The Digital Insider | Category: Digital Security

5 ways generative AI will impact CISOs & cyber security teams – CyberTalk

EXECUTIVE SUMMARY:

Enterprises and individuals have adopted generative AI at an extremely impressive rate. In 2024, generative AI is projected to reach 77.8 million users worldwide — an adoption rate of more than double that of smartphones and tablets across a comparable time frame.

While the integration of generative AI into work environments offers coveted agility and productivity gains, such benefits remain tenuous without the right workforce (and societal) structures in-place to support AI-driven growth.

It nearly goes without saying — Generative AI introduces a new layer of complexity into organizational systems. Effective corresponding workplace transformation — one that enables people to use generative AI for efficiency and productivity gains — depends on our abilities to secure it, secure our people, and secure our processes.

In the second half of 2024, CISOs and cyber security teams can facilitate the best possible generative AI-based business outcomes by framing discussions and focal points around the following:

5 ways generative AI will impact CISOs and security teams

1. Expanded responsibilities. It should have been written on a neon sign…Generative AI will add new ‘to-dos’ to CISOs’ (already extensive) list of responsibilities. Only 9% of CISOs say that they are currently prepared to manage the risks associated with generative AI.

New generative AI-related responsibilities will involve dealing with data security and privacy, access control, model integrity and security, and user training, among other things.

2. AI governance. As generative AI’s footprint expands within enterprises, cyber security leaders must develop comprehensive governance frameworks to mitigate corresponding risks.

This includes addressing the potential for “shadow generative AI,” referring to the unsanctioned use of generative AI tooling. Shadow generative AI poses challenges that parallel those associated with shadow IT.

To build a strategic AI governance plan for your organization, start with an assessment of your organization’s unique needs and generative AI use-cases.

3. User training. Successful AI governance hinges on effective user awareness and training initiatives. Currently, only 17% of organizations have fully trained their teams on the risks around generative AI.

Prioritize generative AI awareness programs, as to communicate acceptable and unacceptable use-cases. This ultimately minimizes the potential for painful cyber security stumbles.

4. The dual-use dilemma. This concept refers to the notion that generative AI technologies can be applied for both beneficial and malicious gain.

The overwhelming majority of CISOs (70%) believe that generative AI will lead to an imbalance in “firepower,” enabling the cyber criminals to wreak havoc on organizations at an unprecedented rate.

Will AI-generated phishing emails achieve a higher click-through rates and perpetuate a high volume of attacks? No one knows. In the interim, CISOs are advised to proactively update and upgrade cyber security technologies.

5. AI in security tooling. Just over a third of CISOs currently use AI — either extensively, or peripherally — within cyber security functions. However, within the next 12 months, 61% of CISOs intend to explore opportunities for generative AI implementation in security processes and protocols.

If your organization is currently assessing AI-based cyber security threat prevention technologies, see how Check Point’s Infinity AI Copilot can advance your initiatives. Learn more here.

Also, be sure to check out this CISO’s Guide to AI. Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

Who moved my firewall? Security in the SASE age – CyberTalk

Six Degrees has been a staple of the security industry since the ‘90s, working with a wide range of companies and government entities to advise on and design solutions for information security. We have partnered with Check Point for many years, working with some of the company’s largest customers on extensive and complex projects. A central challenge is maintaining the confidentiality, integrity, and availability of information over time. For those of us who focus on this aspect of the industry, the definition of SASE by the industry in 2019 should have been a wake-up call. But it took a worldwide pandemic to get our attention.

The past few years have brought dramatic alterations to how and where users access company resources. These alterations have significantly impacted the ability to enforce security controls. The traditional data center firewall found itself with fewer people and assets behind it. That led to a new question. How do we offer remote users the same protections as a data center firewall when remote users are increasingly accessing applications that aren’t hosted within the data center?

Timing is everything

In 2019, Check Point created the Harmony product pillar and moved to Infinity Portal. (Harmony was designed to provide unified security for the end user and Infinity Portal provided cloud-based rather than on-prem security management). With the pandemic in full swing, Six Degrees focused on helping customers provide access for their newly remote users via the existing firewalls. At the same time, Six Degrees built a team focused on addressing email security using Harmony Email & Collaboration (HEC). HEC leveraged a patented technology formerly known as Avanan and incorporated Check Point ThreatCloud (AI-based analysis technologies) for even greater protection.

The initial results of the new Six Degrees email team were impressive. In 2023, the team brought on more Check Point customers than in any previous year in Six Degrees’ history. The key to this success was the pace at which the proof of value for HEC could be realized. With a 15-minute setup and 14-day trial led by a Six Degrees email specialist, customers were easily able to see the risk mitigation and automation benefits of the HEC solution. Six Degrees and Check Point recognized the success, and both added additional solutions team members to the effort.

Near the halfway point of 2024, we are seeing a true shift to the new edge with the pace of adoption already exceeding that of 2023. Conversations are expanding from email to many other aspects of the new edge. Customers that were new to Check Point last year are now fans of HEC, and they are more open to trying additional Harmony solutions. There is a sort of muscle memory that comes from successful HEC trials that makes it easy for a customer to imagine extra value from an application that is just a click away in the Infinity Portal. We are seeing remarkable success with SASE, SaaS, Endpoint, MDR, Browse, and of course, HEC. Success compounds as we build on previous successes. All of Check Point’s solutions supply AI-powered, cloud-delivered security, making deployment rapid without the need for additional headcount.

Protecting against what you don’t know

The newly launched Harmony SaaS service complements HEC deployment through an ecosystem approach to SaaS security. Organizations, on average, use 130 SaaS applications, yet there is research showing that there are often more than 700 additional SaaS applications in use without the knowledge of IT. Most SaaS data leakage and supply chain attacks are a result of these connections. With Harmony SaaS, SaaS security isn’t left to chance. App-to-app connections are monitored and mitigated, including potential integrations with shadow SaaS tools, APIs, and plugins.

