Get the most recent info and news about Verizon Communications on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Verizon Communications Inc., through its subsidiaries, offers communications, technology, information, and entertainment products and services to consumers, businesses, and governmental entities worldwide. Its Consumer segment provides postpaid and prepaid service plans; internet access on notebook computers and tablets; wireless equipment, including smartphones and other handsets; and wireless-enabled internet devices, such as tablets, and other wireless-enabled connected devices comprising smart watches. It also provides residential fixed connectivity solutions, such as internet, video, and voice services; and sells network access to mobile virtual network operators. As of December 31, 2021, it had approximately 115 million wireless retail connections, 7 million wireline broadband connections, and 4 million Fios video connections. The company's Business segment provides network connectivity products, including private networking, private cloud connectivity, virtual and software defined networking, and internet access services; and internet protocol-based voice and video services, unified communications and collaboration tools, and customer contact center solutions. This segment also offers a suite of management and data security services; domestic and global voice and data solutions, such as voice calling, messaging services, conferencing, contact center solutions, and private line and data access networks; customer premises equipment; installation, maintenance, and site services; and Internet of Things products and services. As of December 31, 2021, it had approximately 27 million wireless retail postpaid connections and 477 thousand wireline broadband connections. The company was formerly known as Bell Atlantic Corporation and changed its name to Verizon Communications Inc. in June 2000. Verizon Communications Inc. was incorporated in 1983 and is headquartered in New York, New York.

Verizon Communications

verizon

MOVEit drove a big chunk of the increase, but social engineering and failure to patch led to a doubling of data breaches since 2023, said <strong>Verizon</strong> Business.

Verizon DBIR: Basic Security Gaffes Cause Breach Surge

. This brings insight from the company’s large cyber-security incident investigation operation to enterprises. Verizon announced a new threat intelligence platform This means that cyber-security threat intelligence that’s derived from Verizon’s network is being available through integration with Anomali Threat Platform. Because of Verizon’s new announcement, we can see that they are attempting to add threat intelligence within their overall infrastructure. The intelligence that Verizon provides benefits from it’s Verizon Risk Report (VRR) and Data Breach Investigations Report (DBIR). Both can be used to provide more insight into finding cyber risks. “We’re in a special place within the security context because we are placed between victims and the cyber criminals that attack them”, Bryan Sartin, the executive director of Verizon’s Global Security Services told eWEEK, “This places us in a position of using certain optics, and is a by-product of the optics and creating intelligence that can make a difference for detection, and in response to severe cyber attacks that are in motion”. Verizon is now making plans to take cyber attack history and intelligence and makes it available to help identify recent and previous threats, according to Bryan. For instance, he said that a company could search and check to see if there is an IP address that’s been seen before an associated risk level and an attack. Types of Threat Intelligence With Verizon’s new development of threat intelligence, it leaves the open question “What types of threat intelligence platforms are out there?”. Knowing each form of threat intelligence platform will help you create a system to help your IT team. Threat Intelligence Platforms Threat intelligence platforms are used to organize feeds of data (up to the thousands) into single containers. The platforms allow you to configure alerts on your data from feeds and helps by making it consumable by removing extra entries and enabling you to prioritize these data sources. The advantage of using a is that you can configure alerts on data from feeds and makes it more consumable by removing additional entries and allows you to prioritize the sources of data. threat intelligence platform The biggest advantage of this platform has over threat feeds is its integration with incident response platforms or SIEMs. And you can bring in any form of threat data that you have access to in a central view. On the other hand, your IT team still has to configure every feed, and there isn’t a real analysis of the data until it reaches a person. Ultimately, your threat intelligence platform will only be as good as the data you place into it. Without having real context around indicators, security teams will have issues trying to investigate every issue available, realize it’s not possible, and risk not being able to respond to issues altogether. Threat Data Feed Providers These data feeds are a main point for making threat intelligence programs. This is because it gives users potential threat indicators such as file hashes, IP addresses, and domains. The issue is that while the data can arrive quickly, there is no context to those indicators. On its own, the data is unable to answer important questions such as: Are there any indicators that are connected to the attack? Are they related to a malware program? What role do they play in creating a dangerous infrastructure? Human Intelligence Service and Providers This service has their roots in a system called HUMIT (military tradition of human intelligence). At first, HUMIT was used by humans to help assist other humans, but this process evolved to humans analyzing and collecting data from machine and human sources to show information on ongoing and emerging threats — in this scenario, cyber threats. For instance, human analysts can work from a single incident to create a picture of procedures, techniques, and tactics that help make an intelligence report that can be useful for other industries that are affected. Usually, these reports display the information in full detail. The results of the report can be updated to a searchable database for users to access later on. The only drawback of this threat intelligence platform is that the data needs to be collected manually. This data can be gathered from a multitude of random or inappropriate sources (deep web, dark web, open web). This means that it can take a significant amount of time to be produced. Leading service providers start to make use of machine learning techniques and advanced analytics to increase analytical efficiency since the reports can be made faster without removing the vital context. Complete Threat Detection Solution A complete threat detection solution brings together the functionality and capabilities of feeds, platforms, and providers, with each of these pieces giving users the opportunity to receive the most from intelligence that’s available. They are designed to retrieve data from multiple sources to make it in a real-time view. One would expect that machine learning and automation capabilities that can connect the dots automatically and provide context across through these sources to make some threat content. Plus, this type of technology was made to provide a solution faster than that of a human analyst, resulting in faster intelligence. Complete threat detection solution will allow users to centralize any form of data that you have access to. And it lets you customize the intelligence for integrating with other parts of security intelligence. The advantage of this solution is obvious. Users can use technology that can balance the access to makes it suitable for complete threat intelligence. This makes it easier for users to stay with one vendor that can acknowledge your technology demands. And, you’ll be able to keep your company safe from any inside and outside threats. Conclusion We believe that the future of threat intelligence platforms will have more responsive machine learning systems. Since Verizon is creating their own platform, we can see that large corporations are starting to take charge in the right direction. Conclusively, as threat intelligence technology grows, it will save businesses time, money, and help them effectively solve problems. Do you have any questions related to threat intelligence? Tell us in the comments below! Sources: https://threatconnect.com/blog/how-retailers-get-started-with-threatconnect/ https://www.recordedfuture.com/threat-intelligence-vendors/ https://www.enisa.europa.eu/news/enisa-news/enisa-publishes-first-study-on-cyber-threat-intelligence-platforms

The Strategy Behind Verizon‘s New Threat Intelligence Platform

The annual is a much-anticipated event every year for the cybersecurity sector. Verizon Data Breach Investigation Report Chocked full of comprehensive data about what happened in the past year and where we are headed, this report is the gold standard for taking the temperature of how we are doing when it comes to keeping our data safe. Among its areas of focus is some solid reporting on the state of insider threats. While the vast majority (83%) of breaches are caused by external actors (ie. hackers), a sizable 19% of incidents are from internal threat actors. The report defines them as anyone who has been granted access to company resources, be they full time, part time, or contractors. They are different though from say partners (read 3rd party) like vendors or others in your supply chain because those folks are a whole other kettle of fish. In some cases, the insider threat actors cause us harm by making honest yet costly mistakes. They might misconfigure some settings or send sensitive information to the wrong person. It happens. Their hearts might be in the right place even if their good sense might’ve skipped out for a stroll. But then there are those malicious insiders who intentionally cause harm, stealing, destroying, and generally being up to no good. These are people who were given trust and end up betraying it. But why? To figure it out, let’s take a look at the report’s findings on motivations for these bad internal actors, and see how it impacts various industries. Motivation Breakdown for Insider Threat Activities They say that the only certainties in life are death and taxes. Well, add the reported motivators for insider threats to this list. Unsurprisingly, financial motivation tops the list at a whopping 89%. This makes good sense as usual since most people do what they do for money. They see an opportunity to take something that they should not, and abuse the trust that was put in them. Our winner is followed up by: Grudge (13%) Espionage (5%) Convenience (3%) Fun (3%) Ideology (2%) While math was never my strong suit, even this writer can tell you that these motive results come out to more than 100. What it says is something perhaps more important. Malicious insiders are people who can have multiple motivations in their head at the same time. Take for instance a disgruntled hospital employee who hates her boss, got a bad deal from management, and has access to credit card numbers that she can sell via her cousin. As we dive into the different industries covered in the research, we see that motivations can clearly vary. Espionage is more likely to pop up in government or technology cases than say impacting SMBs at a more modest 7%. Let’s run through them and see what we can learn. Healthcare Threat Actors: Internal 35% vs External 66% Motivations: Financial 98%, Espionage 2%, Fun 1%, Ideology 1% Healthcare comprises a lot of people with a lot of access to sensitive information. It is notoriously hard to defend because most of these people legitimately need to be able to interact with patient data. While the motivation in healthcare related breaches fits the usual pattern of having financial at the top, the report points out that many of the data exposures are actually employees looking at data that they should not simply because they were curious about it. No intention to profit from it, but the organization can still be hit with a regulatory fine nonetheless. Health is a fascinating area for spies as well. This is because it can provide valuable insights into how a country is preparing for a future crisis, or for research on a new vaccine that another country can use to help out their own researchers. While grudges are not listed here as a motivating factor, it probably should be. Healthcare is a field with a lot of people under a lot of stress, working under tough conditions, so it follows that some may succumb to the pressure. Financial and Insurance Threat Actors: Internal 34% vs External 66% Motivations: Financial 97%, Espionage 3%, Ideology 1%, Convenience 1% At first glance, this sector has the highest internal actor percentage of the categories under review. This is maybe not totally surprising since employees may see an opportunity to help themselves to valuables if they think that they can get away with it. There is always the old joke about bank robbers robbing banks because that’s where the money is. But reading a little more into the report, this figure is a little misleading. They cite that misdelivery is actually one of the biggest issues when it comes to insiders. There is not a precise breakdown of how much is intentional vs mistakes, but it is a good reminder that we need to monitor our data handling with care. Government Threat Actors: Internal 30% vs External 80% Motivations: Financial 68%, Espionage 30%, Ideology 2% Government is an interesting sector to target for a number of reasons. First and foremost, government workers have plenty of access to information. Addresses, payment card details, and plenty more bits of sensitive data worth stealing, so there is more than enough motivation for a criminal actor. But then there are the spies. For obvious reasons, governments spy on each other. Rarely is it the case that James Bond breaks into the government installation and steals the secret plans. In the real world, case officers recruit insiders to become traitors, either with financial or ideological means. In some rare cases, you get a Reality Winner who makes mistakes and steals information that she then passes on to amateurs like The Intercept who expose her to the feds. By all accounts, she was hoping to influence public opinion and policy with her leaks, though not very effectively. Interestingly, government is a sector where we see a fair amount of collaboration between internal and external actors. Apparently in 16% of cases, there were bad actors working on both sides of your so-called perimeter. This is up from the 2% of cases back in 2020, so it will be interesting to see why this trend is rising. A Word for the Miscellaneous Errors and Partners in Crime By all accounts, the category of data breaches caused by Miscellaneous Errors, aka someone doing something unintentionally bad that exposes data, has continued its decline. It now only comprises 13% of the incidents. Whether it is better practices, or more likely technology as organizations have upgraded to cloud technologies, this is good news. The one area where it appears to still be cited as an issue is in healthcare, though the reason stated is mostly to do with misdelivery where data is sent to or shared with the wrong people. Apparently in 7% of cases, the attacks are carried out by the combination of internal and external actors working together to your detriment. They give the example of criminals who get themselves hired at the target company and then help their compatriots from the inside. Regardless of the motivations, your organization still needs to protect yourselves from risky insiders. Below are a few ways to get started. 3 Tips and Tools for Defending Against Insider Threats Insiders are always going to be harder to defend against because they are already inside your organization, and chances are they already know where to find what they want to steal. There are a few measures though that we can take to try and prevent their actions and detect them when they do occur. Implement User Behavior Analytics to Detect Sketchy Activity Gaining a baseline understanding of how a user acts within your systems is the first step in being able to detect when something is going wrong. By continuously monitoring what an employee is accessing, sending, editing, etc, big changes that may be indicative of malicious behavior can throw up red flags. For example, if an employee is interacting with sensitive files that are outside of their purview for their job, then it may be a good idea to give them a little bit of extra scrutiny. Add to this behaviors like working at off hours when their activity might otherwise draw less attention, and you can start to build a clearer picture of a potential employee threat. Limit Physical Data Transfers Some of the biggest data thefts in history were not carried out by hackers a continent away. They simply walked out the front door. Edward Snowden, Chelsea Manning, and more than a few other well-known names transferred files onto hard disks or even CDs. Use solutions to stop users from being able to move sensitive files over to physical devices like USB sticks, external hard drives, and the like. In the cloud era with its much more granular controls, there is simply no justification for needing to so given the potential risks. If all else fails, fill the USB slots up with gum. Block File Transfer Services In a similar vein to controlling transfers to physical devices, it is time to end the practice of allowing employees to use file transfer services. Services like Box, Dropbox, and others are great tools if they are being managed by your IT team. But allowing employees to connect their own file transfer accounts is just downright risky shadow IT. Block access to these services by setting rules in your monitoring software platform and encourage your team to use organizationally controlled services like SharePoint or better yet, Google Drive. Trust But Verify As we have noted previously, insider attacks are hard to stop because these are trusted people inside your organization. As scary as an insider threat can be, please remember that the vast majority of your people do not want to do you wrong. They may make mistakes because they are humans, but they mean the best. And the fact is that if we want them to keep doing their best, we have to give them respect and trust. By providing active monitoring to pick up on irregularities that may indicate a threat, we can implement the security controls we need to protect our data without being draconian or disrespectful. Because treating your people like a bunch of criminals is how you get them to act like thieves. Be respectful and hopefully you will get the same treatment in return.

