Category: Security Intelligence

AI reduces data breach lifecycles and costs

The cybersecurity tools you implement can make a difference in the financial future of your business. According to the 2023 IBM Cost of a Data Breach report, organizations using security AI and automation incurred fewer data breach costs compared to…

The rise of malicious Chrome extensions targeting Latin America

In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome…

How credential stuffing works (and how to stop it)

In December 2022, Norton users were put on high alert after threat actors compromised the security application with a credential-stuffing attack. Norton’s security team locked down about 925,000 accounts after detecting a suspicious flurry of login attempts from Norton Password…

QRadar SIEM reduces incident investigation time by 90%

Rising risk, long incident remediation times and high security costs — these things keep security professionals up at night. But SIEM can make a positive difference in all three, according to a recent report. Security information and event management (SIEM)…

Combining EPP and EDR tools can boost your endpoint security

Endpoint protection platform (EPP) and endpoint detection and response (EDR) tools are two security products commonly used to protect endpoint systems from threats. EPP is a comprehensive security solution that provides a range of features to detect and prevent threats…

What’s new in the 2023 Cost of a Data Breach report

Data breach costs continue to grow, according to new research, reaching a record-high global average of $4.45 million, representing a 15% increase over three years. Costs in the healthcare industry continued to top the charts, as the most expensive industry…

What to do about the rise of financial fraud

As our lives become increasingly digital, threat actors gain even more avenues of attack. With the average person spending about 400 minutes online, many scammers enjoy a heyday. Old impersonation scams continue to deceive people every day, as con artists…

X-Force certified containment: Responding to AD CS attacks

This post was made possible through the contributions of Joseph Spero and Thanassis Diogos. In June 2023, IBM Security X-Force responded to an incident where a client had received alerts from their security tooling regarding potential malicious activity originating from…

Cloud security in the era of artificial intelligence

AI and machine learning (ML) have revolutionized cloud computing, enhancing efficiency, scalability and performance. They contribute to improved operations through predictive analytics, anomaly detection and automation. However, the growing ubiquity and accessibility of AI also expose cloud computing to a…

The top 10 API security risks OWASP list for 2023

As more organizations rely on the automation and scale that web applications and connected services provide, application programming interface (API) security has become imperative. In just the last year alone, unique attackers targeting customer APIs grew by 400%, proving that…

Crypto fraud in 2023: How can security teams fight

Hackers stole $4.3 billion worth of cryptocurrency in 2022, making it the worst year on record for crypto fraud. While the government pushes for regulation in the digital coin market, cryptocurrency remains a volatile industry and a risky bet for…

Personal data vs. sensitive data: What is the difference?

In today’s digital age, a tidal wave of information travels across networks from user to user and device to device. Organizations rely on collecting and storing sensitive and personal information to perform business-critical operations, such as collecting credit card payments,…

CSC report: Space systems should be critical infrastructure

In 2013, Presidential Policy Directive (PPD) 21 established 16 critical infrastructure sectors responsible for providing essential services that underpin American society. These services are not only vital to the country’s safety and prosperity but are inherently tied to public confidence.…

SOAR and SIEM in 2023: Key Trends and New Changes

Security information and event management (SIEM) systems remain a key component of security operations centers (SOCs). Security orchestration, automation, and response (SOAR) frameworks, meanwhile, have emerged to fill the gap in these capabilities left by many SIEM systems. But as…

How Fraudsters Redefine Mobile Banking Account Takeovers

Fraudsters are constantly finding new ways to exploit vulnerabilities in the banking system, and one of the latest tactics involves stealing credit card information via mobile banking apps. This type of attack has been seen in different variations in Spain…

Is Open-Source Security a Ticking Cyber Time Bomb?