Essentials of the SaaS Security offering:

Installs in minutes
Discovers your SaaS applications, plugins and APIs
Analyzes security posture gaps
Provides single-click remediation
Automatically stops SaaS attacks in their tracks

Additionally, and possibly best of all, Harmony SaaS doesn’t require prior expertise, making it easy for anyone on the team to manage SaaS security.

The combination of Check Point Infinity Portal and Harmony Email & Collaboration gives CIOs the best possible protection for their organizations. The products are solutions for responding to and staying ahead of increasingly sophisticated threats. Get more information or schedule a trial by contacting Six Degrees, either through a call or the link below.

Learn more here. For additional cyber resilience insights, please see CyberTalk.org’s past coverage or explore this eBook.

Data breach litigation, the new cyber battleground. Are you prepared? – CyberTalk

By Deryck Mitchelson, EMEA Field Chief Information Security Officer, Check Point Software Technologies.

Nearly everyone trusts Google to keep information secure. You trust Google with your email. I use Google for my personal email. Yet, for three years – from 2015 to 2018 – a single vulnerability in the Google Plus platform resulted in the third-party exposure of millions of pieces of consumer data.

Google paid a settlement of $350M in a corresponding shareholder lawsuit, but most organizations cannot afford millions in settlements. For most organizations, this level of expenditure due to a breach is unthinkable. And even for larger organizations with financial means, constant cycles of breach-related lawsuits are unsustainable.

Yet, across the next few years, especially as organizations continue to place data into the cloud, organizations are likely to see a significant uptick in post-breach litigation, including litigation against CISOs, unless they adopt stronger cyber security protocols.

Litigation looms large

Organizations that have experienced data breaches are battling a disturbing number of lawsuits. In particular, privacy-related class actions against healthcare providers are taking off.

Globally, there were 2X the number of data breach victims in 2023 as compared to 2022.

In 2023 alone, breach related class actions and government enforcement suits resulted in over $50 billion in settlement expenditures.

The Irish Health Service Executive, HSE, was severely impacted by a large cyber attack in 2021 with 80% of its IT services encrypted and 700 GB of unencrypted data exfiltrated, including protected health information. The HSE subsequently wrote to 90,936 affected individuals. It has been reported that the HSE is facing 473 data-protection lawsuits, and this number is expected to continue rising.

I recently spoke with a lawyer who specializes in data breach litigation. Anecdotally, she mentioned that breach-related lawsuits have grown by around 10X in the last year. This is becoming the new normal after a breach.

While organizations do win some of these lawsuits, courts have become increasingly sympathetic to plaintiffs, as data breaches can result in human suffering and hardship in the forms of psychological distress, identity theft, financial fraud and extortion. They can also result in loss of human life, but more about that later.

In courts of justice, an organization can no longer plead ‘we made an error or were unaware’, assuming that such a line will suffice. The World Economic Forum has found that 95% of cyber security threats can, in some capacity, be traced to human error. These cases are not complex. But the level of litigation shows that businesses are still making avoidable missteps.

To that effect, businesses need to not only start thinking about data protection differently, but also need to start operating differently.

Personal (and criminal) liability for CISOs

CISOs can be held personally liable, should they be found to have failed in adequately safeguarding systems and data that should be protected. At the moment, we’re not seeing much in the way of criminal liability for CISOs. However, if CISOs appear to have obfuscated the timeline of events, or if there isn’t full transparency with boards on levels of cyber risk, courts will indeed pursue a detailed investigation of a CISO’s actions.

The patch that would have fixed a “known critical vulnerability” should have been applied immediately. If the organization hadn’t delayed, would it still have been breached?

Therefore, it is in CISOs’ best interest to record everything – every interaction, every time that they meet with the board, and every time that they’re writing a document (who said what information, what the feedback was, who has read it, what the asks are), as a proactive breach preparedness measure.

If a CISO ends up in litigation, he or she needs to be able to say ‘this risk was fully understood by the board’. CISOs will not be able to argue “well, the board didn’t understand the level of risk” or “this was too complex to convey to the board”, it is the CISOs job to ensure cyber risk is fully understood.

We’re starting to see a trend where CISOs are leaving organizations on the back of large breaches, which may mean that they knew their charter, but failed to take full responsibility and accountability for the organization’s entire cyber security program.

The consumer perspective

As a consumer, I would expect CISOs to know what their job is – to understand the attack surface and to map out where they have weaknesses and vulnerabilities. And to have a program in-place in order to mitigate against as much.

But even if CISOs have a program in place to mitigate breaches, consumers can still come after them for a class action. Consumers can still argue that cyber security staff should have and could have moved faster. That they should have attempted to obtain additional investment funding from the board in order to remediate problems efficiently or to increase their operational capacity and capability to prevent the data breach.

The challenge that CISOs have got is that they’re trying to balance funding acquisition, the pace of change, innovation, and competitive advantage against actually ensuring that all security endeavors are done correctly.

A current case-study in liability

In Scottland, the National Health System of Dumfries and Gallloway recently experienced a serious data breach. The attack led to the exposure of a huge volume of Personally Identifiable Information (PII). Reports indicate that three TB of sensitive data may be been stolen. As means of proof, the cyber criminals sent screenshots of stolen medical records to the healthcare service.

As expected, a ransom demand was not paid. The criminals have now leaked a large volume of data online. Having previously worked in NHS Scotland, I find such criminal activity, targeting sensitive healthcare information, deplorable. Will we now, similar to HSE, see already constrained taxpayers’ money being used to defend lawsuits?

Liability leverage with proper tooling

CISOs cannot simply put in tooling if it can’t stand up to scrutiny. If CISOs are looking at tooling, but less-so at the effectiveness/efficacy of that tooling, then they should recognize that the probability of facing litigation is, arguably, fairly high. Just because tooling functions doesn’t mean that it’s fit for purpose.

In regards to tooling, CISOs should ask themselves ‘is this tool doing what it was advertised as capable of?’ ‘Is this delivering the right level of preventative security for the organization?’

