Successful bug bounty programs strike a balance between vendor benefits and researcher incentives.

As vulnerabilities continue to take center stage and organizations look to launch bug bounty and security assurance programs, the competition for good researchers is fierce. But it can be hard for prospective researchers to evaluate these programs. Some common questions include what are the current rates for common vulnerabilities? How experienced is the team performing the report triage work? Does a security team or expert make the decisions about what classifies as a vulnerability?

Researchers generally doubt that a product and development team can fairly classify a bug report as a security vulnerability because of a perceived lack of security expertise. Instead, they tend to trust a program more if a dedicated security team (like ProdSec, AppSec, PSIRT, etc.) makes the decision about whether a report is a security vulnerability.

Security researchers also like to review program statistics, which often includes total payouts for the previous year. Higher total payouts often indicate there are more bugs to be found, where lower payouts may mean fewer bugs and/or rewards. They also care about average time to triage, or the time between submission and acknowledgement of a valid or invalid vulnerability. This can tell researchers if the program is experienced and sufficiently supported.

Time between submission and payment, or average time to bounty, is also important. Again, shorter is better and often means the program doesn't have funding issues and values the researcher's time. Longer bounty turnarounds can seed uncertainty.

It's no secret that vendors prefer lower severity bounties and lower payouts, while researchers like higher ones. A lower payout average may lead to the belief that vulnerabilities will be downplayed, and higher severity issues may not get the attention they deserve. High payouts may signal to researchers that no low-hanging fruit exists, which could dissuade new researchers from joining the program. It could also signal that the time investment to find a vulnerability is very high. Often a moderate payout average is best.

Another area that can dissuade researchers involves the legality of vulnerability reporting. Coordinated vulnerability disclosure policies can be tricky to follow when one party doesn't feel valued. Safe Harbor is a promise but can also appear as a threat.

Safe Harbor is a clause added to a vulnerability disclosure program policy that outlines that the security researcher shall not need to fear legal consequences (and may even be provided extra protections) by the target of their security research if that research is performed in good faith and in cooperation with the target. This leads to researchers wanting to know how vendors handle violations or how to get support when a vendor is not following their own stated policies. These are important processes to have defined.

What do researchers value in a program? In my experience, there are six primary areas.

**Speed**

As mentioned previously, faster is better. Researchers want decision-making, responses, vulnerability disclosure, and rewards distributed quickly.

**Humanity**

Researchers want to hear from people, not a corporation or its lawyers. They want to be treated and spoken to like a human being, not as researching robots.

**Transparency and Accessibility**

There should be as few barriers as possible when submitting a bug report. Do the researchers need a tax ID, email address, or encryption software? How can a researcher best engage with a vendor and program? What tools, software, hardware, training do the researchers need to invest in? And how does or will the vendor invest in its researcher population? Answer these questions and be transparent.

**Expertise**

Researchers spend time learning about a product and how it works before they can find ways to break it or make it do things it was not designed for. As a result, they expect that the people reading their reports have at least that same level of expertise.

**Advocacy**

Researchers don't work for the vendor; that's one reason why they submit through a bug bounty program. They can't be involved in all the conversations, so they need an advocate inside the company.

**Recognition/Rewards**

Bug bounty programs are a mutation of a vulnerability disclosure program (VDP), which is entirely based on the concept of "See something, say something," but offers a reward incentive instead of just simply doing it because it is the right thing to do. Ensuring that the incentives offered match the goals of the researcher is crucial. Do they want to be recognized or stay hidden? Do they want payment? Are they even allowed to receive rewards?

For vendors, there's a lot to consider when attracting talented researchers. Present program statistics at least annually (if not in real-time). Publish the decision matrix for rewards and recognition so researchers know what it takes to get a top bounty. Make documentation available that explains the process a bug report undergoes once it leaves the hands of the researcher. Set service-level agreements for key steps in the process and publish stats about how well the team meets them. Use human language, and understand that everyone makes mistakes in this process, but they're rarely malicious. Seek first to understand before casting judgement.

