Category: Uncategorized

  • DOD Cyber Training Academy Aims to Arm Students With Essential … – Department of Defense

    Official websites use .gov
    Secure .gov websites use HTTPS

    To meet the continuously evolving cybersecurity threats facing the United States, the Defense Department established what is now known as the DOD Cyber Crime Center's Cyber Training Academy in 1998 near Linthicum Heights, Maryland.

    Today, DC3 functions as a designated federal cyber center and a DOD Center of Excellence for digital and multimedia forensics. DC3 operates under the secretary of the Air Force executive agency.

    Students pose for group photo.
    Cyber Students

    International students from the Defense Department Cyber Crime Center’s Cyber Training Academy.
    Photo By: DOD
    VIRIN: 221002-O-D0439-002Z


    "The academy provides valuable training, accessible virtually anywhere and at any time," said Casey Szyper, director of DC3 CTA. "A rigorous curriculum provides department personnel with the relevant knowledge and cutting-edge skills they need to meet mission goals."
    CTA's mission is to provide cyber training to ensure defense information systems are secure from unauthorized use, counterintelligence and criminal and fraudulent activities, said Szyper.
    Students can access training courses in four ways: in-residence; instructor-led virtual; online self-paced; or mobile training teams in locations throughout the U.S. and abroad.

    Students pose for group photo.
    Field Trip

    Students from the Defense Department Cyber Crime Center’s Cyber Training Academy take a field trip to Washington, D.C.
    Photo By: DOD
    VIRIN: 221002-O-D0439-001R

    The academy provides training in more than a dozen courses—ranging from computer basics to network intrusions and cyber analysis—designed to meet the evolving needs of students, said Szyper.
    Also, the academy offers training in modern cybersecurity tools such as open vulnerability assessment scanner and network mapper.
    In an effort to offer cyber training across the department, the academy offers a newly designed "CyberCast" which can train common access card/personal identity verification cyber operators through virtual self-paced and skillset-specific materials.

    The academy offers three DOD certifications, widely recognized as validations of competency in digital forensic skills, to students who pass the following combinations of courses: digital media collector, digital forensic examiner and cyber-crime investigator with counterintelligence/law enforcement badge.
    Another unique offering from CTA is their International Cyber Forensics Course.
    "The ICFC provides students with the solid working knowledge necessary to conduct incident response and digital forensics of digital media to include networks." said Angela Jenkins, CTA ICFC Training Coordinator. "The course is in-residence for five weeks with 200-hours of instruction, and more than 94-hours of hands-on training."
    The following encompasses the ICFC schedule:

    ​International Cyber Forensics Course Schedule
    Week 1: Introduction to Networks and Computer Hardware
    Week 2: Cyber Incident Response Course
    Week 3: Windows Forensics Examination-En-Case
    Weeks 4 and 5: Forensics and Intrusions in a Windows Environment

    The latest ICFC, held Aug. 1 through Sept. 2, included students from Hungary, Kuwait, Korea, and Jordan. This was the largest student population in any one iteration since inception of the course in 2019. To date, and through COVID-19 pandemic international limitations, the academy has trained 22 international partners in six separate iterations of the ICFC.
    Upon completion of the ICFC, students will master the following:

    Course Objectives
    Identify hardware components in a computer system
    Employ operating system tools to manage disks, partitions and file systems
    Perform domain management and administrative tasks using Windows server active directory and group policy tools
    Configure a system to be able to communicate on a network
    Perform basic computer troubleshooting
    Perform basic computer tasks using Windows
    Prepare for a cyber incident response and perform the role of a first responder
    Prepare accurate documentation of a cyber investigation to include all actions taken
    Examine where digital data resides in a variety of digital devices
    Collect volatile and non-volatile data
    Demonstrate how to handle digital media effectively upon responding to an incident
    Generate hash values for collected data and forensic images
    Conduct a forensic examination of an image of the Windows operating system
    Demonstrate the basic functions, configurations, outputs, tools and settings of EnCase
    Examine a forensic image from a Windows computer using basic forensic processes and automated tools in EnCase
    Use password recovery toolkit to defeat protected files
    Generate a detailed and accurate account of a network intrusion
    Analyze network-based evidence
    Analyze host-based evidence
    Explain how to conduct a lawful network investigation

    "DC3 has the unique privilege of interacting with our globally-positioned cyber partners in an educational forum," said Jude Sunderbruch, DC3 executive director. "Graduating students of our ICFC have helped to foster positive relationships between DC3 and their host U.S. embassy representatives, national security counterparts, and both U.S. and foreign military training delegates."