Boards should also demand a certain level of security. They should be asking of CISOs, ‘Is the efficacy of what you’ve implemented delivering at the expected level, or is it not?’ and ‘Would our security have prevented a similar attack?’ We don’t see enough senior conversation around that. A lot of organizations fail to think in terms of, ‘We’ve got a solution in-place, but is it actually performing?’

CISOs need to approach data the same way that banks approach financial value. Banks place the absolute best safeguards around bank accounts, investments, stocks and money. CISOs need to do the same with all data.

Third-party risk

One of the areas in which I often see organizations struggle is supply chain and third-party risk. As you’ll recall, in August of 2023, over 2,600 organizations that deployed the MOVEit app contended with a data breach.

What lessons around due diligence can be learned here? What more could organizations have done? Certainly, CISOs shouldn’t just be giving information to third parties to process. CISOs need to be sure that data is being safeguarded to the right levels. If it’s not, organizational leaders should hold CISOs accountable.

If the third party hasn’t done full risk assessments, completed adequate due diligence and understood the information that they’ve got, then consider severing the business connection or stipulate that in order to do business, certain security requirements must be met.

The best litigation defense

In my view, the best means of avoiding litigation consists of improving preventative security by leveraging a unified platform that offers end-to-end visibility across your entire security estate. Select a platform with integrated AI capabilities, as these will help prevent and detect a breach that may be in-progress.

If an organization can demonstrate that they have deployed a security platform that adheres to industry best practices, that’s something that would enable an organization to effectively demonstrate compliance, even in the event of a data breach.

With cyber security systems that leverage AI-based mitigation, remediation and automation, the chances of a class-action will be massively reduced, as the organization will have taken significant and meaningful steps to mitigate the potentiality of a breach.

Reduce your organization’s breach probability, and moreover, limit the potential for lawsuits, criminal charges against your CISO and overwhelming legal expenditures. For more information about top-tier unified cyber security platforms, click here.

7 advanced persistent threats (APTs) to know about right now – CyberTalk

EXECUTIVE SUMMARY:

An unseen adversary could stealthily lurk within your networks for months or even years. Methodically reconnoitering, establishing footholds, mapping out critical assets – this is the modus operandi of Advanced Persistent Threats (APTs).

These sophisticated, well-resourced actors don’t just strike and disappear. Rather, they entrench themselves within systems while obfuscating their presence as they move towards their ultimate objective; a devastating cyber attack. By the time that a given organization detects an APT, the damage might have already been done.

Believe it or not, 80% of organizations have contended with downtime due to APT incidents.

Develop a stronger understanding of the APT landscape and the adversaries that are targeting your industry. Beyond that, learn about mitigation techniques that can strengthen your security and fortify your resilience capabilities. Get the details below.

7 advanced persistent threats to know about right now

1. The US-CERT has released a technical alert regarding two malware strains; Joanap and Brambul, deployed by the North Korean APT group known as Hidden Cobra.

The alert, issued in collaboration with the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI), explains that Hidden Cobra has been using these malware variants since at least 2009. Targets have included organizations in the media, aerospace, finance and critical infrastructure space.

Joanap is a remote access trojan (RAT) that allows Hidden Cobra operatives to remotely issue commands to infected systems via a command and control server. It usually infiltrates systems as a payload dropped by other Hidden Cobra malware, which people inadvertently download through compromised ads or attachments.

In contrast, Brambul is a brute-force authentication worm that propagates through SMB shares by using a list of hard-coded login credentials to perform password attacks; thereby gaining access to victims’ networks.

To mitigate the risks associated with these threats, US-CERT advises organizations to keep systems updated with the latest patches and antivirus software, to enforce the principle of least privilege for user permissions and to deploy effective email security software that can scan and block suspicious attachments.

In addition, disabling Microsoft’s File and Printer Sharing connection requests can prevent this type of malware from spreading within networks.

2. A new advanced persistent threat group, dubbed LilacSquid, engages in data exfiltration attacks across various industry sectors in both the U.S. and the E.U. The tactics employed by the threat group are similar to those of the North Korean threat group known as Andariel, a sub-cluster of the Lazarus group.

LilacSquid’s initial compromise methods include exploitation of known vulnerabilities in internet-facing application servers and use of stolen RDP credentials. After infiltrating a system, LilacSquid leverages a series of open-source tools, including MeshAgent, which allows for remote management, and InkLoader, which allows for decrypting and loading malicious content.

To mitigate the threat posed by LilacSquid, organizations are advised to focus on ensuring that software systems are up-to-date with the latest security patches. It is also suggested that organizations implement strong password policies and multi-factor authentication. Further, organizations should monitor network traffic and deploy advanced threat detection tools.

3. In Southeast Asia, a trio of state-aligned threat actors are executing Operation Crimson Palace, which is currently impacting a high-profile government group. Attackers have exfiltrated sensitive military and political secrets, including strategic documents related to the contested South China Sea.

The operation weaponizes advanced malware tools, involves over 15 DLL sideloading efforts, and innovative evasion techniques.

The operation’s first phase, in March of 2022, involved the deployment of the “Nupakage” data exfiltration tool by Mustang Panda. This was followed by covert backdoor deployments in December of that year. In early 2023, the main campaign began.

To mitigate this type of threat, organizations may wish to implement comprehensive cyber security measures. These include robust network segmentation, regular system updates and advanced threat protection systems that can identify novel malware and backdoor techniques. Also, consider investing in security solutions that use AI.

4. To infiltrate European diplomatic agencies, nation-state backed hackers (attribution unclear) have recently leveraged two new backdoors, known as LunarWeb and LunarMail. The hackers breached the Ministry of Foreign Affairs belonging to an undisclosed European country – one with diplomatic missions in the Middle East.

The attack chain initiates with spear-phishing emails that contain Word documents embedded with malicious macros, which deploy the LunarMail backdoor. This backdoor establishes persistence by creating an Outlook add-in, which activates anytime that the email client is launched.

