Update allows BlastShield users to link with hybrid cloud network providers like AWS, Google, and the most recent addition, Azure, in one secure environment.

**Palo Alto, Calif. – June 16, 2022 –** BlastWave, a zero-trust networking solution provider that reduces the cost and complexity of remote access VPN management, today announced enhancements to its zero-trust security software solution, BlastShield_™_. The enhancements include added security capability for the three main cloud service providers, identity manager unification, Azure gateway security integration and easy bulk onboarding. BlastWave sees these updates as increasingly important with the global workforce shift to remote cloud environments on multiple vendor platforms.

The recent update allows BlastShield users to link with hybrid cloud network providers like AWS, Google, and the most recent addition, Azure, in one secure environment without forcing a user to rely on the respective security measures of each provider. This means users can have workloads distributed across provider environments but only one user authentication system. The update continues BlastWave’s mission of convenient, cutting-edge cybersecurity, all while offering enhanced protection within identity management systems. Most importantly, users can take advantage of BlastShield’s heightened speed and functionality, two vital features in multi-functional, cloud environments.

This latest update also adds support for gateway security in Azure environments, expanding on BlastShield’s previous gateway security capabilities in GCP, AWS, ESXi and COTS hardware systems. This new gateway security integration increases functionality for Azure users, allowing them to rely on password-less authentication instead of dated VPN security measures within their cloud-based Azure environments.

BlastShield’s latest update streamlines bulk onboarding, a typically arduous process, leveraging customers’ SSO functionality. This update’s features rely on an industry-standard API, System for Cross-domain Identity Management (SCIM), designed to simplify the management of user identities in cloud-based services as well as applications. It enables the automatic exchange of user information between identity domains, eliminating the insecure provisioning of identity managers when onboarding large numbers of users in distributed cloud environments. Identity managers have conventionally suffered from potential exposure to credential theft, SIM jacking, and other threat vectors. BlastShield’s update addresses these vulnerabilities without hampering the convenience of identity managers.

“BlastShield’s latest update enhances our proven security mechanisms with single sign-on identity management tools and offers simplified bulk onboarding,” said Michael Bacon, BlastWave Solution Engineer. “Many competitors are focusing more on endpoint security in these hybrid cloud environments, but we’re offering a macro-level security approach that combines the convenience of identity management systems like Okta and One Identity with the proven agile security of BlastShield’s network-level ZTNA and microsegmentation.”

The recent software update and resulting functionality are automatic for new subscribers and can be implemented with the click of a button in the BlastShield interface for current professional and enterprise customers.

“In the past, cybersecurity may have elicited groans from providers, largely due to its perceived inconvenience. This update lends BlastWave’s proven security stack to the login convenience offered by established identity managers,” said Mel Knight, Brier and Thorn CISO. “Once again, whether through bulk onboarding via secure provisioning or enhanced Azure environment security, BlastWave continues to imbue existing technologies with their patented, proven ZTNA security solution. We are excited for our customers to experience this update’s improved, secure convenience, bulk onboarding, and multi-vendor cloud security.”

\# # #

**About BlastWave**

Founded by former executives and technologists from Apple and Cisco, BlastWave is taking a fundamentally different approach to security aimed at protecting privacy and connected devices from cyberattacks. BlastWave’s patented product, BlastShield™️, is an integrated, zero-trust stack that combines state-of-the-art passwordless multi-factor authentication with high-performance, resilient encrypted connectivity and built-in microsegmentation. BlastWave is backed by Rocket Strategies, Lucas Venture Group, and Millennium Investments. The company is headquartered in Palo Alto, California. To learn more, visit www.blastwave.io and follow us on LinkedIn and Twitter @blastwaveinc.

BlastWave Announces Enhancements to Its Zero-Trust Security Software Solution, BlastShield

SharePoint and OneDrive libraries can be encrypted in ransomware attack, researchers say.

