Securonix, Inc. announced that Kash Shaikh has been appointed President and Chief Executive Officer and member of its Board of Directors, effective immediately.

Kash succeeds Nayaki Nayyar who has been serving as the CEO of the security vendor since December 2022. Nayaki has decided to step down and focus the next phase of her career on public Board service, the company said in a press release. 

Kash is a seasoned enterprise technology Executive with Fortune 50 experience and has a record of driving profitable growth across Software, SaaS, and AI Infrastructure markets. 

He has over 30 years of experience of fostering business transformation and delivering innovative technology solutions for global enterprise organizations. He most recently served as President and CEO of Virtana, a leading hybrid-cloud infrastructure observability solutions provider.

Prior to Virtana, Shaikh served as Global Vice President and General Manager for Dell’s Enterprise Solutions Unit. Shaikh has also held leadership and executive positions at Ruckus Wireless, Hewlett Packard, Cisco, and Nortel Networks.

The post Securonix appoints Kash Shaikh as President & CEO as Nayaki Nayyar steps down appeared first on CIO Dimension.

70% of businesses reported increased spending on proactive security solutions, such as attack surface management and risk-based vulnerability management, over the past year, according to a new research from Titania. The report, Emerging Best Practice in the use of Proactive Security Solutions, indicates a marked increase in investments aimed at preemptively mitigating cyber threats. This notably outpaces investments in both preventative and reactive measures.

The study, completed in partnership with Omdia, a global analyst and advisory leader, surveyed over 400 security decision-makers in North America, the UK, France, and Germany. It underscores the acceleration in adoption of proactive security measures from three key drivers: ‘reducing the opportunity for threats’, ‘reducing the mean time to remediate known vulnerabilities’, and ‘minimizing attack surface’. 

Key findings of the report include:

• Strategic Implementation: A significant portion of organizations, particularly those with mature security postures, are strategically deploying proactive security solutions. This trend is especially prevalent among larger organizations. This growth is particularly pronounced in EMEA, where 74% of respondents increased their budgets, compared to 67% in North America. The desire is particularly strong amongst financial services organizations (54%) and critical infrastructure organizations (53%) including energy and utilities companies. In addition, almost half (47%) reported that their top cybersecurity goals for the next 12-24 months are to reduce the opportunity for threats with proactive security. Conversely, only 27% of organizations plan to improve tactical outcomes, such as better threat prevention, detection and response.

• Enhanced Security Posture: Respondents report a strong desire to improve security posture and expect that the broader integration of proactive security tools will greatly improve attack surface management and security control optimization. Currently, a large majority of respondents report having limited visibility into the security posture of network assets (firewalls, switches and routers) and long cadences between assessments – with roughly half of organizations checking network devices at most, monthly. 
  Organizations are also much more likely to only monitor all devices in critical segments (or simply look at a sample of devices), than to monitor every device in their networks. Notably, critical infrastructure organizations (i.e., energy, utilities, and transportation) report much lower confidence than other industries in their ability to maintain adequate network segmentation and prevent unauthorized access to networks.
  
  
• Disruption Anticipation: Almost half (48%) of all respondents anticipate a high level of organizational disruption due to the broader adoption of proactive security solutions, highlighting the transformative impact these measures are expected to have.

“This research vividly illustrates a widespread and rapid shift towards proactive security to improve operational readiness and resilience. Organizations are recognizing the critical need to stay ahead of known threats and shut down attacks by investing in solutions that offer real-time visibility of their security posture and remediating action that will continuously minimize their exposure.”

Tom Beese, Executive Chairman, Titania

The post Over 70% businesses in advanced economies increased spending on proactive security appeared first on CIO Dimension.

58% of enterprises says that detecting vulnerabilities is getting more difficult as their attack surface increases in complexity, size and rate of change, according to a survey by security testing platform Synack. The survey led by TechTarget’s Enterprise Strategy Group (ESG) that shows challenges in scaling penetration testing to meet the needs of large enterprises.

The report commissioned by Synack leverages insights from 200 technical decision-makers at U.S. organizations with at least 1,000 employees. Half of the survey respondents reported it was more difficult to manage their attack surface today than it was a year ago, whether because of third-party risk, data complexity or increasing attacker sophistication.

Other highlights of the report include:

• Organizations reported pentesting currently covers only 47% of business-critical apps
• 60% of respondents reported finding it difficult to test frequently enough to keep up with the pace of application development, with three in four saying it’s likely they will consider platform-based testing solutions like Penetration Testing as a Service (PTaaS)
• 65% recognize that traditional pentesting is not a viable approach to cover their attack surface. 

