Author: Jane Devry

Cybersecurity leader SonicWall has just released their 2025 outlook, including the threats, challenges and trends that will shape the sector in the year ahead. Below, SonicWall’s leading team of threat researchers share their forecast including the key vulnerabilities and threats businesses need to prepare for now.

Hype around improving security outcomes using Generative AI will die down

2024 saw some great concept security demos using GenAI models by ChatGPT, Anthropic, Google, etc. We saw AI SOC agents, AI policy generators, AI security admins and more. If you were expecting to see these demos make production-ready security products, think again. In 2025, we expect the rubber to meet the road – while the focus will switch from making exciting demos to making AI work in real-world scenarios, operationalizing GenAI to consistently improve security outcomes will turn out to be a very challenging problem. Turning hype to production will take significantly more time and, in 2025, the industry will acknowledge that reality.

There will a major cyberattack that uses “Mission Impossible-style” impersonation enabled by modern AI

In the Mission Impossible movie franchise, Tom Cruise and team make use of advanced techniques – latex 3d face masks, voice modulators, adaptive contact lenses and more – to impersonate people, enter restricted areas and save the world from destruction. In 2025, new AI capabilities will make what was only possible in the realm of movies available to the mainstream. And, as with all such new technologies, the bad guys will be amongst the first to take advantage. Unfortunately, the bad guys won’t be using impersonation to save the world; instead, they will launch more sophisticated spoofing and phishing techniques to launch cyberattacks against unsuspecting civilian organizations. 

Rise of Ransomware-as-a-Service (RaaS)

Ransomware attacks will continue to increase in frequency and sophistication. The emergence of Ransomware-as-a-Service will make it easier for cybercriminals to launch attacks without technical expertise, leading to a broader range of organizations, including smaller businesses, becoming targets.

Proliferation of IoT Security Vulnerabilities

With the exponential growth of Internet of Things (IoT) devices, security vulnerabilities will become a critical concern. IoT devices, often with limited security features, will increasingly be exploited for launching attacks, resulting in the need for stronger IoT security protocols and frameworks.

Advances in Quantum Computing Will Redefine Security Strategies

In 2025, the intersection of evolving cyber threats and quantum advancements will redefine security strategies, pushing innovation and international policy developments to safeguard critical systems and data. The focus will be on anticipating hybrid attacks that combine traditional tactics with advanced technology, reshaping the global cyber landscape.

Detecting Attack Origins Will Become Increasingly Difficult 

The line between state and criminal operations will continue to blur further, making it increasingly challenging to attribute attacks. This may prompt stronger international collaboration on cybercrime policy, but effective attribution will remain a core challenge. Governments and private organizations must adapt to this evolving threat landscape, focusing more on proactive intelligence sharing and threat-hunting to disrupt collaborative efforts before they impact critical sectors.

2025 Will See the Rise of Quantum-Resistant Cryptography

While large-scale quantum decryption of algorithms like RSA or AES is unlikely in 2025, targeted attacks on specific or older cryptographic implementations may become more advanced. Despite ongoing “quantum apocalypse” fears being overstated, developing quantum-resistant cryptography will remain a priority for researchers and organizations as part of long-term resilience planning. Governments and private sectors will boost investments in post-quantum solutions, emphasizing broader cybersecurity measures to address potential early threats.

AI Will Augment Cybersecurity Protection Efforts Without Replacing Humans

AI will be a defensive tool and a strategic force multiplier in 2025. It will enable organizations to stay one step ahead of state-sponsored criminals, adapt to quantum threats, and protect critical infrastructure in an increasingly hostile threat landscape. AI’s continuous learning, predictive power, and automation will continue to redefine cybersecurity without replacing the human element, making it essential for both offense and defense to embrace and leverage as a tool in their tool belt.

Reverse Trending

Although cybersecurity developments tend to start at the enterprise and work down to the SME, several growing small and mid-enterprise developments will increasingly trend up into the enterprise. These include:

1) Favoring opex over capex by consuming more security as a service or a managed offering rather than maintaining internal SMEs and making large purchases to continuously refresh hardware.

2) Favoring ease of implementation and management over best of breed by consolidating from numerous vendors to a small number of vendors that offer a platform approach.

3) Outsourcing or offloading IT and cybersecurity work by favoring service providers over traditional consulting firms or resellers. 

Cyber Insurance and 24×7 Monitoring Will Become the Norm

After a short post-COVID dip, the number of cyber-attacks continues to grow at an alarming pace, but more importantly, the average cost of a successful attack is growing at a higher pace and is predicted to grow at a high rate through at least 2029 (the average cost of a data breach in 2024 is $4.88 million). This will put pressure on firms of all sizes to have cyber insurance in place or risk a potentially existential crisis; insurance rate differences driven by best practices requirements will in turn put pressure on firms to adopt 24×7 monitoring of their security infrastructure, such that MDR, NDR and other SOC services will become the norm, particularly as the number of vendors providing those services grows.

Automation

A recent study of 3,000 global firms by Accenture found that the share of cybersecurity-related AI patents increased 2.7X between January 2017 and October 2022. The growing number of cyberattacks, the growing number of attack vectors due to remote work and IoT, the increase in cybersecurity tools and telemetry and the resulting number of alerts generated by cybersecurity tools will require more SOC services and other security as a service, which will in turn drive the need for significantly increased automation to manage alerts, block attempted intrusions, respond to successful intrusions and investigate incidents at a daunting scale. Both cybersecurity skills shortages and simple economics will require a human + machine approach to cybersecurity.

The post Cybersecurity Leader SonicWall Shares 2025 Outlook appeared first on Cybersecurity Insiders.

With technology now supporting almost every facet of business operations, the durability of IT systems and networks is increasingly crucial. Recent events like the CrowdStrike service disruption demonstrate that even top-tier organisations can be susceptible to having their systems impacted by single points of failure. This incident and its aftermath should serve as a wake-up call for chief information officers (CIOs) to re-evaluate their IT strategies and reinforce their systems against unexpected challenges.

