Defendify is a cybersecurity platform designed specifically for small businesses

Defendify

defendify

If your application includes fundamental features like login, registration, password reset/recovery, resend confirmation links, and other specific functionalities requiring server requests, it's crucial to implement mechanisms against brute force attacks and the generation of a substantial load on your service. Without such mechanisms, your application may be vulnerable to various threats, including sending an excessive number of emails/OTPs to users, potentially leading to financial and reputational damage. Many lack adequate rate-limiting measures, relying solely on the limitations imposed by their business logic, such as restricting the number of requests based on a payment model. Some applications, however, do incorporate rate limits, particularly for operations like login attempts, registration, and other critical functionalities. These implementations often depend on the X-Forwarded-For header for IP address tracking. web applications To illustrate a simple example, I came up with this code snippet on Flask from flask import Flask, request, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(
    app,
    key_func=get_remote_address,
    storage_uri="memory://",)

def get_ipaddr():
    # Retrieve the client's IP address from the request
    # X-Forwarded-For header is used to handle requests behind a proxy
    ip_address = request.headers.get('X-Forwarded-For', request.remote_addr)
    return ip_address

# Rate limit to 5 requests per minute per IP
@limiter.limit("5 per minute")
@app.route('/')
def index():
    ip_address = get_ipaddr()
    return ip_address In the following sections, I'll explain various approaches to testing and attempting to bypass rate limits in your application. To efficiently test your app for this type of vulnerability, automation is a powerful tool. You can achieve this by employing scripts, such as those in Python (as I often do), or using tools like Burp Suite (btw a great tool for testers and cybersecurity professionals). Also, tools like Postman might be used to automate checks relatively easily. Testing Rate Limit Changing IP value in X-Forwarded-For header X-Originating-IP: 127.0.0.1 Use different IP values in every request you send. Use double X-Forwared-For header. X-Forwarded-For:
X-Forwarded-For: 127.0.0.1 Try the same with different headers. X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Host: 127.0.0.1
X-Forwared-Host: 127.0.0.1 Change other headers Try changing the user-agent, content-type, accept-language, etc, or cookies, anything that could be used as a user identifier. If there is a rate limit of 3 tries per IP, every three tries, change the IP value of the header (or other headers or params in your requests). Add blank chars in params Try adding to the params you send %00, %0d%0a, %0d, %0a, %09, %0C, %20 For example param1=value1%%0d%0a 
param2=value2%00 For example, if you are requesting OTP for email verification and you only have 3 tries, use the 3 tries for example@email.com
example@email.com%00
example@email.com%0d%0a
And so on Use similar endpoints If you are testing, for example,/API/v1/signup endpoint, then try to perform brute-force to /Signup, /SignUp, /sign-up. Try adding blank chars (from the above) to the original endpoints. Adding extra params to the requested API endpoint If the limit is on the requests of /api/v1/resetpassword endpoint, try brute-forcing it by adding some query params - once the rate limit is reached, try, for example, /api/v1/resetpassword?param1=value1 Logins matter It might be the case that an app has flawed logic - if you log into your account before each attempt/series of attempts, the rate limit is reset for your IP, and you can continue your password brute-force attack. If you are testing a login feature, you can do this in Burp Suit with a Pitchfork attack in the settings (or you can write your own script for this) for each attempt/series of attempts. Here is my example of how I automated a simple check for the X-Forwarded-For header just to get a POW: from random import randint
import requests
import json


url = "https://yourapp.net/api/v1/regconfirm-resend"
data = {
   "email": "yourtest@mail.com"
}

N = 100


def generate_random_ip():
   return '.'.join(
       str(randint(0, 255)) for _ in range(4)
   )


for _ in range(N):
   headers = {
       "Host": "yourapp.net",
       "Content-Type": "application/json",
       "X-Forwarded-For": generate_random_ip()
   }
   response = requests.post(url, headers=headers, data=json.dumps(data))
   print(headers)
   print(f"Status Code: {response.status_code}, Response: {response.text}") Restoring original visitor IPs A possible solution might be the use of Cloudflare and its mechanisms. A detailed explanation can be found here . I will provide only a brief overview of its defense mechanisms. restoring-original-visitor-ips If you use applications that depend on the incoming IP address of the original visitor, a Cloudflare IP address is logged by default. The original visitor IP address appears in an appended HTTP header called CF-Connecting-IP. By following our web server instructions, you can log the original visitor IP address at your origin server. If this HTTP header is not available when requests reach your origin server, check your Transform Rules and Managed Transforms configuration. If Pseudo IPv4 is set to Overwrite Headers - Cloudflare overwrites the existing Cf-Connecting-IP and X-Forwarded-For headers with a pseudo IPv4 address while preserving the real IPv6 address in CF-Connecting-IPv6 header. Remember, when implementing such a defense mechanism, perform thorough testing. This approach might be subsequently applied to the entire cluster and could adversely affect certain functions and microservices where it is unnecessary. In a nutshell, while fixing a security breach, be cautious, as it could potentially impact the entire application. Analyze which part of your system might be affected negatively and test everything before shipping changes to the prod env. NOTE: Also published . here

Defending Your Web App: A Guide to Rate Limiting and Brute Force Attack Prevention

আপনার ওয়েব অ্যাপকে রক্ষা করা: রেট লিমিটিং এবং ব্রুট ফোর্স অ্যাটাক প্রতিরোধের জন্য একটি নির্দেশিকা

Verteidigen Sie Ihre Web-App: Ein Leitfaden zur Ratenbegrenzung und zur Verhinderung von Brute-Force-Angriffen

Defendiendo su aplicación web: una guía para limitar la velocidad y prevenir ataques de fuerza bruta

Défendre votre application Web : un guide sur la limitation du débit et la prévention des attaques par force brute

अपने वेब ऐप का बचाव: दर सीमित करने और क्रूर बल के हमले की रोकथाम के लिए एक गाइड

Web アプリの防御: レート制限とブルート フォース攻撃防止のガイド

웹 앱 방어: 속도 제한 및 무차별 대입 공격 방지 가이드

Defendendo seu aplicativo da Web: um guia para limitação de taxa e prevenção de ataques de força bruta

Защита вашего веб-приложения: руководство по ограничению скорости и предотвращению атак методом перебора

Web Uygulamanızı Koruma: Hız Sınırlama ve Kaba Kuvvet Saldırısını Önleme Kılavuzu

Bảo vệ ứng dụng web của bạn: Hướng dẫn giới hạn tỷ lệ và ngăn chặn tấn công vũ phu