“Point-in-time pentests have been a staple of security programs for so long, it can be hard to move to a continuous approach,” said Dr. Mark Kuhr, Synack CTO and co-founder. “This survey shows security teams are aware of PTaaS’s potential to accelerate business transformation and keep pace with modern software development, even though few have made the leap.”

Only 32% of respondents said they use pentesting to improve overall security strategies and posture. Most either reported using pentesting for compliance or to achieve tactical objectives like finding and fixing vulnerabilities.

The post Detecting vulnerabilities gets more difficult as pentestings miss the mark  appeared first on CIO Dimension.

According to a latest report, nearly half (49.6%) of all internet traffic came from bots in 2023—a 2% increase over the previous year. For the fifth consecutive year, the proportion of web traffic associated with bad bots grew to 32% in 2023, up from 30.2% in 2022, while traffic from human users decreased to 50.4%. Automated traffic is costing organizations billions (USD) annually due to attacks on websites, APIs, and applications.

The 2024 Imperva Bad Bot Report by cybersecurity company Thales presents a global analysis of automated bot traffic across the internet. The 2023 bot traffic, according to the company, is the highest level Imperva has reported since it began monitoring automated traffic in 2013. 

Nanhi Singh, General Manager, Application Security at Imperva, a Thales company, said: 

“Bots are one of the most pervasive and growing threats facing every industry. From simple web scraping to malicious account takeover, spam, and denial of service, bots negatively impact an organization’s bottom line by degrading online services and requiring more investment in infrastructure and customer support. Organizations must proactively address the threat of bad bots as attackers sharpen their focus on API-related abuses that can lead to account compromise or data exfiltration.”

Key trends identified in the 2024 Imperva Bad Bot Report include:

• Global average of bad bot traffic reached 32%: Ireland (71%), Germany (67.5%), and Mexico (42.8%), saw the highest levels of bad bot traffic in 2023. The US also saw a slightly higher ratio of bad bot traffic at 35.4% compared to 2022 (32.1%).

• Growing use of generative AI connected to the rise in simple bots: Rapid adoption of generative AI and large language models (LLMs) resulted in the volume of simple bots increasing to 39.6% in 2023, up from 33.4% in 2022. The technology uses web scraping bots and automated crawlers to feed training models, while enabling nontechnical users to write automated scripts for their own use.

• Account takeover is a persistent business risk: Account takeover (ATO) attacks increased 10% in 2023, compared to the same period in the prior year. Notably, 44% of all ATO attacks targeted API endpoints, compared to 35% in 2022. Of all login attempts across the internet, 11% were associated with account takeover. The industries that saw the highest volume of ATO attacks in 2023 were Financial Services (36.8%), Travel (11.5%), and Business Services (8%).

• APIs are a popular vector for attack: Automated threats caused a significant 30% of API attacks in 2023. Among them, 17% were bad bots exploiting business logic vulnerabilities—a flaw within the API’s design and implementation that allows attackers to manipulate legitimate functionality and gain access to sensitive data or user accounts. Cybercriminals use automated bots to find and exploit APIs, which act as a direct pathway to sensitive data, making them a prime target for business logic abuse.

• Every industry has a bot problem: For a second consecutive year, Gaming (57.2%) saw the largest proportion of bad bot traffic. Meanwhile, Retail (24.4%), Travel (20.7%), and Financial Services (15.7%) experienced the highest volume of bot attacks. The proportion of advanced bad bots, those that closely mimic human behavior and evade defenses, was highest on Law & Government (75.8%), Entertainment (70.8%), and Financial Services (67.1%) websites.

• Bad bot traffic originating from residential ISPs grows to 25.8%: Early bad bot evasion techniques relied on masquerading as a user agent (browser) commonly used by legitimate human users. Bad bots masquerading as mobile user agents accounted for 44.8% of all bad bot traffic in the past year, up from 28.1% just five years ago. Sophisticated actors combine mobile user agents with the use of residential or mobile ISPs. Residential proxies allow bot operators to evade detection by making it appear as if the origin of the traffic is a legitimate, ISP-assigned residential IP address.

“Automated bots will soon surpass the proportion of internet traffic coming from humans, changing the way that organizations approach building and protecting their websites and applications,” continued Singh. “As more AI-enabled tools are introduced, bots will become omnipresent. Organizations must invest in bot management and API security tools to manage the threat from malicious, automated traffic.”

The post Bad bots on the rise as bot traffic starts to dominate the Internet  appeared first on CIO Dimension.