Enterprise cloud services like Microsoft 365 leave enterprises open to ransomware threat actors who want to encrypt files saved in SharePoint Online and OneDrive libraries, researchers warn.   

The new target marks a potential pivot point for ransomware attackers running out of luck focusing on endpoints and network drives and might find less resistance attacking cloud infrastructure, new research from Proofpoint says. The team was able to document the attack chain from initial credential compromise to account takeover, discovery, exfiltration, and, ultimately, the ransom demand. 

"Until now, IT and security teams felt that cloud drives would be more resilient to ransomware attacks," the Proofpoint team wrote along with their findings. "After all, the now-familiar 'AutoSave' feature along with versioning and the good old recycle bin for files should have been sufficient as backups. However, that may not be the case for much longer."  

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Microsoft 365 Function Leaves SharePoint, OneDrive Files Open to Ransomware Attacks

Cyber insurance is more than a policy for paying off ransomware gangs. It's designed to be something you transfer risk to when security controls fail.

Digital risks are a pervasive aspect of operating in today's digital economy, threatening organizations large and small no matter how hardened their security defenses. Unfortunately, preventing cyber incidents is impossible; instead, solving cyber-risk is a combination of proactive measures and risk transference.  

As cyberattacks become more frequent and sophisticated, many organizations are adding cyber insurance to their security portfolios. But not everyone understands just what the "cyber" in "cyber insurance" entails.

Cyber insurance was created to protect organizations and individuals against digital risks like ransomware, malware, and phishing campaigns. Whereas traditional insurance policies often only accept the transference of known physical risks (such as damage to equipment, stock, or locations), cyber insurance enables businesses to transfer the costs associated with recovery from the tangible and intangible losses related to a cyber-related security breach or similar event.

Although still somewhat in its infancy, with less than 1% market penetration, cyber insurance is expected to grow into a $20 billion industry by 2025.

Anyone new to cyber insurance might mistake it for a policy that pays off attackers to retrieve or unlock data. But it's much more than that.

**What Is Cyber Insurance?**

Cyber insurance is something you transfer risk to when your online security controls fail. Cyber insurance can cover multiple liabilities, such as loss of funds and income, expenses related to business interruptions, payments to experts to recover data, and even compensation for bodily injuries, depending on the resulting damage and prescribed policy.

Cyber insurance rates and coverage will be based on the maturity and thoroughness of your cyber defenses, among other factors. Typically, a provider will assess your vulnerabilities as part of the quoting process. This exercise can include, for example, a complete security report of all external assets and detection of potential security issues.

The average cyber-insurance policy for a small to midsize enterprise in 2021 was $1,589 for $1 million in cyber liability coverage. Prices are also based on factors like coverage or limits to what the provider will pay, as well as retentions that are similar to the deductible you pay for your car and home insurance. Other factors are considered, like your industry and the results of security scans.

**What Is the Role of Cyber Insurance Providers?**

Providers can also offer additional scanning and monitoring features to apprise you of potential vulnerabilities. For example, they might include services like full attack surface discovery and monitoring for your organization and five vendors.

They can monitor the Dark Web for keywords to determine if your name is mentioned. They can provide domain monitoring to see if an attacker is preparing a social engineering attack and adding an SSL certificate or an MX entry to a domain like yours. Or they might offer torrent monitoring to see whether your assets are downloading torrents.

By bridging the gap between physical and digital risks, cyber insurance allows companies to get back online and resume normal business operations faster after an incident, minimizing the cost to their recovery.

**What Is a Cyber Claim?**

Unlike nontechnical events like fires and floods, a cyber-insurance claim might be determined by means of attack and your ability or effort to prevent it. Because cyber insurance is still somewhat new and undefined, events and damages that would initiate a claim can be vague and inconsistent. Depending on the situation, the provider may deny coverage.

The most common forms of claims are based on data privacy liability, cyber extortion, network business interruptions, and recovery and restoration of data assets. But the majority of claims are related to breaches.

