business having accumulated more than 25 years’ experience within technology and cyber security sales, including senior positions at Microsoft, Netscape, Dell EMC, and BlackBerry-owned Good Technology. 

In his most recent role at Zscaler, he led the development of the firm’s relationships with telecom clients.

Commenting on his appointment, Sullivan said that he has witnessed the service provider industry transform over his career.

“Most businesses have changed their solutions approach: They now look for one provider to deliver internet connectivity, storage, and security, rather than pick and mix different solutions from different vendors,” he said. 

“For Rubrik, this presents a real opportunity to offer service providers new and better services that will attract more customers. 

“Whether it’s reselling Rubrik licenses as optional extras or including Rubrik security as a managed service to customers, I’m excited to see how we can support our customers and partners more than ever.”

With 72% of organizations paying out when confronted by ransomware, according to the latest data from Rubrik Zero Labs, Rubrik said Sullivan’s appointment as EMEA alliances chief will help service providers find new ways of defending themselves against increasingly sophisticated cyber threats.

“Security is a constantly evolving industry, which is why it’s so important to have a depth of knowledge, talent, and experience within a business,” said Ghazal Asif, vice president of global partners and alliances at Rubrik. “That’s why I’m very happy to welcome Sean to our team. 

“His background working with some of the tech world’s major players, coupled with his attitude and approach makes him an ideal person to lead our efforts with service providers.”

The move is the latest in a string of leadership hires for Rubrik and the second in as many months that have arrived from Zscaler, following the appointment of Tony Keech as vice president of its UK&I business.

Rubrik has also recently announced Richard Cassidy as its new field CISO for EMEA, as well as Andres Botero as chief marketing officer. 

Telefónica and F5 have expanded their partnership to launch a new SaaS-based service designed to improve the security and speed of app deployment in multi-cloud environments. 

Deployed on F5’s Distributed Cloud platform, the new Web Application Defense (WAD) managed service enables Telefónica Tech’s enterprise customers to detect threats and vulnerabilities in real time by combining telemetry collection with programmable rules, advanced AI, and machine learning.

Managed from a single dashboard, the offering has been designed to protect enterprise applications whether they are deployed on-premises, across multiple clouds, or at the edge.

Juan Campillo, Telefónica Tech’s director of cyber security product marketing, said the company’s partnership with F5 enables the company to launch a “state-of-the-art managed services solution” that can detect and block the attempted exploitation of application vulnerabilities.

“In particular, the deployment of WAD on F5's Distributed Cloud Platform will add speed to a critical security layer, while providing flexibility for our enterprise customers to deploy, secure and operate applications in a multi-cloud environment wherever needed: In the data center, across hybrid deployments, or across multiple clouds,” he said.

“In addition, the managed services approach is a significant boost for organizations that lack the resources and expertise to address today's cyber security challenges."

Specializing in digital transformation, Telefónica Tech provides a host of services and integrated solutions across cyber security, cloud, IoT, big data, and blockchain. 

The company claims it has the capacity to reach 5.5 million customers across 175 countries through its presence in Spain, the UK, northern Europe, USA, Brazil, Peru, Colombia, Chile, and Mexico.

The firm’s new WAD managed service is supported by its security operations center (SOC) team, which will provide round-the-clock support and cloud environment monitoring for enterprise customers.

Available for organizations in Spain for a monthly fee, the offering currently includes F5’s Web Application Firewall (WAF), bot defense, API security, and distributed denial of service (DDoS) mitigation capabilities.

“We are delighted to announce the launch of the WAD managed service with Telefónica Tech,” commented Mariana Agache, VP for SP Managed Services at F5. “Our partnership goes far beyond just providing a technology platform, and we will continue to support Telefónica with enablement and go-to-market efforts both in EMEA and beyond. 

“As ever, our mutual goal is to ensure continual innovation and safe, world-class services for customers.”  

The UK’s National Cyber Security Centre (NCSC) announced today that the total number of cyber crime takedowns has fallen for the first time in six years.

According to its annual Active Cyber Defence (ACD) report, it shut down 1.8 million malicious campaigns and 2.4 million malicious URLs throughout 2022, representing a 33% and 22.5% fall on 2021’s figures respectively.

The NCSC started publishing its ACD reports in 2017 and until 2023, every year had led to an increasing number of takedowns.

Much of the reduction came from a drop in takedowns of extortion mail servers. Its figures for 2022 stood at 528,000, down from 2021’s 1,867,439,  and cryptocurrency investment scams which dropped to 459,278 from 610,621 the previous year.

The cyber security arm of GCHQ didn’t offer a concrete explanation regarding why the number of takedowns had fallen, and the campaign-by-campaign breakdown of the takedown data showed mixed conclusions. 

Some attacks dropped in frequency, like extortion mail servers, but others soared, like the takedowns of malware-associated URLs.

Both malware infrastructure URLs and web-inject malware URLs were in the top ten list of  campaign types that were taken down this year.

The former rose to 18,337 takedowns in 2022, up from 5,270 in 2021, and the latter rose to 6,287 from 1,466 the previous year.

One of the possible explanations for the drop in takedowns could be due to apparent low uptimes of the campaigns.

Mail servers have a median availability of 25.5 hours, according to the report, and cryptocurrency investment scams stand at one hour. In comparison, the next top five attack types have a combined median of 56.29 hours. 

The figures suggest that the longer an attack is available, the more time there is for a takedown to occur.

The report also noted a drop in attacks hosted from the UK to the tune of 25%.

While phishing attacks remained at the top of the list, the number of attacks fell markedly, from 113,457 in 2021 to 77,471 in 2022 and a reduction from ten to seven hours of median availability.

Brute force attacks also formed part of the report and, despite the ACD only starting the use of honeypots in August 2022, 40,890 takedowns were recorded. 

SSH was the protocol that led to most takedowns - more than 32,000 were reported from August 2022 to December 2022 - followed by RDP, WordPress, and Exchange some way behind.

Other services covered in the NCSC report include the suspicious email reporting service, which permits members of the public to report suspicious emails and web sites. According to the report, malicious URLs were removed from the internet in an average of six hours. 

What is the NCSC’s Takedown service?

The ACD’s Takedown service finds malicious sites and removes them before significant harm can be done. 

It is focussed on what it deems would cause the most harm to UK interests and also targets all malicious activity hosted in the UK.

It was initially developed with just UK government organizations in mind, but has broadened to cover a wider range of users over the years.

In 2020 it commenced takedowns against cryptocurrency investment scams, takedowns of which peaked in January 2021 before following a consistent downward trend into December 2022.

Platform engineering has become somewhat of an industry buzzword in recent years as organizations look to rapidly accelerate the delivery of applications and unlock greater business value at scale. 

This emerging discipline, as Gartner describes it, helps markedly improve developer experience and productivity by “providing self-service capabilities with automated infrastructure operations”. 

Simply put, platform engineering centers around enabling developer teams to focus on building and fine tuning products while rapidly accelerating product teams’ delivery pipeline. 

Similarly, it helps solve the age-old issue of fostering closer cooperation between software developers and operators. 

By 2026, 80% of software engineering organizations will will establish platform teams, according to Gartner research. This prompts some to question whether platform engineering will render DevOps or DevSecOps obsolete. 

Does platform engineering spell the end of DevOps?

This was a question posed to a trio of participants during a roundtable discussion at KubeCon 2023 in April. 

The panel, which included GitLab CPO David DeSanto, Sarah Polan, Field CTO EMEA at HashiCorp, and Stu Miniman, director of market insights at Red Hat, explored at length the rise of platform engineering and whether it spells the end of DevOps as we know it.

While all three agreed this emerging trend has gathered, and continues to gather, pace in recent years, it’s more complex than simply heralding a new era in product engineering and development. It’s dependent wholly on the individual needs of the business, and their ability to navigate change. 

Platform engineering isn’t for everyone, but it could unlock significant improvements to productivity and application delivery if done currently, according to Stu Miniman. 

“When we talk to our developer communities, some of the biggest problems we hear is that there’s cognitive overload and dealing with context switching,” he said. 

“It’s a challenge that all of us have, but especially with developers. Platforms are not new, but platform engineering is a thing that’s been growing for about three years now.”

Miniman noted that, fundamentally, platform engineering is about enabling developers to focus on their primary role and delegate certain aspects of platform management and governance to teams specifically catered around that task. 

In doing this, platform engineering makes things “a little bit simpler” for developers and removes – to an extent – the cognitive overload that many experience when building and managing platforms. 

What problem does platform engineering solve?

For many years, businesses globally have focused significant resources in bringing together the developer, operator, and cyber security elements that all play a key role in delivering software applications rapidly to keep pace with insatiable customer demand.

But asking developers to build then subsequently maintain platforms has placed significant strain on teams, Polan noted. This strain has reared its ugly head frequently, especially with regard to security and risk management. 

“The past couple of years, the previous trend was very much DevOps. So we wanted to encourage developers and engineers to build and run their own infrastructure and then we quickly became cognizant, both from a business standpoint but also the technical and developer standpoint, that the developers didn’t actually want to own and run their own infrastructure because there’s a lot that goes into that,” she said. 

“Whether it’s risk based, velocity based, or not being able to focus on the business problem.”

Miniman echoed Polan’s comments, noting that this increased strain has frequently been referenced as one of the key hindrances to developer teams in addition to the increased security considerations required when developing at pace. 

“DevSecOps is great, but we know one of the impediments to rolling things out faster often are security issues that you need to worry about or getting everyone involved,” he said. 

“You’re talking about golden paths and about giving people the guardrails, governance, and control. In certain pieces, we want to take that off the plates of the developers so they can focus on writing code, modernizing things and taking advantage of technologies. 

“So, if we can make things a little bit simpler and allow developers to focus on their primary role and the stuff they want to be doing, that makes things easier.”

Platform engineering in an era of heightened risk

Surging security threats in recent years have, in part, led to the growing popularity of platform engineering as a discipline, Polan insisted. By charging responsibility of governance, control, and risk management to developer teams, this can lead to overload and causes vital issues to be missed or overlooked. 

Platform engineering helps mitigate this problem by delegating an aspect of this responsibility. 

“I think that it [platform engineering] is becoming increasingly important, especially as we start looking toward the Internet of Things (IoT) starting to explode and edge computing, and having to have this modularity but also looking from the security and risk standpoint,” she said. “We need to be able to follow these different patterns.”

Polan cited the SolarWinds and Log4j incidents as a prime example of this lack of clarity about platform risks and transparency of oversight for individual platforms within an organization’s estate. 

“I think if we look at SolarWinds, for example, not being able to follow exactly where all of this infrastructure and deployments went affected where the potential threat breach was after the initial supply chain attack. 

“So just making sure that we as organizations are in control, but also garnering business value from this by setting guardrails in place and say ‘we want you to be able to do what you want, follow industry standards, use open source’, but also make sure we have adequate control over these things.”

Why DevSecOps is here to stay

All three roundtable participants agreed that platform engineering doesn’t necessarily spell the end for DevSecOps as a discipline. Instead, this forms another part of how organizations build, modernize and manage their platform environments. 

Miniman suggested that platform engineering represents an “outgrowth” of DevSecOps, adding that it’s “an extension of what we’re doing - it’s evolutionary, not necessarily revolutionary.”

DeSanto echoed his thoughts, noting that there is room for beneficial coexistence that will ultimately deliver benefits for developer teams and the broader organization. 

“I sometimes struggle with why something has to die for something else to exist,” he said. “And so, I don’t know what nerd references are right for the audiences, but maybe it’s the Jedi versus the Sith? That’s what it feels like to me.

“I think there’s a lot more overlap and value to that. In essence, platform engineering is making sure your DevOps or DevSecOps teams are more effective - and they’re more effective because they’re working with the platform team and vice versa. 

“One of the things I’ve seen is that the more you go toward infrastructure as code, that could be in the DevOps system, but it’s for the platform team. You end up in this situation where they’re actually related and one is not necessarily killing the other.

Less than half of the sensitive data in organizations’ cloud environments is encrypted despite a continuous rise in attacks.

According to Thales’ latest report,  just 45% of sensitive data stored in the cloud is currently encrypted, despite 39% of respondents having experienced a breach in their cloud environment in the last 12 months, up 9% from the previous year. 

Despite the increase in sensitive data being stored in the cloud, only a fifth (22%) of respondents reported that more than 60% of their sensitive data is protected with encryption.

The issues also extend to the control businesses have over their encryption keys, with only 14% stating they controlled all the keys to their data in their cloud environments. Additionally, nearly two thirds (62%) said they have five or more key management systems, which increases the overall complexity of securing their data.

The annual report surveyed nearly 3,000 IT and security professionals across 18 countries, examining the latest cloud security threats, trends, and emerging risks. 

Concern for the security of sensitive data is elevated due to a considerable increase in the level of such data being stored in the cloud. 

Three-quarters (75%) of businesses reported more than 40% of their stored data is classified as sensitive, compared to 49% of businesses just a year ago.

In terms of targets, more than a third (38%) ranked software as a service (SaaS) applications as the top target for attackers, followed by cloud-based storage (36%). Human error was reported as the leading cause of cloud data breaches by 55% of respondents.

The findings come at a time when the adoption of multi-cloud continues to snowball, with 79% of organizations now having multiple cloud providers.

“The study shows that organizations are operating in a dynamic multi-cloud landscape, demanding seamless and efficient access to on-demand IT infrastructure and services,” said Sebastien Cano, SVP for cloud protection and licensing activities at Thales.

In addition to infrastructure growth, the report also found that the use of SaaS apps is also seeing a significant uptick, with 22% of businesses now utilizing between 51 and 100 different SaaS applications – compared with 16% back in 2021.

It all adds up to increasingly complex challenges for businesses, with 55% stating that managing their data in the cloud is more complex than tackling on-premises environments. 

A large proportion (83%) also expressed concerns over digital sovereignty, while 55% said data privacy and compliance in the cloud has become more difficult. 

Improving cloud security

Recommending next steps for vulnerable organizations, Thales highlighted identity and access management (IAM) as a “crucial measure” in mitigating breaches. 

The firm’s report found that the adoption of robust multi-factor authentication (MFA) is continuing to progress, with 65% of respondents now utilizing the technology. 

Zero trust controls, however, are lagging somewhat, with just 41% of organizations having implemented them in their cloud infrastructure, and 38% using them within their cloud networks. 

Thales said these factors shine a light on the need to adopt “comprehensive security measures” to effectively safeguard sensitive data and bolster overall resilience. 

Consolidation of key management environments can provide increased operational control to scale up the use of encryption in a manner that security teams can tackle. 

Businesses are also advised to take advantage of the “force-multiplying power of automation” to help reduce the risk of human error and bolster digital sovereignty compliance efforts. 

“Treating cloud environments as an extension of existing infrastructure while maintaining exclusive control and security of data, especially sensitive data, is key to cloud security,” Cano said.

“Customer control of encryption keys is essential as it allows organizations to leverage the scalability, cost efficiency, and accessibility benefits of the cloud while ensuring the utmost integrity and confidentiality of their valuable information.”

Data security provider Rubrik has announced a new collaboration with Microsoft which aims to accelerate cyber recovery through generative AI and natural language processing (NLP). 

Building upon Rubrik’s existing channel offering, the move will see Rubrik Security Cloud integrated with Microsoft Sentinel and Azure OpenAI Service to reduce the time required to investigate and determine responses to cyber incidents. 

According to Rubrik Zero Labs’ State of Data Security report, just 56% of IT and security leaders reported developing or reviewing an incident response plan in 2022, while security operations center (SOC) and incident response teams have become inundated with alerts each day, making prioritization time-consuming.

Rubrik and Microsoft say the new integrations will help SOC teams investigate the most pressing cyber events, as well as offer up remediation guidance.

“In a time when bad actors are becoming increasingly inventive, organizations must lean on AI to turn the tables on attackers,” said Charlie Bell, executive vice president of security, compliance, identity, and management at Microsoft. 

“Working with Rubrik establishes a counterpoint to the modern threats that our customers are facing and allows organizations to react to incidents more quickly. 

“Through the speed of AI, we believe security defenders will be able to identify and stop attacks faster than ever before.”

The development expands Rubrik’s existing integration with Microsoft Sentinel, which was announced back in October 2022. 

Now, Rubrik says its platform’s ability to provide time series data insights directly into Microsoft Sentinel will enable organizations to tackle evolving cyber threats and safeguard sensitive data.

Thanks to the new integration, Rubrik can now leverage large language models and generative AI through OpenAI to automatically create recommended task workstreams in Microsoft Sentinel. Security and IT teams will be able to streamline incident creation, automate recommended task workstreams, as well as accelerate overall cyber recovery.

Bipul Sinha, CEO and co-founder at Rubrik, said the explosion of generative AI will kick start a new age of cyber attacks that “go far beyond human comprehension”.

“We must fight fire with fire and use generative AI to not only understand future cyber events but to also prevent and defend against them,” he said. “We’re thrilled to collaborate with Microsoft and continue to build upon our progressive and long-standing partnership. 

“This is an important step forward as we continue our mission of securing the world’s data and helping businesses achieve cyber resilience.”

Cyber security vendor Malwarebytes has announced a refresh of its reseller partner program, which combines its endpoint security technology with channel incentives such as base and multi-year discounts.