保护您的 Web 应用程序：速率限制和暴力攻击预防指南

Overview Digital fingerprinting is a technique used to identify users across different websites based on their unique device and browser characteristics. These characteristics - fingerprint parameters, can include various software, hardware (CPU, RAM, GPU, media devices - cameras, mics, speakers), location, time zone, IP, screen size/resolution, browser/OS languages, network, internet provider-related and other attributes. The combination of these parameters creates a unique identifier - fingerprint, that can be used to track a user's online activity. Fingerprints play a crucial role in online security, enabling services to identify and authenticate unique users. They also make it possible for users to trick such systems to stay anonymous online. However, if you can manipulate your fingerprints, you can run tens or hundreds or more different accounts to pretend that they are unique, authentic users. While this may sound cool, it has serious implications as it can make it possible to create an army of bots that can spread spam and fakes all over the internet, potentially resulting in fraudulent actions. Note: Obviously, I won’t discuss here how you can do "bad" things; you must always be careful, stay away from the “dark side,” and avoid committing illegal actions. This article is about the technology behind this, so use the information wisely. This is the first (and maybe not the last) article in this domain, so it will be more like an overview. The content offers an intro to the topic. There are dozens of tools and ways to detect, collect, and spoof fingerprints, and there are many different parameters and technologies that can reveal or hide your real identity or the fact that you're spoofing fingerprints (meaning you're not an authentic user). Parameters in Digital Fingerprints Let's consider some of them, some examples of obvious, simple, or well-known params, some that are rarer, less-know, and difficult to spoof. this string provides information about the user's browser, operating system, and device. User-Agent: it reveals the user's network and geo-location. Services use IP addresses for security and to prevent malicious activities. If you use one account from different IPs or many different accounts from the same IP, some services may view this activity (in combination with other params) as suspicious and use some level of bot protection against you. This can also be triggered if you use IPs that are already used or in some kind of banned list (proxies). IP: Information about installed plugins and extensions can be used to create a unique fingerprint - it helps in identifying users based on their browser's additional functionalities. Browser Plugins and Extensions: different users often have different display characteristics. Screen Resolution and Color Depth: they are important factors in fingerprinting - if you have random values, e.g., Japan timezone Norwegian language this is a bit unusual. Timezone and Language Settings: it involves rendering hidden graphics in the user's browser to gather information about the graphics hardware. Quite a tricky one because if you spoof your hardware info, then you can’t have the proper canvas value - you can’t render it on your different real hardware. Canvas: it exploits the unique capabilities and limitations of the user's graphics hardware in rendering 3D graphics - additional information about the user's device. WebGL Fingerprinting: the list of fonts installed on a user's system can be used as a fingerprinting parameter. This information is accessible through JavaScript. The list of fonts has to be realistic - so e.g. you can’t have Win fonts on macOS or you can’t have just 1 or 2 fonts, this is a very suspicious indicator. Fonts: it allows websites to determine the device's battery level and charging status, the combination of battery attributes can be used for fingerprinting. Battery status API: websites can use the web audio API to generate unique audio fingerprints by analyzing the audio processing characteristics of the device. Audio Fingerprinting: This information includes details about the software and hardware components of the device, such as the graphics card, network adapter, and operating system. This adds to the uniqueness of the fingerprint. Hardware Concurrency: This information includes details about the network connection, such as the IP address, ISP, and DNS server. Network Information: some users may use some software that listens to specific ports which also might be useful for some specific cases. Open and used ports: Navigating the Web incognito Digital fingerprint manipulation is a difficult task that demands a proactive approach to avoid detection. The are lots of strategies and tools to hide your identity (fingerprints) or pretend that you are someone else. Use privacy-focused browsers Opting for privacy-focused browsers, such as Brave, Ghostery, Tor, Octo Browser, or Vivaldi with enhanced privacy settings, provides a fundamental defense against common fingerprinting techniques. These browsers prioritize user privacy and incorporate features designed to hide your real fingerprints, making it harder to track your activities. For example, the Tor Browser, grounded in principles of anonymity, routes internet traffic through the Tor network. This strategic routing obscures the user's identity by bouncing connections through a series of volunteer-operated servers, enhancing overall online anonymity. Browser Extensions Privacy-centric browser extensions, including AdBlock, uBlock Origin, Privacy Badger, or CanvasBlocker, could be active defenses against tracking scripts, cookies, and fingerprinting attempts. These tools operate in the background, protecting and preserving user anonymity. VPN and Proxies The use of VPNs or proxy services adds an additional layer of protection by masking the user's real IPs (location, timezone, language, etc) and encrypting internet traffic. This is not only used to change your fingerprints but also to provide a more anonymous online presence and a higher security level. Motivations behind fingerprint spoofing Understanding the Whys Individuals concerned about personal privacy and the growing digital surveillance often spoof fingerprints to shield themselves from relentless online tracking. Privacy: Spoofing fingerprints prove useful for circumventing geo-restrictions, allowing users to access content restricted to specific regions. VPN and proxy services play a crucial role here by not only hiding the user's identity but also providing access to servers in different geographic locations. Geo-restriction: Avoiding targeted advertising and online profiling serves as a compelling motive for individuals to manipulate their digital fingerprints. Some tools can block 3rd-party tracking scripts and cookies, disrupting the profiling process. Ads: Web scraping, multi-accounting, e-commerce, bounty&airdrop, bonus-hunting, social networks bots, and affiliate marketing are often sources of income or bases for medium businesses. Digital agencies, individuals, and influencers engaged in these activities may require fingerprint spoofing to navigate through complicated bot detection systems. Avoiding detection becomes vital for some services, ensuring that legitimate activities are not mistakenly flagged or restricted (though quite often, such activities and accounts are not really legit but pretend to be so). Some of the most popular tools are Multilogin, X-Browser, Octo Browser, AdsPower, Incogniton, Scrapy, Surfsky, Web Scraper.io, ScrappingBee, etc. Strategic needs in the digital arena, bot detection, and protection systems: Collecting Users' Fingerprints Websites use JS (obviously) to harvest details about users to construct comprehensive digital portraits. This involves probing screen resolution, device orientation, mouse movements, keystroke dynamics, etc. Sophisticated fingerprinting scripts enumerate a wide range of browser and hardware attributes. JavaScript: Persistent cookies and data stored in local storage work to track users across sessions and platforms. Techniques include leveraging browser cookies and storing unique identifiers for user tracking. Depending on your purposes you need to know when you need an "empty" browser with unique fingerprints or when you need to trick a service showing that you have particular cookies and the same fingerprints. Cookies and local storage: The inclusion of 3rd-party scripts for analytics and advertising embeds invisible trackers often used to adjust systems behavior for a specific user based on collected fingerprints. You can use the aforementioned tools and approaches to selectively block or trick such scripts to get the needed behavior. 3rd-party scripts: Understanding Your Online Identity Panopticlick (EFF), Pixelscan, deviceinfo.me, and BrowserLeaks show your browser's fingerprint parameters such as User-Agent, canvas fingerprinting, fonts, etc. These checkers provide insights into the uniqueness and stability of your digital fingerprint across different browsing sessions. Online checkers: they allow users to inspect network requests, cookies, and other fingerprinting parameters, fostering a deeper understanding of their digital imprint and how websites detect bots and unique legit users and collect fingerprints. Examining the Network and Application tabs in browsers provides a real-time view of the data exchanged between the browser, websites, and servers. Browser developer tools: Here are some examples of how you can get some info about users' fingerprints in the browser. GEO: navigator.geolocation.getCurrentPosition(function(position) { var userLocation = position.coords; }); Microphone: navigator.mediaDevices.enumerateDevices() .then(function(devices) { var microphones = devices.filter(device => device.kind === 'audioinput'); }); Camera: navigator.mediaDevices.enumerateDevices() .then(function(devices) { var cameras = devices.filter(device => device.kind === 'videoinput'); }); Speakers: navigator.mediaDevices.enumerateDevices() .then(function(devices) { var speakers = devices.filter(device => device.kind === 'audiooutput'); }); Audio: var audioContext = new (window.AudioContext || window.webkitAudioContext)(); var oscillator = audioContext.createOscillator(); var analyser = audioContext.createAnalyser(); oscillator.connect(analyser); analyser.connect(audioContext.destination); GPU: var canvas = document.createElement('canvas'); var gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl'); var renderer = gl.getParameter(gl.RENDERER); console.log(renderer); Fonts: var fonts = []; var fontList = document.fonts.forEach(function(font) { fonts.push(font.family); }); console.log(fonts); Canvas (hashing): var canvas = document.createElement('canvas'); var context = canvas.getContext('2d'); var dataURL = canvas.toDataURL(); var canvasHash = MurmurHash3(dataURL); console.log(canvasHash); RAM and CPU: function getCPUInfo() { return navigator.hardwareConcurrency || 0; } function getDeviceMemory() { return navigator.deviceMemory || 0; } var cpuInfo = getCPUInfo(); var deviceMemory = getDeviceMemory(); console.log(`CPU Cores: ${cpuInfo}`); console.log(`Device Memory (GB): ${deviceMemory}`); Bot Detection Systems: Defending Against Automation A couple of examples of such systems: It is a global leader in bot detection and mitigation. It provides a proactive and precise way to verify that legitimate human users are accessing your website, mobile app, and APIs. Distil Networks uses a combination of techniques to detect bots. It studies a range of variables such as cursor movement, click patterns, and web browsing patterns across other websites. It uses , which checks all visitors against hundreds of different characteristics, focusing on their behavior. Distil Networks defends against web scraping, competitive data mining, account takeovers, transaction fraud, unauthorized vulnerability scans, spam, click fraud, denial of service, and API abuse. It can automatically block 99.9% of malicious traffic without impacting legitimate users. It also offers Distil Bot Defense for Web and API, which protect your website and API servers respectively. Distil Networks: Bot Detection: device fingerprints and Are You a Human technology It actively pulls additional data from the browser to identify devices with precision. When a browser request comes in, Distil interrogates the headers to see if the visitor is lying about their identity. This unique identifier can be used to fully or partially identify individual devices even when cookies cannot be read or stored in the browser, the client IP address is hidden, or one switches to another browser on the same device. It uses machine learning to detect biometric patterns in mouse activity and scrolling, as well as looking at browsers, devices, and other factors for clues. It can detect many simple or medium complexity bots that run JS from a web page. Resource Protection: It's a comprehensive cybersecurity platform that integrates fingerprint-based identification to discern legitimate users from potential threats. Utilizing advanced behavioral analysis and anomaly detection, Imperva builds profiles based on a combination of factors, including IP reputation, user-agent, different fingerprint params, and behavioral characteristics. This allows the system to detect suspicious activities indicative of bot traffic and mitigate potential threats effectively. Imperva: It's a prominent content delivery and cloud service provider that incorporates robust bot detection mechanisms within its security offerings. Leveraging a combination of fingerprint-based detection, behavior analysis, and machine learning, Akamai identifies and mitigates various bots. Akamai's global network allows for real-time threat intelligence, enabling proactive defense against evolving bot tactics. Akamai: It's a widely used content delivery network and security service that employs a multifaceted approach to bot detection. Cloudflare distinguishes between human users and bots by analyzing parameters such as IP reputation, user-agent characteristics, and behavioral patterns. The platform also utilizes threat intelligence and community-driven insights to stay ahead in the battle against emerging bot threats. Cloudflare uses to profile SSL/TLS clients and block potential bot requests. It also uses to apply rules and route traffic based on HTTP request information. is used to identify specific files and prevent data loss. These techniques help in detecting not real users. Cloudflare: JA3 Fingerprinting HTTP Filtering Data Fingerprinting Role of Bot Detection Systems: They play a pivotal role in enhancing bot detection capabilities. With servers strategically positioned around the globe, they can leverage geographical insights and real-time threat intelligence to identify and mitigate bot traffic effectively. The platform's WAF and bot managers contribute to a comprehensive defense against automated "users.” In this ongoing cat-and-mouse game, Bot Detection Systems continue to evolve, leveraging advanced technologies to stay ahead of fingerprint spoofing tech. The collaboration between security providers, businesses, and the wider online community remains crucial in defense against the tactics of automated threats but also, in a way, used against users' privacy, anonymity, and experience online, bringing intrusive ads and sophisticated user tracking tools that are only beneficial for businesses not for users. However, privacy protection, fingerprint hiding and spoofing, and ads and trackers blocking tools are also developing to evade even the most sophisticated user tracking systems. Websites' additional verification steps If a fingerprint appears suspicious, such as frequent changes or unusual combinations of data points, the website may trigger additional verification steps. Suspicious behavior: Websites may present users with captcha challenges to verify their identity. This involves solving puzzles or identifying distorted text, tasks that are difficult to perform for primitive bots. Captcha: Websites may request users to verify their mobile phone numbers to establish a stronger connection between a unique identity and a real-world entity. This can help prevent fraudulent activities. Mobile verification: the idea is the same as with mobile phones, but you need to submit your ID ID verification: Examples: Google doesn't require additional verification for new users with clear, consistent fingerprints. If a user's fingerprint changes frequently or resembles those used by known bots (or just already known for Google), Google may ask for a mobile phone number or ask to deal with a captcha. Financial websites often enforce stricter verification measures due to the sensitive nature of transactions. They may require users to provide additional personal information, verify their identity through secure channels, or pass more complex captcha challenges. Opinion: spoofing is better than hiding Hiding fingerprints can enhance privacy, security, and online anonymity, but spoofing them to appear as a unique, legitimate user offers even greater advantages. By blending in with the crowd and avoiding suspicion from systems that detect anti-detection tools, you can maintain credibility and trust. This approach allows you to enjoy the benefits of being perceived as a unique, legitimate user, minimizing the chance of facing additional protecting measures or obstacles. and, obviously, it helps in preventing leaking of your real data and identity. Also published . here

Intro to Digital Fingerprints: Understanding, Manipulating, and Defending Against Online Tracking

ডিজিটাল ফিঙ্গারপ্রিন্টের ভূমিকা: অনলাইন ট্র্যাকিংয়ের বিরুদ্ধে বোঝা, ম্যানিপুলেট এবং ডিফেন্ডিং

Einführung in digitale Fingerabdrücke: Online-Tracking verstehen, manipulieren und sich dagegen wehren

Introducción a las huellas digitales: comprensión, manipulación y defensa contra el seguimiento en línea

Introduction aux empreintes digitales : comprendre, manipuler et se défendre contre le suivi en ligne

डिजिटल फ़िंगरप्रिंट का परिचय: ऑनलाइन ट्रैकिंग को समझना, हेरफेर करना और उसके विरुद्ध बचाव करना

デジタル指紋の概要: オンライン追跡の理解、操作、および防御

디지털 지문 소개: 온라인 추적에 대한 이해, 조작 및 방어

Introdução às impressões digitais: compreensão, manipulação e defesa contra rastreamento on-line

Введение в цифровые отпечатки пальцев: понимание, манипулирование и защита от онлайн-слежения

Dijital Parmak İzlerine Giriş: Çevrimiçi Takibi Anlamak, Yönetmek ve Savunmak

Giới thiệu về Dấu vân tay kỹ thuật số: Hiểu, thao tác và bảo vệ chống lại việc theo dõi trực tuyến

