Funding Files: Here’s a quick look at some of the funding deals and acquisitions that transpired in February in the cloud, data, cybersecurity, and AI space.

Funding Files: Cyber security, AI and cloud deal roundup, CIOSEA News, ET CIO SEA

Cyber attacks have been on the rise due to growing digitization, the continued transition to the cloud, and the ongoing AI (artificial intelligence) wave. The incre...

ZS, CRWD, or CYBR: Which Cybersecurity Stock Has the Highest Upside Potential? - TipRanks.com

The cybersecurity outlet The Record originally reported that under Trump’s new Defense Secretary Pete Hegseth, U.S. Cyber Command has been ordered to “stand down from all planning against Russia, including offensive digital actions.” The outlet cites three anonymous sources who are familiar ...

Trump's Defense Secretary Hegseth Orders Cyber Command to 'Stand Down' on All Russia Operations

Highlighting focus on the rise of industrial CISOs to balance organizational cybersecurity, operations, and resilience.

Highlighting focus on rise of industrial CISOs to balance organizational cybersecurity, operations, resilience - Industrial Cyber

After years of Russian cyber aggression ... disruptive cyberattacks—multiple recent actions from the Trump administration have recast the US stance on the cybersecurity threats posed by the Kremlin, downplaying the risks of Russian hackers as US adversaries....

The Trump Administration Is Deprioritizing Russia as a Cyber Threat | WIRED

Data from recent analyses, sourced from studies conducted by Wilson Chua of Watchdog Cyber Defense, highlights concerning trends that underscore the urgent need for robust cybersecurity strategies. Adopting advanced AI-powered cybersecurity solutions is no longer optional for Philippine enterprises ...

How AI can improve cybersecurity response times, resilience | The Manila Times

According to Recorded Future, the Cyber Command has between 2,000 to 3,000 employees. Those employees work alongside NSA members and about 5,800 armed service members. The latter group is organized into teams that conduct both defense and offense cybersecurity operations.

Report: Defense Secretary Hegseth orders Cyber Command to halt Russia planning - SiliconANGLE

U.S. Defense Secretary Pete Hegseth issued an order last week directing U.S. Cyber Command to cease all planning against Russia

Hegseth orders halt on all Russia-related cybersecurity operational planning / The New Voice of Ukraine

Cyber

cyber

In October 2022 I published the most embarrassing article of my career, but 2 years later I am starting to think I might have been right. Strolling through the colossal vendor hall at BlackHat in 2022, every stall made some bold claim about AI. “AI-powered analytics”, “Combining AI with real-time detection” or some other slogan. Whenever you talk to the sales team to ask exactly what their AI did, you either get a succession of AI jargon or a claim about secret research teams in underground vaults in Antarctica. Following on from that, I confidently published an article calling out AI as nothing more than marketing BS… “BlackHat 2022, more A than I”. Fast forward a couple of months and ChatGPT was released. All of a sudden, AI became real and suddenly my brilliant article was a joke, and blatantly wrong. But, after strolling through the BlackHat 2024 vendor hall this year, maybe I wasn’t so far off. It is undeniable that AI is indeed real, and that it has huge potential to change the landscape. And in many ways it already has. Something I didn’t believe 2 years ago. But, as you walk through the expansive halls of Mandalay Bay for BlackHat 2024, you still see the same slogans and I still have yet to find a meaningful implementation of AI in security that I can point to that remotely matches the bold claims. “One thing I notice [in BlackHat] was that people were tired of AI”
Ashish Rajan AI CyberSecurity Podcast Why has AI failed to be effective in security? To preempt your objections, I am aware security vendors are indeed using AI within their products. But so far there are no game-changing results that we can point to, and a lot of this comes down to how they are implementing AI. Following the release of ChatGPT and the subsequent AI models, a lot of vendors rushed to add these new tools to their platforms. The go-to implementation was ‘AI-powered remediation guidelines’ and ‘additional context around alerts’. But here is the reality behind this: that implementation helps mostly the vendor not the user.  This simply means they don’t need to spend as much time on their documentation. Not only that, contextual information is always at least 2 years out of date for most commercial AI models. The reality is that a lot of this implementation was simply a way to make good on vendors' promises behind their ‘AI’ powered products. Another problem that limits AI's ability within security is being able to train AI models on specific security data. Models like ChatGPT are great for showcasing what an AI model can do, but are far from reliable for specific use cases. As Dean De Beer said on the AI + A16z Podcast “ChatGPT is a great hammer, [but] I would certainly not recommend it when you start to productize and perform tasks at scale”. Training a security focused model right now needs extraordinary computational power and even if - and it's a big if - a small company could buy enough GPUs to perform this, the cost would be astronomical! “We have not hit the moment where AI is more than a product side feature”
Caleb Sima AI CyberSecurity Podcast This means only a few big players have the ability to implement AI features that go beyond sending generic data to generic AI trained models. Today AI mostly remains a side-feature in the majority of security tools, almost a gimmick marketing teams can blast into the world. How can you do AI right? For all my skepticism, I will admit there are a few interesting implementations of AI. Purple AI  by SentinelOne, marketed as an AI security Analyst, certainly is impressive to see in action (at least in a demo). So how can you use AI, especially if you don’t have the budget of a Formula 1 team? Empower humans, don’t try and replace them
The simple truth is that right now, we don’t and shouldn’t trust AI to replace a human. It will always be behind if we can’t trust it, and its ability is limited. AI is a powerful tool to assist humans.


Focus on what AI is good at right now, classification.
The original strength of AI was classification. We can feed AI lots of context around a vulnerability and get a model to classify and prioritize vulnerabilities.


