Category: Guest Blog Post

Every industry is dealing with a myriad of cyber threats in 2024. It seems every day we hear of another breach, another scam, another attack on anything from a small business to a critical aspect of our nation’s infrastructure.

Related: The case for augmented reality training

Because of this, cybersecurity investments and regulatory oversight are increasing at an astounding rate, especially for those in the financial services industry, bringing an overwhelming feeling to chief compliance officers without dedicated security teams.

And the solution they are turning to is not one that will solve their problems in the long run: handing cybersecurity responsibilities to internal IT teams.

It’s a tale as old as the first computer. When a technical issue arises, hand it over to IT. However, from the sheer amount of regulations coming down the pipeline to the tools necessary to counter threat actors, internal IT is not the right resource for this monumental task.

Regulatory overload

Firms in the financial services industry are staring down the bottom of the regulatory barrel coming into 2024. From identity theft to greater oversight on risk management, internal IT teams will be taking the brunt of these incoming regulations. This comes after the second highest year of enforcement actions from the Securities and Exchanges Commission (SEC).

The SEC’s incoming rules on handling cybersecurity are sweeping to say the least, ranging from 24/7 real-time monitoring to new documentation requirements to new security and vulnerability scanning and remediation requirements. The list goes on. No matter the size of your organization, this influx of regulations is a daunting task to keep up with on top of normal IT personnel responsibilities.

Cocanower

In order to maintain compliance in the coming months, new tools never used by IT workers will need to be implemented to have a secure cybersecurity strategy. To put it plainly, if you hand a tennis novice Serena Williams’ racket, their chances of winning the U.S. Open are slim to none. Experience, on top of the right tools, are necessary to withstand the onslaught of cyber threats currently bombarding the finance sector.

Resources, manpower

Not only are internal IT teams not versed in the necessary tools to counteract threat actors, businesses are not even hiring enough people with the skill sets needed to meet these regulations. Historically, these teams have been structured to focus on day-to-day operational IT tasks, lacking the specialized training and resources required to navigate the intricacies of the latest cybersecurity mandates. And that’s not even to mention the fact that cyberthreats need to be monitored 24/7/365.

Cybersecurity threats don’t stop when you clock out. In fact, that’s most likely when they will happen. For those in IT, schedules and budgets will have to drastically change to accommodate new requirements like real-time monitoring. All factors point to IT teams being in a precarious position, where the demands of complying with new regulations far exceed their available resources and manpower.

This mismatch not only impedes their ability to effectively safeguard against evolving cyber threats but also risks the potential for regulatory non-compliance, leaving financial institutions — and even the IT specialist’s own job security —  vulnerable on multiple fronts.

Assisting your IT team

In order to not overwhelm IT workforces, education and professional development opportunities will be crucial for a secure financial institution. This can also extend to your workforce as a whole.

Regular training sessions for all employees on cybersecurity best practices, potential threats, and the importance of compliance can help ensure that cybersecurity is a shared responsibility, contributing to a more robust defense against cyber threats and regulatory breaches.

Other tactics firms can employ include the adoption of new tools such as security incident and event monitoring (SIEM), real-time vulnerability scanning, endpoint detection and response (EDR) and many others.  Not only will IT teams need to evaluate all of the tools available in the marketplace to find the best  ones for their firm, but they will also need to take time away from their existing responsibilities to garner subject matter expertise around these tools.

The road ahead

Going into 2024, the current resources allocated to internal IT teams underscores a critical need for a strategic overhaul, where financial services firms must either significantly invest in upskilling their internal teams or seek external cybersecurity expertise to ensure alignment with the evolving regulatory landscape.

If companies are willing to provide the necessary support and resources to their internal IT teams to handle these incoming responsibilities and threats, they will be able to weather the regulatory storms ahead.

About the essayist: Michael Cocanower is founder and chief executive officer of AdviserCyber, a Phoenix-based cybersecurity consultancy serving Registered Investment Advisers (RIAs). He has earned certifications as both an Investment Adviser Certified Compliance Professional and as a Certified Ethical Hacker. He also has served on the United States Board of Directors of the International Association of Microsoft Certified Partners and the International Board of the same organization for many years, as well as served on the Microsoft Infrastructure Partner Advisory Council.

Even in the cloud era, Microsoft Exchange Server remains a staple business communications tool across the globe.

Related: The need for robust data recovery policies.

One critical issue faced by organizations that rely on Exchange Server is the risk of a corrupt Exchange Server database cropping up.

Fortunately, effective tools and wise best practices can help mitigate this this exposure enabling companies to indefinitely leverage Exchange Server as a productive, resilient and secure communications tool.

