70% of businesses reported increased spending on proactive security solutions, such as attack surface management and risk-based vulnerability management, over the past year, according to a new research from Titania. The report, Emerging Best Practice in the use of Proactive Security Solutions, indicates a marked increase in investments aimed at preemptively mitigating cyber threats. This notably outpaces investments in both preventative and reactive measures.

The study, completed in partnership with Omdia, a global analyst and advisory leader, surveyed over 400 security decision-makers in North America, the UK, France, and Germany. It underscores the acceleration in adoption of proactive security measures from three key drivers: ‘reducing the opportunity for threats’, ‘reducing the mean time to remediate known vulnerabilities’, and ‘minimizing attack surface’. 

Key findings of the report include:

• Strategic Implementation: A significant portion of organizations, particularly those with mature security postures, are strategically deploying proactive security solutions. This trend is especially prevalent among larger organizations. This growth is particularly pronounced in EMEA, where 74% of respondents increased their budgets, compared to 67% in North America. The desire is particularly strong amongst financial services organizations (54%) and critical infrastructure organizations (53%) including energy and utilities companies. In addition, almost half (47%) reported that their top cybersecurity goals for the next 12-24 months are to reduce the opportunity for threats with proactive security. Conversely, only 27% of organizations plan to improve tactical outcomes, such as better threat prevention, detection and response.

• Enhanced Security Posture: Respondents report a strong desire to improve security posture and expect that the broader integration of proactive security tools will greatly improve attack surface management and security control optimization. Currently, a large majority of respondents report having limited visibility into the security posture of network assets (firewalls, switches and routers) and long cadences between assessments – with roughly half of organizations checking network devices at most, monthly. 
  Organizations are also much more likely to only monitor all devices in critical segments (or simply look at a sample of devices), than to monitor every device in their networks. Notably, critical infrastructure organizations (i.e., energy, utilities, and transportation) report much lower confidence than other industries in their ability to maintain adequate network segmentation and prevent unauthorized access to networks.
  
  
• Disruption Anticipation: Almost half (48%) of all respondents anticipate a high level of organizational disruption due to the broader adoption of proactive security solutions, highlighting the transformative impact these measures are expected to have.

“This research vividly illustrates a widespread and rapid shift towards proactive security to improve operational readiness and resilience. Organizations are recognizing the critical need to stay ahead of known threats and shut down attacks by investing in solutions that offer real-time visibility of their security posture and remediating action that will continuously minimize their exposure.”

Tom Beese, Executive Chairman, Titania

The post Over 70% businesses in advanced economies increased spending on proactive security appeared first on CIO Dimension.

By Lexi Croisdale, Content Marketing Manager, Varonis

Humans eat, sleep, and expose data.  

Just in the time it takes you to read this blog, your blast radius will expand meaningfully. As access to sensitive data expands in the cloud, so do the different ways it can be compromised. 

With some of your most crucial data living in the cloud environment, how can you keep it protected? Which threats should you be most concerned about? 

Let’s discuss it below:

Threat #1: Identity risk  

One of the challenges of using the cloud is the sprawl of applications that create a unique set of identities. As the cloud footprint increases, it’s a challenge for security teams to monitor and secure multiple identities in multiple spaces. 

Threat actors are also evolving and targeting users specifically through various tactics, like social engineering and compromising personal accounts. The LAPSUS$ group made headlines when they hacked major companies, including Microsoft, Okta, Samsung, Ubisoft, and Nvidia, using phone-based social engineering and SIM-swapping. The group would call IT departments and impersonate the target, bypass multifactor authentication or password resets, and gain access to the data.  

There are two steps to help determine the identities of users inside and outside of your organization who have access to your environment. Take stock of all the applications being used in your organization and understand the permissions involved within each of them.

Conduct reporting on a weekly, monthly, or quarterly basis. The metrics found in your report will identify areas that need attention, such as stale users, personal account use, a jump in external users, or more admin access being granted.

It’s also important to set parameters for offboarding employees, as stale user accounts could give former employees the ability to expose your sensitive data and give attackers an opportunity to access your environment. 

Threat #2: Configuration risk  

A multitude of cloud applications brings a multitude of configuration settings. When implementing new applications, it takes time to learn how specific settings are configured by default, what the best practices are, and to distinguish if the settings for production environments differ from sandbox or dev environments. 

Varonis Threat Labs discovered that anonymous users could exploit misconfigured Salesforce communities to potentially expose sensitive data — such as customer lists, support cases, email addresses, and more — to anyone on the internet.  At a minimum, malicious actors could exploit configurations to perform recon for spear-phishing campaigns, and at worst, they could steal sensitive information about the business, including its operations, clients, and partners. 

Many organizations don’t realize that Salesforce, or some of the other file-sharing collaboration platforms, are built by design to share data publicly and that it’s a feature, not a bug. Auditing your security configurations on a recurring basis can help minimise the amount of unwarranted access to your cloud environments. Some applications, such as Salesforce, also have built-in health checker tools that you can run manually.  

Threat #3: Third-party app risk  

Third-party apps connect to your SaaS or infrastructure applications, and this often happens without oversight from security teams because users can grant themselves permissions — often without thinking twice about the access they give these apps.   