Verizon Data Breach Investigation Report 2023 on Motivations for Insider Threat Actors

Internet Outrage Caused by Verizon Shows How Fragile the Internet Routing Is

We Discovered Disparities in Internet Deals: Here's How We Did It

An investigation by The Markup found that AT&T, Verizon, EarthLink, and CenturyLink disproportionately offered lower-income and least-White neighborhoods slow internet service for the same price as speedy connections they offered in other parts of town. Credit: Joel Eastwood and Gabe Hongsdusit. Sources: The Markup analysis of AT&T, CenturyLink, Verizon; U.S. Census Bureau This Article Is Copublished With A.P. News Read on our collaborator's site A couple of years into the pandemic, Shirley Neville had finally had enough of her crappy internet service. “It was just a headache,” said Neville, who lives in a middle-class neighborhood in New Orleans whose residents are almost all Black or Latino. “When I was getting ready to use my tablet for a meeting, it was cutting off and not coming on.” Neville said she was willing to pay more to be able to Zoom without interruption, so she called AT&T to upgrade her connection. She said she was told there was nothing the company could do. In her area, AT&T only offers download speeds of 1 megabit per second or less, trapping her in a digital Stone Age. Her internet is so slow that it doesn’t meet Zoom’s minimum for group video calls, doesn’t come close to the FCC’s of broadband, currently 25 Mbps, and is worlds below median home internet speeds in the U.S., which 167 Mbps. recommended definition average “In my neighborhood, it’s terrible,” Neville said. But that’s not the case in other parts of New Orleans. AT&T offers residents of the mostly White, upper-income neighborhood of Lakeview internet speeds almost 400 times faster than Neville’s—for the same price: $55 a month. The vast gulf between the quality of service AT&T offered these neighborhoods for the same cost is not a fluke. The Markup gathered and analyzed more than 800,000 internet service offers from AT&T, Verizon, Earthlink, and CenturyLink in 38 cities across America and found that all four routinely offered fast base speeds at or above 200 Mbps in some neighborhoods for the same price as connections below 25 Mbps in others. The neighborhoods offered the worst deals had lower median incomes in nine out of 10 cities in the analysis. In two-thirds of the cities where The Markup had enough data to compare, the providers gave the worst offers to the least-White neighborhoods. These providers also disproportionately gave the worst offers to formerly redlined areas in every one of the 22 cities examined where historical maps were available. digitized These are areas a since-disbanded agency created by the federal government in the 1930s had deemed “hazardous” for financial institutions to invest in, often because the residents were Black or poor. Redlining was outlawed in 1968. By failing to price according to service speed, these companies are demanding some customers pay dramatically higher unit prices for advertised download speed than others. CenturyLink, which showed the most extreme disparities, offered some customers service of 200 Mbps, amounting to as little as $0.25 per Mbps, but offered others living in the same city only 0.5 Mbps for 400 times as much—$100 per Mbps. Residents of neighborhoods offered the worst deals aren’t just being ripped off; they’re denied the ability to participate in remote learning, well-paying remote jobs, and even family connection and recreation—ubiquitous elements of modern life. “It isn’t just about the provision of a better service. It’s about access to the tools people need to fully participate in our democratic system,” said Chad Marlow, senior policy counsel at the ACLU. “That is a far bigger deal and that’s what really worries me about what you’re finding.” Christopher Lewis, president and CEO of the nonprofit Public Knowledge, which works to expand internet access, said The Markup’s analysis shows how far behind the federal government is when it comes to holding internet providers to account. “Nowhere have we seen either the FCC nor the Congress, who ultimately has authority as well, study competition in the marketplace and pricing to see if consumers are being price gouged or if those service offerings make sense.” None of the providers denied charging the same fee for vastly different internet speeds to different neighborhoods in the same cities. But they said their intentions were not to discriminate against communities of color and that there were other factors to consider. The industry group USTelecom, speaking on behalf of Verizon, said the cost of maintaining the antiquated equipment used for slow speed service plays a role in its price. “Fiber can be hundreds of times faster than legacy broadband—but that doesn’t mean that legacy networks cost hundreds of times less,” USTelecom senior vice president Marie Johnson said in an email. “Operating and maintaining legacy technologies can be more expensive, especially as legacy network components are discontinued by equipment manufacturers.” AT&T spokesperson Jim Greer said in an emailed statement that The Markup’s analysis is “fundamentally flawed” because it “clearly ignored our participation in the federal Affordable Connectivity Program and our low-cost Access by AT&T service offerings.” The Affordable Connectivity Program was launched in 2021 and pays up to $30 a month for internet for low-income residents, or $75 on tribal lands. “Any suggestion that we discriminate in providing internet access is blatantly wrong,” he said, adding that AT&T plans on spending $48 billion on service upgrades over the next two years. Recent looking at 30 major cities found only about a third of eligible households for the federal subsidy, however, and use it to help cover cellphone bills, which also qualify, rather than home internet costs. research had signed up the majority Connectivity advocates told The Markup that it’s hard to get people to jump through the bureaucratic hoops needed to sign up for the program when service is slow. Greer declined to say how many or what percentage of AT&T’s internet customers are signed up for either the ACP or the company’s own low-cost program for low-income residents. In a to the FCC, AT&T insisted its high-speed internet deployments are driven by “household density, not median incomes.” letter But when The Markup ran a statistical test controlling for density, it still found AT&T disproportionately offered slower speeds to lower-income areas in three out of four of the 20 cities where we investigated their service. “We do not engage in discriminatory practices like redlining and find the accusation offensive,” Mark Molzen, a spokesperson for CenturyLink’s parent company, Lumen, wrote in an email. He said that The Markup’s analysis is “deeply flawed” without specifying how. He did not respond to requests for clarification. EarthLink, which doesn’t own internet infrastructure in the examined cities but rather rents capacity from other providers, did not provide an official comment despite repeated requests. Internet prices are not regulated by the federal government because unlike telephone service, internet service is not considered a utility. As a result, providers can make their own decisions about where they provide service and how much to charge. The FCC declined a request to comment on the findings. The investigation is based on service offers collected from the companies’ own websites, which contain service lookup tools that list all available plans for specific addresses, using a method pioneered by researchers at . Princeton The Markup analyzed price and speed for nearly 850,000 offers for addresses in the largest city in 38 states where these providers operate. https://themarkup.org/still-loading/2022/10/19/dollars-to-megabits-you-may-be-paying-400-times-as-much-as-your-neighbor-for-internet-service?embedable=true#in-most-cities-poorer-neighborhoods-were-offered-worse-internet-plans-more-often Las Vegas is one city where large swaths of CenturyLink’s offers were for slow service. Almost half didn’t meet the current federal definition of broadband. These fell disproportionately on Las Vegas’s lower-income and least-White areas. Las Vegas councilwoman Olivia Diaz said that in the summer of 2020, she approached families where children had stopped showing up to virtual lessons the previous school year to find out what went wrong. City schools were preparing to begin their second school year marked by COVID-19 lockdowns. “We kept hearing there were multiple children trying to connect in the household, but they weren’t able to,” said Diaz, who represents a district that’s predominantly Latino and on the lower end of the city’s income spectrum. More than 80 percent of CenturyLink’s internet offers in her district were for service slower than 25 Mbps. Education advocacy group Common Sense Media recommends at least 200 Mbps download speeds for a household to reliably conduct multiple, simultaneous video conferencing sessions. “I think it’s unfair knowing that it is slow service that we’re paying for that is not commensurate with the faster speeds that they have in the other parts of the city that are paying the same price,” Diaz said. “It just breaks my heart to know we’re not getting the best bang for our buck.” Diaz said city officials have asked CenturyLink to expand high-speed service in her district, but the company declined, citing the prohibitive cost of deploying new infrastructure in the area. CenturyLink did not respond to emails asking about this request. Some officials told The Markup they’ve been yelling for years about bad service for high prices. “If I was paying $6 a month,” Joshua Edmonds, Detroit’s director of digital inclusion, “well you get what you’re paying for.” But he objects to people being asked to pay premium rates for bad service. “What I pay versus what I get doesn’t really make sense.” In a 2018 , Bill Callahan, who runs the online accessibility organization , coined the term “tier flattening” to describe charging internet customers the same rate for differing levels of service. report Connect Your Community He said The Markup’s findings show how much of America’s internet market is based on the “basic unfairness” of internet service providers deciding to deprioritize investing in new, high-speed infrastructure in marginalized areas. “They’ve made a decision that those neighborhoods are going to be treated differently,” said Callahan. “The core reason for that is they think they don’t have enough money in those neighborhoods to sustain the kind of market they want.” The FCC under a provision of the 2021 infrastructure bill aimed at “preventing digital discrimination of access based on income level, race, ethnicity, color, religion, or national origin.” is currently drafting rules A coalition of 39 groups led by the Electronic Frontier Foundation and Center for Accessible Technology to take aggressive action rectifying broadband inequality by examining the socioeconomics of the neighborhoods getting the slowest speeds and the prices they pay—regardless of whether the companies intended to discriminate. urged the FCC https://themarkup.org/still-loading/2022/10/19/dollars-to-megabits-you-may-be-paying-400-times-as-much-as-your-neighbor-for-internet-service?embedable=true#in-most-cities-households-in-the-least-white-areas-were-offered-the-worse-internet-plans-much-more-often AT&T insisted in filings with the agency that the standard for discrimination should be explicit, deliberate efforts to avoid building infrastructure in areas that are populated by people of color or lower-income residents. It also asked for subsidies to build high-speed internet in lower-income neighborhoods because, as AT&T asserted in its to the FCC, “most or all deficiencies in broadband access appear to result not from invidious discrimination, but from ordinary business-case challenges in the absence of subsidy programs.” letter Advocates say that’s just not true. “There are very few places in the country where it is not economically feasible to deploy broadband,” said Brian Thorn, who served as a senior researcher for the Communication Workers of America, a union representing telecom employees, which has been vocal on the issue and to the FCC. filed its own comment (Full disclosure: The CWA is the parent union of The NewsGuild-CWA, which represents The Markup’s employees.) He said members are tired of seeing their employers make inequitable infrastructure deployment decisions. “We would hear from members all the time that they’re out laying lines on one side of the neighborhood and not on the other,” he said. In a to the FCC, the coalition asserted that “broadband users are experiencing discriminatory impacts of deployment that are no different than the impacts of past redlining policies in housing, banking, and other venues of economic activity.” letter The term “redlining” derives from efforts by the federal government to stem the tide of foreclosures during the Great Depression by drawing up maps, with the help of real estate agents, to identify areas that were safe for mortgage lending. Predominantly White neighborhoods were consistently rated better than less-White neighborhoods, which were shaded in red. Echoes of these maps still reverberate today in things like and . rates of home ownership prenatal mortality on the historical map explaining why one part of Kansas City, Mo., was redlined cited “Negro encroachment from the north.” Notes In that same area, AT&T offered only slow service to every single address The Markup examined. Across Kansas City, AT&T offered the worst deals to 68 percent of addresses in redlined areas, compared to just 12 percent of addresses in areas that had been rated “best” or “desirable.” https://themarkup.org/still-loading/2022/10/19/dollars-to-megabits-you-may-be-paying-400-times-as-much-as-your-neighbor-for-internet-service?embedable=true#2022-broadband_kansas_city_redlining Redlining maps frequently tracked neatly with the disparities The Markup found. Addresses in redlined areas of 15 cities from Portland to Atlanta were offered the worst deals at least twice as often as areas rated “best” or “desirable.” Minneapolis, which is served by CenturyLink, displayed one of the most striking disparities: Formerly redlined addresses were offered the worst deals almost eight times as often as formerly better-rated areas. Pamela Jackson-Walters, a 68-year-old longtime resident of Detroit’s Hope Village, said she needs the internet to work on her dissertation in organizational leadership at University of Phoenix online and to virtually attend church services. The slow speeds AT&T offered were a constant annoyance. “They still haven’t installed the high-speed internet over here,” she said. “How do we get it? Are we too poor of a neighborhood to have the better service?” Hope Village has a per capita income of just over $11,000 and is almost entirely Black. To add insult to injury, last fall, AT&T internet service across Hope Village went down for 45 days before being restored. This summer, Jackson-Walters’s internet went down again, this time for four weeks, she said. Jeff Jones, another longtime Hope Village resident, noted a bitter irony amid all the service problems. “To add to the insult, I can look out my bedroom window literally, maybe 150 yards, is the AT&T service facility,” he said with a weary laugh. “I’m like, please help me! You’re right there! How can you ignore this problem that is just right in front of your face?” Until The Markup told Hope Village residents its findings about AT&T’s pricing practices in Detroit, they didn’t know that lower-income areas were more often asked to pay the same price for slower internet. “That’s the big piece,” said Angela Siefer, the executive director of the National Digital Inclusion Alliance, which advocates for broadband access. “Folks don’t know that they’re being screwed.” Credits: & Leon Yin Aaron Sankin Also published here Photo by on Thomas Jensen Unsplash