Navigating new risks

Today, heavy reliance on cloud-centric IT infrastructure and cloud-hosted applications has become the norm. Yet a significant number of enterprises and small and mid-sized businesses (SMBs) continue to rely on Exchange Server.

Microsoft introduced this e-mail and calendaring server in 1996 and over time it has over time become ubiquitous in enterprises and small and mid-sized businesses (SMBs) alike.

While the rise of cloud computing brought alternatives like Microsoft 365 (formerly Office 365,) Exchange Server adapted by offering both on-premises and hybrid deployments.

Empowering control

In an operating environment of hyper interconnectivity and rapid software development, Exchange Server can offer tangible, hands-on control over sensitive data. And this has material value for organizations concerned about data sovereignty.

At the same time, rising digital complexity has given rise to unprecedented failure scenarios involving hardware, software and cloud-configuration lapses. These can lead to costly disruptions, data loss, not to mention  leave businesses wide-open exposure to criminal hackers.

Exchange server ordeal

Take what recently happened to iConnect Consulting, a San Francisco-based supplier of Laboratory Information Management System (LIMs) consulting services.

iConnect  faced a major disruption of its Exchange services, stemming from a corrupted RAID drive and extending into their backups. This rendered their Exchange databases “dirty,” posing a substantial threat to their data integrity. Exhaustive data recovery attempts using logs, databases and Exchange shell prompts proved futile.

The inability to recover email historic data in a timely manner put the company’s core operations at risk, affecting user satisfaction and potentially undermining its reputation.

This led iConnect to deploy Stellar Repair for Exchange Software, a specialized Exchange recovery tool designed to preserve Exchange Server folder structures and customizations while expediting the overall restoration process.

Stellar Repair for Exchange scans corrupt EDB files and recovers mailbox items, including emails, attachments, contacts, calendars, notes, tasks, journals, and public folders. It then can repair the exchange database in case of missing log files or any severe database corruption error.

The user interface is intuitive, making it accessible for users with varying levels of technical expertise. Recovered mailboxes can be exported directly to the live Exchange server, with minimal downtime, or even to Office 365, by establishing a connection through valid admin credentials.

Proactive management

Bhushan

While it is great to have a powerful data recovery tool, like Stellar Repair for Exchange, readily at hand, businesses today should also proactively manage Exchange Server risks springing from the rising digital complexity. Here are a few ‘dos:’

•Rigorous vulnerability management. Diligently apply the latest security patches and updates provided by Microsoft to protect against known Exchange Server vulnerabilities.

•Robust access control. Implement strong password policies and multi-factor authentication to prevent unauthorized access.

•Comprehensive monitoring. Employ continuous monitoring for suspicious activities and have a well-defined incident response plan ready to address any security breaches.

•Backup strategies. Encrypt sensitive data and maintain regular, secure backups to ensure data integrity and availability, even in the event of system failures or cyber attacks.

•User education: Regularly train employees on cybersecurity best practices, including recognizing phishing attempts and secure handling of sensitive information.

These practices are foundational for maintaining the security and operational integrity of Exchange Server environments.

About the essayist: Bharat Bhushan is technical marketer at Stellar Data Recovery. He is skilled in Microsoft Exchange Database, MSSQL Database troubleshooting and data warehousing.

Each of us has probably sat through some level of cybersecurity awareness training during our professional lives.

Related: Dangers of spoofed QR codes

Stop and think before you click on a link within an email from an unexpected source. Don’t re-use a password across multiple sites. Beware over-sharing personal information online, especially on social media platforms. All good advice!

When we sit back and think about the target audience for this training, much of this advice is designed to reach the busy or distracted employee who postpones laptop software updates or who copies sensitive or who copies proprietary information to a USB stick and takes it home.

Irresistible lure

This classic take-a-USB-stick-home scenario has been around for a couple of decades. The careless employee places the information on that stick at considerable risk of theft or even outright loss. But have you thought about the potential impact of an adversary introducing a USB stick to a curious employee?

Consider an employee who leaves the office or the house in the middle of the day to grab lunch somewhere nearby. They place their order, get their food, and because it’s a nice day, they grab a table outside.

But today’s lunch run has a new ingredient: a lonely, presumably lost USB stick sitting on the ground. Even better, there is an especially delicious label on the stick: “Upcoming RIF” or “Executive Strategy PPT” or “Post-Acquisition Plans?”

Dedicated adversaries

Smith

Sound far-fetched? Think about this from the perspective of the bad guys. Most companies have multiple IT/security layers of defense in place designed to keep bad actors out, and to prevent good actors inside the company from making mistakes. If a bad actor can’t get in through the front door, maybe there is some other way to initiate an attack.

Wouldn’t a dedicated adversary consider a location known to be visited by employees of the company they are targeting, like a nearby restaurant where many employees eat daily? Or how about a USB stick left at some other plausible location like a hotel or your local print shop?