**Does My Business Qualify for Cyber Insurance?**

Some businesses may not see themselves as a target to threat actors, but that doesn't mean they are not vulnerable to cyberattacks or are uninsurable. When working with a cyber-insurance provider, companies are subject to an underwriting process that considers various aspects of their businesses (including risk posture, industry, and financial indicators) to determine coverage eligibility. Organizations that piecemeal their defense technologies or maintain lax security habits could be considered a higher risk and be charged higher premiums with lesser levels of coverage, the same way people who live in houses on flood plains have higher premiums.

A good cyber-insurance provider can provide recommendations and services to help prevent cyberattacks or paying ransomware hackers for their data. For example, they might tell you to turn off the Remote Desktop Protocol (RDP), which we know is a primary vector for ransomware. They might also provide guidance around what technologies are known to come with increased digital risks and help organizations adopt security best practices, such as patch management and implementing strong password guidelines.

Ultimately, staying on top of your digital risk involves finding the right risk management partner to help guide you. Cyber-insurance providers provide that extra level of expertise and coverage to reduce risks and provide financial support when things go wrong. In today's age of ransomware, this protection is more imperative than ever.

What We Mean When We Talk About Cyber Insurance

The commercial-grade surveillance software initially was used by law enforcement authorities in Italy in 2019, according to a new report.

Researchers have discovered an enterprise-grade Android family of modular spyware dubbed Hermit conducting surveillance on citizens of Kazakhstan by their government.

Lookout Threat Lab researchers - who spotted the spyware - surmise that the secretive Italian spyware vendor RCS Lab developed it and say Hermit was previously deployed by Italian authorities in a 2019 anti-corruption operation in Italy. The spyware also was found in northeastern Syria, home to the country's Kurdish majority and a site of ongoing crises, including the Syrian civil war.

Android devices have been abused with spyware in the past; Sophos researchers uncovered new variants of Android spyware linked to a Middle Eastern APT group back in November 2021. More recent analysis from Google TAG indicates at least eight governments from across the globe are buying Android zero-day exploits for covert surveillance purposes.

Mike Parkin, senior technical engineer at Vulcan Cyber, says spyware is a tool used by many actors worldwide, including criminal organizations, state or state-sponsored threat actors, national security, and law-enforcement organizations following their own mandates.

"Regardless of who is using it or what agenda they are working toward, these commercial- grade spyware tools can seriously threaten people's personal privacy," he says.

The highest profile spyware case in recent memory was the discovery of Pegasus, a legal surveillance software developed by Israeli company NSO Group. The news caused an international furor after it was found covertly installed on iOS and Android mobile phones belonging to human rights activists, journalists, and high-ranking members of governments.

**How Hermit Works**

Hermit first gets installed on a targeted device as a framework with minimal surveillance capability. Then it can download modules from a command-and-control (C2) server as instructed and activate the spying functionality built into these modules.

This modular approach masks the malware from automated analysis of the app and makes manual malware analysis significantly harder. In addition, it allows the malicious actor to enable and disable different functionalities in their surveillance campaign or the capabilities of a target device. Hermit can also alter its behavior as needed to evade analysis tools and processes.

"The modular design might also be part of the business model of the software vendor, allowing them to sell individual spying features as value-add line items," explains Paul Shunk, security researcher at Lookout, which published a report on Hermit today.

Shunk says the overall design and code quality of the malware stands out compared with many other samples he has seen. 

"It was clear this was professionally developed by creators with an understanding of software engineering best practices," he says. "Beyond that, it is not very often we come across malware \[that\] assumes it will be able to successfully exploit a device and make use of elevated root permissions."

The discovery of Hermit adds another puzzle piece to the picture of the secretive market for "lawful intercept" surveillance tools, he says.

"As in the cases of NSO, Cytrox, and other vendors, discovery of their customers usually exposes their claim that their product is only used for legitimate purposes as at least partially untrue," Shunk says.

One of the Hermit samples Lookout analyzed used a Kazakh language website as its decoy.

