Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that,&nbsp;the North American news lead for Infosecurity Magazine. She also&nbsp;spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

Tara-Seals-Headshot2.jpg

Tara Seals

A zero-day security vulnerability in Google Chrome for Android is being actively exploited in the wild, the Internet giant says.
The issue is a high-severity heap-buffer overflow bug (tracked as CVE-2022-2294) in WebRTC. WebRTC is an HTML5 specification that allows webpages to play real-time audio and video content inside the browser. 
"Google is aware that an exploit for CVE-2022-2294 exists in the wild," the company said in its advisory on the issue.
As usual, Google is keeping the vulnerability's technical details close to the vest until a majority of users have updated their browsers, but <a href="https://cwe.mitre.org/data/definitions/122.html" target="_blank">heap-buffer overflows</a>
in general are memory issues that can lead to a range of bad outcomes if exploited. Possible outcomes include crashing the device, denial of service (DoS), remote code execution (RCE), and security-service bypasses.
Patrick Tiquet, vice president of security and architecture at Keeper Security, did some delving into the issue, and says that bug does indeed allow RCE.
"CVE-2022-2294 is a serious vulnerability that could lead to arbitrary remote code-execution by simply visiting a malicious website," he says. "This could enable an attacker to perform a variety of actions on a target system, such as install malware or steal information. Windows and Android Chrome users should ensure that they install the latest updates to protect themselves." 


To address the flaw, Google released <a href="https://chromereleases.googleblog.com/2022/07/chrome-for-android-update.html" target="_blank">Chrome 103 (103.0.5060.71)</a> for Android on Monday – it said that the update would be rolling out on Google Play "over the next few days."
The update fixes two other security bugs as well: One is a high-severity type-confusion bug (CVE-2022-2295) in Google's V8 open source JavaScript engine, which earned a $7,500 bug bounty for reporters avaue and Buff3tts at S.S.L.; and the other is an unspecified fix that was discovered internally. <a href="https://www.microsoft.com/security/blog/2015/06/17/understanding-type-confusion-vulnerabilities-cve-2015-0336/" target="_blank">Type-confusion issues</a> can also lead to code execution, crashes, and logical efforts.
Tiquet adds, "Web browsers are essential applications that nearly all cloud-based services have in common and are therefore high-priority targets - compromise of a web browser could be leveraged to compromise any cloud-based service accessed by that browser."
<h2 class="regular-text">Fourth Exploited Chrome Zero-Day Bug in 2022</h2>
The WebRTC flaw is the fourth <a href="https://www.darkreading.com/vulnerabilities-threats/18-zero-days-exploited-2022" target="_blank">zero-day</a>&nbsp;in Chrome&nbsp;so far this year. Notably, in April Google disclosed a type-confusion vulnerability that is already being exploited in the wild (<a href="https://www.darkreading.com/attacks-breaches/google-emergency-update-fixes-chrome-zero-day" target="_blank">CVE-2022-1364</a>), which affects the JavaScript and WebAssembly engine in the browser. 
Another type-confusion problem in V8 (<a href="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html" target="_blank">CVE-2022-1096</a>) was patched in March; and the third was patched in February (<a href="https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html" target="_blank">CVE-2022-0609</a>), after it was exploited by a North Korean-backed state advanced persistent threat, according to the Google Threat Analysis Group (TAG). 
"With so many business and cloud applications depending on a web interface, browser vulnerabilities can be problematic," Mike Parkin, senior technical engineer at Vulcan Cyber, says. "Especially one as widely used as Chrome. It’s even worse when there are known exploits in the wild that leverage the vulnerability. Fortunately, Google has already developed patches for this vulnerability on both desktop and mobile platforms and will have them rolled out quickly."

Chrome-imageBROKER-alamy.jpg

MacOS icons showing Finder, Google Chrome, and Firefox browsers.

The heap buffer-overflow issue in Chrome for Android could be used for DoS, code execution, and more.