Make sure you use the right model
The more prioritized we get with AI, the more we need a model that is equally specialized. Training these models ourselves may be out of the realm of possibilities for most. But there are plenty of models that will outperform the standard hammers. Will the ‘A’ ever be ‘I’ in security? Intelligence is a bold - and fairly ambiguous - word. Each day AI is finding itself more embedded into our everyday lives and security tooling has huge potential for AI. I have little doubt that effective innovative implementations of AI will absolutely be available in security tooling. But we aren’t there yet. Security vendors have been stretching their AI abilities for years, and when ChatGPT threw them a lifeline they tried to bend the tools to their slogans. The reality is that effective implementation will be different to what we had first imagined. AI will be effective when the slogans match the tool, and not the other way around. In October 2022 I published the most embarrassing article of my career, but 2 years later I am starting to think I might have been right. In October 2022 I published the most embarrassing article of my career, but 2 years later I am starting to think I might have been right. Strolling through the colossal vendor hall at BlackHat in 2022, every stall made some bold claim about AI. “ AI-powered analytics”, “Combining AI with real-time detection” or some other slogan. Whenever you talk to the sales team to ask exactly what their AI did, you either get a succession of AI jargon or a claim about secret research teams in underground vaults in Antarctica. AI-powered analytics”, “Combining AI with real-time detection” Following on from that, I confidently published an article calling out AI as nothing more than marketing BS… “BlackHat 2022, more A than I”. Fast forward a couple of months and ChatGPT was released. All of a sudden, AI became real and suddenly my brilliant article was a joke, and blatantly wrong. But, after strolling through the BlackHat 2024 vendor hall this year, maybe I wasn’t so far off. It is undeniable that AI is indeed real, and that it has huge potential to change the landscape. And in many ways it already has. Something I didn’t believe 2 years ago. But, as you walk through the expansive halls of Mandalay Bay for BlackHat 2024, you still see the same slogans and I still have yet to find a meaningful implementation of AI in security that I can point to that remotely matches the bold claims. “One thing I notice [in BlackHat] was that people were tired of AI” Ashish Rajan AI CyberSecurity Podcast “One thing I notice [in BlackHat] was that people were tired of AI” “One thing I notice [in BlackHat] was that people were tired of AI” Ashish Rajan AI CyberSecurity Podcast Ashish Rajan AI CyberSecurity Podcast AI CyberSecurity Podcast AI CyberSecurity Podcast Why has AI failed to be effective in security? Why has AI failed to be effective in security? To preempt your objections, I am aware security vendors are indeed using AI within their products. But so far there are no game-changing results that we can point to, and a lot of this comes down to how they are implementing AI. Following the release of ChatGPT and the subsequent AI models, a lot of vendors rushed to add these new tools to their platforms. The go-to implementation was ‘AI-powered remediation guidelines’ and ‘additional context around alerts’. But here is the reality behind this: that implementation helps mostly the vendor not the user.  This simply means they don’t need to spend as much time on their documentation. Not only that, contextual information is always at least 2 years out of date for most commercial AI models. The reality is that a lot of this implementation was simply a way to make good on vendors' promises behind their ‘AI’ powered products. Another problem that limits AI's ability within security is being able to train AI models on specific security data. Models like ChatGPT are great for showcasing what an AI model can do, but are far from reliable for specific use cases. As Dean De Beer said on the AI + A16z Podcast “ChatGPT is a great hammer, [but] I would certainly not recommend it when you start to productize and perform tasks at scale” . Training a security focused model right now needs extraordinary computational power and even if - and it's a big if - a small company could buy enough GPUs to perform this, the cost would be astronomical! AI + A16z Podcast AI + A16z Podcast “ChatGPT is a great hammer, [but] I would certainly not recommend it when you start to productize and perform tasks at scale” “We have not hit the moment where AI is more than a product side feature” Caleb Sima AI CyberSecurity Podcast “We have not hit the moment where AI is more than a product side feature” “We have not hit the moment where AI is more than a product side feature” Caleb Sima AI CyberSecurity Podcast AI CyberSecurity Podcast AI CyberSecurity Podcast AI CyberSecurity Podcast This means only a few big players have the ability to implement AI features that go beyond sending generic data to generic AI trained models. Today AI mostly remains a side-feature in the majority of security tools, almost a gimmick marketing teams can blast into the world. How can you do AI right? For all my skepticism, I will admit there are a few interesting implementations of AI. Purple AI by SentinelOne, marketed as an AI security Analyst, certainly is impressive to see in action (at least in a demo). Purple AI Purple AI Purple AI So how can you use AI, especially if you don’t have the budget of a Formula 1 team? Empower humans, don’t try and replace them
The simple truth is that right now, we don’t and shouldn’t trust AI to replace a human. It will always be behind if we can’t trust it, and its ability is limited. AI is a powerful tool to assist humans. Focus on what AI is good at right now, classification.
The original strength of AI was classification. We can feed AI lots of context around a vulnerability and get a model to classify and prioritize vulnerabilities. Make sure you use the right model
The more prioritized we get with AI, the more we need a model that is equally specialized. Training these models ourselves may be out of the realm of possibilities for most. But there are plenty of models that will outperform the standard hammers. Empower humans, don’t try and replace them The simple truth is that right now, we don’t and shouldn’t trust AI to replace a human. It will always be behind if we can’t trust it, and its ability is limited. AI is a powerful tool to assist humans. Empower humans, don’t try and replace them The simple truth is that right now, we don’t and shouldn’t trust AI to replace a human. It will always be behind if we can’t trust it, and its ability is limited. AI is a powerful tool to assist humans. Focus on what AI is good at right now, classification. The original strength of AI was classification. We can feed AI lots of context around a vulnerability and get a model to classify and prioritize vulnerabilities. Focus on what AI is good at right now, classification. The original strength of AI was classification. We can feed AI lots of context around a vulnerability and get a model to classify and prioritize vulnerabilities. Make sure you use the right model The more prioritized we get with AI, the more we need a model that is equally specialized. Training these models ourselves may be out of the realm of possibilities for most. But there are plenty of models that will outperform the standard hammers. Make sure you use the right model The more prioritized we get with AI, the more we need a model that is equally specialized. Training these models ourselves may be out of the realm of possibilities for most. But there are plenty of models that will outperform the standard hammers. Will the ‘A’ ever be ‘I’ in security? Intelligence is a bold - and fairly ambiguous - word. Each day AI is finding itself more embedded into our everyday lives and security tooling has huge potential for AI. I have little doubt that effective innovative implementations of AI will absolutely be available in security tooling. But we aren’t there yet. Security vendors have been stretching their AI abilities for years, and when ChatGPT threw them a lifeline they tried to bend the tools to their slogans. The reality is that effective implementation will be different to what we had first imagined. AI will be effective when the slogans match the tool, and not the other way around.