Software depends on layers of code, and much of that code comes from open-source libraries. According to an Octoverse 2022 report, open-source code is used in 97% of applications. Not only do developers embrace open source, but so do nine…

A Software Bill of Materials Helps Secure Your Supply Chain

The software supply chain involves developing, maintaining and distributing software to end users. To enhance the functionality of the software being developed, developers frequently depend upon open-source components and libraries. These can be sourced from external vendors like Docker images…

How Application Allowlisting Combats Ransomware Attacks

Ransomware attacks are on the rise in both volume and sophistication. Triple extortion (a ransomware attack on one business leading to extortion threats on its business partners) is raising the cost of attacks. Ransomware-as-a-Service puts the means to attack in…

The Trickbot/Conti Crypters: Where Are They Now?

Despite Conti shutdown, operators remain active and collaborative in new factions In IBM Security X-Force, we have been following the crypters used by the Trickbot/Conti syndicate, who we refer to as ITG23, since 2021 and demonstrated the intelligence that can…

Easy Configuration Fixes Can Protect Your Server from Attack

In March 2023, data on more than 56,000 people — including Social Security numbers and other personal information — was stolen in the D.C. Health Benefit Exchange Authority breach. The online health insurance marketplace hack exposed the personal details of Congress…

DevSecOps: Striking a Balance Between Speed and Security

The current fast-paced business environment demands quick delivery of new products and services, often at the expense of security. To address this, DevSecOps has emerged as a security-focused approach to software development that reconciles the trade-off between speed and security.…

Paying Ransomware’s Ransom: Why it’s Time to Reconsider

Each year, we continue our everlasting hope that ransomware attacks will disappear. The unfortunate reality is that ransomware is as prominent as ever. Experts predict that ransomware attacks will only become more frequent and sophisticated, posing an even greater threat…

A History of Ransomware and the Cybersecurity Ecosystem

The number and complexity of cybersecurity tools have grown at a dizzying pace in recent decades. As cyber threats like ransomware became more numerous and complex, antivirus and threat management tools expanded to meet these challenges. Security experts now often…

How Do Some Companies Get Compromised Again and Again?

Hack me once, shame on thee. Hack me twice, shame on me. The popular email marketing company, MailChimp, suffered a data breach last year after cyberattackers exploited an internal company tool to gain access to customer accounts. The criminals were…

Going Up! How to Handle Rising Cybersecurity Costs

The average cost of cybersecurity systems, solutions and staff is increasing. As noted by research firm Gartner, companies will spend 11% more in 2023 than they did in 2022 to effectively handle security and risk management. This puts companies in…

CISA’s Known Vulnerabilities Impact 15M Public Services

CISA’s Known Exploited Vulnerabilities (KEV) catalog is the authoritative source of information on past or currently exploited vulnerabilities. In a new report, the Rezilion research team analyzed vulnerabilities in the current KEV catalog. The results revealed a whopping 15 million…

Merging DevOps and SecOps is a Great Idea: Get Started Now

In the past, developers created the software, and security teams made it secure. But now, agile organizations are baking security into software from the very start. DevSecOps (development, security and operations) is a framework designed to automate security integration during…

Security Awareness Training 101: Which Employees Need It?

To understand why you need cybersecurity awareness training, you must first understand employees’ outsized roles in security breaches. “People remain — by far — the weakest link in an organization’s cybersecurity defenses,” noted Verizon on the release of their 2022…

Personal Data vs. Sensitive Data: What Is the Difference?

In today’s digital age, information is being transmitted across various platforms and networks, passed from user to user and device to device. Organizations rely on collecting and storing sensitive and personal information to perform business-critical operations, such as collecting credit…

Secure-by-Design: Which Comes First, Code or Security?

For years, developers and IT security teams have been at loggerheads. While developers feel security slows progress, security teams assert that developers sacrifice security priorities in their quest to accelerate production. This disconnect results in flawed software that is vulnerable…

Detecting Insider Threats: Leverage User Behavior Analytics

Employees often play an unwitting role in many security incidents, from accidental data breaches to intentional malicious attacks. Unfortunately, most organizations don’t have the right protocols and processes to identify potential risks posed by their workforce. Based on a survey…

Increasingly Sophisticated Cyberattacks Target Healthcare

It’s rare to see 100% agreement on a survey. But Porter Research found consensus from business leaders across the provider, payer and pharmaceutical/life sciences industries. Every single person agreed that “growing hacker sophistication” is the primary driver behind the increase…

Machine Learning Applications in the Cybersecurity Space

Machine learning is one of the hottest areas in data science. This subset of artificial intelligence allows a system to learn from data and make accurate predictions, identify anomalies or make recommendations using different techniques. Machine learning techniques extract information…

Now Social Engineering Attackers Have AI. Do You?

Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code.  The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code…

How I Got Started: White Hat Hacker

White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping…

Heads Up CEO! Cyber Risk Influences Company Credit Ratings

More than ever, cybersecurity strategy is a core part of business strategy. For example, a company’s cyber risk can directly impact its credit rating.  Credit rating agencies continuously strive to gain a better understanding of the risks that companies face.…

CISA, NSA Issue New IAM Best Practice Guidelines

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) recently released a new 31-page document outlining best practices for identity and access management (IAM) administrators.  As the industry increasingly moves towards cloud and hybrid computing environments,…

6 Ways to Mitigate Risk While Expanding Access

The World Economic Forum recently published a list of trends that are likely to shape the future of cybersecurity by 2030. The article names “progress in cybersecurity, but access must be widened” as a top trend. If these two goals seem…

NIST Launches Cybersecurity Initiative for Small Businesses

For small organizations, the current cyber threat landscape is brutal. While big-name breaches steal the headlines, small businesses suffer the most from ransomware attacks. Additionally, other studies reveal that only half of all small businesses are prepared for a cyberattack.…

Educating Your Board of Directors on Cybersecurity

Many, if not the majority of, big decisions at organizations come from the boardroom. Typically, the board of directors focuses on driving the direction of the company. Because most boards approve yearly budgets, they have significant oversight of resources and…

Is Patching the Holy Grail of Cybersecurity?

A proactive approach to cybersecurity includes ensuring all software is up-to-date across assets. This also includes applying patches to close up vulnerabilities. This practice minimizes risk, as it eliminates outdated software versions in the process. Does this make patching a…

Do You Really Need a CISO?

Cybersecurity has never been more challenging or vital. Every organization needs strong leadership on cybersecurity policy, procurement and execution — such as a CISO, or chief information security officer.  A CISO is a senior executive in charge of an organization’s…

Can Large Language Models Boost Your Security Posture?

The threat landscape is expanding, and regulatory requirements are multiplying. For the enterprise, the challenges just to keep up are only mounting. In addition, there’s the cybersecurity skills gap. According to the (ISC)2 2022 Cybersecurity Workforce Study, the global cybersecurity…

Today’s Biggest Threats Against the Energy Grid

Without the U.S. energy grid, life as we know it simply grinds to a halt. Businesses can’t serve customers. Homes don’t have power. Traffic lights no longer work. We depend on the grid operating reliably each and every day for…

SaaS vs. On-Prem Data Security: Which is Right for You?

As businesses increasingly rely on digital data storage and communication, the need for effective data security solutions has become apparent. These solutions can help prevent unauthorized access to sensitive data, detect and respond to security threats and ensure compliance with…

How I Got Started: Offensive Security

In the high-stakes world of cybersecurity, offensive security experts play a pivotal role in identifying and mitigating potential threats. These professionals, sometimes referred to as “ethical hackers”, use their skills to probe networks and systems in search of vulnerabilities, ultimately…

Understanding the Backdoor Debate in Cybersecurity

Unexpected end tag : p The debate over whether backdoor encryption should be implemented to aid law enforcement has been contentious for years. On one side of the fence, the proponents of backdoors argue that they could provide valuable intelligence…

Is Your Cybersecurity “Too” Good?