The employee picks up the stick, carries it back into the office, and plugs it in. The malware installs itself to the now-infected laptop, and the attack is underway.

In most cases, determining how the malware gets onto one of your machines takes a back seat to remediating, or cleaning up, that infected machine. You need to put out that fire as quickly as you can, before that fire spreads across the network to other machines and servers.

Staged attacks

If there is any good news in this scenario, it’s this: most malware is designed to communicate back to the adversary at some stage of the cyberattack. Perhaps it needs to contact the mother ship which may have additional instructions or code for that malware to deliver.

That initial broadcast or beaconing message is often a simple one, announcing the equivalent of “I’ve been installed successfully, what’s the next step?” Or perhaps the malware has already completed its mission and is ready to send out or exfiltrate the information it has collected.

Ongoing forensics

It’s at this critical stage that comprehensive, real-time visibility across your environment is so important. Many organizations keep logs sourced from devices and applications scattered throughout their IT environment; depending on your industry, this may be a regulatory requirement. But logs are not nearly enough.

Mature organizations are also collecting and storing their network traffic for potential forensic use in support of a future investigation. It’s very powerful to be able to produce an authoritative answer to the question, “What network traffic was moving through this part of my infrastructure ten days ago?” Being able to “replay” that activity is often the only way to piece together what was actually happening as the attack rolled forward.

Factor this scenario into your awareness training, and more importantly, ensure that the visibility you have into your environment is not just a collection of logs. Network-level visibility is the highest-fidelity source available to you and your security team today. Only by seeing what’s on your network, both right now and from the recent past, can you detect and respond to real-time incidents in the fastest and most comprehensive way.

About the essayist: Ben Smith is Field Chief Technology Officer with NetWitness, a threat detection and response firm. His prior employers include RSA Security, UUNET, and the US Government, along with several technology startups.

Augmented reality (AR) and virtual reality (VR) technologies provide intriguing opportunities for immersive and interactive experiences in cybersecurity training.

Related: GenAI’ impact on DevSecOps

Here’s  how these technologies can bridge learning gaps in cybersecurity awareness and enhance the overall training experience.

AR and VR technologies can create distinct immersive experiences by merging digital reality with the physical world. Augmented reality lets users experience the world around them with digital images and audio-visual elements layered on top. This integration offers innovative ways for people to interact with their environment, enhancing their overall experience. Common examples of AR applications include the Pokemon Go mobile game and Snapchat filters.

Virtual reality also utilizes interactive audio-visual elements but within a computer-generated environment. These virtual worlds appear genuine, giving users a more immersive and holistic experience in their surroundings.

These industries are growing in popularity and demand. Research suggests there will be over 1.7 billion AR devices worldwide by 2024 — nearly three times the figure from 2020. The market has also grown by 1,600% since 2018, displaying an interest that shows no signs of slowing.

Improving best practices

Cybersecurity training entails teaching the procedures for mitigating and addressing risks to computer systems. Organizations conduct these sessions to bring participants up to speed on the cybersecurity threat landscape and develop their knowledge of best practices to secure sensitive data, assess risk levels, and report incidents.

Amos

In addition to providing essential knowledge, cybersecurity training encourages individual and team accountability. Everyone in the company is responsible for maintaining information security and applying protective measures in line with established policies.

The immersive nature of AR and VR technologies presents a number of opportunities to improve how people learn about and enforce cybersecurity.

Hands-on training

Incorporating AR and VR into learning creates an environment where participants can enjoy a hands-on experience, which is a great way to retain knowledge and develop skills. For example, security professionals can build cyberattack scenarios, designing the system to provide realistic feedback so participants better understand what to do if they encounter real-life threats.

AR and VR facilitate gamified learning — or using game elements to make learning more enjoyable. This approach encourages deeper engagement since participants interact with various features like leaderboards, achievement badges and actual games as part of their cybersecurity training.

PwC sets an excellent example of gamification in cybersecurity with its Game of Threats. It simulates real-world cyber breaches so participants can gain experience in making critical decisions to protect their companies.Personalized Learning

People are complex, with different learning preferences and aptitudes. Cybersecurity experts can utilize AR and VR  to tailor lessons based on individual learning needs.

For example, they can create and deploy customized projects using AR apps or VR headsets. Each participant will have a specific learning plan built around what they need to know and how they prefer to learn. This is not a new concept — 2021 research on using VR for personalized learning showed a strong positive correlation, resulting in improved student motivation and performance.

Potential drawbacks

While AR and VR have their advantages, there are also disadvantages. The most notable include:

•Technological issues: The risk of technical glitches, power outages, internet disruptions and the like are a huge challenge to successfully adopting immersive technology in cybersecurity training.