    Currently, the academy is only approved to train ministry of defense personnel in partner nations. Collaboration and discussions between the International Military Student Office and Defense Security Cooperation Agency continue in an effort to increase support and funding for training non-MOD personnel through the Section 345 Regional Defense Fellowship Program.
    Choose which Defense.gov products you want delivered to your inbox.
    The Department of Defense provides the military forces needed to deter war and ensure our nation's security.

    source

  • Meta Slapped With 5.5 Million Euro Fine for EU Data Breach – SecurityWeek

    Hi, what are you looking for?
    Meta was fined an additional $5.9 million for violating EU data protection regulations with WhatsApp messaging app.
    By
    Flipboard
    Reddit
    Pinterest
    Whatsapp
    Whatsapp
    Email
    Social media giant Meta has been fined an additional 5.5 million euros ($5.9 million) for violating EU data protection regulations with its instant messaging platform WhatsApp, Ireland’s regulator announced Thursday.
    The penalty follows a far larger 390-million-euro fine for Meta’s Instagram and Facebook platforms two weeks ago after they were found to have flouted the same EU rules.
    In its new decision, the Irish Data Protection Commission (DPC) found the group acted “in breach of its obligations in relation to transparency,” the watchdog said in a statement.
    In addition, Meta relied on an incorrect legal basis “for its processing of personal data for the purposes of service improvement and security,” the DPC added, giving the group six months to comply.
    { Read: Has Facebook Sidestepped GDPR’s User Consent Requirements? }
    The fine was imposed by the Irish regulator because Meta — along with other US tech firms — has its European headquarters in Dublin.
    In response on Thursday, Meta said it was opposed to the DPC decision and would look to overturn it.
    “We strongly believe that the way the service operates is both technically and legally compliant,” a WhatsApp spokesperson said.
    “We disagree with the decision and we intend to appeal.”
    The breaches are similar to those explained in the regulator’s action against Meta earlier in January.
    But the earlier decision also accused the Meta platforms of breaking rules over the processing of personal data for the purpose of targeted advertising.
    In that instance the company, co-founded by social media magnate Mark Zuckerberg, was given only three months to respond to comply with the Irish regulator.
    Meta announced its intention to appeal the 4 January decision, adding the regulatory ruling did not prevent targeted or personalised advertising.
    The DPC said its more recent fine was considerably less because of a 225 million euro fine imposed on WhatsApp for “for breaches of this and other transparency obligations over the same period of time”.
    Thursday’s Whatsapp fine was also far lower because it did not relate to targeted advertising.
    The Irish regulator had fined Meta 405 million euros in September for failures in handling the data of minors, and 265 million euros in November for not sufficiently protecting users’ data.
    This latest round of fines follows the adoption of three binding decisions by the European Data Protection Board (EDPB), the EU’s data protection regulator, in early December.
    The Vienna-based privacy group NOYB, which brought the three complaints against Meta in 2018, had accused the social media behemoth of reinterpreting consent as a civil law contract, which stopped users from refusing targeted advertising.
    In reaction to Thursday’s news, NOYB criticised the “tiny” size of the latest fine — and slammed the DPC for ignoring how WhatsApp shares data within the group for advertising purposes.
    “We are astonished how the DPC simply ignores the core of the case after a 4.5-year procedure,” said NOYB founder Max Schrems.
    In October 2021, the Irish authority had proposed a draft decision that validated the legal basis used by the group and suggested a fine of up to 36 million euros for Facebook and up to 23 million euros for Instagram, over their lack of transparency.
    France’s CNIL regulator and other European bodies disagreed with the draft sanction, which they considered to be far too low.
    They asked the EDPB to judge the dispute with the EU data regulator deciding in their favour.
    The EDPB has also asked the Irish regulator to investigate Meta’s use of personal data.
    However in its statement the DPC pushed back saying the the EU body does not have the power to “direct an authority to engage in open-ended and speculative investigation”.
    The regulator said it will seek to annul the EDPB’s request before the European Union’s Court of Justice.

    AFP 2023
    Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
    Join this webinar to gain clear advice on the people, process and technology considerations that must be made at every stage of an OT security program’s lifecycle.
    This presentation will provide an overview of the security risks associated with SaaS, best practices for mitigating these risks and protecting data, and discuss the importance of regularly reviewing and updating SaaS security practices to ensure ongoing protection of data.
    While there are many routes to application security, bundles that allow security teams to quickly and easily secure applications and affect security posture in a self-service manner are becoming increasingly popular.
    Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.
    No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.
    Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.
    How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.
    Flipboard
    Reddit
    Pinterest
    Whatsapp
    Whatsapp
    Email
    The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often…
    U.S. fighter jets successfully shot down the high altitude spy balloon launched by and belonging to China.
    Los Gatos, Calif-based data protection and privacy firm Titaniam has raised $6 million seed funding from Refinery Ventures, with participation from Fusion Fund, Shasta…
    Many in the United States see TikTok, the highly popular video-sharing app owned by Beijing-based ByteDance, as a threat to national security.The following is…
    As smartphone manufacturers are improving the ear speakers in their devices, it can become easier for malicious actors to leverage a particular side-channel for…
    For the past seven months, the Tor network has been hit with numerous DDoS attacks, some impacting availability.
    The U.S. is tracking a suspected Chinese spy balloon spotted over U.S. airspace, officials said on Feb. 2, 2023.
    The EU’s digital policy chief warned TikTok’s boss that the social media app must fall in line with tough new rules for online platforms…
    Got a confidential news tip? We want to hear from you.
    Reach a large audience of enterprise cybersecurity professionals
    Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
    Copyright © 2023 Wired Business Media. All Rights Reserved.