The attack also exploits misconfigured Zabbix network monitoring tools to deliver the LunarWeb payload. LunarWeb persists by masquerading as legitimate traffic, utilizing techniques such as the creation of Group Policy extensions, replacing system DDLs, and embedding in legitimate software. Both backdoors are decrypted and activated by a component named ‘LunarLoader’ using RC4 and AES-256 ciphers, ensuring that they run exclusively within the targeted environment.

To prevent these types of threats, organizations should install robust email security protocols. Using advanced threat prevention and detection systems is also a must when it comes to enhancing APT resilience.

5. State-backed hacking group APT24 has recently employed advanced social engineering approaches to disrupt networks and to access cloud data across a variety of sectors. The group targets organizations in Western and Middle Eastern NGOs, media organizations, academia, legal services and activists.

The group’s tactics involve posing as journalists and event organizers. This strategy enables APT42 to harvest credentials and gain initial access to cloud environments, from which the group can exfiltrate attractive data.

To counteract these types of threats, take the time to learn about the latest social engineering tactics. Threat intelligence can also enhance an organization’s abilities to contend with such sophisticated campaigns.

6. The advanced persistent threat (APT) operation known as HellHounds has been deploying the Windows version of Decoy Dog malware against telecommunications, IT, government and space industry entities across Russia. At least 48 different organizations have been affected thus far.

To maintain a presence within Russian organizations and to evade malware defenses, the HellHounds group has modified open-source tools. The HellHounds toolkit, though primarily based on open-source projects, has been optimized to ensure prolonged covert operations within compromised environments.

To mitigate this threat, organizations are advised to implement robust multi-factor authentication, regularly update and patch systems, and to employ advanced threat prevention and defense solutions.

7. APT28 is targeting European networks using HeadLace malware and credential harvesting techniques. Operating with stealth, APT28 employes legitimate internet service (LIS) and living off-the-land binaries (LOLBins) to hide their malicious activities within the stream of regular network traffic, significantly complicating detection efforts.

To mitigate the threat, cyber security professionals are advised to block spear phishing attempts, implement comprehensive email security services, and apply multi-factor authentication.

For more insights into the latest malware threats, please see CyberTalk.org’s past coverage. Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

How CISOs can master the art of cyber security storytelling – CyberTalk

EXECUTIVE SUMMARY:

Powerful stories can mean the difference between stagnant security that incites adverse outcomes and 10X better security that fully protects the environment.

Bridging the divide

Due to the volume of cyber threats and the impact that they can have, Chief Information Security Officers are now regularly invited to corporate board meetings. More than 90% of CISOs report attending such meetings – a trend that’s expected to continue as new cyber security rules take effect.

However, when asked to lead boardroom cyber security discussions, CISOs’ points or requests are commonly dismissed, as board members lack the context for and interest in the material at-hand.

This disconnect with and diminishment of cyber security widens a chasm that can potentially lead to egregious cyber security gaps and gaffes. If the board does not understand the need for email threat prevention tools, for example, a stealthy attack could undermine the organization.

Chief Storytelling Officer

In turn, the CISO needs to become the Chief Storytelling Officer – someone who can clearly convey cyber security concepts in a way that builds favorable sentiment and consensus around solutions.

As CISO Tom August adroitly notes, “…a confused mind always says no.” It is incumbent upon CISOs to help board members connect the dots in the language of business, not just the language of security.

Storytelling transforms the abstract into the tangible and comprehensible. Yet, the real feat is to ensure that cyber security storytelling not only informs and expands viewpoints, but that it inspires action.

Cyber security storytelling best practices

So, how can a CISO develop storytelling capabilities and transcend communication gaps?

The key lies in starting with the ‘why’. As many an expert has observed before, change of any kind is a participation sport. For people to participate, they must buy into it via the story that’s told about it. A story provides the opportunity to facilitate an emotional connection with the ‘why’.

CISO stories should also have a ‘throughline’ or a connecting thread that brings various ideas and examples together. The throughline is a core message that stakeholders should be able to easily convey to other stakeholders. It should be memorable and repeatable.

In telling a story, CISOs need to humanize cyber risks. CISOs need to show the impact of failing to take certain actions vs. moving forward with certain actions. Claims should be supported with data and metrics, although not with so many metrics that the audience loses interest.

The final messaging in a CISO’s story should point the board in the direction of the response that is required.

Nailing the narrative approach

Think of the narrative approach as savvy and strategic, rather than a watered-down version of reality for cyber security simpletons. The objective is to create a shared understanding, a shared sense of purpose and a shared interest in solving a business problem.

As cyber security threats and needs change, and as the business itself changes, so too should the narratives that cyber security leaders tell. CISOs should aim to continuously educate the audience and to bring them along on a shared journey.

In conceptualizing the CISO role as that of a Chief Storytelling Officer, at least in the context of board-level discussions, CISOs can reshape dynamics and empower organizations to make informed decisions that ultimately enrich cyber security and ensure resilience.

For more on this topic, click here. Lastly, to receive thought leadership insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

Check Point warns of PDF malware surge – CyberTalk

EXECUTIVE SUMMARY:

In a startling discovery, Check Point Research has found that nearly 70% of all file-based email attacks worldwide now leverage malicious PDFs. This figure represents a 20% increase, year-over-year.

One out of every 246 email attachments is malicious.

Such a sharp year-over-year spike indicates that cyber criminals perceive PDFs as an effective malware delivery mechanism — one which they will continue to employ until relevant threat prevention tools see widespread adoption.

PDF attacks

As Check Point security engineer Rudi van Rooyen explains it, PDF-based attacks exploit vulnerabilities in traditional, signature-based security scanners. Cyber criminals embed hidden content in PDFs and the content effectively bypasses security checks.

The healthcare industry has been particularly hard-hit by PDF-based threats and, given the operational damage that could occur and the lives that could be affected, the need for effective countermeasures is readily apparent.

