Category: Uncategorized

Let Cybersecurity Dive’s free newsletter keep you informed, straight from your inbox.

Companies trying to fill cybersecurity roles need to stop looking for unicorns and expand their search to qualified, but often overlooked, job candidates.
A recent data analysis from CyberSeek confirmed what many in cybersecurity know all too well: The job market is on fire.
U.S. employers posted roughly 715,000 cybersecurity roles in the 12-month period ending in April 2022. Demand for cybersecurity jobs increased 43% over that 12-month period, compared to 18% for the rest of the job market. 
“The growth rate is some of the fastest that we have ever seen,” said Will Markow, VP of applied research, talent for Lightcast, one of the three industry partners behind CyberSeek. “In the first four months of 2022, each month broke the previous month’s record for the most jobs tracked.”
High demand has come at a cost, though. Cybersecurity jobs are taking 21% longer to fill than other IT roles, and cybersecurity salaries have crept up to 10% more than IT salaries, Markow said. Only two states – Maine and Wyoming – aren’t reporting a talent shortage. 
And for every 100 jobs being posted, there are only 66 workers to fill them.
“That means we’re entering the cybersecurity battlefield with one-third of our army on the sidelines,” he said.
Many companies cite a talent gap for their inability to fill cybersecurity roles – but a big part of the problem may be that hiring managers are looking for more than they can find.
ISACA’s latest State of Cybersecurity report indicated that more than 60% of companies have unfilled cybersecurity positions and understaffed teams. 
The top skills gap, cited by more than half of cybersecurity professionals surveyed, is soft skills such as problem solving, critical thinking, and communication. The top factor used to determine whether a candidate is qualified, though, is prior hands-on cybersecurity experience, followed by credentials.
“There are almost 1 million open jobs – but no one is willing to hire junior people,” said Jenai Marinkovic, a member of the ISACA Emerging Trends Working Group and virtual CISO/CTO with Tiro Security.  
At a philosophical level, it makes sense. In an ever-expanding cyberthreat landscape, and with increased scrutiny of cybersecurity practices among government entities as well as customers, few companies are willing to put someone with just a few months of experience in charge of protecting valuable digital assets, Markow said.
However, it often leads to what Jon France, CISO of (ISC)2, describes as “job description abuse.” 
An entry-level role, for example, will require Certified Information Systems Security Professional certification – which requires five years of industry experience and a passing grade on the CISSP exam. 
“There’s fierce competition for the unicorn who’s at a senior level, but because that’s such a tough market, you need to balance your hiring across entry-level and those who are more experienced,” France said.
The high-flying skills are unrealistic. For starters, the recent (ISC)2 Cybersecurity Hiring Guide found that about 62% of cybersecurity professionals in the United States have less than four years of experience. 
In addition, more than 137,000 cybersecurity job postings in the U.S. over the last 12 months asked for CISSP certification, Markow said, citing Cyberseek data.  But less than 95,000 workers have obtained certification. 
“It really benefits employers to think carefully about the skill sets and credentials they request,” Markow said. “We need to widen the hiring aperture to bring in workers from more diverse experiential and educational backgrounds. Employers want someone with at least a bachelor’s degree to enter the position, but we can’t wait four years for the next crop of workers.”
It’s the same for Marinkovic: “We are seeing a decrease in the number of people who demand degrees, but it’s hard to let go of that bias. Cybersecurity tends to be monolithic in its way of thinking.”
One approach to meeting this need is entry-level certification. (ISC)2 is piloting such a program, which targets students as well as those looking to enter cybersecurity from another industry. 
“We have to look at other sectors and attract people interested in changing careers,” France said. “Being new to cybersecurity doesn’t necessarily mean being young.”
Marinkovic, through her work as the executive director of GRC for Intelligent Ecosystems (GRCIE), has developed 6-month courses to prepare women, minorities, and other individuals from underserved communities for entry-level cybersecurity roles. 
Training emphasizes both technical skills – particularly risk assessments and regulatory frameworks – along with soft skills such as communication and conflict resolution.
On-the-job training is both critical and undervalued. The (ISC)2 survey found that roughly two-thirds of companies think it takes nine months for cybersecurity staffers to work independently.
For many in management positions, that’s too much time. “Sometimes, you just have to get bodies in, and it’s a trial by fire,” Marinkovic said. “If it takes at least six months for someone to be ready to do the job, and if you’re already underwater and under skilled, having to bring someone on board when you’re already working 100 hours a week is going to impact your effectiveness.” 
To shorten the learning curve for new cybersecurity professionals, Markow has seen a trend of companies looking at internal candidates who have transferable skills. That way, they only need “last-mile” training to make the move to a cybersecurity role. 
As a bonus, they already know the company’s technology stack and its corporate culture. 
“This is a highly effective way for organizations to expand the talent pipeline,” he said. “It aids employee retention by giving people more mobility, and it’s an effective way to increase the diversity of the applicant pool.” 
In addition, Markow has seen companies “parcel out” cybersecurity tasks – for example, by encouraging IT project managers and software engineers to proactively build security into the software development cycle. 
“When security is embedded into these day-to-day tasks, it makes the whole organization more secure – and it builds more of those pools of skill-adjacent cybersecurity workers,” he said.
Get the free daily newsletter read by industry experts
Physical keys with cryptographic protocols can deliver higher levels of assurance, but organizations shouldn’t conflate resistance with infallibility.
CISOs are up against talent shortages and retention concerns amid an increasingly sophisticated threat landscape.
Keep up with the story. Subscribe to the Cybersecurity Dive free daily newsletter
Keep up with the story. Subscribe to the Cybersecurity Dive free daily newsletter
Subscribe to Cybersecurity Dive for top news, trends & analysis
Get the free daily newsletter read by industry experts
Want to share a company announcement with your peers?
Share your announcement ➔
Physical keys with cryptographic protocols can deliver higher levels of assurance, but organizations shouldn’t conflate resistance with infallibility.
CISOs are up against talent shortages and retention concerns amid an increasingly sophisticated threat landscape.
The free newsletter covering the top industry headlines