Designed to help partners create profitable and consistent business growth, the new program features three tiers: gold, silver, and bronze – with specific benefits for each level. 

Those include margin discounts, protected margins on deal registration, lead sharing, NFR licenses, as well as access to market development funds (MDF). 

The initiative also supports targeting specific verticals with specialized bundle solutions that Malwarebytes said will fulfill vertical needs and drive targeted engagement with a partner’s customer base.

“Today’s evolving threat landscape means that organizations are leaning on their partners to be their trusted IT advisors and cyber security experts more than ever before,” said Jason Coville, chief sales officer at Malwarebytes. 

“We believe it is critical to invest in and support our partners as they guide their customers to a more secure future. We are committed to providing our partners with cutting-edge security solutions that are easy to use, create growth, and provide fast time-to-value.”

Malwarebytes says its revamped reseller program offers competitive pricing and margins to help increase overall earnings potential with deal registrations, as well as additional margin and deal exclusivity on all new opportunities.

There’s also sales and technical training for Malwarebytes solutions, as well as a host of marketing resources such as co-branded collateral, a global campaign repository, and partner communications. 

Partners can access these sales and marketing resources through the Malwarebytes Partner Experience Center (PXC) portal, where they can also register deals and provide customers with free trials.

The firm said the initiative will also benefit from mutual engagement, with partners able to provide input to help drive technology development, as well as future marketing and sales activities.

“At Malwarebytes, if it doesn’t work for our channel partners, it doesn’t work for us,” said Philip Walsh, Malwarebytes’ channel account sales leader for EMEA. 

“Our new reseller program has many elements truly valuable for partners looking to create profitable and predictable businesses. We are focused on making Malwarebytes easy to buy, sell, deploy, and manage.”

Matthew Whitton, chief operating officer of Climb Global Solutions EMEA, a Malwarebytes partner, praised the security vendor’s channel revamp.

“The new reseller program is a testament to Malwarebytes’ ongoing prioritization of the channel,” he said. 

“It offers many opportunities to grow our business, offer additional solutions to upsell and cross sell and gives my team the training and support they need to fully understand and advise customers.”

Security researchers have uncovered a brand-new malware strain targeting Windows’ remote desktop protocol (RDP).

Experts at Bitdefender Labs revealed the newly discovered malware today, dubbed RDStealer. 

RDStealer takes the form of a server-side implant that monitors incoming connections with client drive mapping enabled.

Once connected, an RDP client is infected with the Logutil malware, allowing data (including credentials and private keys) to be extracted.

The attack chain associated with RDStealer involves a typical DLL sideloading technique, but researchers observed that the level of disguise observed in this campaign “surpasses anything witnessed thus far”.

DLL sideloading takes advantage of how Windows locates libraries. An attacker might give a malicious binary the same name as a trusted DLL and drop it into the same folder, or high in the search order, as a trusted application. 

When that application launches, the malicious binary is also launched.

The attack features multiple DLL libraries chained together and the process is initiated through the utilization of the Windows Management Instrumentation (WMI).

The cross-platform nature of RDStealer represents an even more significant threat since both the RDStealer and Logutil malware samples have been written in the Go programming language. 

During an analysis of domains connected to the attack, researchers noted references to Linux and ESXi - the VMware hypervisor - indicating the multiplatform potential of the Logutil backdoor.

The attack itself appears more concerned with the theft of data and credentials, and used folders that were likely to be excluded by scanners such as %WinDir%\System32\. 

Researchers also found malware in %WinDir%\security\database directory, where Microsoft has advised administrators to exclude specific files from scanning. 

The findings suggest the attackers have anticipated administrators simply excluding the entire folder.

RDStealer: How does the attack work?

RDStealer specializes in data gathering, clipboard capturing, and keylogging. 

It also monitors incoming RDP connections and can compromise a remote machine if Client Drive Mapping (CDM) is enabled. 

CDM is a commonly used feature and must be enabled at both the client and server ends. It permits users to access and transfer files between their local machine and the remote server via RDP and allows administrators to move files between a remote server and their admin workstation.

On a compromised machine, RDStealer collects clipboard data and keystrokes before checking the availability of tsclient connection and one of the C, D, E, F, G or H drives (automatically created when CDM is enabled and representing disks on the connected RDP client.)

Data is exfiltrated and the Logutil backdoor is deployed to both maintain a foothold in the victim’s network and provide capabilities such as file download/upload and command execution.

The abuse of WMI by this malware to establish persistence on the system is particularly unique. 

The malware can be triggered by either the WMI service or host process and makes use of a library (ncobjapi.dll) that has previously been weaponized by other groups. 

However, in this instance, the library is simply used to launch the Logutil payload as part of the sideloading chain.

How to prevent infection

The research is a reminder that attacks will continue to get ever more sophisticated as tactics evolve, particularly with the move to remote work. 

All virtual channels are capable of transferring data and can be weaponized, so administrators must consider exposed entry points and deploy automated protection controls.

And, as researchers note, “the best protection against modern attacks remains the defense-in-depth architecture”.

The US is leading the tech industry in auditing codebases for security issues, with the UK reportedly lagging well behind.

Germany was also identified as one of the nations that was underperforming when it comes to code auditing, despite significant cyber security challenges across the industry.

The findings came from open source software firm SUSE’s latest report, showing a disparity in the way in which the nations see code auditing as an operational priority.

According to the report, nearly half (45%) of respondents in the US regard code audits as a priority, and invest accordingly, while only 23% and 26% of respondents in Germany and the UK respectively adopt the same attitude.

SUSE’s global CTO Brent Schroeder said he believes that the US’ potentially more mature DevOps environments could be an influential factor.

“The US being ahead is probably more about the maturity of the US with DevOps and DevSecOps,” Schroeder told ITPro.

Citing his experience with meeting customers, Schroeder said the importance of bringing the integration of security and security practices into the developer pipeline and notes that “companies, at least in the US, are really starting to embrace and recognize that”.

“If they don’t bring security into the process, they encounter one of two things: One is the speed and agility with which code is delivered is significantly diminished because near the end of the process they have to do checks for security.

“They do everything they can to do the integration as quickly as possible but then releasing new applications, major new features into a production environment, they’ve got to pause to check with the security team: does this pass all the audits and the requirements?

“Or else you deliver vulnerabilities at scale.”

Who cares about source code audits?

Being aware of what is in one’s software supply chain is critical. Recent security incidents have demonstrated the importance of detecting, remediating, and monitoring vulnerabilities in applications.

Across the US, Germany, and the UK, an average of 33% of respondents to the survey believed that goals on source code audits would be revised upwards, rising to 46% if one only considers software and network engineers, technical architects, and developers.

95% also intended to review their software supply chain to increase security. This included 51% that had already done so, increasing to 68% of US-based respondents but going down to only 40% of those that are Europe-based.

Why are the UK and Germany lagging?

The difference in approach could potentially be attributed to governmental and regulatory approaches. 

In the US, the M-22-18 memorandum set a deadline for compliance with the National Institute of Standards and Technology (NIST) Secure Software Development Framework (SSDF), SP 800-218, and the NIST Software Supply Chain Guidance.

The M-22-18 memorandum, dated 14 September 2022, set clear dates for US government agencies to adopt the requirements. 

Ninety days were given for a software inventory, 120 days for a vendor communication process, and 270 days for attestation letters not posted publicly by software providers for “critical software”.

US companies keen to do business with government agencies must therefore ensure they comply with the NIST requirements, aimed at addressing software security and secure development practices.

The EU’s Network and Information Security (NIS) directive was the first piece of EU-wide legislation on cyber security but, as a briefing on NIS2 in February 2023 noted, implementation proved difficult and resulted in fragmentation across member states.

NIS2 entered into force on 16 January 2023 and is set to be implemented in each member states’ national law by 17 October 2024.

ChatGPT and competitors such as the recently-launched Google Bard have shot generative artificial intelligence (AI) into the mainstream. Allowing users to create, combine and remix content, generative AI is hailed as a transformative technology for businesses. 

As the use of generative AI grows, though, so do concerns about cyber security, because the technology has the ability to drive more targeted cyber attacks. Hackers can use generative AI to compose impactful phishing emails, and the technology is making deepfakes even more convincing.

Creating malware is also easier with generative AI. In 2020, for example, researchers discovered a new type of malware called DeepLocker that used generative AI to create unique obfuscation techniques, making it difficult for security tools to detect and block. 

Attackers use off-the-shelf machine learning libraries and frameworks such as TensorFlow or PyTorch to create generative models, says Adam Blake, CEO and founder ThreatSpike Labs. “These tools are widely available and easy to use, which has lowered the barrier to entry for adversaries looking to use AI in their attacks.”

There are several types of generative AI, each with potential uses in cyber attacks. So what are the new risks posed by the different types of generative AI and how can businesses protect themselves as the technology develops?

Text-based generative AI security threats

Text-based generative AI such as ChatGPT helps make phishing attacks far more sophisticated and difficult to spot. “AI-enhanced campaigns could create highly personalized emails to enable spear phishing at scale,” says Dane Sherrets, senior solutions architect at HackerOne.

Because text-based generative AI models are currently the most mature, experts say this type of attack will have the most impact in the near future. “They can be used to generate personalized phishing emails, or disinformation campaigns about an organization or individual,” adds Josh Zaretsky, partner at consulting firm Altman Solon.

Using text-based generative AI, interactive chat capabilities could be honed in the future to automatically target companies via their web chat services, says Matt Aldridge, principal solutions consultant at OpenText. 

Video-based generative AI security threats

Further down the line, video-based generative AI such as Runway’s Gen-1 could super-charge deep fake attacks to trick employees into transferring large amounts of cash to criminals. For example, an adversary could use video generation to create a deepfake of a company executive for social engineering attacks or to spread disinformation, says Blake. 

Alternatively, he says, an attacker could use a video-generating model to create fake footage of a CEO instructing employees to transfer money or disclose sensitive information. Video models can be used to bypass facial recognition security measures in an identity-based attack, or impersonate company employees in spoofing attacks, according to Zaretsky. 

Audio-based generative AI security threats

Voice cloning is just one use for audio-based generative AI, and it’s easy to see how it could be used for nefarious means. An attacker could use audio-based systems to create a convincing voice phishing call that appears to be from a trusted source, such as a bank or credit card company, says Blake. “Alternatively, an attacker could use an audio-generating model to create a fake audio clip of a CEO instructing employees to take a specific action.”

Text-to-speech generative AI such as Microsoft’s new neural codec language model VALL-E is able to accurately replicate a person’s voice using a combination of a text prompt and a short clip of a real speaker. Because VALL-E can replicate tone and intonation and convey emotion, voice clips produced using the model are very convincing.

The speed at which audio-based generative AI is developing is a major threat, according to Aldridge. “Audio fakes are a reality and the technology that makes them possible is improving at speed – we’ve seen huge developments in recent years, with computers creating conversations on their own.”

Image-based generative AI security threats

AI-generated images created by the likes of DALL·E 2 could also pose a major risk as the technology develops. 

An attacker could use generative AI to create a convincing fake image or video that appears to show a company executive engaging in inappropriate or illegal behavior, for example. “The image or video could be used to blackmail or to spread disinformation,” says Blake.

Code-based generative AI security threats

As well as enabling less experienced attackers to create advanced malware, automated code generation by generative AI models can facilitate the bypass of traditional security tools, says Aldridge. Code-based generative AI tools include Tabnine and GitHub Copilot.

“It will do so by hiding malicious intent deeply within an otherwise benign application in an advanced trojan attack for example – in a similar way to how information can be hidden within an image using steganography.”

Combined generative AI security threats

Adversaries can also combine different types of generative AI models to carry out more complex attacks. 

For example, an attacker wishing their victim to perform a specific action could use a text-generating model to compose a convincing email; a video-generating model to create a fake video; and an audio-generating model to create a phony audio clip, Blake explains. 

“This combined attack could be particularly effective because it leverages multiple forms of media to create a more transparent and compelling message.”

How to mitigate generative AI security threats

Like any type of security threat, the risk posed by generative AI-based attacks is likely to evolve, making it integral that businesses are prepared. For now, it’s worth noting that security technology is not always able to spot and halt these attacks. 

There are no known tools at this moment that can identify generative AI-derived attacks as “the modus operandi is to appear human-like”, says Kevin Curran, senior IEEE member, and professor of cyber security at Ulster University. He says the generation of realistic fake videos is particularly worrying.

With this in mind, businesses need to stay vigilant and adapt to new threats as they emerge, working closely with cyber security experts and technology providers, says Maher Yamout, senior security researcher at Kaspersky. He advises stringent authentication measures such as multi-factor authentication (MFA) to prevent unauthorized access.

Overarching this should be a strong strategy, taking into account the use of AI within the business. Introducing AI technology into the fabric of a business could be counterproductive if organizations fail to consider safety and security, says Sherrets. 

As the threat posed by generative AI becomes more sophisticated, experts agree training and education are key. Sherrets advises businesses to bolster staff training around the latest methods of attack. “Humans will always be one of the easiest vectors for an adversary to exploit – organizations will do well to make sure their staff are educated about the new tools used by attackers.”

Cyber security solutions provider Cyware is looking to grow its partnership with its channel and managed security (MSSP/MDR) partners through its new global partner program, CywareOne.

The fresh initiative will enable partners to provide customers with Cyware’s advanced threat intelligence automation, security advisory sharing, low-code vendor-agnostic SOAR, as well as cyber fusion technologies.

In an announcement, the firm revealed it has already partnered with several globally renowned cyber security providers to deliver security solutions, including GuidePoint Security, Ernst & Young, Optiv, Morado, and SHI.

"CywareOne represents a significant step forward in our commitment to developing strong partnerships with businesses that share our vision for a safer digital world," said Matt Courchesne, Cyware’s head of channel for North America. 

"Our new program will deliver the resources and support our partners need to succeed in the rapidly evolving cyber security landscape."

Cyware specializes in unifying threat intelligence, automation, threat response, and vulnerability management with a range of data insights. The company’s Cyber Fusion solution integrates SOAR and TIP technology to enable collaboration across siloed security teams. 

The platform is deployed by enterprises, government agencies, and MSSPs while providing threat intelligence-sharing platforms for the majority of information-sharing and analysis centers (ISACs) around the world.

With its new partner program, Cyware is now also offering various benefits to its partners, including comprehensive training programs, dedicated support, co-marketing opportunities, and competitive discounts.

CywareOne has been designed to streamline engagement and opportunity management while facilitating a high level of trust and transparency. 

Ultimately, the aim is to equip partners with the skills and resources to effectively tackle clients’ cyber security issues.

The company said the program will create a thriving community of partners that are “united by their commitment to excellence”.

"We designed CywareOne with a clear goal in mind: to facilitate our partners' success," said Amit Patel, SVP of sales at Cyware. 

"We are committed to working collaboratively with our partners to deliver unrivaled cyber security solutions, providing them with the tools they need to excel and differentiate themselves in the market."

Microsoft has been busy in the past few days with a series of announcements and patches, including new features for the Windows Subsystem for Android and critical security updates.

We’ve listed some of the top features included in the new Windows 11 updates, including details of the latest vulnerabilities affecting devices that haven’t yet been updated.

File sharing with Android

Windows Insiders can now share files directly from their user folder to the Windows Subsystem for Android.

Windows Subsystem for Android allows users to run Android apps directly on their device, provided they are downloaded directly through the Amazon Appstore.

Much like Windows Subsystem for Linux, it negates the need for manual virtualization and allows developers to debug Android APK files directly on their PC.

Apps must request file viewing and editing permission through a system dialog each time they are connected to a compatible device, and this can be revoked at any point. System folders and hidden folders are excluded from file sharing.

Microsoft also stated that potential threats from an app will be scanned and blocked via the user’s antivirus software, regardless of whether the app was installed through the Amazon Appstore or 

A full release date for the feature has yet to be announced, but is expected in the near future.

Microsoft also stated that potential threats from an app will be scanned and blocked via the user’s antivirus software, regardless of whether the app was installed through the Amazon Appstore or another platform.

A full release date for the feature has yet to be announced, but is expected in the near future.

June 2023 Patch Tuesday fixes

This month, Microsoft’s Patch Tuesday security release included a total of 94 patches, inclusive of 14 Chromium flaws and five GitHub vulnerabilities.

Six critical vulnerabilities were included in this list, including three Windows Pragmatic General Multicast (PGM) vulnerabilities carrying near-maximum severity scores of 9.8 on the CVSS v3.1 scale. 

The high severity scores were assigned because exploiting them could have led to remote code execution (RCE) via the Windows messaging queue.

The PGM vulnerabilities were tracked as CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015 respectively.

Microsoft also patched a SharePoint vulnerability that could have allowed a threat actor to obtain administrator powers through privilege execution, tracked as CVE-2023-29357.

Unlike every Patch Tuesday for the past year, this month’s contained no zero-day vulnerabilities.

“This is the third month in a row where Patch Tuesday features at least one critical RCE in Windows PGM, and June adds three to the pile,” said Adam Barnett, lead software engineer at Rapid7.

“Microsoft hasn’t detected exploitation or disclosure for any of these, and considers exploitation less likely, but a trio of critical RCEs with CVSS 3.1 base score of 9.8 will deservedly attract a degree of attention.”