AI is Failing in Cyber

KI misluk in kuber

Süni intellekt kiberdə uğursuzluğa düçar olur

La IA está fallando en el ámbito cibernético

AI epäonnistuu kyberissä

AIはサイバー空間で失敗している

AI កំពុង​បរាជ័យ​ក្នុង​អ៊ីនធឺណិត

AI žlunga kibernetinėje erdvėje

A IA está falhando no ciberespaço

AI iri Kukundikana muCyber

AI กำลังล้มเหลวในโลกไซเบอร์

AI سائبر میں ناکام ہو رہا ہے۔

人工智能在网络领域失败

The digital landscape is both a battleground and a fertile ground for innovation and recent announcement of its strategic consolidation marks a pivotal moment in the cybersecurity and enterprise tech sectors. By amalgamating the distinct capabilities of Cytek Security, Tek Experts, and Elev8, TeKnowledge is not merely expanding; it is redefining its trajectory towards cybersecurity excellence and comprehensive enterprise growth. TeKnowledge’s Enterprise technology continues to be characterized by rapid evolution and unprecedented challenges. Organizations across the globe are grappling with the dual pressures of digital transformation and the need to fortify their defenses against an increasingly sophisticated cyber threat landscape. By the end of 2024, on the global economy is predicted to top USD 10.5 trillion. the cost of cyberattacks The push towards adopting cloud computing, artificial intelligence, and automation technologies is accelerating, pushing enterprises to innovate while ensuring the security and integrity of their digital assets. Furthermore, the shift towards remote and hybrid work models has necessitated a reevaluation of IT infrastructure and security protocols, underscoring the importance of technical skilling and training programs to equip the workforce for the demands of this new digital era. Companies which aim to offer comprehensive solutions spanning cybersecurity, technical skilling, and digital transformation consultancy, reflects a broader industry trend towards integrated services designed to address the multifaceted challenges of enterprise tech in 2024. Amid economic uncertainty and a global tech talent shortage, a predicted that by 2030, there could be a global talent shortage of more than 85.2 million people in the tech sector, the need for such holistic approaches to enterprise technology solutions has never been more acute, setting the stage for transformative changes in how businesses secure and leverage their digital futures. report from Korn Ferry Cybersecurity is no longer a standalone concern but a critical foundation for digital enterprise growth: robust cybersecurity measures are a significant driver of innovation, trust, and competitive advantage. TeKnowledge’s approach integrates cybersecurity into every facet of its service offerings, ensuring that digital transformations are secure by design. This integrated approach is not only a response to the growing sophistication of cyber threats but also a proactive measure to embed security into the digital architecture of businesses and governments. "At TeKnowledge, we're not just responding to cybersecurity, technological innovation, and talent development challenges; we're anticipating them, crafting a unified strategy that leverages the strengths of Cytek Security, Tek Experts, and Elev8 Tek. The new TeKnowledge brand signifies more than an expansion—it's a commitment to transforming the digital ecosystem by directly addressing the tech talent gap while accelerating cybersecurity and AI readiness and implementation. Our mission is clear: to accelerate progress and secure futures by equipping our customers with the tools, talent, and strategies needed for success in this rapidly evolving digital landscape,” says Aileen Allkins, President and CEO of TeKnowledge. At the core of TeKnowledge’s bold move is a recognition of the intertwined nature of cybersecurity and digital transformation. In the face of a global tech talent shortage and the escalating pace of digital threats, the amalgamation is a strategic response designed to elevate the company’s service offerings. TeKnowledge is positioning itself as a one-stop shop for governments and enterprises worldwide, offering a cohesive suite of services ranging from advisory and consultancy to advanced cybersecurity protection and technical skilling.\ Leveraging Global Expertise for Local Impact With a leadership team boasting veterans from Microsoft, HP, Convergys, CA Technologies, and Concentrix, TeKnowledge is leveraging global expertise to foster local and global enterprise growth. The company’s strategy emphasizes the importance of technical skilling and capacity building to bridge the tech talent gap—a move that is as much about empowering its clientele as it is about securing the digital future. A Unified Strategy for the Digital Age TeKnowledge’s unified strategy is a testament to the power of integration in the digital age. By bringing together the strengths of Cytek Security, Tek Experts, and Elev8, the company is not just expanding its service offerings but is also creating a new paradigm for how cybersecurity and digital transformation are approached. This strategic consolidation aims to provide unparalleled expertise and comprehensive solutions that enable customers to achieve their strategic imperatives more quickly and effectively. As TeKnowledge launches under this unification and expansion strategy, the company is demonstrating a model for how enterprises can navigate the complexities of digital innovation securely and efficiently.  By harnessing the collective strengths of its component companies, TeKnowledge is setting a new standard for excellence, innovation, and comprehensive digital solutions in a world where technology is both the greatest asset and the biggest challenge.

TeKnowledge's Expansion: Tackling the Tech Talent Crisis with Unified Cybersecurity and Upskilling