Are You Paying 400 Times More for Your Internet Than Your Neighbor? You Might Be

With the breathless pace at which new digital innovations are emerging every day, many are now wondering when broadband will finally be rendered obsolete. Despite the possibility of alternatives like 5G taking over, however, many critics and proponents of broadband alike have yet to really determine once and for all whether it can replace broadband entirely. Is there a 5G future beyond our current broadband-defined era? Many companies are trying to make a 5G world the new reality, but doubts remain about whether it can truly replace broadband. Cable companies are pushing 5G initiatives Despite the fact that many proponents of broadband argue that 5G is only being pushed by would-be disruptors who want to stiff cable companies, it’s a simple matter of fact that some of today’s biggest industry names are actually pouring hefty sums of investment into 5G technology. Verizon recently claimed that it launched the first real 5G initiative in the world, for instance, and actually asserts that it’s Verizon 5G Home initiative can survive and thrive at the low rate of just $50. Verizon’s new efforts to aren’t entirely honest, however; the company is bragging about providing the first 5G network really as a method of bolstering public awareness about its bold gambit more than anything else. In other words, it’s a clever marketing scheme. Furthermore, not everybody in the areas Verizon is claiming to represent will have access to 5G services, which critics continue to disdain as being lackluster and incapable of living up to their promise. This isn’t to say that broadband isn’t without its own critics, but rather to point out that many of 5G’s most important pioneers have yet to produce the wondrous results they’re promising in terms of affordable network management software. push 5G onto the world Many still posit that 5G can replace broadband over the next decade or so as costs plummet and the availability of services, like Botox, picks up. After all, many people who presently rely on broadband are sick and tired of their service and in dire need of an overhaul, especially for those in rural areas. Despite continued innovation within the realm of digital technology, rural broadband access remains one of the most pressing problems of the developed world, with poor people in isolated communities struggling to gain internet access. This is causing a hefty demand for alternatives to broadband which some proponents of 5G see as a valuable opportunity to show their stuff to the world. 5G is better, but it’s not quite revolutionary The simple reality of modern telecommunications technologies and their associated infrastructure is that the world isn’t yet ready for 5G. This isn’t to say that investment won’t keep picking up in 5G services, or that cellphones and digital services of the future won’t enjoy faster speeds and more secure connections, but rather to state the obvious that wired connections are likely here to stay. Companies that are very clear about their deals know this. Despite the fact that many consumers despise the downsides of broadband, it’s still fast and reliable in a number of ways that 5G services simply aren’t right now. 5G will have provide many benefits to those who opt to invest in it, but wired internet services will always remain the more secure and cheaper option for a enough people that broadband will endure. Modern 5G initiatives should really be viewed as little more than live betas of an exciting innovation that’s yet to truly come into its own. Verizon’s famous gambit in particular is likely just a laboratory experiment being conducted with little intention of taking it national. Nonetheless, images of a home internet replacement will continue to tantalize investors and savvy IT professionals for years to come. Broadband just isn’t that popular in many cases, especially in rural areas where wire services are so shoddy that in some cases they literally don’t exist at all. In these communities, the allure of 5G technologies will seem almost irresistible, and many marketing experts and digital professionals will doubtlessly push exciting new 5G services to these areas in an effort to vacuum up some additional funding for themselves. Replacing broadband entirely, however, is a herculean task that even the best 5G networks will likely find themselves incapable of achieving. It’s true that 5G technology is about to change the way we receive our internet services, and companies like Verizon will doubtlessly keep pushing this new innovation for as long as they see the potential to profit from it. Nonetheless, consumers shouldn’t fear a widespread end of their broadband services and those who are pushing for a 5G-dominated future should consider stepping on the breaks until this new technology has proven itself a little more. The rise of 5G, as impressive as it is, simply isn’t enough to displace broadband entirely. The hectic pace of the digital age has upended many ways of doing business, but some established monoliths like broadband services likely won’t be going away anytime soon.

Can 5G Replace Broadband?

This is the memo Marissa Mayer meant to send Yahoo employees Editor’s note: We have obtained what appears to be an early draft of a memo allegedly written by Yahoo CEO Marissa Mayer. It was found last night on an abandoned thumb drive in the parking lot of a Pollos Hermanos restaurant, shortly after the 2-for-1 margarita happy hour. Though we cannot vouch for its authenticity, we present it for your consideration: Beloved Yahoos: As you’ve probably read on the Internet by now, Yahoo has finalized a deal to transfer its operating business to Verizon Communications. This is a great day for all who wear the purple, not just those of us who stand to take home hundreds of millions of dollars with this transaction. Yahoo is a company that changed the world. Before Yahoo, the Internet was just a bunch of nerds eating chimichangas while playing Magic: The Gathering in their mom’s basement. Yahoo brought the Internet to everyone, including people who probably should not be allowed anywhere near a keyboard. I am extremely proud of all we accomplished in the 4 years, 9 days, 8 hours, and 27 minutes I have served as CEO. As we embark upon a new adventure as Verizonauts, I’d like to reflect on our journey to date. Over the last four years we: * Acquired Tumblr and maintained its position as one of the most tastefully curated collections of GIF pornography on the Web. * Proudly maintained Yahoo’s position in the Guinness Book of World Records for the World’s Largest Yodel. * Served as the launch pad for hundreds of new startups, many of them operating under Yahoo’s own roof while their founders drew a much-needed regular paycheck. * Launched a groundbreaking series of cold and hot luncheon options. * Acqui-hired top talent from hundreds of startups that no one outside their own walls had ever heard of, briefly rescuing them from obscurity before sending them back again. * Created billions of dollars of new value, mostly in the form of restricted stock units for executives who were acqui-hired and are no longer with the company. * Helped to add such colorful terms as “resting and vesting,” “snackin’ and slackin,” and “twerkin’ not workin’’’ to our industry’s vernacular. * Created one of the industry’s first sites devoted exclusively to eSports, causing tens of thousands of people to say, “What the f**k is eSports?” * Initiated a much needed overhaul of the Nautilus equipment in the corporate workout center (slated to be completed in December 2018). * Burning Love, Sin City Saints, and Other Space FTW!!! * Achieved unparalleled levels of corporate opacity with our vaunted FYI weekly speaking series; by the end, even I couldn’t understand what anyone was talking about. * Single-handedly kept Kim, Kanye, Kourtney, Khloe, Kris, Kylie, Kendall, Korky, and (K)aitlyn at the front of America’s Konsciousness. * Continued to pioneer the use of pointless punctuation in company logos. Of course, there is still much work to be done managing the transition of Yahoo’s vast content holdings to its new Verizon masters. To help smooth the transition I have appointed a special team composed of Level 1 executives who have not yet cashed out their stock options and assigned them the inevitable horsey acronym. Our team of CRAVENS will be available 24/7 to not answer your questions and ignore your concerns. For their extraordinary efforts they will receive a healthy retention bonus consisting of thousands of shares of Alibaba stock and their body weight in Kind bars, for as long as supplies last. I will always bleed purple. MM