AI-powered protection

To address this issue, Check Point has launched an AI-powered engine called Deep PDF. It utilizes deep learning algorithms to review all PDF content components.

Deep PDF examines:

The internal structure of PDFs
Embedded images and their placement
Embedded URLs and their context within the document
Raw content within the PDF

Says Van Rooyen, Deep PDF technology is a component of Check Point’s ThreatCloud AI. It’s available to all Check Point customers; from small businesses to multi-national companies that leverage the complete security platform.

To analyze malicious PDFs, Check Point’s ThreatCloudAI not only utilizes the Deep PDF tool, but also deploys over 300 machine learning features to conduct a comprehensive analysis of a given email attachment and its payload.

Call to action for security leaders

The sharp spike in PDF-based malware indicates that security leaders need to take action. Flawed email security (signature-based defense) is no longer good enough.

To stay ahead of attachment-focused adversaries, organizations need to proactively embrace AI/ML-driven threat prevention.

Partner with industry leading security providers, like Check Point, to obtain cutting-edge technologies that can effectively detect and prevent the most sophisticated of malware-based attacks.

Key takeaways for security leaders

Leverage AI-powered technologies, like Deep PDF, to enhance your organization’s cyber security posture.
Implement regular cyber security awareness programs for employees. Discuss PDF-based attacks, how to approach a potentially malicious PDF, and how to proceed if a suspect file is accidentally downloaded or opened.
Ensure that your organization maintains a comprehensive incident response plan. Detail procedures for containing and mitigating cyber security incidents. Regularly test and evolve the plan to reflect new threats, like PDF-based malware.
Collaborate across your sector and with security providers, as partnerships can provide stabilizing resources and support.

For technical information concerning PDF-based threats, please visit the Check Point Research website. For more malware-related insights, please see CyberTalk.org’s past coverage.

Lastly, to receive thought leadership insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

NIS2 is coming – why you should act now – CyberTalk

By Patrick Scholl, Head of Operational Technology, Infinigate

NIS2 – the Network and Information Security Directive – is a revision of the NIS Directive, which came into force in 2016, with the aim of strengthening cyber security resilience across the EU.

The revision tightens reporting requirements and introduces stricter control measures and enforcement provisions. By October 17th 2024, the NIS2 Directive will be a requirement across all EU member states. Despite the urgency, businesses still have many questions.

Distributors like Infinigate are committed to supporting the implementation of NIS2 by offering a broad choice of cyber security solutions and services in collaboration with vendors, such as Check Point.

Supporting NIS2 implementation

In Germany, as an example, NIS2UmsuCG, the local directive governing the implementation of the EU NIS2 to strengthen cyber security, is already available as a draft and defines EU-wide minimum standards that will be transferred into national regulation.

It is estimated that around 30,000 companies in Germany will have to make changes to comply. However, thus far, only a minority have adopted the measures mandated by the new directive. Sometimes, symbolic measures are taken with little effect. In view of the complexity of the NIS2 requirements, the short time in which they are to be implemented and the need for holistic and long-term solutions, companies need strong partners who can advise on how to increase their cyber resilience.

Who is affected?

The NIS2 directive coming into force in autumn 2024 will apply to organisations across 18 sectors with 50 or more employees and a turnover of €10 million. Additionally, some entities will be regulated regardless of their size — especially in the areas of ‘essential’ digital infrastructure and public administration.

The following industry sectors fall under the ‘essential’ category:

Energy
Transport
Banking and finance
Education
Water supply
Digital infrastructure
ICT service management
Public administration
Space exploration and research
Postal and courier services
Waste management
Chemical manufacturing, production and distribution
Food production, processing and distribution
Industry & manufacturing (medical devices and in-vitro, data processing, electronics, optics, electrical equipment, mechanical engineering, motor vehicles and parts, vehicle manufacturing)
Digital suppliers (marketplaces, search engines, social networks)
Research institutes

It’s worth bearing in mind that NIS2 regulations apply not only to companies, but also their contractors.

Good to know: The “size-cap” rule

The “size-cap” rule is one of the innovations that come with NIS2 and is intended to level out inequalities linked with varying requirements and risk profiles, budgets, resources and expertise. The regulation is intended to enable start-ups and medium-sized companies as well as large corporations to be able to implement the security measures required by NIS2.

You can get NIS2 compliance tips here: https://nis2-check.de/

NIS2 in a nutshell

In Germany, companies are required to register with the BSI (Federal Office for Information Security), for their relevant areas. A fundamental rule is that any security incidents must be reported immediately.

Across Europe, the strict security requirements mandated by NIS2 include the following:

Risk management: identify, assess and remedy

Companies are required to take appropriate and proportionate technical, operational and organisational measures. A holistic approach should ensure that risks to the security of network and information systems can be adequately managed.

Security assessment: a self-analysis

Security assessment includes questions such as: what vulnerabilities are there in the company? What is the state of cyber hygiene? What security practices are already in place today? Are there misconfigured accounts that could be vulnerable to data theft or manipulation?

Access management: protecting privileged accounts

Companies subject to NIS2 regulations are encouraged to restrict the number of administrator-level accounts and change passwords regularly. This lowers the risk of network cyber security breaches threatening business continuity.

Closing the entry gates: ransomware and supply chain security

One of the main concerns of the NIS2 directive is proactive protection against ransomware. Endpoint security solutions can help here. Employee training is another necessary step to create risk awareness and help identify and prevent cyber attacks.

The focus here should be on best practices in handling sensitive data and the secure use of IT and OT systems. Supply chain vulnerability is a major area of concern. Companies need to ensure that the security features and standards of the machines, products and services they purchase meet current security requirements.

Zero tolerance strategy: access control and zero trust

In a world where corporate boundaries are increasingly blurred due to digitalisation, cloud infrastructures and decentralised working models, perimeter-based architectures have had their day. A zero trust concept provides multiple lines of defence, relies on strong authentication methods and threat analysis to validate access attempts.