On November twenty-fourth, 2014, there was an attack that was caused by a hacker group identifying itself as “Guardians of Peace” or the “Lazarus Group”: a cybercrime group that is run by the government of North Korea. This particular attack was interesting because of what this particular hacker organization decided to attack. They did not go and attack some type of important government building or the infrastructure of some great government contractor that would allow them to use their programming skills in order to steal US secrets. Instead, they decided that it would be a better use of their talents to hack information from the media company Sony Pictures in an event that is now known as the Sony Pictures Hack. Lots of data were taken from Sony Pictures including the personal information of employees, personal info about the families of said employees, emails between various different employees, information about executive salaries at this company, plans for many of the future films for Sony Pictures, scripts of different products, and other information that was important. Even the US Ambassador to the United Nations at the time described how strange this particular incident was: This is absurd. Yet it is exactly the kind of behavior we have come to expect from a regime that threatened to take 'merciless countermeasures' against the U.S. over a Hollywood comedy, and has no qualms about holding tens of thousands of people in harrowing gulags. - United States of America Ambassador to the United Nations Samantha Power After all of the important information was taken from the systems at Sony Pictures, the attackers then decided to release some malware in order to wipe Sony’s computer infrastructure. This malware was a variant of Shamoon - a modular computer virus discovered back in 2012 also known as W32. DistTrack targeted certain versions of the Microsoft Windows operating system. One of the things the hackers demanded is the withdrawal of the then-upcoming film The Interview from theaters - a film about a group of reporters hired by the United States and South Korean governments to assassinate the leader of North Korea: We will clearly show it to you at the very time and places The Interview be shown, including the premiere, how bitter fate those who seek fun in terror should be doomed to. Soon all the world will see what an awful movie Sony Pictures Entertainment has made. The world will be full of fear. Remember the 11th of September 2001. We recommend you to keep yourself distant from the places at that time. (If your house is nearby, you'd better leave.) Whatever comes in the coming days is called by the greed of Sony Pictures Entertainment. All the world will denounce the SONY. - statement from the “Guardians of Peace” back in December 2014 Despite the threats and danger, the movie The Interview was still released - not in theaters but on digital platforms like Google Play, YouTube, and Xbox Video. Fortunately for the US, and unfortunately for the North Korean hackers, the move backfired and led to the film still being released because now the movie became a statement about free speech and standing up to cyberterrorism. After all, if North Korea could scare the United States into not releasing a movie, then foreign hackers would be able to have a huge amount of influence over the country and what media would be released in the future. Sony even said in a statement: “We are proud to make it available to the public and to have stood up to those who attempted to suppress free speech.” Who would have known that a hack related to a Hollywood movie would be one of the earliest attempts of a foreign entity to use cyberterrorism in order to control the actions of another country? On November twenty-fourth, 2014, there was an attack that was caused by a hacker group identifying itself as “ Guardians of Peace” or the “ Lazarus Group”: a cybercrime group that is run by the government of North Korea. November Guardians Lazarus This particular attack was interesting because of what this particular hacker organization decided to attack. They did not go and attack some type of important government building or the infrastructure of some great government contractor that would allow them to use their programming skills in order to steal US secrets. Instead, they decided that it would be a better use of their talents to hack information from the media company Sony Pictures in an event that is now known as the Sony Pictures Hack. Pictures Lots of data were taken from Sony Pictures including the personal information of employees, personal info about the families of said employees, emails between various different employees, information about executive salaries at this company, plans for many of the future films for Sony Pictures, scripts of different products, and other information that was important. Even the US Ambassador to the United Nations at the time described how strange this particular incident was: This is absurd. Yet it is exactly the kind of behavior we have come to expect from a regime that threatened to take 'merciless countermeasures' against the U.S. over a Hollywood comedy, and has no qualms about holding tens of thousands of people in harrowing gulags. - United States of America Ambassador to the United Nations Samantha Power This is absurd. Yet it is exactly the kind of behavior we have come to expect from a regime that threatened to take 'merciless countermeasures' against the U.S. over a Hollywood comedy, and has no qualms about holding tens of thousands of people in harrowing gulags. - United States of America Ambassador to the United Nations Samantha Power After all of the important information was taken from the systems at Sony Pictures, the attackers then decided to release some malware in order to wipe Sony’s computer infrastructure. This malware was a variant of Shamoon - a modular computer virus discovered back in 2012 also known as W32. DistTrack targeted certain versions of the Microsoft Windows operating system. Shamoon One of the things the hackers demanded is the withdrawal of the then-upcoming film The Interview from theaters - a film about a group of reporters hired by the United States and South Korean governments to assassinate the leader of North Korea: The Interview We will clearly show it to you at the very time and places The Interview be shown, including the premiere, how bitter fate those who seek fun in terror should be doomed to. Soon all the world will see what an awful movie Sony Pictures Entertainment has made. The world will be full of fear. Remember the 11th of September 2001. We recommend you to keep yourself distant from the places at that time. (If your house is nearby, you'd better leave.) Whatever comes in the coming days is called by the greed of Sony Pictures Entertainment. All the world will denounce the SONY. - statement from the “Guardians of Peace” back in December 2014 We will clearly show it to you at the very time and places The Interview be shown, including the premiere, how bitter fate those who seek fun in terror should be doomed to. Soon all the world will see what an awful movie Sony Pictures Entertainment has made. The world will be full of fear. Remember the 11th of September 2001 . We recommend you to keep yourself distant from the places at that time. (If your house is nearby, you'd better leave.) Whatever comes in the coming days is called by the greed of Sony Pictures Entertainment. All the world will denounce the SONY . - statement from the “Guardians of Peace” back in December 2014 The Interview 11th of September 2001 SONY Despite the threats and danger, the movie The Interview was still released - not in theaters but on digital platforms like Google Play, YouTube, and Xbox Video. Interview Fortunately for the US, and unfortunately for the North Korean hackers, the move backfired and led to the film still being released because now the movie became a statement about free speech and standing up to cyberterrorism. After all, if North Korea could scare the United States into not releasing a movie, then foreign hackers would be able to have a huge amount of influence over the country and what media would be released in the future. Sony even said in a statement: “We are proud to make it available to the public and to have stood up to those who attempted to suppress free speech.” Who would have known that a hack related to a Hollywood movie would be one of the earliest attempts of a foreign entity to use cyberterrorism in order to control the actions of another country?