This is the memo Marissa Mayer meant to send Yahoo employees

We’re living in a pandemic of data breaches. More than 17 billion personal records were exposed last year, and 2024 has begun with a string of several high-profile back-to-back breaches in the first quarter, including data exposure of millions of AT&T account holders. Big Tech companies are in the crosshairs, too, facing mounting criticism from government officials calling for urgent reform. Even the open-source software supply chain is under threat from social engineering campaigns looking to compromise maintainer projects. ‘Social engineering’ is the key term here because it’s not software vulnerabilities that enterprises should be worried about. Those only make up 5% of breaches, while 68% involve the human element. How can this be? And what should companies do about it? The doors we open for hackers – and how to close them Exotic and sophisticated zero-day attacks and vulnerability exploits may garner the bulk of attention from the press, CISOs, and security teams, but the reality is that today’s cybersecurity tools are becoming exceedingly efficient at preventing and remediating these attacks. Hackers know this. They’re not going after software vulnerabilities. They’re attacking identity because it’s far cheaper and easier to exploit or force human error. So, they target credentials such as passwords, browser cookies, and private API keys. The data says it all, really: a Verizon report proves these credentials show up in 86% of security breaches related to web-based applications and platforms. Obtaining these credentials is how attackers do the most damage with minimal ease. Sometimes, these credentials are shared a little too freely. Other times, a shocking amount goes unused. The point is that organizations have lost control of their credentials, and the result is a growing fragmentation of identities across increasingly complex technology stacks. Those stacks are filled with layers that manage security in different ways, from Kubernetes clusters to Linux servers, copious amounts of specialized databases, IoT, cloud APIs, etc. It gets even more convoluted on a granular level once you’re inside a cloud account. If you have three Windows servers and seven Linux servers, each of those also governs its own login credentials. If you’ve got a multi-cloud setup with both AWS and Azure, those companies also track identity in different ways. In the quest for greater efficiency, DevOps engineers are even splitting cloud-native applications into smaller micro-services, each needing its own identity. Each of these layers opens yet another door for attackers to enter. If you’re an enterprise operating with more DevOps and cloud infrastructure, you’re inevitably going to add even more layers to the stack. More layers mean more doors. In other words, the mere presence of secrets, such as private keys, API keys, passwords, or even browser cookies, should be seen as a vulnerability waiting to be exploited in an identity attack. Stop using secrets for access purposes The problem isn’t the technology itself, though, but human behavior. Any time you create more doors, you’re increasing the probability of human error. So, how do you fix these data breaches? The first step is to consolidate all identities. All identities - including people and machines like servers, laptops, bots, databases, microservices, etc. – must be united into an inventory that provides a single source of truth. The second step is to make these identities impossible to impersonate or “steal”, effectively making the infrastructure security immune to human mistakes. To do this, minimize or eliminate the reliance on secrets for authentication purposes. As a rule, your identity should also never ever be presented as information. The only way to prevent data theft on a catastrophic scale is to remove all static credentials and standing privileges and instead deploy strong authentication with cryptographic identity. In practice, this means basing identity on three-point criteria that include 1) a user’s specific device, 2) a biometric marker, and 3) a personal identification number (PIN). In theory, this is exactly how the iPhone works: the biometric marker is facial recognition, the personal identification number is your PIN code, and the Trusted Platform Module (TPM) chip inside the phone is what governs the ‘machine identity.’ But credentials – or doors, if you will – are just half the story. Observability isn’t enough The thing about human error is that it’s blind to the quality of your cybersecurity and observability tools. It only takes one human to make a mistake by granting access to the wrong people. This already happens. As we learned earlier this year, Google Kubernetes Engine admins are not immune to misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them. The cybersecurity industry has spent a disproportionate amount of time and money on observability. Companies are acquiring and maintaining tools to respond to threats rather than fix enforcement to proactively protect infrastructure. One reason companies tend to be put off by fixing enforcement is the aforementioned complexity of modern technology stacks. The natural assumption is you need competent teams who can configure every single layer with its own authentication, its own authorization, its own encryption, and its own audit. The smarter solution here would be for the cybersecurity industry to embrace a new paradigm for modernizing secure access to infrastructure. This paradigm has to be built on embracing mechanisms that unify all access within a single control point for authentication and authorization. Most enterprises sorely need (and yet lack) this mechanism as a front-end to all of their disparate infrastructure. Access should only ever be granted based on tasks, and only the minimum required privileges should ever be granted. These should then be de-provisioned immediately afterward. This concept of on-demand least-privileged access then needs to be applied to both human and non-human machine and service accounts. In other words, every company should be able to easily enforce the policy that developers should never have access to production data. However, without unified access controls, this will remain a sci-fi concept for many cybersecurity professionals. Unifying access controls isn’t just helpful in the proactive sense. If a data breach does eventually occur, a centralized view of all the access relationships attributed to a user or resource is essential for purposes like quickly revoking unwanted access or auditing. This is how enforcement and observability can be combined for agility. And if you’ve already assigned cryptographic identity beforehand to each individual user or resource, you’ve now associated the actual human user with each action. This means assigning the right permissions to the right people becomes a much easier task. Defend against human behavior There are, of course, positive signs of technology leaders in the industry taking data breaches very seriously. Microsoft has pledged to shore cloud vulnerabilities, prevent credentials from being stolen, and automatically enforce multi-factor authentication for employees. Any efforts to embrace stronger authentication and  cryptographic measures should be commended. If cybersecurity is going to ‘win,’ though, enterprises have to understand that stopping data breaches isn’t about defending against viruses or ultra-sophisticated hacking techniques. It’s about defending against human behavior that exposes infrastructure to data leaks. That’s the mindset that needs to change. Unified access control, paired with zero trust, must be the foundation for modernizing secure access. We’re living in a pandemic of data breaches. More than 17 billion personal records were exposed last year , and 2024 has begun with a string of several high-profile back-to-back breaches in the first quarter, including data exposure of millions of AT&T account holders. 17 billion personal records were exposed last year Big Tech companies are in the crosshairs , too, facing mounting criticism from government officials calling for urgent reform. Even the open-source software supply chain is under threat from social engineering campaigns looking to compromise maintainer projects. Big Tech companies are in the crosshairs Even the open-source software supply chain is under threat ‘Social engineering’ is the key term here because it’s not software vulnerabilities that enterprises should be worried about. Those only make up 5% of breaches , while 68% involve the human element. How can this be? And what should companies do about it? make up 5% of breaches The doors we open for hackers – and how to close them The doors we open for hackers – and how to close them Exotic and sophisticated zero-day attacks and vulnerability exploits may garner the bulk of attention from the press, CISOs, and security teams, but the reality is that today’s cybersecurity tools are becoming exceedingly efficient at preventing and remediating these attacks. Hackers know this. They’re not going after software vulnerabilities. They’re attacking identity because it’s far cheaper and easier to exploit or force human error. So, they target credentials such as passwords, browser cookies, and private API keys. The data says it all, really: a Verizon report proves these credentials show up in 86% of security breaches related to web-based applications and platforms. 86% of security breaches Obtaining these credentials is how attackers do the most damage with minimal ease. Sometimes, these credentials are shared a little too freely. Other times, a shocking amount goes unused . The point is that organizations have lost control of their credentials, and the result is a growing fragmentation of identities across increasingly complex technology stacks. Those stacks are filled with layers that manage security in different ways, from Kubernetes clusters to Linux servers, copious amounts of specialized databases, IoT, cloud APIs, etc. a shocking amount goes unused It gets even more convoluted on a granular level once you’re inside a cloud account. If you have three Windows servers and seven Linux servers, each of those also governs its own login credentials. If you’ve got a multi-cloud setup with both AWS and Azure, those companies also track identity in different ways. In the quest for greater efficiency, DevOps engineers are even splitting cloud-native applications into smaller micro-services, each needing its own identity. Each of these layers opens yet another door for attackers to enter. If you’re an enterprise operating with more DevOps and cloud infrastructure, you’re inevitably going to add even more layers to the stack. More layers mean more doors. In other words, the mere presence of secrets, such as private keys, API keys, passwords, or even browser cookies, should be seen as a vulnerability waiting to be exploited in an identity attack. Stop using secrets for access purposes Stop using secrets for access purposes The problem isn’t the technology itself, though, but human behavior. Any time you create more doors, you’re increasing the probability of human error. So, how do you fix these data breaches? The first step is to consolidate all identities. All identities - including people and machines like servers, laptops, bots, databases, microservices, etc. – must be united into an inventory that provides a single source of truth. The second step is to make these identities impossible to impersonate or “steal”, effectively making the infrastructure security immune to human mistakes. To do this, minimize or eliminate the reliance on secrets for authentication purposes. As a rule, your identity should also never ever be presented as information. The only way to prevent data theft on a catastrophic scale is to remove all static credentials and standing privileges and instead deploy strong authentication with cryptographic identity. In practice, this means basing identity on three-point criteria that include 1) a user’s specific device, 2) a biometric marker, and 3) a personal identification number (PIN). In theory, this is exactly how the iPhone works: the biometric marker is facial recognition, the personal identification number is your PIN code, and the Trusted Platform Module (TPM) chip inside the phone is what governs the ‘machine identity.’ But credentials – or doors, if you will – are just half the story. Observability isn’t enough Observability isn’t enough The thing about human error is that it’s blind to the quality of your cybersecurity and observability tools. It only takes one human to make a mistake by granting access to the wrong people. This already happens. As we learned earlier this year, Google Kubernetes Engine admins are not immune to misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them . misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them The cybersecurity industry has spent a disproportionate amount of time and money on observability. Companies are acquiring and maintaining tools to respond to threats rather than fix enforcement to proactively protect infrastructure. One reason companies tend to be put off by fixing enforcement is the aforementioned complexity of modern technology stacks. The natural assumption is you need competent teams who can configure every single layer with its own authentication, its own authorization, its own encryption, and its own audit. The smarter solution here would be for the cybersecurity industry to embrace a new paradigm for modernizing secure access to infrastructure. This paradigm has to be built on embracing mechanisms that unify all access within a single control point for authentication and authorization. Most enterprises sorely need (and yet lack) this mechanism as a front-end to all of their disparate infrastructure. Access should only ever be granted based on tasks, and only the minimum required privileges should ever be granted. These should then be de-provisioned immediately afterward. This concept of on-demand least-privileged access then needs to be applied to both human and non-human machine and service accounts. In other words, every company should be able to easily enforce the policy that developers should never have access to production data. However, without unified access controls, this will remain a sci-fi concept for many cybersecurity professionals. Unifying access controls isn’t just helpful in the proactive sense. If a data breach does eventually occur, a centralized view of all the access relationships attributed to a user or resource is essential for purposes like quickly revoking unwanted access or auditing. This is how enforcement and observability can be combined for agility. And if you’ve already assigned cryptographic identity beforehand to each individual user or resource, you’ve now associated the actual human user with each action. This means assigning the right permissions to the right people becomes a much easier task. Defend against human behavior Defend against human behavior There are, of course, positive signs of technology leaders in the industry taking data breaches very seriously. Microsoft has pledged to shore cloud vulnerabilities, prevent credentials from being stolen, and automatically enforce multi-factor authentication for employees. Any efforts to embrace stronger authentication and  cryptographic measures should be commended. If cybersecurity is going to ‘win,’ though, enterprises have to understand that stopping data breaches isn’t about defending against viruses or ultra-sophisticated hacking techniques. It’s about defending against human behavior that exposes infrastructure to data leaks. That’s the mindset that needs to change. Unified access control, paired with zero trust, must be the foundation for modernizing secure access.

