The latest Gone Phishin' event, finds that about 20% of the subjects were compromised by a simulated phishing email; almost 15% did not recognize a malicious download site. Larger organizations, or those that would be expected to have more robust security training programs, tended to fare the worst.
Cyber Security
Cyber criminals, state-sponsored hackers and even the occasional disgruntled employee are constantly looking to gain unauthorized access for a variety of purposes: theft of money, cyber espionage, personal information for sale or for use in scams, and damage to critical infrastructure for just a few of the most common.
So how does an organization mitigate an entire world full of continual cyber attacks? Just as buildings have a number of necessary elements of physical security: access control, cameras, alarms and so on; there are similar key elements of cyber security that are absolutely vital for just about any modern business.
It starts with identifying and closing the most common doors that attackers use. For example, phishing attacks on employees are far and away the most common initial point of entry. The breach of even a low-level employee account can quickly turn into an escalation in access privileges and the ability to reach sensitive information. This is also true of smart devices, which are generally more poorly secured than computers and phones.
Kronos, a payroll provider known to be used by several thousand companies ranging from Tesla to National Public Radio (NPR), had its Private Cloud service go offline due to a ransomware attack. There is speculation that the Log4Shell vulnerability was involved.
Leveraging the Hancitor malware, the ransomware gang earned $43.9 m after compromising 49 critical infrastructure entities in finance, government, healthcare, manufacturing, and IT.
WordFence discovered over 13.7 million cyber attacks targeting four vulnerable plugins and 15 Epsilon framework themes in 36 hours hitting 1.6 million WordPress websites.
Organisations which have chosen the long run tackling digital transformation over the prompt adoption strategy and try to mate it with their established internal tactics have experienced fewer ransomware attacks.
Brazil's Health Ministry is looking at extended downtime for the system that processes Covid-19 vaccination data as it attempts to recover from two ransomware attacks that came just four days apart.
Manufacturers are introducing remote operations capacity for OT systems, allowing employees, contractors, and trusted third parties to operate on-site infrastructure from anywhere in the world. While the benefits are multifaceted, the risks to critical infrastructure are real.
We are living in the middle of an arms race in cybersecurity. Adversaries are leading the way, while the good guys reconfigure and retool, and the cycle continues. What does the crystal ball look like for the cybersecurity and risk management world of 2022?
Report from security firm Analyst1 illustrates how agile ransomware groups have become, to the point that they are backing off and regrouping with new tactics before slow-moving legislation and enforcement can catch up with them.
Given the growth of wire fraud and grey area when it comes to liability, creating a system that guarantees protection has become incredibly important. The best way to prevent uncertainty about who is at fault is to prevent the risk from happening all together.