数字指纹简介：理解、操纵和防御在线跟踪

In today's interconnected world, almost every individual has had some experience with malicious links. These can manifest in various forms through emails, text messages, social media direct messages, or other online communication channels. digital traps Malicious links are the preferred tools of cybercriminals, who use social engineering and deception to manipulate their targets into clicking on these potentially harmful URLs. These deceptive links can lead to various malicious activities, from downloading malware or ransomware onto the victim's device to directing them to counterfeit websites designed to steal personal information or money. Understanding malicious links, comprehending the damage they can inflict, and knowing how to spot them is paramount, particularly for businesses safeguarding sensitive data. Defining and Identifying Malicious Links Malicious links are like Swiss Army knives in a cybercriminal's toolkit, offering versatility in delivery and an array of potential threats. They provide an uncomplicated means of infiltrating unsuspecting individuals, as many recipients click on links without pausing to consider their origins or the potential risks involved. or a text message containing a malicious link and achieve a broad spectrum of outcomes, from stealing user credentials to monetary gain. Being vigilant and exercising caution when interacting with digital content is essential to maintaining security. Cybercriminals can send an email Recognizing a malicious link requires a discerning eye, even when it appears benign at first glance. Hovering over a link reveals its URL, enabling users to check if it's a recognized and safe destination. To reduce risks, avoiding clicking on shortened links that obscure their final destination is advisable. Analyzing the entire message can also provide crucial insights; unexpected communications, messages from unknown senders, or messages that pressurize the recipient into clicking on the link should all raise suspicions. The Impact of Malicious Links Like other forms of cyberattacks, malicious links can cause significant harm to individuals and organizations. It takes just one unsuspecting click from an employee to download malware that can infiltrate an entire network through their device. While malicious attachments are increasingly used, malicious links remain a substantial threat. The consequences of falling victim to a malicious link can range from minor inconveniences to catastrophic outcomes, depending on the link's purpose and the target's ability to mitigate the damage. Individuals who click on such links, whether acting on their own behalf or on behalf of an organization, are vulnerable to having their account credentials stolen and misused, their devices infected with malware, their data breached or stolen, financial losses, and reputational damage. For organizations without robust cybersecurity measures in place, compromising even a single device or account via a malicious link can serve as the entry point for a more extensive and damaging attack. Malicious Link Tactics The world of cybercriminals is vast and diverse, with various tactics and methods employed to exploit potential targets. of the broader category of phishing, and they can be further subdivided into various subcategories. Attackers use many tricks to entice their targets into clicking on harmful links. The ultimate aim of cybercriminals is to persuade users to click on the malicious link, which, when activated, can automatically download malware or ransomware onto the victim's device. Alternatively, the link can lead to a counterfeit website, requiring the victim to enter their credentials or provide data or money to the attacker. Malicious links represent just one facet Many of the maneuvers used by cybercriminals rely on social engineering and deception to lure the target into clicking on the malicious link. These tactics include impersonating loved ones, work supervisors, or legitimate corporate entities to instill a false sense of security and gain trust. Urgency is a common theme in their messages, often accompanied by offers that appear "too good to be true," compelling the target to click on the link without critically assessing the decision. These tactics are insidious and effective, underscoring the importance of learning to recognize them. Conclusion Malicious links are pervasive on the internet, and although many people are well-versed in identifying the typical signs of a scam or phishing email, cybercriminals continue to rely on tried-and-true social engineering methods to deceive their targets. Staying informed about the evolving landscape of these scams is vital. Additionally, understanding other , such as insider threats and data breaches, is crucial for businesses looking to protect themselves from common incidents. Awareness and vigilance in the digital realm are the keys to guarding against the hidden threat of malicious links. forms of cyber threats

Guarding Against the Hidden Threat: Recognizing and Defending Against Malicious Links

With the surge in popularity of tools and large language models, individuals now have the incredible capability to amplify the quantity and caliber of their work like never before. generative AI However, all great advancements have a dark side. The world of is not exempt from this revolution, as malicious actors can now employ AI-enabled tools to outwit organizations and capitalize on vulnerabilities on a grand scale. cybersecurity To stay ahead of emerging AI-powered threats, it’s crucial for your organization to be adequately prepared. This post outlines essential steps that you can take to safeguard against these challenges. Strengthening Your Organization’s Security Foundations Even before the popularization of AI tools, most organizations were not adequately prepared for serious cybersecurity attacks. There are dozens of reasons for this, but at its core, maintaining a strong security posture is like running on a treadmill. There are always new vulnerabilities being uncovered and exploited. Malicious actors don’t stand idle while organizations undergo changes in management, backfill team members, implement new policies, or accrue technical debt. The gap between the demand for cybersecurity jobs and the supply of experts has been . The reality is that many organizations are falling behind compared to the threats they face. It’s never been more important to build out a robust cybersecurity team and empower them to develop lasting security systems. well documented Get the Security Basics Right While the new AI technologies can accelerate how hackers attack, organizations still need to execute the basic security best practices: Is MFA enabled on critical applications? Are you using strong passwords? Do you have endpoint security and device management tools installed everywhere? Do you have firewalls and strong network security settings? Are you rotating access keys periodically? Are you following the principle of least privilege when assigning permissions? By reducing weak links and variability across your attack surface, you can ensure a maintainable baseline security posture. If you don’t have the basics solved, you’re vulnerable regardless of what technologies bad actors are using. Expand Security Education Across Teams Your security is only as strong as your weakest link. In many attacks, all it takes is one non-vigilant employee to open the door to a breach. Consistent education and training for all employees is a core component of strong security posture. Phishing attacks in particular have grown eerily convincing. It’s simple to use generative-AI tools to build webpages, write persuasive messages, and even impersonate someone’s tone with a sample of their writing. Organizations with higher cyber literacy and a culture of security awareness have the competitive advantage and are more resilient against attacks. Consider what your security training program looks like for employees across the entire company. What threats are not currently covered in your regular training? How frequently do you remind employees of social engineering attack red flags? How can you make it easier for employees to know what actions are risky? By providing security education and training, organizations can ensure their employees are better equipped to detect and report threats. A security-first company culture makes for easier and faster responses to severe threats from the security team. Monitor Attack Surfaces and Manage Alerts It’s critical to equip your organization with the proper tools to monitor for malicious activity and malware. Now is the time to consider every possible attack surface: company and personal devices, email inboxes, networks, exposed digital resources, APIs, SaaS applications, and even corporate offices. Do you have tools or processes that monitor your organization’s status in each area and notify you of any suspicious activity? Many organizations have a dedicated Security Operations Center (SOC) that receives alerts from various security tools, prioritizes which alerts are serious threats, and investigates to determine whether they are critical, contained, or false positives. If you are in a large organization with a large attack surface, you could see thousands of alerts every day. Some of these alerts are native to the tools you use. For example, will notify you about suspicious login attempts and will notify you if malware is detected on a device. If you have custom rules and policies your team has set using a cloud security or security automation platform, you would receive alerts from events that meet that criteria. Okta CrowdStrike Triaging security alerts at scale is a discipline that requires your team to iterate constantly. They must prioritize which alerts require thorough investigation, which alerts should be resolved with automated workflows, and what policies can be implemented and enforced to minimize common low-level alerts.\ If you don’t have an efficient way of fielding alerts, your team will end up with alert fatigue, burn out faster, and struggle to make the most out of their time. Launch Proactive Security Automation at Scale So far, we’ve walked through some fundamentals to invest in a security team, implement basic security best practices, create a culture of security awareness, and monitor for malicious activity across your organization. If your team is already at this stage, then you are in good shape to face the security threats of… 2015? The security landscape changes constantly. The shift to cloud computing, SaaS applications, and a new generation of monitoring tools has added significant complexity for security and IT teams to manage. Streamline Communication Workflows Across Your Organization Maintaining a strong security posture in 2023 requires coordination across multiple teams. Large organizations have teams designated for specific security use cases: Security Operations Center (SOC) Identity and Access Management (IAM) Governance Risk and Compliance (GRC) IT/ SaaS Security Cloud Security To create streamlined communication and amplify the impact of your security team, you need automated workflows to connect your tools to your people in a seamless way. For example, when Okta sends out an , does your team need to manually read the alert, draft an email or message, send it to the employee to verify that they were the person trying to log in, and resolve the alert if it’s a false alarm? alert for a suspicious login Handling tasks like this manually has a serious opportunity cost when you could be spending that time proactively improving your security posture. Enforce Security Best Practices with Modern Automation at Scale While fielding alerts in a sophisticated way is important, taking steps to implement security best practices as enforced policies can reduce the overall volume of alerts. For example, once you set an automated policy that checks whether a new AWS S3 bucket is publicly-accessible, you can catch poor security configurations upfront and notify the AWS user that launched it that they need to change the settings. Without the automation in place to run this check, you only avoid public-accessible buckets by routinely querying across your AWS account and manually following up with users and updating settings. The context-switching required for this makes it impractical, especially considering how many different AWS resources could have insufficient security settings. In this framing, consider how easy it is for your team to create automated workflows. Does it require scripting or submitting a request to a security analyst? Your team’s ability to create automated workflows (whether it’s to handle alerts, enforce policies, or streamline communication) is the exponential lever on the impact of your daily work. Security automation previously required scripting, then came low-code tools that enable you to drag-and-drop actions into a canvas and build custom automation across tools faster than ever. And now, there’s another seismic shift. Incorporate AI Capabilities into Your Security Systems “When a new S3 bucket is created, check if it is publicly accessible. If it is public-accessible, notify the AWS user that they need to update the settings to block public access.” This is a security workflow in two sentences. How powerful can a couple of lines be? Much more powerful than you’d think. Introducing generative AI into the security automation equation means now all you need is a prompt to generate an automated workflow. In other words, it’s never been easier to turn security best practices into active security policies for your organization. This comes at a critical time since malicious actors are also adopting AI technology to formulate new attacks and extract more damage. next generation of security automation If you have brittle or legacy security infrastructure, you may be prepared for the types of attacks we’ve seen in recent years, but you may not be able to adapt to the new types of attacks that we haven’t seen yet. Fundamentally, security teams will need to embrace AI-powered tools to gather information faster, enforce new security policies at scale, and interact with targeted employees in-real time to validate their identity and obtain additional context.