Business continuity: prepared for emergencies

Business continuity management measures are essential to ensure that critical systems can be maintained in the event of an emergency. These include backup management, disaster recovery, crisis management and emergency plans.

In summary, we should not let the complexity of the topic discourage us from taking action; after all, NIS2 is for our benefit, to help us protect our business assets from increasing cyber risk.

Businesses would be well advised to start on the route to assessing their security posture and current status vis-à-vis NIS2 requirements. You can make a start by simply identifying all relevant stakeholders in your organisation, starting a task-force and gathering intelligence on your cyber risk.

Identify key steps and build a roadmap to compliance that is manageable for your resources; your channel partners can help by providing expert advice https://page.infinigate.com/nis2-checkpoint.

The importance of cyber security education for young students – CyberTalk

Dasha Smolina is an emerging cyber security professional and is currently a Security Engineer in the Eastern U.S. Region at Check Point Software Technologies. She joined Check Point in 2023 to help organizations and businesses meet their cyber security needs.

Overview

The sophisticated cyber threat landscape poses a significant risk to the education sector. Malicious actors’ interest in this sector is growing. Students are often targeted by these attackers because of their increased online presence, risky online behavior, and lack of cyber security awareness. Unlike businesses, which often successfully employ cyber security awareness training to prevent cyber crime incidents, schools overlook cyber security training in their curricula. As young students continue to boundlessly explore the web and are increasingly exposed to cyber threats, K-12 educators need to provide better cyber security training for students to ensure their safety online.

Background – Why are students targeted and what cyber crime are they experiencing?

In the past few years, the internet has become a primary channel for education, with two-thirds of children saying they access their online education resources daily. One in three education devices contains sensitive data, making it critical to keep devices secure.

Students are also more connected to the web than ever before because of the prominence of social media and online gaming. These children are exposed to the internet constantly, relying on it for almost all of their educational and recreational needs. However, they often lack awareness about online safety. As noted previously, attackers are targeting these children because of their increased online presence, risky online behavior, naivety and lack of safety precautions.

K-12 students are experiencing concerning cyber risks such as cyber bullying, inappropriate content, identity theft, and more. Given that 92% of children are online by the age of 12 and that 72% of them having experienced at least one cyber threat, it is evident that students are at risk of attacks by cyber criminals. Moreover, these attacks are multifaceted, with attackers utilizing various techniques to induce harm (see Exhibit 1).

In addition to what was mentioned above, online crimes against children are also high because of the prevalence of children using social media without adult supervision. Nine out of 10 households with internet access have children who are active on social media, and 54% of these households do not regulate their children’s online activities. The lack of supervision and awareness, combined with an increase in online activity means that students are exposed to many cyber security threats.

Exhibit 1 – Boston Consulting Group Survey Results

The data shows that one particular cyber threat affects children more commonly than adults: cyber bullying. Cyber bullying is particularly dangerous because it can affect children through all hours of the day and night and can come in many forms such as texting, social media posts, and chatroom messages. Cyber bullying can also be anonymous, which leaves victims with little recourse to report the attacker. Even if the victim knows who the attacker is and blocks or reports them, there are so many avenues through which to hide an identity online that the attacker can easily find another way to harm the victim; it is nearly impossible to escape a determined cyber bully. Cyber bullying has detrimental effects on its victims, leading to mental health issues, increased stress and anxiety, depression, and violence. The effects of cyber bullying have also been shown to be long-lasting, continuing even once the bullying has stopped.

Another long-lasting cyber crime that children are targeted for is identity theft. This dangerous cyber crime ensnares one in 50 children annually and has life-long implications for a child. For those who may not know, identity theft as a cyber crime occurs when an attacker steals a person’s data and information to commit fraudulent identity-based activities, such as opening credit cards or bank accounts, applying for loans, committing online crimes like scams, and more. Children who have had their identity stolen might not find out for years, or even decades, until they try to open their own credit card account and discover that their credit history has been tarnished. Children fall victim to identity theft through data breaches, doxxing (someone else publicly sharing their information or “docs”), parents or close ones oversharing information about the child, children oversharing their information or passwords with friends, and phishing and other common online scams.

Trusting strangers online and naivety can also lead children to become victims of online predators or groomers. Online predators visit popular social media websites and falsify their age and profile content to potentially lure young children into online interactions. Once contact is established, the groomer then pressures the child to reveal explicit photos of themselves and might even try to meet the child in person. Sometimes the groomer will blackmail the child, but other times the victim might not even realize they are being groomed, considering the online predator to be their boyfriend or girlfriend. There are about 500,000 online predators active each day but only two out of ten children are aware of this potential danger. Rather than protecting themselves and limiting potential exposure to dangerous adults online, 40% of children online remove their privacy settings to attract more followers. This makes it that much easier for groomers to access a child’s information and manipulate them online.

Children also fall for online financial scams, as shown by the data collected for the FBI’s 2023 Internet Crime Report, which states that people under the age of 20 accumulated over $40 million worth of losses to online scams in 2023. Online scammers are preying on children who are accessing the internet at early ages and who lack the awareness to recognize cyber threats.

With more children going online at even younger ages, it is no longer as easy as it once was to keep children safe at home. Online threats are infiltrating their lives and putting children in danger of cyber attackers. Given education’s shift towards online learning, students are facing many new kinds of cyber risks. Moreover, with the emergence of new technologies, such as the Internet of Things or cloud-based and network-connect devices, including children’s toys and household appliances, the evolution of threats is not slowing down. Thus, it is important for educators to better understand the situation and help equip students with the knowledge and skills to protect themselves from attackers.

Proposed solution – How can cyber attacks that target students be prevented?

To protect young students from becoming cyber crime victims, educators and parents should increase the cyber security safety measures in-place on children’s devices. They should also provide cyber safety awareness education for children. Oftentimes, once an attack has occurred, the damage is irreparable, and parents can only report the crime and mitigate the impact. Therefore, prevention should be the priority. Combining safety controls with better cyber security education in regards to topics like phishing, privacy, social media safety, and cyber security awareness training will equip students with the tools and skills they need to be safe online.