Google Chrome WebRTC Zero-Day Faces Active Exploitation

There's no such thing as a slow week for cybercrime, which means that covering the waterfront on all of the threat intelligence and interesting stories out there is a difficult, if not impossible, task. This week was no exception and, in fact, seemed to offer a veritable trove of important happenings that we would be remiss not to mention.
To wit: Dangerous malware campaigns! Info-theft! YouTube Account Takeovers! Crypto under siege! Microsoft warnings!
In light of this,&nbsp;Dark Reading is debuting a weekly "in case you missed it" (ICYMI)&nbsp;digest, rounding up important news from the week that our editors just didn't have time to cover before.
This week, read on for more on the following, ICYMI:
<ul><li>Smart Factories Face Snowballing Cyberactivity</li><li>Lazarus Group Likely Behind $100M Crypto-Heist</li><li>8220 Gang Adds Atlassian Bug to Active Attack Chain</li><li>Critical Infrastructure Cyber Pros Feel Hopeless</li><li>Hacker Impersonates TrustWallet in Crypto Phishing Scam</li><li>Cookie-Stealing YTStealer Takes Over YouTube Accounts</li><li>Follina Bug Used to Spread XFiles Spyware</li></ul>

<h2 class="regular-text">Smart Factories Face Snowballing Cyberactivity</h2>
A whopping 40% of smart factories globally have experienced a cyberattack, according to a survey out this week.
Smart factories – in which industrial Internet of things IIoT)&nbsp;sensors and equipment are used to reduce costs, obtain telemetry, and bolster automation – are officially a thing, with the <a href="https://www.darkreading.com/attacks-breaches/industry-4-0-points-up-need-for-improved-security-for-manufacturers" target="_blank">digitization of manufacturing well underway</a>. But cyberattackers are taking notice too, according to Capgemini Research Institute.
Among sectors, heavy industry faced the highest volume of cyberattacks (51%). Those attacks take many forms, too: 27% of firms have seen an increase of 20% or more in bot-herders taking over IIoT endpoints for distributed denial-of-service (DDoS) attacks; and 28% of firms said they have seen an increase of 20% or more in employees or vendors bringing in infected devices, for instance.
"With the smart factory being one of the emblematic technologies of the transition to digitization, it is also a prime target for cyberattackers, who are scenting new blood," according <a href="https://www.capgemini.com/insights/research-library/cybersecurity-in-smart-factories">to the report</a>. 
At the same time, the&nbsp;firm&nbsp;also uncovered that in nearly half (47%) of organizations, smart factory cybersecurity is not a C-level concern.
<h2 class="regular-text">Lazarus Group Likely Behind $100M Crypto-Heist</h2>
Security researchers are laying the $100 million hack of the Horizon Bridge crypto exchange at the feet of North Korea's notorious <a href="https://www.darkreading.com/threat-intelligence/north-korea-s-lazarus-group-turns-to-supply-chain-attacks" target="_blank">Lazarus Group advanced persistent threat</a>.
Horizon Bridge enables users of the Harmony blockchain to interact with other blockchains. The heist occurred June 24, with the culprits making off with various cryptoassets, including Ethereum (ETH), Tether (USDT), Wrapped Bitcoin (WBTC), and BNB. 
<a href="https://hub.elliptic.co/analysis/the-100-million-horizon-hack-following-the-trail-through-tornado-cash-to-north-korea/">According to Elliptic</a>, there are strong indications that Lazarus is behind the incident. The group not only carries out classic APT activity like cyber-espionage, but also acts as a money-earner for the North Korean regime, researchers noted.
The thieves in this case have so far sent 41% of the $100 million in stolen crypto assets into the Tornado Cash mixer, Elliptic noted, which essentially acts as a money launderer.
<h2 class="regular-text">8220 Gang Adds Atlassian Bug to Active Attack Chain</h2>
The 8220 Gang has added the latest critical security vulnerability affecting <a href="https://www.darkreading.com/cloud/actively-exploited-atlassian-zero-day-bug-full-system-takeover" target="_blank">Atlassian Confluence Server and Data Center</a> to its bag of tricks in order to distribute cryptominers and an IRC bot, Microsoft warned this week. 
The Chinese-speaking threat group has been actively exploiting the bug since it was disclosed in early June.
"The group has actively updated its techniques and payloads over the last year. The most recent campaign targets i686 and x86_64 Linux systems and uses RCE exploits for CVE-2022-26134 (Confluence) and CVE-2019-2725 (WebLogic) for initial access," Microsoft's Security Intelligence Centre <a href="https://twitter.com/MsftSecIntel/status/1542281805549764608">tweeted.</a>