Palo Alto Networks’ Unit 42 recently released the Ransomware Retrospective 2024: Unit 42 Leak Site Analysis and Incident Response report 2024. As part of the Ransomware Retrospective, they studied 3,998 leak site posts from various ransomware groups. Leak sites are platforms where threat actors publicly disclose stolen data as a means of coercing victims into paying ransom.

Key findings from this investigation: Unit 42 saw a 49% YoY increase in multi-extortion ransomware attacks from 2022 – 2023 globally. In India, the manufacturing sector has been the most targeted industry for ransomware extortion in 2023. Of the 3,998 leak site posts from 2023 globally, LockBit ransomware remains the most active, with 928 organizations accounting for 23% of the total. LockBit is also the most active group in APAC and India (note: this was before the recent law enforcement disruption of LockBit). At least 25 new ransomware leak sites were observed in 2023; of which Akira led the way. 

Anil Valluri, MD and VP, India and SAARC, Palo Alto Networks, said, “In India, the Manufacturing sector has emerged as the primary target for ransomware attacks over the past year. This unsettling trend underscores the critical vulnerabilities within the Indian manufacturing sector, where limited visibility into operational technology (OT) systems, inadequate network monitoring, and suboptimal cyber-hygiene implementation have left organizations exposed. Organizations must implement enterprise-wide Zero Trust network architecture to create layers of security that limit an attacker from successfully moving laterally around the network.”

The 3,998 posts from ransomware leak sites represented a 49% increase compared to 2022, where 2,679 posts were observed globally. This increase can be attributed to zero-day exploits targeting vulnerabilities for MOVEit Transfer SQL Injection and GoAnywhere MFT, among others.

As further evidence, when reviewing the number of compromises reported by ransomware leak sites, sporadic spikes were observed (see figure below). These loosely aligned with periods where ransomware groups began exploiting specific vulnerabilities.

Unit 42 2024 Incident Response Report: Speed of Exfiltration + Vulnerabilities Driving Activity

Unit 42 analyzed more than 600 incidents from 250 organizations for the 2024 Unit 42 Incident Response Report. This investigation went beyond ransomware leaksite posts into the overall casework volume. While phishing has historically been a popular tactic with attackers, the report found that it is declining, but only sort of.

From a one-third share of initial access incidents in 2022, phishing has dropped to just 17% in 2023. This indicates a potential de-prioritization of phishing as cybercriminals adapt to more technologically advanced – and perhaps more efficient – infiltration methods. More advanced threat actors are moving away from traditional and interactive phishing campaigns to less noticeable and possibly automated methods of exploiting system weaknesses and pre-existing credential leaks. Other key findings from the report include:

●      More-Sophisticated Threat Actors Are Gaining Initial Access Differently: There has been a discernible rise in the exploitation of software and API vulnerabilities. Exploiting such vulnerabilities accounted for 38.60% of the initial access points in 2023, up from 28.20% in 2022.

• Threat Actors Grab Data Indiscriminately: In 93% of incidents, threat actors took data indiscriminately rather than searching for specific data. This is up from 2022, when 81% of cases involved non-targeted data theft. In 2021, it was even lower at 67%. The surge points to a growing trend among cybercriminals who seem to be casting a wider net, gathering any data they can access rather than expending effort to locate and extract particular datasets.
• Extortion tactics to maximize yields: Interestingly, while the rate of harassment and other extortion tactics w.r.t. Ransomware has remained steady over the past few years, the rate of harassment in cases where payments were made has jumped by 27x since 2021.
• Higher demands, lower payouts: In 2023, median ransom demands increased from $650,000 to $695,000 (3%↑) but median payouts decreased from $350,000 to $237,500 (32%↓). This can be potentially attributed to organizations calling-in Incident Response teams with negotiation capabilities (which fewer did in the past).

Huzefa Motiwala, Director, Systems Engineering, India and SAARC, said “While the surge in ransomware incidents is concerning, there are glimmers of hope amidst the challenges. The data reveals a promising shift in organizations’ response strategies, with a notable increase in median ransom demands countered by a decrease in median payouts. Since organizations are more willing to call-in Incident Response teams, threat actors are happy to take the path of least resistance. Which, in most scenarios, is to grab what they can get, and move on.”

The post Manufacturing the worst hit by ransomware in India: Palo Alto research appeared first on CIO Dimension.

The rapid adoption of Generative AI (GenAI) technologies has led to a significant increase in sophisticated phishing campaigns. A recent study by Abnormal Security reveals that 80% of these campaigns now leverage GenAI tools, marking a critical turning point in the fight against digital fraud.