    source

  • Get 10 cybersecurity courses for just $35 – TechRepublic

    Get 10 cybersecurity courses for just $35
    Your email has been sent
    Be prepared for the latest cybersecurity threats with the 2023 Complete Cyber Security Ethical Hacking Certification Bundle.
    A recent study found that cyber criminals can penetrate 93% of company networks. Really, it’s not a matter of if your business is vulnerable, it’s when it will be targeted. While there’s some security in being relatively small, you can’t assume your business won’t eventually become a target. Still, there’s a lot you can do to bolster your cybersecurity, including giving yourself an education.
    Whether your company seems lax on cybersecurity and you want to help mitigate the risks or you’re looking for a lucrative new opportunity, learning cybersecurity skills is a great idea—especially now that The 2023 Complete Cyber Security Ethical Hacking Certification Bundle is on sale for just $34.99.
    This 10-course bundle includes training from Total Seminars, Oak Academy and Saad Sarraj. It’s designed to help you start as a beginner and rise to an advanced level of cybersecurity expertise, so you can either start from scratch or jump into the courses at a more intermediate level.
    You’ll learn how to set up a Kali Linux system, how to create a secure penetration testing environment, hack systems with Metasploit, scan networks using Nmap and Nessus, use Python to crack passwords and much more. From ethical hacking to AWS security, practical hacking with Raspberry Pi and more, you’ll get a comprehensive cybersecurity education that will help you protect your business against potential attacks. The final course will even prepare you to sit and pass the CompTIA PenTest+ certification exam to demonstrate your skills.
    It’s time to join the fight to protect businesses from cybercrime. Right now, you can get The 2023 Complete Cyber Security Ethical Hacking Certification Bundle on sale for just $34.99.
    Prices and availability are subject to change.
    Stay up to date on the latest in technology with Daily Tech Insider. We bring you news on industry-leading companies, products, and people, as well as highlighted articles, downloads, and top resources. You’ll receive primers on hot tech topics that will help you stay ahead of the game.
    Get 10 cybersecurity courses for just $35
    Your email has been sent
    Your message has been sent
    TechRepublic Premium content helps you solve your toughest IT issues and jump-start your career or next project.
    Looking for the best payroll software for your small business? Check out our top picks for 2023 and read our in-depth analysis.
    Next year, cybercriminals will be as busy as ever. Are IT departments ready?
    The company, which for several years has been on a buying spree for best-of-breed products, is integrating platforms to generate synergies for speed, insights and collaboration.
    Organize a number of different applicants using an ATS to cut down on the amount of unnecessary time spent finding the right candidate.
    Whether you are a Microsoft Excel beginner or an advanced user, you’ll benefit from these step-by-step tutorials.
    Stay up to date on the latest in technology with Daily Tech Insider. We bring you news on industry-leading companies, products, and people, as well as highlighted articles, downloads, and top resources. You’ll receive primers on hot tech topics that will help you stay ahead of the game.
    Recruiting a Data Architect with the right combination of technical expertise and experience will require a comprehensive screening process. This Hiring Kit provides an adjustable framework your business can use to find, recruit and ultimately hire the right person for the job. From the hiring kit: To make their best decisions, businesses need the best …
    Regardless of what business or what industry you are in, the potential benefits of cloud computing and cloud computing services are self-evident. Whether you just need some basic off-premises storage or run your entire enterprise from the cloud, the benefits of scalability, convenience, predictability, availability and reliability are always just a few clicks away, or …
    Useful and actionable information is the engine of success that drives the modern business enterprise. Properly collecting, storing and processing business data is what provides the fuel for that success engine. The database administrator is responsible for determining how data will be collected, structured and stored so that it can be accessed and processed when …
    Smartphones and other mobile devices play a vital role in the modern digital world. Businesses not only rely on mobile applications for connecting with customers and clients, but also deploy applications for use by employees for internal communications and interaction. Of course, consumers use their mobile devices for a multitude of social and commercial activities. …