While Microsoft has not identified any of the vulnerabilities as having been exploited in the wild, there are some that have been highlighted as “exploitation more likely”, underlining the need to patch them as soon as possible.

Moment 3

Windows has also dropped a fresh cumulative update for Windows 11 22H2 (KB5027231), which had been known under the codename ‘Moment 3’ prior to release.

A significant feature of the update is a fix for 32-bit apps that use the CopyFile API and support the large address aware memory usage option. The error affected file copying and attachment in commercial and enterprise environments.

The update also comes with a number of quality-of-life improvements, including support for Bluetooth low energy (LE) audio and a new section in the settings menu for USB-4 and Thunderbolt devices connected to a device.

Microsoft rolled out accessibility improvements within the release, including a fix that allows the narrator tool to correctly describe file attributes.

Even more features in a cumulative update

In addition to KB5027231, Microsoft also rolled out another update named KB5027223 for Windows 10 21H2.

In addition to all of the patches from Moment 3, KB5027223 includes a number of other improvements such as general improvements for the taskbar search box.

The update fixes an error that prevented users from accessing the Server Message Block (SMB) shared folder, one that prevented the Local Security Authority Subsystem Service (LSASS) from working, and an audio issue affecting certain CPUs.

It also addresses a Windows kernel vulnerability that could have allowed attackers to view heaped memory from secure processes.

Security researchers have theorized that rising exploits of the critical vulnerability in Log4J could soon worsen as cyber criminals continue to find new ways around the ongoing implementation of Microsoft’s anti-phishing measures.

Introduced in 2022 after the IT community demanded it for years, Microsoft blocked the enablement of VBA macros in Office documents by default.

It meant that one of the leading methods of distributing malware via Office documents and phishing emails was effectively nullified - a major boon to defenders.

Since then, researchers at ESET have noticed a rise in exploits targeting the Log4J vulnerability across the world. 

While the reason for the increase in attempts isn’t currently clear to researchers, the possibility that cyber criminals are looking for new ways to carry out attacks now phishing with malicious documents has become more difficult.

ESET’s researchers said that, while it’s just a theory, this rise may continue as cyber criminals look for effective ways to achieve their goals now one of their most favored tactics has been thwarted. 

“If you look at the numbers globally, we have seen 166 million attacks [in 2022]... and in 2023, the numbers were going up by 13%,” said Ondrej Kubovič, security awareness specialist at ESET, about the latest data on Log4J exploit attempts.

“So, knowing that there are new systems being introduced with Log4J, and our statistics are showing this, then we can say that Log4J is still interesting for the attackers, and with VBA [macros] being closed down and OneNote being closed down, this might get worse.”

The latest Log4J numbers

Despite Log4Shell not being as devastating as the community initially thought it would be, it remains highly exploited - the second-most used exploit method, according to ESET’s telemetry, behind password guessing.

The popularity of exploiting the vulnerability is also expected to increase not just because of Microsoft’s anti-phishing measures, but also because of the number of vulnerable downloads that are still made.

ESET said in its T3 2022 Threat Report that as many as a quarter of all new Log4J library downloads are of the vulnerable version, even though patched and secure versions have been available since December 2021.

IBM’s figures paint an even darker picture, suggesting that nearly half (40%) are still vulnerable to the flaw that received a maximum 10/10 rating on the CVSSv3 severity scale.

In just the last seven days, 32% of Log4J downloads were of the vulnerable version, Sonatype’s data showed.

As of September 2022, the number of blocked Log4J exploit attempts in the UK sat at 13.4 million, ESET said, roughly 12% of the global 166 million attempts. 

This represented a 15% year-on-year increase, one that was generally in line with the figures for countries across the world.

Poland’s figures were amongst the highest out of any country in the world with a 30% increase in attacks. 

ESET could not offer a definitive explanation for these markedly high attack attempts and neither could the Polish national computer emergency response team (CERT) after consulting with the security researchers.

Ukraine’s CERT issued an alert at around this time warning of Russia’s changing tactics, favoring vulnerability exploits as opposed to attack techniques used earlier in the conflict, though a strong link between the nation’s activity and Log4J exploits in Poland has not been established.

Blocking VBA macros: How effective has it been?

In the year since Microsoft rolled out the changes to Office documents, blocking VBA macros by default, data has shown a dramatic reduction in attacks.

Proofpoint’s figures from the back end of 2022 showed a 66% drop in macro-enabled attack attempts, a trend that continued through the first half of 2023 with macros “barely” making an appearance in campaign data.

“The cyber criminal ecosystem has experienced a monumental shift in activity and threat behavior over the last year in a way not previously observed by threat researchers, the security company said. 

“Financially motivated threat actors that gain initial access via email are no longer using static, predictable attack chains, but rather dynamic, rapidly changing techniques.”

The findings in Proofpoint’s data were also corroborated by researchers at ESET in private media briefings.

Attackers pivoting to OneNote

After Microsoft put an end to macro-enabled Office documents, attackers soon realized that the company’s note-taking app OneNote could be exploited in a similar way to how Word and Excel were before 2022.

An increase in attacks was reported by various security firms earlier this year involving OneNote files, which still allowed the embedding of various files in documents, including executables.

A typical scenario would see an email sent to a victim and attached to it was a mostly empty OneNote document. 

Attackers would create a large text box reading ‘Click to open document’, or a similar message, but behind that text box would be a number of links to batch files that would be clicked and executed if the victim clicked on the text box, which only served to conceal the malicious buttons.

In some examples, a series of batch files would run, downloading other similar files and executing PowerShell code, ultimately leading to the installation of malware and essentially bypassing the blocking of VBA macros. 

An example highlighted by Fortinet in March 2023 saw such an attack lead to the dropping of the AsyncRAT which was able to assume total control of a victim’s machine.

In the same month, Microsoft implemented enhanced security measures for OneNote, including more frequent and explicit warnings when opening potentially malicious files.

Weeks later, it also announced it would block 120 file extensions often used in malicious campaigns by default as an additional stand against phishing using its productivity software.

Now, fresh concerns have been raised around the introduction of the new top-level domains (TLDs).  

Cyber security experts have previously criticized the new additions, including the ones such as .zip, as these could be harnessed in campaigns, potentially making malicious links appear more legitimate than they really are.

ESET’s researchers told ITPro that while the current data doesn’t show a significant increase in attacks leveraging the new TLDs, they “understand the concern”.

Security operations provider Arctic Wolf has announced an expansion of its Security Operations Warranty to eligible customers in Europe, as well as Australia and New Zealand (ANZ). 

The initiative aims to provide qualifying customers with fully underwritten financial assistance of up to $1 million, should they be on the receiving end of a major security incident. 

It's available at no cost to both new and renewing customers that use the Arctic Wolf Managed Detection and Response and other solutions to support incident response activities, legal and regulatory expenses, and other associated business costs that may arise from cyber attacks.

Dan Schiappa, chief product officer at Arctic Wolf, said the company is focused on delivering a “combination of effective security operations solutions and unique customer benefits” that will help organizations build business resilience.

"With the expansion of the Arctic Wolf Security Operations Warranty to Europe and ANZ, we continue to demonstrate our leadership in the security operations space and the confidence we have in the Arctic Wolf Security Operations Cloud, coupled with the third-party provider service benefits as part of the Security Operations Warranty, to detect and prevent successful cyber attacks across all threat surfaces," he said.

The move comes at a time when 40% of organizations currently lack comprehensive cyber insurance, the firm’s own research has found, while most businesses that do not have an active cyber policy believe it would not fully cover the costs of a major cyber breach.

In response, Arctic Wolf said it developed its Security Operations Warranty to help customers address their cyber risk gaps by automatically providing an additional layer of financial resilience.

The company revealed the warranty expansion as part of its Partner Jam event, which centers around its channel, alliance, and insurance partner community. 

The Arctic Wolf Partner Program has grown to incorporate 1,300 partners around the world, with almost 200 of those located in EMEA and ANZ – including Arctic Wolf’s European Alpha Partner of the Year, medocino Hamburg GmbH. 

“Many cyber security vendors claim to be able to be able to stop cyber attacks, but few are willing to stand behind their claims, which is what makes Arctic Wolf and their Security Operations Warranty such a disruptor for our industry,” said Stephan Beckmann, CEO at medocino.

“With their Security Operations Cloud, Arctic Wolf is addressing a real market need by making world-class security operations achievable for any business with the push of a button.”

Prevention-first cyber security provider Deep Instinct has announced the appointment of Jim Ortbals as its new vice president of Americas channels, while Ryan Vaupel joins as vice president of operations.

As channel lead for the Americas, Ortbals will focus on driving adoption of the platform via the company’s Stratosphere Partner Program, supporting existing partners, and striking up new relationships. 

He joins the company from Zscaler, where he led the firm’s global service provider, MSSP, and distribution routes to market, working with many of its top partners around the world. 

Prior to that, he held various global channel and field sales leadership positions at industry multinationals such as VMware and Cisco, as well as late-stage startups such as Zerto.

In an announcement, Ortbals said Deep Instinct’s channel partners and customers are “looking for innovation in cyber security” as opposed to more detection and response.

“The Deep Instinct Stratosphere Partner Program is bringing predictive prevention to our partners to lower risk for customers around the globe and the demand is growing,” he said. 

“My focus is to develop our partner ecosystem and ensure they have the right tools and solutions to be successful.”

Ryan Vaupel also joins the business as vice president of operations, tasked with “laying the foundation for operation excellence,” Deep Instinct said.

With almost two decades of executive-level experience, Vaupel most recently served as senior vice president of global operations at ZIMPERIUM and held a similar leadership role at Zerto. 

Deep Instinct said the appointment will add a combination of technology, enterprise sales, leadership, transformation, and operations expertise to the company.

“The status quo reactionary security model is failing to stop zero-day, ransomware, and other unknown threats until after they are already inside an organization,” Vaupel said. 

“Deep Instinct’s prevention platform provides organizations with a proactive security model that prevents threats before they can execute in an environment.

“I look forward to driving our organization at maximum operating efficiency to ensure we delight our customers, partners, and employees.”

Commenting on the appointments, Deep Instinct CEO Lane Bess said the industry is at a “tipping point” with the rise of generative AI promising to “broadly increase not only the velocity of attacks but also severity”.

“It is a wakeup call for organizations to focus their attention on prevention and the only way we get there is with the most sophisticated form of AI – deep learning,” Bess added. “Jim and Ryan will both play an integral role for Deep Instinct during this time of immense growth.”

The economy is in a difficult situation. ONS figures show that the UK economy grew by 0.1 percent in the first quarter of 2023 and the cost-of-living crisis continues to affect confidence. 

While the technology sector has traditionally been able to weather tough conditions, that's not the case this time around. 

Even areas like IT security are facing challenges. While Gartner predicted this market will continue to grow by 11.1% year-on-year through to 2026, this increase in spending will have to be stretched further to keep pace with emerging threats. 

CISOs are having to look at their strategies with fresh eyes in order to stretch budgets, including potentially consolidating the number of vendors they work with.

So what will these consolidation exercises look like, and how can channel partners capitalize?

What should consolidation mean to your customers?

When we use the term consolidation, we typically mean cost-cutting. However, for security teams, the ability to reduce costs should not be conflated with decreasing budgets, which will ultimately leave teams without critical resources. 

The challenge is how to make budgets go further and invest where companies need it, rather than this being an exercise in having money taken away.

Waiting until customers ask about this approach is too late. Instead, taking a proactive approach can put you - and your customer’s security team - in the driving seat when it comes to how projects are defined and what the success metrics are.

To get started, analyze how your customer manages their security processes and the products. It’s easy to build up shelfware that is either not being used, or only utilized for tasks that are not valuable enough to carry on spending on them. 

These solutions can be removed and replaced with more cost-effective options, especially where other solutions can be used to cover the same tasks.

This may throw up some interesting findings. You may find yourself dealing with challenging scenarios and internal company politics. For example, you may find that processes are not as efficient as they could be, or that teams are relying heavily on manual work to get things done.

In a worst case scenario, you may uncover something that is not compliant with an industry standard or regulation. 

It’s important to be tactful here, as security teams may have invested a lot of their time into building and evolving their processes. With anything that has been in place for a while, this can create a lot of attachment. While we all like to think of ourselves as rational beings, this is not always the case. 

Taking a diplomatic approach can pay off as no-one likes to think of their deployment as wasteful.

Building back up again

Once you have established the tools, processes, and people involved in delivering security, you can assess the potential overlaps and where consolidation can occur. 

Every vendor talks about the mythical single pane of glass for security, and you may find that customers have multiple ways of achieving this result. They may even be running multiple product suites for their security and risk management requirements, from identity management through to firewalls, network security, and cloud.

From here, you can look at how to consolidate and improve security operations. 

This may remove some tools, but the main goal should be to achieve better processes and faster delivery. Ideally, you can reduce the overall vendor count and make use of more integrated suites of services rather than multiple products. 

This can make a big difference in cloud environments, where customers would otherwise have to run multiple agents to get the security services they need. Taking a ‘one agent’ approach reduces the overall amount of compute resources required to manage security services, which helps the customer save costs.

On top of this audit, you can move into recommending how best to consolidate and maintain security levels. For example, many companies will subscribe to a threat intelligence feed, but do they make use of it? 

Instead, can you supply a service that combines multiple feeds for better coverage while also offering recommendations on where to improve over time. This delivers an ongoing revenue opportunity while helping customers reduce their spending on specific security products.

Alongside this, explore ways  you can help the customer to automate their processes where possible. These efforts not only help the security team work faster and more efficiently, but it can show where there are ways to improve processes and working practices. 

Security vendors are all deploying AI and machine learning to streamline processes, but this should also be used to free up focus time for security analysts.

Looking for more opportunities around value

While security consolidation projects may set out to cut costs, they might lead to other opportunities that you can build on. For instance, many companies now need more help in communicating their security position to their internal leadership teams or the board. 

This calls for more risk management support, but it also requires nuanced communication support as well. It is not enough to just provide a dashboard – instead, you may need to help security teams work on how they communicate with leadership.

Improving communication is a great secondary objective for consolidation projects. By cutting the number of tools involved, you can remove some of the headaches for security teams about getting the right data together. 

On top of this, you can make it easier for them to demonstrate they are doing a good job.

Many companies need help on security consolidation projects. To maximize these opportunities, start by looking for overlaps and gaps. Once this audit is complete, you can make recommendations on how to reduce the number of vendors, integrate those that are in place, and make processes more efficient for everyone involved. 

The result should save the company money, but it should also deliver better security posture for the future.

Organizations have been urged to place a greater focus on ensuring that the cyber security training they deliver is translated into actual behavior change among staff.

Leading cyber security experts and a career criminal addressed delegates at Dell Technologies World 2023, saying that raising cyber awareness across the business is not enough to enact useful change.

Oz Alashe MBE and CEO at risk management firm Cybsafe, veteran security journalist Kim Zetter, and famous former con artist Frank Abagnale all agreed that individual behavior can make or break an organization’s cyber posture.

Zetter used Mandiant’s Henna Parviz, a security analyst who spotted the first indicators of the Solarwinds attack.

It was Parviz who in November 2020 noticed a Samsung phone had been registered to an employee without a phone number, and that it had been used to log into the employee’s virtual private network (VPN) from a different state to where the employee was based.

What she had discovered was the first concrete clue of the Solarwinds breach, led by a standard security alert that Zetter stated a less-fresh, “more jaded” analyst may have disregarded entirely.

Alashe said that the main question that goes unasked in board rooms right now is: ‘Is what we’re doing working’ and noted that this also forces firms to consider what their goals are.

He pointed to a need for small and medium businesses to feel motivated and empowered to take care of cyber security, and for large businesses to govern cyber security at a board level with the same clarity as other risks.

“It’s not knowledge vs behavior change, that’s not what I’m saying at all,” he told ITPro.

“What I’m saying is that knowledge doesn’t equal behavior change, and if we’re not changing behaviors we’re not reducing risk.”

“I know I shouldn’t eat as many packets of crisps as I do and I’m going to do it. If I’m going from A to B, I don’t want someone to teach me how to read a map, I want my phone to help me ‘go down the road and turn left’.

AI’s influence on cyber security

Alashe also pointed out areas of innovation that will demand a change in behavior from employees, such as the threat posed by real-time deepfakes or generative AI.

Although AI has driven a surge in social engineering attacks, with text-generating chatbots such as ChatGPT or Bard allowing attackers to craft sophisticated emails, firms could also use generative AI to protect against phishing.

While machine learning (ML) algorithms can be used for positive processes such as identifying behavioral weaknesses, Alashe said this could also be turned on its head by attackers to better identify prime targets for social engineering.

It is in light of this that he has called for a focus on behavioral change over a purely educational approach to cyber security.

“It is a constant game of cat and mouse, this idea that we would get to a point of knowledge and education - or indeed behavior nirvana - is just not true,” said Alashe.

“Ultimately as technology evolves, and as criminals find new ways of using this technology to steal or gain access to things that they shouldn’t have access to, we will need to evolve the things that we do and the behaviors we exhibit to get around them.”

Perspectives on the future of security

Abagnale stressed that criminals are the same as they have ever been, but are increasingly in possession of more sophisticated tools.

“What I did 50 years ago as a teenager is 4,000 times easier to do today, and with AI it will be 5,000 times easier in the next few years,” he said.