Sony Pictures Hack: The Strike From North Korea and Early Cyberwarfare

Many small and medium businesses today rely on managed service providers (MSPs) with support for IT services and processes due to having limited budgets and fully loaded environments. MSP solutions can be integrated with client infrastructures to enable proper service delivery, thus bringing certain disadvantages along with functional benefits. In this post, we focus on MSP cyber security, including the main challenges, threats, and practices. Read on to find out: Why an MSP should care about cyber security Which threats you need to counter the most How to protect your and clients’ data and infrastructures from possible failures MSP Security: Why is it important? Managed service providers (MSPs) are usually . This fact alone makes an MSP a desired target for hackers. The opportunity to rapidly develop a cyberattack and spread the infections across a large number of organizations makes MSP security risks difficult to overestimate. A single vulnerability in an MSP solution can become a reason for failures in numerous infrastructures resulting in data leakage or loss. Apart from the loss of valuable assets, serious noncompliance fines can be applied to organizations that become victims of cyberattacks. connected to the environments of multiple clients An MSP that fails to build and support proper security can not only be forced to pay significant funds. The main point here is the reputational loss that you usually cannot recover. Thus, the risk is not only financial: failed cybersecurity can cost you future profits and the very existence of your organization. Main MSP cybersecurity threats in 2023 Although the for MSPs are countless, some threats are more frequent than others. Below is the list of most common threats that an MSP security system should be able to identify and counter. types of online cybersecurity threats Phishing Phishing can be considered an outdated cyberattack method, especially when you pay attention to the competencies and possibilities of contemporary hackers. However, phishing is still remaining among the top data threats for individuals and organizations worldwide. Simplicity is key here: a phishing email is easy to construct and then send to thousands of potential victims, including MSPs. And even if a hacker has a more thorough approach and creates individual, targeted emails to trick organizations’ employees or clients, the phishing tactics still do not require much effort to conduct an attack. Ransomware With hundreds of millions of attacks occurring every year, ransomware has been an emerging threat for SMBs and enterprise organizations for at least a decade. Ransomware is malware that sneakily infiltrates an organization’s environment and then starts encrypting all the data at reach. After a significant number of files are encrypted, the ransomware displays a notification about that fact along with a ransom demand. Many organizations have fallen victim to ransomware. The Colonial Pipeline incident in the US was also a ransomware case. A Managed Service Provider must pay special attention to this threat as the connection between an MSP and clients can cause rapid strain spreading and global data loss inside the entire client network. Denial of Service (DoS) attacks Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks are also “old-school” simple and effective hacking tactics used since the mid 90’s. The point of a DoS or DDoS attack is to cause an abnormal load on an organization’s infrastructure (a website, a network, a data center, etc.) resulting in a system failure. A DoS attack most probably won’t be the reason for data loss or damage, but the service downtime can become a source of operational discomfort, financial and reputational losses posing risks for the future of an organization. A DoS attack is conducted with the use of hacker-controlled devices (bot network) that send enormous data amounts to a target organization’s nodes and overload processing performance capabilities and/or bandwidth. Again, a DoS attack on an MSP can then be spread on clients’ environments and result in a system-wide failure. Man-in-the-Middle (MITM) attacks This type of cyber threat is a bit trickier and more complicated to conduct than direct infrastructure strikes. A man-in-the-middle (MITM) attack involves a hacker intruding, for example, into a network router or a computer, aiming to intercept traffic. After a successful malware intrusion, a hacker can monitor data traffic going through the compromised node and steal sensitive data, such as personal information, credentials, payment or credit card information, etc. This can also be a tactic suitable for corporate espionage and theft of business know-hows or commercial secrets. Risky zones for becoming a victim of MITM attacks are, for example, public Wi-Fi networks. A public network rarely has an adequate level of protection, thus becoming an easy nut to crack for a hacker. The data stolen from the traffic of careless users can then be sold or used in other cyberattacks. Cryptojacking Cryptojacking is a relatively new cyberthreat type that emerged along with the crypto mining boom. Willing to increase profits from crypto mining, cybercriminals came up with malicious agents that intrude computers, and then start using CPU and/or GPU processing power to mine cryptocurrencies, which then get transferred directly to anonymous wallets. Cybercriminals can get increased profits because they don’t need to pay electricity bills for their mining equipment in this illegal case. MSP solutions are desired targets for cryptojackers. Such a solution can be a single point of access to the networks of multiple organizations with all the servers and other computing devices at their disposal. Thus, one cyberattack can bring a lot of resources for cryptojacking to a hacker. 8 practices cybersecurity MSP organizations should use Regarding the frequency and progressing level of threats, an MSP must have an up-to-date reliable cybersecurity system. The 8 below can help you reduce the risk of protection failures. MSP cyber security practices Credential compromise and targeted attacks prevention A managed service provider should know that their infrastructure will be among the priority targets for cyberattacks and build security systems appropriately. Hardening vulnerable nodes and tools for remote access (for example, virtual private networks) is the first step to prevent compromising credentials and the entire environment as a result. Scan the system for potential vulnerabilities regularly even when your daily production software and web apps are online. Additionally, consider setting standard protection measures for remote desktop (RDP) services connected to the web. That is how you can reduce the impact of phishing campaigns, password brute forcing and other targeted attacks. Cyber hygiene Promoting cyber hygiene among staff members and clients is an efficient yet frequently underestimated way to enhance MSP cybersecurity. Although users and even admins tend to assume that relying on usual IT protection measures is enough, a Global Risks Report of World Economic Forum states that by 2022, . An employee or a user that simply remains unaware of a threat is the most significant threat in digital environments. 95% of all cyber security issues involve human error Ensuring that staff and clients know which emails not to open, which links not to click, and which credentials not to give out regardless of reasons is one of the most efficient cybersecurity measures for any organization, including MSPs. Staff education and promotion of a thorough approach towards cyberspace among clients requires much less investment compared to other protective measures and solutions but can alone noticeably boost an organization’s cybersecurity level. Anti-malware and anti-ransomware software The need for specialized software that can prevent malware from infiltrating the IT environment (and hunt malicious agents out of the system as well) may seem inevitable. However, organizations sometimes tend to postpone integrating such solutions in their systems. That’s not an option for an MSP. A managed service provider is the first line of defense for clients, and software for tracking malware and ransomware must be integrated and properly updated in an MSP cybersecurity circuit. The corporate license for such software can be costly but this is when the investment pays off in safe data, stable production availability, and clean reputation among the worldwide IT community. Networks separation Like any SMB or enterprise organization, an MSP should care about internal network security not less than about the external perimeter. Configuring and separating virtual spaces of departments can require time and effort but a protected internal network poses a serious challenge for an intruder to go through the barriers undetected. Additionally, even if internal firewalls fail to stop a hacker at once, early threat detection can give an organization more time to react and successfully counter a cyberattack. internal firewalls Thorough offboarding workflows To ensure stable production and provide appropriate performance, MSPs use third-party software solutions. Whenever a solution is no longer required due to, for example, a workflow optimization, that outdated solution should be properly excluded from an organization’s environment. To avoid leaving undetected backdoors, the offboarding process must be set up to completely wipe the solution’s elements out of the infrastructure. The same recommendation is relevant for the accounts of former employees and clients. Such an unused account can remain below the radar of an IT team, giving a hacker additional space to maneuver both when planning and conducting a cyberattack. Zero trust and principle of least privilege Zero trust and the principle of least privilege (aka PoLP) are two cybersecurity methods that an MSP should apply. Both methods are called to limit access to critical data and system elements as much as possible. PoLP prescribes granting every user inside an environment only access that is required to do their job well. In other words, any access that can be prohibited without harming an employee’s efficiency or a client’s comfort should be prohibited. The zero trust method is in turn focused on authorization. Here, every user and machine must authenticate before getting access to known resources and actions. Additionally, zero trust can help increase network segmentation efficiency. These two methods don’t exclude or replace each other and can be used simultaneously to boost MSP cybersecurity even further. Multi-factor authentication Nowadays, a password that is considered reliable may still not be enough to protect accounts and data from unauthorized access. Adding a two-factor authentication to an MSP infrastructure can strengthen protection of the entire environment, as the password alone won’t be enough to log in. Two-factor authentication (2FA) requires a user to confirm a login with an SMS code or another authorization phrase before they can access their account, change data and manipulate functions. The additional code is generated randomly at the moment of login and has a limited relevance period, thus becoming challenging for a hacker to retrieve and use on time. Non-stop threat monitoring Threats are evolving to become more sophisticated and to break through security layers more efficiently. Thus, 24/7 active monitoring of the environment can help you detect breaches and vulnerabilities before they cause unfixable failures. With up-to-date monitoring software, you can have more control over your IT environment and more time to appropriately react to cyberattacks. Backup for MSP: Your safety net when all else fails The non-stop intense development of cyberthreats means that sooner or later a hacker can find a key to any security system. The only solution that can help you save your organization’s data and infrastructure after a major data loss incident is backup. A backup is a copy of data that is stored independently. In case the original data at the main site is lost after a breach, a backup can be used for recovery. The amount of data to generate, process and store to ensure proper functioning of an organization makes manual and legacy backups unsuitable for the MSP reality. Conclusion In 2023 and beyond, managed service providers are bound to remain desired targets for cyberattacks from phishing and DoS-attack attempts to ransomware infection and cryptojacking. To ensure MSP cybersecurity, such organizations should: Create working against targeted attacks and malware, protection systems Promote cyber hygiene among employees and clients, Apply network segmentation, PoLP and non-stop monitoring to the entire environment. Additionally, MSPs might want to consider integrating multi-factor authentication and thorough offboarding workflows for solutions and employees. However, a functional MSP backup is the only solid way to maintain control over an organization’s data in case of a major data loss incident. Also published here.