    source

  • Layoffs Mount as Cybersecurity Vendors Hunker Down – Dark Reading

    Cybersecurity firms Snyk and Cybereason separately announced significant layoffs during the last week of October, cutting their workforces by 198 and 200 workers and representing 14% and 17% of their workforces, respectively.
    The two companies are the latest cybersecurity vendors to join a growing list of more than three dozen firms to pare their workforces in the past six months, as the global economy continues to flash signs of a slowdown and possible recession. On Oct. 24, for example, Snyk CEO Peter McKay announced that, while the developer security firm continues to grow, the company “must operate even more efficiently in order for Snyk to effectively withstand the continued headwinds facing the global economy.”
    Cybereason CEO and co-founder Lior Div also claimed strong operations but stressed its need to move away from aggressive investments in research and development, sales, and marketing and instead focus on customer retention and innovating in its core market of extended detection and response (XDR).
    “While we are making significant traction in these areas and our growth remains strong, we are seeing significant volatility in the global financial markets that require us to prioritize profitability over growth,” he said in an Oct.26 blog post.
    Snyk and Cybereason are not alone. In June, privacy and security firm OneTrust announced it would lay off 950 employees, or 25% of its workforce. In late May, cloud security firm Lacework announced it would layoff approximately 300 workers, or 20% of its head count. Last week, cybersecurity automation firm Forescout announced it would be cutting costs but did not release the specific number of layoffs, instead saying the company intended to “optimize our cost base to prepare for difficult economic times over the next period to ensure the future success.”
    In total, 32 cybersecurity firms have announced layoffs or restructuring since early May, according to layoff tracking site Layoffs.FYI, most citing the tightening market and need to protect the longevity of the business.
    “While we do not have control of the environment around us, we do have a responsibility to control how we operate our business and make changes as needed to best position the company for continued and long-term success,” Jay Parikh, CEO of Lacework, said in a May update. “We have adjusted our plan to increase our cash runway through to profitability and significantly strengthened our balance sheet so we can be more opportunistic around investment opportunities and weather uncertainty in the macro environment.”
    Cybersecurity vendors’ retrenchment is not without cause. The vast majority (83%) of companies expect to contend with a recession in 2023, and most of those businesses are taking steps to prepare, according to the “2023 State of IT” report. IT budgets will likely stagnate: While half of businesses (51%) expect to increase IT budgets in 2023, a significant portion of those increases are due to inflation, not expanding purchases and services, the report stated.
    Investments are drying up as well, leaving startup companies more reliant on their actual cash flow to fuel future operations. Venture capital financing totaled $3.1 billion in the third quarter of 2022, down from $7.9 billion for the same quarter in 2021, according to cybersecurity-focused venture capital firm Momentum Cyber.
    “It’s at that point where investors can be much more scrutinizing with valuations, because if they feel like the whole economy is slowing down, they might not feel like they want to take that go-to-market risk,” Eric McAlpine, managing partner at Momentum Cyber, said in the company’s “Cybersecurity Market Review Q3 2022” report.
    It should be said that not every company says layoffs are the result of economic realities. In August, for example, security software firm Malwarebytes reportedly sacked at least 125 employees, or about 14% of its global workforce, maintaining the company was not trying to achieve profitability but shifting to a different strategy. A month later, Malwarebytes announced a $100 million investment and a strategic shift to the managed detection and response (MDR) market.
    Yet for the most part, companies appear to be hunkering down, cutting spending, and making sure they can survive as long as possible if market conditions worsen. Privacy and security firm OneTrust, for example, pointed to a potential poor economy as the reason for the paring of its workforce.
    “My responsibility is to ensure OneTrust thrives and is positioned for sustained growth, and unfortunately, reducing our headcount and adapting to the capital markets sentiment is what is needed to keep us in our leadership position,” Kabir Barday, the firm’s CEO, said in a blog post. 
    While specific cybersecurity vendor companies are cutting workers, overall the job market for cyber pros continues to be strong — a good sign for those workers who have been laid off. Businesses continue to look for cybersecurity experts, with the workforce growing 6% to 1.34 million in North America over the past 12 months, according to (ISC)2, a cybersecurity professional organization.
    And job listings for tech jobs in general on jobs site Indeed.com have climbed 49% above the pre-pandemic baseline as of Oct. 21.
    Meanwhile, the continued shortfall in cybersecurity workers and the increasing adoption of cloud services will result in more organizations gaining their cybersecurity expertise delivered as a service. (ISC)2 expects greater adoption, especially by small businesses, that do not have the need or budget to fund a permanent on-site team.
    “We have seen a greater demand for cybersecurity skills to defend, protect, and secure our trail of personal data as threats become increasingly complex and our digital footprint continues to grow,” says Clar Rosso, CEO of (ISC)2, urging organizations to not drop their collective guard.
    “As organizations navigate increased economic pressures, I encourage them to continue to prioritize their cybersecurity needs,” Rosso says. “Bad actors and exploits will not go away if the economy worsens; in fact, one might argue the threat landscape worsens during challenging times.”
    Copyright © 2023 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG.