And the main C2 server used by the app was just a proxy, with the real C2 being hosted on an IP from Kazakhstan. 

"The combination of the targeting of Kazakh-speaking users and the location of the back-end C2 server is a strong indication that the campaign is controlled by an entity in Kazakhstan," Shunk says.

Lookout says an Apple iOS version of the spyware exists as well, but the research team was unable to obtain a sample to analyze.

**'MaliBot' Targets Online Banking**

Meanwhile, another Android-based malware family reared its head this week in the form of Malibot, which is targeting online banking customers in Spain and Italy with the capability to steal credentials and crypto wallets. The malware was discovered by F5 Labs while the security company was tracking the mobile banking Trojan FluBot.

The malware consists of two campaigns: Mining X, which presents a QR code that leads to the malware Android Package Kit, and TheCryptoApp, which attempts to dupe users into downloading a fake version of the popular cryptocurrency tracker app available on the Google Play Store. 

It's also able to steal or bypass multifactor authentication codes and trick victims into downloading the malware either via a direct SMS phishing message or via fake websites they're lured to.

"This is certainly one to pay attention to and F5 expects to see a broader range of targets as time goes on, especially given the versatility of the malware could, in principle, be used for a wider range of attacks than stealing credentials and cryptocurrency," F5 warns in a blog post.

Android Spyware 'Hermit' Discovered in Targeted Attacks

Security pros can employ the technology to evaluate vulnerabilities and system capabilities, but they need to watch for the potential risks.

Digital twin technology allows for the creation of a virtual duplicate of a live production system, network environment, or cloud instance in real time — and it promises to be a rapidly growing market and boon to manufacturers and security pros alike, according to a new report from Capgemini. The benefits not only provide fallback during scheduled downtimes and improve performance through optimization, but they also aid organizations through the introduction of new business or operating models, the report, "Digital Twins: Adding Intelligence to the Real World," states.

The industry itself is still in its nascent stages, but investments are increasing. The market size for digital twins, which exceeded $5 billion in 2020, is expected to grow at more than a 35% compound annual growth rate between 2021 and 2027, Capgemini states.

Though cybersecurity is not a top driver of the technology at this time, 62% of respondents said cybersecurity and blockchain are of "importance."

Digital twins mirror a real-world system to let designers and engineers examine in realistic detail how different conditions will affect it, such as how a wind turbine might fare in a hurricane. Aside from the manufacturing and business opportunities, however, security pros can employ the technology to stress-test and otherwise evaluate the vulnerabilities and capabilities of security controls on computing environments. The ability to attack a live twin of a production environment — complete with ongoing updates reflected from the original system or environment — without putting data or productivity at risk potentially allows security teams to be as aggressive as they need to be without compromising operations. But whether data is placed at risk still seems to be a debated issue.

**Risking Data**

Capgemini cautions that security teams do not have carte blanche with digital twins. 

"An adversary affecting a digital twin or its physical counterpart can introduce divergence in the behaviors or states of the two entities," the report states. "Given the bi-directional link between the two, an attacker may negatively affect both through changes in either."  

"There are multiple areas where we have to be very careful about security with digital twins," cautions Brian Bronson, president of the Americas and APAC for Capgemini Engineering. "One of the main ones is the data capture. Because the digital twin has to do simulations with the 'in service' data, the process of capturing the data must be secure in order to protect it."

While the promise of digital twin technology for security is recognized, it might be too soon to fully implement it, says Ollie Whitehouse, global CTO at NCC Group, a research and consulting firm specializing in assessments, detection and response, compliance, and software resilience. 

"At the theoretical level, the assertion holds true," he says. "However, we are likely many decades off from digital twins being as tightly coupled as the paper implies. It's unclear as to their true value, i.e., what metricated improvement in cyber resilience an organization or product will yield if they employ digital twins."

Lisa O'Connor, cybersecurity research and development global lead at Accenture, concurs with the assertions in the Capgemini report. 