The integration of AI in phishing attacks has led to a dramatic 1265% increase in such incidents since 2022, as reported by InfoSecurity Magazine. The availability of free or trial-based AI tools, such as ChatGPT, has made it easier for cybercriminals to generate convincing phishing content, with the potential to create up to 30 templates per hour.

AI’s role in evolving phishing techniques

AI’s proficiency in generating high-quality content has significantly reduced the effectiveness of traditional phishing detection methods. AI-based proofreading tools can eliminate common phishing indicators, making attacks more challenging to identify.

The rapid response rates of AI models, like ChatGPT’s 15-20 seconds and the 3.5 Turbo Model API’s under 3 seconds, further enhance the efficiency of these attacks.

Lukas Junokas, Chief Technology Officer at Breezit, an event planning platform, shares a challenging encounter with a phishing email that closely imitated the writing style of a high-ranking executive, asking for confidential information. This email managed to evade standard detection filters because of its authenticity.

“Generative AI has undeniably transformed phishing, making attacks more personalized and harder to detect. The new challenge lies in the arms race between evolving AI capabilities in both creating and detecting sophisticated threats,” Lukas noted.

The emergence of malicious-AI-as-a-service

The concept of ‘Malicious-AI-as-a-Service’ is gaining traction, facilitating the automation and scaling of phishing operations. This development lowers the entry barrier for cybercrime, enabling even those with minimal technical skills to execute sophisticated attacks.

Valentin Rusu, Head of Malware Research and Analysis at Heimdal, highlights the potential dangers of Reinforced Learning in black-hat hacking.

“Imagine a hacker training an AI to break security systems through trial and error.” “This could lead to unprecedented cybersecurity challenges,” Rusu remarked.

Adelina Deaconu, Heimdal’s MXDR (SOC) Team Lead, adds that genAI has the potential to exploit personal vulnerabilities and advises people to step back if something seems suspicious.

“I’m especially worried about how generative AI can now analyze and exploit personal vulnerabilities and emotions, making the emails seem more convincing. I advise people to step back, verify information, and report any concerns. If something seems suspicious, it likely is,” says Adelina.

Brian David Crane, founder of CallerSmart, an app for investigating mystery phone numbers, believes that generative AI can scale up spear phishing and vishing attacks.

“With generative AI, cyberattacks can happen at scale, be relentless with malware code modification and generative chatbots using spear phishing & vishing attacks with an automated selection of targets based on publicly available data or information,” says David.

 Statistical insights: the growing AI threat

• 83% of companies prioritize AI over other technologies (Notta AI).
• 51% of businesses rely on AI for threat detection and remediation (EFT Sure).
• One in five people will open AI-generated phishing emails (SoSafe Awareness).
• 69% of organizations stated that they could not avert cyber-attacks without AI (CapGemini).

The way forward: awareness and vigilance

As AI continues to evolve, organizations and individuals must stay informed and exert caution when opening emails.

 “People should pay attention to strange email addresses, tone of the email, requests for sensitive information, signature and formatting, and should avoid clicking on URLs (hover over them first and see if the displayed URL matches the visible text),” says Adelina.

Understanding the capabilities and potential misuse of AI in phishing is the first step toward developing more effective countermeasures.

Source: Heimdal Security

The post The escalating threat of AI-driven phishing appeared first on CIO Dimension.

A new forecast from Gartner indicates that Generative AI is all set to transform the cybersecurity space in India. The emergence of generative AI (GenAI) has caused one of the biggest disruptions in digital and business sectors in the last couple of years. “Through ethical, safe and secure implementation of this technology, CISOs can improve the performance of their security functions and enhance organizational resilience,” said Abhyuday Data, Director Analyst at Gartner. 

While managing GenAI presents inevitable challenges, there are also external factors to consider, such as regulatory concerns and the rapid adoption of cloud computing.

To effectively handle the combined impact of these forces and enhance their organization’s cybersecurity program in 2024, Gartner recommends that CISOs in India must prioritize two top cybersecurity trends:

GenAI Transforming the Cybersecurity Market: GenAI introduces new attack surfaces requiring  changes to application and data security practices and user monitoring. Gartner predicts that by 2025, GenAI will cause a spike in the cybersecurity resources required to secure it, causing more than a 15% incremental spend on application and data security.

Gartner analysts said organizations should conduct proof of concepts before incorporating GenAI into their cybersecurity programs, beginning with application security and security operations. A policy for overseeing the introduction of GenAI-based products into the organization must also be established, to ensure that all internal teams using this technology understand and adhere to a set of unified policies.