    source

  • MD Department of Labor To Fund Critical Cybersecurity Upskilling … – Maryland Department of Labor

    State Invests Training Dollars for the Cultivation of a Highly-Skilled Workforce to Combat Cyber Threats
    BALTIMORE, MD (October 27, 2022) – Maryland Secretary of Labor Tiffany P. Robinson today announced that funding from the Employment Advancement Right Now (EARN) Maryland program will be utilized to deliver cutting-edge cybersecurity training to State employees. In partnership with the Maryland Department of Information Technology (DoIT), EARN grantee Baltimore Cyber Range LLC (Baltimore Cyber) will provide training to one hundred State employees.
    “EARN Maryland has been nationally-recognized for its industry-driven approach, which has proven successful in cultivating a highly-skilled workforce for the private sector,” said Secretary Robinson. “But given the ever-evolving cybersecurity threat to our state government, I am pleased we are able to invest in the training and upskilling of our own cyber workforce with these funds. State employees play a critical, full-time role in ensuring our government runs effectively and efficiently, and this grant to Baltimore Cyber will go a long way towards achieving this goal,” continued Robinson.
    Those selected for training will have the opportunity to participate in classroom and hands-on training, including hyper-realistic scenarios of real-world cybersecurity threats free-of-charge. Select individuals will also have the opportunity to earn the Certified Information Security Systems Professional Certification.
    “The Department of Information Technology looks forward to partnering with MD Labor and Baltimore Cyber on this exciting initiative,” said Chip Stewart, State Chief Information Security Officer. “The training provided through this effort will ensure our State workforce continues to have the relevant skills to identify and respond to ever-changing cybersecurity threats.”
    This investment is the latest in the Hogan administration’s commitment to developing a strong cybersecurity and information technology workforce. Recognizing the success of the EARN Maryland program, the Hogan administration has more than doubled the investment into EARN, with an added targeted investment of $3 million annually for cybersecurity and information technology. Given the growing demand for highly-skilled cyber and information technology professionals, the FY23 budget includes an additional $1 million, for a total of $4 million for the industry. 
    The program has supported nearly 2,100 individuals in obtaining employment in the cybersecurity and information technology industries, and close to 2,000 incumbent workers have received training. 
    Similarly, over the past several years, the Maryland Apprenticeship and Training Program has experienced impressive growth, with the program achieving the first-time milestone of over 12,000 apprentices “earning and learning” across Maryland. The program currently has 182 active apprenticeship programs partnering with 3,879 employers. Since 2016, a total of 16 Registered Apprenticeship programs for occupations in cybersecurity or information technology have been created in Maryland, serving 60 individual businesses collectively. 
    In addition, the Department of Labor has previously awarded a total of 15 individual grants to a variety of intermediaries to help support the adoption of the apprenticeship model for cyber/IT employers.   
    Apprenticeships are full-time jobs that include on-the-job training and classroom instruction, allowing apprentices to earn while they learn. Anyone 18 years of age or older can be a registered apprentice. Businesses and job seekers interested in apprenticeships are invited to contact info@mdapprenticeship.com or call 410-767-2246. For more information about EARN Maryland, please visit https://labor.maryland.gov/earn/.
    MEDIA CONTACT:
    Joe Farren
    Cell: 410-746-0010
    1100 North Eutaw Street, Baltimore, MD 21201

    source

  • Microsoft surpasses $20B in security revenue as enterprise … – Cybersecurity Dive

    Let Cybersecurity Dive’s free newsletter keep you informed, straight from your inbox.

