Tag: Security Intelligence

SOAR and SIEM in 2023: Key Trends and New Changes

Security information and event management (SIEM) systems remain a key component of security operations centers (SOCs). Security orchestration, automation, and response (SOAR) frameworks, meanwhile, have emerged to fill the gap in these capabilities left by many SIEM systems. But as…

How Fraudsters Redefine Mobile Banking Account Takeovers

Fraudsters are constantly finding new ways to exploit vulnerabilities in the banking system, and one of the latest tactics involves stealing credit card information via mobile banking apps. This type of attack has been seen in different variations in Spain…

Is Open-Source Security a Ticking Cyber Time Bomb?

Software depends on layers of code, and much of that code comes from open-source libraries. According to an Octoverse 2022 report, open-source code is used in 97% of applications. Not only do developers embrace open source, but so do nine…

A Software Bill of Materials Helps Secure Your Supply Chain

The software supply chain involves developing, maintaining and distributing software to end users. To enhance the functionality of the software being developed, developers frequently depend upon open-source components and libraries. These can be sourced from external vendors like Docker images…

How Application Allowlisting Combats Ransomware Attacks

Ransomware attacks are on the rise in both volume and sophistication. Triple extortion (a ransomware attack on one business leading to extortion threats on its business partners) is raising the cost of attacks. Ransomware-as-a-Service puts the means to attack in…

The Trickbot/Conti Crypters: Where Are They Now?

Despite Conti shutdown, operators remain active and collaborative in new factions In IBM Security X-Force, we have been following the crypters used by the Trickbot/Conti syndicate, who we refer to as ITG23, since 2021 and demonstrated the intelligence that can…

Easy Configuration Fixes Can Protect Your Server from Attack

In March 2023, data on more than 56,000 people — including Social Security numbers and other personal information — was stolen in the D.C. Health Benefit Exchange Authority breach. The online health insurance marketplace hack exposed the personal details of Congress…

DevSecOps: Striking a Balance Between Speed and Security

The current fast-paced business environment demands quick delivery of new products and services, often at the expense of security. To address this, DevSecOps has emerged as a security-focused approach to software development that reconciles the trade-off between speed and security.…

Paying Ransomware’s Ransom: Why it’s Time to Reconsider

Each year, we continue our everlasting hope that ransomware attacks will disappear. The unfortunate reality is that ransomware is as prominent as ever. Experts predict that ransomware attacks will only become more frequent and sophisticated, posing an even greater threat…

A History of Ransomware and the Cybersecurity Ecosystem

The number and complexity of cybersecurity tools have grown at a dizzying pace in recent decades. As cyber threats like ransomware became more numerous and complex, antivirus and threat management tools expanded to meet these challenges. Security experts now often…

How Do Some Companies Get Compromised Again and Again?

Hack me once, shame on thee. Hack me twice, shame on me. The popular email marketing company, MailChimp, suffered a data breach last year after cyberattackers exploited an internal company tool to gain access to customer accounts. The criminals were…

Going Up! How to Handle Rising Cybersecurity Costs

The average cost of cybersecurity systems, solutions and staff is increasing. As noted by research firm Gartner, companies will spend 11% more in 2023 than they did in 2022 to effectively handle security and risk management. This puts companies in…

CISA’s Known Vulnerabilities Impact 15M Public Services

CISA’s Known Exploited Vulnerabilities (KEV) catalog is the authoritative source of information on past or currently exploited vulnerabilities. In a new report, the Rezilion research team analyzed vulnerabilities in the current KEV catalog. The results revealed a whopping 15 million…

Merging DevOps and SecOps is a Great Idea: Get Started Now

In the past, developers created the software, and security teams made it secure. But now, agile organizations are baking security into software from the very start. DevSecOps (development, security and operations) is a framework designed to automate security integration during…

Security Awareness Training 101: Which Employees Need It?

To understand why you need cybersecurity awareness training, you must first understand employees’ outsized roles in security breaches. “People remain — by far — the weakest link in an organization’s cybersecurity defenses,” noted Verizon on the release of their 2022…

Personal Data vs. Sensitive Data: What Is the Difference?

