Police disrupt Ragnarok operators and DDoS platforms, flaw in Microsoft MFA could allow bypass, and IT firms targeted via VSCode abuse.
The post The Good, the Bad and the Ugly in Cybersecurity – Week 50 appeared first on SentinelOne.
It's time to integrate the crucial data — Common Vulnerability Scoring System (CVSS) scores and other crucial information — from CISA's Vulnrichment program directly into the NVD. Centralize, streamline, and then focus on what really matters: runtime analysis of your applications.
Assume there’s been a breach, ditch the outdated tools, and get proactive with deep visibility and context-aware detection. Detect and block attacks before they even know what hit them.
Insight No. 3: Volunteers are noble, but they won't save us from the cyber apocalypseCybersecurity needs serious investment, not just spare time and good intentions. Time to step up with government funding, private sector muscle and global collaboration.
The post Cybersecurity Insights with Contrast CISO David Lindner | 12/13/24 appeared first on Security Boulevard.
The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.
Dive into six things that are top of mind for the week ending Dec. 13.
1 - FCC seeks tighter cyber regulations for telecomsU.S. telecommunications companies may have to comply with tougher cybersecurity regulations after at least eight of them got breached by Salt Typhoon, a cyber espionage group affiliated with the Chinese government.
“The attack underscores the urgent need for robust cybersecurity frameworks to protect against escalating threats targeting the telecommunications sector,” reads a fact sheet published by the U.S. Federal Communications Commission (FCC) this week.
Here are two key ways in which the FCC wants to tighten telecoms’ regulatory screws:
If FCC commissioners vote in favor of these two measures, the declaratory ruling would go into effect right away, while the cybersecurity compliance framework would be opened for public comment.
To get more details, read the FCC document, titled “Fact Sheet: Implications of Salt Typhoon Attack and FCC Response.”
For more information about the Salt Typhoon cyber espionage attacks against telecoms:
More cybersecurity complexity and workloads. An increase in cyberthreats. Thornier regulatory compliance. Understaffed cyber teams.
Those are the top factors making work more difficult for cybersecurity professionals, according to a report from Enterprise Strategy Group (ESG) and the Information Systems Security Association (ISSA).
“The Life and Times of Cybersecurity Professionals,” for which 369 IT and cybersecurity professionals were polled, found that 65% of respondents said cybersecurity work is harder today than it was two years ago.
Factors Making Cybersecurity Work More Difficult Than Two Years Ago
(Source: ““The Life and Times of Cybersecurity Professionals” by ESG and ISSA, December 2024)
Moreover, 57% of respondents said their job is stressful at least half the time, citing as the main reasons an overwhelming workload; disinterested business managers; IT initiatives launched without security oversight; and constant emergencies and disruptions.
So what can help strengthen cybersecurity professionals’ job satisfaction? These are the top five happiness boosters:
“Organizations with a strong cybersecurity culture that empower the CISO and collaborate with and support the cybersecurity staff can not only improve security efficacy and efficiency but also create a harmonious and healthy work environment for cybersecurity teams,” Jon Oltsik, ESG analyst emeritus and report author, said in a statement.
For more information about stress and burnout among cybersecurity pros:
The Center for Internet Security (CIS) has published a bunch of 2025 predictions from its cybersecurity experts. Here’s a small sampling.
For more information about some of these topics, check out these Tenable resources:
During two recent webinars about vulnerability management, we polled attendees about their involvement with patch management and about their plans for automating vulnerability remediation. Check out how they responded.
(232 webinar attendees polled by Tenable, December 2024)
(235 webinar attendees polled by Tenable, December 2024)
Watch the on-demand webinars to learn about the latest in Tenable Vulnerability Management and in Tenable Security Center.
5 - FBI spotlights financial fraudsters’ use of GenAICybercrooks are leveraging generative AI tools to sharpen financial fraud schemes against individuals and businesses, but there are ways to prevent becoming a victim.
That’s the message from the FBI in its new public service announcement titled “Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud.”
With generative AI tools, cybercriminals create believable text, images, videos and audio that seem legit, making it hard to detect financial fraud efforts, including romance scams, impersonation schemes and investment rackets.
For example, these tools allow a cybercriminal to clone voices of real people and create fake audio that sounds like them to use in phone calls. Similarly, generative AI lets scammers doctor real videos of, say, a CEO, and turn them into a clip of the CEO instructing an employee into transferring money to a fraudulent account.
To protect yourself in your personal life and at work from fraud attempts that use generative AI, FBI tips include:
For more information about the confluence of AI and financial cybercrime, including trends and prevention tips:
Software supply chain security is a key challenge for European Union member nations, requiring concerted risk assessments and the development of common policies.
So said the European Union Agency for Cybersecurity, better known as ENISA, in its “2024 Report on the State of Cybersecurity in the Union,” whose goal is to assess the cyber landscape in the EU and offer policy recommendations to strengthen cybersecurity in all 27 EU countries. Securing the software supply chain is one of the priority areas identified in the report.
Currently, hackers are continuously trying to insert malware into legitimate software updates that are then distributed to customers via trusted delivery channels. By 2030, attacks against software supply chains are expected to become the top emerging cybersecurity threat.
Right now, 74% of EU countries have legislation that defines supply chain security measures, a percentage expected to increase with new EU regulatory requirements. Meanwhile, 77% of digital service providers (DSP) and operators of essential services (OES) have a policy in place to manage third-party risk.
To shore up supply chain security, ENISA proposes “stepping up EU wide coordinated risk assessments and the development of an EU horizontal policy framework,” the report reads.
The report also tackles three other critical challenges: the cybersecurity skills gap; the management of cybersecurity crises; and the need for a coordinated approach to cybersecurity policy adoption.