Despite the growing threat, Abagnale praised the growing trend of companies abandoning passwords for passkeys, as Google has done recently.

All three speakers were also jointly optimistic about the potential for canny users and improved technology to bring down risk in the near future.

“There will come a time when virtually every single device considers the user, and the people using them, and therefore gives them the help and support they need,” Alashe said.

“We no longer have to rely just on training and education, we can actually give you the persistence and influence what they actually do. It’s a better and more scientific way to be, it’s a more data-driven way to be. And our people deserve it.”

With a slew of tech giants announcing layoffs, the mood of the IT services market is cautious. Big investments and expansion plans are likely to be on hold, at least in the short term. 

But while it’s easy to see all of the negative headlines and fear the worst, it’s also important to think long term. There are positive predictions for the year. Gartner has predicted that the IT security market will grow over 11% in 2023, and it’s perhaps a mixed blessing that cyber criminals are keeping the security market buoyant. 

Rather than panic, the channel should prepare, and focus on communicating the value of security to grow this part of their business.

Cultivating a resilient ecosystem

Key to creating a compelling security offering is building an ecosystem - working with the right vendors with solutions that work together and can create sales opportunities. For example, email security and endpoint security are essentials that every customer needs, but these can be complemented with security training for users. 

Email protection and user awareness together can protect a business far better than just email protection, but businesses will often only demand the first. It’s natural for them to assume that a technical solution will fix what they see as a technical problem. It may take time to educate users, but having the right solution will make this much easier.

Similarly, protection is vital, but there needs to be a backup plan - literally. Data loss prevention is a critical addition to this suite of solutions that can be added later if the customer is not immediately convinced of its necessity.

The key is to create a jigsaw that can be slotted together all at once or completed over time, rather than a cacophony of overlapping products. Providers should be looking to create an integrated suite of vendors and solutions that will segue into complementary sales.

Channel partners should also embrace more of the solutions within existing vendor portfolios. Vendors have done a lot of the hard work in creating solutions where a need exists, and this should be taken advantage of. Just because a vendor is known for its network firewalls, that doesn’t mean it doesn’t offer worthwhile security solutions outside of this niche.

Build a foundation and find areas for growth

It can be tempting to focus on the here and now, but building resilience means creating a foundation for future growth. It’s natural to say that you should repair the roof while the sun is shining, but that doesn’t mean the roof shouldn’t be repaired during inclement weather.

Even in straitened times it’s necessary to invest in the right training. This is true for sales people, it’s vital that they know exactly what they are selling, but also engineers. 

Time needs to be allocated for learning and development, whether that’s gaining certification or learning through communities. 

Staying resilient means customers have faith in the partner they work with. Firms will also be using this time to consider how they are spending their money and thinking about value.

But need will be a consideration, and so partners should be proactive in undertaking account reviews to accommodate businesses' evolving needs.

Annual refresh cycles are a thing of the past with as-a-service products, and there’s no need to wait a year to approach a customer and suggest a review if things have changed. By working with vendors that provide strong analytics and dashboard features, insights can not only preempt issues, but be used to upsell.

Partnerships and customer success 

Not everything offered by a partner has to be delivered directly. By working with businesses offering complementary solutions then it’s possible to offer a more comprehensive service. This can be a stopgap until a service is brought in-house. 

Either way, the point is to let the customer know we are a one-stop shop and can cover all their needs. 

That’s important, as one of the key parts of resilience is understanding how important current customers are. We all know the old adage that winning a new customer costs ten times as much as retaining an existing one. Resilience means a sales team has to treat every customer as a potential lifetime partner and show that they are not forgotten once sold to. 

Ultimately, resilience means looking at where your business is healthiest and making sure that everything possible is done to make sure this aspect is supported, through sales, customer service, employee education and the right product suite.  

It may also be the right time to think about who your customers are - are you a generalist, or are you serving a niche market? 

Targeting an audience, rather than limiting options for future sales, can increase resilience - there are benefits of more targeted sales material, a consolidated product suite, even better word of mouth as businesses talk to similar businesses.

Resilience is not a case of battening down the hatches and waiting the bad times out, it means being proactive. It means keeping up with changes that will keep a business going through the worst of times, and being prepared to take advantage of better times. 

Most of all, it means looking to the long term as well as making short-term decisions - ”duck and cover” will only work for so long.

Risk awareness and risk management are crucial to safeguarding an organization’s assets from cyber attack, according to conventional wisdom. But how effective are these strategies if businesses are now told it’s not a matter of if, but when, disaster strikes? 

This “when, not if” theme arises again and again in modern cyber security discourse – suggesting falling victim to cyber crime is an inevitability. Being targeted, and cyber criminals successfully pulling an attack off, are two different things, though. Risk management and risk awareness are both concepts designed to make life as difficult as possible for an attacker. 

By an entire business engaging in the process of identifying and evaluating potential threats, they can offer organizations a certain base level of protection. While many might question whether these efforts – from not just the security teams – are worth the bother if an attack is ‘inevitable, they might keep organizations just on the right side of a serious incident.

Building risk appetite

Risk awareness and risk management are different things, explains EY’s UK&I government and public sector cyber security lead, Rick Hemsley.

“Whereas risk awareness refers to the proactive measures taken by organizations to educate their employees and stakeholders about potential cyber security risks,” he says, “[risk] management centers around the identification, assessment, and mitigation of potential risks to a company.”

Within these two definitions lie many distinct actions and activities: some technical and some cultural. Among the most important is defining the organization’s risk appetite, ensuring this is understood across the organization, and making sure mitigations are in place that respond to risk appetite. 

Risk appetite is a fundamental element of risk awareness and risk management. You can’t protect against everything. A person leaving their home in the morning might get their pocketbook stolen or there might be a water leak while they’re away. They can insure against loss of credit cards and water damage. But only if they’ve assessed the possibility, and put in place a mitigating strategy. They’ll do neither if they don’t think the risks are worth addressing – which is where risk appetite factors in.

Risk awareness is essential

Risk awareness is arguably the most crucial aspect, says David Adams, Grc security consultant at Prism Infosec. “Risk management won’t be effective if risk awareness is not included as a strategy.” 

Staff entrusted with implementing controls will only live up to expectations if they understand why it’s important to the organization and aware of the risks of not acting. But risk awareness isn’t just something for the tech team to consider. It must be embedded in the thought patterns and working practices across the organization. 

“The risk management strategy may well advise that personnel only work on encrypted personal applications, and in the risk awareness strategy this would be regularly communicated to staff but made relevant to them, perhaps in the form of awareness training,” explains Adams.

Can we measure how effective risk management is?

One of the issues around promoting risk awareness through an organization is it’s not always easy to measure. A risk management strategy of, say, using threat analysis to identify attempted cyber attacks, and showing which attacks are thwarted, can generate data used to demonstrate how effective these systems are and justify spending on them. 

It’s more difficult to measure the effectiveness of risk awareness in this way. An organization can, howeer, test how well its people understand the various risks it’s identified, and measure how they implement approved behaviors. It can ealso nsure that strong systems are in place, for example by implementing a zero trust framework for technology. 

Frequent and overt testing, as well as measuring people’s attitudes towards risk, can itself alienate staff, as can putting in place technology requirements that feel intrusive to actually getting work done. 

The goal should be to guard the organization, not to corral its people. And, in any case, we can’t compare two real-world scenarios – with and without a strong risk awareness strategy in place – to quantify the effect of the strategy.

Does risk management make a difference?

What organizations can do is be aware of the risks humans bring. Last year, the World Economic Forum (WEF) said 95% of cyber security  issues could be traced to human error. 

Normalising appropriate behaviours can help an organization diminish the risk of human error by increasing awareness of the consequences of certain actions – or absence of certain actions. 

The key is for the organization to ensure people feel part of the strategy, not that the strategy is foisted upon them. “A good risk awareness strategy helps create a security-conscious culture across the company, making it more resilient against attacks,” Hemsley tells ITPro. 

Adams puts it another way: “Security is the responsibility of us all and people are now much more conscious of this fact. But when it comes to the individual, relevance is key. It’s vital to make the strategy meaningful to staff.”

In the end risk awareness is a key component of how an organization handles the risks its exposed to. When the organization’s people are aware of these risks, and understand how their individual actions can help – or hinder – the organization in facing up to the very real prospect of attacks, they can play a part in mitigation. 

When cyber attacks are a matter of when, not if, every possible strategy and mitigation that helps an organization deal with its appetite for risk is a strategy worth having, regardless of how much effort it might take to implement.

An IT worker in the UK has been convicted of unauthorized computer access and blackmail after attempting to take advantage of a ransomware attack on his employer. 

Ashley Liles was found to have attempted to blackmail his employer, Oxford Biomedica, into paying a ransom in the wake of a 2018 security breach. 

In February that year, the Oxford-based company suffered a security incident that saw threat actors gain unauthorized access to the company’s computer systems. 

Jurors at Reading Crown Court heard that, during an investigation into the incident, Liles commenced a secondary attack against the company. 

“Liles began to investigate the incident, in his role as the company’s IT security analyst and worked alongside colleagues and the police to try to mitigate the incident,” according to a statement from the South East Regional Organized Crime Unit (SEROCU).

“However, unknown to the police, his colleagues, and his employer, Liles commenced a separate and secondary attack against the company.”

Liles accessed board members’ private emails more than 300 times and altered the original ransom note to change the payment address to his own cryptocurrency wallet.  

Prosecutors said that Liles’ intention was that, if a payment was made, it would be made to him rather than the original attacker. 

The security analyst was also found to have created an “almost identical” email address to the original ransomware attacker and began pressuring his employer to pay the ransom fee. 

However, no payment was ever made and the unauthorized access to private emails was discovered, revealing that the access came from Liles’ home address.

A subsequent investigation by police officers from SEROCU’s cyber crime team arrested Liles in 2018 and conducted a search of his home. 

Although digital devices were seized in the raid, Liles was found to have wiped all data from his devices to cover up his involvement in the scheme. 

“Items seized from his address included a computer, laptop, phone and a USB stick,” SEROCU said. 

“Liles had wiped all data from his devices just days before his arrest in order to try to hide his involvement, however the data was recovered and this provided direct evidence of his crimes.”

Liles initially denied his involvement despite this evidence being found, and did not plead guilty for around five years. 

He is set to return to Reading Crown Court for sentencing on 11 July.

Businesses using ExtraHop’s Reveal(x) 360 can now gain visibility into employees’ use of generative AI tools, thanks to the latest update to the network detection and response (NDR) platform.

The cyber security provider said the functionality will better protect organizations against accidental misuse of AI tools, such as OpenAI ChatGPT, helping them to better understand their risk exposure and whether AI tools are being used in compliance with AI policies.

The move comes at a time when generative AI and AI as a service (AIaaS) tools are being increasingly adopted across the enterprise in a bid to boost productivity. 

However, despite its benefits, ExtraHop CEO Patrick Dennis said customers have “expressed a real concern” about employees sending proprietary data and other sensitive information into AI services.

“Until today, there has been no good way to assess the scope of this problem,” he said. “Amid the proliferation of AIaaS, it’s extremely important that we give customers the tools they need to see what is happening across the network, what data is being shared, and what could be at risk. 

“With this new capability, our goal is to ensure that they can reap the wide-ranging benefits of generative AI while still maintaining data protections.”

AIaaS and generative AI tools have skyrocketed in recent times as users get to grips with the new technology. 

Since its release in November last year, OpenAI’s ChatGPT alone has gone on to amass more than 1 billion users. 

The key issues for organizations that implement these new AIaaS tools revolve around data leaks and intellectual property (IP) risk as employees input potentially sensitive and confidential information into them.

Once proprietary information has been shared, the service will continue to use that data to process future requests from other users, with the AI being unlikely to understand the effects of re-using the data to which it has access.

Reveal(x)’s new functionality works by providing organizations with visibility into the devices and users on their network that are connecting to external AIaaS domains, as well as information on how much data is being shared with these services. 

In some cases, the offering can also detail the type of data and individual files that are being shared.

The platform can do this through its use of network packets as the primary data source for monitoring and analysis, the firm said. 

By using a real-time processor, it turns unstructured packets into structured wire data and analyzes payloads and content from OSI Layer 2-7 for complete network visibility. 

“ExtraHop believes the productivity benefits of these tools outweigh the data exposure risks, provided organizations understand how these services will use their data (and how long they’ll retain it),” the company said in a blog post.

“And provided organizations not only implement policies governing use of these services but also have a control like Reveal(x) in place that allows them to assess policy compliance and spot risks in real time.”

A years-old malicious platform is being used at a vastly accelerated rate by cyber criminals to launch “industrial-scale” email attacks on businesses.

Microsoft publicized the rapid adoption of platforms such as BulletProftLink in a report on Friday, saying the tools are being widely used to carry out highly sophisticated business email compromise (BEC) attacks.

These platforms offer cyber criminals a full-service toolkit for launching BEC attacks, including legitimate-looking email templates, hosting, and automated services for launching attacks.

Microsoft’s report noted the rising adoption of BulletProftLink and its ilk is offering new ways for the underground industry to successfully monetize cyber crime as a service (CaaS).

The company’s Digital Crimes Unit said it has observed a 38% increase in CaaS attacks targeting business email specifically between 2019 and 2020.

How does BulletProftLink work?

There are a number of unique capabilities that make attacks that are being carried out using BulletProftLink’s tools difficult to dissect.

The most notable of these is a trend in attackers evading impossible travel detections.

Many security products have detections for impossible travel that can often identify and neutralize accounts that have been compromised by cyber criminals.

An organization will be aware of the IP addresses used by its office-based workers and those working remotely.

If one worker is known to log in from London regularly, or did log into their account from a London-based IP address one morning, but one hour later logged into the same account from a Hong Kong-based IP address, for example, that would trigger an impossible travel detection.

Security teams would then typically investigate the case knowing a potential cyber attack is taking place. 

That worker could not travel between the two cities in that time frame, meaning some malicious activity is likely occurring.

Armed with BulletProftLink, attackers purchase IP addresses from residential IP services that match their target’s location. 

After creating residential IP proxies localized to their victim’s location, attackers can then launch attacks, masking their real location and avoiding any impossible travel detections.

“Residential IP addresses mapped to victim locations at scale provide the ability and opportunity for cyber criminals to gather large volumes of compromised credentials and access accounts,” said Microsoft in its Cyber Signals report. “Threat actors are using IP/proxy services that marketers and others may use for research to scale these attacks.

“One IP service provider, for example, has 100 million IP addresses that can be rotated or changed every second.”

BulletProftLink also goes a step further from the go-to phishing as a service platforms many cyber criminals flock to, such as Evil Proxy, Naked Pages, and Caffeine. 

All of these platforms offer attackers the capabilities to launch phishing attacks at scale using compromised credentials, but BulletProftLink uses blockchain for its hosting.

This decentralized gateway design, Microsoft said, allows the platform to host phishing and BEC websites in a decentralized way, making it considerably more difficult to disrupt.

Typically, Microsoft and other web security organizations could track and locate the origin of malicious content and take steps to remove the source from the internet.

While each individual phishing link can either be blocked or taken down, tracking down the source on a public blockchain is much more challenging than a typical web2-hosted campaign.

Why is BEC such a threat?

BEC is a type of phishing attack that targets a specific individual, usually a high-ranking worker at an organization with the authority to make large financial transfers

The aim of the attacks is to convince that high-ranking individual to transfer funds into a seemingly legitimate account that’s actually controlled by the cyber criminals.

Microsoft’s telemetry indicates that there were 35 million BEC attack attempts last year, equating to 156,000 a day.

BEC can also lead to the distribution of malware in the form of email attachments. Such malware, as well as convincing email chains without the use of malware, can lead to sensitive or personally identifiable information (PII) being leaked and later used for follow-up scams or extortion. 

“BEC attacks stand apart in the cyber crime industry for their emphasis on social engineering and the art of deception,” Microsoft said. 

“Instead of exploiting vulnerabilities in unpatched devices, BEC operators seek to exploit the daily sea of email traffic and other messages to lure victims into providing financial information, or taking a direct action like unknowingly sending funds to money mule accounts, which help criminals perform fraudulent money transfers.”

The prevailing fear is that attacks are not only getting more sophisticated and more frequent, but tools like BulletProftLink are allowing for such attacks to be performed at greater scales, increasing the difficulty involved in detecting and disrupting them.

Microsoft’s recommendations are to maximize email security settings. Flagging all messages from external parties, enabling notifications for unverified senders, and blocking senders with identities that can’t be verified. 

Lowering the risk tolerance for impossible travel can also help. It’s not uncommon for workers to take their devices and work from a coffee shop at some point during the day, for example. 

Such a trip could be allowed under standard configurations but given the rise in these attacks, it could make sense to restrict movement even further from the main working location.

Enabling strong authentication such as MFA or passwordless passkeys can make compromising email accounts much more difficult for attackers and is seen as a must-have security measure for all sizes of organizations. 

Training employees to spot these kinds of attacks can also be beneficial, leading to manual flags that can then be triaged by the IT admin or security team.

Identity-based cyber attacks are an increasing weapon of choice the more we work in a world increasingly reliant on identity-based authorization. This means, in essence, stealing or faking our passwords or other login credentials. 

In response, organizations are adding new layers of authentication, which, inevitably, cyber criminals work to find ways through or around. In this cat-and-mouse game, identity-based attacks are on the rise, and organizations must implement several measures to defend themselves from these.