In today’s digital age, information is being transmitted across various platforms and networks, passed from user to user and device to device. Organizations rely on collecting and storing sensitive and personal information to perform business-critical operations, such as collecting credit…

Secure-by-Design: Which Comes First, Code or Security?

For years, developers and IT security teams have been at loggerheads. While developers feel security slows progress, security teams assert that developers sacrifice security priorities in their quest to accelerate production. This disconnect results in flawed software that is vulnerable…

Detecting Insider Threats: Leverage User Behavior Analytics

Employees often play an unwitting role in many security incidents, from accidental data breaches to intentional malicious attacks. Unfortunately, most organizations don’t have the right protocols and processes to identify potential risks posed by their workforce. Based on a survey…

Increasingly Sophisticated Cyberattacks Target Healthcare

It’s rare to see 100% agreement on a survey. But Porter Research found consensus from business leaders across the provider, payer and pharmaceutical/life sciences industries. Every single person agreed that “growing hacker sophistication” is the primary driver behind the increase…

Machine Learning Applications in the Cybersecurity Space

Machine learning is one of the hottest areas in data science. This subset of artificial intelligence allows a system to learn from data and make accurate predictions, identify anomalies or make recommendations using different techniques. Machine learning techniques extract information…

Now Social Engineering Attackers Have AI. Do You?

Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code.  The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code…

How I Got Started: White Hat Hacker

White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping…

Heads Up CEO! Cyber Risk Influences Company Credit Ratings

More than ever, cybersecurity strategy is a core part of business strategy. For example, a company’s cyber risk can directly impact its credit rating.  Credit rating agencies continuously strive to gain a better understanding of the risks that companies face.…

CISA, NSA Issue New IAM Best Practice Guidelines

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) recently released a new 31-page document outlining best practices for identity and access management (IAM) administrators.  As the industry increasingly moves towards cloud and hybrid computing environments,…

6 Ways to Mitigate Risk While Expanding Access

The World Economic Forum recently published a list of trends that are likely to shape the future of cybersecurity by 2030. The article names “progress in cybersecurity, but access must be widened” as a top trend. If these two goals seem…

NIST Launches Cybersecurity Initiative for Small Businesses

For small organizations, the current cyber threat landscape is brutal. While big-name breaches steal the headlines, small businesses suffer the most from ransomware attacks. Additionally, other studies reveal that only half of all small businesses are prepared for a cyberattack.…

Educating Your Board of Directors on Cybersecurity

Many, if not the majority of, big decisions at organizations come from the boardroom. Typically, the board of directors focuses on driving the direction of the company. Because most boards approve yearly budgets, they have significant oversight of resources and…

Is Patching the Holy Grail of Cybersecurity?

A proactive approach to cybersecurity includes ensuring all software is up-to-date across assets. This also includes applying patches to close up vulnerabilities. This practice minimizes risk, as it eliminates outdated software versions in the process. Does this make patching a…

Do You Really Need a CISO?

Cybersecurity has never been more challenging or vital. Every organization needs strong leadership on cybersecurity policy, procurement and execution — such as a CISO, or chief information security officer.  A CISO is a senior executive in charge of an organization’s…

Can Large Language Models Boost Your Security Posture?

The threat landscape is expanding, and regulatory requirements are multiplying. For the enterprise, the challenges just to keep up are only mounting. In addition, there’s the cybersecurity skills gap. According to the (ISC)2 2022 Cybersecurity Workforce Study, the global cybersecurity…

Today’s Biggest Threats Against the Energy Grid

Without the U.S. energy grid, life as we know it simply grinds to a halt. Businesses can’t serve customers. Homes don’t have power. Traffic lights no longer work. We depend on the grid operating reliably each and every day for…

SaaS vs. On-Prem Data Security: Which is Right for You?

As businesses increasingly rely on digital data storage and communication, the need for effective data security solutions has become apparent. These solutions can help prevent unauthorized access to sensitive data, detect and respond to security threats and ensure compliance with…

How I Got Started: Offensive Security

In the high-stakes world of cybersecurity, offensive security experts play a pivotal role in identifying and mitigating potential threats. These professionals, sometimes referred to as “ethical hackers”, use their skills to probe networks and systems in search of vulnerabilities, ultimately…

Understanding the Backdoor Debate in Cybersecurity

Unexpected end tag : p The debate over whether backdoor encryption should be implemented to aid law enforcement has been contentious for years. On one side of the fence, the proponents of backdoors argue that they could provide valuable intelligence…

Is Your Cybersecurity “Too” Good?