Social Engineering is the Biggest Cyber Threat

Small businesses have been a lucrative target for cybercriminals. And for obvious reasons such as lack of ✅ Security resources ✅ Financial resources ✅ Expertise in the security field ✅ Cyber insurance The above-mentioned reasons make small businesses susceptible to various cybercrimes like phishing and social engineering attacks, among others. Through these attacks, the threat actors steal your organization’s credentials. Once they obtain these credentials, the threat actor can launch various attacks to steal your information. Before I venture ahead, let me throw some light on compromised credentials and compromised credentials attacks. What Are Compromised Credentials Attacks? When an unauthorized person or an entity unlawfully gains your login details (usernames, passwords, API keys, or tokens), it is known as compromised credentials. When threat actors use a list of those compromised credentials to deploy cyber-attacks by login attempts into a wide range of online accounts, it is known as a compromised credential attack. A compromised credentials attack is one of the most common techniques used by threat actors targeting small businesses. And it can have disastrous consequences. Picture this: In 2023, users' credentials were the most commonly compromised data category in data breaches involving small businesses, with about 54% compromised. Per the Verizon DBIR report, stolen or compromised credentials are the root of over 50%) of all breaches. Compromised Credential: Why Are They Valuable to Cybercriminals? For various reasons, your customers’ credentials are a lucrative commodity in the dark net market. 📍Credentials are easier and cheaper to lay hands on. 📍They don’t require much effort from novice threat actors to get their hands on. 📍The credentials can be developed and abused in a variety of other fraudulent activities, such as spam, financial fraud, and acquiring additional data and personally identifiable information (PII). 📍 They are acquired through users' poor password hygiene. For these reasons, users’ credentials are valuable commodities for bad actors. Common Credentials Attack Methods to Watch Out For While numerous credentials attacks exist, these three are the most prominent and common. Brute Force Attacks In this technique, attackers repeatedly guess login credentials using common password lists. While this is not a compromised credentials attack, it is a credential attack. Reason: They are using various permutations and combinations to guess your credentials. Credential Stuffing Attacks Similar to a brute force attack, the difference is in the techniques used by attackers. Threat actors use the stolen credentials combination to see which one works for a specific website. Dictionary Attacks As the name suggests, attackers use words from the dictionary to figure out the combinations needed to log in to your account. They use the words in combination with common usernames, such as admin, manager, user, IT admin, and others. Risks Associated with Compromised Credentials Attacks Compromised credentials pose similar risks as those posed by credentials takeover. Here are some of the prominent ones. 📌 You can be locked out of your account. Yes, that’s a reality. 📌 Your personal or financial information can be stolen and used for malicious purposes. 📌 They can deface your account or webpage. In simple words, they can delete your information and fill it with their content. 📌 They can also modify your information to make you appear as a criminal. 📌 In the worst-case scenario, they can shut down your account. And make it difficult for you to reopen the account. 📌 Your credentials are a lucrative community on the dark web, and this is where you can find your credentials being sold. How to Protect Your SMB Against Compromised Credentials Attacks Here are a few ways you can guard your small business against compromised credential attacks. ✅ Enforce the use of multi-factor authentication (MFA) among your employees, clients, and customers. Reason: Human error is the cause behind stolen credentials (More details on this in my blog, Human Error), and MFA can help mitigate that error. ✅ Ban previously compromised passwords by not letting users set the same password again and prompting them to choose another one. To find out which ones were compromised earlier, you can visit the website haveibeenpwned.com and get the list of compromised credentials. ✅ CAPTCHAs are another way to prevent compromised credentials attacks. A user may be required to solve a CAPTCHA quiz to authenticate their login rights. ✅ AI-based Intrusion Detection System (IDS) can help you detect any anomalies in logging activities, and you can prevent access there and then. ✅ A list of blocked IP addresses is another way to restrict the access of threat actors who want to steal your users’ credentials. Final Words In the end… Remember this. Your reliance on passwords and other weak authentication methods will always keep you susceptible to compromised credentials attacks. So, to defend your business against compromised credentials, your business goal must be to 🎯 Make it as difficult as possible for criminals to steal the credentials. 🎯 Slow down the process to as much level as possible. Small businesses have been a lucrative target for cybercriminals. And for obvious reasons such as lack of ✅ Security resources ✅ Financial resources ✅ Expertise in the security field ✅ Cyber insurance The above-mentioned reasons make small businesses susceptible to various cybercrimes like phishing and social engineering attacks, among others. Through these attacks, the threat actors steal your organization’s credentials. Once they obtain these credentials, the threat actor can launch various attacks to steal your information. Before I venture ahead, let me throw some light on compromised credentials and compromised credentials attacks. What Are Compromised Credentials Attacks? When an unauthorized person or an entity unlawfully gains your login details (usernames, passwords, API keys, or tokens), it is known as compromised credentials. When threat actors use a list of those compromised credentials to deploy cyber-attacks by login attempts into a wide range of online accounts, it is known as a compromised credential attack. A compromised credentials attack is one of the most common techniques used by threat actors targeting small businesses. And it can have disastrous consequences. Picture this: In 2023, users' credentials were the most commonly compromised data category in data breaches involving small businesses, with about 54% compromised. In 2023 , users' credentials were the most commonly compromised data category in data breaches involving small businesses, with about 54% compromised. 2023 2023 Per the Verizon DBIR report, stolen or compromised credentials are the root of over 50%) of all breaches. Per the Verizon DBIR report, stolen or compromised credentials are the root of over 50%) of all breaches. 50% ) 50% Compromised Credential: Why Are They Valuable to Cybercriminals? For various reasons, your customers’ credentials are a lucrative commodity in the dark net market. 📍Credentials are easier and cheaper to lay hands on. 📍They don’t require much effort from novice threat actors to get their hands on. 📍The credentials can be developed and abused in a variety of other fraudulent activities, such as spam, financial fraud, and acquiring additional data and personally identifiable information (PII). 📍 They are acquired through users' poor password hygiene. For these reasons, users’ credentials are valuable commodities for bad actors. Common Credentials Attack Methods to Watch Out For While numerous credentials attacks exist, these three are the most prominent and common. Brute Force Attacks In this technique, attackers repeatedly guess login credentials using common password lists. While this is not a compromised credentials attack, it is a credential attack. Reason: They are using various permutations and combinations to guess your credentials. Credential Stuffing Attacks Similar to a brute force attack, the difference is in the techniques used by attackers. Threat actors use the stolen credentials combination to see which one works for a specific website. Dictionary Attacks As the name suggests, attackers use words from the dictionary to figure out the combinations needed to log in to your account. They use the words in combination with common usernames, such as admin, manager, user, IT admin, and others. Risks Associated with Compromised Credentials Attacks Compromised credentials pose similar risks as those posed by credentials takeover. Here are some of the prominent ones. 📌 You can be locked out of your account. Yes, that’s a reality. 📌 Your personal or financial information can be stolen and used for malicious purposes. 📌 They can deface your account or webpage. In simple words, they can delete your information and fill it with their content. 📌 They can also modify your information to make you appear as a criminal. 📌 In the worst-case scenario, they can shut down your account. And make it difficult for you to reopen the account. 📌 Your credentials are a lucrative community on the dark web, and this is where you can find your credentials being sold. How to Protect Your SMB Against Compromised Credentials Attacks Here are a few ways you can guard your small business against compromised credential attacks. ✅ Enforce the use of multi-factor authentication (MFA) among your employees, clients, and customers. Reason: Human error is the cause behind stolen credentials (More details on this in my blog, Human Error), and MFA can help mitigate that error. ✅ Ban previously compromised passwords by not letting users set the same password again and prompting them to choose another one. To find out which ones were compromised earlier, you can visit the website haveibeenpwned.com and get the list of compromised credentials. ✅ CAPTCHAs are another way to prevent compromised credentials attacks. A user may be required to solve a CAPTCHA quiz to authenticate their login rights. ✅ AI-based Intrusion Detection System (IDS) can help you detect any anomalies in logging activities, and you can prevent access there and then. ✅ A list of blocked IP addresses is another way to restrict the access of threat actors who want to steal your users’ credentials. Final Words In the end… Remember this. Your reliance on passwords and other weak authentication methods will always keep you susceptible to compromised credentials attacks. So, to defend your business against compromised credentials, your business goal must be to 🎯 Make it as difficult as possible for criminals to steal the credentials. 🎯 Slow down the process to as much level as possible.

Compromised Credentials and Breaches: How It Affects Your Business

While hackers don’t differentiate between the size of their victims, certain attacks, like social engineering attacks, are most common in SMBs and SMEs. This blog specifically addresses the unique challenges and threats you may face as a small and medium-sized business or enterprise (SMB/SME) owner. Not for nothing, social engineering attacks are termed – unseen perils, silent threats to your small business and enterprise. Social Engineering Attacks: The Stats and The Reports Picture this: 📌 Per the report by Barracuda, small businesses witness 350% more social engineering attacks than larger enterprises. 📌 More than 30% of small businesses in the US have weak points that threat actors can exploit. 📌 Per the recent Verizon Data Breach Investigation Report, social engineering attacks, system intrusion, and privilege misuse incidents account for 92% of breaches in small businesses. It is essential to understand what a social engineering attack is and how it impacts your small business to understand how it affects you. What Is Social Engineering? As Cisco puts it, social engineering is not a cyberattack at its heart. It is the art of persuasion and human psychology. The modus operandi here is to target the minds of the victims like conmen and gain their trust. With the victims’ trust gained, the attackers go in for the kill by encouraging them to 📍Divulge personal information 📍Click on malicious web links 📍Open malware-infected attachments So, what is Social Engineering? Let’s look at the definition. Social Engineering: The Definition Any manipulation technique that exploits human errors to gain personal information, access, or valuables is a social engineering attack. In technical terms, social engineering is the psychological manipulation of people into divulging confidential information or performing unsafe actions. In layman’s terms, social engineering is an assault on your emotions and feelings to extract sensitive and personal information for malicious purposes. In the world of cybercrime, scams related to human hacking are on the rise. These scams target unsuspecting users, playing tricks with their minds and luring them into revealing sensitive data and confidential information. Social engineering attacks can happen 👉 Online 👉 In-person 👉 Other interactions How Does Social Engineering Work? Social engineering works in four steps. But essentially, it works on your cognitive biases, where a threat actor impersonates either an authoritative person or a trustworthy individual and cons you into trusting them. They work in four steps. Preparation This is where a threat actor collects information about your business, and this may include your business emails, messaging apps, and other sensitive information related to your business. Infiltration This is where a bad actor will approach you or your employees. They usually imitate a reliable resource and use the previously gathered information to validate themselves. Exploitation Here, a threat actor will use persuasion tricks to obtain more sensitive information from your employees or even you. The threat actor plays on the human mind and tricks you into revealing some sensitive information. Disengagement Once an attacker has the information they sought, they will cut off all ties with you, deploy malware in your office network, and disappear in thin air. Why are SMBs and SMEs Prime Targets? Whether you have a small business or a small enterprise, you are at risk of social engineering attacks. Here are the prime reasons threat actors love your small business or your small enterprise. 📍Lack of resources is one of the primary reasons threat actors target your small business or small enterprise. 📍Trusting Culture of SMBs/SMEs is an important reason for threat actors to love small businesses and enterprises. 📍Your overworked and overburdened employees who juggle multiple responsibilities are the prime targets of threat actors. So, how do you counter these attacks on your business? Top Ways To Protect Your Small Business From Social Engineering Social Engineering attacks can be devastating for your small business, and your business may suffer: 📍Significant financial losses 📍Downtime 📍Reputational damage 📍Loss of Stakeholder and customers’ trust You can counter social engineering attacks on your small business with these methods. 📌Train your employees to recognize 📍Phishing emails 📍Suspicious phone calls 📍Unsolicited requests for sensitive data 📌 Verify each email for sender addresses and the legitimacy of the data requests. 📌 Deploy two-factor authentication or multi-factor authentication on all your accounts for better security. 📌 Data encryption is your ally; embrace it with both hands. Encrypt your data at rest and in transition. When you follow these steps, you can ensure that your small business is protected from social engineering attacks. While you are at it, here are some common scams to watch out for. Common Scams to Watch Out For While practicing the four ways you can mitigate the threat of social engineering attacks, keeping an eye on some of the most common scams prevalent is essential. 📌 Phishing 📌 Tech Support Scams 📌 Pretexting 📌 Baiting 📌 Malware 📌 CEO Fraud Each of these scams is also an individual scam, but they can be deployed for sophisticated social engineering attacks. The best method to prevent social engineering attacks is to create awareness about the various tactics used by threat actors. Final Words Social engineering is becoming dangerous because attacks have become sophisticated with tech evolution. Threat actors indulging in social engineering are master con artists who know how to trick you into revealing sensitive information by invoking extreme emotions in you and your employees. So, the best way to protect your small business from social engineering is to educate your employees. While hackers don’t differentiate between the size of their victims, certain attacks, like social engineering attacks, are most common in SMBs and SMEs. This blog specifically addresses the unique challenges and threats you may face as a small and medium-sized business or enterprise (SMB/SME) owner. Not for nothing, social engineering attacks are termed – unseen perils, silent threats to your small business and enterprise. Social Engineering Attacks: The Stats and The Reports Picture this: 📌 Per the report by Barracuda, small businesses witness 350% more social engineering attacks than larger enterprises. 350% more social engineering attacks than larger enterprises. 350% more social engineering attacks than larger enterprises. 📌 More than 30% of small businesses in the US have weak points that threat actors can exploit. 30% of small businesses 30% of small businesses 📌 Per the recent Verizon Data Breach Investigation Report, social engineering attacks, system intrusion, and privilege misuse incidents account for 92% of breaches in small businesses . 92% of breaches in small businesses 92% of breaches in small businesses It is essential to understand what a social engineering attack is and how it impacts your small business to understand how it affects you. What Is Social Engineering? As Cisco puts it, social engineering is not a cyberattack at its heart. It is the art of persuasion and human psychology. Cisco Cisco The modus operandi here is to target the minds of the victims like conmen and gain their trust. With the victims’ trust gained, the attackers go in for the kill by encouraging them to 📍Divulge personal information 📍Click on malicious web links 📍Open malware-infected attachments So, what is Social Engineering? Let’s look at the definition. Social Engineering: The Definition Any manipulation technique that exploits human errors to gain personal information, access, or valuables is a social engineering attack. In technical terms, social engineering is the psychological manipulation of people into divulging confidential information or performing unsafe actions. In layman’s terms, social engineering is an assault on your emotions and feelings to extract sensitive and personal information for malicious purposes. In the world of cybercrime, scams related to human hacking are on the rise. These scams target unsuspecting users, playing tricks with their minds and luring them into revealing sensitive data and confidential information. Social engineering attacks can happen 👉 Online 👉 In-person 👉 Other interactions How Does Social Engineering Work? Social engineering works in four steps. But essentially, it works on your cognitive biases, where a threat actor impersonates either an authoritative person or a trustworthy individual and cons you into trusting them. They work in four steps. Preparation This is where a threat actor collects information about your business, and this may include your business emails, messaging apps, and other sensitive information related to your business. Infiltration This is where a bad actor will approach you or your employees. They usually imitate a reliable resource and use the previously gathered information to validate themselves. Exploitation Here, a threat actor will use persuasion tricks to obtain more sensitive information from your employees or even you. The threat actor plays on the human mind and tricks you into revealing some sensitive information. Disengagement Once an attacker has the information they sought, they will cut off all ties with you, deploy malware in your office network, and disappear in thin air. Why are SMBs and SMEs Prime Targets? Whether you have a small business or a small enterprise, you are at risk of social engineering attacks. Here are the prime reasons threat actors love your small business or your small enterprise. 📍Lack of resources is one of the primary reasons threat actors target your small business or small enterprise. 📍Trusting Culture of SMBs/SMEs is an important reason for threat actors to love small businesses and enterprises. 📍Your overworked and overburdened employees who juggle multiple responsibilities are the prime targets of threat actors. So, how do you counter these attacks on your business? Top Ways To Protect Your Small Business From Social Engineering Social Engineering attacks can be devastating for your small business, and your business may suffer: 📍Significant financial losses 📍Downtime 📍Reputational damage 📍Loss of Stakeholder and customers’ trust You can counter social engineering attacks on your small business with these methods. 📌Train your employees to recognize 📍Phishing emails 📍Suspicious phone calls 📍Unsolicited requests for sensitive data 📌 Verify each email for sender addresses and the legitimacy of the data requests. 📌 Deploy two-factor authentication or multi-factor authentication on all your accounts for better security. 📌 Data encryption is your ally; embrace it with both hands. Encrypt your data at rest and in transition. When you follow these steps, you can ensure that your small business is protected from social engineering attacks. While you are at it, here are some common scams to watch out for. Common Scams to Watch Out For While practicing the four ways you can mitigate the threat of social engineering attacks, keeping an eye on some of the most common scams prevalent is essential. 📌 Phishing 📌 Tech Support Scams 📌 Pretexting 📌 Baiting 📌 Malware 📌 CEO Fraud Each of these scams is also an individual scam, but they can be deployed for sophisticated social engineering attacks. The best method to prevent social engineering attacks is to create awareness about the various tactics used by threat actors. Final Words Social engineering is becoming dangerous because attacks have become sophisticated with tech evolution. Threat actors indulging in social engineering are master con artists who know how to trick you into revealing sensitive information by invoking extreme emotions in you and your employees. So, the best way to protect your small business from social engineering is to educate your employees.