Identity-based cyber attacks are a growing threat

Hacking into computer systems is as old an activity as computer systems themselves. But the attack surface is wider than ever before; there are more systems around, storing more data about individuals and organizations, offering more potential for exploitation. 

“With so much more personal information now online, companies, institutions, infrastructure, and even democracies are being maliciously targeted by actors wishing to exploit it,” Del Heppenstall, partner and head of cyber at KPMG in the UK tells ITPro.

It’s people that are most often the source of a data breach. The 2022 Verizon Data Breach Investigations Report found 82% of data breaches involve the “human element”. That human element can be through sheer malevolence, such as social engineering attacks, of course. But more often than not, it’s a simple incident of human error, such as people falling prey to fake SMS messages, succumbing to a phishing exercise, or reusing common passwords across personal and professional logins. Mistakes are inevitable – after all, we are only human – which is why zero trust strategies are important. 

“Adversaries can easily launch high-volume password spraying where they only need to be right once out of millions of attempts,” former BP CISO, Simon Hodgkinson, says. “Similarly, with high-volume phishing attacks, all it takes is one person to click on the link and provide their credentials. The defenders on the other hand need to be right 100% of the time.”

Guarding against the inevitable

Not only do the attackers really know their business, they’re pushing hard and faster. The Microsoft Digital Defense Report 2022 notes the volume of password attacks has risen to an estimated 921 attacks every second. That’s a 74% increase in just one year.

So what is an organization to do? Hodgkinson tells ITPro: “One must be pragmatic. Cyber risk cannot be eradicated. Organizations can only put in place mitigations aligned to their risk appetite and have robust response plans in place. Every organization should assume that they will be compromised at some point.”

In this context, organizations must put security front and center. For Heppenstall, the security-first approach that most organizations now take can be strengthened by moving to an identity-focused approach. 

He mentions features like least privilege, enhanced monitoring, threat analytics and controls, the establishment of communications guidelines both internally and with external entities and individuals, and continuous validation of end-users including internal, contractors, and third parties. He also suggests “keeping proactive and reactive risk management capabilities around identity and access management, then integrating it with business and security needs will be key to handling threats”.

Taking a nuanced approach to tightening the net

For Kevin Curran, IEEE senior member and professor of cyber security at Ulster University, organizations can fall short if they don’t understand the difference between identity management and authentication. 

It’s crucial to “establish how roles are identified in a system and how they are assigned to individuals”, he tells ITPro. This means “security teams need to pay attention when removing, adding, and updating individuals alongside their roles in a system”. 

“There needs to be a sensible allocation of levels of access to individuals or groups of individuals,” he continues. “Only then can security teams assume that they have established a ‘foundation’ of protecting the sensitive data within the system and securing the organization itself.”

Best practice isn’t only about technology: there are cultural and process factors to take into account too. Hodgkinson gives ITPro a strong example of how cultural shift has helped other industry sectors with different issues.

“The airline and oil and gas industries dramatically improved safety by embracing a culture of ‘speak up’,” he explains. “When there was an accident or a near miss, people were encouraged to share. This led to a culture of continuous improvement in safety. A similar approach is required in cyber – let’s encourage people to report and share their learnings.” 

What would this look like in practice? “If one user clicked on a phishing link, they should share why so others learn from it,” he adds. “This will require organizations to positively support employees who have made a mistake.”

All in all, it would seem that organizations must accept the inevitable and assume attacks will happen. They must also understand that their best mitigation is not solely a matter of best technology practice. It’s also about organizational culture, accepting that people are fallible, and providing a culture of support and learning in that context.

Zero trust strategies are one in which nothing and nobody can use an organization’s digital resources without being verified. This isn’t just about verification upon entry into the system, but also when individuals are moving around within the system.

Such a strict regime is required because a cyber criminal or an automated agent might breach a system and move about freely within it if, once inside, there were no verification checks. Zero trust has, therefore, become a gold standard for cyber security in today’s enterprise landscape. 

Implementing zero trust requires a root and branch examination of the entire technology estate. The organization needs to identify its vulnerabilities, both technological and human, and figure out how to best plug the holes. This should be done in the context of minimal disruption to everyday workload, and an understanding that zero trust is not a one-time fix but an evolving idea. 

Implementing such a regime, however, isn’t without its potential pitfalls and pain points. It’s a time-consuming and complex process that requires input from many roles across the organization, as well as external expertise. 

1. Failing to look beyond the corporate network

When hybrid working is the norm, people will be using all manner of locations to work including their homes and public networks. Everything is part of the attack surface and the organization should trust nothing. Every endpoint is a potential vulnerability. 

This also, by the way, includes devices that might sit outside the network such as printers, security cameras, and other Internet of Things (IoT) devices.

A thorough audit of devices will be required before work begins, with a strategy in place to protect each device and to ensure that each device is updated as regularly as needed. 

2. Implementing zero trust too quickly

Implementing a Zero Trust approach might require significant changes to technologies and also to how people go about their daily business. Go too fast and it’s easy for mistakes to happen. Single devices or applications might slip through the net of compliance assurance at the time of implementation or later. Security hygiene – ensuring that all hardware and software is up to date and patched – is a central aspect of zero trust.

Ensuring every piece of hardware and software is known and its security can be optimized at all times takes time. It is important to allocate enough time to managing everything from the outset, and to develop processes for ensuring existing and new acquisitions are accommodated going forward. 

3. Ignoring the principles of least privileged access

Least privileged access refers to the policy of ensuring users only have the bare minimum permission level to do what they need to do. It’s designed to keep access to resources tightly controlled and prevent the kind of sprawling access through systems that can be most helpful to bad actors. 

However, it can be difficult to implement, particularly in the case of multi-cloud environments in which data and apps are hosted with different providers, each with different policies and security protocols. In the end, budget, available time, and sheer workload can mean in-house teams assign wider privileges than necessary.

Using a class of software called entitlement management, or cloud infrastructure entitlement management, access to a multitude of software, systems, devices, and cloud platforms can be managed centrally. 

4. Failing to focus on users

An organization’s employees are not the only stakeholders it’ll have to work with. There may also be contractors, suppliers, purchasers, delivery partners, and others. Presenting users with new protocols, hoops to jump through, and processes – without understanding whether these are seen as barriers – can cause resentment and foster non-compliance strategies. Users who work around security protocols are users who create risk. 

High-quality user education on how to achieve compliance with security protocols is only part of the solution. People must also understand why certain behaviors are required, and be comfortable with any required actions or approaches. Creating a ‘culture of security’ across the organization takes time, effort, and leadership – from chief officers, senior managers, and line managers. 

5. Assuming zero trust is bought into by default

Every organization is different. Its technology setup will be unique. How people use technology will vary too. Where its people work will vary too, including in-office, remote or hybrid, one city, with national offices, or multinational. The variables are many and complex. While certain principles and approaches apply to zero trust, their implementation in any one organization will be unique. Simply going to a vendor and expecting them to do everything without any input is a fallacy.  

Organizations need to commit their own staff resource to work alongside vendors and understand that the implementation of zero trust will take time. This is and will continue to be an ongoing process.

With cyber attacks showing no signs of slowing down, and with organizations of all sizes and in all markets potentially vulnerable, securing data and networks is paramount. It’s no longer adequate to take a piecemeal approach to this challenge. A zero trust approach can help an organization implement a risk-based strategy toward data security. It isn’t without pitfalls, and organizations should be alive to these, and willing to commit the time and energy required to work them through. 

Search engines pushing malware to users continue to be one of the most pervasive cyber security threats facing organizations around the world.

Netskope’s 2022 Cloud and Threat report found that nearly 10% of all malware downloads in Q1 2022 were referred from search engines. 

Downloads of malicious software “mostly resulted” from weaponized data voids, or a combination of search terms that specifically appealed to business web users, the study found. 

Data voids occur when there is a lack of clearcut information available on search terms found in Google. Netskope said this means that content matching certain terms appears “very high in search results” - which in turn appeals to threat actors targeting certain users. 

The research revealed that threat actors are increasingly relying on malicious web content to target users by developing finely-catered websites spanning a range of categories, such as business, marketing, technology, education, and retail. 

These websites are often developed and populated in a patient manner by attackers to ensure they appear legitimate and dupe unknowing users. 

“Attackers have been populating their websites with enough content to make them seem legitimate, and only using them to host malicious content after they have been around long enough to blend in,” the report stated. 

“They have also been abusing free hosting services and compromising existing websites to deliver malicious content.”

Netskope’s findings on malvertising align with previous research into this attack method, which has surged in popularity among threat actors in recent months. 

An investigation by Bitwarden in January found that the volume of fake ads promoting malicious software and websites impersonating popular brands has increased markedly over the last year.  

Similar research from HP Wolf Security’s threat research division observed a surge in malvertising across 2022. 

In a blog post in January, the security firm warned that businesses were facing a significant volume of malicious websites aimed at compromising user accounts and targeting operations. 

“In the last two months, we’ve seen a significant increase in malware distributed through malvertising, with multiple threat actors currently using this technique,” researchers said.

The rise of malvertising has reached such a point in the last 12 months that researchers have raised questions over Google’s handling of the issue.

In a January Twitter thread, security researcher Will Dormann questioned why VirusTotal, which is owned by Google, was not being used to automatically examine sponsored links for malware. 

Dormann’s criticism followed an incident in which a popular crypto influencer fell victim to a malicious OBS link promoted in Google Search results. 

Social engineering risks still acute

Malvertising represents “just one of many” social engineering techniques frequently employed by threat actors, the Netskope study warned. 

In addition to leveraging search engines, attackers still focus heavily on targeting users via email platforms, collaboration apps, and chat applications to dupe victims. 

The study noted that the two most prevalent forms of malware still harnessed by attackers include Trojans, which accounted for 60% of all malware downloads in Q1 2022, and phishing downloads, which accounted for 13% of all incidents.

“Phishing scams, credit card skimmers, exploit kits, and other malicious web content continued to rise in 2022,” the report stated. 

“Compromised sites, sites created using free hosting services, and fake websites hosting seemingly legitimate content have helped attackers disguise malicious web content, making it difficult to filter malicious content using URL categorization alone.”

“The rise in cloud malware delivery and malicious web content underscores the importance of inspecting all content, from all destinations, for both web and cloud.”

Cloud apps placing users at risk 

Malware delivery via cloud applications remained a key point of concern, the study found. 

Over the last year, cloud malware delivery increased significantly, with malware downloads occurring from more than 400 cloud apps. 

Microsoft OneDrive remained the most popular weapon of choice for threat actors in this regard. 

However, Netskope observed a marked increase in the popularity of Google Cloud Storage, which saw “significant increase in usage as it gained popularity for object hosting across the web”. 

To mitigate rising malware threats, Netskope recommended that organizations deploy “multi-layered, inline threat protection” for cloud and web traffic.

In doing this, businesses can prevent inbound and outbound malware communications.

Similarly, it advised implementing “real-time coaching” for users to ensure safer app alternatives and to monitor unusual activity. 

Google Cloud has unveiled a raft of new generative AI tools that will provide security practitioners with detailed insights into how their organization could be breached. 

Announced at the RSA conference, the Google Cloud Security AI Workbench is described as an “industry-first extensible platform”, powered by a specialized security-specific large language model (LLM) known as ‘Sec-PaLM’.

“This new security model is fine-tuned for security use cases, incorporating our unsurpassed security intelligence such as Google’s visibility into the threat landscape and Mandiant’s frontline intelligence on vulnerabilities, malware, threat indicators, and behavioral threat actor profiles,” said Sunil Potti, VP of Google Cloud Security. 

Security Command Center AI 

A key feature within this announcement is the launch of Security Command Center AI, a premium version of Google Cloud’s existing Security Command Center service which is integrated within the new AI Workbench. 

Google said this can provide security operators with “near-instant analysis of findings and possible attack paths”. 

This enhancement to Security Command Center Premium could help organizations: 

The inclusion of AI-generated explanations for attack paths and methods could prove vital to security practitioners, Potti said. 

It’s said they can provide easily-digestible information in real time to reduce toil on operators and greatly enhance their ability to react to ongoing security incidents. 

“Security Command Center will translate complex attack graphs to human-readable explanations of attack exposure, including impacted assets and recommended mitigations,” he said. 

Potti added that this will also provide AI-powered risk summaries for security, compliance, and privacy findings for Google Cloud. 

Cloud security for ‘non-specialists’ 

A key message Google Cloud pushed during its address at RSA was that by embedding generative AI into cloud security operations, it believes complexity will be greatly reduced.

Google said that the integration of Security Command Center features and the new AI Workbench will empower “non-security specialists to handle security tasks that were previously out of reach due to lack of specialized knowledge”.

This could represent a marked shift in how organizations handle cloud security, opening up responsibility to a wider range of practitioners and alleviating stress on frontline security operators, the company said. 

“Security Command Center Premium can discover, identify, and recommend remediations for hundreds of cloud misconfigurations, software vulnerabilities, and external threats,” Google Cloud said in a statement.  

“Integration with Security AI Workbench will provide straightforward explanations of findings so security and non-security specialists can help keep their organization safe.” 

AI-generated summaries coming through Command Center Premium will, once again, aim to offer easily-digestible answers to key security questions, tips on remediation for ongoing incidents, and assess security risks within cloud environments.  

Generative AI in cyber security 

The rollout of generative AI security tools by Google Cloud follows the launch of Microsoft’s Security Copilot last month, and once again pits industry heavyweights Microsoft and Google against each other in the ongoing generative AI contest. 

Microsoft Security Copilot uses GPT-4 generative AI to provide users with prompt-based security detection and remediation functionalities, and was met with great excitement upon launch. 

However, while Google appeared to have been ‘beaten to the punch’ by Microsoft with the Copilot launch, the integration of generative AI security tools within Google Cloud - a key service for the tech giant - could mark a significant tipping point for the company in an increasingly competitive cloud landscape. 

Sweden-based cyber risk management specialist Outpost24 has announced the appointment of Brendan Hogan as its new chief strategy officer (CSO).

A former VMware executive, Hogan brings more than 20 years of experience to the role and will spearhead the company’s M&A strategy, corporate development, as well as alliance strategy.

As CSO, he is tasked with driving long-term product strategy, scaling operations to support further growth opportunities, and seeking expansion across new global markets.

In an announcement, Outpost24 emphasized Hogan’s expertise in strategic planning, in organic growth, and deal execution, having previously led and advised on more than 50 global M&A deals, totaling $30 billion. 

“Brendan is an exceptional strategist and operator with deep industry experience, we at Outpost24 are thrilled to bring his valuable expertise onboard,” said Karl Thedéen, CEO at Outpost24. 

“He will have an instrumental role in our continued development which will see a positive change in strategy to help us deliver our goals and cement us further as a serious market player within cyber security.”

Prior to joining Outpost24, Hogan was vice president and head of strategy and corporate development for Massachusetts-based cyber security firm Carbon Black, which went on to be acquired by VMware. 

Post-acquisition, Hogan continued to lead strategy across VMware’s security portfolio, with partnerships and acquisitions being a key focus.

He was also senior director for strategy, mergers, and acquisitions at KPMG, and served as part of the strategy and corporate development executive team at VeriSign.

“I’m delighted to have joined Outpost24 at an exciting time,” Hogan said. “Over the past year, they have made big moves within the industry, and I am eager to continue to accelerate the business growth and further enhance our product innovation through strategic acquisitions that will support our customers who want to reduce their cyber security risk.”

Based in Kariskrona, Sweden, Outpost24 provides vulnerability management, application security testing, threat intelligence, and access management via its unified security platform. 

The offering’s user base has grown to include more than 2,500 customers across 65 countries. 

Back in July 2022, Outpost24 revealed it had been acquired by private equity firm Vitruvian Partners and underlined its goal of further international expansion.

Last month, the company also announced the appointment of Ola Burmark as its new chief financial officer (CFO), replacing Jonas Alfredson. 

Burmark most recently served as CFO at telecommunications and cyber security firm ENEA Group and has previously held CFO positions at various Nasdaq Stockholm listed companies. 

“Under the new ownership of Vitruvian Partnerships, the growth and expansion seen over the past year has been exciting,” Thedéen said at the time. 

“Ola’s business acumen and strategic financial vision will benefit us greatly as we continue to seek out new opportunities and meet the demand for cyber security in this digital economy.”

The recent acceleration in the artificial intelligence (AI) space represents a “tectonic shift” in DevSecOps and could herald a new era of efficiency and productivity for software developers, according to GitLab chief product officer David DeSanto. 

DeSanto notes generative AI developments have been a source of great excitement across the global tech industry, he tells ITPro at KubeCon 2023, not least of all in software development and cyber security. 

Within days of ChatGPT’s launch last November, devs the world over were fawning over the prospect of harnessing the tool in their daily workflows. The ability to generate and even test code proved tantalizing and appeared to be the silver bullet many had dreamt of. 

How AI can power software development

DeSanto believes the industry is currently “at the precipice” of a revolution with regard to the practical implementation of AI within the software development lifecycle. That’s not to say AI or machine learning isn’t already being used in this regard, but the scale of potential is highly evident across the ecosystem. 