•Eye strain and discomfort: Using AR or VR devices for extended periods may cause eye strain and related symptoms.

•Potential for increased distraction: With so many interactive features at their disposal, it’s easy for participants to get distracted.

•Accessibility issues: Developing countries might encounter limited access to AR and VR equipment, making it considerably difficult to explore immersive learning.

Keeping these potential issues in mind when launching AR and VR cybersecurity training will provide trainees with the best experience possible.

AR and VR can help enhance cybersecurity awareness training by facilitating personalized, immersive learning experiences. As these tools become more pervasive among a wide range of applications, they will play a critical role in creating more engaging and efficient learning experiences.

About the essayist: Zac Amos writes about cybersecurity and the tech industry, and he is the Features Editor at ReHack. Follow him on Twitter or LinkedIn for more articles on emerging cybersecurity trends.

 

In today’s digital landscape, organizations face numerous challenges when it comes to mitigating cyber risks.

Related: How AI is transforming DevOps

The constant evolution of technology, increased connectivity, and sophisticated cyber threats pose significant challenges to organizations of all sizes and industries. Here are some of the key challenges that organizations encounter in their efforts to mitigate cyber risks in the current environment.

 •Rapidly evolving threat landscape. The threat landscape is constantly evolving, with cybercriminals coming up with new techniques and exploiting vulnerabilities. Organizations must stay ahead of these threats, but it can be challenging due to the dynamic nature of the cybersecurity landscape.

•Lack of security awareness and education. Often, employees within organizations lack sufficient security awareness and education. This lack of knowledge makes them susceptible to phishing attacks, social engineering, and other cyber threats.

Organizations need to invest in cybersecurity training programs to educate their employees about security best practices.

•Inadequate security testing. Many organizations rely solely on traditional penetration testing or security assessments performed at the end of the software development cycle. This reactive approach often fails to identify critical vulnerabilities early on, making it easier for attackers to exploit them.

DevSecOps encourages a shift-left approach, where security testing is integrated throughout the development process. By incorporating automated security testing tools and conducting regular code reviews, organizations can identify and remediate vulnerabilities in a timely manner.

•Legacy systems and dependencies. Legacy systems and dependencies pose a significant challenge for organizations. These systems may contain known vulnerabilities that are difficult to patch or update due to compatibility issues.

Moreover, outdated software components and libraries can introduce security risks into the overall system. Practical DevSecOps aproach promotes a proactive approach to managing dependencies and encourages the use of tools for vulnerability management and continuous integration, which can help identify and address these risks.

•Compliance and regulatory requirements. Organizations often struggle to meet regulatory and compliance requirements due to the complex and ever-changing nature of these standards. Failing to comply with these requirements can result in hefty fines and reputational damage. Implementing DevSecOps practices can help organizations stay compliant by embedding security controls into the development process, performing regular audits, and ensuring that security requirements are met throughout the software lifecycle.

Effective mitigation

To effectively mitigate cyber risks and address the challenges mentioned above, organizations can adopt the Practical DevSecOps approach. Practical DevSecOps integrates security practices into the software development process, embraces automation and continuous integration, and emphasizes collaboration between development, security, and operations teams.

By implementing Practical DevSecOps, organizations can:

•Identify and address vulnerabilities early in the development cycle.

•Promote security awareness and education among employees.

•Conduct regular security testing and code reviews.

•Manage dependencies and address vulnerabilities in software components.

•Ensure compliance with regulatory requirements.

•Improve overall security posture and reduce cyber risks.

For individuals looking to advance their careers in cybersecurity and demonstrate their proficiency in Practical DevSecOps, obtaining relevant certifications can provide a competitive edge.

Nugraha

Practical DevSecOps certifications validate a person’s skills and knowledge in implementing security practices throughout the software development lifecycle. Mitigating cyber risks in the current environment is challenging due to the rapidly evolvin threat landscape, lack of security awareness, inadequate security testing, legacy systems, and compliance requirements. However, by implementing DevSecOps practices, organizations can effectively address these challenges

About the essayist: Yuga Nugraha is abDevSecOps engineer who is focused on the research division exploring multiple topics including DevSecOps, Cloud Security, Cloud Native Security Container, Orchestration, IaC, CI/CD) and Supply Chain Security.

Professionals are constantly seeking ways to fortify their defenses against malicious threats. One approach gaining traction is the “assume-breach mindset.” This proactive approach is designed to better prepare organizations for inevitable security breaches.

Related: The case for proactive security

An assume-breach mindset is a cybersecurity strategy that flips the traditional security model. Rather than solely focusing on prevention, it assumes the attackers are already inside the network and prepares accordingly.

This mindset acknowledges that no system is completely invulnerable and the goal is to limit the damage once a breach occurs.