Defending Your Organization Against AI-Powered Hackers

Defendiendo su organización contra piratas informáticos impulsados por IA

Défendre votre organisation contre les pirates utilisant l'IA

एआई-संचालित हैकरों के विरुद्ध अपने संगठन का बचाव करना

AI を利用したハッカーから組織を守る

Defendendo sua organização contra hackers com tecnologia de IA

Bảo vệ tổ chức của bạn chống lại tin tặc do AI cung cấp

保护您的组织免受人工智能黑客的攻击

In today’s episode of the Brains Byte Back podcast, we speak with , Founder & CMO at , a company offering web app security, WAF and SSL Certificates to keep businesses safe. Venkatesh Sundar Indusface In the conversation, Sundar shares tips to help listeners defend their businesses from . He starts off by stressing the importance of ensuring that all software and systems are kept up to date with the latest security patches and updates. Doing this can help to shut down any known vulnerabilities that hackers may look to exploit. hackers Additionally, he underlines that it’s important to make use of strong access controls and authentication measures to allow only trusted users access to sensitive data or systems. This consists of measures such as two-factor authentication, strong password policies, and limiting access to only those who require it. Sundar adds that regular security assessments and penetration testing can be effective when it comes to identifying vulnerabilities before hackers can take advantage of them. This can entail simulating real-world attacks and attempting to exploit weaknesses in the system, to find potential areas where improvement is necessary. Alongside the above, Sundar highlights specific tactics that listeners can use to defend against ransomware attacks, such as ensuring that data backups are regularly performed and stored securely. This can help to reduce the impact of a ransomware attack by allowing businesses to restore their systems and data from a previous backup. And finally, Sundar covers why it is important to teach those within your organization about the danger of phishing attacks and other social engineering tactics that hackers frequently use to gain access to sensitive data or systems. He encourages business owners to provide regular awareness training to make sure that employees are more knowledgeable and fully aware of the latest threats and how to avoid falling victim to them. security Watch the Video https://youtu.be/Q-zGfmaYRcQ?embedable=true Venkatesh Sundar: Okay. So, I am Venkatesh Sundar, the founder of Indusface. I was the founding CTO who wrote the first line of code and built the minimum viable product, which gave us the right to win and get the first set of customers. I was the first presales engineer in the deployment of the first few set of customers. Venkatesh Sundar:  As we evolved and the product market fit was established and we had large enterprises, banks, insurance, manufacturing, and large manufacturing, adopt our product and use it for securing their Web API, and mobile apps. And as we scale, I was able to get better people than me to solve the scale problem and take on a marketing, digital marketing role to build, what we have built with our success closer to our home base in Asia. And India, I took on a marketing role to see how I bring the message out to the international market. So an accidental marketer from a technologist and then that problem again the day zero problem of marketing to get international customers were solved. Venkatesh Sundar:  And we are at a point where we have 100 plus customers in the US, we have 5,000 plus customers globally, including the freemium versions 1500 plus customers, using the freemium version. But the paying customers, large enterprises, a big market segment in the US, is also 100 plus and building on that. I’m now taking the third day zero problem to build on the enterprise US business as a president of America’s, so now in the process of moving from here to the US Right now, I travel quite a bit but yeah, replicate our enterprise success here. Build on the mid-market success that we acquired digitally from internationally and now focusing on the US market to build the pre-sales sales business development, customer success in the US Enterprise Market. So that’s my long answer. I can keep talking about this but yeah, we have established product market fit at every stage proven, the product at every market, and then building on scale, on top of it. And in a nutshell, I Think I would define myself as solving the day zero problem. I mean, startup by different day zero but you break it down into many d0 problems. As we scale up. Then the day zero problem, I’ve tried to find somebody better than me to scale it up and then I try to move on to do something else. Samuel Brake Guia: Fantastic. Well, congratulations on all this growth. You’ve seen and I was really curious about how the company started and you gave quite a good summary there. But I’d like to know how did you come up with the name Indusface, what’s the story behind that? Venkatesh Sundar: Yeah the story is more related to a roots. We’ll I mean I’m obviously living in India and my origins in India and India has gone through different transformations, different stages, especially in technology, India ended up becoming the go-to place for services, outsourcing software development, those kinds of stuff, but the product innovation from India was still lacking when we started this. So, I think it is more an emotional type to route. We wanted to be the face of India. And India’s roots are in India’s civilization. For a product made in India, that goes internationally, right? And in this day and age of global globalization, they have a right product, anybody in the world anywhere can buy it, but we want to have the footprint of the roots and the founders. Venkatesh Sundar:  Also, tied to our team. So Indus civilization represents the ancient civilization, which had phenomenal, innovation progress, two thousand of years back. We want to do that now in the New Age, era of information technology, In cyber security, which is where, which is my domain, and that’s about it, so nothing, very exciting. But yeah, that’s probably more an emotional founder’s emotion attached to it. Samuel Brake Guia: I’d say that’s very exciting, that’s cool. I did not know that. I’m always so curious to know what the story is behind a company’s name because I always find it so important. And that you usually find actually that’s quite an interesting story. And I like the fact that this is a fusion of different words. So, that is really cool. And you mentioned there about cybersecurity and last year, you folks publish an article, to keep your business prepared for It hacking season and obviously as you mentioned in the article 89% of organizations, reportedly experience holiday ransomware attacks. But as we know these attacks can happen at any time of year. So what advice do you have for listeners to best defend their businesses from hackers? Venkatesh Sundar:  So I mean ransomware is not an attack. Ransomware is an outcome of an attack where somebody’s data is held for ransom, and during holiday seasons, people are most vulnerable, they are looking for shopping and users are looking for deals. Businesses are trying to come out with new promotions and speeds of more importance to get those promotions in their applications out. And in that process, there might be many vulnerabilities, that leaves them open, which is what gives an open playground for hackers. So it happens during holiday season. Venkatesh Sundar:  It’s an automatic function of speed for the businesses to roll out their promotions exploit, make use of the holiday seasons, and for consumers who are looking for deals combination of all those things leaves open many vulnerabilities. So my advice to people especially businesses because we are in the business of protecting applications for businesses because applications are central to the way they interact with their consumers employees partners and everybody, right? So we protect applications. so we tell that makes security and integral part of your software development life cycles and all the way into production. So that at least your application does not become the segway through which your customers, your consumers on your data at risk. So, do not compromise speed, but make security an integral part without compromising speed and, that cannot be done unless and until you accept that this is my domain, this is my area of expertise in terms of what we do, it can be a CRM application. It can be a D to see. E-commerce application. It can be a cab riding platform, whatever it is right at the end of it. Central to any of those businesses interacting with their consumers and application. And businesses have to focus on the security of their application because that is the heartbeat of any digitization initiatives. And speed of business is now imperative for anybody to stay relevant. Venkatesh Sundar: It’s not about how big you are, but how fast you adapt to the changing needs of consumers, trends and everything, is how every business operates to stay relevant. And with speed comes risk, and the need for speed is even further higher during the holiday season, especially for certain types of businesses, which have different promotions. And hence, you see a correlation between a higher amount of attacks and public reports during holiday seasons for ransomware. Because it’s not my chance or correlate or coincidence, right? There is a very strong cause and effect there because of speed people end up having more vulnerabilities that are, can be exploited and hackers are waiting to exploit those vulnerabilities and during holiday seasons. The customers might be even more vulnerable to succumb to ransomware attacks as opposed to. Even though they’re ethical call and reasons, might be never to succumb to it, and not pay a single buck. Even if it is going to cost me less even it’s going to or even, it’s going to cost me more for the downtime it creates, but that ethical reason goes for a toss when they are when their businesses shut down. And even further, so during holiday seasons So my advice, which is the question you asked is to consumers, do not click on any random links or do not click on links. That you do not know, do not share your OTP to unknown people, and make sure that the endpoint that we have which are interacting is trusted. It is encrypted Venkatesh Sundar:  Have an eye for detail that is only through consumer education, education and awareness that can address that, but to businesses, which becomes a segue through which because you consumers interact with them, they had to make sure that their own application that their own services that they provide lives up to the trust, the consumers and the businesses and other people place on them and to live up to the trust. They had to make sure they proactively, take effect effort to mitigate those risks. And if it proactively take those effort and mitigate those risks, it can also deal with when those attacks happen, much better. And it also wins consumer confidence because most of the breaches, the problem of erosion of consumer confidence is not because of the attack or the downtime itself, but because of the lack of transparency that businesses have in communicating, clearly what is that happen. Those transparency doesn’t exist, but if they show that clear, Venkatesh Sundar: These are the things we have in place in spite of this happen. But we learn from this, and we are improving it, and This is the impact and these are on the workarounds then. Actually those situations turns around to build the trust further. So, the long answer again is to businesses, pay important attention to applications security, and do not compromise on application security practices in the, in favor of speed, make it an integral part and do not compromise on speed, but make it integral part of How do I keep the agile development going on with speed as an integral. With security is an integral part of that. Samuel Brake Guia:  You got some pretty solid advice and what you mentioned about transparency and being clear. I think that’s what’s so important and I also I’m very curious to know like Oh there are other companies operating in this space and if so like how do you differentiate yourself from the competition? Venkatesh Sundar: Yeah, I think it goes back to the story. You asked the first question, How did you start in space? I mean, right from day zero and this was like when we went to the I mean again, if you look at the history, the first product that we build in in this phase was basically a risk detection product, a malware detection product. and once we got a critical mass of customers and some traction from it, it got acquired by trend micro, right? And it was a set purchase. We’ve got acquired by Trend Micro with a little bit of money that we made from that and we went back to the drawing board and said that we want to start something else and obviously my domain expertise was on security application, security specifically. And it was a crowded market. We were not the only vendors. We are not creating a new category, but in an existing category, how do I create a blue ocean? How do I create a differentiation especially when there are many players and there has to be a compelling enough aha for in terms of value to the customer. Even if we are a new startup coming up, the version one product, right? Venkatesh Sundar:  And that differentiation that we identify 10 years back that even though we are building a software product even though we are building a tool that is trying to solve a specific problem in this case protecting applications and establishing the intent of the traffic and the user that is coming into the transaction. Is it? Good or bad? Other players are doing it. Venkatesh Sundar:  But there is a set of policies that we had to build, but the key differentiator was We just don’t throw it all in and walk away. We combine management of it updates of it, making sure that your applications are protected from new threats. Your applications are protected relevant to your current application risks, like a holiday season example, that you mentioned that you are rolling out this feature, but there is this vulnerability that exists because of speed and they’re not going to the proper QA, do not worry about it, let that vulnerability exist, but we as a gateway, that instantly virtually patch it as a part of the managed services. So it’s a tool that we combined with managed services offering As part of my 24 by 7 support license, became that one singular Aha factor that we provided to the customers, and guess what? 10 years later since the drawing board situation when it was just PPT vision mission statement and differentiation and everything. The same differentiation holds good today. And imitation is the best form of compliment. Some of the biggest players in the competition, who are our competitors are actually copying the same capability. Now, So we have the first advantage. We have the critical mass but the fact that they are copying the same value feature differentiation that we have is actually some kind of pride for me as an individual and also the company because yeah we have done something right? And we have to follow the report game and innovate further so management. Combined with the application, security, and within application security. If you really lay down the landscape, that is this detection of the application which requires specialized skills. Venkatesh Sundar:  That is accurate surgically, accurate risk protection? Specific to the risk of your application, that requires a specialized grid skill, which is a web application firewall. And there is detection, typically security, scanning pen testing. And there is continuous risk monitoring, which is not just configure and walk away. There are new threats, your application itself is changing, it is integrating with third-party components. New APIs are being added. Venkatesh Sundar: All of these three together under one umbrella with the 24 by 7 support management, to you becoming a single SOAP application security, vendor rent management will just don’t throw a tool and walk away becomes a most compelling differentiator and then the delivery of it to the customer and references and everything then helps to sustain it. So, in terms of capability piecing together, all the aspects of the application security, and providing our expertise, on top of the product, became our, a hard differentiation, which was my minimum viable product launch based on which you want it and it continues to remain a key differentiation today based on our ability to build on the first more advantage and process integration, a lot of other things and now our competition and the industry itself and even analysts are telling that OEM vendors have to up their game. In terms of the services component, they provide as part of support, you cannot just be incident management. It has to be this, which further validates our original vision, and our differentiation as well. Samuel Brake Guia: Mm-hmm. Yeah, I think what you said definitely makes sense to me, the fact that imitation really is the greatest compliment and I can understand how you have such a competitive offering when you offer all of that and it does sound like you’re working on a lot at the moment and I’d love to know. Like what’s next on the horizon? Venkatesh Sundar:  Yeah, so if we look at how the application has evolved, right? I mean there’s Web 1.2.or, people are talking about 3.0 The fundamentals of communications and applications and providing some service doesn’t change. But what has changed? is like if you look at Internet traffic today, The user to website, related conversations is a small, it’s certainly a big part, but it comparatively, it’s the Internet traffic. The bigger part of Internet traffic is going to be at communication more than human to app communication. Device to App, Communication App to add communication. An example, you go to your website or a golden app, you go ahead and engage in a transaction. You want to buy something or you want to download a document or upload a document. Then finally, there are other pieces like a payment gateway. That’s a third-party component that those applications integrates with. Venkatesh Sundar:  And that payment Gateway is an API call between the application and communicating with and some other application that application is communicating it for providing the service to the consumers, right? So the app-to-app communication is going to be such an integral part of the app economy evolution that API security has become a big pain point. APA Security paradoxical is easier to solve from a technical standpoint, but from an operational standpoint, people are talking about Shadow API. People are talking about How do I discover those unknown APIs. How do I make sure I have a surgically accurate policy for my API definition, which really requires a swagger file, or some sort of documentation, which people don’t have because, you know how developers and documentation work together, right? So, those are big challenges and we try to address those challenges and APA security is a big thing. The second big team is ransomware, then, the power for a hacker to bring down a system is becoming cheaper and cheaper. Independent of vulnerabilities and risks and waiting for a targeted attack. They can just do a blind DDoS attack. Samuel Brake Guia: Fantastic. well, we’re gonna include a link to your website in the show notes of this episode but otherwise Venky, those are my questions today and I just want to say thank you so much for joining me. Venkatesh Sundar: Fantastic. It has been a pleasure. Thank a lot. This article was originally published by Sam Brake Guia on The Sociable.