<h2 class="regular-text">Critical Infrastructure Cyber Pros Feel Hopeless</h2>
A staggering 95% of cybersecurity leaders at critical national infrastructure organizations in the UK say they could see themselves leaving their jobs in the next year. 
<a href="https://www.bridewellconsulting.com/cni-organisations-must-lighten-load-on-cyber-teams-or-risk-mass-exodus-of-workforce">According to a survey</a> from Bridewell, 42% feel a breach is inevitable and don't want to tarnish their career, while 40% say they are experiencing stress and burnout which is impacting their personal life.
Meanwhile more than two -thirds of the respondents say that the<a href="https://www.darkreading.com/dr-tech/tackling-5-challenges-facing-critical-national-infrastructure-today" target="_blank"> volume of threats and successful attacks has increased </a>over the past year – and 69% say it is harder to detect and respond to threats.
<h2 class="regular-text">Hacker Impersonates TrustWallet in Crypto Phishing Scam</h2>
More than 50,000 phishing emails sent from a malicious Zendesk account made their way to email boxes in recent weeks, looking to take over TrustWallet accounts and drain funds.
TrustWallet is an Ethereum wallet and a popular platform for <a href="https://www.darkreading.com/vulnerabilities-threats/opensea-nft-marketplace-faces-insider-hack" target="_blank">storing non-fungible tokens (NFTs)</a>. Researchers at Vade said that the phish impersonates the service, using a slick and convincing TrustWallet-branded site to ask for users' password recovery phrases on a sleek TrustWallet phishing page.
The emails, meanwhile, are unlikely to trigger email gateway filters, since they're being sent from Zendesk.com, which is a trusted, high-reputation domain.
"As NFTs and cryptocurrencies overall have seen a significant downturn in recent weeks, on-edge investors are likely to react quickly to emails about their crypto accounts," according to <a href="https://www.vadesecure.com/en/blog/hacker-impersonates-trustwallet-in-crypto-phishing-scam">Vade's analysis</a> this week.
<h2 class="regular-text">Cookie-Stealing YTStealer Takes Over YouTube Accounts</h2>
A never-before-seen malware-as-a-service threat has emerged on Dark Web forums, aimed at taking over YouTube accounts. 
Researchers at Intezer noted that the malware, which it straightforwardly calls YTStealer, works to steal YouTube authentication cookies from content creators in order to feed the underground demand for <a href="https://www.darkreading.com/threat-intelligence/youtube-creators-hit-in-account-hijacking-campaign" target="_blank">access to YouTube accounts</a>. The cookies are extracted from the browser’s database files in the user’s profile folder. 
"To validate the cookies and to grab more information about the YouTube user account, the malware starts one of the installed web browsers on the infected machine in headless mode and adds the cookie to its cookie store," according <a href="https://www.intezer.com/blog/research/ytstealer-malware-youtube-cookies/">to the analysis</a>. "[That way] the malware can operate the browser as if the threat actor sat down on the computer without the current user noticing anything."
From there, YTStealer navigates to YouTube’s Studio content-management page and nabs data, including the channel name, how many subscribers it has, how old it is, if it is monetized, if it's an official artist channel, and if the name has been verified. 
<h2 class="regular-text">Follina Bug Used to Spread X-Files Spyware</h2>
A rash of cyberattacks is underway, looking to exploit the Microsoft Follina vulnerability to lift scores of sensitive information from victims. 
Follina is a recently patched remote code-execution (RCE) bug that's exploitable through malicious Word documents. It started life as an unpatched zero-day that<a href="https://www.darkreading.com/attacks-breaches/russia-apt28-launches-nuke-themed-follina-exploit-campaign" target="_blank"> quickly caught on among cybercrime groups</a>.
According to a Cyberint Research Team report shared with Dark Reading via email, analysts found several XFiles stealer campaigns where Follina vulnerability was exploited as part of the delivery phase.
"The group that is selling the stealer is a Russia-region based and is currently looking to expand," researchers said. "Recent evidence suggests worldwide threat actor campaigns [underway]."
The stealer sniffs out data from all Chromium-based browsers, Opera, and Firefox, including history, cookies, passwords, and credit card information. It also lifts FTP, Telegram and Discord credentials, and looks for predefined file types that are located on the victim's Desktop along with a screenshot. It also targets other clients, such as Steam, and crypto-wallets.