Finally, if you want to learn more about bug bounties, consider these organizations: Bug Bounty Community of Interest, FIRST, and OWSP. As bug bounty programs mature and become more humanized, vendors and researchers can work together to create policies and processes that are rewarding for all involved.

How to Attract Top Research Talent for Your Bug Bounty Program

Cybercriminal groups are targeting misconfigured Docker and Kubernetes clusters — or just automating the sign-up process for free trial accounts — to build infrastructure for cryptomining.

Cryptojacking is creeping back, with attackers using a variety of schemes to leech free processing power from cloud infrastructure to focus on mining cryptocurrencies such as Bitcoin and Monero.

Cryptominers are using the availability of free trials on some of the largest continuous integration and deployment (CI/CD) services to deploy code and create distributed mining platforms, according to Sysdig, a provider of security for cloud-native services. Attackers are also targeted misconfigured Kubernetes and Docker instances to gain access to the host systems and run cryptomining software, cybersecurity services firm CrowdStrike warned this week.

Both tactics are really just trying to cash in on the rise of digital currencies at someone else’s expense, says Manoj Ahuje, a senior threat researcher for cloud security at CrowdStrike.

"As long as the compromised workload is available, in essence, it is free compute — for a cryptominer, that’s a win in itself as his input cost becomes zero," he says. "And ... if an attacker can compromise a large number of such workloads effectively by crowdsourcing the compute for mining, it helps to reach the goal faster and mine more in the same amount of time."

Cryptomining efforts are increased over time, even as the value of cryptocurrencies have plunged in the past 11 months. Bitcoin, for example, is down 70% from its peak in November 2021, affecting many cryptocurrency-based services. However, the latest attacks show that cybercriminals are looking to pick off the lowest hanging fruit.

Compromising providers' cloud infrastructure may not appear to harm businesses, but the cost of such hacks will trickle down. Sysdig found that attacker typically only make $1 for every $53 of cost borne by the owners of the cloud infrastructure. Mining a single Monero coin using free trials on GitHub, for example, would cost that company more than $100,000 in lost revenue, Sysdig estimated.

Yet companies may not initially see the harm in cryptomining, says Crystal Morin, a threat researcher at Sysdig.

"They are not harming anyone directly, such as taking somebody's infrastructure or stealing data from businesses, but if they were to scale this up, or other groups took advantage of this type of operation — 'freejacking' — it could start financially hurt these providers and impact — on the back end — the users, with free trials going away or forcing legitimate users to pay more," she says.

**Cryptominers Everywhere**

The latest attack, which Sysdig dubbed PURPLEURCHIN, appears to be an effort to cobble together a cryptomining network from as many services as possible that offer free trials. Sysdig's researchers discovered that the latest cryptomining network utilized 30 GitHub accounts, 2,000 Heroku accounts, and 900 Buddy accounts. The cybercriminal group downloads a Docker container, runs a JavaScript program, and loads in a specific container.

The success of the attack is really driven by the cybercriminal group's efforts to automate as much as possible, says Michael Clark, director of threat research for Sysdig.

"They have really automated the activity of getting into new accounts," he says. "They use CAPTCHA bypasses, the visual ones and the audio versions. They create new domains, and host email servers on the infrastructure that they have built. It is all modular, so they spin up a bunch of containers on a virtual host."

GitHub, for example, offers 2,000 free GitHub Action minutes per month on its free tier, which could account for up to 33 hours of run time for every account, Sysdig stated in its analysis.

**Kiss-a-Dog**

The cryptojacking campaign CrowdStrike discovered targets vulnerable Docker and Kubernetes infrastructure. Called the Kiss-a-Dog campaign, the cryptominers use multiple command-and-control (C2) servers for resiliency, using rootkits to avoid detection. It includes a variety of other capabilities, such as placing backdoors in any compromised containers and using other techniques to gain persistence.