During the CrowdStrike outage, a software misconfiguration triggered widespread effects, impacting approximately 8.5 million devices. Around 60% of Fortune 500 companies were affected, resulting in $5.4 billion in damages. This situation highlights the critical need for secure remote network access, which is essential for swiftly addressing and resolving issues before they escalate into more significant network failures. The impacts of such disruptions – whether financial, reputational, operational, or security-related – are considerable, highlighting the need for comprehensive strategies to ensure network resilience.

When disruption strikes, resilient IT systems are key to maintaining continuous operations, enabling swift recovery, and scaling to meet sudden shifts in demand. For CIOs, resilience goes beyond simply meeting uptime metrics; it’s about ensuring the network is prepared for the unexpected and guaranteeing the availability and reliability of IT infrastructure in any situation. A resilient network acts as a shield, absorbing shocks and allowing operations to proceed without interruption.

Lessons learned: Insights gained from recent outages

The process of strengthening network resilience starts with learning from incidents like the Ascension Ransomware attack. As they are responsible for maintaining IT infrastructure, CIOs are accountable for ensuring continuity in these scenarios. They should carry out thorough assessments of their IT and network environments to pinpoint potential single points of failure. This involves regular system audits, stress testing, and scenario planning to understand how different failures could impact operations.

Proactive measures help to identify vulnerabilities and protect the overall health of the network infrastructure. By examining configurations, access controls, and security policies, organisations can detect weaknesses that might expose them to cyber threats. Identifying issues like outdated software, misconfigurations, or unpatched systems helps to facilitate timely remediation before malicious actors exploit them.

Regular audits help to guarantee that configurations align with industry best practices and organisational policies, removing the possibility of errors that could compromise security or stability. Continuous monitoring as part of these assessments allows organisations to stay ahead of evolving challenges, delivers real-time insights and facilitating rapid responses to emerging issues. Making regular audits and assessments the foundation of network management empowers teams to maintain optimal configurations and steer across the ever-changing cybersecurity landscape with confidence.

Secure remote management and monitoring

Building on this critical audit and assessment process, secure remote network access represents another vital component of network resilience.  

Out-of-band management solutions can play a vital role here in ensuring secure remote access and control by providing a back-up communication channel that works independently of the primary network. These solutions enable organisations to quickly isolate and contain security incidents by locking down affected parts of the network, thereby preventing further damage, and helping ensure improved stability and security.

Coupled with this, the latest out-of-band systems can equip network engineers with the essential tools for remote hands-on management during critical situations, allowing rapid engagement with issues, and faster mean time to resolution (MTTR). This means that even if the main network is down or has been compromised in some way, administrators can still securely manage network devices and remedy problems without any interruptions.

At the same time, strong authentication measures, such as multifactor authentication can be implemented in order to offer a critical layer of defence against unauthorised access, while encryption protects sensitive data exchanged between remote systems and network devices. 

This kind of approach can be strengthened further through the use of tools that offer real-time insights into network performance. These are key in helping to recognise issues early, detecting security threats, and responding rapidly to maintain smooth operations.

As we have seen, technology is critically important, but the human dimension must never be neglected. As remote work continues to expand, it’s essential that remote management solutions can scale to support geographically dispersed teams without sacrificing security. Ultimately, a well-informed team is key. Educating users on security best practices boosts the overall effectiveness of any remote management strategy.

Turning resilience into competitive advantage

While all the above actions are key, achieving network resilience goes beyond dealing with current issues. Anticipating future vulnerabilities is just as important. CIOs need to stay ahead of emerging threats by keeping abreast of technological advancements and evolving security landscapes. Investing in automation and artificial intelligence can provide predictive insights into potential system failures. 

These technologies monitor system performance in real-time, detect anomalies, and can even initiate automatic corrective actions helping to address issues before they escalate.

Another policy CIOs should implement to put themselves in a better position to tackle disruptions is the development of clear incident response plans, outlining steps to be followed during various outages to ensure teams can respond rapidly and effectively. Regular drills and updates keep these plans relevant, and stakeholders prepared.

Addressing the human element is critical in this context too. With many network engineers nearing retirement, there’s a looming skills gap that could impact IT resilience. CIOs should invest in training and development programmes to upskill existing staff and attract new talent. Embracing flexible working arrangements, like remote or hybrid models, can help attract a broader pool of candidates.

A positive outlook

By fostering a culture of continuous improvement, teams feel empowered to proactively identify and tackle vulnerabilities before they have an impact. When departments collaborate, they combine their unique perspectives, leading to robust and comprehensive resilience strategies that address risks that might otherwise be overlooked.

From a financial standpoint, it is critical to advocate for sufficient budget allocations dedicated to enhancing IT and network resilience. While investing in redundant systems, secure remote access solutions and advanced monitoring tools does come with upfront costs, these expenses pale in comparison to the potential losses from prolonged outages. In the long run, these are investments that safeguard an organisation’s stability and reputation and that’s a compelling justification for making them. 

It is equally important to highlight that resilience is not just about preventing losses; it’s a way to secure a competitive advantage. In a market where uninterrupted service is expected, companies that consistently deliver reliability gain a strategic edge. By focusing on resilience, CIOs can build stakeholder trust, establish a reliable reputation, and secure a foundation for growth in an increasingly risk-laden environment. Proactively fortifying IT and network resilience not only shields against disruptions but also lays a strong foundation for future success. 

The post Safeguarding resilience in the age of outages: Essential actions for CIOs appeared first on Cybersecurity Insiders.

NAKIVO, a reputable vendor in data protection and disaster recovery, proudly announces the release of NAKIVO Backup & Replication v11. This new version introduces advanced functionalities tailored to meet the evolving needs of businesses in ensuring security for virtualized environments. With Proxmox agentless backup, direct cloud backup for Microsoft 365, expanded NAS cloud backup options, and robust cybersecurity measures, v11 delivers comprehensive data resilience across cloud, physical, and virtual environments. Customers can update their current version or download the 15-day free trial to experience the new features.