roundup-H._Mark_Weidman_Photography-Alamy.jpg

Photo of a rancher on horseback in a cattle roundup

Dark Reading's digest of the other don't-miss stories of the week, including YouTube account takeovers and a sad commentary on cyber-pro hopelessness.

ICYMI: A Microsoft Warning, Follina, Atlassian, and More

Mike Walters is co-founder and President of <a href="https://protect-us.mimecast.com/s/dfuACR6MLxfG04OK6sNQQsd?domain=action1.com/" title="Follow link">Action1 Corporation</a>, which provides remote monitoring and management software. Mike has more than 20 years of experience in IT technology and IT security. Prior to Action1, Mike co-founded Netwrix, whose visibility platform for cybersecurity and risk mitigation is helping more than 10,000 customers.

125x125-MichaelFimin.jpg

Michael Walters

Everyone uses browsers to access a wide range of networked systems, from shopping sites to enterprise management. As a result, browsers collect tons of sensitive information — from passwords to credit card data — that hackers are eager to get their hands on. 
Moreover, browser vendors frequently add new features, which increases the risk of flaws in program code that hackers can exploit. And even though there seem to be a lot of different Web browsers, there are actually just two open source browser engines. Chrome, Vivaldi, Brave, and many other browsers are all built on the same engine, Chromium. 
Even Microsoft <a href="https://blogs.windows.com/windowsexperience/2021/05/19/the-future-of-internet-explorer-on-windows-10-is-in-microsoft-edge/" target="_blank">killed Internet Explorer in 2021</a> and switched to Chromium with Edge. The only surviving alternative to Chromium is Mozilla Firefox, which uses a different engine; all the other browsers are proprietary corporate tools like Apple Safari. As a result of this consolidation, adversaries can closely focus on undercovering the vulnerabilities in the two browser engines. 
The Latest Critical Web Browser Vulnerabilities Every month, we see myriad serious new Web browser vulnerabilities. In the first half of 2022, Chrome has announced three zero-day vulnerabilities. By exploiting <a href="https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html" target="_blank">CVE-2022-0609</a>, hackers can corrupt data and execute code on vulnerable systems. <a href="https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html" target="_blank">CVE-2022-1096</a>, which was discovered in the wild, affects the JavaScript V8 engine. <a href="https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_14.html" target="_blank">CVE-2022-1364,</a> which was also discovered in the wild, can be exploited to trigger remote code execution on a targeted system, and <a href="https://www.theregister.com/2022/04/15/google-third-fix-chrome-vulnerability/" target="_blank">affects not just the nearly 3 billion users of Chrome</a>, but also everyone using any other Chromium-based browser. 
Mozilla is not immune from vulnerabilities, either. So far in 2022, we've seen <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2022-04/" target="_blank">CVE-2022-22753</a>, a high-severity vulnerability that can enable an adversary to get admin rights in Windows; <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2022-04/#CVE-2022-22753" target="_blank">CVE-2022-22753</a>, which could be abused to gain access to an arbitrary directory; and <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/#CVE-2022-1802" target="_blank">CVE-2022-1802</a> and <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/#CVE-2022-1802" target="_blank">CVE-2022-1529</a>, which could be exploited to enable JavaScript code execution. 
The problem is not just serious but growing: In the first quarter of&nbsp;2022 alone, Chrome fixed 113 vulnerabilities, 13% more than in the same period in&nbsp;2021, while Firefox fixed 88 vulnerabilities, a 12% jump from the first quarter of&nbsp;2021. These increases make browsers a top target for hackers. 
How Hackers Attack Browsers Hackers use multiple techniques to exploit browser vulnerabilities. Occasionally, they will discover a vulnerability that enables them to download and execute malicious code when a user simply visits a compromised site. From there, the code can download other malicious packages or steal sensitive data. Plug-ins are a common vector for these "drive-by download" attacks. 
A more common tactic, however, is for hackers to send phishing emails that contain exploit kits targeting Web browsers. Indeed, <a href="https://umbrella.cisco.com/info/2021-cyber-security-threat-trends-phishing-crypto-top-the-list" target="_blank">Cisco's 2021 cybersecurity threat trend report</a> found that about 90% of data breaches were due to phishing. A person clicks on a link in a <a href="https://www.darkreading.com/cloud/multichannel-phishing-concerns-cybersecurity-leaders-in-2022" target="_blank">phishing email</a>, which opens a malicious page in their browser, which can exploit an unpatched vulnerability in the browser to deploy malware or steal data stored in the browser. For example, <a href="https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/10/magnitude-ek-has-been-spotted-targeting-the-chrome-browser/" target="_blank">Magnitude</a> actively targeted Chromium in October 2021. 
Strategies to Mitigate Risk From Browser Vulnerabilities Organizations should combine multiple techniques to reduce their risk from browser vulnerabilities. The first is to keep all browsers updated. However, patching browsers can be problematic. Research shows that 83% of users run <a href="https://www.darkreading.com/endpoint/unpatched-browsers-abound-study-shows" target="_blank">versions of Chrome that are vulnerable to zero-day attacks</a> that have already been identified by Google. One reason is simply that many users do not like rebooting their browsers, which is often required as part of an update. 
Another barrier to patching is that many people install browsers under their user profiles, into folders that system administrators cannot access without special tools. To overcome these issues, automate patching for third-party apps, including browsers; ensure your IT teams can force reboots remotely in a way that is convenient to end users; and manage applications installed under user profiles. 
The second measure is to enforce <a href="https://www.darkreading.com/endpoint/understanding-and-mitigating-single-sign-on-risk" target="_blank">multifactor authentication (MFA)</a> on all critical systems and services. That way, hackers will be unable to access those resources even if they manage to steal a user's credentials. 
Third, regularly clear the browser history on users' machines to erase stored passwords, and to clear their cookies as well, since they can enable attackers to access services such as email without the user's credentials. Ensure your IT teams can perform these tasks remotely and, ideally, automate them. 
Fourth, remember the human factor. Be sure to roll out an extensive cybersecurity awareness program that educates all your users about security best practices and why they should follow them. In particular, teach them how to spot phishing emails and why to avoid using browser plug-ins or extensions, especially those that don't receive regular updates. In addition, train them to choose strong and unique passwords for each website they visit and not to store passwords in their browsers; to facilitate this, give them a password management app.