source

The cybersecurity talent shortage is a major problem. Sixty percent of organizations struggle to recruit cybersecurity staff, and 52% struggle to retain qualified people, according to a Fortinet report.
“I’m not seeing a lack of talent available for entry-level jobs, the problem is in the five-to-10-year experience level,” said Helen Patton, an advisory CISO at Cisco and a senior faculty member at Digital Directors Network.
Job descriptions only further the problem, Patton said. Qualified candidates are often deterred from applying to a job due to unreasonable job posting requirements. “You’ve got hiring managers who don’t know how to write job descriptions, and you’ve got recruiters who don’t understand the role,” she said.
In her book, Navigating the Cybersecurity Career Path, Patton offered advice to help security leaders build a security team, including how to recruit the right talent with good job postings.
In this excerpt from Chapter 18, Patton suggests tips on how to write a cybersecurity job posting. Learn which skills to include, as well as the importance of using inclusive language and explaining how the role will benefit the candidate — and not just the organization.
Of all the challenges with security job postings, the skills mismatch causes most candidates to skip your posting and look elsewhere. The industry has a skills gap, yet our job postings require too many skills and too many certifications. Also, there is an assumption that the successful candidate must arrive in the new job fully trained to do whatever is needed. Before you sit down to write your posting, fully consider the skills that are absolutely required from a new hire, as well as the skills you are willing to help the candidate develop on the job.
When you are considering skills, you should also consider what formal education you expect in your candidates. Don’t ask for a four-year degree unless you truly believe it’s a necessary requirement. (Most security leaders do not.) Be careful about the certifications you require; do they really support the role you are hiring for? Are there equivalences you are willing to consider, such as work experience in place of formal schooling? Must all the training you require be security-specific, or can you let candidates demonstrate skills through another path? How do you feel about self-taught candidates?
Benchmark yourself against other postings and resources, such as the U.S. National Initiative for Cybersecurity Education (NICE) Workforce framework. Make sure you’re not asking a junior candidate to have senior-level skills. Make sure the senior level job posting isn’t asking for too much experience or technology mastery. Just because it is a senior position doesn’t mean the role requires expert-level mastery of every skill!
Differentiate between general IT skills (such as programming languages) and security skills (assessing applications for insecure code), and make sure you’re not labeling a job “security” just because it sits in the security organization. It’s perfectly fine for a CISO to hire a generic application developer, project manager, or data analyst without making them a “security engineer,” “security manager,” or “security analyst.”
Interestingly, when you talk to hiring managers, it is often not the technical skills that are hard to develop on the job — it’s the professional skills like empathy, teamwork, and communication. When you read the job description, which “required skills” are listed first? The technical skills! If you think you can train the technical skills on the job but want to hire the professional skills, list the professional skills first.
Don’t ask for skills or experience you are willing to live without. Even putting unnecessary skills in the “optional” or “preferred” section is enough to turn high-quality candidates away — so make sure the skills you put into your job postings are ones you truly require.
Read a Q&A with author Helen Patton for tips on finding your niche in the industry.
No job is created in isolation. If you’re hiring someone into a role, it is because your organization needs that role for some purpose, and that purpose aligns with your security strategy and the organizational business goals and mission.
So, when you’re creating a job posting, let potential candidates know the “why” of the job. Why does this job exist? What purpose does it fill? How does it fit into the company, the security team, the security function? Is the role focused on one single line of business in the company or the whole company? Is the role going to be part of a revenue-generating team or a product support team, or will it be an administrative function? What are your core values, and how does this position support them? Include a link to the important parts of your company website so a candidate can quickly see general information about working at your company.
Don’t just talk about what the job is; talk about how the company will support the development of the candidate. Tell the candidate what they become, as well as what the job can become. Do you invest in training employees on the job, send them to conferences, or pay for industry memberships? Then say so! Let them know that you will be helping them grow when they join your team, not just assessing their job performance. Let them know that the risk they are taking to apply for your job is worth it.
You should give candidates some context because it allows them to see themselves in the role. Candidates want to be excited about a new opportunity. If all you can do is tell them that they will be monitoring vulnerabilities, pen testing an application, or writing policy, you’re not giving them the full picture.
Giving candidates the “why” allows them to fill out the role in their imagination and allows them to imagine their success as part of your team.
Context will allow candidates to be better prepared for interviews, ask better questions, and be better prepared to do what you need.
When you’re creating a job posting, you are creating a vision for the candidate. You’re telling a story of what the role can be and what their role in it will look like. So, just like any good storyteller, you need to put the reader in the center of the story — not as a passive observer, but as the whole point. To do this, you need to use the first-person language.
Instead of saying, “The candidate will monitor systems and follow playbooks to respond to incidents,” you might choose to say, “You will use your powers of observation to identify anomalies and attacks against your company.”
Instead of saying, “Applicants will be part of the Security team,” you might say, “You will be a key member of a highly professional and inclusive group of people who ensure the security of the entire company.”
When you write your job postings, you should be careful to avoid language that is seen as gendered, biased, or otherwise promotes negative stereotypes. Some people want to be “rock stars,” but for others, this is seen as a masculine, high-competition standard that automatically excludes women or other minorities. There is free software available to check the language you plan to use. Search for “bias language applications” to see some options. Please use them. Candidates will not apply for your job if the language you use prevents them from seeing themselves as being successful in the role.
If you can, try to avoid using filter Q&A as the first step in the application process. Companies love to do this — it helps their algorithms “weed out” unqualified candidates. But security jobs aren’t cookie-cutter, and these algorithms often do more harm than good because they filter out qualified candidates who lack exactly the right kind of experience or use the wrong words in their résumés. Our algorithms aren’t ready for the lack of structure currently existing in the security profession. If you must use these, ask your recruiter to see the reject list as well as the selection list. You’ll be surprised who gets left behind!
About the author
Helen Patton is an advisory CISO at Cisco, where she shares security strategies with the security community. Previously, she spent eight years as CISO at The Ohio State University, where she was awarded the 2018 ISE North American Academic/Public Sector Executive of the Year. Before joining Ohio State, she spent 10 years in risk and resiliency at JPMorgan Chase. She serves on the State of Ohio CyberOhio Advisory Board, the Manufacturing and Digital USA Cybersecurity Advisory Board and the Ohio State University College of Electrical and Computer Engineering Industry Advisory Board. Patton is also a faculty member for the Digital Director’s Network and for the Educause Leadership Institute.
Hybrid access as a service from a startup helped a global company secure optimized connectivity over home broadband connections. …
API integration, machine learning and AIOps are vital to achieve the benefits of SD-WAN automation, which include better network …
A heavy reliance on the network can increase energy use across businesses. Here are some best practices network teams can follow …
The U.S. government has released a report outlining plans to build a National AI Research Resource democratizing access to AI …
For the first time in two years, tech employment didn’t grow in January, thanks to tech company layoffs. But the shift to digital…
Smart contracts, automated content creation, targeted advertising, community building and metaverse-like experiences are some of …
Internet Explorer mode lets users view legacy IE websites not supported by other browsers, which can increase productivity and …
Implementing MDM in BYOD environments isn’t easy. IT should communicate with end users to set expectations about what personal …
Dell joined Microsoft in cutting 5% of its workforce due to slowing PC sales. The company said the action will better position it…
If your cloud-based workloads and applications need to move back on premises, you’ll need a plan. Start your reverse migration …
Cloud cost management is a top priority on admin’s minds. FinOps expert Mike Fuller talks about cloud billing challenges and how …
Responding to user demand, Oracle struck a deal with Red Hat to make the latter’s Enterprise Linux operating system an integral …
Dutch government will take swift action to prevent citizens getting into trouble due to the misuse of algorithms
The Lords Communications Committee has launched an inquiry to investigate how the UK can tackle digital exclusion during the …
Research by McKinsey found that 31% of girls who are studying tech-based subjects at school in Europe then drop out of the …
All Rights Reserved, Copyright 2000 – 2023, TechTarget