A Cybersecurity Startup Founder's Insights: Defending Your Business from Hackers (Podcast)

Perspectivas del fundador de una startup de seguridad cibernética: defender su negocio de los piratas informáticos (podcast)

Les idées d'un fondateur d'une start-up de cybersécurité : Défendez votre entreprise contre les pirates (Podcast)

एक साइबर सुरक्षा स्टार्टअप संस्थापक की अंतर्दृष्टि: हैकर्स से अपने व्यवसाय की रक्षा करना (पॉडकास्ट)

サイバーセキュリティ スタートアップ創設者の洞察: ハッカーからビジネスを守る (ポッドキャスト)

Insights de um fundador de startup de segurança cibernética: defendendo sua empresa contra hackers (Podcast)

Thông tin chi tiết của nhà sáng lập công ty khởi nghiệp về an ninh mạng: Bảo vệ doanh nghiệp của bạn khỏi tin tặc (Podcast)

网络安全初创公司创始人的见解：保护您的企业免受黑客攻击（播客）

Ransomware is a severe and persistent problem. A Nordlocker study from January 2020 to July 2022 with $4.15 trillion in combined revenue. indicated ransomware attacks targeted companies These cybersecurity issues also affected more than 12 million employees during the studied period. Thus, ransomware protection methods are a much-discussed topic. As types of ransomware get more advanced and devastating, what are the best ways to defend a business? People often bring up access controls as they plan or improve strategies to safeguard against ransomware. However, they’re not total solutions. Limiting what people can access within an organization can minimize the damage linked to a ransomware attack. The Least-Privilege Principle Minimizes Possible Access One best practice for ransomware protection is to deploy the least-privilege principle for access. It means people to do their jobs. only have what’s required However, this approach also encourages hackers to find the accounts of the people within the organization who have the most privileged access. It’s also helpful to restrict which users can install and run the software. Hackers often try to do those things when putting malware on a machine. However, it’s necessary to strike the right balance between security and productivity. If people believe a company’s cybersecurity procedures prevent them from doing their jobs well, they might try to circumvent those measures. Privileges-Based Access Management Thwarts Hackers A privileged access management (PAM) strategy is also an excellent preventive measure against successful ransomware attacks. That approach significantly limits how far they can spread. PAM relies on single-use for a person’s session. It’s then useless for a hacker to steal those passwords and try to access systems with them. PAM sessions also get recorded and monitored. passwords that only remain valid Security team members can end them remotely if a person’s behavior becomes suspicious or exceeds a predetermined threshold. Companies also use behavioral analytics to create profiles of each privileged user. The details could include how fast they type, what sites or platforms they visit, for how long, and from which location the person accesses the system. A deviation from the norm does not necessarily signify something amiss, but it could encourage security teams to keep a closer watch. Using the Latest Tech Matters, Too Access control is only part of a well-developed strategy against ransomware. Companies should also invest in the latest technologies. That might mean ensuring all employees use the latest operating systems and software versions. It could also entail purchasing cybersecurity solutions that rely on artificial intelligence and other advanced options to help people spot and defend against cyber threats. Legacy systems with new and improved processes. That’s one of the common problems that encourage investments in new technologies. often can’t keep up However, companies should still consider tech-related cybersecurity tools even if they have the most recent computers and software versions. For example, some access control products allow people to see login attempts and current sessions on a centralized dashboard. IT managers and others in authority can then detect anything that seems out of the ordinary. Discouraging Password-Sharing Could Make a Difference It’s impossible to know precisely what kind of supercharged ransomware is on the horizon. However, something practical that people can keep doing is following best practices for accessing tools and platforms. One of the basic principles is always to keep passwords private and never share them. However, that advice often gets overlooked or ignored. A 2021 study found had shared passwords over email or text messages. However, password-sharing may also be a company policy. 62% of United States employees Such was the case for 46% of workers who said their employers directed them to share passwords for resources used by multiple people. Password-sharing could circumvent an IT team’s best efforts to implement tight access controls. Also, the more people with access to one password, the easier it is for at least one of them to misuse it and erode security even further. This problem is most impactful when a password associated with a high-privilege account spreads between people at an organization with fewer access rights. Treat Access Control as One of Many Vital Aspects Ransomware is an ever-present threat, and cybercriminals are orchestrating attacks that are more disabling, costly, and difficult to recover from. However, creating and implementing an all-encompassing ransomware prevention and response plan can keep companies safer. Access control can limit what a hacker can affect and do within an organization. It can also stop ransomware from spreading through a network. However, people must view access control as one measure among many to keep ransomware at bay. Sources: https://nordlocker.com/ransomware-attack-statistics/ ​​ https://www.cisa.gov/stopransomware/ransomware-guide https://www.techradar.com/news/how-to-prevent-ransomware-attacks-using-access-controls https://www.watermarkinsights.com/resources/blog/how-to-know-when-its-time-for-new-tech https://www.prnewswire.com/news-releases/new-survey-finds-enterprise-password-security-is-as-flimsy-as-a-sticky-note-301262779.html

Is Configuring Access Control Effective When Defending Your Business Against Supercharged Ransom?

Defending Bitcoin with John Carvalho

An FAQ for Defending Net Neutrality

Stereotypes should be debunked, not categorically denied I’m sure by now you’ve all read by James Damore. But I’m not here to talk about the memo — I’m here to talk about Google’s response. that memo Clearly panicked about what the leak of this document would do to its efforts to recruit and retain women, executives at Google quickly released multiple statements. Here are their responses to the memo’s contents: Google Vice President of Diversity, Integrity, and Governance, Danielle Brown: “I found that it advanced incorrect assumptions about gender” Google CEO, Sundar Pichai: “First, let me say that we strongly support the right of Googlers to express themselves, and much of what was in that memo is fair to debate, regardless of whether a vast majority of Googlers disagree with it. However, portions of the memo violate our Code of Conduct and cross the line by advancing harmful gender stereotypes in our workplace. Our job is to build great products for users that make a difference in their lives. To suggest a group of our colleagues have traits that make them less biologically suited to that work is offensive and not OK.” YouTube CEO, Susan Wojcicki: “No, it’s not true.” In addition, James Damore was fired for . “perpetuating gender stereotypes” After reading these responses, it was clear to me that Google believed that the arguments in the memo were “incorrect,” “assumptions,” “stereotypes,” “not OK,” and “not true.” I suppose as a woman, I should have felt relieved. But I didn’t. Because I’m not just a woman, Google, . I chose this field because I like facts and I have profound respect for scientific discourse. When I argue that a hypothesis, a belief, or a statement is wrong, I’m expected to provide supporting evidence that refutes the argument. I’m sure that your employees are expected to do so as well. So why didn’t you hold yourself to the same standard? If James Damore is so wrong, then countering his arguments based on the merits should have been easy. I’m a woman who works in STEM And beyond that, my job as a data scientist basically consists of looking at data and making generalizations about populations, so the reason you gave for firing James Damore concerns me quite a bit. Are you saying that all generalizations about gender are unacceptable? Only the ones not supported by data? Only the ones that are harmful? Only the ones that are seen as stereotypes? Only the ones that are not politically correct? Only the ones that are inconvenient when you are being sued? As someone who works in STEM, I have been trained to look at studies and tear them apart for the smallest inconsistencies in logic. Did you really think you could say that “much of what was in that memo is fair to debate” and “portions of the memo violate our Code of Conduct and cross the line by advancing harmful gender stereotypes in our workplace” without me asking you to clarify which sections you found fair for debate and which portions violated which specific portions of your Code of Conduct? To be absolutely clear — I find James Damore’s memo poorly written, his arguments fundamentally lacking, and his conclusion flawed. But this post is about you, Google. Your response could have been clear, precise, and well-cited, showing your commitment to both women and the values that underpin STEM. But instead, Google, you’ve done the most sexist thing of all. You’ve shown that when you need to appeal to me, you primarily see me as a woman, not as someone who works in STEM.

Dear Google, in defending me as a woman, you’ve insulted me as someone who works in STEM

Michael Burry, M.D. from The Big Short If you haven’t already, go and watch , starring Christian Bale (above), Ryan Gosling, Steve Carell and Brad Pitt amongst others. It’s a great film, clearly and concisely explaining the events that led to the financial crisis of 2008. The Big Short The film was based on a book by Michael Lewis which I started reading to try and get my head around the minutiae of the story. There are lots of obscure and complex financial concepts at the centre of the story. It’s absolutely fascinating. One character that really caught my attention was Michael Burry, a lone genius running a multi-billion dollar hedge fund. In an email, he wrote: “I hated discussing ideas with investors because I then became a Defender of the Idea, and that influences your thought process.” If you’ve ever brainstormed ideas with a group of people, you’ve likely found yourself in this situation. You’ve started to argue the merits of an idea and found that it’s not so easy to relinquish it. You’ve somehow become attached to the idea. A perfect brainstorm consists of 3 steps: Generate lots of unfiltered ideas without judging them Objectively evaluate all of the ideas Decide on one, or more, of the most suitable ideas The first two steps require you to step back from the ideas and not get attached to anything. Unfortunately people are innately competitive. In step 1 they want to suggest the ‘best’ idea. In step 2, when discussing the ideas, people often play devil’s advocate but it’s hard to know when to abandon an argument. If you spend 3 minutes defending an idea, you’ve put yourself in the mindset that this is an idea you could back. If someone can convince you that this isn’t a good idea then it means you weren’t smart enough to figure out why this idea isn’t suitable. If you spend 3 minutes trying to poke holes in an idea, you’ve put yourself in the mindset that this is not the idea for you. This is not idea. Human nature makes it difficult to form a complete u-turn and start supporting the idea. your This results in sub-standard ideas. People’s personalities are projected onto the ideas and the loudest person wins. The idea’s merit rarely enters the equation at all. That’s not to say I don’t think you should tell people your idea. I don’t think that you should try and be that lone genius. I don’t think that you should avoid all conflict or allow other people to sway your thoughts on a matter. Instead, it’s often best to bypass individual opinions completely. Are you able to use people outside of the brainstorm to inform the decision? Imagine that it has come down from senior management that your company must have a mobile app. Should you immediately launch a capital expenditure project with a whole bunch of features and see if anyone downloads it? Could you instead use a credit card to buy some Google Adwords and track clicks to see if anyone seems interested in the app? This idea, popularised in a book called by Eric Ries, is called a . It allows you quickly and cheaply figure out if your idea is worth pursuing. The Lean Startup Minimum Viable Product Try to find the smallest possible version of the thing you’re looking to build that will give you an indication of how successful it might be. It’s often said that if you’re not embarrassed by your first version then it’s not minimal enough. For example, Bill Gross from wanted to know if people would buy a car online — before he invested time in the logistics to fulfil the order. Idealab he built a simple webpage and sold a car online If you have a more established product and are trying to decide how to proceed, you might find useful. A/B Testing A/B Testing is performed by implementing two (or more) ideas, grouping your audience and showing each group one of the ideas. By tracking a certain metric, e.g. conversion rate or engagement rate, you can absolutely determine which of the versions performs best. For example, Airbnb wanted to know if professional photography on each of their listings would mean more bookings. . Once they could say for certain that better pictures resulted in more bookings, it made sense for them to send a photographer to each new location. They added professional photographs to a small sample of their listings and compared the booking rate to those without Of course, these aren’t the only techniques for turning a subjective conversation into an objective comparison but they’re my favourites. There are lots of resources online to help you implement them based on your situation. I challenge you to try a different approach next time you’re discussing some ideas. Try to remove your personal bias from the discussion. See if you can demonstrate disproportionate return for one of the ideas and suddenly everyone’s ego melts away. No one will stand in the way of idea once it’s demonstrably the best. If you liked this article please click the heart button below to share — it would mean a lot to me.