Everything You Need to Know About MSP Cybersecurity

MSP সাইবারসিকিউরিটি সম্পর্কে আপনার যা কিছু জানা দরকার

Alles, was Sie über MSP-Cybersicherheit wissen müssen

Todo lo que necesita saber sobre la ciberseguridad de MSP

Tout ce que vous devez savoir sur la cybersécurité MSP

एमएसपी साइबर सुरक्षा के बारे में वह सब कुछ जो आपको जानना चाहिए

MSP サイバーセキュリティについて知っておくべきことすべて

MSP 사이버 보안에 대해 알아야 할 모든 것

Tudo o que você precisa saber sobre segurança cibernética MSP

MSP Siber Güvenliği Hakkında Bilmeniz Gereken Her Şey

Mọi thứ bạn cần biết về An ninh mạng MSP

关于 MSP 网络安全您需要了解的一切

Startups have every reason to feel like they are jumping into an ocean filled with sharks as they approach their 2023 cybersecurity strategies. As media and industry experts flood the internet with cybersecurity predictions, trends, and expectations for a year that has barely two months in, startups may wonder how to keep up. Pretending to be a small fish and hoping you go unnoticed is not a proven effective strategy. As reported on January 11, you should “think again” if you believe you can fly under a cybercriminal’s radar because your company is too small or unknown. Forbes Setting priorities while reaching business targets is challenging and hard to balance for any startup leader. And our global cybersecurity threat environment and compliance landscape do not make things any easier. How can you get past endless to-do security lists that exhaust resources, time, and money, which you do not have to spare? In this report, learn how to navigate the challenges and dive into three core cybersecurity essentials: Partnering up, virtual security teams, and preventive security/audit operations. Partnering up to spin up When professionally driven companies unite forces, only good things happen. Startups can work alongside talented security professionals without giving away “the keys to the kingdom.” Partnering up is the best way to leverage the benefits of a leading security ecosystem. For example, you can consider partnering with cybersecurity, compliance, or technology solutions. Key partnerships will benefit your systems security, your startup’s performance, and your clients. The key takeaway is to be aware of your startup’s limitations and to perceive them not as a vulnerability but as an opportunity to diversify, grow and improve your capacities. The only real chance any startup has in our modern cybersecurity threat environment is to partner up. However, this approach should never translate into losing ownership of your security. While no in-house team today can keep up and develop on-premises the tools necessary to operate in our sophisticated online world, creating business security alliances is an excellent method to build up, level up and expand your resources. Virtual CISO and security teams: Setting up overwatch In a post-COVID world, virtual security teams and virtual CISOs are not just a trend but another powerful tool for startups. Even if you have your own security team, virtual teams can help you take it to the next level while handling the work that needs to be done to free up your operators. The report, commissioned by Vade and conducted by Vanson Bourne, reveals that an astounding 96% of organizations are currently outsourcing at least some of their needs to Managed Service Providers (MSPs) or plan to do so in the future. Like other cybersecurity reports, the study explains how the increased sophistication of cyberattacks drives organizations to outsource operations. 2022 SMB Cybersecurity Landscape Talent and skill shortages, cost-effective performance, and workload scaling are top priorities in the virtual security market. The value for money and ROI of virtual CISOs is undoubtedly attractive for startups. An in-house CISO may cash in an annual salary of $250,000, or more, while virtual teams can cost around a few thousand dollars or more. But although startup leaders can now afford gold-standard virtual cybersecurity, it's essential to ensure these services are the ones you need. When shopping for virtual CISOs, you should settle for nothing short of the full package and full ownership. This means you should get all the tools and strategies to help you improve security, compliance, and governance. Your startup must have full control and ownership of your architecture. The full package must always include risk assessments, business-customized security road maps, compliance management, security policies and controls, top-notch security programs, continuous testing and tracking, risk mitigation tools, and audit mechanisms. Preventive security, pentests, and audit ops: Taking the ridge Cybercriminals can spend weeks or even months preparing a cyberattack, coding their malware (or just buying it on the dark web), running scans, and searching for the weakest way into your system. But once it's game on, the breach, on average, can take anything from 30 minutes to a couple of hours. This means that in a real attack, your security team is racing against the clock to identify and shut down the attacker before the real damage occurs. To make matters worse, as criminals get creative and new technologies are developed, attack times are slashed. reported on November 2022 that ransomware gangs embraced intermittent encryption. As the name implies, intermittent encryption, using different customized patterns, only encrypts parts of the file but can still make a drive worthless. Cloud Security Alliance Intermittent encryption is used explicitly in ransomware attacks to speed up the attack time and prevent early detection. These modern cyber attacks, now executed at high speeds, leave security teams with little to no time for defensive maneuvers. Enter: Preventive security, your best ally. Preventive security is understanding and visualizing your entire digital attack surface to identify errors, misconfigurations, vulnerabilities, and weaknesses to patch them up before a real attacker can exploit them. The main goal of preventive security is to keep one step ahead of hackers. But how can you run preventive security when digital attack surfaces continue to expand? Compromising everything from IoT to edge-computing, cloud environments, Big Data, endpoints, networks, and new web and mobile applications, digital attack surfaces can be overwhelming for startups. Try to approach this problem with a head-on frontal attack. Startups can use real internal auditors and security experts who leverage internal audit technologies driven by cutting-edge innovation and automation. These services can help your startup investigate your security posture and establish a baseline of findings with clear remediation paths. Audits on your environment should be continuous and not “one-and-done” events. For more specific needs, such as launching a new app online, you can use laser-targeted, customized penetration testing services that will solely examine the new product before launch. Running internal audits and penetration tests not only serves startups in the fight against cybercriminals but prevents them from being exposed to the risks associated with breaching data and privacy laws. It can also set a new firm up for business success, opening new business doors and building its reputation with confidence as it expands to new markets. From spear phishing and whaling to ransomware and DDoS attacks, there is no security threat that cannot be resolved by taking the proper approach. The best chance startups have to run successful vulnerability management frameworks is to shift from defensive to proactive security. Cybersecurity today will define, make, or break your company. It will reveal your startup’s  values and mission. Cybersecurity can open doors to new business, increase visibility and performance, and generate trust. , Founder and CEO of Taylor Hersom Eden Data