Privacy Policy
Cookie Preferences
Do Not Sell or Share My Personal Information

source

Submit
Δ
Thanks for contacting us. We've received your submission.
A little-reported data breach at a marketing email service owned by Intuit is raising concerns about security protocols at its better-known properties such as TurboTax, QuickBooks and Credit Karma, The Post has learned.
Intuit, a sprawling, publicly traded business-software empire with a market capitalization of $110 billion, admitted last week that 133 accounts using its MailChimp site were hacked. The company did not say who was responsible.
While the number of breached accounts is relatively small, many were used by customers who run businesses with hundreds of thousands or even millions of emails on their rosters, according to sources.
Last March, MailChimp confirmed hackers gained access to information on 102 of its customer accounts. A month later, Intuit was slapped with a class-action suit from customers of crypto wallet Trezor — a company that used MailChimp.
Trezor customers in the pending suit — including one man who says he lost $87,000 — claim Intuit did not use “adequate and reasonable measures to ensure that its data systems were protected.”
Late last month, reports surfaced that several key email services including MailChimp could be at risk as part of a bigger cybersecurity attack. MailChimp, according to a post on the company’s website, said it did not detect any problems until Jan. 11.
Customers complained they were alerted the next day that their accounts had been compromised but said MailChimp allegedly gave them no tools to respond to the data breach and didn’t even provide a phone number to call.
“Intuit’s business is all about data security… what’s going on here?,” one infuriated marketing executive who’s email list had been compromised told The Post. “This is a huge black eye for Intuit because you’re going to question their entire system.”
“Based on our investigation to date, this targeted incident has been limited to 133 Mailchimp accounts, and there is no evidence that this compromised customer data beyond these Mailchimp accounts.”
Legal experts fear the hack could signal bigger problems at other Intuit companies.
“While MailChimp might be considered a boring, sleepy company, it is part of the portfolio of Intuit,” former SEC enforcement attorney Ron Geffner told The Post. “Have they implemented the same policies and procedures at all portfolio companies? Is it a back door into the parent company?”
“Is this isolated or indicative of other problems the company faces with regard to cybersecurity?”
In 2021, TurboTax revealed hackers had accessed some of customers’ financial and personal information. The company said at the time it was not a “systemic data breach of Intuit.”
“An isolated incident raises fewer questions,” Geffner adds. “Multiple failures begs the question of whether it was due to a failure of the company and have the same failures resulted in multiple breaches.”
MailChimp could also be on the hook for millions in fines from regulatory bodies including the Consumer Financial Protection Bureau, the Federal Trade Commission and multiple states after customers data was compromised, attorneys told The Post.
MailChimp will have to prove to regulators it provided adequate protections for customer data. Even if MailChimp did provide adequate customer protection laws, it will likely have to compensate customers and their clients for lost time and money dealing with the security breach, experts said.