The attack techniques resemble those of other groups investigated by CrowdStrike, including LemonDuck and Watchdog. But most of the tactics are similar to TeamTNT, which also targeted vulnerable and misconfigured Docker and Kubernetes infrastructure, CrowdStrike stated in its advisory.

While such attacks may not feel like a breach, companies should take seriously any signs that attackers have access to their cloud infrastructure, says CrowdStrike's Ahuje.

"When attackers run a cryptominer in your environment, this is a symptom that your first line of defense has failed," he says. "Cryptominers are leaving no stones unturned to exploit this attack surface to their advantage."

Cryptojacking, Freejacking Compromise Cloud Infrastructure

**DUBLIN, Oct. 27, 2022 /PRNewswire/ —** The "Banking Encryption Software Market Size, Share & Trends Analysis Report by Component, by Deployment, by Enterprise Size, by Function (Cloud Encryption, Folder Encryption), by Region, and Segment Forecasts, 2022-2030" report has been added to **ResearchAndMarkets.com's** offering.

The global banking encryption software market size is expected to reach USD 5.03 billion by 2030, expanding at a CAGR of 13.0% from 2022 to 2030, according to this study conducted. The growing need for modern security solutions worldwide is anticipated to drive the growth of the industry. In addition, the rising incidences of cyber-attacks also bode well for growth.

Banking encryption software facilitates the confidential exchange of vital data by encrypting the data at the sender's end in a form not readable without a proper authentication key, which is usually in the form of a password. The receiver can use the authentication key to decrypt the data and read it. The strong emphasis banks and other financial institutions are putting on securing data transactions is driving the adoption of banking encryption software.

The growing partnerships among the encryption software providers are expected to drive market growth. For instance, In April 2021, Google Cloud and Broadcom collaborated. This collaboration increased the integration of cloud services into Broadcom's primary software franchises. In this partnership, Broadcom was able to make enterprise operations software and its security suite available on Google Cloud, enabling organizations to encrypt and decrypt data at the column level.

**Banking Encryption Software Market Report Highlights**

*   The software segment is expected to dominate the segment over the forecast period. This is due to its offered benefits such as security and privacy protection to the financial institutes
*   The cloud segment is anticipated to witness the fastest growth over the projection period. The growth of the segment can be attributed to the inexpensive deployment and customization options
*   The large enterprise segment dominated the market in 2021. Large organizations are adopting encryption solutions to meet the changing security needs owing to the rising incidences of cybercrimes
*   The cloud encryption segment is anticipated to witness the fastest growth because of its capability to facilitate a cost-effective and scalable encryption model
*   The Asia Pacific regional market is expected to witness the fastest growth over the projection period due to an increase in demand for encryption software among banks in developing countries in the Asia-Pacific, including China and India, to safeguard and ensure the privacy of data

**Key Topics Covered**

Chapter 1: Methodology and Scope  
Chapter 2: Executive Summary  
Chapter 3: Banking Encryption Software Industry Outlook  
Chapter 4: Investment Landscape Analysis  
Chapter 5: FinTech Industry Highlights  
Chapter 6: Banking Encryption Software Component Outlook  
Chapter 7: Banking Encryption Software Deployment Outlook  
Chapter 8: Banking Encryption Software Enterprise Size Outlook  
Chapter 9: Banking Encryption Software Function Outlook  
Chapter 10: Banking Encryption Software Regional Outlook  
Chapter 11: Competitive Analysis  
Chapter 12: Competitive Landscape

**Companies Mentioned**

*   Broadcom
*   ESET North America
*   IBM Corporation
*   Intel Corporation
*   McAfee, LLC
*   Microsoft
*   Sophos Ltd.
*   Thales Group
*   Trend Micro Incorporated
*   WinMagic

For more information about this report visit https://www.researchandmarkets.com/r/fp92vx.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

More Insights

Webinars

*   Penetration Testing, Red Teaming, and More: Improving Your Defenses By Thinking Like an Attacker
*   Building & Maintaining an Effective Incident Readiness and Response Plan