This potential for improved productivity comes amid a period of troubling macroeconomic conditions that are prompting tightening purse strings and placing a strain on already stretched workforces. Simply put, AI tools could make or break how well teams work moving forward.

“I’ve been calling it a tectonic shift in how DevSecOps is done,” he says. “ The reason I feel that way is that there are still many companies who struggle to get a large enough workforce to support what they want to do.

“If you can make your existing team members more effective, then you also make them more engaged, and by making them more engaged, they’re more likely to stay. You are now building a retention component within how you support your team.” 

DeSanto points to code suggestions as an example, noting an AI-based support functionality within the development process could deliver significant benefits to both individuals and broader teams. 

Last week, GitLab announced it had moved its own code suggestions functionality into open beta. The signs so far are promising, with indicators it’s led to efficiency gains as well as improving both quality of life and quality of performance among developers. 

“Now you could have an intermediate developer, for example, functioning and performing like a senior developer,” he suggests. 

Other potential use cases, such as leveraging AI to identify vulnerabilities, would also drastically improve efficiency throughout the development lifecycle and help streamline a notable pain point in the process. 

“Those sorts of things are going to make everyone more effective, but also as a team, as a company. One of Gitlab’s core tenets is that everyone can contribute. You’re truly going to make it everyone can contribute if you apply AI properly.”

How to implement AI in DevSecOps

GitLab’s own research correlates with what DeSanto tells ITPro about the increasing use – and potential – of AI tools in DevSecOps. 

The company’s annual Global DevSecOps report, published today, finds nearly two-thirds (65%) of developers are now using AI or machine learning in testing processes, or expect to be doing so within the next three years. 

Similarly, 62% of developers told the company they use AI or machine learning to check code. DeSanto notes, this marks an increase from 51% last year. This, he says, highlights the fact developers view AI as a valuable tool within their proverbial kit. 

DeSanto was keen to emphasize there are certain nuances within this shift in appetite toward AI tools, though. While research shows a notable increase in interest, he believes seniority plays a role in how receptive developers or security personnel may be toward this trend. 

“It depends on the maturity of the developer in their career, or on their skillset in terms of the true impact [of AI tools],” he says. “A lot of the time, when it comes to improving developer productivity we see it tends to be newer developers who are getting almost like a coach to support them.

“But developers who are mature don’t have that same big thirst. They view it as a way to get things done faster and spend some of that saved time in code reviewing.”

DeSanto also suggests for teams seeking to leverage AI tools, it isn’t a case of deploy and relax. Deployment requires a concerted effort and razor-sharp focus across the enterprise to maximize the use of AI, else it’ll merely amount to a poorly harnessed stack of tools that add little value. 

“For AI to be effective, and for everyone to be effective as a result of this, it can’t just be applied to one part of the software development lifecycle,” he continues. “This is not just the developer, it’s everything involved in delivering software.

“GitLab is an enterprise DevSecOps platform, so obviously we’re focused on covering the entire development lifecycle. In our opinion, you can’t just apply AI to the developer experience and to developer efficiency, you’re not solving the whole problem.”

Australian cyber security services provider CyberCX has announced the appointment of Phil Mason as its new CEO in the UK. 

By appointing a new CEO in the UK, the company says it is now looking to replicate its success and growth on UK shores.

A seasoned industry veteran, Mason brings two decades of cyber security experience to the role, having previously held senior positions at IRMSecurity, part of the Capgemini Group. 

There, he led cyber transformation strategies for influential public-sector organizations and global enterprises.

As CEO of CyberCX’s UK business, Mason will work to drive growth in the UK market, focusing on supporting new business and talent acquisition. 

The firm said the appointment will ensure a “consistent, global approach” that is also tailored to UK-specific needs. 

“CyberCX has burst onto the global cyber security scene, and I am thrilled to be leading the UK business to replicate the success it has seen in Australia,” Mason said. 

“With cyber threats becoming increasingly complex and frequent, there has never been a more important time to safeguard businesses against cyber security threats. 

“I look forward to leading our UK team in helping our clients navigate this complex landscape and stay ahead of the curve.”

Formed in 2019, CyberCX has grown to become a prominent name in the cyber security space across Australia and New Zealand. 

The firm specializes in the provision of cyber security and cloud services, partnering with organizations to manage their cyber risk, respond to incidents, and build resilience.

Since its inception, CyberCX has grown its workforce to more than 1,300 cyber security and cloud professionals and has offices in Australia, New Zealand, the US, and the UK. 

The firm partners with both private and public sector organizations, providing end-to-end cyber capabilities, and helps customers securely accelerate their digital transformation strategies. 

With Mason as the new UK CEO, CyberCX said it is well-positioned to meet the growing demand for security services as threats continue to escalate. 

“Phil’s extensive experience and track record for growth in revenue and services, combined with his dedication to customers and building high-performance teams, make him the ideal person to lead our operations in the UK,” said John Paitaridis, CEO at CyberCX. 

“We look forward to working with him to become the UK’s leading independent provider of cyber security.”

Microsoft’s April 2023 Patch Tuesday delivered not just the usual score of security fixes for Windows admins, but also a new feature that has attracted criticism from the IT community.

The Windows 11 22H2 KB5025239 cumulative update, among other fixes and features, delivers the new Windows Local Administrator Password Solution (LAPS) to IT teams managing both on-prem and cloud environments.

Microsoft LAPS manages and backs up local admin account passwords on Azure Active Directory-joined devices. 

It’s seen as one of the most secure ways to ensure unauthorized users aren’t able to access things they’re not supposed to.

The new LAPS is available for Windows 10&11 Pro, EDU, and Enterprise versions, as well as Windows Server 2022, Windows Server Core 2022, and Windows Server 2019.

LAPS for Azure AD is not yet available. It’s now bundled into Microsoft Entra - the name given to Microsoft’s identity and access products that can be managed through a single portal.

The Azure AD version of LAPS is expected to go from private to public preview “later this quarter,” said Jay Simmons, development lead at Microsoft, and will deliver new features such as password encryption, password histories, an emulation mode, and automatic rotation.

“Windows LAPS is a huge improvement in virtually every area beyond Legacy LAPS,” he added.

Online IT admin communities have not greeted the news as warmly as expected.

The main issue among these communities relates to concerns over how to migrate. 

The new LAPS feature has been released but Microsoft has not supplied the community with any documentation detailing how to complete the migration.

Some professionals have already encountered issues where the new LAPS has stopped working due to nuances in the migration process. 

The prevailing advice is to stop deploying the legacy LAPS MSI immediately after the April Patch Tuesday update is applied. 

Failure to do so reportedly breaks the new LAPS and prevents legacy LAPS from updating passwords.

“You need to update documentation and guidance very soon,” one user told Simmons in an online discussion.

“I hate spending my day discovering something that is about to hit 100,000 of our machines doesn't have guidance, and we have to action something,” they added.

“If migration docs aren’t available yet, [why] was this released,” another asked. “This tells me that documentation, upgrades, and coexistence, were not given any priority - which is bloody shocking but given how Microsoft pushes stuff out the last few years, I suppose it really shouldn’t be any more.”

Simmons responded to users by saying that he “should have been better prepared” to allay the global community’s concerns.

“New Windows LAPS has been designed to be an almost entirely opt-in feature, using a separate brand new GPO policy and separate brand new AD schema attributes, which – at least to my Microsofty-mind – mostly mitigates the risk of applying the patches to existing environments,” he said.

“But regardless yes we should have preemptively called this out in the post so as to not scare folks.”

Error-strewn Patch Tuesday releases are becoming something of a commonality from Microsoft, with the monthly updates often presenting major issues for IT teams.

Most recently in last month’s March Patch Tuesday updates, IT admins complained about a variety of problems after installing patches for an Outlook zero day.

Windows 10 users were hit with the infamous blue screen of death after installing December’s updates, and around a year earlier IT admins were forced to ignore the security fixes for a month as a result of the rampant issues reported by the community.

April 2023 Patch Tuesday Summary

Microsoft’s April 2023 Patch Tuesday brought fixes for 97 total security vulnerabilities including seven critical-rated flaws and one zero day that’s been actively exploited by a ransomware group.

Tracked as CVE-2023-28252, the privilege escalation vulnerability in Windows Common Log File System (CLFS) Driver grants SYSTEM-level privileges if successfully exploited.

Kaspersky identified exploit attempts dating back to February 2023 that it said were very similar to other types of exploits it had been tracking. 

The team investigated and discovered that it was a zero day affecting different versions of Windows, including Windows 11.

The Nokoyama group is described as “sophisticated” and used a newer version of its ransomware payload, which has historically been a rebranded version of JSWorm. Now written in C with encrypted strings.

In previous attacks, Nokoyama has also deployed the Cobalt Strike penetration testing tool to evade antivirus products, and a custom modular backdoor called Pipemagic in other attacks.

Kaspersky said it believes “CVE-2023-28252 could have been easily discovered with the help of fuzzing” - a technique that sees automated injections of invalid or unexpected inputs into a target system to reveal security vulnerabilities.

It said that the clfs.sys driver extensively uses try/catch blocks to handle exceptions, so code continues to execute as if no errors were thrown. 

Kaspersky’s analysis showed that a possible access violation that follows after the vulnerability is triggered was masked by one of these exception handlers, and because there was no crash, fuzzers were most likely ‘finding’ the vulnerability but not reporting it as a potential issue.

April 2023 Patch Tuesday breakdown

This month’s 97 security fixes slightly exceeded March’s total of 83, with the overall count not including the 17 Microsoft Edge issues patched on 6 April.

All seven of the critical-severity vulnerabilities were remote code execution (RCE) flaws.

The two most serious of which, CVE-2023-21554 and CVE-2023-28250, affecting Microsoft Message Queuing and Windows Pragmatic General Multicast (PGM) respectively, both scored a near-maximum 9.8/10 on the CVSS v3 severity scale.

Four RCEs were also found in Microsoft Office, Microsoft Word, and Microsoft Publisher, and were exploitable by opening malicious documents.

All four were categorized under “exploitation less likely” by Microsoft. This classification is designated to vulnerabilities for which attackers would either have difficulty writing the code, require expertise and/or sophisticated timing, or would experience varied results when testing the vulnerable target.

These flaws are also not recently exploited in the wild but given the potential impact of successful abuse, the vulnerability warrants an update regardless.

The full breakdown of the vulnerabilities’ types can be found below:

• 45 remote code execution
• 20 elevation of privilege
• 10 information disclosure
• 9 denial of service
• 7 security feature bypass
• 6 spoofing

Microsoft's full dashboard of the month’s updates can be found on its website.

If you ask IT professionals what their top concerns are, security will certainly be among the top five. Whether it’s preventing ransomware attacks, regular patch management or trying to ensure users don’t click risky links, cyber threats are always lurking in the background ready to cause a crisis.

While the idea of hackers trying to brute force their way into systems may make for better TV, internal threats – be they actively malicious internal actors or employees falling for phishing attempts – are a far more common attack vector.

According to a report from Kroll published in November 2022, insider threats are actually increasing, making up close to 35% of unauthorised access incidents recorded in the third quarter of the year. The company also noted an uptick in credential theft, particularly via ‘smishing’.

One mitigation often put forward is increasing understanding and ‘buy-in’ from employees across the breadth of an organisation. What this actually means, however, can be hard to pin down, let alone implement.

Members of the IT Pro Network have come together to discuss exactly this problem and whether there really is a solution to effective security training for all.

Cyber security starts at home

“Something I have done in the past which has worked.... Don’t look for buy-in for cyber security at work,” says Mark Evans, interim information technology director at construction firm Tilia Homes. “Teach people how to protect their children, their bank accounts, their car insurance, their NHS information, their banking details – those learned behaviours will come back into the business.

“People need to be aware that they have a responsibility to themselves to protect their data and that gives them all of the context they need in order to develop good cyber hygiene.”

Paul Watts, distinguished analyst at the Information Security Forum feels the same, adding that making the conversation less ‘corporate’ can help people actually focus on what’s being said.

“When I was CISO at Network Rail, I borrowed a whole primary school year group. They came in and helped me get people talking about staying safe in cyber space. That was a great day and the business was much more receptive to a conversation with no corporate agenda (although the health and safety prep was hard work),” he says.

For some organisations, this marriage of cyber security at work and cyber security at home is easier to bring together. Peter Donlon, group CTO at online greeting cards business Moonpig, says: “One of the more successful approaches for me has been educating the company on what it is we need to protect and bring to life the consequences of not doing so. In our case holding millions of people's personal photos, messages to loved ones, addresses, etc.

“When you highlight what it is we're all trusted to look after and what the consequences of breaking that trust are, I've found it becomes easier to educate people on how they need to play their part.”

Speak softly and carry a big stick

While it’s good to be understanding and wish to educate, there’s only so far this attitude can go if someone is unwilling to cooperate or participate in an organisation’s cyber security strategy.

“You need to do everything you can to educate people of the importance, and constantly remind people,” says Gerard McGovern, director of digital strategy. “I like the idea of centring it on activities out of work that will then permeate into the workplace, but it must be backed up with consequences. If reception let someone into the office without checking ID, there would be consequences. The same must be true with cyber.”

Watts makes a similar observation, adding: “We've gone out of our way to demystify technology and make it more accessible without educating people on the risks.

“I do wonder sometimes whether that is on us as a community of practice; you don't give someone a car and expect them to know how to drive it without giving them some tuition first.”

A generational divide

IT leaders are often faced with the challenge of different age groups being more adept with technology, depending on when digitisation became part of their lives. For the baby boomer generation, computers arrived relatively late in their career. Many were in middle age by the time there was a computer on every desk, with the internet becoming ubiquitous even later.

For the younger members of generation X and the older millennials – once shorthand for ‘young people’ – computers have been around in some form or another for most of their lives. They still remember a world before the internet, however, which crept into schools, universities and workplaces when they were in their teens and twenties.

Now, it’s generation Z, often given the moniker “digital natives”, who are entering the workplace and shaking things up, having never known a pre-internet, pre-PC world.

Yet while these younger generations may be more tech savvy, they’re not necessarily more knowledgeable when it comes to cyber security.

“Yes, younger people who have grown up with technology are generally more familiar with digital apps and devices and may be more comfortable using them,” says Craig York, CIO at Milton Keynes University Hospitals NHS Trust. “However, being tech-savvy doesn't necessarily equate to being more aware of cyber security concerns. The younger generation at my organisation are perhaps more lax about cyber security than their older counterparts.”

In Watts’ experience, not only are younger people no better at cyber security than their older counterparts, they bring a whole new wave of challenges.

“You've only got to look at the herd mentality when following a trend on social media, a new (unproven) app that an influencer shoves down their throats, they will literally do anything for 'likes' and, of course, FOMO [the fear of missing out],” he says.

“I always thought the young would … pay more attention to their digital persona and footprint. I'm being proven very wrong there.”

The team behind the Kali Linux project has released a brand-new version called Kali Purple, designed specifically for defensive security practitioners - a first for the project.

Kali Purple was released as a technical preview this week and marks the first time the platform has catered to defenders, previously being used as a tool for red teamers and penetration testers.

As of now, Kali Purple is a proof of concept distro for security testing, described by Kali as a “reference architecture for the ultimate SOC In-A-Box”.

It will allow teams to engage in internal wargames, learn how to protect small-to-medium-sized IT environments, and practice threat hunting, among other activities.

The name references the addition of blue and purple team capabilities to Kali Linux’s existing suite of red team testing tools, expanding the distro from its offensive testing pedigree to encompass the entire security testing spectrum.

More than 100 defensive tools are included within Kali Purple. These include CyberChef, which can encrypt or decrypt data as well as compression and data analysis, Elastic’s security information and event management (SIEM), and the open source network intrusion detection system Zeek.

Kali Autopilot, a script builder for automated attacks is also included in Kali Purple. Through a community hub developers will be able to share scripts for blue teams to go up against, as well as practice packet captures to train in network analysis.

The developers outlined their goal of making Kali the best Linux distro for security tests, and expanding enterprise-grade security to all.

“Remember what we did a decade ago with Kali Linux? Or with BackTrack before that? We made offensive security accessible to everyone,” Kali wrote in its blog post.

“No expensive licenses required, no need for commercial grade infrastructure, no writing code or compiling tools to make it all work… just download Kali Linux and do your thing. We are excited to start a new journey with the mission to do exactly the same for defensive security: Just download Kali Purple and do your thing.”

Kali Purple has been structured around the National Institute of Standards and Technology’s (NIST’s) five functions as outlined in the Cybersecurity Framework: “identify, protect, detect, respond, and recover”.

In addition to the announcement of Kali Purple, the firm highlighted eight new tools included in Kali Linux 2023.1.

These include the aforementioned Cyberchef, as well as packet capture system Arkime, DevSecOps and vulnerability management tool DefectDojo, network scanner Dscan, Kubernetes package manager Kubernetes-Helm, password analysis and cracking kit 2 (PACK2), pen test data management tool RedEye, and cryptographic algorithm interface Unicrypto.

The update also brings a visual refresh to the distro, with new wallpapers and Kali Purple themes, as well as a new tiling and widget system with the introduction of the graphical workspace environment KDE Plasma 5.27.

Kali Purple is available as a pre-launch technical preview now, with a dedicated Discord server and wiki. Further details on its full launch are expected in the future.