Proxmox Agentless Backup

As Proxmox VE continues to gain traction as a flexible and cost-effective open-source virtualization solution, NAKIVO Backup & Replication v11 steps in with powerful Proxmox agentless backup capabilities. Key Proxmox VM protection features include:

• Proxmox Agentless Backup: Simplify Proxmox VE VM protection by removing the need for guest OS agents.
• Incremental Backup with Native Change Tracking: Speed up the backup process by capturing only the changed blocks of data after the last full backup.
• Flexible Storage Options: Store backups locally, in the cloud, on S3-compatible platforms, deduplication appliances, or on tape.
• Enhanced Security with Encryption and Immutability: Protect backup data from ransomware and unauthorized access in both local and cloud storage.
• Full VM Recovery and Granular Restore Options: Restore entire VMs or specific files to achieve tight recovery objectives.

Cloud Backup for Microsoft 365

To support the growing demand for cloud-based data resilience, the v11 of the NAKIVO solution for Microsoft 365 backup enables direct backups of Microsoft 365 data to leading public clouds, such as Amazon S3, Wasabi, Azure Blob, and other S3-compatible storage options. This feature empowers businesses to strengthen their disaster recovery strategy by:

• Backing Up Data Offsite: Avoid the need for on-premises storage and meet compliance requirements.
• Creating Multiple Backup Copies: Store backup copies in various locations for enhanced redundancy and quick recovery.
• Applying Encryption and Immutability: Ensure data remains secure and tamper-proof, providing robust defense against ransomware.

NAS Cloud Backup

With v11, NAKIVO enhances NAS protection through flexible backup options to securely store NAS file shares in the cloud, on deduplication appliances, and on tape. This feature aligns with the 3-2-1 backup strategy, providing businesses with data redundancy and security:

• Backup to Multiple Destinations: Support cloud and on-premises storage targets for increased flexibility.
• Immutability for NAS Backups: Stop ransomware from modifying or deleting your data once stored locally or in the cloud.
• Enhanced Data Resilience: With copies stored onsite and offsite, businesses can meet regulatory compliance and maintain high availability.

Source-Side Encryption

Adding a new layer of data security, NAKIVO Backup & Replication v11 introduces source-side encryption to protect sensitive information at the point of origin. Customers can now encrypt data before it leaves the original system, reducing risks associated with data transmission and cyber threats.

This feature integrates seamlessly with AWS Key Management Service (KMS) for streamlined encryption key management and enhanced data security for virtualized environments.

Backup from NetApp Storage Snapshots

NAKIVO Backup & Replication v11 enhances protection for virtualized environments by expanding support for storage snapshots, now including NetApp FAS and AFF arrays. Businesses can back up their VMware VMs from these storage snapshots, minimizing the impact on production workloads and improving backup efficiency.

Federated Repository for Scalable Storage

The new Federated Repository feature enables businesses to create a scalable storage pool from multiple repositories. This system automatically redirects backups if a repository reaches capacity or is unavailable, ensuring uninterrupted protection and easy scalability as data needs grow.

Tenant Overview Dashboard for MSPs

For Managed Service Providers (MSPs), version 11 of the NAKIVO backup solution for MSPs introduces the Tenant Overview Dashboard that simplifies tenant management. MSPs can view resource usage, performance metrics, and job statuses in a single interface, allowing proactive monitoring and optimized resource allocation.

Real-Time ReplicationBETA Support for vSphere 8 

NAKIVO Backup & Replication v11 extends the Real-Time ReplicationBETA feature to cover VMware vSphere 8.0. This enables businesses to maintain up-to-date replicas of critical VMs, enhancing disaster recovery readiness and safety for virtual environments.

Immutability on NEC HYDRAstor

To protect against ransomware attacks, v11 allows customers to enable immutability for backups stored on NEC HYDRAstor systems, ensuring data remains secure and recoverable even in case of a cyberattack.

Expanding Global Reach with Spanish Language Support

In support of its growing international customer base, NAKIVO Backup & Replication v11 offers full Spanish language support, making it easier for Spanish-speaking users to navigate and manage data protection.

Advancing Data Protection and Global Reach

“With v11, we’re introducing features that align with today’s demands for flexible data protection, increased security, and multilingual support,” said Bruce Talley, CEO of NAKIVO. “Our goal with this release is to provide a comprehensive solution that supports data resilience for businesses worldwide.”

 

The post NAKIVO Launches v11 with Advanced Security Features for Virtualized Environments and Microsoft 365 appeared first on Cybersecurity Insiders.

Businesses often have a strong aversion to being labeled a luddite. But implementing the latest technology can have swift, negative consequences for business networks in terms of bandwidth, connectivity and finances. The solution to these pitfalls that many companies are turning to is the network edge, where they can thrive without sacrificing latency, performance, or security. 

Generative Artificial Intelligence (AI), Internet of Things (IoT) and other cutting-edge technologies are exciting new frontiers. To take advantage of these new developments, businesses have been investing in moving to the edge in order to process data at the source rather than the cloud, which can cause latency and security concerns. Processing data at the edge can speed up business decisions while also collecting key data at the source, which can help refine product offerings and customer experiences. It also enables companies to minimize data transfer via external networks, bolstering security, producing better customer outcomes, and optimizing bandwidth utilization.

Challenges on the Edge

Cloud-based applications see substantial performance gains on an optimized edge network, thanks to the lower latency achieved by closing the distance between edge devices and their users. Placing security controls closer to cloud-hosted data also reduces the threat of private networks being compromised by outside attacks. Additionally, an optimized edge network helps avoid congestion issues that might arise with devices and applications by rerouting traffic to the correct destinations and ensuring the network is not overloaded. This shift to the edge also delivers cost savings businesses would typically incur from cloud providers by offloading processing and storage requirements to the edge. 

While the benefits are enticing, it’s not as simple as adopting any edge network solution. A poorly configured one can turn the potential assets into liabilities. Security problems are the biggest risk. Businesses must ensure their edge is ultra-secure and can respond to threat incidents emerging from different devices or locations. Another problem can arise if your IT team does not have the correct knowledge and training. Without it, they could quickly become overwhelmed by having to manage the multitude of devices, locations, and applications that make up the edge. The upfront cost also can be a barrier to adopting edge networking. It can be expensive because it requires the purchase and deployment of suitable devices and systems that achieve the desired aims without sacrificing security.

Automation Drives Success

The automated edge has emerged as a critical advancement in edge networking. In simplified terms, the automated edge is intelligence that is embedded into edge devices which takes care of networking tasks like configuration, responsiveness, provisioning, and even monitoring all by itself. 