Think of trying to sign up for the latest social networking app, and to bypass filling out a lengthy form, you can simply connect it to your Gmail account, thus opening up access to your information stored within this app.  It can be challenging to understand which apps are configured and what they have access to, which is similar to the identity risks covered in threat #1.  

You can assess how many employees are using the app and their activity levels with automation or through manual reporting. For example, users who haven’t opened a high-risk app in the last six months should have their permissions revoked to avoid breaches. You may want to disconnect the app altogether if it’s not being used.  

Continually monitoring and cleaning up your third-party app library will ease monitoring and maintaining what apps have access to your data. 

Threat #4: Cloud vulnerabilities  

Vulnerabilities in the cloud are usually not by design and could be bugs or holes in the code or application. In 2021, our research team identified a bug in Salesforce dubbed Einstein’s Wormhole, which exposed calendar events that could contain highly sensitive data such as attendee names, emails, meeting URLs, passwords, and replies being sent to organizers. Prior to the bug being patched, meeting information with potentially sensitive information was exposed to the entire internet.  

It’s important to monitor and see what’s happening inside applications, regardless of how much control you have over their coding and/or ability to fix bugs and patch appropriately. It’s also important to internally educate teams about the risks involved with applications that are beyond your security teams‘ control. 

Everyone owns a portion of the risk and should understand that the cloud is more accessible than ever. 

Threat #5: Link/permissions risks 

Most cloud applications are designed for collaboration and file sharing, which can allow end users to share data externally, organization-wide, or even create public links that could be accessible to anyone on the internet.  

While sharing links eases the ability to collaborate and distribute information, they also bring a higher risk of your data getting into the wrong hands and employees having access to information they don’t need. 

A classic example of excessive permissions mixed with an insider threat is the U.S. Pentagon document leak. A junior airman had access to classified information that he shouldn’t have had access to and while there were perimeter defenses in place to stop him from downloading the data to an external source, he was able to take pictures of the content and transcribe the information. The employee then hosted the information on a Discord server, spurring a diplomatic crisis. 

Having least privilege automation in place can help combat the risk involved with excessive permissions by revoking organization-wide, external, and public link access over time.  

The power of automation keeps your information secure and doesn’t require a heavy lift for security teams to constantly analyze link permissions for the thousands of users and files they create.  

This article was first published on Varonis website – https://www.varonis.com/blog/how-to-protect-your-cloud-environment-from-todays-top-5-threats

The post How to protect your Cloud environment from today’s top 5 threats appeared first on CIO Dimension.

Research and advisory firm Info-Tech Research Group has published its newest industry blueprint, Build an IT Risk Taxonomy. This data-backed resource aims to help organizations to become more flexible and agile to adapt to changing business conditions, according to the company. 

“Managing emerging risks such as climate risk, the impact of digital disruption on internal technology, and the greater use of third parties will require IT leaders to be more disciplined in how they manage and communicate material risks to the enterprise,” says Donna Bales, principal research director at Info-Tech Research Group.

“Establishing a hierarchical common language of IT risks through a taxonomy will facilitate true aggregation and integration of risks, enabling more effective decision making.”

Info-Tech’s blueprint highlights the challenges IT departments face in managing and addressing risks. These challenges include business leaders who are seeking to make informed decisions and expect timely and consistent risk reporting from IT. The constantly evolving threat landscape also adds complexity, requiring IT risk managers to balance the emerging threats while not losing sight of the current risks.

The firm’s research explains that developing a relevant and detailed IT risk taxonomy over time can be particularly challenging and that gaining acceptance and promoting accountability within the organization may pose further obstacles. However, involving business leaders and risk owners in the development of the IT risk taxonomy can enhance organizational acceptance and understanding.

In the new resource, Info-Tech advises that risk management must also mature as technology and digitization continue to advance. To strengthen operational and financial resiliency, organizations must move away from a siloed approach to IT risk management toward an integrated approach.

Without a common IT risk taxonomy, effective risk assessment and aggregation at the enterprise level is not possible. The firm’s blueprint outlines an IT risk taxonomy approach that can provide a common language to enable more efficient risk aggregation and interoperability between IT and the enterprise. The recommended approach includes the following three phases:

1. Understand Risk Management Fundamentals: IT departments must take a collaborative approach when developing an IT risk taxonomy to enable greater acceptance and understanding of accountability.
   
2. Set the Organization Up for Success: Risk managers must invest sufficient time in conducting a comprehensive analysis of the existing and future threat landscape when defining level 1 IT risks and consider the causal impact and complex linkages and intersections.
   
   
3. Structure an IT Risk Taxonomy: IT risk managers must recognize the dynamic nature of the threat landscape and acknowledge that an IT risk taxonomy is a living document that requires regular review and enhancement to ensure its ongoing relevance and effectiveness.

“This holistic, disciplined approach to risk management helps to promote a more sustainable risk culture across the organization while adding greater rigor at the IT control level,” explains Bales.

As the risk landscape continually evolves, there is greater pressure on the risk function to work collaboratively throughout the organization to strengthen operational resilience and minimize strategic, financial, and reputational impact. A successful risk taxonomy is forward-looking and codifies the most frequently used risk language across an organization.

The post IT must anticipate risks to adapt in age of disruption: Info-Tech Research Group appeared first on CIO Dimension.