It’s been just over eight weeks since Jason Loomis took the reins as Freshworks CISO, and the seasoned security veteran is relishing the opportunity to lead one of the most dynamic cyber security teams in the software industry.

Arriving at the firm in late November, Jason joined after serving as CISO at California-based SaaS company Mindbody for nearly four and a half years, where he played a key role in building a robust security programme and scaling the security function.

While Loomis notes he was sad to leave a company with which he’d established a long-term emotional connection, he says the time was right to embark on a new challenge. “It’s almost heart-breaking leaving when you’ve built something so great with a team so strong,” he tells IT Pro. “ I will always love the team that I built at Mindbody. But I did what I wanted to do, and so, I was looking for a new opportunity.”

The first 100 days is like ‘drinking from the fire hose’

Jason boasts a wealth of experience in the cyber security industry. Prior to his time at Mindbody, he served as CISO at TechStyle Fashion Group, the company behind notable brands such as Fabletics, Savage X Fenty and Kate Hudson’s yoga wear line.

This breadth of experience appears to have embedded a deep appreciation for continuous learning and understanding the varied and acute requirements of security teams. Since joining Freshworks, he says he‘s continued in this vein.

Still within his first 100 days as CISO, a period often described as a ‘drinking from the fire hose’ experience by security professionals, Jason says he’s relished the opportunity to take a step back. He’s learing how the Freshworks security apparatus operates and is gaining a deeper understanding of the unique challenges the company faces.

Thus far, he seems impressed. Freshworks boasts a mature security function, which he admits is quite a contrast to his previous role building a team and scaling operations. “At my previous company, I partially had to build a team. But here I’ve got a fully functioning team,” he explains.

“For me to come in and make changes would be like coming into the Avengers and telling them ‘hey, why don’t you try things this way’ – I literally inherited a bunch of superheroes and there’s not a single person out of a team of close to 70 that isn’t a rock star.”

“For the first 100 days, it’s a lot of shut up and listen, learn and absorb. I try not to even make decisions in the first 100 days,” he adds.

This initial bedding in period has also given Jason room to breathe, observe how his teams function, and to embed his own leadership style, which he describes as being highly collaborative and democratised.

“Every single decision that’s made is a team decision,” he says. “How my teams make decisions are more important that the decisions themselves. I never make a decision on my own, so it’s a group effort. And while I’m ultimately the quarterback and I’ve sometimes got to make a call; I’m always asking everyone on the team for their input. Everyone has a say.”

Getting the basics right

In leading a sizeable security function, Jason says this role gives him the opportunity to focus on getting the basics right. He’s keen to ensure customers are in safe hands amidst heightened security risks and concerning developments across the global threat landscape.

“One of the approaches I really like to focus on is the basics. There are basic controls that reduce 85% of cyber security risks,” he explains. “If you do those things well, the majority of your risk is reduced.”

The data-driven mindset Jason has adopted as part of his leadership style means he “doesn’t care about certifications”. "I’m a data-driven CISO,” he adds. “So, I want really well-defined metrics and I want to be able to measure the efficacy of what we are doing. Because, and to quote Peter Drucker, “if you can’t measure it, you can’t manage it.”

This is not to suggest that he doesn’t acknowledge the value in SOC 2 or ISO certification, but to Jason these are business requirements and often don’t truly reflect how effectively a team or organisation handles its security obligations. Simply put, by getting the basics right, these regulatory and compliance obligations should be something of an afterthought.

“For me it’s about asking, are we doing what we say we’re doing in our policies and standards? I could care less when SOC 2 comes in and says what we’re doing. I want to know that we’re doing our job effectively and covering this,” he explains. “I don’t want someone to tell me we’re doing a good job; I want the data to show it.”

Adapting to the evolving threat landscape

It goes without saying that Jason joins Freshworks, a SaaS solutions provider, during a challenging period. Over the last two years, a series of deeply troubling attacks have rocked the global software supply chain, with the SolarWinds and Kaseya breaches arguably the standouts due to the scale and severity of their impact.

The Kaseya ransomware attack in July 2021 saw thousands of customers and managed service providers (MSPs) exposed. Similarly, the SolarWinds incident affected thousands of organisations worldwide, including several US Government departments. Noted as a landmark moment in the cyber security industry, Jason believes very few organisations would have seen the SolarWinds breach coming. He adds the situation is “only going to get worse”.

“With SolarWinds, probably one of the biggest and most famous supply chain issues, I guarantee you that 99% of companies with very mature third-party risk management programmes would not have seen that coming,” he says. “So even sometimes just having basic third-party risk management, you’re not going to be able to stop things like that.”

The SolarWinds attack of late 2020 was one of the most significant in recent cyber security history

Cloudbees research published last year found that C-suite executives are becoming increasingly concerned about software supply chain attacks in the two years since SolarWinds. While 40% were ‘somewhat more concerned’, 42% were ‘much more concerned’ of attacks, since 2019.

This growing issue has prompted a more robust approach from regulators and authorities. At present, there is a concerted focus on Software Bill of Materials (SBOM) – the equivalent of a food ingredients label outlining the various components found in software products. Jason welcomes this focus, noting that the move “is going to help incredibly” and enable organisations to mitigate growing risks.

Supply chain vulnerabilities aren’t the only issue that keeps Jason up at night, however. Across 2023 he believes one of the key threats that Freshworks and the broader industry will face is the increasing focus on APIs among cyber criminals.

Salt Security recently found 95% of companies reported some form of API-related security incident across 2021/22, while another study revealed API vulnerabilities cost businesses up to $75 billion each year. With a rapidly evolving threat landscape, Jason believes businesses will continue to face API-related risks and highlighted the issue as a “top concern coming into the next year or two”.

A key factor in this rising problem, he notes, is the proliferation of APIs and their critical role in supporting businesses to provide services. “It’s becoming core to anybody who’s a SaaS company and core to many products,” he says. “Because of that growth [in APIs] sometimes security might not have played a key role in its development. When you’re growing a new technology, as we know, security often takes a back seat.

“Are all these APIs out there being developed securely? Not as secure as in other code areas. APIs are often overlooked. And because API security is more on the business logic side, I think there’s a lot of ripe opportunity for hackers to go after due to the proliferation and the scale of it.”

Shifting left to combat key threats in 2023

Jason says Freshworks views API security as a key area of concern and, as such, he is placing a strong focus on mitigating risks. “My goal over the next year, and I know it’s one of the most overused marketing terms in security over the last few years – is to shift left,” he explains.

Shifting left is a principle employed in software development which helps identify potentially troublesome flaws in products earlier on in the development process. In doing this, organisations can not only fine-tune products from a security standpoint earlier on, but deliver longer-term cost savings.

“This is a cost-saving thing,” Jason explains. “Because the further right you go before fixing bad code in production costs up to 700 times what it would have if you had caught it beforehand. There are a bunch of gates and chains in place within the lifecycle which mean you could spend $1 now to fix it, or $700 later on. This doesn’t include other factors such as breaches, or penalties and the costs associated with that bug exposing something bad.”

Despite contending with a challenging threat landscape and heightened security risks, Jason believes he joined Freshworks at an ideal time, and looks forward to the prospect of building on the company’s established security function and being part of the future growth journey. “I want to be there for the growth at Freshworks, and I want to scale with them and ensure that security is scalable.”

Passwords: they can be tricky at the best of times. Proper password hygiene is one of the most important factors in endpoint security, as it keeps sensitive data secure and prevents threat actors from getting into important systems.

But despite the risks, the use of weak or recycled passwords continues to be a problem even amongst IT professionals. While systems such as two factor authentication have been used as an extra layer of security, groups like the FIDO Alliance and World Wide Web Consortium have been working to make passwords a thing of the past, in favour of more secure methods.

This week, we spoke to Richard Meeus, EMEA director of security & technology strategy for Akamai Technologies, to explore the solutions driving secure sign ons, and how the sector can adapt to this change.

Highlights

“The criminals know that we are bad with passwords, and we just use something like our pet's name or something like that. And it's relatively easy for people to get the passwords or, as most commonly happens, an organisation will be breached and their password and username database will be leaked out onto the internet. And then, those usernames and passwords are reused against websites all over the planet.”

“The concept of security authentication has always been based around, sort of, one of three concepts. So there's something you know, which is a password, something you are, which is your biometric. So use your face print or your thumbprint, or something like that. Or something you have, which could be a USB token, or something that you can punch numbers into as a handheld device. So one of those three things, and we've relied upon the something you know, predominantly, which is the password.”

“Anything that we can do within security that actually makes lives easier for end users, and makes them more secure, is a good thing. And reducing passwords, reducing the use of passwords is a good thing, because nobody likes them.”

Read the full transcript here.

Footnotes

• Revealed: The top 200 most common passwords of 2022
• If not passwords then what?
• What are biometrics?
• What is two-factor authentication?
• What is multi-factor authentication (MFA) fatigue and how do you defend against attacks?
• How to implement passwordless authentication
• Best password managers
• Best free password managers
• The sooner the FIDO Alliance can shut down passwords, the better
• Will FIDO passwordless authentication save cyber security?
• The top 12 password-cracking techniques used by hackers

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

​​This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Going passwordless'. We apologise for any errors.

Rory Bathgate

Hi, I'm Rory Bathgate.

Jane McCallion

And I'm Jane McCallion

Rory

And you're listening to the IT Pro Podcast, where this week we're discussing passwordless security.

Jane

Good password hygiene is one of the most important factors in endpoint security. If passwords are managed improperly, threat actors can access critical systems, and the use of weak or recycled passwords continues to be a problem even amongst IT professionals.

Rory

In place of legacy systems such as one time passcodes sent via SMS, groups like the FIDO Alliance and World Wide Web Consortium are working to make passwords a thing of the past.

Jane

Today, we're speaking to Richard Meeus, EMEA director of security & technology strategy for Akamai Technologies, to discuss the solutions that can enable more secure sign ons, and how the sector is handling this change. Richard, thank you for joining us.

Richard Meeus

Thank you very much, delighted to be here.

Jane

So everyone's been using passwords on their computers for decades. How come now they're being called insecure?

Richard

Well, I don't think it's now that they're being thought of as being insecure, I think they've been insecure for a long time. I mean, passwords have been utilised as an authentication mechanism for centuries. And it's always been fairly trivial to find out what they were. What we've been doing recently is with a plethora of websites and services, especially after the pandemic that everybody went online. Everybody reused the same passwords. People, humans, users we're rubbish at passwords, we have a limited capacity to remember passwords. And therefore we tend to use the same one repeatedly. Or we just try and be very clever and add a ‘1’ to the end, to try and make it uncrackable. And because of this, the criminals know this, the criminals know that we are bad with passwords, and we just use something like our pet's name or something like that. And it's relatively easy for people to get the passwords or, as most commonly happens, an organisation will be breached and their password and username database will be leaked out onto the internet. And then, those usernames and passwords are reused against websites all over the planet. And if you look at some of the database repositories, the legitimate repositories which are used for you to see if you have had your username and password put out onto the internet, there's about 10 million — 10 billion sorry, username and password combinations in there. That's a lot more than the internet-connected population. In fact, it's about four times more than the internet connected population. So there's a good chance there's a criminal somewhere who has your username and your password, and is trying them on a number of websites. Right now. What we want to do is move to a situation where that risk is mitigated to a certain degree.

Rory

With this risk of reusing passwords, certainly, or generating weak passwords. I know that a lot of businesses rely on things like password managers, can those be continued to be relied upon by businesses?

Richard

I think password managers, as well as with organisations looking to protect their users, it's important that password managers are used properly. A password manager is a great tool, I use one for my home business use for creating complex passwords, complex unique passwords. So I don't know what my passwords are, because they are a random bunch of 25 alphanumeric and special characters. I have no idea what they are. And the password manager remembers that, so every single asset that I talk to has a unique password. Password managers, I think, are very useful especially in the short term and within enterprises. It's not so great for end users because the vulnerable people in society, and people who are not familiar with technology, may find them quite difficult to use. But in enterprises they're certainly very useful because it allows you to create complex, distinct, unique user passwords for every single application that you go to. My passwords are often 25 characters long and a stream of unrecognisable characters, and numbers, and estimation marks, and question marks, and special characters that will be impossible to guess or impossible to do a brute force hack upon. So I think they definitely have a position, especially in the enterprise.

Jane

I mean, Richard, once again, I also use password managers. Are there risks associated with those? Recently we have seen LastPass, breached. And every time I see something like that my heart goes in my mouth. And then you realise, actually, your passwords are typically safe. But is there any kind of real chance that either the database itself could be breached particularly say, if you're reusing password for them? Or something a bit more sophisticated than that?

Richard

Well, I think a lot of the time, there's always been that concern about “if I put all my eggs in one basket, is that creating more of a risk? I think that's been the typical response to people not wanting to use password managers. But I think when you actually look at the security that is around the actual passwords, and how they're stored and how they're utilised, I think that that overweighs any of that concern about the risk about having all your passwords in one basket, or eggs in one basket. So I don't think there's a chance that if you, people do use them, I think they are very good, they're very useful. It again, outweighs the risk of just having very simple passwords that you can try to remember.

Jane

Yeah.

Rory

So in response to this, to focus on passwordless security as an option. When someone says passwordless security, I mainly think of biometric security, fingerprints, facial recognition. Is this the most promising avenue for this technology? And what are some of the other methods that are in place?

Richard

Yeah, well I mean the concept of security authentication has always been based around sort of one of three concepts. So there's something you know, which is a password, something you are, which is your biometric. So use your face print or your thumbprint, or something like that. Or something you have, which could be a USB token, or something that you can punch numbers into as a handheld device. So one of those three things, and we've relied upon the something you know, predominantly, which is the password. And we tend to use the something you have, like the USB key, or the something you are like the biometrics as an additional level and commonly called this is like two factor or multi factor authentication. So that what the concept is of going passwordless, is actually shifting away from using passwords as the primary method of authentication. And say, why do we need to use passwords as a primary, when we can use one of the other two, such as having a hardware device or using biometrics to do that first part of authentication? Obviously, there are many benefits to using the hardware device, or your thumbprint, or your face print. Because they're not likely to have the same level of simplicity around them. You know, it's not going to be quite as simple as password 123, when you're talking about your thumbprint, so there's a lot of sort of intrinsic benefit to that already.

Jane

I mean, when we're talking about this, we've sort of talked to him a little bit. When we talk about passwords you're speaking about moving the second part of two factor authentication to the front, the something you have, the something you are. Are we talking about getting rid of passwords completely, or do they become the second part of this 2FA? Or is it going to be my face and my token?

Richard

Passwords can still be used, but I would suggest that they are taken away largely completely, because they prove that they can't really be utilised effectively or securely. Certainly, if you have a three factor authentication it’s often used when you're going into very secure facilities. Where you have to sort of take in your access card, do a thumbprint, and then you have to type a PIN code in there. And then the PIN code would be sort of synonymous with your normal password. So that sort of three factor authentication will still be relevant in a lot of cases. But I think the concept of using a password to log on to a website will eventually go away, because it's not an effective way to access that level and proportionate that level risk.

Rory

And when you're talking about, I guess, in some cases this is consumers would be able to use, say a passkey, a physical passkey to verify their identity on a multitude of different accounts. In an enterprise model, could this be hard to, this specific something you have, could that be hard to implement in that if you left the company, you'd have to return what you had. It would potentially be harder than do changing a password?

Richard

Absolutely, I think the same thing you have part is an interesting concept about what it can actually be. And something, because I think everybody's sort of familiar with the, the old dongles which have the sort of rotating password pass key on them, that have been around from people like RSA for many, many years. And if you look in your desk drawer, you'll probably find two or three of them where the batteries died that you've had from many years ago. And that's not an unusual situation. And so there is an overhead to managing all those additional keys, and people will forget them, people will lose them. So there is an additional overhead in terms of that. So ideally, you want to try and use something that you already have, and you're never likely to let go of. And that's probably something like a mobile phone. And you can use a mobile phone as the something you have component. And it also allows you to do the something you are component because it allows you to do, especially with the modern smartphones, the biometrics and things like facial recognition and fingerprint recognition.

Jane

And I suppose if you've got company provided phones, then it's as easy as just returning the phone or remotely wiping it or any of that kind of thing if somebody leaves the company but they are, for whatever reason, not returning the phone.

Richard

Yes, if you're provided a company phone you will normally have some sort of MDM, some mobile device management software on the phone. Whereas as soon as they leave the company or as soon as the employment is terminated, then it's a question of just hitting a button on the central console and it would remove any of those components.

Jane

Yeah, I've thought of all kinds of nefarious things for employees to do. I think most of us more inclined to sort of lose our phone, on a train or whatever as well.

Richard

Yeah,absolutely. But also remembering that without the knowledge of where you're going, and what you're going to, because you still have to get the thumbprint to actually authenticate because it's part of that you would have something you have, something you are. Smartphones make it very easy to do two factor authentication, by taking the biometrics and the something you have. So that gives you the two factor based on that. So if you do lose your phone, they may be able to guess the pin number or the swipe pattern you have to get into the phone. But it's unlikely then they'll have the biometrics to actually get through the next level, to get on to the corporate assets as required.

Jane

Sure.