source

The need for cybersecurity professionals has been growing rapidly, even faster than companies can hire—and that demand is expected to continue. The number of unfilled cybersecurity jobs worldwide grew 350% between 2013 and 2021, from 1 million to 3.5 million, according to Cybersecurity Ventures. The industry researcher also predicts that in five years, the same number of jobs will still be open. 
In the U.S., there are about 1 million cybersecurity workers, but there were around 715,000 jobs yet to be filled as of November 2021, according to a report by Emsi Burning Glass (now Lightcast), a market research company. If so many bodies are needed to fill seats in cybersecurity roles, then what’s the holdup on companies and universities preparing future professionals to take these jobs?
There’s no one answer to that question, Will Markow, vice president of applied research–talent at Emsi Burning Glass, tells Fortune. Rather, a number of dynamics are making it difficult to build a talent pipeline for cybersecurity jobs. One contributing factor to the talent shortage is that there aren’t enough professionals who have the credentials necessary (whether it’s a master’s degree in cybersecurity or other certificate program) to get hired.
“Cybersecurity jobs see the skill requirements evolve far more rapidly than many other fields,” Markow, who specializes in cybersecurity job market research, explains. “Cybersecurity jobs are, by nature, more likely to fuse together skill sets from disparate domains. If you think about it, every new technology now has a digital component, and every technology with a digital component needs to have a digital security component.”
While companies are looking to hire cybersecurity professionals in droves, the industry often requires that workers have certain credentials or certifications on top of education requirements, Markow explains. An example is a CISSP certification, which is required for many top-level cybersecurity roles that are in high demand—and have high-paying salaries, to the tune of about $120,000.
Bottom line: Even if you have an undergrad or graduate degree in cybersecurity, computer science, or an adjacent field, that may not be enough to land certain jobs in the industry. 
“Employers have been very slow to reduce either credential requirements or education requirements for cybersecurity jobs, despite the hiring difficulty that they have,” Markow says. “We really haven’t seen any noticeable shift in the share of cybersecurity openings that are available to workers who don’t have either a bachelor’s degree or at least three to five years of prior work experience.”
Some employers, however, are developing talent pipelines for cybersecurity roles. One employer in particular that hires swaths of cybersecurity professionals is Deloitte; as of May 2021, the company employed more than 22,000 cybersecurity workers around the world under its Deloitte Cyber business line. In fact, Deloitte was named as the top company for hiring cybersecurity talent by Datamation. 
Other top cybersecurity employers include PwC, EY, Booz Allen Hamilton, and KPMG. Research from Emsi Burning Glass also shows that in recent months, financial services requested more cybersecurity workers than professional services companies. 
In step with global trends, the demand for cybersecurity talent at Deloitte continues to grow, Deborah Golden, Deloitte U.S. cyber and strategic risk leader, tells Fortune. 
“The cybersecurity landscape used to be contained within four walls. Obviously where we are today, that’s truly not the case,” she says. “The pandemic pushed change into a bit of hyper-speed, but we were already headed into digital transformation. Because of that, we are becoming overly diverse in terms of the types skills we’re looking for, from everything from deep cyber to domain expertise.”
To help fill these high-demand roles, Deloitte Cyber developed a train-to-hire program that trains candidates in cybersecurity topics to fill jobs they wouldn’t traditionally be qualified for. 
Candidates engage in boot camps and other job training to prepare them to take on cybersecurity jobs that otherwise would have needed to be filled by a traditionally trained professional—someone who studied cybersecurity or an adjacent field in undergrad or graduate school. The trainings focus on topics including software engineering, data science, and UI/UX development.
“Don’t be concerned if you don’t have all the certifications or the degrees or the capabilities that you think were historically needed for cyber,” Golden advises. “Given where the market is today, there’s a need to have greater diversity of thought, and, just candidly, more and different types of skill sets and backgrounds coming to solve.”
Undergraduate and graduate degree programs focused on cybersecurity continue to be a popular route for entering the industry. But like Deloitte, other companies are also providing in-house training for current employees who are looking to enter the cybersecurity workforce. 
If you’re already in a technical role—but not specifically cybersecurity—Markow suggests finding ways to “bake” cybersecurity into your current role. This could involve learning a new skill set through shorter-term training opportunities or boot camps. 
Another way to get your feet wet is to prepare to take one of the entry-level cybersecurity certification tests, such as Security Plus. 
“You’ll learn a lot about the field just in preparing for the exam,” he says. “And then if, and when, you obtain the credential, you already have a credential that’s in demand and requested by many employers, which is just going to make it all that much easier for you to find your first job and enter in advance your career in cybersecurity.”
See how the schools you’re considering fared in Fortune’s rankings of the best master’s in cybersecurity programs, public health programs, business analytics programs, data science programs, and part-time, executive, full-time, and online MBA programs.

source

Insight and analysis of top stories from our award winning magazine “Bloomberg Businessweek”.
Ashlee Vance explores innovations in new tech, software, engineering, and science in places outside of Silicon Valley.
For Fear or Money, Consumer Giants Are Staying in Russia
Cash Crisis Proves a Boon for Mobile-Money Startups in Nigeria
UK Wage and Inflation Data Set to Fuel Further BOE Rate Hikes
Japan’s LDP Policy Head Says Monetary Policy Has Room for Reform
Power Bill Relief Central in Australia Budget, Treasurer Says
Court Orders Nestlé to Pay $2.2 Million to Bullied Ex-Employee
For Fear or Money, Consumer Giants Are Staying in Russia
Coolant Leak at Russian Spacecraft, Station Crew Safe
Social Media Buzz: Lyft, Alaska, Anna Paulina Luna, Rihanna
Amazon Subsidiary Zappos Lays Off Around 20% of Staff, DJ Says
Netanyahu Plans ‘Broader Action’ Against Terrorism Supporters
Britain’s Cherished NHS Wrestles With Its ‘Reform or Die’ Moment
Izzy Englander’s Wife Withdraws Suit Over Post-Nuptial Agreement
Trump’s 40 Wall St. Put on Lender Watch as Vacancies, Costs Rise
Disney Streaming Tech Chief Leaves Ahead of Larger Staff Cuts
Music Rights Firm Launches With Robbie Williams and Placebo Hits
Can ChatGPT Write a Better Novel Than I Can?
Adani Draws Parallels to Evergrande, But It’s Far More Vulnerable
If Pixar Can Do it, So Can You: ‘How Big Things Get Done’
Tech Holdouts Are Making Life Hell for Their Colleagues
Brazil’s Richest Man Loses Billions as His M&A Machine Breaks Down
Forget Hard or Soft Landing: Meet the Rolling Recession
UK Salesman Wins $86,000 Ageism Payout for ‘Bald’ Discrimination
Trump Offers Deal to Provide DNA in Rape-Accuser’s Suit
OPEC Chief Tells Climate Activists to ‘Look at the Big Picture’
Maple Syrup’s $1.5 Billion Industry Splinters as Winters Get Warmer
In the DC Suburbs, an Artful Compromise Over Density and Housing
The Rise of the Millionaire Renters
Super Bowl Parties Produce Tons of Trash. Phoenix Is Hoping to Fix That
A $92 Billion Crypto Profit Maker Is in Line for a Shake-Up
This Week in Crypto: Billionaires Reconcile, ‘Britcoin’ in Works (Podcast)
Real World Courts Come For Digital Crypto Hackers (Podcast)
Eamon Akil Farhat
Subscriber Benefit
Subscribe
Royal Mail said no personal data was compromised during a cyberattack detected last week, though the UK postal firm continues to grapple with the situation and letters and parcels are still not being exported.
Chief Executive Officer Simon Thompson told a House of Commons panel Tuesday that based on the investigation so far, no data breach took place, though the UK Information Commissioner’s Office, which regulates data privacy, has been informed.