Emphatically, no, it isn’t. But now that we have your attention, is that even the right question? Probably not. Your security can never truly be “too good”; conversely, neither can it be “too poor,” though it is possible to have…

The Biden Administration’s 2023 Cybersecurity Strategy

The Biden Administration recently introduced a new national cybersecurity strategy, expected to aggressively address an increasingly complex and dangerous threat landscape. Improving cybersecurity may not be the top priority for the Biden Administration, but it is an issue that the…

How the ZeuS Trojan Info Stealer Changed Cybersecurity

Information stealer malware is a type of malicious software designed to collect sensitive information from a victim’s computer. Also known as info stealers, data stealers or data-stealing malware, this software is true to its name: after infecting a computer or…

Is Your Critical SaaS Data Secure?

Increasingly sophisticated adversaries create a significant challenge as organizations increasingly use Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) to deliver applications and services. This mesh of cloud-based applications and services creates new complexities for security teams. But attackers need only…

Rationalizing Your Hybrid Cloud Security Tools

As cyber incidents rise and threat landscapes widen, more security tools have emerged to protect the hybrid cloud ecosystem. As a result, security leaders must rapidly assess their hybrid security tools to move toward a centralized toolset and optimize cost…

How Morris Worm Command and Control Changed Cybersecurity

A successful cyberattack requires more than just gaining entry into a victim’s network. To truly reap the rewards, attackers must maintain a persistent presence within the system. After establishing communication with other compromised network devices, actors can stealthily extract valuable…

How I Got Started: SOC Analyst

The role of a Security Operations Center (SOC) analyst is crucial in maintaining an organization’s security posture. A SOC analyst wears many hats but typically acts as a watchdog looking out for attacks in progress while also finding ways to…

Zero Trust Data Security: It’s Time To Make the Shift

How do you secure something that no longer exists? With the rapid expansion of hybrid-remote work, IoT, APIs and applications, any notion of a network perimeter has effectively been eliminated. Plus, any risk inherent to your tech stack components becomes…

What Comes After the Digital Transformation?

When Covid hit, companies had to accelerate their digital transformation process out of necessity. But now, almost three years after the initial shutdown, most organizations have embraced digital to the point where they are now maintaining new technologies rather than…

Reach Out to Peers and Vendors to Build Your Security

Cyberattacks don’t happen in a vacuum. While your organization may be specifically targeted by cybercriminals, the style of attack they are using isn’t unique to you. It’s one they will use over and over, especially if it is successful, and…

Leveraging SaaS Data Security and Compliance Tools

Data breaches are a risk that every business has to prepare for. To mitigate potential risks like the loss of sensitive information, financial impact and reputational damage, organizations need to take a proactive approach to protect their data and comply…

How Cyber Insurance Changed Cybersecurity

When cyber insurance first became available in the 1990s, there wasn’t much need for it — or at least, so people thought. The internet as we know it today was still in its infancy, and most organizations didn’t see the…

The Needs of a Modernized SOC for Hybrid Cloud

Cybersecurity has made a lot of progress over the last ten years. Improved standards (e.g., MITRE), threat intelligence, processes and technology have significantly helped improve visibility, automate information gathering (SOAR) and many manual tasks. Additionally, new analytics (UEBA/SIEM) and endpoint…

How the Talent Shortage Impacts Cybersecurity Leadership

The lack of a skilled cybersecurity workforce stalls the effectiveness of any organization’s security program. Yes, automated tools and technologies like artificial intelligence (AI) and machine learning (ML) offer a layer of support, and bringing in a managed security service…

Security at the Masters

The Masters is known for its many timeless traditions. The azaleas of Amen Corner. The Green Jacket. The pimento cheese sandwiches. But there’s also a modern twist with the way the Masters uses data as the foundation of its digital…

The Importance of Accessible and Inclusive Cybersecurity

As the digital world continues to dominate our personal and work lives, it’s no surprise that cybersecurity has become critical for individuals and organizations. But society is racing toward “digital by default”, which can be a hardship for individuals unable…