Startup cybersecurity 2023: Never be out of the fight

How Security Engineering is Changing the Cybersecurity Industry

Cómo la ingeniería de seguridad está cambiando la industria de la ciberseguridad

Comment l'ingénierie de la sécurité change l'industrie de la cybersécurité

कैसे सुरक्षा इंजीनियरिंग साइबर सुरक्षा उद्योग को बदल रही है

セキュリティ エンジニアリングがサイバーセキュリティ業界をどのように変えているか

Como a engenharia de segurança está mudando o setor de segurança cibernética

Kỹ thuật bảo mật đang thay đổi ngành an ninh mạng như thế nào

安全工程如何改变网络安全行业

Key takeaways Cybersecurity risks have the potential to affect all businesses regardless of size and should be regarded as a matter of priority. The need for cyber risk management within organizations is essential given the risks of financial and reputational damage and the nature of this ever-evolving landscape. Cyber risk management processes enable businesses to identify, analyze, evaluate and address cyber threats on an ongoing basis, helping to reduce the risk posed by any threats. Cyber security frameworks are a set of guidelines, standards, and best practices that are designed to help businesses manage cyber security risks. Some of the most common frameworks include the GDPR and FISMA. NIST Cybersecurity Framework, Businesses can take certain steps to manage the risk of cyber threats. These include developing a risk assessment matrix, appointing the right staff and conducting ongoing reviews to identify cyber threats. Introduction Cyber security is essential for all organizations regardless of their size, as the recent demonstrates. As cyber criminals continue to exploit vulnerabilities across all ends of the business spectrum exposing organizations to disruptions, financial loss and reputational damage, this is an area that all businesses must prioritize. cyber attack on Uber’s computer network The most effective way for organizations to protect themselves in this continually evolving environment is by adopting strategies to manage cybersecurity risk. What is cyber risk management? Cyber risk management is an ongoing review process that involves identifying potential cybersecurity threats within an organization, analyzing and evaluating their impact and addressing how to respond to such threats, should they arise. A typical cybersecurity risk management process will follow these four steps: Identify risks that could exploit a cyber security vulnerability within the organization. Analyze the level of risk identified and the likelihood of it occurring. Prioritize each risk on the basis of severity. Monitor risks on an ongoing basis to ensure risk responses align with a continually shifting threat landscape. What are the cyber risk security frameworks? Cyber security frameworks are a set of guidelines, standards, and best practices that are designed to manage cyber security risks. These frameworks are designed to help organizations assess and mitigate their exposure to vulnerabilities that could be exploited by cybercriminals. Without a robust and resilient cybersecurity framework, organizations leave themselves open to being attacked by malicious actors. Cybersecurity frameworks are split into three categories based on the functions required, as follows: 1. Control Frameworks In a control framework, strategies are developed to minimize security risks. By assessing the technical state of an organization, this framework aims to prioritize the implementation of security controls. 2. Program Framework A program framework analyzes the state of the security program within an organization and measures its competitive analysis. It also facilitates communications between the organization’s cyber security team and its management. 3. Risk Frameworks A risk framework defines the processes for assessing and managing risk. By identifying and quantifying risks appropriate security measures can be prioritized, helping to minimize the risk of a threat. While they are designed for different needs and audiences, all three frameworks aim to mitigate cybersecurity risks. Listed below are some  of the most common cybersecurity frameworks designed to help businesses establish adequate cybersecurity policies and procedures: NIST Cybersecurity Framework ISO 27001 and ISO 27002 GDPR FISMA PCI DSS 5 tips for cyber risk management. Below are five practical steps a business can take to effectively manage the risk of cyber threats. 1. Use a risk assessment matrix A risk assessment matrix is a visual tool that helps an organization identify areas of risk within it. Threat levels are commonly categorized on an increasing scale of acceptable (green) to unacceptable (red) and are based on the severity and probability of the threat occurring. Using a risk management matrix can help your business identify potential risks enabling you to implement adequate safeguards and controls to lower them. 2. Integrate risk management within enterprise systems Integration risk management involves identifying, assessing and mitigating the risks associated with the integration of new technology into an organization’s IT infrastructure through the development of risk management policies and procedures. Integrating risk management across all aspects of an organization can help it create effective enterprise risk management (ERM) initiatives and will allow it to form a standardized and cohesive risk management practice throughout each department. integration can help your organization ensure it is more effective in identifying and managing risks consistently and on an ongoing basis. Risk management 3. Appoint the right staff Appointing individuals who are specifically tasked with the role of ensuring cyber risk is effectively managed is essential for all organizations. In larger companies, a Chief Information Security Officer (CISO) should be appointed to lead the individuals or teams responsible for identifying and monitoring cyber risks ensuring any threats are swiftly responded to and resolved. A dedicated cyber security staff member or team will also ensure there is a point of contact within your organization that can be reached in the event of any uncertainty or a breach of security resulting in a fast and effective resolution to potential threats or problems. 4. Apply the right governance framework Organizations should establish cybersecurity governance programs with effective policies and procedures that ensure engagement across the entire spectrum of their business ranging from employees and to those in leadership positions. remote workers Larger organizations should form a Risk Management Committee on their Board that oversees activities relating to cyber security, making decisions in line with their overall appetite for risk. 5. Prioritize cyber threats as part of a regular risk management review/audit Cyber risk management is not a one-off event but must be incorporated as part of an ongoing review process in order to be effective. It is essential to regularly monitor your business to ensure your systems, safeguards and controls are adequate for the risks posed. By prioritizing cyber threats through regular audits, reviews, and readiness exercises appropriate steps can be taken to prevent the risk of a cyber threat impacting your business. Conclusion As long as cybercriminals continue to find ways to outsmart and exploit vulnerabilities within organizations, there will be a need to have protocols in place which are designed to counter such risks. Putting in place an effective cyber risk management process can help your business identify potential threats quickly, thereby mitigating the risk of financial loss, disruption to business and reputational damage.