    The company’s cybersecurity business is growing, but CEO Satya Nadella warned that customers, in an uncertain economy, are exercising caution.
    Microsoft surpassed $20 billion in revenue from its cybersecurity business over the past 12 months, double the total reached just two years ago.
    CEO Satya Nadella shared the revenue milestone during the company’s fiscal second quarter earnings call last week.
    After acquiring a number of niche security vendors, Microsoft has positioned itself as one of a handful of security companies that can claim an end-to-end platform for the enterprise customer. 
    “Customers are consolidating on our security stack, in order to reduce risk, complexity and cost,” Nadella told Wall Street analysts during the call.
    Nadella claims Microsoft is the only company with integrated tools spanning identity, security, compliance, device management and privacy. He told analysts the company is taking market share across all the major categories and said the number of organizations with four or more workloads has increased 40% year-over-year. 
    U.K. sports and lifestyle retailer Frasers Group consolidated its security business under Microsoft after working with multiple vendors, according to Microsoft. 
    The company, which has expanded over the years through numerous acquisitions, unified its IT security with Microsoft over security rivals like CrowdStrike and SentinelOne
    He also cited firms like Astellas Pharma, Ferrovial and University of Toronto moving to Microsoft Sentinel for the company’s integrated extended detection and response and security information and event management capabilities. 
    In 2022, rival security firms like Palo Alto Networks and CrowdStrike noted that enterprise customers were looking to consolidate security vendors in order to decrease complexity. Macroeconomic concerns were starting to impact customer decision making, they said. 
    During the call, Nadella warned that customers overall are exercising caution because of macroeconomic conditions. 
    The company earlier this month announced plans to cut 10,000 jobs companywide, representing about 5% of its overall workforce. It was not immediately disclosed how those job cuts would break down across various units of the company. 
    Get the free daily newsletter read by industry experts
    The ubiquity of the cloud has left security gaps for organizations, leaving them to navigate a complex vendor landscape and defend their technology supply chain
    Chief Product Officer Josh Prewitt said the company restored email access to more than three-quarters of its Hosted Exchange customers. But Rackspace officials pushed back on alleged connections to ProxyNotShell.
    Subscribe to Cybersecurity Dive for top news, trends & analysis
    Get the free daily newsletter read by industry experts
    The ubiquity of the cloud has left security gaps for organizations, leaving them to navigate a complex vendor landscape and defend their technology supply chain
    Chief Product Officer Josh Prewitt said the company restored email access to more than three-quarters of its Hosted Exchange customers. But Rackspace officials pushed back on alleged connections to ProxyNotShell.
    The free newsletter covering the top industry headlines

    source

  • Investigation launched into Twitter after 400m user details posted on hacking forum | Cyber Security Hub – Cyber Security Hub

    A dataset allegedly containing the email addresses and phone numbers of more than 400 million Twitter users has been put up for sale on hacking forum Breached Forums.
    The dataset was uploaded to Breached Forums on December 23, 2022, by a hacker going by the screen name ‘Ryushi’. The hacker claimed to have collected the data using data scraping techniques and a now-patched vulnerability in the social media site’s software in 2021 and demanded US$200,000 for an “exclusive” sale of the data.
    Sample of 400 million Twitter breach
    Alexandria Ocasio-Cortez
    – SpaceX
    – CBS Media
    – Donald Trump Jr.
    – Doja Cat
    – Charlie Puth
    – Sundar Pichai
    – Salman Khan
    – NASA’s JWST account
    – NBA
    – Ministry of Information and Broadcasting, India
    – Shawn Mendes
    – Social Media of WHO pic.twitter.com/RdezKOlMml

     
    In their post, the hacker addressed Twitter owner Elon Musk directly, saying: “Twitter or Elon Musk if you are reading this you are already risking a GDPR fine over 5.4 m[illion] breach imaging [sic] the fine of 400 m[illion] users breach.
    “Your best option to avoid paying $276 million USD in GDPR breach fines like Facebook did…is to buy this data exclusively”.
    The hacker went on to warn that if Twitter did not buy the data before it was sold, users would “lose trust in you” and said that if malicious actors used the data to gain unauthorized access to the accounts of prominent people (e.g. celebrities or politicians), that they will “for sure make them ghost the platform” and “ruin [Musk’s] dream” of Twitter being a video sharing platform.
    Ryushi went on to say that the data breach would exacerbate an already “sensitive time” for content creators on Twitter, and that if Musk was unsure about what to do he should “run a poll on Twitter like usual and people will chose their fate”, a reference to the fact Musk has allegedly used Twitter polls to influence business decisions.
    The hacker also blamed Twitter directly for that hack, saying “at the end of the day it’s the company’s fault this data was breached”. 
    Hey @elonmusk, since you don’t seem to have much a media/comms team anymore, can you address the apparently legitimate claim that someone scraped & is now selling data on hundreds of millions of Twitter accounts? Maybe it didn’t happen on your watch, but you owe Twitter a reply.