It adapts to changes in daily operations, automatically optimizing network performance by directing traffic through different pathways to reduce lag time and interruptions, as well as providing greater reliability and security. 

Most beneficial is that it can coordinate with generative AI models, improving connectivity and real-time decision-making from different devices, locations, and applications. This coordination enhances data analysis close to the source, while also accelerating customer interactions and offering additional opportunities for growth and innovation. Additionally, if your business relies heavily on low latency – which most businesses do – then your IT team will no longer have to constantly manage any blockages in your network and then figure out the best solution. The automated edge does it for you.

Edge Automation Made Simple

For all its promises, the automated edge also brings with a level of complexity many companies cannot, or are unwilling to, manage on their own. Instead, they are establishing partnerships with Network-as-a-Service providers to give them a fast, flexible, and competitive advantage. Network-as-a-Service, or NaaS, provides companies with an efficient end-to-end solution in the operational management and performance of their networks on a subscription basis. 

NaaS providers assist companies with building their own private network on their own terms. This network can be scaled and configured to meet their needs. This relationship eliminates the complexity of implementing edge automation. It also takes care of security issues and protects your network from attacks through constant monitoring and early detection.

An optimal NaaS platform has been integrated with leading automated edge capabilities, allowing it to engage with all types of edge devices and applications. As a result, businesses can deploy new technology tools safely and efficiently while enabling their IT team to concentrate on other mission-critical tasks.

Visibility into network infrastructure via a user-friendly dashboard helps inform decisions about scalability and agility on demand, providing seamless network management, all while network maintenance concerns are taken care of 24/7 by an expert team of engineers.

Unleashing the power of IoT, generative AI and other cutting-edge technologies will mean giving a good look at edge networking. And by establishing the backbone today of what advancements will come in the future, businesses can capitalize on tomorrow’s developments in network edge innovation.

 

The post Living on the (Automated) Edge: How to Leverage Private Networks to Unleash the Power of AI Without Compromising Security appeared first on Cybersecurity Insiders.

With a growing trend of cyber threats and vulnerabilities in the defense sector and an estimated $600 billion in intellectual property theft annually, the Department of Defense’s release of the Cybersecurity Maturity Model Certification (CMMC) 2.0 on October 11th marked a seminal moment in government cybersecurity requirements. This updated framework represents a fundamental shift in how the U.S. government approaches the protection of controlled unclassified information (CUI) within its vast network of defense contractors. As someone who helps organizations navigate these requirements, I’m witnessing firsthand how this new framework will transform the defense industrial base’s approach to cybersecurity.

Why Did We Need CMMC 2.0?

The defense industry was experiencing information leakage at unprecedented levels, and there were no guarantees they were delivering uncompromised products. With over 300,000 DoD contractors, CMMC 2.0 addresses these concerns by establishing minimum acceptable standards for how the supply chain protects government data entrusted to them. This standardization is critical, as it creates a unified approach to securing sensitive information across the entire defense supply chain.

The new framework introduces a tiered system where defense contractors must implement cybersecurity standards based on the sensitivity of the information they handle. Regular assessments verify compliance, and companies must achieve predetermined security levels to win contracts. This structured approach aims to create a more resilient defense industrial base. The tiered system is particularly important because it recognizes that not all contractors handle information of the same sensitivity level, allowing for a more nuanced and practical approach to security requirements.

Over the years, I’ve observed that the path to compliance isn’t always straightforward. The defense industry has seen an influx of companies offering CMMC-related services, making it challenging for contractors to determine what’s truly necessary for their unique situations. This has created a complex marketplace where organizations must carefully evaluate their needs and potential solutions.

Navigating a New Landscape

Based on extensive experience in this field, I recommend organizations follow a three-step approach. First, companies need to do an assessment to understand what is contractually going to be required. It doesn’t make sense to prepare for Level 3 compliance – the highest level – when the company isn’t going to be required to be certified at that level. This initial assessment is crucial for avoiding unnecessary expenses and effort while ensuring adequate preparation for certification.

Following the initial assessment, organizations should develop a detailed roadmap to address compliance gaps. This roadmap needs to be realistic and achievable, taking into account both technical and operational constraints. 

The final step is ensuring the organization can sustain its required compliance level long-term. This systematic approach helps companies avoid overinvesting in unnecessary security measures while ensuring they meet their contractual obligations.

Unraveling the Complexity

One particularly complex aspect of CMMC 2.0 that deserves special attention involves cloud-based services and FedRAMP equivalency requirements. The increasing reliance on cloud services in the defense industry has created unique challenges in maintaining compliance while leveraging modern technology solutions. Organizations need to first conduct a thorough scoping exercise to determine what falls within their CMMC assessment and where FedRAMP equivalency requirements apply to cloud-based assets or services.

Documentation plays a major role in cloud service compliance, and this is an area where many organizations initially struggle. Organizations must maintain comprehensive records, including controls responsibility matrices, data flow diagrams, and relevant policies. All this information needs to be properly documented in the system security plan (SSP). This is vital because the documentation process often reveals gaps in security controls that weren’t apparent during initial assessments.

Beyond just meeting compliance requirements, organizations need to think strategically about their cybersecurity posture. This includes developing robust incident response plans, establishing clear lines of communication with security teams and leadership, and creating processes for continuous monitoring and improvement. These elements are essential for maintaining CMMC compliance over time and protecting sensitive information effectively.

An Ongoing Commitment to Security Excellence

As the defense industry adapts to these new requirements, the focus shifts from compliance only to creating sustainable security practices. CMMC 2.0 is not only a new set of regulations, but it’s a comprehensive approach to protecting sensitive information throughout the defense supply chain. 

Looking ahead, this framework will likely serve as a model for other sectors beyond defense, potentially reshaping cybersecurity standards across all critical infrastructure industries. With the global cybersecurity market projected to reach $500 billion by 2030, CMMC 2.0 positions the defense industrial base at the forefront of a larger transformation in how organizations protect sensitive information. The key to success lies in understanding that CMMC compliance is not a one-time achievement but an ongoing commitment to security excellence.