Pros

When it comes to cybersecurity, being prepared for the worst-case scenario is often the best strategy. Here are some advantages of dopting an assume-breach mindset:

•Early detection. Assume-breach focuses on the early detection of threats, allowing organizations to identify and respond to breaches more quickly.

•Risk mitigation. Data security has never been more critical and projections indicate that the data security market is expected to grow to $10.78 billion by 2028. By proactively preparing for breaches, organizations can reduce the potential impact and limit data exposure.

•Realistic perspective. It forces IT professionals to take a realistic view of their security posture and adapt to the evolving threat landscape.

•Enhanced preparedness. Organizations that adopt this mindset are better equipped to adapt to new attack vectors and evolving threat landscapes.

•Improved incident response. Assume-breach ensures the organizations have well-defined incident response plans, which are systematic step-by-step procedures implemented in case of a breach, streamlining the recovery process.

Cons

Amos

While it offers valuable advantages, it’s not without its challenges. Embracing this approach is resource-intensive and may introduce complexities. Here are some drawbacks of this mindset:

•Resource intensive. Preparing for potential breaches can be resource-intensive regarding time, effort and costs.

•Increased complexity. Adopting this mindset can make cybersecurity practices more complex, potentially overwhelming some organizations. A cyberattack happens very often, roughly every 39 seconds, and 43% of these attacks are aimed at small businesses.

•Overemphasis on detection. Over-reliance on detection can lead to neglecting the importance of prevention.

•Employee anxiety. Constantly operating in a state of preparedness can increase stress among IT professionals.

•Not a one-size-fits-all: This mindset may only be suitable for some organizations as its effectiveness varies depending on the specific security needs and resources available.

Other considerations

The decision to adopt an assume-breach mindset should be made after careful consideration of your organization’s unique circumstances. While it offers several benefits, it is not a one-size-fits-all solution. Here are some factors to consider:

•Organization size. Smaller organizations with limited resources may find it challenging to implement and maintain an assume-breach approach effectively.

•Industry and threat profile. Certain industries are more likely to be targeted by advanced threats. The assume-breach mindset may be more suitable for organizations in these sectors.

•Available resources. Assess organization’s capacity to invest in detection tools, incident response plans and employee training.

•Regulatory requirements. Some industries have stringent regulatory requirements that mandate a proactive security stance.

•Hybrid approach. Many organizations opt for a hybrid approach, combining aspects of both prevention and detection to strike a balance.

The assume-breach mindset represents a notable shift in cybersecurity strategy, offering a proactive and realistic approach to dealing with an increasingly complex threat landscape. IT professionals can make a well-informed decision about whether this mindset is the right path by thoroughly evaluating the benefits and drawbacks and considering the organization’s specific needs and capabilities.

About the essayist: Zac Amos writes about cybersecurity and the tech industry, and he is the Features Editor at ReHack. Follow him on Twitter or LinkedIn for more articles on emerging cybersecurity trends.

Most folks don’t realize that the Internet contributes more than 3.7 percent of global greenhouse gas emissions.

Related: Big data can foster improved healthcare

Within that, video represents over 80 percent of the traffic that flows through this global network which is growing rapidly at about 25 percent per year. A similar dynamic is taking place over enterprise networks, especially in the wake of the COVID-19 pandemic. A tremendous amount of video traffic is being managed by IT departments. This is why tracking the impact of digital video consumption across the business ecosystem is becoming increasingly important.

Meanwhile, the number of screens consumers use — at home and work — is also multiplying at an astonishing rate. With all these devices, there is an increase in video and encoders to handle the exploding demand for video content, driven by the growth of video-heavy social applications — TikTok and WhatsApp, to name but a few. These factors drive high demand for encoders and decoders.

It is in this context that it is important to focus on the details of video technology. Encoders, for instance, consume significantly more energy than decoders – sometimes as much as 5 to 10 times as much energy, in comparison.

In the past, there was an asynchronous relationship between these two categories of technology. Most video content was created — and encoded — by a much smaller percentage of the population compared to those who consumed – and therefore decoded video. Today, the gap between these two groups has narrowed significantly.

User-generated video content for professional and personal purposes has skyrocketed. As a result, we not only have more traffic flowing through public and private networks, but we also have much more original content generation taking place.

This is significantly elevating the carbon footprint of the video sector. As a result, industry executives are re-evaluating how to balance sustainability with the ever-growing corporate and consumer demand for video content.

This is why we — together as a video streaming community — must take responsible steps to initiate an effort to reduce the carbon footprint on the entire value chain of this industry.