source

No companies appear to be safe when it comes to cybersecurity. Online sports betting service DraftKings recently suffered a data breach, while a healthcare system exposed the details of over 3 million users.
Things just got more frightening as we found out a popular cybersecurity company suffered a massive data breach. When a service in charge of protecting your digital life is breached, it’s time to take action.
Read on for details on this scary breach and a few ways to protect your information.
Credential stuffing is a popular technique for cybercriminals. So, what is credential stuffing? It’s when criminals take stolen usernames and passwords and use bots to inject them into other websites, hoping to gain access to accounts. The stolen credentials are often posted on the Dark Web, making it easy for thieves to get their hands on them.
Credential stuffing attacks are successful when a victim uses the same password on multiple online accounts. If a thief has compromised credentials from one site, they can use them to infiltrate another that uses the same password. That’s why it’s critical to have strong, unique passwords for every online account.
Learn the tech tips and tricks only the pros know.
Norton LifeLock recently suffered a data breach, and the company says its system wasn’t at fault. It claims the breach was the result of a credential-stuffing attack. At any rate, thousands of users’ details were exposed.
In a notice sent to impacted users, the company explains that “our systems were not compromised. However, we strongly believe that an unauthorized third-party knows and has utilized your username and password for your account.”
It’s believed that as many as 925,000 inactive and active accounts were compromised. Stolen data includes first names, last names, phone numbers, and mailing addresses.
The first thing you must do is change your Norton LifeLock account password. Next, ensure all of your online accounts have unique passwords. Don’t use the same password for multiple accounts.
Here are some other tips that will help you to stay safe online:
Norton renewal email scam: Keep an eye out for this phony invoice
Antivirus warning: What to do if you see this warning from McAfee
More:
Get tech updates and breaking news on the go with the Komando.com App, available in the Apple and Google Play app stores.

source

By Debra Cassens Weiss
August 8, 2022, 9:51 am CDT

Image from Shutterstock.
Lawyers in New York will have to take at least a one-hour cybersecurity course as part of their continuing legal education requirements beginning in July 2023.
Although Florida and North Carolina require some technology training as part of their CLE requirements, New York is the first state to require coursework in cybersecurity, data privacy or data protection, LawSites reports.
New York has already adopted an ethical duty of technology competence for lawyers. The new CLE requirement, adopted in June, requires one hour of CLE related to cybersecurity, privacy and data protection every two years. The hour can be related to lawyers’ ethical obligations regarding data protection or to technological aspects of protecting law office and client data.
The mandated one-hour training counts toward the 32-hour CLE requirement for new lawyers in their first two years after admission to the bar. It counts toward the 24-hour biennial CLE requirement for other lawyers.
Lawyers can apply up to three hours of cybersecurity ethics training toward their ethics and professionalism CLE requirement. Mandated professionalism training is six hours over two years for new lawyers and four hours over two years for other lawyers.
The New York State Supreme Court’s Appellate Division adopted the cybersecurity CLE requirement based on a recommendation from the New York State Bar Association’s Committee on Technology and the Legal Profession. The NYSBA approved the committee report in June 2020, according to the bar’s news center.