Reports

*   How Machine Learning, AI & Deep Learning Improve Cybersecurity
*   Breaches Prompt Changes to Enterprise IR Plans and Processes

Editors' Choice

Tara Seals, Managing Editor, News, Dark Reading

Jai Vijayan, Contributing Writer, Dark Reading

Shauli Rozen, CEO and Co-Founder, ARMO

Dark Reading Staff, Dark Reading

Webinars

*   Penetration Testing, Red Teaming, and More: Improving Your Defenses By Thinking Like an Attacker
*   Building & Maintaining an Effective Incident Readiness and Response Plan
*   State of Bot Attacks: What to Expect in 2023
*   Analyzing and Correlating Security Operations Data
*   Understanding Cyber Attackers & Their Methods

Reports

*   How Machine Learning, AI & Deep Learning Improve Cybersecurity
*   Breaches Prompt Changes to Enterprise IR Plans and Processes
*   Implementing Zero Trust In Your Enterprise: How to Get Started
*   6 Elements of a Solid IoT Security Strategy
*   Incorporating a Prevention Mindset into Threat Detection and Response

White Papers

*   Understanding the Zero Trust Approach
*   Top Cloud Threats to Cloud Computing: Pandemic Eleven
*   BotGuard for Applications Higher Education Case Study
*   Top Four Steps to Reduce Ransomware Risk
*   2022 Cyber Threat Landscape Report

Events

*   Understanding Cyber Attackers - A Dark Reading Nov 17 Event
*   Black Hat Europe - December 5-8 - Learn More
*   Black Hat Middle East & Africa - November 15-17 - Learn More

More Insights

Webinars

*   Penetration Testing, Red Teaming, and More: Improving Your Defenses By Thinking Like an Attacker
*   Building & Maintaining an Effective Incident Readiness and Response Plan

Reports

*   How Machine Learning, AI & Deep Learning Improve Cybersecurity
*   Breaches Prompt Changes to Enterprise IR Plans and Processes

Worldwide Banking Encryption Software Market to Reach $5.03 Billion by 2030 at a 13% CAGR

Setting priorities for internal security measures and outsourcing complex practices help protect small and midsize businesses.

Due to their limited security budgets and high dependence on unmanaged IT systems, small businesses are often left vulnerable and frequently targeted by cybercriminals. While large enterprises can usually recover from an attack, many small businesses are forced to shut down if they cannot afford to pay ransoms or restore the function of their network systems. These ransomware attacks can leave behind millions in damages. However, to keep your small to midsize business (SMB) as unscathed as possible in the face of an attack, it becomes imperative to understand internal vulnerabilities and how to strengthen your organization's cybersecurity posture from the top down.

One of the reasons SMBs have seen an uptick in ransomware attacks is the sheer ease with which criminals can successfully penetrate their defenses. Threat actors don't need to employ expensive and highly technical gangs to assist in a breach. Instead, they simply infiltrate internal networks through the use of software with artificial intelligence and machine learning. Once in, they can seize data, open backdoors for future exploitation, and freeze entire IT systems.

Additionally, SMBs are part of a far bigger picture. SMBs are often key members of larger companies' supply chains, and the revenue from these relationships with large companies is essential to their well-being. Those larger companies are imposing strict rules or policies on the security posture of their smaller counterparts to protect themselves against vulnerabilities in their supply chains. SMBs that are slow to adapt to this demand may start losing business whether or not they actually get hacked. And if they do get hacked, the larger companies are more likely than ever to discontinue the business relationships.

Establishing a well-thought-out disaster recovery plan that allows for routine and proper testing is essential to protecting the operation of the organization. A holistic approach to cyber infrastructure management enables an organization to properly deploy effective protections. Here are three steps to begin implementing those protections.