    Users of the site have urged Musk to publicly comment on the data breach. Cyber security expert and investigative journalist Brian Krebs tagged Musk in a public post about the breach, saying that he “owe[s] Twitter a reply” about the breach, even if it “didn’t happen on [his] watch”.
    The forum post included sample data for 37 celebrities, corporations, journalists, politicians and government agencies including Doja Cat, Alexandria Ocasio-Cortez, the World Health Organization, Shawn Mendes and Piers Morgan.
    It has been suspected that the sample data has already been used by malicious actors to access the accounts listed in the sample, namely British tabloid journalist Piers Morgan. This suspicion arose after Morgan’s Twitter was allegedly hacked and a number of strange tweets were posted to his profile between Christmas Day and Boxing Day 2022.
    These tweets included abusive messages, false information and racial slurs directed at a number of people including the late Queen Elizabeth II and singer Ed Sheeran.
    Morgan has not yet publicly addressed the hack.
    The Irish Data Protection Commission (DPC) announced on December 23, 2022, that it will be launching an investigation into a breach that exploited the same vulnerability and affected 5.4 million users in July 2022. This investigation was referenced by Ryushi in their post.
    The breach took place using a vulnerability in Twitter software that was first flagged to the company in January 2022. This vulnerability allowed malicious actors to learn if an email address or phone number was associated with an existing account by entering the number or email address and attempting to log in. 
    The DPC said in a statement that it had “corresponded with Twitter International Unlimited Company (‘TIC’)” in relation to the data breach and “raised queries in relation to GDPR compliance”. 
    After considering the information provided by TIC in response to its queries, the DPC said it was “of the opinion that one or more provisions of the GDPR and/or the Act may have been, and/or are being, infringed in relation to Twitter Users’ personal data”. 
    As a result of this, the DPC said that it will be investigating the data breach to determine “whether TIC has complied with its obligations, as controller, in connection with the processing of personal data of its users or whether any provision(s) of the GDPR and/or the Act have been, and/or are being, infringed by TIC in this respect”.
    In November 2022, social media company Meta was fined $275 million following an investigation by the DPC into a Facebook data leak that took place in April 2021. This was also referred to by the hacker in their Breached Forums post. 
    February 21 – 22, 2023
    Free CS Hub Online Event
    22 February, 2023
    Online
    01 March, 2023
    Online
    08 – 09 March 2023
    Free CS Hub Online Event
    08 March, 2023
    Online
    15 March, 2023
    Online
    Insights from the world’s foremost thought leaders delivered to your inbox.
    2023-03-15
    10:00 AM – 11:00 AM EST
    2023-03-15
    10:00 AM – 11:00 AM SGT
    2023-03-08
    10:00 AM – 11:00 AM EST
    Reach Cyber Security professionals through cost-effective marketing opportunities to deliver your message, position yourself as a thought leader, and introduce new products, techniques and strategies to the market.
    Join CSHUB today and interact with a vibrant network of professionals, keeping up to date with the industry by accessing our wealth of articles, videos, live conferences and more.
    Cyber Security Hub, a division of IQPC

    Careers With IQPC| Contact Us | About Us | Cookie Policy
    Become a Member today!

    We respect your privacy, by clicking ‘Subscribe’ you will receive our e-newsletter, including information on Podcasts, Webinars, event discounts, online learning opportunities and agree to our User Agreement. You have the right to object. For further information on how we process and monitor your personal data click here. You can unsubscribe at any time.