Emphatically, no, it isn’t. But now that we have your attention, is that even the right question? Probably not. Your security can never truly be “too good”; conversely, neither can it be “too poor,” though it is possible to have…

The Biden Administration’s 2023 Cybersecurity Strategy

The Biden Administration recently introduced a new national cybersecurity strategy, expected to aggressively address an increasingly complex and dangerous threat landscape. Improving cybersecurity may not be the top priority for the Biden Administration, but it is an issue that the…

How the ZeuS Trojan Info Stealer Changed Cybersecurity

Information stealer malware is a type of malicious software designed to collect sensitive information from a victim’s computer. Also known as info stealers, data stealers or data-stealing malware, this software is true to its name: after infecting a computer or…

Is Your Critical SaaS Data Secure?

Increasingly sophisticated adversaries create a significant challenge as organizations increasingly use Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) to deliver applications and services. This mesh of cloud-based applications and services creates new complexities for security teams. But attackers need only…

Rationalizing Your Hybrid Cloud Security Tools

As cyber incidents rise and threat landscapes widen, more security tools have emerged to protect the hybrid cloud ecosystem. As a result, security leaders must rapidly assess their hybrid security tools to move toward a centralized toolset and optimize cost…

How Morris Worm Command and Control Changed Cybersecurity

A successful cyberattack requires more than just gaining entry into a victim’s network. To truly reap the rewards, attackers must maintain a persistent presence within the system. After establishing communication with other compromised network devices, actors can stealthily extract valuable…

How I Got Started: SOC Analyst

The role of a Security Operations Center (SOC) analyst is crucial in maintaining an organization’s security posture. A SOC analyst wears many hats but typically acts as a watchdog looking out for attacks in progress while also finding ways to…

Zero Trust Data Security: It’s Time To Make the Shift

How do you secure something that no longer exists? With the rapid expansion of hybrid-remote work, IoT, APIs and applications, any notion of a network perimeter has effectively been eliminated. Plus, any risk inherent to your tech stack components becomes…

What Comes After the Digital Transformation?

When Covid hit, companies had to accelerate their digital transformation process out of necessity. But now, almost three years after the initial shutdown, most organizations have embraced digital to the point where they are now maintaining new technologies rather than…

Reach Out to Peers and Vendors to Build Your Security

Cyberattacks don’t happen in a vacuum. While your organization may be specifically targeted by cybercriminals, the style of attack they are using isn’t unique to you. It’s one they will use over and over, especially if it is successful, and…

Leveraging SaaS Data Security and Compliance Tools

Data breaches are a risk that every business has to prepare for. To mitigate potential risks like the loss of sensitive information, financial impact and reputational damage, organizations need to take a proactive approach to protect their data and comply…

How Cyber Insurance Changed Cybersecurity

When cyber insurance first became available in the 1990s, there wasn’t much need for it — or at least, so people thought. The internet as we know it today was still in its infancy, and most organizations didn’t see the…

The Needs of a Modernized SOC for Hybrid Cloud

Cybersecurity has made a lot of progress over the last ten years. Improved standards (e.g., MITRE), threat intelligence, processes and technology have significantly helped improve visibility, automate information gathering (SOAR) and many manual tasks. Additionally, new analytics (UEBA/SIEM) and endpoint…

How the Talent Shortage Impacts Cybersecurity Leadership

The lack of a skilled cybersecurity workforce stalls the effectiveness of any organization’s security program. Yes, automated tools and technologies like artificial intelligence (AI) and machine learning (ML) offer a layer of support, and bringing in a managed security service…

Security at the Masters

The Masters is known for its many timeless traditions. The azaleas of Amen Corner. The Green Jacket. The pimento cheese sandwiches. But there’s also a modern twist with the way the Masters uses data as the foundation of its digital…

The Importance of Accessible and Inclusive Cybersecurity

As the digital world continues to dominate our personal and work lives, it’s no surprise that cybersecurity has become critical for individuals and organizations. But society is racing toward “digital by default”, which can be a hardship for individuals unable…

Secure-by-Design: A 2023 Cybersecurity Prime

The traditional approach to security has been to get the product to market fast and worry about security later. Unfortunately, that approach has never really worked. It puts too much of the cybersecurity responsibilities on the customer and leaves many…