Optimizing energy use

Carbon footprint assessment must encompass all direct and indirect emissions within the value chain. This should include everything from the extraction of raw materials, design, manufacturing, transportation, and even the final recycling of the devices. All key players will need to actively participate in reducing energy consumption across their stage of the ecosystem

Wetzel

Optimizing the energy consumption of each key player — and their products — can positively impact the planet. It can also be a good business practice, if done correctly, because it reduces costs for the key players in the long run. This makes it a win-win for everyone involved. In today’s market — across a growing number of geographic regions — environmentally optimized products and services are also more competitive. They reduce the raw material needed for production and consume less electricity upon deployment.

VITEC shares their commitments to sustainability and enlists their industry to join them. We’ve taken a leadership position in introducing a well-developed methodology, named GreenPEG, to move forward in a sustainable, measurable, and accountable manner. This involves the implementation of a comprehensive strategy including:

•Modern Facilities. In 2021, VITEC invested in photovoltaic panels and batteries to generate electricity for its manufacturing needs in three separate facilities in Germany, California and Georgia. In 2022, we built a facility in France that is up to the latest standards in energy efficiency and in 2023, the company has been working on upgrading  facilities in Scotland to include high-performance heat pumps.

•Streamlining Logistics. In 2022, VITEC moved its U.S. logistics center from the West Coast to the East Coast to consolidate and reduce the surface area of their supply chain. This means fewer trucks have to travel fewer miles to meet logistical needs. By the end of 2023, they plan to achieve a similar outcome in Europe by moving to a single logistics center.

•Embracing energy-efficient design principles. VITEC has integrated eco-friendly requirements into their design control process and architecture. This has had a major impact on hardware and software designs.

Software, for instance, is responsible for power management. Dynamically switching off — or into sleep mode — all hardware functions when not in use, can significantly reduce the impact on the overall energy consumption of products once they have been deployed into the market. One example is the VITEC SmartLink function for ChannelLink IP Gateways. This feature can monitor video streams and detect if one is no longer being used.

When this happens, the IP stream will automatically stop transmitting to save power. This showcases how to embrace energy-efficient design principles and illustrates how intelligent, sustainable software design directly impacts power consumption.

On the hardware front, VITEC selects the least-consuming components and designs for optimal power. This leads to more compact products, fewer raw materials, and less weight, reducing production and transportation costs

•Product recycling.  Whenever possible, VITEC uses raw materials with the best carbon footprints to ensure that the packaging and components on all products are easily recyclable.

•Implementing real-time energy monitoring and controls. VITEC will begin integrating real-time energy monitoring and reporting on any future products. This will allow customers to assess their products’ overall power consumption and therefore be able to select the best mode for any specific application.

These steps have contributed significantly to VITEC’s ability to minimize its carbon footprint. The rest have been offset by financing United Nations-approved projects.

More, however, needs to be done. It is not enough for a single company to engage in sustainability initiatives. An industry-wide effort is required. That is why VITEC is enlisting their key stakeholders, partner organizations, and even competitors to join them in creating sustainability initiatives across the entire ecosystem. The next step is to help guide the next video compression standard to ensure it is more eco-friendly and fast-enabled. To do so, VITEC assembling a consortium of industrial and academic partners. They want to extend an open invitation to any other organization willing to join them.:

About the essayist: Philippe Wetzel is Founder and CEO of VITEC, a supplier of IP video technology that converts and compresses raw video feeds into data formats that can be encrypted and streamed across the data networks that support military defence efforts. VITEC technologies are agnostic and highly efficient in terms of bandwidth utilization. This means video intelligence can easily be uncompressed, replayed, or recorded on any endpoint used by coalition partners across the different wireless networks in the field that support different data rates.

In cybersecurity, keeping digital threats at bay is a top priority. A new ally in this battle is robotic process automation (RPA.) This technology promises to simplify tasks, boost accuracy and quicken responses.

Related: Gen-A’s impact on DevSecOps

Robotic process automation is about getting repetitive, rule-based tasks done with the help of software robots, often called “bots.” These bots mimic human actions, handling tasks like data entry, retrieval and processing.

Automation matters in cybersecurity. RPA can be a lifesaver, freeing experts to focus on more complex security challenges.

Nine out of 10 employees want a single solution for their tasks. This emphasizes why automation is essential because it’s a way to make things more efficient and use human resources wisely. Here are some reasons why the role of automation is crucial in cybersecurity:

•Speed and accuracy: Cyber threats happen instantly and automation reacts quickly — much faster than humans. Bots can spot and deal with threats immediately, reducing the time systems are vulnerable.

•Handling vast data volumes: Nowadays, organizations deal with tons of data. Teams get flooded with logs and alerts. RPA processes massive amounts of data to find patterns and odd things humans might miss.