Rory

Through things like FIDO, there's been talks — I know that some manufacturers at Google Apple, Microsoft, have been in talks — to standardise this kind of technology that you're talking about. So that regardless of the hardware you were using, like the standardised keys across either your business interactions, or on a consumer basis across all of your different accounts, do you think a unified approach like that will be necessary to avoid there being a different kind of tool sprawl for businesses and consumers in the future where they're having to oh, you know, “which passkey am I going to be doing through my phone?”

Richard

I think there's going to be an argument for that. Not quite sure what things are going to happen in the short term, but it remains to be seen. I do think the work that FIDO is doing to promote easier and more secure access online is something that will be followed by more and more organisations. The current iteration, which is FIDO2, so fast identity online version two, even goes so far as to provide solutions that allow you to do phish proof MFA, because that is also a problem with MFA. It's not 100%. It's a lot better than not having multi factor authentication. But MFA is not 100%, and with the next generation, which is FIDO2, it will be phish proof. Again, it's never going to be 100%, but it's going to be a lot closer to where we want it to be.

Jane

So Richard, you've mentioned, FIDO2 briefly there. Could you tell us a bit more sort of what that's about?

Richard

Yeah, so FIDO2 is a methodology to make MFA sort of even better, because surprisingly, MFA doesn't solve all problems. You know, we think that it's going to address all of our authentication issues, but it doesn't and there's been several organisations that have been breached fairly publicly. So a very well known video game manufacturer, a well known taxi company, a global taxi company has recently been breached by what's called an MFA bypass. And an MFA bypass technique basically means that the device is talking to the website or the application, and the device that is doing the multi factor authentication are not linked. So this means that if you have stolen credentials, you can put those into the asset, put those into the website, the website will respond with an MFA challenge. And the attackers realise that the MFA challenge is going to be sent to the user, and they will try and persuade them to actually accept the challenge. And it's surprisingly easy to do that, with things like push MFA challenges. If you start sending people that at 3am in the morning, it's remarkable how quickly people will just click on ‘accept’, rather than have to listen to the bing, bing, bing, bing, bing, bing, constantly being reminded in the middle of the night. And this is what's happened to many, many organisations, is that because the device that’s making the request to the asset and the device are not linked, you can get this what's called push MFA or MFA bypass. So what FIDO2 wants to do is to locally connect the devices making the request to the origin and your external device. Now, you can do this through a USB key, plug the USB key into your device, they're now locally linked. Or you can do it through NFC, or you can do it as we do with Akamai, you can link them together through cryptographic keys. So my phone and my laptop are cryptographically linked, which basically means that the MFA is not valid unless it comes from my laptop. So if my credentials are stolen, and somebody tries to log in in another part of the world, and then tries to do a push MFA exertion on me, it won't even happen because the request has to come from my laptop. And this is what FIDO2 is doing, it’s ensuring that local MFA connectivity before it actually goes on to the next stage. And by doing this, it gets round a lot of the big MFA bypasses that have happened this year.

Jane

So this all sounds really great. And as a consumer, I can see myself adopting it. I already have, I use my thumb on my phone, people use their faces on their phone. And, you know, really consumers can turn on a penny when it comes to adopting new technology, anything like that. For businesses, it can be a little bit more difficult, especially if there's some kind of integration that they need to do with legacy systems. So how quickly can that be done? I mean, is it a problem? Am I throwing up a problem where one doesn't exist? But if I'm not, how can this be managed, and how quickly can things change?

Richard

I think with enterprise, it'll be a lot easier than it will be for consumers. For two different reasons. The main reason for consumers is that there will be a long tail of users who, for want of a better word, maybe a sort of Luddite about adopting the new technology. There are many people who don't want to have a smartphone with biometric controls on them for whatever reason. So for a service, such as public services, public sector, where they have to provide a fully inclusive service, there's gonna be a long tail of people there who won't fit into the parameters where you can do that full technology, but for multi factor authentication using biometrics or smartphone, so there will have to be solutions there to cater for those people. But with the enterprise, you have a lot more control. And you can certainly start linking all of your assets to talk to a central identity provider, be it Active Directory or some other form. And once you have authenticated with your main IDP, your main identity provider that can provide authentication tokens to every single other device within your estate, meaning once you're logged in, you're logged in across your estate. And that identity is protected by authentication through multifactor.

Jane

So the other way around to what you find quite often then, is that for businesses actually, this is quite easy. I mean, are there any sort of key hurdles that might hold up passwordless security in businesses or is it really just as easy as kind of going, “right this is our, you know, the method that we do now internally, at least. And, and off we go”?

Richard

There's always going to be some legacy applications that don't have the ability to use authentication. So there's a functionalities like OAuth, which allows applications to be authenticated elsewhere. If they don't have the functionality to have that capability, then you're going to have to have another way of authenticating with those legacy applications. So it's not necessarily going to be applicable across the board. But most modern organisations will have the facility to deploy the majority of their applications through that one password, or one authentication process, and then being able to pass that assertion through to all the relevant applications.

Rory

Do you think that implementing a system like this might also help with oversight of who has access to which systems? Because currently, obviously with passwords, it's very easy within an organisation for someone to ping a password across on a Google chat to someone who maybe shouldn't have access to, to a back end system. So using authenticators might also improve observability across the system?

Richard

I think there's a potential for that, I think that where that particular area’s going is more into is looking at the authorisation component. So with identity, you’ve got the identification, which is the username, you've got the authorisation. Sorry, the authentication, which is the something you are, something you have, something you are. And then there's the authorisation component, and authorisation is something that's being looked at when you look at things like zero-trust network access, which is a way of giving users access just to applications that they need. So it's really sort of going down heavy on lease privilege. This is a really good way to ensure that only the users authorised to access an application, get that level of access. Which means that anybody else does not have that level of access. So, if you gave somebody else a password, you'd have to have the username and have the password, but they still wouldn't be authorised, they still wouldn't physically be able to get to that particular asset. And I think that's why a lot of organisations are looking into it. Because I know zero trust is a word that bandied around a lot with, with wanton carelessness, sometimes, but it fundamentally comes down to lease privilege, which is something that IT professionals have been familiar with for many, many years. And that's where it's trying to get to, if you don't have the right identity, authentication and authorisation, you can't actually get to that application.

Jane

So Richard, if the worst does happen, and a business is hit by a cyberattack, can using a passwordless solution help minimise the impact? Or does it just minimise the risk?

Richard

That's a really good question. I think initially, it minimises the risk. Because I think if you, there was a report I think in the Verizon data breach incident report last year, that credential vulnerabilities were responsible for 84% of all breaches. So if you can get to addressing that vulnerability, that reduces the risk significantly of having a breach. So I think that's the first aspect. Once somebody has got inside your organisation, then absolutely, having good identity controls is in place, but it's a little bit late at that point, you then need to be looking at other security elements to be able to protect your organisation. And that can be through things like zero trust, network access, or micro segmentation to throw another technology into the mix to prevent them moving laterally through your organisation. But I think this is where passwords can be used, especially within the enterprise as part of a layered security model of trying to reduce the risk at all levels, reduce the level at authentication time, reduce the risk at connection time, whether connecting via IP or just the application layer, and then reducing the risk of moving throughout an organisation when deployed as part of a managed strategy, then you're able to reduce the risk at all levels as best as possible.

Jane

Yeah, and I think you've kind of hit on something important there really, which is whether this is passwordless or really any other kind of security technology, or any technology, that it's not a panacea, it's not a cure-all, it has to be used as part of a wider security strategy. Whether that's training or like you say, other technologies that can help the progress or at least to slow the progress of anybody who's staging an attack. Is that a fair observation?

Richard

Absolutely. I think that there aren’t many things that as security professionals we can do, that actually makes things easier for end users. Normally, we are seen as the Department of No, the Fun Police. So I think that anything that we can do within security that actually makes lives easier for end users, and makes them more secure, is a good thing. And reducing passwords, reducing the use of passwords is a good thing, because nobody likes them. Nobody likes them, nobody likes trying to have to remember them. There's always a challenge, there’s always some times you forget, or whatever. It's a problem. It's a massive security risk. So getting rid of that pain point from users would be a boon I would say.

Rory

So you think that there's real potential for this to improve, maybe, productivity within the workforces? Or at least improve the use of access for vital systems within workforces?

Richard

Absolutely. I think when you look at most organisations where you have, you know, probably thousands of applications within an organisation, although most users will only have access or need to use 10 or 20 of them. The ability to reduce the access to just the applications you need, and the ability to have to worry about a password is fantastic. At Akamai we've been passwordless for many years now. So I don't use a password to log on. I don't use a password to access applications, it's just all done through passwordless technology. And that makes it a lot easier for me not having to worry about, “oh, I need to access that particular system. Where is it located? What password do I need?” All that, it's a lot easier to use? And yes, it's anything that gets rid of that, “oh, what's the password for that application that I haven't used for two months?” Anything gets around that problem, which everybody has, if you can get if you can solve it, it's bound to help all sorts of users.

Jane

So Richard, at Akamai you are ahead of the curve. But how far away do you think we are from universal adoption of this kind of security across businesses?

Richard

I think that's a very difficult question. Because there are many companies and many verticals that are on all sorts of that journey, all different areas of the passwordless adoption journey. I think people will want to go there because the benefits are manifold. But there is always going to be an issue with inclusivity. Because you have to make sure that everybody is catered for. And if you can't cater to everybody, then there's always going to be an issue. So in the consumer space, I think it's going to be utilised to enable users, I still think you're going to have to have passwords for inclusivity. But if you're using it in the consumer space, and you want to get access to all of your favourite music sites, or TV sites, or shopping sites without having to remember a password all the time, I think people are going to embrace that. And that it will be seen as a benefit not only for the consumers, but also the vendors as well. In the enterprise space, I think that organisations will want to go down this level to a certain degree, I think there's always going to be legacy applications that won't suit that. Or the infrastructure will not benefit it as a whole. But I think overall, it's certainly a methodology that will be broadly adapted. The big vendors, as you mentioned at the beginning, are doing this. Microsoft has things like Microsoft Hello, which allows you to do passwordless authentication. It's something that's being adopted through many different vectors, so it will increase. Am I going to put a date on it and say you have no more passwords in five years. That’s a crystal ball I would love to have, but I couldn't say that.

Jane

No fun, no fun.

Rory

Well, Richard, thank you so much for being on the show.

Richard

Thank you Rory, thank you Jane. It's been a pleasure. Thank you very much indeed for having me.

Jane

Thank you. As always, you can find links to all of the topics we've spoken about today in the show notes and even more on our website at itpro.co.uk

Rory

You can also follow us on social media, as well as subscribe to our daily newsletter. Don't forget to subscribe to the IT Pro podcast wherever you find podcasts. And if you're enjoying the show, leave us a rating and a review

Jane

I will be back next week with more from the world of it but until then goodbye.

Rory

Goodbye

Most cyber scare stories have more in common with horror fiction than practical reality, and I’m not talking purely about the hyped-up cyber warfare stuff that appears online. Me being me, I’m focussed on the hacking threat stuff.

Admittedly, I have a thirst for oddball cyber security research papers, but there’s a secret to digesting these papers in a way so as not to confuse the theoretical risk with the practical one. There’s a huge difference between fascinating research work, conducted by hugely talented folk, and the practical risk you are likely to be exposed to as a result of it.

This isn’t to say that such research is pointless; far from it in fact. The most technologically fanciful lab-based threats can evolve into very real-world ones, albeit often bearing little resemblance to the original. There are three fascinating pieces of research that stand out, and all fall down as far as the current real-world threat stakes are concerned.

Attack of the mechanical keyboards

Let’s start with Keytap3, which immediately announces it has already evolved somewhat from the original research by Georgi Gerganov. The name also suggests, quite rightly, that this involves typing.

That involvement is an attempt to be able to remotely and quite literally listen in to what you are typing and then convert that audio into written output. It does this by analysing n-gram frequency – the contiguous sequence of items in a sample – of recorded audio clusters.

Gerganov isn’t the first to look into this as a spying methodology, nor will he be the last, and I applaud him for his efforts so far. Despite, I have to say, my not being able to replicate the success he has had in the lab when taking part in a demonstration of the technology. You can try it by visiting the demo website and allowing your typing audio to be analysed.

Gerganov says he doesn’t have access to the recordings, as the test runs within your client browser and none of the data is uploaded or stored by the researcher. This is one of the reasons the results are poor: without the wider input data from a broad, real-world, range of both keyboards and microphones, plus different typing speeds and styles, the experiment is likely to perform best with the variables it understands from the lab development.

“One possible explanation for the results that you observe is that simply Keytap3 is somehow overfitted to my setup or style,” he tells me. “Even though I have tried to keep the implementation as general as possible, without making unnecessary assumptions about the typing style or the devices (keyboard and mic) it is still possible that the algorithm performs well only in the limited set of environments that I have tested it with.”

GGerganov only has two mechanical keyboards and says the results are “pretty good” when using that small set of data points. He would welcome more data from participants of the demo: it’s up to you whether or not to upload the recording after the demo so that he can broaden the input data.

In case you’re wondering, he doesn’t think typing speed is a huge factor. Instead, the main factor is the ability to match key sounds to determine if separate sounds are made by the same key, for example. “Currently, Keytap uses a time-domain cross-correlation metric to match the keys with one another and it is definitely not perfect,” Gerganov says, before adding he was surprised it performs as well as it does. He’s currently working on improving the algorithm using frequency-domain metrics.

‘Ghost touch’ doesn’t send shivers down my spine

Next up is an experimental smartphone threat vector that grabbed my attention by virtue of being one that works with both iPhone and Android devices.

There are always ways into devices, although most of them require either temporary physical ownership of the device or the actual owner to have installed something malicious. Or, in the case of BadUSB attacks, a subtle combination of the two. Rather than ownership of the phone, BadUSB attacks require ownership, or usage of, a malicious memory drive or even a specially crafted data/charging cable. The Wired Ghost Touch (WIGHT) attack model uses the malicious charging port approach. The type of cable is irrelevant, and bypassing data blockers allows attackers to remotely “swipe” the touchscreen.

Researchers from the Zhejiang University, China and two from the Technical University of Darmstadt, Germany, have demonstrated how this works using both a Samsung Galaxy S20 and an Apple iPhone SE, and some other less popular smartphones.

It works by injecting specially crafted “malicious noise” signals that evade noise reduction and voltage management filtering while still impacting the capacitive touchscreen measurement systems. In fact, the researchers say they can perform three attack types by syncing the injected noise with the device touchscreen scanning cycle: a “ghost touch” that doesn’t require physical user input, an “alteration attack” that changes the actually touched position to another, and a denial of service that prevents any touch from being recognised.

I’ve read about previous ghost touch research but that all requires the target device to be screen-down and within a few millimetres of a table or desktop, with some cumbersome equipment installed underneath. For me, that reduces the threat level to negative, as even a highly targeted individual that would merit such attention would almost certainly already have defensive measures in place to defeat it.

The WIGHT model doesn’t require data access permission from the USB cable, which is a plus point, nor does the electromagnetic radiation approach of those under-the-table devices. Instead, by injecting a common-mode signal that can’t be absolutely filtered but still produces a differential-mode signal, thanks to asymmetric circuits, the necessary touchscreen interference can be achieved.

It’s a lot more advanced than Keytap3, but still doesn’t give me the collywobbles, nor should it you, because the touchscreen positioning precision remains in the 50/50 ballpark.

There is one scary aspect to the attack methodology, though. The researchers say that as the attack signal is a high-voltage alternating current, it could give a smartphone user a very nasty shock outside of carefully controlled lab conditions.

Scary in a Minority Report kind of a way

What if your account was compromised before you opened it? Although this might sound like a third entry in the “that doesn’t apply to real-world, labs-based threat research” stakes, it isn’t. This threat vector sounds unbelievable – but it’s actually doable right now. Researchers found that 35 of 75 leading web services were vulnerable in some way or other.

The work, using a Microsoft Security Response Centre (MSRC) grant, was undertaken by independent security researcher Avinash Sudhodanan and Microsoft senior researcher Andrew Paverd. The research paper is well worth a read and a genuine;y worrying one.

Andrew Paverd describes it as a “new class of attacks affecting websites and other online services”. It’s scary precisely because a cyber criminal can gain access to an account before you even create it. It gets worse, in that they could then take over that account once you have. It has a kind of Minority Report feel to it – but is far from a fictional fancy.

Using one of five different attack scenarios, an attacker creates an account for a web service that’s subsequently reactivated by a user and then, having given them time to use the account and add value by way of financial and other data, subsequently retakes control. The five methods require differing scenarios to play out and involve exploiting a weakness in the merging of classic and federated accounts: not signing users out after a password reset; Trojan identifiers; a failure to invalidate email change capability URLs in the password reset process; and by exploiting a non-verifying Identity Provider vulnerability.

It’s all rather complicated, but you can’t ignore the test result of almost half of the service providers targeted falling victim. That said, it’s not a given that it works even beyond that 50/50 test result. It requires a user not to have joined a service yet, the attacker to know that fact along with them wanting to start using it at some point soon, and the email address they will use – which is a stretch.

It also requires the web service in question not to send a verification email to the user-provided address while at the same time preventing any further actions until that verification had been received. Using unique email addresses for every account would also effectively mitigate the success of such an attack, and the ease with which this can be achieved these days it’s a route I’d recommend. Not least as unique email identifiers, especially when also used as account login usernames, makes other attack scenarios harder to pull off as well. Win-win.