source

Third-Party Risk Contributes to Healthcare Data Breaches
Since 2009, the number of individuals affected by health data breaches in the U.S. has exceeded the country’s population of 331.9 million. As per federal statistics, this means many people have been victims of more than one incident.
Unfortunately, the situation seems to be growing worse. In just the last three years, the volume and frequency of breaches have nearly doubled, from 368 in 2018 to 715 in 2021. And during the first half of 2022, the number of data breaches impacting 500 or more records reported to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) numbered 337.
Meanwhile, IBM’s 2022 Cost of a Data Breach report showed that the average cost of a healthcare data breach reached $10.1 million per incident. This was a 9.4% increase from the prior year.
It’s clear healthcare is under attack, and an important part of the risk comes from third-party vendors.
According to an analysis by Fortified Health Security, OCR data reveals that healthcare providers accounted for 72% of healthcare data breaches in the first half of 2022. Meanwhile, business associates accounted for 16%, and health plans for 12% of breaches. Overall, over 19 million records were implicated in healthcare data breaches during the first six months of 2022.
Perhaps even more disturbing is how a handful of entities are responsible for huge swaths of lost data. According to the Fortified report, seven entities experienced breaches of more than 490,000 records each (6.2 million records total). The affected entities include:
Further incident analysis, according to Fortified, shows that:
In June 2022, a data breach was discovered involving the third-party mailing and printing vendor OneTouchPoint (OTP). A notice on OTP’s website explained that the company detected encrypted files on certain computer systems in April 2022. The subsequent OTP investigation determined that an unauthorized party accessed certain servers starting on April 27. OTP began notifying their customers of the incident on June 3.
The list of affected healthcare entities impacted by the OTP breach includes Geisinger, Kaiser Permanente and 35 other healthcare brands. Among the affected companies were major medical networks and health insurance providers. The exfiltrated files in the breach contained patient names, member IDs and information provided during a health assessment.
This incident highlights an increasingly important reality facing security teams today. That is, your security is only as good as your partner’s security.
Read the CODB Report  
Here’s another third-party incident that involved millions of individual records. Eye Care Leaders (ECL), an ophthalmology-specific electronic medical record (EMR) solution, was a victim of unauthorized system access in December 2021. ECL began notifying impacted organizations of the incident in March 2022. Since then, more than two dozen organizations have submitted individual breach reports to OCR.
No one knows the full extent of the damage from the ECL breach. But based on one report, the incident impacted at least 2 million individuals from a variety of organizations.
Texas Tech University Health Sciences Center (TTUHSC) alone accounted for nearly 1.3 million impacted individuals. TTUHSC said that ECL’s compromised databases may have contained extensive personal patient data. The stolen information included patient names, phone numbers, addresses, emails, gender, birth dates, driver’s license numbers, health insurance information, appointment information, medical record numbers, Social Security numbers and other medical information.
ECL is now facing multiple lawsuits over its handling of the breach. Plaintiffs alleged a lack of transparency, reputational harm and business disruptions.
These incidents show us how difficult it is for organizations to protect their data assets these days. Consider that the average organization uses 110 Software-as-aService apps. And each of these SaaS vendors can have hundreds, if not thousands, of clients. In a supply chain software attack, malicious code is injected into an application, and the infection spreads to all users.
Third-party cybersecurity risks are both common and highly damaging. As per a CrowdStrike report, 45% of organizations surveyed said they experienced at least one software supply chain attack in 2021. And the same report states that supply chain attacks are increasing by an eye-popping 430%.
In another recent survey of cybersecurity workers, 64% of respondents said they could not stop an attack from a compromised software supplier. At the same time, 71% of organizations were victims of software supply chain attacks, resulting in data loss or asset compromise.
What can be done to minimize third-party risk? For starters, it’s important to understand your company’s relationship with your third-party vendors. Vetting third-party security posture is imperative. Ask them what policies and security measures they deploy to protect themselves and their clients. Security agreements should also be provided in writing and included in vendor contract language. It’s also important to implement a system that continually assesses and monitors third-party risks.
From within your company, you can also improve third-party security through approaches such as zero trust. Every enterprise gives multiple users, apps and devices access to IT assets. And despite the different goals and needs of these employees, partners, clients and customers, they all require some level of access to corporate information. The number of connections and resources that need to be managed makes user verification complex.
A zero trust security strategy enables organizations to increase their cyber resiliency and manage the risks of a disconnected business environment while still allowing users access to the appropriate resources. It’s a model that uses context and machine learning to establish secure connections while also protecting an organization from cyber threats.
Cyber threats that target healthcare aren’t going away soon. But informed third-party relationships and stronger internal measures can provide healthier security for all.
Jonathan Reed is a freelance technology writer. For the last decade, he has written about a wide range of topics including cybersecurity, Industry 4.0, AI/ML…
4 min read – The art of cyber crime is in a constant state of flux and evolution. Simply staying on pace with these trends is a significant part of the CISO’s job. Today’s modern CISO must ensure they are always prepared for the…
4 min read – As the U.S. looks to bolster electric vehicle (EV) adoption, a new challenge is on the horizon: cybersecurity. Given the interconnected nature of these vehicles and their reliance on local power grids, they’re not just an alternative option for getting…
4 min read – As we move deeper into a digitally dependent future, the growing concern of data breaches and other cyber threats has led to the rise of the Chief Information Security Officer (CISO). This position is essential in almost every company that…
Having a skilled team of cybersecurity professionals is an organization’s best defense against threat actors. Not only can it decrease the risk of cybersecurity attacks, but it also reduces business disruption when attacks do occur. However, the 2022 ISC2 Cybersecurity Workforce Study found that the Asia-Pacific (APAC) region is facing a troubling gap in its cybersecurity workforce. The study surveyed 11,779 cybersecurity professionals across the world in 14 regions, including Singapore, Australia, South Korea, Japan, China, India, the US and…
Though the technology has only been widely available for a couple of months, everyone is talking about ChatGPT. If you are one of the few people unfamiliar with ChatGPT, it is an OpenAI language model with the “ability to generate human-like text responses to prompts.” It could be a game-changer wherever AI meshes with human interaction, like chatbots. Some are even using it to build editorial content. But, as with any popular technology, what makes it great can also make…
A recent White House Fact Sheet outlined the current and future U.S. cybersecurity priorities. While most of the topics covered were in line with expectations, others drew more attention. The emphasis on critical infrastructure protection is clearly a top national priority. However, the plan is to create a labeling system for IoT devices, identifying the ones with the highest cybersecurity standards. Few expected that news. The topic of quantum-resistant encryption reveals that such concerns may become a reality sooner than…
As time passes, the security landscape keeps getting stranger and scarier. How long did the “not if, but when” mentality towards cyberattacks last — a few years, maybe? Now, security pros think in terms of how often will their organization be attacked and at what cost. Or they consider how the difference between legitimate Software-as-a-Service (SaaS) brands and Malware-as-a-Service (MaaS) gangs keeps getting blurrier. MaaS operators provide web-based services, slick UX, tiered subscriptions, newsletters and Telegram channels that keep users…
Analysis and insights from hundreds of the brightest minds in the cybersecurity industry to help you prove compliance, grow business and stop threats.