•Consistency and reliability: People can make mistakes, especially when doing the same thing repeatedly. Bots are like super reliable workers — they do tasks precisely as told, lowering the chance of costly errors.

•24/7 watch: Cyberattacks don’t care about work hours. They can happen anytime. Automation works 24/7, ensuring constant surveillance and quick responses even when humans are off the clock.

Implementation steps

Amos

Incorporating RPA into cybersecurity is crucial, especially with data breaches impacting 281.5 million people in the U.S. in 2021. Understanding cybersecurity laws and regulations is essential for securing and efficiently implementing RPA. Here is a strategic approach for introducing automation into the cybersecurity teams.

•Identify repetitive tasks. Begin by identifying repetitive tasks in existing operations. These tasks may include reviewing logs, managing incident reports or conducting routine scans.

•Ensure compatibility. Ensure the RPA solutions the team is considering can seamlessly integrate with the existing cybersecurity systems. Compatibility is crucial to avoid disruptions.

•Choose the right tool. Conduct thorough research to select an automation tool that aligns with the organization’s needs. Prioritize features such as scalability, security and analytical capabilities.

•Define objectives. Clearly define the team’s objectives for incorporating RPA into its existing strategy. Specify which tasks will be automated and explain how this will enhance efforts.

•Develop SOPs. Create detailed standard operating procedures (SOPs) that explain how automated tasks should be set up and operated. The SOPs will serve as the guiding documents.

•Train and test. Train the team on how to use and maintain RPA tools. Rigorously test the bots to ensure they perform tasks accurately and securely.

• Monitor and refine. Maintain vigilant oversight of the RPA operations to look for anomalies or issues actively. Continuously refine and improve bots to enhance their efficiency and effectiveness.

•Ensure compliance.Verify the RPA deployment complies with industry regulations and security standards. Regularly updating and strengthening RPA software will protect it against potential vulnerabilities.

•Seek human-machine harmony.Emphasize the importance of humans working alongside RPA. Automation should enhance human capabilities — not replace them — to ensure a harmonious cybersecurity strategy.

RPA is an excellent addition to the cybersecurity toolkit, offering the potential to streamline operations and improve overall security posture. The synergy between human expertise and RPA technology will be crucial in defending against cyber adversaries.

About the essayist: Zac Amos writes about cybersecurity and the tech industry, and he is the Features Editor at ReHack. Follow him on Twitter or LinkedIn for more articles on emerging cybersecurity trends.

Throughout 2023, we’ve witnessed numerous significant cyber incidents. One of the largest this year was the MOVEit breach, which impacted various state motor vehicle organizations and exposed driver’s license information for nearly 9.5 million individuals.

Related: The Golden Age of cyber espionage

We have also seen ransomware outbreaks at MGM and Caesar’s Casino, causing losses in the millions of dollars and targeted assaults on the healthcare sector, affecting over 11 million patients.

These attacks are leading to a record number of personally identifiable information posted on the Dark Web, a portion of the internet that is hidden and provides anonymity to its users. Many individuals are curious about the strategies employed by law enforcement agencies to monitor and respond to these threats.

Threat intel sharing

Law enforcement agencies depend on multiple channels to aid their efforts against cyber threats. The primary source is the affected organization or individual. Cybersecurity experts determine the required support level when a cyberattack is reported to a local law enforcement agency. Larger-scale attacks may involve collaboration with various federal agencies for assistance and resolution.

One notable agency is the Cybersecurity & Infrastructure Security Agency (CISA,) often recognized as “America’s Cyber Defense Agency,” which offers extensive resources to support local law enforcement in handling cyberattacks. Reporting these incidents, regardless of size, is crucial in proactively preventing similar cyberattacks for individuals and organizations.

Rogers

Reported attacks help build a threat intelligence feed that organizations and law enforcement agencies monitor worldwide. Threat intelligence information equip agencies with valuable resources, offering immediate or nearly immediate insights into emerging threats, vulnerabilities and cyberattacks. This early warning tool aids in the preparedness of organizations or individuals for an impending cyberattack.

Dark Web presence

Another source that law enforcement agencies monitor is the Dark Web, which has become a haven for illegal activities, allowing cybercrime enterprises to operate on underground forums and websites. Embedded cybercrime units within law enforcement closely track criminal and cyber gangs by tracing their actions on the dark web.

It’s worth noting that numerous attacks are initially reported on this platform, often before an organization becomes aware of the breach. By monitoring the dark web, law enforcement agencies can notify an organization that they may be a victim, allowing for possible incident response to stop the attack from spreading.

Law enforcement agencies also partner with private sector entities like Internet Service Providers (ISPs) and financial institutions to detect and monitor ongoing cyberthreats. ISPs have a critical function as they can observe the network traffic flowing through their systems and promptly report any identified malicious items.