Browser-creativep-alamy.jpg

As a result of browser market consolidation, adversaries can focus on uncovering vulnerabilities in just two main browser engines.

Why Browser Vulnerabilities Are a Serious Threat — and How to Minimize Your Risk

Sakshi Udavant is a&nbsp;content writer and freelance journalist.

Sakshi Udavant is a freelance writer for Dark Reading

WriterDefault_vladwel_Adobe.jpg

Sakshi Udavant

fueldump-avionymous-alamy.jpg

Airliner dumping fuel overboard midair - preparations for immediate return back to the airport and emergency landing

While technology has changed the world for the better, this rising dependence has also increased cyber risks. From an <a href="https://www.ftc.gov/news-events/news/press-releases/2021/02/new-data-shows-ftc-received-22-million-fraud-reports-consumers-2020" target="_blank">exponential increase in online scams</a> to a growing number of human-error problems, there's a greater need to prepare for worst-case cybersecurity scenarios.

But this kind of preparation requires a proper understanding of what the worst-case scenarios are and how they can be managed. "By definition, the worst-case scenarios for cybersecurity are when human life is at risk due to an attack," says Matthew Warner, CTO and co-founder of Blumira, a detection and response platform that enables faster resolution of threats to help stop ransomware attacks and prevent data breaches. For businesses, this can mean a loss of important, sensitive information that <a href="https://www.darkreading.com/tech-trends/many-medical-device-makers-skimp-on-security-practices" target="_blank">puts lives in danger</a> or threatens to shut down the company.

Fortunately, awareness around cybersecurity is widespread. Governments are <a href="https://www.darkreading.com/operations/software-incident-response-among-big-focus-areas-in-biden-s-cybersecurity-executive-order" target="_blank">issuing recommendations</a> and <a href="https://www.darkreading.com/attacks-breaches/new-cyber-incident-law-not-a-national-breach-law-but-a-major-first-step" target="_blank">passing laws</a>, and companies are actively deploying measures to safeguard data. Here are some of the best ways to prepare for the <a href="https://www.darkreading.com/cloud/catastrophic-cloud-attack-costs-would-rival-that-of-hurricane-damages" target="_blank">worst-case cyber scenarios</a>.

7 Ways to Avoid Worst-Case Cyber Scenarios

<a href="https://www.darkreading.com/threat-intelligence/microsoft-source-code-exposed-what-we-know-what-it-means" target="_blank">Source code</a> being stolen and leaked is a longtime pattern, going back to Microsoft Windows in 2004 and <a href="https://www.darkreading.com/risk/diebold-disses-democracy" target="_blank">Diebold voting machines in 2006</a>. Warner says, "These days source code is often stolen either by accessing accounts through poorly configured MFA and credential stuffing; vulnerabilities that allow access to local files remotely, e.g., local file inclusion; or rogue git repositories that were improperly made public."

The best way to prevent source code from being stolen is to protect all data equally and follow <a href="https://www.darkreading.com/endpoint/solarwinds-attack-reinforces-importance-of-principle-of-least-privilege" target="_blank">least-access privilege principles</a> whenever possible, he adds. For example, only people who must work on source code should have access to it.

But the problem with this approach is that it interferes with developers' workflow. "Loss prevention for source code often competes against developer productivity and quality of life issues that few companies can afford to compromise on," says Casey Bisson, head of product and developer enablement at BluBracket, a platform that protects software supply chains by preventing, finding, and fixing risks in source code. "Developers don't want to work in environments where they <a href="https://www.darkreading.com/endpoint/zero-trust-shouldn-t-mean-zero-trust-in-employees" target="_blank">face access barriers</a> to getting things done, and when companies that grant broad access can innovate and grow faster than those that don't, the market has a way to force change," he says.