 

 

The post Beyond Compliance: CMMC 2.0 and the New Era of Cybersecurity for the Defense Industry appeared first on Cybersecurity Insiders.

In an era where innovation often outpaces implementation, legacy systems remain a hidden yet significant threat to cybersecurity. A recent breach involving DemandScience, a business-to-business data aggregator, highlights the risks that outdated and neglected systems pose. The incident, which exposed sensitive data linked to over 122 million individuals, was traced back to a system that was declared as decommissioned for approximately two years. Unbeknownst to the company, this retired system remained exposed, exemplifying a pervasive issue in IT: the failure to secure and monitor legacy assets.

This massive data breach underscores the importance of proper awareness and management for all outdated hardware, software and processes that an organization continues to rely on or even retains without actively using. The security risks associated with these legacy systems can lead to severe consequences, including steep financial costs and lasting reputational damage. Addressing this challenge requires careful inventory processes, proactive strategies to reduce vulnerabilities and ongoing monitoring of the IT ecosystem.

Why Legacy Systems Pose Security Risks

Legacy systems come with significant drawbacks. Many of these systems no longer receive vendor support or security updates, leaving them vulnerable to exploitation. In addition, they often lack compatibility with modern security tools, complicating efforts to monitor and protect them effectively.

An additional challenge arises from undocumented or “inherited” systems that fall outside the scope of regular IT audits. These systems, which often result from mergers, acquisitions and shadow IT, create gaps in visibility and increase risks. For attackers, these hidden vulnerabilities are attractive targets because they offer an easy way to infiltrate networks or access sensitive data.

Strategies for Addressing the Risks of Legacy Systems

The best way to mitigate the risk of legacy systems is to remove them. However, this is not always practical; legacy systems often need to remain in operation for valid reasons, such as their role in supporting critical business processes, maintaining compliance with regulations or managing historical data.

When legacy systems cannot be retired, organizations can mitigate the security risks associated with them while ensuring they continue to support business needs. Critical best practices include the following:

• Collect and maintain an up-to-date inventory of all hardware, software and processes using a tool like a configuration management database (CMDB). This strategy helps ensure that no system is overlooked and security measures are comprehensive.
• Conduct regular security assessments across all connected devices, including vulnerability scans and penetration tests, to uncover and address weaknesses before attackers can exploit them.
• Isolate legacy systems using network segmentation to minimize the potential damage of an attack and prevent outdated systems from serving as an entry point to the broader network.
• Implement strong access controls with tools such as identity and access management (IAM) systems and multifactor authentication (MFA). Regularly review access permissions to ensure only authorized individuals can interact with sensitive systems.
• Monitor for unusual activity across the IT ecosystem, including suspicious access to legacy data and use of older systems. Ideally, use an IT auditing solution that provides detailed alerts to appropriate teams in real time and offers functionality to facilitate incident investigation and response.
• Develop a clear asset retirement plan that includes securely decommissioning systems no longer in use and transitioning dependencies to modern platforms.

Securing the Future

More broadly, addressing the challenges posed by legacy systems requires adopting a lifecycle approach to IT management. Critical steps include planning for end-of-life transitions and leveraging automation tools to monitor and secure systems. 

To ensure that IT environments evolve alongside business needs, organizations must also invest in modernizing their processes. For example, it’s essential to train IT teams on risk mitigation strategies that reflect a deep understanding of emerging cyberattack tactics and techniques.

DemandScience Breach: A Wake-Up Call

The recent DemandScience breach serves as a stark reminder of the dangers posed by legacy systems. A long-decommissioned system remained exposed, ultimately resulting in the compromise of millions of sensitive records. Organizations should treat this incident as a wake-up call to reevaluate their legacy IT management strategies. Legacy systems require deep visibility, proactive protection measures and ongoing vigilance. 

The lesson from the DemandScience breach is clear: Legacy systems are not just relics of the past — they are active risks in the present. By prioritizing security and modernizing outdated assets, organizations can protect themselves from similar threats and build a safer, more resilient IT ecosystem.

 

The post The Hidden Threat of Legacy Systems: Lessons from a Massive Recent Data Breach appeared first on Cybersecurity Insiders.

As Pavel Durov, the founder of Telegram, landed in France, and walked down the stairs of his private jet into the hands of French police, I’m not sure he recognised how this moment would shift the future of secure messaging apps. What Mr Durov’s arrest makes clear is that the era of centralised messaging apps being able to provide security, privacy and freedom to their users is over. In many ways, Mr Durov’s arrest signposts the beginning of a gradual shift towards decentralised and ownerless messaging protocols. 

Concern over the ability of centralised messaging apps to protect users from misinformation and malicious activity has been rising in recent years, with national authorities across the western world threatening to take action. But where previously scrutiny on messaging apps was largely being driven by regulators and national governments, a growing portion of app users are now beginning to shift to alternative platforms where privacy and security are being prioritised. 

In early November, the owner of X and CEO of Tesla, Elon Musk, appeared on the Joe Rogan Experience podcast. Among other topics under discussion was the potential for the Signal messaging platform to be compromised through government interference. This threat, they warned, could leave millions of Americans at risk of having their private information and messages exposed to national authorities. Where once encryption was regarded as a safeguard against this danger, governments may now seek to override such protections. 

In the case of Mr Durov, for instance, the French authorities pursued charges against him on the basis of failure to comply with a request for user data and enabling criminal activity on the platform. Although he is contesting the charges, some fear he may be forced to hand over Telegram’s encryption keys, giving the authorities access to private user information and messages. 

The privacy issues associated with popular messaging apps stems in large part from the use of centralised servers. By holding user data in one place, centralised architectures can be a honeypot for governments and would-be hackers, and increase risks to users by becoming single points of failure. Even in the case of Signal, which employs end-to-end encryption and advanced metadata protections, the platform uses central servers to relay and store user metadata. In theory, this means confidential user information such as IP addresses and phone numbers can all be accessed by third parties. 