Social Engineering Attacks: One of the Biggest and Quietest Threats to Your Business

How to Find Out If You're Paying for Slow Internet

My 30-Day Journey on a Dark Web Marketplace That Belonged to a Cyber Gang

একটি ডার্ক ওয়েব মার্কেটপ্লেসে আমার 30-দিনের যাত্রা যা একটি সাইবার গ্যাং এর অন্তর্গত

Meine 30-tägige Reise auf einem Dark Web-Marktplatz, der einer Cyber-Gang gehörte

Mi viaje de 30 días en un mercado de la Dark Web que perteneció a una banda cibernética

Mon voyage de 30 jours sur un marché du Dark Web appartenant à un cyber-gang

डार्क वेब मार्केटप्लेस पर मेरी 30-दिवसीय यात्रा जो एक साइबर गिरोह से संबंधित थी

サイバーギャングが所有するダークウェブマーケットプレイスでの私の30日間の旅

사이버조직이 속한 다크웹 마켓플레이스에서의 30일간의 여정

Minha jornada de 30 dias em um mercado da Dark Web que pertencia a uma gangue cibernética

Мое 30-дневное путешествие по торговой площадке даркнета, принадлежавшей кибербанде

Siber Çeteye Ait Karanlık Web Pazarında 30 Günlük Yolculuğum

Hành trình 30 ngày của tôi trên thị trường web đen thuộc về một băng nhóm mạng

我在网络帮派暗网市场中的 30 天之旅

In 2022, Fortune 500 companies in North America unlocked a business value of $1 trillion by adopting cloud technologies. 86% of these organizations utilized multiple cloud providers for their operations. With a Total Addressable Market (TAM) of $8.6 billion in 2023, the multi-cloud market size is projected to expand to $50 billion (28.6% CAGR) by 2030. Multi-cloud is becoming increasingly popular among large enterprises and Managed Service Providers (MSPs). It enables organizations to optimize costs, bolster regulatory compliance, improve the performance of cloud applications, and speed up innovation. Organizations can leverage the best features and pricing of different cloud providers to increase flexibility and reduce costs. By selecting technologies that are widely supported across providers, they can develop vendor-neutral applications. By adhering to security best practices and selecting suitable deployment regions, organizations can strengthen regulatory compliance, enhance resilience, and reduce the latency of their applications. Finally, by lowering technological, cost, and security barriers, organizations can accelerate engineering innovation. If you are a network engineer, cloud architect, or business leader devising a multi-cloud strategy for your organization, this article introduces you to high-level options to interconnect your multi-cloud. Interconnecting cloud deployments is complicated. Multi-cloud environments typically involve a mix of public and hybrid clouds customized to an organization's particular needs and goals. Achieving low latency, high performance, and cost-effective connectivity between applications, databases, and clients across different clouds can be a considerable challenge. What complexity arises, you ask? Consider a scenario where a database is hosted on one cloud platform while a streaming application operates on another. The challenge is establishing a reliable, secure connection between the database and the application servers without any data loss. Each public cloud offers unique networking capabilities and topologies, which complicates centralized management and orchestration. Cloud providers lack standardized models for inter-cloud connectivity, possibly to discourage customers from using multiple providers, as improved connectivity might reduce customer loyalty. Nevertheless, methods do exist to facilitate interconnection between different clouds. There are multiple ways to interconnect cloud environments. You can use your enterprise’s data center as a hub. An enterprise's data center functions as a hub routing traffic between public clouds or forwarding traffic from on-prem to the cloud. You have two options. Use a VPN tunnel between the cloud endpoints and the data center to send traffic over the internet securely. Alternatively, you can use dedicated connections- like AWS Direct Connect, Azure ExpressRoute, or GCP Dedicated Interconnect- between the cloud and the enterprise’s data center. Since colocation providers -such as Equinix, Digital Reality, and CoreSite interconnect the cloud to the Enterprise’s on-prem DC through their data centers, the process for creating these connections is time-consuming and expensive. Use a carrier-managed MPLS circuit for multi-cloud and hybrid-cloud connectivity. Public cloud providers like AWS, GCP, and Azure partner with internet service providers (ISPs) like Verizon, AT&T, and Orange to provide MPLS connectivity, allowing enterprises to link their cloud environments through these carriers. While specific steps vary between cloud providers, the process consists of two parts. First, enterprises create a dedicated connection to a colocation provider like EQUNIX. Next, they peer the connection with the partner's customer edge route using eBGP. After peering with eBGP, the inter-cloud traffic flows over the partner’s MPLS circuit. Use a virtual cloud router. Network as a Service Provider (NaaS) provides connectivity between clouds and the on-prem DC. They abstract the underlying Public cloud provider-specific connectivity features, making the orchestration, management, and monitoring of connections seamless. An enterprise creates a virtual router using the NaaS provider’s console and adds its dedicated cloud connections and datacenter gateway to the virtual router. This allows the router to route traffic between clouds and the enterprise’s data center. Which connectivity option should you choose? Each option has its advantages and disadvantages. Internet connectivity to the cloud is most practical for low-bandwidth scenarios. For legacy cloud applications that don't demand high availability, VPN tunnels are a sensible choice. They are simple to manage and cost-effective. Private connectivity is often essential for business-critical applications. The enhanced security, network performance, and reliability justify the additional expense for systems like your internal ERP or CRM, which require secure private access for compliance purposes. MPLS circuits, known for their reliability and predictability, are generally reserved for mission-critical applications. However, due to their costly and inflexible nature, marked by long-term contracts and extensive setup and removal periods, private connectivity offers a more flexible alternative. NaaS providers provide pricing flexibility via Pay-Per-User rates and are easy to manage. If you are considering reaping the many benefits of a multi-cloud strategy, choose the connectivity model appropriate for your business objectives. Links to blogs used for research: Insights from CTOs on cloud strategies | McKinseyMulti-Cloud
Management Market Size, Share | Report [2030] (fortunebusinessinsights.com) aws-network-connectivity-over-mpls.pdf (awsstatic.com) Who is selling NaaS, and what do you get? | Network World Multicloud Connectivity: A Complete Guide | Megaport Disclaimer: I am not affiliated with any of the businesses mentioned in this blog, nor do I represent them. The blog is written to educate the audience about the benefits of multi-cloud and networking options. It does not promote any specific company or vendor. In 2022, Fortune 500 companies in North America unlocked a business value of $1 trillion by adopting cloud technologies. 86% of these organizations utilized multiple cloud providers for their operations. With a Total Addressable Market (TAM) of $8.6 billion in 2023 , the multi-cloud market size is projected to expand to $50 billion (28.6% CAGR) by 2030. Multi-cloud is becoming increasingly popular among large enterprises and Managed Service Providers (MSPs). It enables organizations to optimize costs, bolster regulatory compliance, improve the performance of cloud applications, and speed up innovation. Organizations can leverage the best features and pricing of different cloud providers to increase flexibility and reduce costs. By selecting technologies that are widely supported across providers, they can develop vendor-neutral applications. By adhering to security best practices and selecting suitable deployment regions, organizations can strengthen regulatory compliance, enhance resilience, and reduce the latency of their applications. Finally, by lowering technological, cost, and security barriers, organizations can accelerate engineering innovation. Total Addressable Market (TAM) of $8.6 billion in 2023 If you are a network engineer, cloud architect, or business leader devising a multi-cloud strategy for your organization, this article introduces you to high-level options to interconnect your multi-cloud. Interconnecting cloud deployments is complicated. Multi-cloud environments typically involve a mix of public and hybrid clouds customized to an organization's particular needs and goals. Achieving low latency, high performance, and cost-effective connectivity between applications, databases, and clients across different clouds can be a considerable challenge. What complexity arises, you ask? Consider a scenario where a database is hosted on one cloud platform while a streaming application operates on another. The challenge is establishing a reliable, secure connection between the database and the application servers without any data loss. Each public cloud offers unique networking capabilities and topologies, which complicates centralized management and orchestration. Cloud providers lack standardized models for inter-cloud connectivity, possibly to discourage customers from using multiple providers, as improved connectivity might reduce customer loyalty. Nevertheless, methods do exist to facilitate interconnection between different clouds. There are multiple ways to interconnect cloud environments. You can use your enterprise’s data center as a hub. An enterprise's data center functions as a hub routing traffic between public clouds or forwarding traffic from on-prem to the cloud. You have two options. You can use your enterprise’s data center as a hub. Use a VPN tunnel between the cloud endpoints and the data center to send traffic over the internet securely. Alternatively, you can use dedicated connections- like AWS Direct Connect, Azure ExpressRoute, or GCP Dedicated Interconnect- between the cloud and the enterprise’s data center. Since colocation providers -such as Equinix, Digital Reality, and CoreSite interconnect the cloud to the Enterprise’s on-prem DC through their data centers, the process for creating these connections is time-consuming and expensive. Use a carrier-managed MPLS circuit for multi-cloud and hybrid-cloud connectivity. Public cloud providers like AWS, GCP, and Azure partner with internet service providers (ISPs) like Verizon, AT&T, and Orange to provide MPLS connectivity, allowing enterprises to link their cloud environments through these carriers. While specific steps vary between cloud providers, the process consists of two parts. First, enterprises create a dedicated connection to a colocation provider like EQUNIX. Next, they peer the connection with the partner's customer edge route using eBGP. After peering with eBGP, the inter-cloud traffic flows over the partner’s MPLS circuit. Use a carrier-managed MPLS circuit for multi-cloud and hybrid-cloud connectivity. Use a virtual cloud router. Network as a Service Provider (NaaS) provides connectivity between clouds and the on-prem DC. They abstract the underlying Public cloud provider-specific connectivity features, making the orchestration, management, and monitoring of connections seamless. An enterprise creates a virtual router using the NaaS provider’s console and adds its dedicated cloud connections and datacenter gateway to the virtual router. This allows the router to route traffic between clouds and the enterprise’s data center. Use a virtual cloud router. Which connectivity option should you choose? Each option has its advantages and disadvantages. Internet connectivity to the cloud is most practical for low-bandwidth scenarios. For legacy cloud applications that don't demand high availability, VPN tunnels are a sensible choice. They are simple to manage and cost-effective. Private connectivity is often essential for business-critical applications. The enhanced security, network performance, and reliability justify the additional expense for systems like your internal ERP or CRM, which require secure private access for compliance purposes. MPLS circuits, known for their reliability and predictability, are generally reserved for mission-critical applications. However, due to their costly and inflexible nature, marked by long-term contracts and extensive setup and removal periods, private connectivity offers a more flexible alternative. NaaS providers provide pricing flexibility via Pay-Per-User rates and are easy to manage. If you are considering reaping the many benefits of a multi-cloud strategy, choose the connectivity model appropriate for your business objectives. Links to blogs used for research: Insights from CTOs on cloud strategies | McKinsey Multi-Cloud
Management Market Size, Share | Report [2030] (fortunebusinessinsights.com) Insights from CTOs on cloud strategies | McKinsey Multi-Cloud
Management Market Size, Share | Report [2030] (fortunebusinessinsights.com) aws-network-connectivity-over-mpls.pdf (awsstatic.com) aws-network-connectivity-over-mpls.pdf (awsstatic.com) Who is selling NaaS, and what do you get? | Network World Who is selling NaaS, and what do you get? | Network World Multicloud Connectivity: A Complete Guide | Megaport Multicloud Connectivity: A Complete Guide | Megaport Disclaimer: I am not affiliated with any of the businesses mentioned in this blog, nor do I represent them. The blog is written to educate the audience about the benefits of multi-cloud and networking options. It does not promote any specific company or vendor.