**1\. Keep Evolving Your Risk Management**

Insufficient security measures not only escalate the risk of attack, but they escalate the risk of significant compliance violations as well. Risk is constantly evolving, and managing that risk is an essential part of every cybersecurity program and critical to business resilience. But it is often overlooked and not well executed. Frequently, SMBs run outdated software that all but invites attackers to target well-known vulnerabilities. Fortunately, the ability to share intel has vastly improved the ability to continuously seek out indicators of compromise, allowing IT teams to quickly mitigate sophisticated actors before they can bring harm to the company.

**2\. Establish Continuous Vulnerability Monitoring**

The most effective approach to recognizing vulnerabilities is a monitoring system that detects attacks as quickly as possible, with swift remediation tactics in place. Security monitoring generally refers to the process of analyzing several logs or network devices (firewalls, servers, switches, etc.) for potential security incidents.

Most often, a security incident and event management (SIEM) system is used to aggregate, consolidate, and normalize that data. Advanced behavioral analytics augment the SIEM alerts and provide a comprehensive view of the customer landscape. Within this system, suspicious activity can be identified and quickly brought to IT personnel's attention to determine if it represents a true threat. SMBs can outsource this function to receive access to enterprise-grade security technology and expertise they otherwise might not have been able to attract, afford, or retain. Continuous monitoring means threats can often be mitigated ahead of time, and vulnerabilities can be quickly patched around the clock.

**3\. Select Appropriate Security Vendors**

Most SMBs lack the technical expertise to properly evaluate a security solution/provider. If this is the case with your organization, consider engaging a third-party managed security provider to assist in the evaluation. Selecting a security solution/partner should be a well-thought-out decision that is focused on results. You must ask yourself whether the provider protects your business from as many angles as possible. What specific tools is this partner going to use? And how are they keeping up with the continued advancements that bad actors are using to gain access to your data?

Security vendors should be able to ingest data from several sources, including firewalls, endpoints, virtual private networks, flow data, DNS, DHCP, intrusion detection and prevention systems, and cloud log data. There should be a wide range of analytics using various methodologies, such as statistical models that look for advanced beaconing and domain beaconing. Applied math helps to identify account enumeration, cohort anomalies, data loss, pattern matching, dispersion analysis, and statistical variance. Machine learning can also be used to check bidirectionally long term and short term using probability, Arima modeling, and neural networks to look for long and slow activity. These analytic processes continuously learn from the data they ingest and become more powerful over time.

Staying on top of security can create the resilience to defend against damaging attacks that could force shutdowns or create large disruptions in business. By crafting a strong defense against an aggressive threat landscape, businesses can remain both compliant with legal and contractual requirements and resilient to real-world threats.

3 Steps Small Businesses Can Take to Prevent Cyberattacks

Cybersecurity and telecom providers from around the world can now test their technologies and use cases in OneLayer's digital twin private network environment.

**TEL AVIV, Israel, Oct. 27, 2022 /PRNewswire/ —** OneLayer, a pioneer in securing private LTE/5G networks for enterprises, announced today the launch of one of the world's first 5G private network security labs. The lab, which will be open to the public for research purposes, acts as a digital twin to simulate specific threat scenarios posed to an enterprise network. The data collected during these simulations will help companies find the best security solutions for each organization and its needs.

Private cellular networks provide organizations with improved connectivity and increased reliability, a dedicated bandwidth with capacity and range, no lag time, and connectivity of IoT and OT devices across vast areas. As organizations increasingly adopt private networks, they must also address securing such networks, so the same standard of security applied to enterprise IP networks is addressed in the cellular domain.

The OneLayer 5G Security Lab provides a simulated environment for cyber and telecom companies to examine diverse security challenges and solutions in this domain. Using core equipment from Nokia, Druid, and Airspan, the lab can create private networks based on different types of cores, end units, and IoT devices to model different types of cyberattacks and the solutions to defend against them.