Stop defending your ideas, you’re ruining them

By Tyler Young, CISO at BigID The countdown to the Paris 2024 Olympics is on, and it’s crucial to defend the Olympic stage against cyber threats. Cyberattacks targeting the Olympics are not new, but their frequency and sophistication have increased over the years. For example, the 2018 Winter Olympics in Pyeongchang, South Korea, experienced a cyberattack resulting in a Wi-Fi outage malfunctioning internet protocol TVs, which resulted in the shutting down of the Winter Olympics website. This disruption prevented attendees from printing reserved tickets and attending the ceremony. Since 2018, these attack efforts have only grown. In fact, according to NTT, the total number of security events blocked during the Tokyo 2020 Games, including unauthorized communications to the official website, was 450 million. So, today, a strong plan is needed to ensure safety against the intersecting threats of advanced AI and increased cybersecurity risks. Anticipating Increased Attacks and Disinformation Campaigns at the Paris 2024 Olympics The cybercrime economy continues to grow and was reported to be the third largest economy in the world, behind only the U.S. and China. Additionally, large events like the Olympics have always been prime targets for cybersecurity attacks due to their large audience, complex infrastructure, and data-rich environment. We should expect ransomware gangs to continue to target organizations by exploiting rudimentary tactics (like phishing and unpatched systems). Franz Regul, CISO at the Paris 2024 Olympics, recently said he expects this year’s Summer Games in Paris to have eight to 12 times more security events than 2020. Since February of this year, security incidents have already disrupted the preparations for the Games. French media have reported on multiple separate incidents, including the theft of laptops that allegedly contained information about security matters related to the Olympics. Additionally, Russian propagandists created a disinformation campaign with AI deepfakes to flood social media with short videos raising alarms about possible terrorist attacks and stoking fears about safety. Embracing AI to Enhance Performance, Fairness, and Security AI has made it easier for people with limited hacking abilities to carry out cyber attacks, but industry experts know that AI can also be a valuable tool in defending against these attacks as well. The International Olympic Committee should take a cue from businesses and leverage AI to protect against cyber threats. According to “The 2024 Global Report on Generative AI: Breakthroughs & Barriers”, the security risk of data breaches or ransomware attacks is the top influence when adopting AI. If Olympic committees turn to AI, it's crucial for them to maintain control over the kind of data that these AI systems are trained on. As the age-old saying goes, “You can't protect what you don't know.” AI comes with its own set of risks and concerns, including sensitive data exposure. When language models are trained using data that contains sensitive or regulated information, it can result in unauthorized exposure, access, and breaches. It's essential to have robust data governance and controls in place to prevent such incidents. Enhancing Cybersecurity Measures Ahead of The Games The Olympic Committee needs to adhere to industry standards to maintain a strong data security posture. Proactively detecting and addressing data security vulnerabilities is essential. BigID’s 2024 State of Data Security Report highlights that 63% of CISOs prioritize proactive risk detection and remediation for data security, as only scanning data isn't sufficient. Deploying advanced cybersecurity measures in any business, much less the Olympics, requires a delicate balance. It's imperative that the Olympic Committee and host countries operate efficiently with zero disruptions. In order to effectively accomplish this, they need to adopt Secure by Default principles and be innovative with their solutions. Taking into consideration existing business processes and wrapping security technologies around them is extremely important. Secure by Default takes critical processes, systems, and solutions and bakes security measures natively into the operations. Another critical component of this evolving strategy is employee education and awareness. The human element often plays a significant role in data security. By ensuring that all employees, especially those interacting with AI systems, are well-versed in best practices for data management and aware of the potential risks, companies can create an additional layer of defense against data breaches. Training programs should be regularly updated to reflect new developments in AI technology and emerging security threats. Lastly, security leaders can leverage threat intelligence data—regardless of the industry—to deeply understand upcoming geopolitics and cyber-related chatter and how this may impact them. Cybercriminals and nation-state attackers begin to make moves by spinning up infrastructure, registering domains, and implementing government plans such as the five-year plans prior to launching an attack. All of this can be correlated and detected by leveraging the right amount of threat research and data. Ensuring Integrity and Safety at the Olympics Through Robust Cybersecurity By prioritizing these measures, the Olympic Committee aims to ensure a secure and forward-thinking Olympic experience. In light of AI's increasing influence, the Olympic Committee will likely allocate equal or greater resources for the 2024 Games to prevent attacks and enhance cybersecurity measures. But it’s necessary. This commitment not only upholds the Games' integrity but also safeguards participants, spectators, and global stakeholders from potential cyber threats, thereby creating a safe and innovative environment for all. While the laundry list of priorities for security leaders to keep their organizations safe varies and changes from organization to organization, it is crucial to foster open dialogue, innovation, and policy development. By embracing AI while staying informed and implementing robust security practices, security practitioners can harness its power and safeguard against emerging threats. By Tyler Young, CISO at BigID By Tyler Young, CISO at BigID The countdown to the Paris 2024 Olympics is on, and it’s crucial to defend the Olympic stage against cyber threats. Cyberattacks targeting the Olympics are not new, but their frequency and sophistication have increased over the years. For example, the 2018 Winter Olympics in Pyeongchang , South Korea, experienced a cyberattack resulting in a Wi-Fi outage malfunctioning internet protocol TVs, which resulted in the shutting down of the Winter Olympics website. Pyeongchang Pyeongchang cyberattack cyberattack This disruption prevented attendees from printing reserved tickets and attending the ceremony. Since 2018, these attack efforts have only grown. In fact, according to NTT , the total number of security events blocked during the Tokyo 2020 Games, including unauthorized communications to the official website, was 450 million. NTT NTT So, today, a strong plan is needed to ensure safety against the intersecting threats of advanced AI and increased cybersecurity risks. Anticipating Increased Attacks and Disinformation Campaigns at the Paris 2024 Olympics Anticipating Increased Attacks and Disinformation Campaigns at the Paris 2024 Olympics The cybercrime economy continues to grow and was reported to be the third largest economy in the world, behind only the U.S. and China. Additionally, large events like the Olympics have always been prime targets for cybersecurity attacks due to their large audience, complex infrastructure, and data-rich environment. We should expect ransomware gangs to continue to target organizations by exploiting rudimentary tactics (like phishing and unpatched systems). Franz Regul, CISO at the Paris 2024 Olympics, recently said he expects this year’s Summer Games in Paris to have eight to 12 times more security events than 2020. eight to 12 times eight to 12 times Since February of this year, security incidents have already disrupted the preparations for the Games. French media have reported on multiple separate incidents, including the theft of laptops that allegedly contained information about security matters related to the Olympics. security incidents security incidents Additionally, Russian propagandists created a disinformation campaign with AI deepfakes to flood social media with short videos raising alarms about possible terrorist attacks and stoking fears about safety. AI deepfakes AI deepfakes Embracing AI to Enhance Performance, Fairness, and Security Embracing AI to Enhance Performance, Fairness, and Security AI has made it easier for people with limited hacking abilities to carry out cyber attacks, but industry experts know that AI can also be a valuable tool in defending against these attacks as well. The International Olympic Committee should take a cue from businesses and leverage AI to protect against cyber threats. According to “ The 2024 Global Report on Generative AI: Breakthroughs & Barriers ”, the security risk of data breaches or ransomware attacks is the top influence when adopting AI. The 2024 Global Report on Generative AI: Breakthroughs & Barriers The 2024 Global Report on Generative AI: Breakthroughs & Barriers If Olympic committees turn to AI, it's crucial for them to maintain control over the kind of data that these AI systems are trained on. As the age-old saying goes, “You can't protect what you don't know.” AI comes with its own set of risks and concerns, including sensitive data exposure. When language models are trained using data that contains sensitive or regulated information, it can result in unauthorized exposure, access, and breaches. It's essential to have robust data governance and controls in place to prevent such incidents. Enhancing Cybersecurity Measures Ahead of The Games Enhancing Cybersecurity Measures Ahead of The Games The Olympic Committee needs to adhere to industry standards to maintain a strong data security posture. Proactively detecting and addressing data security vulnerabilities is essential. BigID’s 2024 State of Data Security Report highlights that 63% of CISOs prioritize proactive risk detection and remediation for data security, as only scanning data isn't sufficient. 2024 State of Data Security Report 2024 State of Data Security Report Deploying advanced cybersecurity measures in any business, much less the Olympics, requires a delicate balance. It's imperative that the Olympic Committee and host countries operate efficiently with zero disruptions. In order to effectively accomplish this, they need to adopt Secure by Default principles and be innovative with their solutions. Taking into consideration existing business processes and wrapping security technologies around them is extremely important. Secure by Default takes critical processes, systems, and solutions and bakes security measures natively into the operations. Another critical component of this evolving strategy is employee education and awareness. The human element often plays a significant role in data security. By ensuring that all employees, especially those interacting with AI systems, are well-versed in best practices for data management and aware of the potential risks, companies can create an additional layer of defense against data breaches. Training programs should be regularly updated to reflect new developments in AI technology and emerging security threats. Lastly, security leaders can leverage threat intelligence data—regardless of the industry—to deeply understand upcoming geopolitics and cyber-related chatter and how this may impact them. Cybercriminals and nation-state attackers begin to make moves by spinning up infrastructure, registering domains, and implementing government plans such as the five-year plans prior to launching an attack. All of this can be correlated and detected by leveraging the right amount of threat research and data. Ensuring Integrity and Safety at the Olympics Through Robust Cybersecurity Ensuring Integrity and Safety at the Olympics Through Robust Cybersecurity By prioritizing these measures, the Olympic Committee aims to ensure a secure and forward-thinking Olympic experience. In light of AI's increasing influence, the Olympic Committee will likely allocate equal or greater resources for the 2024 Games to prevent attacks and enhance cybersecurity measures. But it’s necessary. This commitment not only upholds the Games' integrity but also safeguards participants, spectators, and global stakeholders from potential cyber threats, thereby creating a safe and innovative environment for all. While the laundry list of priorities for security leaders to keep their organizations safe varies and changes from organization to organization, it is crucial to foster open dialogue, innovation, and policy development. By embracing AI while staying informed and implementing robust security practices, security practitioners can harness its power and safeguard against emerging threats.