Bridging the Communications Gap with Cybersecurity Outcome-Driven Metrics: Outcome driven metrics (ODMs) are central to creating a defensible cybersecurity investment strategy. They provide a credible and defensible expression of risk appetite that supports direct investment.

“ODMs enable SRM (security & risk management) leaders to convey the value of cybersecurity investment beyond the importance of regulatory compliance,” said Data. “Organizations seeking an approach to measure cybersecurity value that resonates with executives and supports practical investment decisions must adopt ODMs.”

Spending in security to grow

Gartner forecasts that end-user spending on security and risk management (SRM) in India is expected to total $2.9 billion in 2024, an increase of 12.4% from 2023. 

Indian organizations will continue to increase their security spending through 2024 due to legacy IT modernization using cloud technology, industry demand for digital platforms, updated regulatory environment, and continuous remote/hybrid work.

In 2024, cloud security spending in India is projected to record the highest growth. The adoption of cloud and multi-cloud presents security challenges, causing an increased focus on cloud security by Indian organizations.

The post GenAI will transform the cybersecurity market in India: Gartner  appeared first on CIO Dimension.

2023 saw organisations witness unprecedented levels of cybercrime. Palo Alto Networks’ State of Cybersecurity survey found that 67% of Indian government/essential services witnessed more than 50% increase in disruptive cyberattacks in 2022–2023. In October 2023, the firm received the most number of calls to their incident response team ever. Cybercriminals have used ransomware to target critical infrastructures and found novel techniques to exploit emerging technologies like generative AI to ill-effect. 

The State of Cybersecurity survey also found that 75% of Indian organisations have increased their cybersecurity budgets in 2023 compared to 2022. With Indian organisations investing more within cybersecurity, it’s critical this money be spent wisely.

Predicting cybersecurity trends for 2024 will be especially important if organisations want to get ahead of modern cyberattackers. With stakes higher than ever, organisations need to take a holistic approach – accounting for macroeconomic factors, emerging technologies, and cloud risks among others.

Ian Lim, Field Chief Security Officer, Palo Alto Networks, said, “In 2023, we’ve seen mature organisations, who invest heavily in cybersecurity, still falling victim to debilitating cyberattacks. This is due to the tenacity and ingenuity of attackers who exploit cyber hygiene issues or find novel ways to compromise legacy defences. Another key reason for these breaches lies in the complexity of security capabilities in most modern organisations. They use an average of 31.58 disparate security tools to protect their highly interconnected and innovative environments. The lack of correlation and the level of noise generated by these tools creates immense visibility gaps and dampens their ability for detection and response.”

He added, “Going into 2024, highly motivated cybercriminals, nation state attackers and hacktivists will continue to innovate, expand and exploit – not much we can do to slow that down. However, we could and should definitely address the complexity of our security capabilities with AI to make them more effective and cost efficient.”

Here are the five cybersecurity trends to watch out for in 2024:

1.        Hacktivism: the modern crusade 

2023 saw numerous instances of broadcast events being disrupted by climate activists. This year, this protest could take the shape of a cyber-first campaign. With significant events like the Olympics, the Euros, and regional elections coming up, hacktivists will look to further their cause to audiences in the millions. Previously, a high level of technical expertise was necessary, but the cybercrime-as-a-service model has lowered this threshold. Now, it only takes an extremely motivated activist with sufficient funds.

Tumultuous geopolitical climates will provide opportunities for hacktivists to gain notoriety for their group and sympathy for their cause. Most hacktivist activity is via Distributed-Denial-of-Service (DDoS) attacks. For example, during the G20 Summit in India, more than 30 groups of hacktivists from neighbouring countries attacked more than 600 websites of government and private entities through DDoS attacks, defacements, and data leaks.

In 2024, organisations should evaluate their risk profile according to the evolving threat landscape and ensure coverage not only for financially motivated attacks but also for hacktivism and nation-state attacks.

2.        AI’s role in cybersecurity will evolve, for good and bad

Since ChatGPT’s launch in October 2022, there have been concerns worldwide regarding its potential to democratise cybercrime. Despite having guardrails to prevent malicious applications, a few creative prompts can get ChatGPT to generate near flawless phishing emails that sound “weirdly human” at immense scale. We’ve seen attackers use Gen AI in novel ways like deepfake and voice technology to scam banks out of millions. Companies adopting Gen AI must be wary about the vulnerabilities of model poisoning, data leakage, prompt injection attacks, etc. Attackers will continue to exploit innovation gaps with the increased use of Gen AI for legitimate use cases.