"The goal of this security lab is to provide the opportunity to test private networks and security use cases to improve the understanding of connected IoT and OT devices for continued R&D of OneLayer's private cellular security platform," said Liron Ben-Horin, VP of Systems Engineering at OneLayer. "We intend to collect and analyze data in order to profile devices and segment networks appropriately. We want to share our tools and capabilities with the private network ecosystem to foster industry collaboration. As such, we welcome any company that is researching or testing LTE/5G devices to join us on this journey at our Tel Aviv-based security lab."

"OTORIO and OneLayer have joined forces in order to leverage OneLayer's 5G Security Lab to test the integrations with various technologies and telecom systems," said Matan Dobrushin, VP Research at OTORIO. "We are excited for our mutual research collaboration to ensure the usability, efficiency and safety of OTORIO's solutions in hybrid networks."

"We are excited for the opportunity to leverage OneLayer's Security Lab and to work together to improve the cybersecurity of 5G core network devices," said Sharon Brizinov, Director of Security Research at Claroty's Team82. "The collaborations coming out of the security lab will benefit enterprise security overall as we explore the ever-growing attack surface of the Extended Internet of Things (XIoT) and these devices' connectivity within cellular networks."

"Armis recognizes the growing risk raised by private cellular networks," said Barak Hadad, Head of Research at Armis. "Together with OneLayer, we can help defenders gain full visibility to their core networks and their connected devices."

"I'm excited to see a Tel Aviv-based startup, OneLayer, investing in a unique 5G devices lab. These types of activities enable the Israeli ecosystem and cybersecurity market to ensure we are ahead of the bad guys as the network continues to evolve," said Eli Fainberg, VP Product at Forescout.

**About OneLayer**

OneLayer provides enterprise-grade security for private LTE/5G networks. Its platform and IoT security toolkit can be implemented in private cellular networks to provide better visibility, control and protection for organizations. The company was founded by world-class cybersecurity experts with a deep understanding of both cellular protocols and IoT security needs and veterans from the IDF's 8200 and 81 intelligence units. OneLayer is backed by industry-leading advisors and has partnered with experts both in the cybersecurity domain as well as the telecom industry. To learn more about OneLayer please visit https://one-layer.com/ or LinkedIn.

OneLayer Opens 5G Security Lab for Network Security Companies to Research Threats to Private Cellular Networks

The healthcare sector is twice as likely to face data breach consequences as any other industry surveyed.

**FRISCO, Texas, Oct. 27, 2022 /PRNewswire/ —** Netwrix, a cybersecurity vendor that makes data security easy, today announced additional findings for the healthcare sector from its global 2022 Cloud Security Report.

61% of respondents in the healthcare industry suffered a cyberattack on their cloud infrastructure within the last 12 months, compared to 53% for other verticals. Phishing was the most common type of attack reported.

"The healthcare sector is a lucrative target for attackers because the chances of success are higher. The first two years of the pandemic exhausted the industry. With patient health being the main priority for these organizations, IT security resources are often too stretched and are focused on maintaining only the most necessary functions," comments Dirk Schrader, VP of Security Research at Netwrix. "Plus, the high value of data gives cyber criminals better opportunities at financial gain: They can either sell stolen sensitive medical information on the dark web or extort a ransom for 'unfreezing' the medical systems used to keep patients alive."

An attack in the healthcare sector is more likely to result in financial consequences. 32% of respondents from other industries report that an attack had no impact on their business, while only 14% of healthcare organizations say the same. Unplanned expenses to cover security gaps and compliance fines are the most common types of damage that the healthcare sector faces due to a cyberattack.

"Healthcare organizations plan to increase the share of their workload in the cloud from 38% to 54% by the end of 2023. Fast cloud adoption should be accompanied by relevant security measures and special attention to internet-of-things (IoT) devices and systems; for example, compromise of respirators or IV infusion devices can lead to physical harm to patients," adds Schrader. "Network segmentation will help prevent one compromised device from impacting the entire system. IT teams must also strictly limit who — humans and machines — can access what data and systems according to the least-privilege principle, and regularly review and right-size those access rights."