Maximizing Business Value with Strategic Multi-cloud Connectivity.

Insider threats are a problem as old as time. So, why are we still not so great at dealing with them? Or more to the point, why does the security industry not seem to be nearly as developed in its methodology when it comes to identifying these insiders? At least, in relation to how frameworks have been created for other areas of security. So, when MITRE’s Chief Scientist for Insider Threats Capabilities Dr. Deanna Caputo spoke about the launch of a new framework for insider threats in a , it brought up more than a few questions about where we are headed. recent interview Not Enough Is Known About Insider Threats Speaking to Dr. Caputo, the first point that stuck out was that this new framework was not replacing a previous one. It was the first of its kind to address a growing concern. Insider threats have been on the rise for a while. In 2023, the Verizon Data Breach Investigations Report (DBIR) found that insiders were responsible for 19% of incidents. But long before this report, in 2018, the team at MITRE received a request from a large financial organization to start compiling data about insider threats to create a framework that will help defenders do a better job of catching them. Dr. Caputo notes that there is plenty of research out there on insider threats, focused primarily on the technical or psychological components of the issue. But much of what we know about incidents is based on anecdotal cases and are not really data-driven. “We have great sensoring, meaning we can see everything you do on your computer,” she says, noting the expansion of tools available now for detecting risk factors being adopted by security teams. “But that doesn't mean we know what the risk or even the threat looks like. So we're finding them but kind of tripping over them when it’s too late. Instead, we want to find them before the big harm has been done. And the data is out there.” Unfortunately though, this data was not being collected and analyzed in a single project where it could be operationalized. This is where Dr. Caputo and her team understood that they could play a role in creating a framework that would look at the full range of risk factors and actions to provide security teams with a better approach to tackling the problem. After some delays from Covid, late last year Dr. Caputo’s team restarted their outreach to the industry to have them confidentially send in their confirmed insider threat incidents for them to study. This included both cases of malicious actors as well as those unintentional actions which could be classified as errors on the part of insiders. Addressing the Demand for a Framework From Insider Threat Professionals While collecting data for problem-solving is generally a good thing, the question of who exactly this framework is meant to serve was a bit puzzling. After all, we already have MITRE’s ATT&CK and D3FEND frameworks. So why are they making another one? Dr. Caputo answers that as the insider threat space matures, there is a need for a framework that organizations can use as a benchmark for how they are dealing with the challenges. “Executives are expecting them to see things but the problem is that the signs are not obvious enough,” she says. There is also a considerable need for direction when it comes to how to prioritize indicators in assessing insider threats. She points to the fact that many organizations now have a dedicated person whose role is specifically to handle insider threats as a positive development. This is important because it is not just individuals from infosec, the SOC, or HR she says, noting though, that this is a team sport. The idea is instead to have someone who sees the whole picture across every component of the threat picture and can really connect the dots. And that requires taking an approach that takes all the factors into account and questions some of our old assumptions about what an insider threat looks like. Taking a Holistic Approach to Insider Threats Along with the attempt to become a central repository for insider threat data, Dr. Caputo says that her team is looking to make this research different by collecting both the technical cyber data as well as many of the more human psychological factors. Catching insider threats is a fairly difficult endeavor. She makes the point that identifying the risk is not necessarily from any one action or even rule-breaking. Moreover, unlike a ransomware attack or terrorism, there is no “boom” moment where we know that the attack has occurred. A smart malicious actor will keep their head down and do what they need to in order to steal information over the long run without getting caught. If we are only looking at specific actions through our own silos of visibility, then we are probably going to miss significant signals. Part of the work means reassessing misconceptions. “We spend too much time on bad things happening in people's lives and we don't account for the risk that good things cause,” says Dr. Caputo. “Humans are never perfect and our judgment is degraded by a lot of things like lack of sleep, fatigue, stress, but stress is good and bad. So the stress of getting married, the stress of buying a house, the stress of having small children all have the equal impact on your decision making. Even though they're very happy things.” “I think programs are slowly starting to see that we're not just waiting for bad things that happen to our employees,” she says, explaining that, “We need just to account for their whole being, which might mean that good things are overwhelming them. And that sounds so odd. But it's true. It's not that something really bad happened and they decided to do bad things. It's just not that simple.” There is also the matter of perspective. Dr. Caputo uses the example of financial factors in insider threat activity. “It’s not about debt,” she says. “The number of insiders for small amounts of money is more about how much that money matters to them. It centers more on how much your debt matters to you and how much do you feel you need to have. Think about financial strain and stress when assessing who is likely to be recruited.” The challenge here though is in how to identify the likely recruits and their associated indicators. “We’ll find more about how to identify it in the framework,” she says. Where Organizations Are Getting it Right The good news says Dr. Caputo is that organizations are getting better at some aspects of the fight against insider threats. Funding for investing both in people and tools appears to be improving, says Dr. Caputo. While there is room for improvement in dealing with issues like false positives and knowing which indicators are the right ones, she says that organizations are doing much better at having more sensors out there for visibility and to collect relevant information. 3 Tips for Improving Your Insider Threat Program Along with the good movement that we are seeing, there is always an opportunity to improve. Dr. Caputo takes a human-centric approach and offers a couple of tips to consider. Don’t Treat Everyone as Negligent “There’s the misconception that if an employee makes a mistake, that's negligence, but that's not right”, says Dr. Caputo. “If we keep talking about them being negligent, all of our human sensors are going to stop caring, or trying.” If we want our employees to be part of a “human firewall” that helps by identifying issues and making the effort to do things right, then avoid treating them like anything less than human adults who will make mistakes here and there. “You have to expect errors and mistakes, genuine human mistakes,” she says. Attackers are Changing Behaviors So Don’t Shame “We get outsmarted a lot and our adversaries are constantly changing their human social engineering,” says Dr Caputo who has begun referring to new methods to trick humans as zero-day social engineering because it resonated with her technical people. Just as you would not shame a technical person for not catching a classic zero-day vulnerability, we need to cut our teams some slack when a clever attacker uses an innovative and new idea to get past our defenses. People Aren’t the Weakest Link, They’re the Missing Link Turning a misconception on its head, Dr. Caputo is a firm believer that your people are your strongest defense. Technology will only get us so far. Think about the phishing emails that make it past the filter as a prime example. When one does, how are we empowering our people to identify it and send it on to security? The same concept holds true for insider threats. Technology will help us pick up tons of valuable signals like exfiltration or accessing sensitive data, but it is often the human referrals of suspicious activity that will help us to fill in the whole picture and identify a threat. How to Get Involved in the Insider Threat Framework At this point, there is no set date for the framework's release. Dr. Caputo hopes that it might be available at the end of 2024, but says that it is a slow process. For now, the focus is on collecting quality data, relying on the early adopters to help them get to some findings. It will need time to improve as more organizations join them and share their data. Dr. Caputo hopes that more organizations will take part in the effort. “No amount of data is too little to participate in this,” she says, adding that, “This can’t be done without help from the community.” The benefits for those who share data is that they will get to see more of the findings sooner, learning more about themselves earlier, having an impact on the way that the framework is shaped. Insider threat leaders can advocate for sharing their data with MITRE, noting how combining efforts can help vendors and customers pool efforts for the community’s advancement in getting better at really understanding insider threat issues. “This gives a way to make more data-driven decisions,” she says. “Don’t underestimate the willingness to have different departments participate because they will see gains as well.”