Secure-by-Design: A 2023 Cybersecurity Prime

The traditional approach to security has been to get the product to market fast and worry about security later. Unfortunately, that approach has never really worked. It puts too much of the cybersecurity responsibilities on the customer and leaves many…

Embracing Automation to Unlock New Innovations

My entire career has been driven by automation. I learned early on that automating repetitive tasks using simple scripts allowed me more time to focus on exciting challenges. If I did anything more than twice, I would ask myself if…

How Zero Trust Changed the Course of Cybersecurity

For decades, the IT industry relied on perimeter security to safeguard critical digital assets. Firewalls and other network-based tools monitored and validated network access. However, the shift towards digital transformation and hybrid cloud infrastructure has made these traditional security methods…

Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor

This blog was made possible through contributions from Christopher Caridi.  IBM Security X-Force recently discovered a new malware family we have called “Domino,” which we assess was created by developers associated with the cybercriminal group that X-Force tracks as ITG14,…

Detection Methods: Do You Know Where Your Credentials are?

Information-stealing malware has become extremely pervasive in recent years. This malware harvests millions of credentials annually from endpoint devices and enterprises across the globe to devastating effects.  Using highly automated and orchestrated attack methods, threat actors and initial access brokers…

2022 Industry Threat Recap: Energy

In 2022, 10.7% of observed cyberattacks targeted the energy industry, according to the X-Force Threat Intelligence Index 2023. This puts energy in fourth place overall — the same as the year prior and behind manufacturing, finance and insurance and professional…

Can Zero-Knowledge Proofs Save Cryptocurrency?

Blockchain has transformed many industries, from healthcare to real estate to banking. But despite the “unhackable” hype, flaws in Blockchain technology undeniably weaken its goals of bringing greater security, transparency and privacy to the world. Between January and November 2022,…

Four Ways to Harden Your Network Perimeter

With the threat of cyberattacks on the rise worldwide, hardening your organization’s network perimeter has never been more critical. Many organizations have begun to focus more on actively securing and monitoring their externally facing assets to fend off cyberattacks from…

How to Provide Relevant Threat Intelligence

In the evolution of cybersecurity, the threat landscape is ever-changing while the line of defense is ever-shrinking. Security professionals started with securing the perimeters, but now we need to assume a breach in a zero-trust environment. However, providing intelligence to…

How LockBit Changed Cybersecurity Forever

In every industry, visionaries drive progress and innovation. Some call these pioneers “crazy”. The same rule applies to the world of cyber gangs. Most threat groups try to maintain a low profile. They don’t seem to trust anyone and want…

Using a Private Version of ChatGPT as an Enabler for Risk and Compliance

Organizations face many challenges regarding cybersecurity, including keeping up with the ever-evolving threat landscape and complying with regulatory requirements. In addition, the cybersecurity skill shortage makes it more difficult for organizations to adequately staff their risk and compliance functions. According…

Using ChatGPT as an Enabler for Risk and Compliance

Organizations face many challenges regarding cybersecurity, including keeping up with the ever-evolving threat landscape and complying with regulatory requirements. In addition, the cybersecurity skill shortage makes it more difficult for organizations to adequately staff their risk and compliance functions. According…

How to Defend Against Extortion Groups Like Lapsus$

The hacker group Lapsus$ (sometimes referred to as LAPSUS$ or simply Lapsus) is a relatively newer organization in the cyber arena. The group began to garner public attention in December 2021 after some successful attacks on major corporations, where even…

X-Force Identifies Vulnerability in IoT Platform

The last decade has seen an explosion of IoT devices across a multitude of industries. With that rise has come the need for centralized systems to perform data collection and device management, commonly called IoT Platforms. One such platform, ThingsBoard,…

Locks, Stocks and Brokers: Hackers and Insider Trading

On February 14, 2023, a Russian national and owner of Moscow cybersecurity firm M-13 was found guilty of wire fraud, securities fraud and conspiracy to obtain unauthorized access to computers. Vladislav Klyushin was charged along with four other men —…

The Important Role of SOAR in Cybersecurity

Understaffed security teams need all the help they can get, and they are finding that help through SOAR. SOAR — security orchestration, automation and response — is defined by Gartner as the “technologies that enable organizations to collect inputs monitored…