Financial institutions report suspected cybercrime incidents to law enforcement agencies to assist with investigations and the possibility of recovering monetary funds lost during the incident.

Global cooperation

Lastly, one of the most significant partnerships agencies have is the collaboration with international partners. Global law enforcement agencies share information on recent attacks, trends and vulnerabilities. Because cyberattacks have no borders, partnering with other nations has proven to be a dependable source of valuable insights to combat cyber threats.

With the increasing number of cyberattacks worldwide, law enforcement agencies have come to a clear realization regarding the need for cybersecurity experts. These agencies are making considerable strides to strengthen their current cybercrime units by actively recruiting more professionals in the field. This recruitment drive aims to enhance their monitoring capabilities and response to cyberthreats.

One of the most fundamental actions an individual or organization can do to help law enforcement agencies is to report the incident. Fostering a collaborative and proactive relationship between individuals, organizations and law enforcement agencies in the battle against cybercrime is critical to ensure a safer online landscape for everyone.

About the essayist:  Demetrice Rogers, cybersecurity professional and adjunct professor at Tulane University’s School of Professional Advancement.

QR code phishing attacks started landing in inboxes around the world about six months ago.

Related: ‘BEC’ bilking on the rise

These attacks prompt the target to scan a QR code and trick them into downloading malware or sharing sensitive information.

In June, we started seeing these types of attacks amongst our customer base. Since June, there has been a fourfold increase in the search volume around keywords associated with these types of attacks.

Within the last week we have identified 655,0000 QR codes for our customers, of which 1,000 contained suspicious text and 8,000 came from a domain with a low rank (a freemail or a new email address, which are both flags for malicious senders). This is a true reflection of the attack landscape.

Scans slip through

These attacks are so successful because many traditional email security tools focus only on text-scanning, allowing image-based attacks to slip through. When attacks reach the inbox, users have a natural reaction to “scan the code,” assuming it’s legitimate.

When they do, many users don’t have any apprehensions around scanning QR codes because the assumption is that QR codes are legitimate. Also, users generally receive the email on their device but scan the QR code with their phone.

Mobile phones often don’t have the same level of corporate protections that desktops do. A lot of companies find themselves looking in the rear-view mirror post-compromise to see the anomalies detected like a new IP address/device that sent the attack email.

Lieberman

At this stage, companies should (at a minimum) educate their employees about the prevalence of these attacks, and the key things to look out for as the most basic form of protection against them. For example, users should know that Microsoft, Zoom, ZenDesk and other platforms will NEVER ask you to log in via QR code, which is something that users may often fall prey to.

Attacker friendly

Looking at hacker economics here, it is easy to understand why these attacks are so popular: they come with a low investment of cost and time, and they can be scaled up without much effort. In some cases, these attacks are also hard to detect. As a few examples:

•Secure email gateways pick up the first URL a QR code sends them to, but not the malicious redirect.

•Text can be embedded in the image of the QR code itself, which text based systems won’t pick up – Optical Character Recognition (OCR) is required.

Best practices

So how do you defend your enterprise against QR code phishing attacks?

The first step business leaders should take is determining if there is a legitimate use case for QR codes being used via email in their business. QR codes only make life easier if they don’t come with a side of malware, or a scam to steal information. Beyond that, here are a few best practices:

•Determine if the email contains a QR code and if it is from an untrusted sender or a sender with a low domain rank. Each company has to determine what they deem to be an “untrusted sender,” it can be a sender with a recently registered domain, a first-time sender to the user or a user that has not been seen across the company or the platform.

•Read QR codes to determine if text is hidden in an image that isn’t in text form, or extract and follow the URL to determine if it is malicious. In image-based attacks, images can be added to a deny list and emails containing anything similar can be blocked.

•With the QR code landscape evolving and new QR codes coming out constantly, attackers can keep iterating these attacks. A recent method involves a malicious QR code in PDF attachments. As such, it is important to not only scan text and images in the email body, but in attachments as well.

•Use tooling to determine if you hover over the QR code and get a redirect. If not, you’ll know that the code is not legitimate.

Staying on top of how these attacks evolve and ensuring that your defense mechanisms follow suit can feel like a full-time job. However, cloud email security providers can offer a series of defense mechanisms—from QR code scanning, to perceptual hashing, OCR-based detection and URL and behavioral analysis.

Tools and services are readily available to ensure these attacks don’t hit users inboxes in the first place, and have a fighting chance at being successful in their phishing attempts.

Make sure to always check the waters before you swim (or in this case, scan).

About the essayist: Allen Lieberman is the Chief Product Officer at Tessian. Prior to Tessian, Allen was at VMware Carbon Black for nearly a decade, where he held roles including Senior Director of Product Marketing and VP of Product Management.