Securing the Paris Olympics: Balancing AI Innovations & Heightened Cyber Threats

Score Big With Football Analytics: Design Your Country's Perfect National Team with Machine Learning

Defusing Emotionally Charged Conversations: 4 Steps to Success

Cybersecurity and AI: Meetings and Insights from the Nexus 2050 Conference

Cryptographic Ransomware Encryption Detection: Survey: Abstract and Introduction

We’re living in a pandemic of data breaches. More than 17 billion personal records were exposed last year, and 2024 has begun with a string of several high-profile back-to-back breaches in the first quarter, including data exposure of millions of AT&T account holders. Big Tech companies are in the crosshairs, too, facing mounting criticism from government officials calling for urgent reform. Even the open-source software supply chain is under threat from social engineering campaigns looking to compromise maintainer projects. ‘Social engineering’ is the key term here because it’s not software vulnerabilities that enterprises should be worried about. Those only make up 5% of breaches, while 68% involve the human element. How can this be? And what should companies do about it? The doors we open for hackers – and how to close them Exotic and sophisticated zero-day attacks and vulnerability exploits may garner the bulk of attention from the press, CISOs, and security teams, but the reality is that today’s cybersecurity tools are becoming exceedingly efficient at preventing and remediating these attacks. Hackers know this. They’re not going after software vulnerabilities. They’re attacking identity because it’s far cheaper and easier to exploit or force human error. So, they target credentials such as passwords, browser cookies, and private API keys. The data says it all, really: a Verizon report proves these credentials show up in 86% of security breaches related to web-based applications and platforms. Obtaining these credentials is how attackers do the most damage with minimal ease. Sometimes, these credentials are shared a little too freely. Other times, a shocking amount goes unused. The point is that organizations have lost control of their credentials, and the result is a growing fragmentation of identities across increasingly complex technology stacks. Those stacks are filled with layers that manage security in different ways, from Kubernetes clusters to Linux servers, copious amounts of specialized databases, IoT, cloud APIs, etc. It gets even more convoluted on a granular level once you’re inside a cloud account. If you have three Windows servers and seven Linux servers, each of those also governs its own login credentials. If you’ve got a multi-cloud setup with both AWS and Azure, those companies also track identity in different ways. In the quest for greater efficiency, DevOps engineers are even splitting cloud-native applications into smaller micro-services, each needing its own identity. Each of these layers opens yet another door for attackers to enter. If you’re an enterprise operating with more DevOps and cloud infrastructure, you’re inevitably going to add even more layers to the stack. More layers mean more doors. In other words, the mere presence of secrets, such as private keys, API keys, passwords, or even browser cookies, should be seen as a vulnerability waiting to be exploited in an identity attack. Stop using secrets for access purposes The problem isn’t the technology itself, though, but human behavior. Any time you create more doors, you’re increasing the probability of human error. So, how do you fix these data breaches? The first step is to consolidate all identities. All identities - including people and machines like servers, laptops, bots, databases, microservices, etc. – must be united into an inventory that provides a single source of truth. The second step is to make these identities impossible to impersonate or “steal”, effectively making the infrastructure security immune to human mistakes. To do this, minimize or eliminate the reliance on secrets for authentication purposes. As a rule, your identity should also never ever be presented as information. The only way to prevent data theft on a catastrophic scale is to remove all static credentials and standing privileges and instead deploy strong authentication with cryptographic identity. In practice, this means basing identity on three-point criteria that include 1) a user’s specific device, 2) a biometric marker, and 3) a personal identification number (PIN). In theory, this is exactly how the iPhone works: the biometric marker is facial recognition, the personal identification number is your PIN code, and the Trusted Platform Module (TPM) chip inside the phone is what governs the ‘machine identity.’ But credentials – or doors, if you will – are just half the story. Observability isn’t enough The thing about human error is that it’s blind to the quality of your cybersecurity and observability tools. It only takes one human to make a mistake by granting access to the wrong people. This already happens. As we learned earlier this year, Google Kubernetes Engine admins are not immune to misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them. The cybersecurity industry has spent a disproportionate amount of time and money on observability. Companies are acquiring and maintaining tools to respond to threats rather than fix enforcement to proactively protect infrastructure. One reason companies tend to be put off by fixing enforcement is the aforementioned complexity of modern technology stacks. The natural assumption is you need competent teams who can configure every single layer with its own authentication, its own authorization, its own encryption, and its own audit. The smarter solution here would be for the cybersecurity industry to embrace a new paradigm for modernizing secure access to infrastructure. This paradigm has to be built on embracing mechanisms that unify all access within a single control point for authentication and authorization. Most enterprises sorely need (and yet lack) this mechanism as a front-end to all of their disparate infrastructure. Access should only ever be granted based on tasks, and only the minimum required privileges should ever be granted. These should then be de-provisioned immediately afterward. This concept of on-demand least-privileged access then needs to be applied to both human and non-human machine and service accounts. In other words, every company should be able to easily enforce the policy that developers should never have access to production data. However, without unified access controls, this will remain a sci-fi concept for many cybersecurity professionals. Unifying access controls isn’t just helpful in the proactive sense. If a data breach does eventually occur, a centralized view of all the access relationships attributed to a user or resource is essential for purposes like quickly revoking unwanted access or auditing. This is how enforcement and observability can be combined for agility. And if you’ve already assigned cryptographic identity beforehand to each individual user or resource, you’ve now associated the actual human user with each action. This means assigning the right permissions to the right people becomes a much easier task. Defend against human behavior There are, of course, positive signs of technology leaders in the industry taking data breaches very seriously. Microsoft has pledged to shore cloud vulnerabilities, prevent credentials from being stolen, and automatically enforce multi-factor authentication for employees. Any efforts to embrace stronger authentication and  cryptographic measures should be commended. If cybersecurity is going to ‘win,’ though, enterprises have to understand that stopping data breaches isn’t about defending against viruses or ultra-sophisticated hacking techniques. It’s about defending against human behavior that exposes infrastructure to data leaks. That’s the mindset that needs to change. Unified access control, paired with zero trust, must be the foundation for modernizing secure access. We’re living in a pandemic of data breaches. More than 17 billion personal records were exposed last year , and 2024 has begun with a string of several high-profile back-to-back breaches in the first quarter, including data exposure of millions of AT&T account holders. 17 billion personal records were exposed last year Big Tech companies are in the crosshairs , too, facing mounting criticism from government officials calling for urgent reform. Even the open-source software supply chain is under threat from social engineering campaigns looking to compromise maintainer projects. Big Tech companies are in the crosshairs Even the open-source software supply chain is under threat ‘Social engineering’ is the key term here because it’s not software vulnerabilities that enterprises should be worried about. Those only make up 5% of breaches , while 68% involve the human element. How can this be? And what should companies do about it? make up 5% of breaches The doors we open for hackers – and how to close them The doors we open for hackers – and how to close them Exotic and sophisticated zero-day attacks and vulnerability exploits may garner the bulk of attention from the press, CISOs, and security teams, but the reality is that today’s cybersecurity tools are becoming exceedingly efficient at preventing and remediating these attacks. Hackers know this. They’re not going after software vulnerabilities. They’re attacking identity because it’s far cheaper and easier to exploit or force human error. So, they target credentials such as passwords, browser cookies, and private API keys. The data says it all, really: a Verizon report proves these credentials show up in 86% of security breaches related to web-based applications and platforms. 86% of security breaches Obtaining these credentials is how attackers do the most damage with minimal ease. Sometimes, these credentials are shared a little too freely. Other times, a shocking amount goes unused . The point is that organizations have lost control of their credentials, and the result is a growing fragmentation of identities across increasingly complex technology stacks. Those stacks are filled with layers that manage security in different ways, from Kubernetes clusters to Linux servers, copious amounts of specialized databases, IoT, cloud APIs, etc. a shocking amount goes unused It gets even more convoluted on a granular level once you’re inside a cloud account. If you have three Windows servers and seven Linux servers, each of those also governs its own login credentials. If you’ve got a multi-cloud setup with both AWS and Azure, those companies also track identity in different ways. In the quest for greater efficiency, DevOps engineers are even splitting cloud-native applications into smaller micro-services, each needing its own identity. Each of these layers opens yet another door for attackers to enter. If you’re an enterprise operating with more DevOps and cloud infrastructure, you’re inevitably going to add even more layers to the stack. More layers mean more doors. In other words, the mere presence of secrets, such as private keys, API keys, passwords, or even browser cookies, should be seen as a vulnerability waiting to be exploited in an identity attack. Stop using secrets for access purposes Stop using secrets for access purposes The problem isn’t the technology itself, though, but human behavior. Any time you create more doors, you’re increasing the probability of human error. So, how do you fix these data breaches? The first step is to consolidate all identities. All identities - including people and machines like servers, laptops, bots, databases, microservices, etc. – must be united into an inventory that provides a single source of truth. The second step is to make these identities impossible to impersonate or “steal”, effectively making the infrastructure security immune to human mistakes. To do this, minimize or eliminate the reliance on secrets for authentication purposes. As a rule, your identity should also never ever be presented as information. The only way to prevent data theft on a catastrophic scale is to remove all static credentials and standing privileges and instead deploy strong authentication with cryptographic identity. In practice, this means basing identity on three-point criteria that include 1) a user’s specific device, 2) a biometric marker, and 3) a personal identification number (PIN). In theory, this is exactly how the iPhone works: the biometric marker is facial recognition, the personal identification number is your PIN code, and the Trusted Platform Module (TPM) chip inside the phone is what governs the ‘machine identity.’ But credentials – or doors, if you will – are just half the story. Observability isn’t enough Observability isn’t enough The thing about human error is that it’s blind to the quality of your cybersecurity and observability tools. It only takes one human to make a mistake by granting access to the wrong people. This already happens. As we learned earlier this year, Google Kubernetes Engine admins are not immune to misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them . misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them The cybersecurity industry has spent a disproportionate amount of time and money on observability. Companies are acquiring and maintaining tools to respond to threats rather than fix enforcement to proactively protect infrastructure. One reason companies tend to be put off by fixing enforcement is the aforementioned complexity of modern technology stacks. The natural assumption is you need competent teams who can configure every single layer with its own authentication, its own authorization, its own encryption, and its own audit. The smarter solution here would be for the cybersecurity industry to embrace a new paradigm for modernizing secure access to infrastructure. This paradigm has to be built on embracing mechanisms that unify all access within a single control point for authentication and authorization. Most enterprises sorely need (and yet lack) this mechanism as a front-end to all of their disparate infrastructure. Access should only ever be granted based on tasks, and only the minimum required privileges should ever be granted. These should then be de-provisioned immediately afterward. This concept of on-demand least-privileged access then needs to be applied to both human and non-human machine and service accounts. In other words, every company should be able to easily enforce the policy that developers should never have access to production data. However, without unified access controls, this will remain a sci-fi concept for many cybersecurity professionals. Unifying access controls isn’t just helpful in the proactive sense. If a data breach does eventually occur, a centralized view of all the access relationships attributed to a user or resource is essential for purposes like quickly revoking unwanted access or auditing. This is how enforcement and observability can be combined for agility. And if you’ve already assigned cryptographic identity beforehand to each individual user or resource, you’ve now associated the actual human user with each action. This means assigning the right permissions to the right people becomes a much easier task. Defend against human behavior Defend against human behavior There are, of course, positive signs of technology leaders in the industry taking data breaches very seriously. Microsoft has pledged to shore cloud vulnerabilities, prevent credentials from being stolen, and automatically enforce multi-factor authentication for employees. Any efforts to embrace stronger authentication and  cryptographic measures should be commended. If cybersecurity is going to ‘win,’ though, enterprises have to understand that stopping data breaches isn’t about defending against viruses or ultra-sophisticated hacking techniques. It’s about defending against human behavior that exposes infrastructure to data leaks. That’s the mindset that needs to change. Unified access control, paired with zero trust, must be the foundation for modernizing secure access.