To minimise the risk of privacy breaches and to protect user data, we urgently need to adopt protocols and networks in support of decentralisation. This means protocols where no single entity can hold overarching control over the network infrastructure or user data, eliminating the threats posed by having a singular owner, developers or companies having special access to user messages or metadata. Early iterations of the internet provided a clear structure for the decentralisation of routing and storage, however at the time content encryption was in its

infancy and incentive systems were underdeveloped. We now have the tools available to deploy end-to-end encryption on scale and to solve decentralised incentive models, ushering in a new wave of decentralised protocols. We must now prioritise these approaches when developing applications which store sensitive user data, for the good of users and in the interest of upholding the fundamental right to privacy, security and digital freedom. 

The teams working on Session are committed to building this future, by leveraging the power of decentralisation. In contrast to other messaging platforms, when you use Session, your messages are routed and stored by a network of over 2,200 community operated nodes. In doing so Session dispenses single points of failure and moves the responsibility of data storage and routing to a geographically diverse set of nodes bound by a protocol which ensures data privacy and security. This protocol explicitly removes the need to collect confidential metadata such as phone numbers and IP addresses, so Session users can engage with confidence that their privacy and security will be fully protected at all times. 

I want to bring this full circle to where we started: the arrest of Pavel Durov in France. From a personal perspective, witnessing this unfold was both shocking and deeply unsettling. I didn’t think we had yet reached a stage in the devolution of privacy where Western democracies would arrest and imprison developers of open-source software. Clearly, I was wrong. We are at that point. Now, more than ever, we need tools like Session—tools designed to ensure that neither developers nor operators of messaging apps have privileged access to users’ messages or data. I’m happy to be working towards that vision and it’s something which motivates me everyday.

 

The post The Future of Secure Messaging: Kee Jefferys on Protecting Privacy in a Digital Age appeared first on Cybersecurity Insiders.

Today’s world is powered by technology. Most day-to-day business operations are underpinned by online systems and digitally stored data. And, with over 60% of the UK’s workers on a hybrid working schedule, reliable access to these applications from anywhere, anytime is paramount. 

But the modern world holds many threats that can disrupt these remotely accessible networks. Cyber attacks are becoming more and more of a reality for many sectors, including in Critical National Infrastructure. A recent report from NCC Group shows that 34% of all cyber attacks in July were on Industrials, which has the ability to cause mass issues when disrupted.

When assessing their resilience against operational threats, businesses need to look at their network infrastructure and its capabilities. As industries continue to embrace digital solutions and services, access to secure, reliable, and flexible connectivity is becoming crucial for businesses that want to keep up with innovation whilst negating potential risks.

Mitigating the growing risk of cyber attacks

Digital transformation offers businesses a myriad of benefits. The adoption of technology such as AI, robotics, and cloud computing is improving the smooth running of many organisations, from small businesses to global enterprises. Over the past 18 months, the number of people who use Microsoft Copilot daily in the office has doubled, utilising the AI agent to prioritise inboxes and manage branding in PowerPoint. Another game changer for data accessibility is cloud computing, which allows global businesses to store critical business data somewhere that can be accessed remotely. 

But with new technology comes new risks, and digitalisation opens businesses up to be the victim of cyber attacks. According to the Cyber Security Breaches Survey 2024, half of UK businesses experienced a cyber security breach in 2023. This can cause immediate disruption of critical business processes and put sensitive data, such as client information, at risk. 

Cyber threats are a risk to all types of organisations and at every level. Supply chains, where banking and payment data are processed daily, are at risk of coming to a halt if they experience a cyber attack. Industries such as transport can find themselves facing massive cyber threats which affect their systems, as TfL experienced recently. The attack saw customer data such as names, addresses, and bank details being externally accessed – a worrying reality for companies with customer communities big and small. 

The good news is that businesses can take these steps to protect themselves. By adopting resilient network solutions, they are able to mitigate the risks of cyber attacks and ensure continued access to the business critical data they need to operate. 

How do you build a robust network?

When deciding how to future-proof their networks, it’s essential that businesses assess the best method for them. Forward thinking organisations, that are keen to keep up with new technologies, could significantly benefit from considering how their connectivity needs might change or grow over time. 

Adopting solutions such as Security Service Edge technologies and Secure Access Service Edge can provide businesses with the scalability and security they need to grow whilst remaining safe from cyber threats. 

• Security Service Edge Technologies

When accessing websites, as well as public or private applications it’s essential that businesses are confident this access is secure. Security Service Edge (SSE) technologies such as Cloud Access Security Broker (CASB) can support this. CASB provides compliance, risk scores, and reputation to the cloud applications it identifies. It also prevents damage by identifying malware and blocking inappropriate apps before they can cause disruption within a business’s processes. 

Another technology that contributes to SSE is Data Loss Prevention (DLP). This service acts as a layer of protection against data exfiltration – when data gets transferred from one place to another without authorisation. DLP also detects cloud malware and can eliminate infected files which could put sensitive data at risk. 

• Secure Access Service Edge

To increase layers of security even further, SSE technologies can be combined with SD-WAN. The result is a converged network and security solution which is referred to as Secure Access Service Edge (SASE). SASE ensures that all of business’ endpoints are managed with the same networking policies and security as their on-premise infrastructure, even though their locations might be different. 

As a cloud architecture model, it merges policy enforcement and security monitoring with integrated network controls. By allowing authentication and data access as needed, it brings network and security together to become one single service. 

Cloud storage is already one of the strongest data protection options, but implementing the latest advancements is the only way to ensure the safest protection. Once SSE and SASE technologies are enabled only the right people can access critical business data anytime, anywhere, providing the flexibility and safety needed for successful innovation and growth.

Building a foundation of resilience

Guaranteeing that every new technological step is safeguarded with a resilient network will allow organisations to confidently step into the future whilst protecting themselves against a changing cyber-threat landscape. 

Constant vigilance will ensure that businesses are one step ahead of the risks that can threaten their networks and cause disruption. Adopting SSE and SASE technologies will enable safe and reliable data access. This centralised control and built-in security at scale is essential, allowing businesses to run their day-to-day operations smoothly.

To ensure your business is prepared for future disruption risks, start evaluating your business’s network today. 

 

The post Future proofing business with resilient network solutions appeared first on Cybersecurity Insiders.