Hence, one of the AI Cybersecurity trends expected in 2024 is the maturation on how organisations protect enterprise-level use of Gen AI. This involves making sure that security controls, vulnerability management and threat monitoring activities are embedded through the entire lifecycle of AI development projects. Gen AI will further embed itself into cybersecurity capabilities. Its ability to summarise, weed through noise, and give concise summaries of security events is far greater than a human analyst’s (especially at the scale a modern SOC operates). With LLMs getting better by the day, we are bound to see more sophisticated applications that move beyond just being a clever and occasionally-hallucinating chatbot.

3.        Operational technology will remain the low-hanging fruit

Operational Technology is the heart of any industrial organisation. As the primary generator of revenue, OT systems must have a high level of cyber maturity. Palo Alto Networks’ State of Cybersecurity survey found that 67% of Indian government/essential services witnessed more than 50% increase in disruptive cyberattacks in 2022–2023. As organisations scramble to resolve OT-related cybersecurity woes, they will face a lack of specialised solutions that cater to the specific and niche needs of OT professionals. Many organisations still believe OT environments are protected by an air gap, whereas IT/OT convergence has resulted in OT being more connected than ever to IT and, in many cases, to the cloud. This has expanded the attack surface and greatly increased the risk to OT networks, without the investment in cyber controls.

A breach of OT systems can not only result in lost revenue, but also potentially, injuries or loss of life. A cyber secure OT environment is also a safe and reliable OT environment. A Zero Trust architecture will protect the most critical OT systems from threats, while allowing organisations to focus on their digital transformation. 2024 will see organisations invest in OT cyber security maturity to protect their most important business systems and manage the increased risk to an acceptable level.

4.        Consolidation to enable the next frontier in cybersecurity

Unit 42’s Cloud Threat Report (Volume 7) found that on average, security teams take approximately 6 days to resolve a security alert, with 60% of organisations taking longer than 4 days. In a threat landscape where attackers only require a few hours to find and exploit vulnerabilities, 4-6 days is just way too long. Organisations with disparate security tools that are not well integrated have a harder time deploying automation and orchestration. This is a major setback to reducing the mean time to detect and the mean time to respond. 

In addition to the lacklustre threat response, organisations with siloed solutions are having a hard time securing their rapid digital transformation initiatives. Alongside macroeconomic headwinds and workforce challenges, enterprises are looking to consolidate their vendor spread and reduce complexities. Put simply, it is easier to manage the cybersecurity stack if there is one point of contact when a crisis inevitably strikes. Over the long term, it reduces costs and yields better results. This is thanks to the increased visibility and seamless integration that comes with a unified security offering. More organisations are waking up to these benefits and thus 2024 will see customers focus on reducing complexities and turning to consolidated cybersecurity stacks. 

5.        Securing the cloud will be high on the agenda 

Per the State of Cybersecurity survey, India leads APAC in cloud migration, with 80% of businesses already having a large proportion of infrastructure on the cloud, and 42% adjusting their cybersecurity strategy to adopt cloud security. Early adopters of cloud typically start with a single hyperscaler. Naturally, the single cloud model would adopt native security tools from their chosen Cloud Service Provider (CSP). Through the course of time, they experience issues and outages that can only be addressed by adopting a multi or hybrid cloud strategy. This multicloud journey would most likely necessitate a review on their existing cloud security paradigm as native CSP security tools do not seamlessly translate to different CSPs. 

In 2024, organisations that have to contend with multi or hybrid cloud projects would move to establishing a more unified approach to security when dealing with more than one cloud provider. Rationalising cloud security tools across the entire development lifecycle will also be a focus as this provides much higher visibility, correlation, and security monitoring.

The post Hacktivism to GenAI: Here are the top 5 cybersecurity predictions for 2024 appeared first on CIO Dimension.

Authored by: Leela Krishna

Data has never been as important for companies as it is today. The potential impacts of loss of data privacy have led many countries to pass data regulations such as the General Data Protection Regulation (GDPR) in the EU or the recent Digital Personal Data Protection Act (DPDP Act) in India. These regulations require companies to take specific measures to protect customer data and facilitate requests from individuals, making compliance a key concern. 

The protection of customer data is a major business imperative for any organization, especially ones working with sensitive information like financial or health data. Data has long been the backbone of operations and business models of companies and is only becoming more crucial with the increasing deployment of machine learning models. Creating data protection protocols in compliance with these regulations will help assuage customer concerns and enable fintech companies to build a strong data foundation upon which they can create solutions. For the sake of simplicity, the measures that companies can take can broadly be grouped into two categories: security and general compliance.