**About Netwrix**

Netwrix makes data security easy, thereby simplifying how professionals can control sensitive, regulated and business-critical data, regardless of where it resides. More than 11,500 organizations worldwide rely on Netwrix solutions to secure sensitive data, realize the full business value of enterprise content, pass compliance audits with less effort and expense, and increase the productivity of IT teams and knowledge workers.

Founded in 2006, Netwrix has earned more than 150 industry awards and been named to both the Inc. 5000 and Deloitte Technology Fast 500 lists of the fastest growing companies in the U.S.

For more information, visit www.netwrix.com.

Netwrix Study: 86% of Cloud Attacks in the Healthcare Sector Result in Financial Losses or Other Damage

Survey points to gaps in understanding of what's driving higher costs and limiting access to cyber insurance coverage — and what businesses can do about it.

**SCHAUMBURG, Ill., Oct. 26, 2022 /PRNewswire/ —** Good news for cybersecurity: More risk managers have purchased cyber insurance to help protect their businesses and customers from the potentially disastrous consequences of breaches and hacks. The bad news: Increasing premiums and restrictions for cyber coverage over the past year have created frustration for some business leaders.

This is the mixed picture emerging from the just-released 12th annual Information Security and Cyber Risk Management study from Zurich North America and Advisen Ltd., a Zywave Company. The 2022 study indicates that 86% of respondents now have cyber insurance, up three percentage points from 2021 and the highest percentage in the history of the survey. About 83% of respondents say they've taken steps to assess their cyber risk, and 69% have invested in cybersecurity solutions to mitigate risk.

Such findings suggest that CEOs, CIOs and risk managers increasingly grasp the threat that cyberattacks pose to their businesses, customers and the economy. But comments in the survey also reveal gaps in understanding of the drivers of insurance rates and restrictions and the role that risk mitigation actions play in the ability to access coverage at an affordable price.

"Our latest survey shows that many respondents recognize cyber threats and claims have increased in frequency and severity, but some business leaders struggle with the extent of the impact on insurance costs, policy terms and risk selection," said Michelle Chia, Head of Professional Liability and Cyber at Zurich North America. "What's clear is that cyber resilience is critical to business resilience. Carriers, distributors, risk managers, IT professionals, governments and employees everywhere need to work together to strengthen cyber resilience in this fast-evolving risk landscape."

Other highlights from the survey:

*   54% of respondents who experienced a claim reported it to their cyber insurance carrier. More than 70% recouped costs from their cyber insurance carrier, while a portion of claims are still in process.
*   52% have increased their organization's oversight of IT vendor management in response to geopolitical conflict concerns.
*   52% of respondents agreed that their cyber insurance meets their expectations and provides value, and 61% said their coverage meets some but not all organizational needs.
*   Over 93% of respondents said they expect Data Breach and Cyber Extortion/Ransomware coverage to be included in cyber insurance policies, followed by Data Restoration (87%) and Business Interruption (75%).
*   81% of respondents reported having cyber incident response plans in place, but less than 60% test these plans regularly.
*   62% of respondents cited "Enhance Employee Training" as one of their top cybersecurity priorities over the next year.

"While there's more to be done, it's encouraging to see organizations taking steps to shore up their cyber resilience," Chia said. "Insights from this survey present the opportunity for insurance carriers and brokers to provide continuing education on the shifting cyber risk environment and mitigation techniques. Those responsible for managing cyber risk can refer to this survey's insights to help gain organizational support for additional investments to enhance cyber resilience and access to insurance coverage."

The survey was completed at least in part by 353 risk managers, insurance buyers and other risk professionals. The majority classified themselves as either a chief risk manager or the head of a risk management department (28 percent); a different member of a risk management department (25 percent); a chief information security officer or chief privacy officer (5 percent); or other executive, such as a CIO, CFO or CEO (20 percent).

The full Information Security and Cyber Risk Management survey report is here.