So the best option is to ensure that secrets, passwords, and keys are never present in the source code. Moreover, there are software packages that aim to prevent both accidental and intentional leaks, such as data loss prevention software that scans emails and other network traffic for sensitive data, suggests Jason Hong, professor at the School of Computer Science at Carnegie Mellon University. Researchers are also looking to develop heuristics to detect <a href="https://www.darkreading.com/vulnerabilities-threats/with-cloud-the-norm-insiders-are-everywhere-and-pose-greater-risk" target="_blank">insider threats</a> so there will be more solutions available in the future, he adds.

sourcecode-David_Kashakhi-alamy.jpg

Abstract modern virtual computer script on black background, work of software developer programmer on desktop

Protect the Source Code

The biggest failures in avoiding cloud breaches and exposed systems because of configuration issues spring from configuration accidents and configuration problems due to risk ignorance.

"Configuration accidents can include everything from true mistakes or oversights — failure to require 2fa to access a sensitive resource — to systems that provide too little protection against social engineering — no visibility to typo-squatting attacks," Bisson explains.

Fortunately, there are many solutions for this. Hong suggests that companies should set better defaults — e.g., everything is private by default, and you have to take explicit steps to make certain parts publicly visible. He also recommends having strong, unique passwords for cloud services and using two-factor authentication, since incidents like the Colonial Pipeline attack happened because of a <a href="https://www.darkreading.com/omdia/colonial-pipeline-cyberattack-proves-a-single-password-isn-t-enough" target="_blank">compromised password</a>.

Warner adds it's important to regularly assess your attack surface through vulnerability scanning and Internet-scanning tools like Shodan and Censys. Bisson also recommends the <a href="https://academy.wehackpurple.com/courses/incident-response-mini-course" target="_blank">We Hack Purple mini-course on incident response</a>.

securitycontrols-Aleksei_Gorodenkov-alamy.jpg

Female System Engineer Controls Operational Proceedings. In the Background Working Monitors Show Various Information

Don't Skip Security Controls

Ransomware can be a huge nuisance (and an economic loss) for companies, but few are actively working on preventing such attacks. "Large companies have enormous installed bases of legacy software full of vulnerabilities," Bisson says. "For many companies, they have to compare the cost and disruption of upgrading those systems against the risk of a ransomware attack and the payout needed to recover."

While some businesses may see ransomware as a matter of profit and loss, for organizations like hospitals, it's a matter of life and death, Bisson adds.

While these attacks can't be completely avoided, companies can get leverage over the attackers by <a href="https://www.darkreading.com/dr-tech/a-comprehensive-backup-strategy-includes-saas-data-source-code" target="_blank">having a backup</a>. Implementing strong procedures to trigger any critical priority processes to restore backups will go a long way in mitigating the risks of ransomware attacks, Warner says.

backup-datacenter-Aleksei_Gorodenkov-alamy.jpg

Male IT Engineer Walking and Working in Data Center Corridor. She is Holding Tablet Computer. He is Blurred in Motion

Keep Strong Backups

Data breaches and ransomware attacks can lead to companies losing a lot of important data because it's difficult and expensive to create multiple backups of all the data required to keep the business running.

However, hoarding an unnecessarily large amount of data never helps. In fact, it can work against you in case of data breaches and ransomware attacks. So the best prevention is conducting a <a href="https://www.darkreading.com/cloud/to-manage-security-risk-manage-data-first" target="_blank">thorough analysis of your existing data</a> and <a href="https://www.darkreading.com/endpoint/data-asset-management-what-do-you-really-need-" target="_blank">deleting what you don't need</a>. This way, even if your systems are attacked, you're able to safeguard what's truly important.

datamanagement-Carloscastilla-alamy.jpg

Technology and communication for analytics and data management in internet 3d illustration

Understand and Manage Your Data

<a href="https://www.darkreading.com/analytics/soc-teams-burdened-by-alert-fatigue-explore-xdr" target="_blank">Alert fatigue</a> is real. There are only so many times humans can actively respond to security alerts without feeling burned out or dismissive of the constant incoming messages.

That's where automation can help. "Look for tools with prioritized alerts that help you determine the importance of an alert," Warner suggests. "Alerts that are accompanied by context — such as playbooks or related incidents — can also help you understand the severity of the alert as well as how to respond."