Protection is the priority

Adopting robust security measures is now a non-negotiable that has been ratified into law. There are many ways in which data can be protected in the digital age, but a good first place to start is actually non-digital – adopting best practices on data governance, hygiene, disposing of the data and physical security. Organizations need to ensure that their data assets, and other critical infrastructure are safeguarded against unauthorized access, natural disasters, and other potential threats. By implementing strict access control systems, businesses can deter malicious actors from physically accessing sensitive data. And then the governance, supported by a strong and regular audit of the effectiveness of the controls is vital to ensure that vulnerabilities do not exist and or are remediated promptly.

Physical measures will only be the starting point for data protection. Businesses are becoming more and more interconnected with rising rates of cloud adoption across sectors, all while remote working becomes a common business practice. All these factors compound, exponentially increasing network vulnerabilities and making network security a priority for organizations. Creating and regularly updating the perimeter defenses such as firewalls, intrusion detection systems, and intrusion prevention systems to monitor and block any unauthorized or malicious traffic will be crucial to thwarting evolving cyber threats.

The conventional network/security controls can be taken one step further with the creation of Zero Trust architectures that have stringent verification protocols, regardless of whether the user or device is inside or outside the organization’s network. Zero Trust is becoming the norm for many organizations as it protects organizations from external and insider threats alike. 

While network security focuses on safeguarding the pathways by which data can be illegally accessed there are security measures that target the data itself. Such data security measures first require companies to map out all the data they own and process, whether it is customer data or proprietary data. This provides the foundation for additional measures like encryption at rest and in transit to limit the damage when access is compromised by malicious actors, and regular backups. Backups are an essential component of contingency plans in the event that data gets lost, corrupted or compromised.

Having robust internal data protocols and accesses also can create a rich layer for advanced machine learning based analytics and automated response mechanisms. Using security information and event management (SIEM) tools with a layer of analytics can allow the organization to monitor, detect and respond to threats in real time. Finally, to reiterate, no security measures will be effective if they are not complimented by commiserating audit process. And lastly, the most important aspect is the human intervention in the middle. Continuous training and awareness campaigns are what can avoid or minimize any and every possible impact of an incident.

Beyond network boundaries

While security measures are an essential part of data protection laws, most regulations cover a variety of other provisions concerning the implications of data processing activities. For example, organizations will have to think of compliance when setting up their data processing and storage infrastructures. Many data protection regulations, including the DPDP Act, create obligations on companies to respond to requests from data principals regarding the status of any personal data the company may be holding. Similarly, there are obligations to notify data principals if their data has been compromised via a data breach. All these measures require the setting up of necessary mechanisms to ensure that organizations are well placed to adhere to these provisions. This can be especially complicated for large companies that have third party vendors who store or process data on behalf of these companies. 

Organizations will also need to conduct privacy impact assessments to identify, assess, and mitigate privacy risks. Previously just an ideal practice for organizations to follow, Data Protection Impact Assessments (DPIAs) are now a requirement under the DPDP Act. These assessments allow companies to scrutinize the nature, scope, context, and purpose of their data processing activities to ensure compliance and protect the rights of data principals under the DPDP Act.

Keeping up to date

Data protection regulations are going to be the norm moving forward so ensuring compliance will be a crucial aspect of operations for all organizations. As the importance of data continues to grow, so does the responsibility of protecting it. 

A multi-faceted approach encompassing both robust security measures and stringent privacy compliance processes is the way forward. This includes clearly defining policies on classification, ensuring access on need basis, employing right set of standards and technology controls, aptly defining processes for customer data, vendor/third party assurance programs, proactively integrating the privacy in design, and getting executive support for the initiative while ensuring continuous improvement. In a world rife with cyber threats and regulatory complexities, this dual focus ensures not only business continuity and legal compliance but also the trust of customers and stakeholders.

The author is the IT Head of Broadridge India, a global fintech company. Broadridge provides the critical infrastructure that powers investing, corporate governance, and communications to enable better financial lives.

The post Data protection in the digital age: How FinTechs can dot the I’s and cross the T’s appeared first on CIO Dimension.

By Lexi Croisdale, Content Marketing Manager, Varonis

Humans eat, sleep, and expose data.  

Just in the time it takes you to read this blog, your blast radius will expand meaningfully. As access to sensitive data expands in the cloud, so do the different ways it can be compromised. 

With some of your most crucial data living in the cloud environment, how can you keep it protected? Which threats should you be most concerned about? 

Let’s discuss it below:

Threat #1: Identity risk  

One of the challenges of using the cloud is the sprawl of applications that create a unique set of identities. As the cloud footprint increases, it’s a challenge for security teams to monitor and secure multiple identities in multiple spaces. 