**About Zurich North America**

Zurich North America is one of the largest providers of insurance solutions and services to businesses and individuals. Our customers represent industries ranging from agriculture to technology. Zurich North America is part of Zurich Insurance Group, a leading multi-line insurer serving people and businesses in more than 210 countries and territories. Founded 150 years ago, Zurich is transforming insurance. In addition to providing insurance protection, Zurich is increasingly offering prevention services such as those that promote wellbeing and enhance climate resilience.

Reflecting its purpose to "create a brighter future together," Zurich aspires to be one of the most responsible and impactful businesses in the world. It is targeting net-zero emissions by 2050 and has the highest-possible ESG rating from MSCI. In 2020, Zurich launched the Zurich Forest project to support reforestation and biodiversity restoration in Brazil.

The Group has about 56,000 employees and is headquartered in Zurich, Switzerland. Zurich Insurance Group Ltd (ZURN), is listed on the SIX Swiss Exchange and has a level I American Depositary Receipt (ZURVY) program, which is traded over-the-counter on OTCQX. Further information is available at www.zurich.com.

2022 Advisen-Zurich Survey Illuminates Growing Cybersecurity Concerns

Leaning on social media to amplify your company's brand? Here's a look at the emerging cybersecurity risks that can arise from TikTok, LinkedIn, Twitter, and other platforms.

7 Hidden Social Media Cyber-Risks for Enterprises

Chrome's Stable Channel 107 rollout includes security fixes from a slew of independent researchers, racking up nearly $60,000 in bounties.

Google Chrome's rollout of its latest browser update includes 14 individual security fixes — three high-severity — found by independent researchers who earned bug bounty payouts totaling more than $57,000. 

There is still one high-severity bug with a payout amount listed as "TBD," meaning the final collective tally could top $60,000. 

The latest update, Chrome 107 for Windows, Mac, and Linux, will roll out over the coming days, Google announced, along with the new version's security improvements. 

"We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel," the Chrome team said about the update's release. 

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Google Chrome Pays $57K (and Counting) in Bug Bounties for Latest Update

Developers will be able to scan for vulnerabilities in source code, containers, dependencies, and applications in production.

GitLab has announced a number of new security and compliance features and enhancements to its platform that are intended to help organizations secure the software supply chain.

The new capabilities include security policy management, compliance management, events auditing, and vulnerability management. A dependency management capability to help developers track vulnerabilities in dependencies they are using will be available at a later date. Organizations will be able to automatically scan for vulnerabilities in source code, containers, dependencies, and applications in production, GitLab says.

The increased focus on governance will help organizations identify risks by providing them with visibility into their projects and the dependencies in use, security findings, and user activities, GitLab says. The platform will be able to track changes and implement controls to define what goes into production, helping organizations ensure that they are adhering to license compliance and regulatory frameworks.

The new enhancements are designed to provide developers with tools to proactively scan for vulnerabilities and implement controls to secure applications. Developers also have access to actionable and relevant secure coding guidance within the GitLab platform.

"With the recent addition of GraphQL schema support in 15.4, these API security scans help secure applications with minimal configuration compared to prior releases," GitLab says. "Additional application security scanners include static application security testing, secret detection, container scanning, dependency scanning, infrastructure-as-code scanning, and coverage-guided fuzz testing."

GitLab promises upcoming features, such as a mechanism to parse and ingest existing software bill of materials data from third parties to create a comprehensive software bill of materials for the project, as well as the ability to cryptographically sign both the build artifact and attestation file to prove builds have not been altered. Another upcoming feature will allow GitLab administrators and group owners to create new customized roles with granular permissions to help security teams align role-based access control with the organization's policies.

The security of the software supply chain is increasingly top of mind for security professionals. For 70% of all respondents in Dark Reading's "State of Supply Chain Threats" survey in August, supply chain security was among the top five security priorities. In the same vein, GitLab's "2022 Global DevSecOps Survey," released earlier this year, found security was the highest budget priority for organizations.

Source

DARKReading