To take it a step further, he suggests utilizing the classic <a href="https://www.darkreading.com/attacks-breaches/what-the-battle-of-britain-can-teach-us-about-cybersecurity-s-human-element" target="_blank">defense-in-depth pattern</a>. "If you have multiple places that can detect, stop, and alert when threats are occurring within an environment, then you have multiple chances to stop the threat."

This approach is helpful for security teams of all sizes. <a href="https://www.darkreading.com/omdia/analysis-log4j-vulnerability-highlights-the-value-of-defense-in-depth-accurate-inventory" target="_blank">Defense-in-depth</a> offers smaller teams a cost-effective, less time-intensive way to toughen up security, while it frees up time and resources for larger security teams to focus on bigger issues.

securityalert-Marc_Binder-alamy.jpg

Security alert on a computer system or server

Automate Security Alert Management

No matter how tight your security systems are, there's always a chance something will go wrong. You can have the best tools in the world, but attackers are also adapting to new technologies, making their attacks strong and sometimes unpreventable.

In these cases, it's important to plan your recovery process in advance. "Focus on continuous improvement over perfection," Bisson says. "Work assuming failure will happen and plan for how to recover."

There are various ways to do this. Hong suggests implementing <a href="https://www.darkreading.com/tech-trends/security-teams-still-favor-prevention-over-detection" target="_blank">measures for prevention</a>, coupled with detection and response. Some example prevention mechanisms include cybersecurity training for staff, strong and unique passwords, and two-factor authentication, he says. On the other hand, <a href="https://www.darkreading.com/omdia/the-xdr-revolution-threat-detection-and-response-for-all-" target="_blank">detection and response</a> mechanisms include analyzing logs, cybersecurity insurance, and periodically backing up your data.

recoveryplan-Prime_MZ-alamy.jpg

recovery plan is on a label of a blue hanging file. In the background a computer keyboard

Plan Recovery in Advance

Along with preparing for prevention on a practical level, it's also important to ensure your mindset is ready to deal with incoming attacks. "A focus on maturing and growing your cybersecurity mindset within your organization with realistic and actual efforts forward is the best way to protect yourself," Warner says.

Echoing this idea, Hong says a lot of computer security is actually rather basic: Have strong, unique passwords for important sites. Use two-factor authentication. Keep your software and your operating system up to date. Don't click on weird or unexpected links. Have backups.

However, the hard part is doing these consistently and at scale. That's where the <a href="https://www.darkreading.com/cloud/security-at-the-edge-why-it-s-complicated" target="_blank">mindset shift</a> can help.

Being more proactive about security measures, not skipping out on security checks even though they're boring, and having <a href="https://www.darkreading.com/cloud/companies-need-to-keep-watch-on-cloud-data" target="_blank">routine audits</a> may seem unnecessary, expensive, and monotonous, but these attitudes can be a game-changer if you're a victim of an attack.

securitymindset-NicoElNino-alamy.jpg

Man surveys illustrated screen of network diagram. Business Analytics and Data Management System (DMS)

Maintain a Security Mindset

In the wake of devastating attacks, here are some of the best techniques and policies a company can implement to protect its data.

Editors' Choice

White Papers

More White Papers

Webinars

More Webinars

Reports

More Reports

More Insights

Commentary

Bob Evans is senior VP, communications, for Oracle Corp. He is a former InformationWeek editor.

Evans-IWK-125x125.jpg

Bob Evans

5) "One of the trends that we saw in the fourth quarter that was quite encouraging is the performance of smaller deals," Loughridge said in the SeekingAlpha.com transcript. "That is, smaller deals across our hardware business, our software businesses, our services business both in major markets and &#91;inaudible&#93; in our growth markets. Number one, smaller deals are a significant portion of our total revenue stream but I think what we are seeing in smaller deals have been more characteristic of a leading indicator." Nice to hear someone talk about "leading indicators" in a positive context. Are you and your team taking steps to help your company optimize small-deal opportunities?

6) "Frankly underneath that the retail industry saw growth for the first time in seven quarters," Loughridge said. "As we said, if you look at public sector it had the strongest performance in the quarter and for the year." He added that "we had growth in healthcare and life sciences that marked an 11th consecutive quarter of growth." Again, discussions of growth&#8212;and not only in sectors like healthcare where it's been happening for some time, but also in troubled areas like retail. If you've had your team and its capabilities in suspended animation for the past 18 months while your budget's been hacked, this is a pretty powerful wake-up call because when your CEO says it's time to fire up all those great ideas that have been on hold for a couple of years, it probably won't be a good career move to reply that you'll need six months to unthaw everything.