Since students are provided with devices to access the internet by their parents or their educators, a simple way to better protect students is to employ cyber security solutions on these devices. As education becomes more digital, for school systems that provide tablets and computers for students, Check Point provides a suite of solutions to secure students. These solutions prevent uncontrolled exposure to inappropriate website content, phishing, and advanced cyber threats targeting students and their personal information. Check Point’s cyber security solutions for education protect against all imminent threats, are easy to implement, facilitate meeting compliance mandates, and keep students’ online access safe and regulated. Please reference the Check Point solution overview for K-12 education here: https://www.checkpoint.com/downloads/products/harmony-education-solution-brief.pdf

For parents providing devices for their children, Check Point offers a similar consumer product, ZoneAlarm, which incorporates features from the Check Point Harmony suite to prevent malware, phishing, ransomware, and other zero-day threats. Please reference the Zone Alarm information here: https://www.zonealarm.com/

For over 30 years, Check Point’s mission has been to secure the digital world for everyone, everywhere and we pursue this mission by preventing attacks before they happen with an industry-leading 99.8% threat prevention rate. So, the best way to secure the devices that young children are using is to install prevention-first cyber security solutions onto the devices.

While securing the devices helps prevent attacks from happening, a multi-layered approach to security should also include cyber security awareness education programs. Safe internet use lessons for children, including topics like keeping information private on social media, being wary of online scammers, and how to report/stop cyber bullying, would greatly benefit students. Based on a report from the Children’s Commissioner, parents share an average of 71 photos and 29 videos of their children every year and children will share their own content to social media over 70,000 times by age 18. This abundance of information makes it easy for attackers to profile their victims and use the information that they post against them.

Educating parents and children about limiting the personal information that they share online will help prevent attacks. Educating students about different types of scams and attacks will also help prevent children from engaging in cyber bullying and with online financial scammers. Teaching kids to be critical thinkers and practicing situational awareness when engaging with cyber space will better ensure that they are on-guard and don’t fall prey to basic scams that cause tremendous harm.

If this cyber security education is provided to students in a way that is engaging and easy to understand, students will regain the knowledge effectively. Creating lesson plans that contain interesting topics, like generative AI, social media safety, and preventing online gaming scams, will ensure a fun learning experience and an abundance of engagement on the part of the students. Bringing in guest cyber security speakers or employing online games are great ways for educators to teach cyber security topics without requiring the educators to be cyber security experts themselves. There is an abundance of options for helping students be safe online and it is extremely important that students are equipped with the tools and skills to remain safe in the increasingly dangerous online environment.

K-12 cyber security education resources

Fun online games (all games have NO LOGIN requirements to ensure students do not have to share any information to engage with the content)

https://sos.fbi.gov
- Game for 3^rd – 8^th graders that works on tablets, mobile devices, or computers. Covers topics including internet safety, online etiquette, smart sharing, securing systems, and protecting against attackers.
https://beinternetawesome.withgoogle.com/en_us
- Game for 2^nd – 6^th graders that works on tablets, mobile devices, or computers. Game is available in multiple languages. Covers topics including smart sharing, recognizing scams, staying secure online, online etiquette, and how to report online incidents.
https://www.pbs.org/wgbh/nova/labs/lab/cyber/
- Game for 4^th – 8^th grade students that works on computers. The game is designed to teach students how to recognize and thwart cyber attacks. Students play as a startup company with in-sufficient security and are tasked with creating a security strategy to prevent hackers from infiltrating their company.
https://overthewire.org/wargames/
- Game for 8^th – 12^th grade students that works on computers. This game is more advanced and tasks students with learning cyber security topics while practicing ssh and linux scripting skills.
https://public.cyber.mil/training/cyber-awareness-challenge/
- Training style game for 7^th – 12^th graders that works on computers. This game is geared towards teaching users how to mitigate threats and vulnerabilities. The training provides an overview of cyber threats and best practices to stay secure online.

The evolution of healthcare ransomware attacks – CyberTalk

By Zac Amos, Features Editor, Rehack.com.

In recent years, ransomware has emerged as a critical threat to the healthcare industry, with attacks growing in frequency, sophistication and impact. These cyber assaults disrupt hospital operations, compromise patient safety and undermine data integrity.

Understanding how ransomware tactics have evolved — from basic phishing schemes to complex, multi-faceted attacks — enables healthcare organizations to develop more robust defenses. Staying informed about the latest trends and techniques that cyber criminals use allows healthcare providers to safeguard their systems and ensure the continuity of care.

Initial ransomware attacks

Early ransomware tactics in healthcare were relatively rudimentary but still impactful. The first known ransomware attack — the PC Cyborg or AIDS Trojan — occurred in 1989 and targeted roughly 20,000 researchers and medical institutions. This attack involved distributing infected floppy disks that encrypted file names and paying a ransom to unlock them.

Although primitive by today’s standards, this attack highlighted the vulnerability of healthcare systems. Hospitals faced significant disruptions, affecting patient care and operations. This early incident underscored the potential havoc that ransomware could wreak on the healthcare sector. It set the stage for more sophisticated future threats.

Evolution of attack vectors

The evolution of ransomware in healthcare has seen a significant shift; from simple phishing attacks to sophisticated social engineering techniques. Initially, attackers used basic phishing emails to trick individuals into downloading malicious software.

However, as defenses improved, cyber criminals adapted by using more advanced social engineering tactics. These methods involve conducting detailed research on targets, the creation of personalized messages and placing phone calls, as to gain trust and infiltrate systems.

Alongside this, Remote Desktop Protocol (RDP) exploits have surged. These exploits allow attackers to access healthcare networks remotely by exploiting weak passwords and unpatched systems.