Threat actors are also evolving and targeting users specifically through various tactics, like social engineering and compromising personal accounts. The LAPSUS$ group made headlines when they hacked major companies, including Microsoft, Okta, Samsung, Ubisoft, and Nvidia, using phone-based social engineering and SIM-swapping. The group would call IT departments and impersonate the target, bypass multifactor authentication or password resets, and gain access to the data.  

There are two steps to help determine the identities of users inside and outside of your organization who have access to your environment. Take stock of all the applications being used in your organization and understand the permissions involved within each of them.

Conduct reporting on a weekly, monthly, or quarterly basis. The metrics found in your report will identify areas that need attention, such as stale users, personal account use, a jump in external users, or more admin access being granted.

It’s also important to set parameters for offboarding employees, as stale user accounts could give former employees the ability to expose your sensitive data and give attackers an opportunity to access your environment. 

Threat #2: Configuration risk  

A multitude of cloud applications brings a multitude of configuration settings. When implementing new applications, it takes time to learn how specific settings are configured by default, what the best practices are, and to distinguish if the settings for production environments differ from sandbox or dev environments. 

Varonis Threat Labs discovered that anonymous users could exploit misconfigured Salesforce communities to potentially expose sensitive data — such as customer lists, support cases, email addresses, and more — to anyone on the internet.  At a minimum, malicious actors could exploit configurations to perform recon for spear-phishing campaigns, and at worst, they could steal sensitive information about the business, including its operations, clients, and partners. 

Many organizations don’t realize that Salesforce, or some of the other file-sharing collaboration platforms, are built by design to share data publicly and that it’s a feature, not a bug. Auditing your security configurations on a recurring basis can help minimise the amount of unwarranted access to your cloud environments. Some applications, such as Salesforce, also have built-in health checker tools that you can run manually.  

Threat #3: Third-party app risk  

Third-party apps connect to your SaaS or infrastructure applications, and this often happens without oversight from security teams because users can grant themselves permissions — often without thinking twice about the access they give these apps.   

Think of trying to sign up for the latest social networking app, and to bypass filling out a lengthy form, you can simply connect it to your Gmail account, thus opening up access to your information stored within this app.  It can be challenging to understand which apps are configured and what they have access to, which is similar to the identity risks covered in threat #1.  

You can assess how many employees are using the app and their activity levels with automation or through manual reporting. For example, users who haven’t opened a high-risk app in the last six months should have their permissions revoked to avoid breaches. You may want to disconnect the app altogether if it’s not being used.  

Continually monitoring and cleaning up your third-party app library will ease monitoring and maintaining what apps have access to your data. 

Threat #4: Cloud vulnerabilities  

Vulnerabilities in the cloud are usually not by design and could be bugs or holes in the code or application. In 2021, our research team identified a bug in Salesforce dubbed Einstein’s Wormhole, which exposed calendar events that could contain highly sensitive data such as attendee names, emails, meeting URLs, passwords, and replies being sent to organizers. Prior to the bug being patched, meeting information with potentially sensitive information was exposed to the entire internet.  

It’s important to monitor and see what’s happening inside applications, regardless of how much control you have over their coding and/or ability to fix bugs and patch appropriately. It’s also important to internally educate teams about the risks involved with applications that are beyond your security teams‘ control. 

Everyone owns a portion of the risk and should understand that the cloud is more accessible than ever. 

Threat #5: Link/permissions risks 

Most cloud applications are designed for collaboration and file sharing, which can allow end users to share data externally, organization-wide, or even create public links that could be accessible to anyone on the internet.  

While sharing links eases the ability to collaborate and distribute information, they also bring a higher risk of your data getting into the wrong hands and employees having access to information they don’t need. 

A classic example of excessive permissions mixed with an insider threat is the U.S. Pentagon document leak. A junior airman had access to classified information that he shouldn’t have had access to and while there were perimeter defenses in place to stop him from downloading the data to an external source, he was able to take pictures of the content and transcribe the information. The employee then hosted the information on a Discord server, spurring a diplomatic crisis. 

Having least privilege automation in place can help combat the risk involved with excessive permissions by revoking organization-wide, external, and public link access over time.  

The power of automation keeps your information secure and doesn’t require a heavy lift for security teams to constantly analyze link permissions for the thousands of users and files they create.  

This article was first published on Varonis website – https://www.varonis.com/blog/how-to-protect-your-cloud-environment-from-todays-top-5-threats

The post How to protect your Cloud environment from today’s top 5 threats appeared first on CIO Dimension.