7) "The thing you clearly saw though is the difference between major-market performance and growth-market performance actually expanded in the quarter to about a nine-point differential," Loughridge said, emphasizing that declining revenue from Russia has stabilized. Nine points&#8212;that's pretty significant&#8212;are you and your team helping your company leverage this growth-market potential in India, China, Brazil, and Russia?

RECOMMENDED READING:

<a href="http://www.informationweek.com/news/global-cio/security/showArticle.jhtml?articleID=222301244">Global CIO: IBM Iowa's Birthday: IBM Gets $52M, But What Does Iowa Get?</a>

<a href="http://www.informationweek.com/news/global-cio/security/showArticle.jhtml?articleID=221600338">IBM CEO Sam Palmisano Talks With Global CIO</a>

<a href="http://www.informationweek.com/news/global-cio/security/showArticle.jhtml?articleID=222300803">Global CIO: IBM CEO Palmisano Challenges IT Industry Via Smarter Planet 2</a>

<a href="http://www.informationweek.com/news/global-cio/security/showArticle.jhtml?articleID=222002799">Global CIO: The Top 10 CIO Issues For 2010</a>




<table cellspacing="0" cellpadding="10" border="1" bordercolor="#0e374b" align="center">
<tr>	
<td>
<img src="http://twimgs.com/infoweek/1217/217ID_GlobalCIO_75.jpg" alt="GlobalCIO" width="75" height="75" border="0" align="right" style="margin:0 10px 0 10px;">
Bob Evans is senior VP and director of InformationWeek's Global CIO unit. 
 
To find out more about Bob Evans, please visit his <a href="http://www.informationweek.com/authors/showAuthor.jhtml?authorID=1097">page</a>. 
 
For more Global CIO perspectives, check out <a href="http://www.informationweek.com/blog/main/archives/global_cio/index.html">Global CIO</a>, 
or write to Bob at <a href="mailto:bevans@techweb.com">bevans@techweb.com</a>. 
</td>
</tr>
</table>

5)  "One of the trends that we saw in the fourth quarter that was quite encouraging is the performance of smaller deals," Loughridge said in the SeekingAlpha.com transcript. "That is, smaller deals across our hardware business, our software businesses, our services business both in major markets and &#91;inaudible&#93; in our growth markets.  Number one, smaller deals are a significant portion of our total revenue stream but I think what we are seeing in smaller deals have been more characteristic of a leading indicator." Nice to hear someone talk about "leading indicators" in a positive context. Are you and your team taking steps to help your company optimize small-deal opportunities?  6)  "Frankly underneath that the retail industry saw growth for the first time in seven quarters," Loughridge said. "As we said, if you look at public sector it had the strongest performance in the quarter and for the year." He added that "we had growth in healthcare and life sciences that marked an 11th consecutive quarter of growth." Again, discussions of growth&#8212;and not only in sectors like healthcare where it's been happening for some time, but also in troubled areas like retail. If you've had your team and its capabilities in suspended animation for the past 18 months while your budget's been hacked, this is a pretty powerful wake-up call because when your CEO says it's time to fire up all those great ideas that have been on hold for a couple of years, it probably won't be a good career move to reply that you'll need six months to unthaw everything.  7)  "The thing you clearly saw though is the difference between major-market performance and growth-market performance actually expanded in the quarter to about a nine-point differential," Loughridge said, emphasizing that declining revenue from Russia has stabilized. Nine points&#8212;that's pretty significant&#8212;are you and your team helping your company leverage this growth-market potential in India, China, Brazil, and Russia?  RECOMMENDED READING:  Global CIO: IBM Iowa's Birthday: IBM Gets $52M, But What Does Iowa Get?  IBM CEO Sam Palmisano Talks With Global CIO  Global CIO: IBM CEO Palmisano Challenges IT Industry Via Smarter Planet 2  Global CIO: The Top 10 CIO Issues For 2010         Bob Evans is senior VP and director of InformationWeek's Global CIO unit.  To find out more about Bob Evans, please visit his page.  For more Global CIO perspectives, check out Global CIO, or write to Bob at bevans@techweb.com.

IBM's CFO sheds light on atypical opportunities, applications outsourcing, retail resurgence, business analytics, and more.

Global CIO: IBM CFO Offers 7 Key Insights In Earnings Analysis

Mobile

Insider Threats

Thao tests smartbox

Thao test smartbox

Events

More Events

[Risk] Compliance

Risk

Breaking news, news analysis, and expert commentary on cybersecurity risk, and the tools, technologies, and practices for assessing risk.