In today’s interconnected world, digital identities are the keys to accessing sensitive information, financial assets, and critical systems. However, as technology advances, so do the methods used by cybercriminals to exploit these identities. From phishing and credential stuffing to account takeovers and ransomware attacks, identity-related threats have surged, posing significant risks to individuals and organizations alike.

To combat these evolving challenges, automated identity threat protection solutions have emerged as vital components of modern cybersecurity strategies. These tools use advanced technologies like artificial intelligence, machine learning, real-time monitoring, and behavioral analytics to detect and prevent identity-related threats.

Let’s explore the top automated identity threat protection tools available today, delve into their features and capabilities, and discuss how they help mitigate risks while securing personal and organizational assets.

What Is Automated Identity Threat Protection?

Automated identity threat protection refers to a suite of technologies designed to safeguard digital identities by identifying, monitoring, and mitigating potential threats. These solutions automate the process of detecting suspicious activities, securing access points, and responding to breaches, significantly reducing the time and effort required to manage identity-related risks.

The Growing Importance of Identity Protection

1. The Rise in Cybercrime: The global cost of cybercrime is expected to reach trillions of dollars annually, with identity-related threats accounting for a significant portion of this damage.
2. The Shift to Digital Ecosystems: The widespread adoption of cloud computing, remote work, and digital transformation has increased reliance on digital identities.
3. The High Cost of Data Breaches: Beyond financial losses, data breaches damage reputations and lead to regulatory fines.
4. The Complexity of Modern Threats: Attackers leverage advanced techniques such as AI-driven phishing campaigns, making traditional security measures insufficient.

Key Features of Identity Threat Protection Solutions

When choosing an identity threat protection tool, it’s important to assess its features and capabilities to ensure comprehensive protection. Below are the essential features to look for:

1. Real-Time Threat Monitoring

The ability to continuously monitor identities, accounts, and systems for signs of compromise is crucial. Real-time monitoring ensures that threats are detected and addressed as they occur, minimizing potential damage.

2. Dark Web Intelligence

Identity-related threats often originate on the dark web, where cybercriminals sell stolen credentials and personal information. A robust solution should scan hidden forums, marketplaces, and encrypted platforms to detect exposed data.

3. AI-Powered Detection

Artificial intelligence and machine learning enable tools to identify patterns and anomalies indicative of identity theft, credential misuse, or unauthorized access.

4. Behavioral Analytics

By tracking user activity, such as login locations, device usage, and access patterns, these solutions can flag unusual behaviors that may signal a compromised account.

5. Data Breach Alerts

Timely alerts about data breaches that involve personal or organizational information help users act quickly to mitigate risks.

6. Integration with Existing Systems

Compatibility with other security tools, such as Identity and Access Management (IAM), Security Information and Event Management (SIEM), and endpoint protection, ensures a comprehensive security ecosystem.

7. Automated Response and Remediation

Top-tier tools automate response workflows, such as resetting compromised credentials, blocking suspicious logins, or notifying administrators of potential threats.

8. Compliance Support

For organizations operating in regulated industries, solutions must align with compliance standards such as GDPR, CCPA, HIPAA, or PCI-DSS.

9. Scalability

The solution should be capable of growing with an organization’s needs, whether protecting a single user, a family, or a large enterprise.

The Top Automated Identity Threat Protection Solutions

Below is an in-depth look at the leading tools in the identity threat protection landscape, highlighting their unique features, use cases, and benefits.

1. Webz.io

Lunar by Webz.io is a sophisticated platform designed to monitor the dark web and surface web for identity threats. It provides real-time alerts and actionable intelligence, enabling organizations to address risks before they escalate.

Key Features

• Comprehensive Monitoring: Tracks dark web forums, encrypted messaging platforms, and surface web sources.
• AI-Driven Analytics: Uses machine learning to identify patterns of malicious activity.
• Customizable Parameters: Allows users to set specific search terms and keywords for tailored monitoring.
• Real-Time Alerts: Notifies users immediately when potential threats are detected.

Use Cases

• Monitoring corporate credentials for exposure on the dark web.
• Tracking discussions related to specific brands, employees, or sensitive information.
• Protecting intellectual property from unauthorized distribution.

2. IDShield

IDShield is an all-encompassing identity protection service that caters to individuals and families. It provides around-the-clock monitoring, alerts for suspicious activities, and expert support for identity restoration.

Key Features

• Identity and Credit Monitoring: Tracks personal information across various platforms, including the dark web and credit reporting agencies.
• Identity Restoration Services: Provides dedicated specialists to assist in resolving identity theft cases.
• Social Media Monitoring: Flags suspicious activities or privacy risks on personal accounts.
• Family Plans: Protects multiple family members under one subscription.

Use Cases

• Preventing identity theft for individuals and families.
• Monitoring children’s online presence for privacy risks.
• Restoring compromised identities with expert support.

3. PingOne for Workforce

PingOne for Workforce is a cloud-based solution designed for enterprises. It provides secure access management, advanced authentication methods, and identity protection tools to enhance organizational security.

Key Features

• Single Sign-On (SSO): Simplifies login processes while ensuring security.
• Adaptive Multi-Factor Authentication (MFA): Dynamically adjusts authentication based on contextual factors.
• Identity Lifecycle Management: Tracks employee identities from onboarding to offboarding.
• Integration Capabilities: Works seamlessly with enterprise IT systems.

Use Cases

• Streamlining secure access to business applications.
• Protecting sensitive data and resources from unauthorized access.
• Enforcing adaptive authentication for enhanced security.

4. Tenable.ad

Tenable.ad is specifically designed to secure Active Directory (AD) environments, which are often a primary target for identity-related attacks. It identifies vulnerabilities and helps organizations strengthen their AD security posture.

Key Features

• Attack Path Analysis: Maps potential pathways attackers might exploit to gain unauthorized access.
• Privilege Escalation Detection: Identifies and mitigates risks of privilege abuse.
• Real-Time Monitoring: Detects misconfigurations and security gaps in AD.
• Automated Remediation: Provides actionable steps to address vulnerabilities.

Use Cases

• Securing Active Directory against internal and external threats.
• Preventing lateral movement and privilege escalation.
• Strengthening overall IT infrastructure security.

