Security News
In this year's Secureworks Threat Intelligence Report, the team will provide insights and findings generated by coupling the expertise of our research group with direct observations from a vast pool of customer telemetry and incident response engagements. It is my hope, as leader of this talented team of threat researchers, that you will be able to use this summary of what we have seen day in and day out to make your own organization safer from the threats that really matter.
At a time when enterprises are increasingly banking on digital ecosystems for their growth strategies, TCS' survey shows that only 16% of chief risk officers and chief information security officers ranked digital ecosystems as a concern when assessing expected cyber targets, and only 14% listed the risks from such ecosystems as the top priority arising out of board-level discussions. "Companies across the globe are increasingly turning to digital ecosystems of partners, vendors, and even competitors to reimagine and grow their business. Ignoring the threats originating from these ecosystems represents a blind spot which needs to be addressed urgently," said Santha Subramoni, Global Head, Cybersecurity, TCS. "One way of reducing the probability of an attack within digital supply chains is to implement a 'zero trust' policy-a framework based on the principle of 'never trust, always verify,' applied not only to humans but also machines."
Game publishing giant Bandai Namco has confirmed that they suffered a cyberattack that may have resulted in the theft of customers' personal data. This past Monday, the BlackCat ransomware operation claimed to have breached Bandai Namco and stolen corporate data during the attack.
Although guidance from the White House and CISA advising on this heightened risk for U.S. businesses and the increase in the proposed budget for cybersecurity within the federal government signals that more resources are needed to properly defend against these risks, this does not necessarily translate to more IT budget or security staff within most organizations in the private sector. Prioritizing the modernization of aging technology stacks will be essential to mitigate rising cybersecurity vulnerabilities and ensure the security of the organization's critical systems and applications from malicious cyber campaigns.
Some data discovery solutions give you only metadata, which is a good place to start, but comprehensive data classification based on sensitive content provides the additional context so you can focus on protecting what is important first. Volume: Data volumes in cloud environments are on the increase and hence the solution you pick needs to be able to handle large volumes of data and can scale itself up or down as needed to do both discovery and classification of the data.
Unidentified cyber threat actors have started using Brute Ratel C4, an adversary simulation tool similar to Cobalt Strike, to try to avoid detection by endpoint security solutions and gain a foothold on target networks, Palo Alto Networks researchers have found. Their line of attack is apparently successful, as one of the files delivering the Brute Ratel C4 "Badger" - a payload for remote access similar to Cobalt Strike's Beacon - has initially not been flagged as malicious by security tools leveraged by VirusTotal.
According to the US National Counterintelligence and Security Center, the U.S. is in a global quantum computing race, and China is winning. One emerging technology that could help combat the malicious use of quantum computing is confidential computing.
Whether it's through stolen credentials, phishing attacks, or simply user errors, people continue to pose the greatest risk to cybersecurity. While behavioral attacks are nothing new, Verizon's recently released Data Breach Investigations Report shows that it's as bad as ever, with 82% of breaches in the report involving a human element.
How would you describe the biggest security threat to your organization? Perhaps you envision a faceless cybercrime syndicate or hostile state. As SANS Institute senior instructor Lance Spitzner explains in this analysis of Verizon's latest Data Breach Incident Report, your biggest security threat is actually the humans you work with day in, day out.
PCI DSS is a global standard that provides a baseline of technical and operational requirements designed to protect account data. To provide organizations time to understand the changes in the new version and implement any updates needed, the current version of PCI DSS, 3.2.1, will remain active for two years until it is retired on 31 March 2024.