source

Cyber crime is an ever-evolving problem, with an estimated cost of US$10trn by 2025. In 2021, there were more than 4,100 publicly disclosed data breaches, which equates to approximately 22 billion records being exposed. The figures for 2022 are expected to at least match this, if not exceed it by as much as five percent. 
Cyber Security Hub is dedicated to delivering breaking news from the cyber security sector. With this in mind, here are the news stories detailing the threat vectors, cyber attacks and data breaches that had the biggest impact on its readers over the past 12 months.
In May, Cyber Security Hub research revealed that three out of every four cyber security professionals considered social engineering or phishing attacks to be the “most dangerous” threat to cyber security at their companies.
The research, which was conducted for the CS Hub Mid-Year Market Report 2022, also found that other top threats included supply chain/third-party risks (cited by 36 percent of respondents) and a lack of cyber security expertise (cited by 30 percent of respondents).
Discover more about the concern over social engineering attacks in our analysis from August 2022.
On November 17, 2022, the Wall Street Journal broke the news that 12 Meta employees had been either disciplined or fired for breaking Facebook’s terms of service and hijacking user accounts.
The employees, some of whom were contractors employed as security guards at the tech company’s offices, had been using a heavily regulated internal access tool referred to as ‘OOps’ to reset access to Facebook accounts. One employee was dismissed following accusations that they used OOps to allow hackers to fraudulently gain access to multiple Facebook accounts in exchange for thousands of dollars’ worth of Bitcoin.
Read about the consequences for those abusing access to the account reset tools in our recent news report.
On October 14, 2022, a malicious actor gained access to 130 of the company’s source code repositories after its employees were targeted by a phishing attack.
The attack saw a malicious actor pose as code integration and delivery platform CircleCI in order to harvest login credentials and authentication codes from employees. It also gained access to Dropbox’s account on code repository site GitHub, as CircleCI login information can be used to access Github.
Throughout the attack, the hacker gained access to some of the code Dropbox stores on the platform, including API keys used by its developers.
Discover more about how phishing attacks occur in our guide to social engineering.
Google reported that it had blocked the “largest” distributed denial of service (DDoS) attack on record, which had a peak of 46 million requests per second (rps) on June 1.
The attack targeted a Google Cloud Armor user with HTTPS for a duration of 69 minutes and had 5,256 source IPs from 132 countries contributing to it. Google reported that the attack was the biggest Layer 7 DDoS attack reported to date and was 76 percent larger than the previous record.
In a blog post about the attack, Emil Kiner, senior product manager for Cloud Armor, and Satya Konduru, technical lead, both at Google, noted that the attack was akin to “receiving all the daily requests to Wikipedia…in just 10 seconds”.
Learn more about DDoS attacks in this piece from earlier this year.
The US Federal Communications Commission (FCC) and the Department of Homeland Security (DHS) amended its list of foreign IT vendors that “pose an unacceptable risk to national security or the security and safety of United States persons” on March 25. 
The amendment added Kapersky Antivirus, a digital security company previously named by Gartner as the third-largest provider of consumer-level IT products and the fifth-largest vendor of enterprise IT products. Two Chinese-owned companies, China Mobile International and China Telecom Corp, were also added.
FCC commissioner, Brendan Carr, said the companies were added to the roster to “help secure [US] networks against threats posed by Chinese and Russian state-backed entities seeking to engage in espionage and otherwise harm America’s interests.”
Find out more about Kaspersky’s response to the amendment and the impact of the blacklisting.
On July 27, Cyber Security Hub reported that a hacker going by the alias “devil” claimed to have the details for 5.4 million Twitter accounts for sale.
The hacker said they had harvested the information using a vulnerability previously flagged to Twitter on January 1, 2022.
Twitter confirmed the breach on August 5, and suggested that in the future users should enable two-factor authentication to protect their accounts from unauthorized logins.
Read more about how the hacker was able to exploit the vulnerability and the accounts affected by the data breach.
Rockstar Games, the developer of popular Grand Theft Auto (GTA) game series, suffered a data breach on September 19, 2022, after an unauthorized party gained access to the company’s Slack channel.
From there, the hacker downloaded and leaked previously unseen assets and clips from the as-yet-unreleased GTA 6 game to a fan forum. While it was initially thought to be a hoax, swift involvement from both Rockstar Games and the authorities confirmed the clips were real.
A 17-year-old from Oxfordshire known only as AK was later arrested by the City of London police, allegedly not only in connection to the hack, but to hacks against Uber and Microsoft from earlier in 2022.
Learn more about the alleged hacker and his multiple attacks in this September news post. 
Google announced its plans to acquire cyber security firm Mandiant at a cost of more than $5bn on March 8, 2022, in a move designed to bolster its internal cyber security resources.
The $5.4bn acquisition was Google’s second-most expensive deal in its history, second only to its purchase of Motorola Mobility for $12.5bn in 2012.
The plans to merge Google and Mandiant’s cloud offerings, as well as the size of the deal, led to speculation on what its impact might be for the cyber security sector at large. Cyber security experts noted that it may signal a shift in the cloud landscape, with those offering cloud services increasing investment in security and consulting services.
Learn more about the merger and its influence on the cyber security sector in this March post.
In late July 2022, an unauthorized party gained access to the internal servers for tech giant Samsung’s US customers. Samsung warned customers of the data breach on August 4, after an internal investigation confirmed that the malicious party had gained access to personal information for customers. 
Just over a month later, a class action lawsuit was filed by a Samsung customer affected by the breach. Shelby Harmer filed the lawsuit with the US District Court for Nevada on September 6 “on behalf of Samsung’s customers whose personally identifiable information was stolen by cyber criminals”.
The lawsuit alleged that Samsung had not only failed its customers by not reporting the breach in a timely manner, but also by incorrectly safeguarding their personal information in the first place.
Find out more about the lawsuit and its charges in this September update.
Carding marketplaces are dark web sites where users trade stolen credit card details for financial fraud, usually involving large sums of money. On October 12, 2022, carding marketplace BidenCash released the details of 1,221,551 credit cards for free.
A file posted on the site contained the information for more than 1.2 million credit cards expiring between 2023 and 2026, in addition to other details needed to make online transactions.
BidenCash had previously leaked the details of thousands of credit cards in June 2022 as a way to promote the site. As the carding marketplace had been forced to launch new URLs three months later in September after suffering a series of DDoS attacks, some cyber security experts suggested this new release of details could be another attempt at advertising.  
Discover how BidenCash gained access to 1.2 million credit card details in our October coverage. 