MITRE Pushes to Launch New Insider Threat Framework

Authors: (1) William P. Wagner IV, Claremont Graduate University. Table of Links Abstract & Introduction Definition of Key Terms Fundamentals of Internet Operation Encapsulation Usage-Based Economic Models Net Neutrality Legal History Researcher Conclusions Areas for Further Exploration & References 7. Legal History The basis of all legal challenges – either for or against net neutrality legislation lies in determining which agency will regulate the Internet in the U.S., and then what rules that agency will apply. 7.1. 2005 Order In 2005 the FCC released the first agency guidelines regarding the “open Internet” – the four rules [13]: “To encourage broadband deployment and preserve and promote the open and interconnected nature of the public Internet, ... • consumers are entitled to access the lawful Internet content of their choice. • consumers are entitled to run applications and use services of their choice, subject to the needs of law enforcement. • consumers are entitled to connect their choice of legal devices that do not harm the network. • consumers are entitled to competition among network providers, application and service providers, and content providers.” 7.2. National Cable & Telecommunications Association v. Brand X Internet Services (2005) These rules were challenged by industry groups representing the ISPs as being too broad. And greatly complicating the issue down the road, in Section II, Paragraph 4, the FCC specifically states that the ISPs are not Title II but are in fact covered under Title I ancillary. On June 27, 2005 the United States Supreme Court (applying Chevron deference) upheld a determination by the FCC that cable Internet providers were an "information service," and not a "telecommunications service" as classified under the Telecommunications Act of 1996. Supreme Court Justice Antonin Scalia wrote the dissenting opinion, and we will see that his words would later seem prescient when quoted in the majority opinion ten years later in 2016[15]. 7.3. 2010 Open Internet Order In a 2010 Executive Order, President Obama directed the FCC to formalize regulations regarding Net Neutrality. The 2010 Order applied much of the same oversight of “common carriers” to the ISPs. The 2010 Order laid out three basic principles: transparency, no blocking, and no unreasonable discrimination. 7.4. Verizon Communications Inc. v. FCC (2014) The 2010 Order was tested in the Supreme Court when Verizon sued the FCC. The Supreme Court ruled that two of the three main principles of the 2010 Order did not fall under the FCC’s jurisdiction of Title I ancillary. The Court upheld the Transparency requirements but found that the other two requirements required the FCC to treat ISPs as “common carriers.” In its findings, the Court suggested some possible fixes. The Court also recognized the “Virtuous Cycle” of edge providers and recognized that ISPs had the “means and the incentive” to disrupt this cycle to the detriment of consumers. 7.5. 2015 REPORT AND ORDER ON REMAND, DECLARATORY RULING, AND ORDER After a public comments period, the FCC sought to re-define the regulations to define ISPs as “common carriers” and further codify the rules regarding Net Neutrality. In February of 2015 the FCC published the REPORT AND ORDER ON REMAND, DECLARATORY RULING, AND ORDER. The 2015 Order classifies ISPs under Title II of the Communications Acts of 1934,1996[14] and it gives strict guidelines regarding Net Neutrality. The 2015 Order states no blocking, no throttling, and no paid prioritization. The FCC sited the 2014 Verizon findings in the order and pointed to the Court’s reference to the “Virtuous Cycle” as authority to change the ISP classification to “common carrier.” 7.6. United States Telecom Association v. FCC and Independent Telephone and Telecommunications Alliance (2016). The large telecom companies sued the FCC, however this time the smaller telecoms joined on the side of the FCC. On June 14 of 2016, the U.S. Court of Appeals for the District of Columbia refused to hear the case, thereby upholding the ruling in USTA v FCC that the FCC had operated under its authority to re-classify the ISPs as “common carriers.” Circuit Judge Srinivasan joined by Circuit Judge Tatel wrote the majority opinion. Amongst the various considerations was the following [15]: Justice Scalia’s dissenting opinion [in the 2005 decision], joined by Justices Souter and Ginsburg, went even further. According to Justice Scalia, the statute permitted only one conclusion: cable broadband ISPs “are subject to Title II regulation as common carriers, like their chief competitors [e.g., DSL] who provide Internet access through other technologies.” Id. at 1006 (Scalia, J., dissenting). The agency, in Justice Scalia’s view, had no discretion to conclude otherwise. And he expressly accepted that his reading of the Act would result in “common carrier regulation of all ISPs,” a result he considered “not a worry.” Id. At 1011. The large telecoms appealed to the U.S. Supreme Court and on November 5th, 2018 the U.S. Supreme Court refused to hear the case, thereby upholding the previous findings. 7.7. 2017 - 2018 FCC Changes Direction In 2017 President Donald Trump appointed Ajit Pai as Chairman of the FCC. Chairman Pai has changed the FCC’s direction and decided the FCC should not regulate ISPs with regard to Net Neutrality, thereby rendering the Court’s ruling temporarily moot as it applies to the current direction of the FCC. The FCC did stipulate that ISPs must be transparent in any throttling or associated fees. The Supreme Court’s 2018 finding does however mean that should the FCC change direction again, that the stricter rules would have legal precedence. It may also be cited as precedence in any upcoming legal challenges to the current interpretation. This paper is under CC BY-NC-SA 4.0 DEED license. available on arxiv

The Evolution of Net Neutrality Laws

Authors: (1) William P. Wagner IV, Claremont Graduate University. Table of Links Abstract & Introduction Definition of Key Terms Fundamentals of Internet Operation Encapsulation Usage-Based Economic Models Net Neutrality Legal History Researcher Conclusions Areas for Further Exploration & References 9. Areas for Further Exploration • Net Neutrality at the State and Local Level. • Legislation affecting local municipalities providing public internet. • Effects of Net Neutrality on 5G deployment and vice versa. • The mechanism for resolving inter-ISP disputes. • The effects of stimulus on supply-side or demand-side economics. References [1] FCC Adopts a Policy Statement Regarding Network Neutrality, Tech Law Journal, 2005, No Author Cited, http://www.techlawjournal.com/topstories/2005/20050 805.asp [2] FCC Passes Compromise Net Neutrality Rules. December 21, 2010. Wired, Sam Gustin. https://www.wired.com/2010/12/fcc-order/ [3] Net Neutrality Explained: What It Means (and Why It Matters). November 23, 2017. Fortune, Andrew Nusca. [4] Net Neutrality in Canada & The Telus Incident Of 2005, December 7, 2017, Sarah Bauer, https://www.navigatormm.com/blog/net-neutrality-incanada-the-telus-incident-of-2005/ [5] Why is the Internet so Important? Reference.com https://www.reference.com/technology/internetimportant-db9d1faab5337241 [6] 47 U.S.C. § 230(b)(2). [7] 47 U.S.C. § 230(b)(1). [8] GN Docket No. 17-199 - In the Matter of: Inquiry Concerning Deployment of Advanced Telecommunications Capability to All Americans in a Reasonable and Timely Fashion. FCC 2018 BROADBAND DEPLOYMENT Report. Adopted: February 2, 2018, Released: February 2, 2018. By the Commission: Chairman Pai and Commissioners O’Rielly and Carr issuing separate statements; Commissioners Clyburn and Rosenworcel dissenting and issuing separate statements. Paragraph 15. [9] RFC 3233 Defining the IETF and 3935 A Mission Statement for the IETF. [10] https://github.com/quicwg [11] FCC Global Broadband Deployment Report 2016 [12] Verizon Reply at 63; Letter from Robert C. Barber, AT&T to Marlene H. Dortch, Secretary, FCC, WC Docket No. 10-90. Attach. at 15-19 (filed July 30, 2014) (AT&T July 30, 2014 Ex Parte Letter). [13] FCC POLICY STATEMENT, 2005, [14] FCC 2015 REPORT AND ORDER ON REMAND, DECLARATORY RULING, AND ORDER. Paragraph 29. [15] United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT FILED: MAY 1, 2017. No. 15-1063. UNITED STATES TELECOM ASSOCIATION, PETITIONER v. FEDERAL COMMUNICATIONS COMMISSION AND UNITED STATES OF AMERICA, RESPONDENTS INDEPENDENT TELEPHONE & TELECOMMUNICATIONS ALLIANCE, ET AL., INTERVENORS. This paper is under CC BY-NC-SA 4.0 DEED license. available on arxiv

A Technical Perspective on Net Neutrality: Areas for Further Exploration

Authors: (1) William P. Wagner IV, Claremont Graduate University. Table of Links Abstract & Introduction Definition of Key Terms Fundamentals of Internet Operation Encapsulation Usage-Based Economic Models Net Neutrality Legal History Researcher Conclusions Areas for Further Exploration & References 8. Researcher Conclusions The research shows that there is sufficient evidence to support the idea of the “Virtuous Cycle,” that it is the activity by innovators, investors, and content providers along the edge of the Internet that drives network growth and innovation, and that this cycle should be protected. Further, this researcher finds that an economic system based strictly on usage of encapsulated packets is capable of responding to all the needs of the infrastructure market, while ensuring competition along the edge. The research also shows that the reverse is not true - the ISPs have an incentive and the opportunity to abuse their position with regard to competition and this would negatively impact the edge. The large ISPs have made no secret of their goals. In Verizon Oral Arguments Transcript at line 31 “I’m authorized to state by my client [Verizon] today that, but for these rules, we would be exploring those commercial arrangements...” Therefore, it is this researcher’s recommendation that the principles of encapsulation, capitalism and democracy would best be served by regulation of ISPs to ensure that the basic tenets of Net Neutrality (as defined at the beginning of this paper and codified in the 2015 FCC Order) are followed. These basic regulations would not restrict any technical decision making by the ISPs, however they would prevent the ISPs from using their often-unique position to restrict access based on content, removing the temptation to start down a slippery slope. This paper is under CC BY-NC-SA 4.0 DEED license. available on arxiv

Net Neutrality: Balancing ISP Power for a Fair Internet

**SILVER SPRING, United States / Maryland, April 3rd, 2024/CyberNewsWire/**The Leading Company for Securing Access Between Workloads Recognized for the Aembit Workload IAM Platform. Aembit, the Workload Identity and Access Management (IAM) Company, has been named one of the Top 10 Finalists for the RSA Conference™ 2024 Innovation Sandbox contest that manages and secures access between critical software resources, like applications and services. Aembit will present its technology to a panel of renowned industry judges and a live in-person audience on May 6 at RSA Conference 2024 at the Moscone Center in San Francisco. for its platform Since 2005, the contest has served as a platform for the most promising young cybersecurity companies to showcase their groundbreaking technologies and compete for the title of “Most Innovative Startup.” The competition is widely recognized as a catapult for success as the Top 10 Finalists have collectively celebrated more than 80 acquisitions and received $13.5 billion in investments over the last 18 years. Aembit will have three minutes to pitch the panel of judges before a question-and-answer round. RSAC Innovation Sandbox “The submissions for this year’s RSA Conference Innovation Sandbox contest were both dynamic and inspiring. Along with the rest of our entrepreneurial audience, I am excited to see these ideas come to life on stage,” said Linda Gray Martin, senior vice president of RSA Conference. “The evolution of global cyber threats is constant and there’s no better place to look for solutions and to help solve these challenges than in our own community.” With the rapid expansion of automated software, cloud services, and APIs, enterprises are being met with an exploding number of workloads across their IT environments. Reflect on the now-outdated practice of jotting down user credentials on sticky notes. Similarly, the current method of securing interactions between workloads typically involves the use of static, long-lived credentials, which are prone to theft and often embedded directly within code. This approach not only introduces security vulnerabilities but also complicates management and impedes prompt response during security incidents and compliance audits. Aembit shifts the model so enterprises can focus on managing access, instead of managing secrets. “Aembit automates and secures the entire workload-to-workload access workflow, from discovery, to enforcement, to audit – at scale,” said David Goldschlag, co-founder and CEO of Aembit. “Instead of building another dashboard showing you problems due to secrets and keys, we proactively fix the root cause of these challenges by systematically improving the way workloads are authorized access to your most sensitive resources, without code changes. You can think of us as Okta (or Azure AD), but between workloads instead of between users and services. The RSA Conference presents the ideal platform for us to demonstrate the significance and impact of our solution to the global security community.” The RSAC Innovation Sandbox contest kicks off at 10:50 a.m. PT on May 6, and winners will be announced at approximately 1:30 p.m. the same day. The panel of renowned expert judges includes , partner at Greylock; , chief technology officer at Check Point Software Technologies; , senior operating partner at Energy Impact Partners; independent researcher; and , SVP & CISO at Verizon. , RSAC executive chairman and program committee chair of RSA Conference, will return to host the contest. Asheem Chandna Dorit Dor Niloofar Howe Paul Kocher, Nasrin Rezai Hugh Thompson For more information regarding RSA Conference 2024, taking place at the Moscone Center in San Francisco from May 6 to 9, users can visit . To learn more about the Aembit Workload IAM Platform, . https://www.rsaconference.com/usa watch this demo video About Aembit Aembit is the Workload Identity and Access Management platform that secures access between workloads across clouds, SaaS, and data centers. With Aembit’s identity control plane, DevSecOps can fully automate secretless, policy-based, and Zero Trust workload access. For more information, visit and . www.aembit.io follow us on LinkedIn About RSA Conference RSA Conference™ is the premier series of global events and year-round learning for the cybersecurity community. RSAC is where the security industry converges to discuss current and future concerns and have access to the experts, unbiased content, and ideas that help enable individuals and companies advance their cybersecurity posture and build stronger and smarter teams. Both in-person and online, RSAC brings the cybersecurity industry together and empowers the collective “we” to stand against cyberthreats around the world. RSAC is the ultimate marketplace for the latest technologies and hands-on educational opportunities that help industry professionals discover how to make their companies more secure while showcasing the most enterprising, influential, and thought-provoking thinkers and leaders in cybersecurity today. For the most up-to-date news pertaining to the cybersecurity industry visit www.rsaconference.com. Where the world talks security. Contact CMO Apurva Dave Aembit apurva@aembit.io This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here.

Stories, News & Mentions about VERIZON

Verizon’s Stories on HackerNoon

Verizon's News & Mentions