The healthcare sector has also seen a rise in exploited vulnerabilities in medical devices and the IoT. Cyber criminals have increasingly targeted these interconnected systems — which often lack robust security measures — to launch attacks.

This trend was particularly evident in the fourth quarter of 2023. The healthcare industry accounted for 16% of all ransomware attacks, making it the second-most targeted sector during this period. Exploitation of vulnerabilities can disrupt medical services and poses significant risks to patient safety. In turn, this highlights the urgent need for enhanced cyber security measures in healthcare.

Advanced encryption and evasion techniques

As ransomware has evolved, attackers have developed more complex encryption methods to secure healthcare data more effectively. One notable tactic is double extortion, where cyber criminals encrypt data and threaten to release sensitive information if the victim doesn’t meet their demands. This dual threat has increased the pressure on targeted organizations.

Further, 74% of Chief Information Security Officers believe that AI-powered cyber threats, including advanced ransomware, significantly impact their organizations. Attackers are also implementing polymorphic malware, which constantly changes its code to avoid detection by traditional security systems. Techniques like this make it challenging to combat sophisticated threats.

Targeting larger and more critical institutions

Ransomware attackers have shifted from targeting small clinics to targeting large hospitals and extensive healthcare networks, resulting in more significant disruptions and higher ransom demands than previously. Larger institutions have substantial financial resources, which makes them attractive targets for cyber criminals seeking substantial payouts.

The financial impact of the attacks on larger healthcare organizations is profound. In 2023, experts reported data breaches costing an average of $10.93 million each. This cost increase underscores ransomware’s severe financial strain on healthcare providers. It affects their ability to deliver essential services and invest in further security measures.

Ransomware-as-a-service

The rise of Ransomware-as-a-Service (RaaS) platforms has contributed to the proliferation of ransomware attacks in the healthcare sector. These RaaS groups operate on various business models, including monthly subscriptions, one-time license fees, affiliate programs or pure profit-sharing arrangements.

Offering user-friendly interfaces and comprehensive support, RaaS has lowered the barrier to entry for cyber criminals. It even enables those with zero technical expertise to launch sophisticated attacks. This democratization of ransomware has led to an increase in the frequency and diversity of attacks. It poses a more significant threat to healthcare organizations that must now defend against an extremely broad range of adversaries.

Collaboration and sophistication of cyber criminals

The formation of ransomware syndicates and partnerships has further expanded the threat landscape in healthcare. Cyber criminal groups now share resources and intelligence, enhancing their capabilities and effectiveness. In fact, some RaaS operators provide ongoing technical support and grant access to private forums where hackers exchange tips and information, fostering a collaborative environment.

This collective effort allows more sophisticated attacks, as cyber criminals leverage advanced threat intelligence and surveillance to identify vulnerabilities and tailor their strategies. Consequently, healthcare organizations face increasingly coordinated and informed adversaries, making securing their systems even more challenging.

Countermeasures and mitigation strategies

In response to the evolution of advanced ransomware, healthcare organizations have had to enhance their defensive measures. Adopting multi-layered security approaches — involving a combination of firewalls, intrusion detection systems, regular software updates and employee training — has become paramount.

Additionally, AI and machine learning are crucial in detecting and preventing attacks. These technologies can analyze vast amounts of data in real time and identify unusual patterns more accurately than traditional methods. Leveraging AI-driven tools lets healthcare providers anticipate and mitigate ransomware attacks more effectively than otherwise. It also helps bolster their overall cyber security posture.

Adapting to an evolving threat

The need for continuous adaptation in cyber security strategies is critical as ransomware threats evolve and become more sophisticated. The future landscape of ransomware in healthcare will likely see more advanced tactics. This makes it essential for healthcare organizations to stay vigilant and proactive in their defense measures.

For more insights from Rehack Features Editor, Zac Amos, click here. Lastly, to receive practical cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

OpenAI’s safety oversight reset (what it means) – CyberTalk

EXECUTIVE SUMMARY:

OpenAI is setting up a new safety oversight committee after facing criticism that safety measures were being deprioritized in favor of new and “shiny” product capabilities.

CEO Sam Altman and Chairman Bret Taylor will co-lead the safety committee, alongside four additional OpenAI technical and policy experts. Committee members also include Adam D’Angelo, the CEO of Quora, and Nicole Seligman, who previously served as general counsel for the Sony Corporation.

The committee will initially evaluate OpenAI’s existing processes and safeguards. Within 90 days, the committee is due to submit formal recommendations to OpenAI’s board, outlining proposed improvements and new security measures.

OpenAI has committed to publicly releasing the recommendations as a means of increasing accountability and public trust.

Addressing user safety

In addition to scrutinizing current practices, the committee will contend with complex challenges around aligning AI system operations with human values, mitigating potential negative societal impacts, implementing scalable oversight mechanisms and developing robust tools for AI governance.

AI ethics researchers and several of the company’s own employees have critically questioned the prioritization of commercial interests over detailed safety evaluations. The release of ChatGPT-4o has amplified these concerns, as ChatGPT-4o is significantly more capable than past iterations of the technology.

Major AI research labs (think Anthropic, DeepMind…etc) and other tech giants pursuing AI development will likely follow OpenAI’s lead by forming independent safety and ethics review boards.

AI and cyber security

The extremely fast development of versatile AI capabilities has led to concerns about the potential misuse of AI tools by those with malicious intent. Cyber criminals can leverage AI to execute cyber attacks, spread disinformation and to compromise business or personal privacy.

The cyber security risks introduced by AI are unprecedented, making solutions — like AI-powered security gateways that can dynamically inspect data streams and detect advanced threats — critically important.

Check Point Software has developed an AI-driven, cloud-delivered security gateway that leverages machine learning models to identify attempted exploitations of AI; deepfakes, data poisoning attacks and AI-generated malware, among other things. This multi-layered protection extends across networks, cloud environments, mobile devices and IoT deployments.

Protect what matters most. Learn more about Check Point’s technologies here. Lastly, to receive practical cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.