With more than 140,000 members, Cyber Security Hub is the vibrant community connecting cyber security professionals around the world.
Join Now
February 21 – 22, 2023
Free CS Hub Online Event
22 February, 2023
Online
01 March, 2023
Online
08 – 09 March 2023
Free CS Hub Online Event
08 March, 2023
Online
15 March, 2023
Online
Insights from the world’s foremost thought leaders delivered to your inbox.
2023-03-15
10:00 AM – 11:00 AM EST
2023-03-08
10:00 AM – 11:00 AM EST
2023-03-01
11:00 AM – 12:00 PM PST
Reach Cyber Security professionals through cost-effective marketing opportunities to deliver your message, position yourself as a thought leader, and introduce new products, techniques and strategies to the market.
Join CSHUB today and interact with a vibrant network of professionals, keeping up to date with the industry by accessing our wealth of articles, videos, live conferences and more.
Cyber Security Hub, a division of IQPC

Careers With IQPC| Contact Us | About Us | Cookie Policy
Become a Member today!
Already an IQPC Community Member?
Sign in Here or Forgot Password
Sign up now and get FREE access to our extensive library of reports, infographics, whitepapers, webinars and online events from the world’s foremost thought leaders.
We respect your privacy, by clicking ‘Subscribe’ you will receive our e-newsletter, including information on Podcasts, Webinars, event discounts, online learning opportunities and agree to our User Agreement. You have the right to object. For further information on how we process and monitor your personal data click here. You can unsubscribe at any time.

source

Use the CRI to assess your organization’s preparedness against attacks, and get a snapshot of cyber risk across organizations globally.
Content added to Folio
Cyber Crime
INTERPOL recently conducted operation African Surge to take down malicious infrastructure across the African continent and requested the help of private enterprises. Trend Micro is proud to have been asked to participate, and provided global threat intelligence that was utilized in this operation.
By: Jon Clay November 25, 2022 Read time:  ( words)
Save to Folio
INTERPOL recently conducted operation African Surge to take down malicious infrastructure across the African continent and requested the help of private enterprises. Trend Micro is proud to have been asked to participate and provided global threat intelligence that was utilized in this operation.
To read the official announcement, please visit: https://www.interpol.int/News-and-Events/News/2022/Operation-across-Africa-identifies-cyber-criminals-and-at-risk-online-infrastructure
Trend Micro has a long history of supporting law enforcement, including INTERPOL, with our threat intelligence. From providing information about malicious actors to the threats and infrastructure used in their many attacks, our information provides valuable intelligence for their use. In this case we observed over 2,000 malicious and active servers (IP addresses) in Africa, most of which were associated with notorious botnets like Emotet and Trickbot. We also shared information on web hosting servers with malicious domains of over 6,000 IP addresses, including one country with over 36,000 detections. Our data was from 2021 through the first half of 2022 and emphasized bulletproof hosting servers. Much of the data was related to malware, scams and phishing. We also shared information on extortion spam schemes to help identify their impact across Africa, including about 84,000 detections. Trend Micro also provided our free online scanning tool, Housecall, to support people within the country to assess their systems for malware and other threats.
The Africa Cyber Surge Operation, launched in July 2022, has brought together law enforcement officials from 27 countries, working together for almost 4 months on actionable intelligence provided by INTERPOL private partners. This intelligence focused on opportunities to prevent, detect, investigate and disrupt cybercrime through coordinated LE activities utilizing INTERPOL platforms, tools, and channels. This operation focused both on cyber criminals and compromised network infrastructure in Africa, allowing member countries to identify more than 1,000 malicious IP addresses, Dark Web Markets, and individual threat actors, enhancing cooperation between INTERPOL, AFRIPOL and the member countries, and contributing to connecting policing for a safer world,” said Craig Jones, Director Cybercrime Directorate, INTERPOL.
Africa is a region we’ve been monitoring for our customers for quite a long time. We worked with INTERPOL back in 2017 to understand the budding cybercrime industry in West Africa. Trend Micro researchers have been looking into many of the cybercriminal undergrounds over the years to help us better understand how these communities operate as well as what threats are being discussed and the goods and services being offered.
“Emerging markets provide fertile grounds to plant malicious infrastructure to launch or further global cyberattacks,” said Ed Cabrera, Chief Cybersecurity Officer and former CISO of the US Secret Service. “Exponential growth in connectivity in these markets coupled with lagging legal frameworks and perceived lack of law enforcement capacity emboldens cyber threat actors.”
We are very excited to see more public-private partnerships like this that fight cybercriminals by disrupting their infrastructure and leading to arrests. The more we and our peers in the industry can help, the better we can fulfill our mission to make the world safe for exchanging digital information.
Our global threat intelligence is highly sought after due to its unmatched breadth and depth. This intelligence comes from our solutions across 500,000 commercial customers and tens of millions of consumer customers around the world. These solutions gather threat intelligence across endpoints (including mobile, PC, Mac, Servers), email, web, network traffic, IoT/IIoT, data centers and cloud infrastructures.
“Trend Micro will continue to support law enforcement around the world,” Cabrera said. “It’s not just a good idea, it’s who we are. We’re proud to have been a part of this INTERPOL operation and look forward to finding more ways to help.”
 
Jon Clay
VP, Threat Intelligence

source