5 Tips for Managing Cybersecurity Risk

The recent attacks against Ukraine have been one of the most damaging cyber incidents in decades, and the U.S. government has not done enough to counter these attacks. The country is increasingly vulnerable to Russian hacking operations and is not cracking down on cyber gangs. However, the Russian security services are becoming increasingly adept at fighting back against hackers. While the has tried to keep a lid on the threats posed by Russian hacking, the current conflict has created a fertile ground for scammers and phishers. Matt Warren, the director of the Centre for Cyber Security Research and Innovation at RMIT University, has urged local organizations to prepare for a range of attack scenarios. These include denial of service campaigns, website defacement, and ransomware. Australian government Australia has recently imposed sanctions on Russia, a move that has angered cyber gangs. These gangs may be influenced by Russian intelligence agencies and aim to target critical infrastructure in Europe. The attacks could affect the electricity, water, and gas networks in particular. There is a high risk that state-based hackers may also target critical infrastructure in Europe. This means organizations need to be prepared and review their cybersecurity and business continuity planning. As the international cyber threat continues to escalate, governments and companies need to increase their defenses to keep their data safe. A will be essential to ensure that critical systems are protected. If cyberattacks are not detected and remedied quickly, organizations will become vulnerable to more serious attacks. stronger cyber security posture The increased threat of international terrorists and other criminal actors will only increase the potential for more serious damage. But in the end, the world will be better for it. In the meantime, organizations must make sure they are prepared for all types of cyber-attacks. These include malicious cyber gangs targeting critical infrastructure, denial-of-service campaigns, and ransomware. As the tensions between Russia and Ukraine continue, there is a high likelihood of more attacks against critical infrastructure in the region. The escalation of these attacks could affect many industries and countries. The U.S., for example, has been hit the most by cybercrime groups, including the Conti ransomware group. The government has also launched an initiative to help Ukraine fight back against the cybercrime groups. The goal of these attacks is to degrade the credibility of the United States in the West. In the meantime, Russia will not spare any nation from retaliatory measures. While the UK and the United States are committed to protecting their vital infrastructure from attack, they can only take so far. Therefore, the government must take action. If the threats continue to escalate, the UK government must be prepared for these attacks. Then, the government should look at its cyber-extortion-related policies. These laws will ensure that the country is protected against foreign attacks that aim to undermine the political stability of the Ukraine. If this does not happen, it is important to strengthen the defence of critical sectors.

Cyber Conflict between Russia and Ukraine Escalates

There are many ways to approach the cybersecurity of your business and ensure that your data, and that of your customers, is safe from malicious actors. Most of these can boil down to focusing on the three major areas of technology, processes and people. This can help you better focus your approach to what your firm needs and which tools and techniques there are to help. Technology One of the biggest developments in the technology of cybersecurity is the integration of . These machines and programs absorb knowledge and then act on it to create a better security system than you can on your own and one that can respond at the speeds needed to counter cyber-attacks. artificial intelligence AI can monitor not only the people who access your processes, but the devices they use, giving you warning of malware on your system’s computers as well as the mobile devices assigned to or owned by employees. This monitoring can not only help you avoid problems, but it can help you better bounce back after a successful breach or breakdown by providing after-action reports and suggesting solutions. Using micro-segmentation of your data is another technological advantage you can have against cyber attacks by dividing access with security perimeters so employees can only open files they need for the job at hand instead of the whole system's worth of data. Not only does limiting access help stop data breaches from inside sources, it can also help you find the files and reports that you need easier than scrolling through the whole system. While looking for the newest tech developments and innovation to fuel your security system, it is important to not overlook the hardware and software that you currently use. Monitoring systems such as AI and your IT department can help you pinpoint which items are the least secure as well as which ones are the most likely to experience problems due to age or use. This can help you swap out crucial components before failure and update software and security as needed to avoid both cyberattacks and work shutdowns. Processes The right can inform your employees of the things expected from them as well as any disciplinary actions which will be taken for violating the policies and processes of the business. These will need to be clearly outlined so everyone knows what should be done and how as well as updated and refined on a regular basis. Including training courses and refreshers to job descriptions can help make sure that your company is not liable for damages from a mistake on the part of your employees, and it is important to have everyone sign and certify that they understand the policies and processes defined by the company. processes In terms of cybersecurity, these processes should include a proper way to maintain passwords, a schedule for updating hardware and software and a prohibition towards using private devices to access business data. Adding processes for auditing systems, who can sign off on projects and areas of restricted physical access can also keep you safer. People A security system, for cyber or physical security, is only as good as the people who maintain and interact with it. Requiring multi-factor authentication for secure systems and areas, assigning the least amount of privilege possible and keeping a mindset are good ways to train your people to be mindful of security concerns. Including regular training and updates for issues like password and key card maintenance, the use of personal devices and accessing company information off-site can increase your safety and decrease your liability if a breach happens. zero-trust Taking a multi-faceted approach to cybersecurity is the best way to keep your business safe from malicious actors. This means focusing on the technology, processes and people equally with the right training and equipment. Integrating AI can help you monitor more aspects of your system as well as effortlessly micro-segregate your access, incorporate multi-factor authentication and recover from successful attacks more quickly and effectively.

Stories, News & Mentions about CYBER

Cyber’s Stories on HackerNoon

Cyber's News & Mentions