Social Engineering is the Biggest Cyber Threat

U.S. Digital Policy and Cyberspace Blueprint for Global Progress

Organizations will likely experience at least one cyberattack in their lifespan, regardless of their size or industry. Cyber risk quantification has emerged as a way to accurately identify threats, reducing the chances of attack success. Here’s what it is and why businesses should choose it over risk assessments. The Definition of Cyber Risk Quantification Cyber risk quantification is the process of using quantitative measurements to calculate an organization's vulnerability to cyber threats. Multiple frameworks exist, each aiming to align business objectives with cybersecurity strategies. The most basic way information technology (IT) professionals can find risk is by multiplying the percentage chance a cybersecurity incident will occur by its potential financial impact. The risk quantification approach takes things a step further by applying specialized frameworks. Examples of Cyber Risk Quantification Frameworks These cyber risk quantification frameworks are some of the most common. NIST SP 800-53 NIST SP 800-53 is a catalog of security and privacy controls released by the United States National Institute of Standards and Technology (NIST). It measures cyber threats by severity to help companies prioritize them and protect information systems. ISO 27005 ISO 27005, published by the International Organization for Standardization (ISO), is a guide for performing information security risk assessments. It applies to companies of all sizes and has been reissued multiple times, so it is a common cyber risk quantification framework. The FAIR Model The nonprofit FAIR Institute published the Factor Analysis of Information Risk (FAIR) model. This probability-based model uses a mathematical algorithm to measure risk monetarily and quantitatively. While it’s practical, it requires a tremendous amount of information. How It Differs From Standard Risk Assessments A standard risk assessment categorizes systems, data, or networks as low, medium, or high risk. This process can be content-, context- or user-based, meaning an IT decision-maker assigns labels based on what something contains, the circumstances in which it’s used or how they feel about it. It often leans toward qualitative or dynamic findings. While standard risk assessments are effective, they aren’t always enough. How do IT teams prioritize security controls when multiple assets are medium risk? What happens when higher-ups arbitrarily decide a low-risk system takes priority over a high-risk one? Sometimes, objective, quantitative measurements are crucial. Cyber risk quantification uses mathematical formulas, logical flow charts, or quantitative metrics to calculate risk, differentiating it from the standard approach. It identifies the likelihood of cyberattacks and how much an organization can lose if affected by one, making its findings more rational and data-driven. Why Choose It Over Plain Risk Assessments? Decision-makers should consider cyber risk quantification over similar alternatives because cyberattacks are increasing in frequency and severity — they can’t afford inaccurate assessments. While cybercriminals' techniques already grow increasingly sophisticated daily, recent advances in automation technology have accelerated their progress dramatically. Soon, cyberattacks may become too costly for firms to handle, forcing them to close or make budget cuts. Experts predict cybercrime-related losses will hit $13.82 trillion by 2028, up from $8.15 trillion in 2023 — a 69.94% increase in under a decade. Upper management will likely expect more from cybersecurity teams as the stakes rise. Increased spending is another cause for heightened scrutiny. About69% of IT leaders expect their cybersecurity budgets to grow 10%-100% by the end of 2024. Therefore, it’s safe to assume most teams will face pressure from higher-ups who want to see a correlation between budget expansions and diminishing cyber risk. The Benefits of Cyber Risk Quantification The most significant benefit of cyber risk quantification is improved threat prioritization. IT teams with an objective, data-driven overview based on probability know precisely what assets to prioritize and where to direct resources. Moreover, they gain a business-specific understanding of which cyber threats are relevant. Consequently, decision-makers have an easier time allocating resources and determining IT budgets. This way, teams don’t have to worry about pinching pennies defending high-risk systems. Eventually, this may lead to a surplus, enabling professionals to repurpose unused funds for more important duties. Objective, data-driven information is easily understandable — even to those without IT backgrounds. Team leaders can use cyber risk quantification to enhance communication between them and executives, making it easier to secure board buy-in on issues like funding, threat prioritization, and incident response decisions. How to Get Started With Cyber Risk Quantification Implementing cyber risk quantification for an organization is a multi-step process. 1. Inventory Physical and Information Assets An inventory of physical and information assets helps decision-makers determine what to include in their risk quantification. For example, while public data stores may not be considered because they’re easily recoverable, customer relationship management software would be since it houses a tremendous amount of proprietary and personally identifiable information. 2. Collect Data on Systems and Cyberthreats Companies can only calculate risk if they have enough information to enter into a simulation, algorithm, or mathematical equation. Therefore, data collection, preprocessing, and aggregation are essential to success. IT professionals should ask how cyberattack frequency, attack surfaces, and cybercrime trends could affect their assets. 3. Quantify Risk Internally and Externally Accuracy increases as specificity does. Unless businesses are small, conducting multiple cyber risk quantification processes is in their best interest. Considering over 98% of companies work with a third-party vendor that’s recently suffered a data breach, separating cyberthreats by whether they originate internally or externally is a great starting point. 4. Present the Findings to Management Once IT professionals use cyber risk quantification to turn raw data into easily understandable, jargon-free text, charts, or infographics, they should present their findings. Whether their goal is to secure more funding, convey the importance of cyber threats, or argue for risk reprioritization, this step establishes a meaningful, impactful connection between them and executives. 5. Reassess the Organization’s Risk Regularly The threat landscape constantly evolves, so a single risk quantification won’t stay current for long. IT teams should conduct a new one periodically to ensure their defenses continue to be effective and their insights remain relevant. Make the Most of Cyber Risk Quantification As cyberattacks and data breaches become increasingly severe and frequent, the pressure on cybersecurity and IT professionals to identify and defend against cyber threats rapidly increases. Cyber risk quantification is an effective, accurate method to help alleviate some of that strain and help teams defend against the ever-evolving threat landscape. Organizations will likely experience at least one cyberattack in their lifespan, regardless of their size or industry. Cyber risk quantification has emerged as a way to accurately identify threats, reducing the chances of attack success. Here’s what it is and why businesses should choose it over risk assessments. Organizations will likely experience at least one cyberattack in their lifespan, regardless of their size or industry. Cyber risk quantification has emerged as a way to accurately identify threats, reducing the chances of attack success. Here’s what it is and why businesses should choose it over risk assessments. The Definition of Cyber Risk Quantification The Definition of Cyber Risk Quantification Cyber risk quantification is the process of using quantitative measurements to calculate an organization's vulnerability to cyber threats. Multiple frameworks exist, each aiming to align business objectives with cybersecurity strategies. The most basic way information technology (IT) professionals can find risk is by multiplying the percentage chance a cybersecurity incident will occur by its potential financial impact. The risk quantification approach takes things a step further by applying specialized frameworks. professionals can find risk professionals can find risk Examples of Cyber Risk Quantification Frameworks These cyber risk quantification frameworks are some of the most common. NIST SP 800-53 NIST SP 800-53 is a catalog of security and privacy controls released by the United States National Institute of Standards and Technology (NIST). It measures cyber threats by severity to help companies prioritize them and protect information systems. catalog of security and privacy controls catalog of security and privacy controls ISO 27005 ISO 27005, published by the International Organization for Standardization (ISO), is a guide for performing information security risk assessments. It applies to companies of all sizes and has been reissued multiple times, so it is a common cyber risk quantification framework. The FAIR Model The nonprofit FAIR Institute published the Factor Analysis of Information Risk (FAIR) model. This probability-based model uses a mathematical algorithm to measure risk monetarily and quantitatively. While it’s practical, it requires a tremendous amount of information. uses a mathematical algorithm uses a mathematical algorithm How It Differs From Standard Risk Assessments A standard risk assessment categorizes systems, data, or networks as low, medium, or high risk. This process can be content-, context- or user-based, meaning an IT decision-maker assigns labels based on what something contains, the circumstances in which it’s used or how they feel about it. It often leans toward qualitative or dynamic findings. While standard risk assessments are effective, they aren’t always enough. How do IT teams prioritize security controls when multiple assets are medium risk? What happens when higher-ups arbitrarily decide a low-risk system takes priority over a high-risk one? Sometimes, objective, quantitative measurements are crucial. Cyber risk quantification uses mathematical formulas, logical flow charts, or quantitative metrics to calculate risk, differentiating it from the standard approach. It identifies the likelihood of cyberattacks and how much an organization can lose if affected by one, making its findings more rational and data-driven. Why Choose It Over Plain Risk Assessments? Decision-makers should consider cyber risk quantification over similar alternatives because cyberattacks are increasing in frequency and severity — they can’t afford inaccurate assessments. While cybercriminals' techniques already grow increasingly sophisticated daily , recent advances in automation technology have accelerated their progress dramatically. grow increasingly sophisticated daily grow increasingly sophisticated daily Soon, cyberattacks may become too costly for firms to handle, forcing them to close or make budget cuts. Experts predict cybercrime-related losses will hit $13.82 trillion by 2028, up from $8.15 trillion in 2023 — a 69.94% increase in under a decade. Upper management will likely expect more from cybersecurity teams as the stakes rise. losses will hit $13.82 trillion losses will hit $13.82 trillion Increased spending is another cause for heightened scrutiny. About 69% of IT leaders expect their cybersecurity budgets to grow 10%-100% by the end of 2024. Therefore, it’s safe to assume most teams will face pressure from higher-ups who want to see a correlation between budget expansions and diminishing cyber risk. 69% of IT leaders 69% of IT leaders The Benefits of Cyber Risk Quantification The most significant benefit of cyber risk quantification is improved threat prioritization. IT teams with an objective, data-driven overview based on probability know precisely what assets to prioritize and where to direct resources. Moreover, they gain a business-specific understanding of which cyber threats are relevant. Consequently, decision-makers have an easier time allocating resources and determining IT budgets. This way, teams don’t have to worry about pinching pennies defending high-risk systems. Eventually, this may lead to a surplus, enabling professionals to repurpose unused funds for more important duties. Objective, data-driven information is easily understandable — even to those without IT backgrounds. Team leaders can use cyber risk quantification to enhance communication between them and executives, making it easier to secure board buy-in on issues like funding, threat prioritization, and incident response decisions. How to Get Started With Cyber Risk Quantification Implementing cyber risk quantification for an organization is a multi-step process. 1. Inventory Physical and Information Assets An inventory of physical and information assets helps decision-makers determine what to include in their risk quantification. For example, while public data stores may not be considered because they’re easily recoverable, customer relationship management software would be since it houses a tremendous amount of proprietary and personally identifiable information. 2. Collect Data on Systems and Cyberthreats Companies can only calculate risk if they have enough information to enter into a simulation, algorithm, or mathematical equation. Therefore, data collection, preprocessing, and aggregation are essential to success. IT professionals should ask how cyberattack frequency, attack surfaces, and cybercrime trends could affect their assets. 3. Quantify Risk Internally and Externally Accuracy increases as specificity does. Unless businesses are small, conducting multiple cyber risk quantification processes is in their best interest. Considering over 98% of companies work with a third-party vendor that’s recently suffered a data breach, separating cyberthreats by whether they originate internally or externally is a great starting point. over 98% of companies over 98% of companies 4. Present the Findings to Management Once IT professionals use cyber risk quantification to turn raw data into easily understandable, jargon-free text, charts, or infographics, they should present their findings. Whether their goal is to secure more funding, convey the importance of cyber threats, or argue for risk reprioritization, this step establishes a meaningful, impactful connection between them and executives. 5. Reassess the Organization’s Risk Regularly The threat landscape constantly evolves, so a single risk quantification won’t stay current for long. IT teams should conduct a new one periodically to ensure their defenses continue to be effective and their insights remain relevant. Make the Most of Cyber Risk Quantification As cyberattacks and data breaches become increasingly severe and frequent, the pressure on cybersecurity and IT professionals to identify and defend against cyber threats rapidly increases. Cyber risk quantification is an effective, accurate method to help alleviate some of that strain and help teams defend against the ever-evolving threat landscape.

What Is Cyber Risk Quantification?

Stories, News & Mentions about DEFENDIFY

Defendify’s Stories on HackerNoon