    source

  • The 10 Best Online Courses to Start a Cybersecurity Career – MUO – MakeUseOf

    If you want to get involved in cybersecurity, learning the necessary skills beforehand is a good idea.
    Cybersecurity is essential across several industries today, and cybersecurity professionals are highly sought after in today's tech-centric labor market. Thus, the demand is high, and if you have foundational knowledge in the field, improving your technical prowess and skills will boost your career prospects significantly.
    Cybersecurity is rapidly evolving, and you do not want to be caught slacking or left behind. Hence, you must go above and beyond to level up your profession. Here are ten of the best-advanced cybersecurity courses to enroll in and acquire comprehensive training.
    This expert course is invested in teaching the most important statistics of cybersecurity and the dynamics of cybercrime. It also analyzes how to respond to cybercrime incidents and forensic acquisitions. Also, you will understand how to efficiently conduct a computer investigation to trace IP or data theft, determine which data is lost, and how to recover them.
    Further, you will acquire professional knowledge on hackers' techniques and how to defend security systems against expert cyber criminals. Beginners who are already skilled in the general protection of internet systems but want to become advanced cybercrime investigators will find this curriculum very helpful. The course is divided into fourteen series and is available on Udemy for $71.76.
    This nine-week online course offers in-depth training on cybersecurity threats and how to manage them. You will take your cybersecurity knowledge further by learning all about password security issues, attacks, ways passwords are bypassed, and how you can prevent these attacks.
    This expert track uses practical examples and scenarios to outline how the biggest cyber threats can be identified and tackled with vital digital security tools. The advanced cybersecurity training course comprises hands-on tests and case studies to help increase your awareness and furnish your network security skills. You can access this course on FutureLearn for $39.
    This program goes beyond teaching how to tackle cyberattacks; it instills proactivity in the sense that breaches are mostly preventable. The courses are specially designed for professionals in the cybersecurity field to accelerate their careers.
    Also, you will acquire skills crucial to ensuring data privacy from unauthorized disruption, identifying cyber risks and how to respond appropriately, and designing security policies to ensure the privacy of customers' data. To enroll in this advanced cybersecurity program, you can subscribe to the all-access fee of $2,970 for a year or $495 per online course. This pay guarantees access to six relevant courses, lecture materials, videos, tests, and exams for a year or sixty days.
    This cybersecurity diploma is available for those interested in thoroughly understanding the important cybersecurity concepts. You have at your disposal lecture materials to facilitate your knowledge of investigation techniques, risk management, security policies, and malware function.
    You also get a specialist tutor dedicated to making the learning process enjoyable. The specialist teaches online frauds and fraudsters, defense against cyber crimes, effective cybersecurity tips, and policies. Enhance your career prospect with this self-paced six-series course for the discounted sum of €12 (c.$12.02), and be a professional in about three weeks.
    This course presents a detailed overview of key cybersecurity concepts to improve your technical understanding. These advanced concepts include assembly language, cryptography, risk assessment and management, and popular security frameworks. As a learner, you thoroughly understand security frameworks, Linux, and how to recognize vulnerabilities in security systems and deal with them.
    This online training encompasses sound lecture materials, assessments, hands-on labs, and projects. The advanced cybersecurity concepts course is available to tech professionals ranging from cybersecurity consultants to penetration analysts and security analysts and is accessible on INFOSEC for the yearly subscription of $299.
    The tutors of this training are committed to equipping students with an overall understanding of cybersecurity, its risks, and risk management. Enrolling in this course guarantees comprehensive knowledge on how to analyze cyber threats, threat intelligence, cyber strategies, and policies to strengthen the security system of your organization.
    Furthermore, you get guidance on protecting cyber assets by building and enforcing a strong Cyber risk framework to fight off the unauthorized intrusion of sensitive data. The cyber risk officer course runs for eight weeks, is self-paced, tutor-led, and available for €1,950 (c.$1,952).
    To enroll in this specialist course, it is important that you already have some experience in cybersecurity and Python to make learning easier. In five outlines, you will learn how to use Python to carry out cybersecurity tasks and objectives efficiently.
    This course is free; after five months, you will become an expert in developing Python and modifying the same to automate cybersecurity tasks. Python is a widely used programming language and can be quite helpful in establishing defense activities.
    The Diploma in Cybersecurity Advanced Course teaches the fundamentals of cyber defense, ethical hacking, information security, Python scripting, and encryption. The advanced topics will give insight into main concepts in the cyber world, communication with computers to understand the nature of cyber attacks, and how cybercriminals bypass security questions.
    It is important to note that this course is based on programming languages; hence, you will gain additional knowledge of popular programming languages like SQL, HTML, and Python. One of the side attractions of this course is that you have access to live sessions with tutors to engage directly. The course costs €5,500 (c. $5,507) and takes about 10 months to be completed.
    This professional certification is for cybersecurity specialists who wish to go beyond the norm by acquiring skills to become professionals. Cybersecurity professionals are trained to implement policies and the most effective data security solutions in complex cyber situations. Graduates of this professional course become proficient in proactively securing security operations within an organization, applying advanced security practices using modern technologies to ensure that an organization is ready for unforeseen attacks.
    Enrolling in this course is characterized by access to interactive, hands-on lab experience, video sessions, and growth analytics. This course is highly recommended for advanced level training. To enroll, you must have at least five years of technical security experience and pay the $494 tuition fee.
    Defense cybersecurity is an important aspect of the cybersecurity profession. Every organization needs the services of a defense cybersecurity expert who is skilled in relentlessly tackling cyber infiltration and data theft. This course teaches the importance of putting in place a competent defense framework as a preventive method.
    The academy is committed to training cybersecurity specialists into professionals with sufficient expertise in cyber defense and defense infrastructures. Learners also have access to high-tech infrastructures to learn with. The course is divided into 11 modules and can be completed within 12 months if you invest at least 12 hours weekly.
    There are countless reasons you should invest in accelerating your career in cybersecurity, considering the competitive advantage it gives you over other cyber specialists. Cybersecurity is ever-expanding, and this overview of each advanced certification will be very helpful in making that professional decision your career needs.
    Raji Oluwaniyi is a multifaceted content writer with a penchant for research, writing, and editing a wide range of content with minimal oversight. As a Top Rated Freelancer, he has three years of experience writing tech-related and career-focused content for companies like Career Karma and Test Gorilla. Currently, he is a Work and Career section writer at MakeUseOf. As such, he looks forward to impacting a wide audience through his value-oriented and engaging approach to content writing.

    source