5. Spotlight

Spotlight is a dark web monitoring tool that specializes in identity threat detection. It scans hidden platforms to uncover stolen credentials, personal data, and other sensitive information.

Key Features

• Keyword-Based Tracking: Users can define specific keywords or parameters for targeted searches.
• Real-Time Alerts: Sends immediate notifications for detected risks.
• Comprehensive Reporting: Provides actionable insights for security teams.
• Dark Web Scanning: Covers forums, marketplaces, and encrypted communication channels.

Use Cases

• Detecting leaked corporate credentials on hidden platforms.
• Monitoring sensitive customer data for exposure.
• Enhancing organizational threat intelligence.

6. Bitdefender

Bitdefender offers an advanced identity protection suite as part of its broader cybersecurity portfolio. It provides tools for threat detection, dark web monitoring, and proactive defense.

Key Features

• AI-Driven Threat Detection: Identifies phishing attempts, ransomware, and credential theft.
• Cross-Platform Protection: Secures identities across multiple devices and operating systems.
• Dark Web Monitoring: Tracks stolen credentials and personal data.
• Integrated Security Suite: Combines endpoint protection with identity safeguards.

Use Cases

• Preventing phishing attacks targeting employees.
• Protecting organizational credentials from compromise.
• Integrating identity protection into a comprehensive security framework.

7. Recorded Future

Recorded Future is a leading provider of threat intelligence solutions, offering robust identity protection tools. It combines global data collection with AI-driven analytics to deliver actionable insights.

Key Features

• Threat Intelligence Integration: Tracks identity-related risks across the surface and dark web.
• Predictive Analytics: Anticipates emerging threats through data analysis.
• Custom Dashboards: Tailors monitoring and reporting to user needs.
• Automated Alerts: Provides instant notifications for potential breaches.

Use Cases

• Enhancing enterprise threat intelligence strategies.
• Monitoring employee credentials for exposure.
• Anticipating identity-related risks before they escalate.

8. LeakCheck

LeakCheck is a straightforward yet powerful tool for detecting stolen credentials. It cross-references personal and corporate accounts against an extensive database of leaked information.

Key Features

• Credential Database: Maintains a vast repository of compromised data.
• Real-Time Notifications: Alerts users when monitored accounts are exposed.
• Simple Interface: Easy-to-use platform for non-technical users.

Use Cases

• Protecting employee accounts from credential stuffing attacks.
• Identifying personal data leaks across platforms.
• Monitoring multiple accounts efficiently.

9. Darktrace

Darktrace is a leader in AI-based cybersecurity, offering solutions for anomaly detection and automated response. Its identity protection capabilities include behavioral analytics and real-time threat mitigation.

Key Features

• Self-Learning AI: Adapts to user behavior to detect irregularities.
• Automated Remediation: Neutralizes threats instantly without human intervention.
• Anomaly Detection: Flags unusual activity patterns.
• Comprehensive Integration: Works seamlessly with existing systems.

Use Cases

• Detecting insider threats and unauthorized access.
• Securing accounts against credential compromise.
• Strengthening organizational defenses with automated threat response.

10. Cybersixgill

Cybersixgill provides advanced dark web monitoring and threat intelligence tools. Its platform delivers real-time insights into identity-related risks by scanning hidden forums and marketplaces.

Key Features

• Deep Web and Dark Web Coverage: Tracks stolen credentials and personal data.
• AI-Powered Insights: Identifies patterns and trends in identity threats.
• Automated Alerts: Sends real-time notifications of detected risks.
• Detailed Reporting: Helps organizations understand and address vulnerabilities.

Use Cases

• Monitoring dark web activity for organizational threats.
• Protecting customer data from identity theft.
• Anticipating and mitigating emerging risks.

Choosing the Right Identity Threat Protection Solution

Selecting the best identity threat protection solution requires careful evaluation of your unique needs, budget, and the tool’s capabilities. With the increasing sophistication of cyber threats, it’s crucial to invest in a solution that aligns with your security objectives while offering scalability and ease of use. Here are key factors to consider:

1. Specific Needs

Determine whether you need protection for personal use, family coverage, or enterprise-level security. For businesses, consider whether the tool can secure environments like Active Directory or integrate seamlessly with existing security frameworks. Individuals may prioritize dark web monitoring and restoration services, while enterprises might focus on threat intelligence and automated response.

2. Scalability

Ensure the solution can grow with your requirements. A tool designed for small-scale personal use might not suffice for a rapidly expanding business with global operations. Scalable solutions are particularly important for organizations anticipating growth or increased reliance on digital identities.

3. Ease of Use

User-friendly interfaces and straightforward setup processes are essential for maximizing efficiency. A complex tool requiring extensive training might deter effective implementation, especially for non-technical users. Look for solutions that balance advanced features with intuitive design.

4. Integration Capabilities

Check whether the tool integrates with your current security ecosystem, such as SIEM, IAM, or endpoint protection systems. Tools that work seamlessly within your existing infrastructure can enhance efficiency, reduce compatibility issues, and provide a unified security approach.

5. Budget

Evaluate the cost-effectiveness of the solution. While some tools may offer robust features, they might exceed budget constraints. Compare the features offered against your security needs to ensure you’re getting value for your investment. Consider not only the upfront cost but also any ongoing subscription or licensing fees.

6. Compliance Requirements

For businesses operating in regulated industries, it’s vital to choose solutions that align with compliance standards such as GDPR, HIPAA, PCI-DSS, or CCPA. A non-compliant solution could expose your organization to legal risks and financial penalties.

7. Customer Support and Service

Look into the level of support offered by the provider. Solutions with responsive customer service, detailed documentation, and expert assistance for recovery and incident handling can make a significant difference during critical moments.

8. Customization Options

The ability to tailor monitoring and alert parameters ensures the solution meets your specific needs. For example, businesses may want to focus on monitoring particular domains or keywords related to their brand.

By carefully considering these factors, you can ensure that your chosen identity threat protection solution not only meets your current needs but also provides the flexibility and robustness to adapt to future challenges. Making the right choice can dramatically enhance your security posture and provide peace of mind in an increasingly volatile digital landscape.

 

The post The Top Automated Identity Threat Protection Solutions appeared first on Cybersecurity Insiders.