"First, all systems should be secure by design. This is no different whether we are building a production system or a digital twin of some aspect of that system," she says. 

If the digital twin is not secure by design, it could become a vector of attack.

"Changing the digital twin or the physical object's perceived behavior by intercepting and modifying the data is a known attack tactic in critical infrastructure and is common in any operational technology \[environment\]," she continues. "Such manipulations may affect the human operator or resulting analytics to make decisions on the wrong masked data. In the case where a digital twin is designed to provide direct feedback to or control of operational systems, it could directly affect those systems if not properly secured."

Nevertheless, digital twin technology has proponents who foresee its value as a cybersecurity tool. Dan Isaacs, CTO of the Digital Twin Consortium, says digital twin technology already offers security teams the ability to not only test larger environments, but also to become more granular to test more focused systems and infrastructure.

In fact, one can build a nested digital twin environment to uncover focused details related to risk, vulnerabilities, and training, as well as optimize operations. There are no silver bullets, but this is defense in-depth, Isaacs says.

**An Emerging Technology**

While Capgemini and the Digital Twin Consortium both promote the applications digital twin technology offer for very large environments, such as protecting power grids, network protection, and manufacturing, NCC's Whitehouse is still skeptical, underscoring the challenges the technology still must overcome.

"There has been some evidence that digital twins are possible in small-scale systems, but they have not been shown to scale to our knowledge," Whitehouse says. "There are numerous variables affecting how one can fully implement cyber-physical, complex business processes, and supply chains in a digital-twinned environment. Digital twins are an emerging concept going through rapid evolution."  

But, he cautions, "they are not prime for mass adoption today outside of the very specialized, and especially when looking at cyber resilience challenges. Often-imperfect data and insight into the physical system today coupled with cost constraints means watered-down realities exist. Digital twins are a vision of what might be — but the reality today is often very different when we look at implementation."

Capgemini's Bronson agrees that digital twin technology is at "the beginning of the journey."

"One of the main attention points is to understand that a digital twin is not a 'photo' at one point in time," he says. "We have to think of the full life cycle of the real object that we want to replicate — from the design to the end of life to recycling."

A digital twin is a database that contains sensitive information, warns Accenture's O'Connor. "Protecting the digital twin itself is as important as protecting the system it analyzes," she says.

Unlocking the Cybersecurity Benefits of Digital Twins

A working group of European and US officials meet at The Hague to collaborate on ransomware operations and strategies.

The US Department of Justice, along with the European Union criminal justice organization Eurojust, brought together law enforcement and legal experts recently at The Hague in workshops to enhance international cooperation to stop ransomware attacks.

The group represented 27 countries and included representatives from the Federal Bureau of Investigation (FBI), Secret Service, Homeland Security Investigations, the European Judicial Cybercrime Network, Eurojust's Cybercrime Team, and Europol's European Cybercrime Centre.

"Only by working together with key law enforcement and prosecutorial partners in the EU can we effectively combat the threat that ransomware poses to our society," US Assistant Attorney General Kenneth A. Polite Jr. said in a statement about the event. "I am confident that the U.S.-EU ransomware workshop will spur greater coordination and collaboration to address the ransomware threat."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

EU & US Unite to Fight Ransomware

A secure Web browser takes the top prize, and for the second year in a row malware detection is an afterthought.

**RSA CONFERENCE 2022 –** RSAC's Innovation Sandbox is a _Shark Tank_\-like competition, bringing 10 startup finalists to present onstage before judges.

Talon Security seized the first-place prize with a bold vision for the corporate Web browser of the future. For those thinking the browser is too competitive a market to take on, Talon's pitch makes intriguing arguments.

Deploying any kind of traditional security controls or software across operating systems, and into third-party contractors or personal devices, is logistically difficult or impossible. Yet Web browsers can be deployed by any user without admin privileges. In 2019, Microsoft consolidated under Google's open source Chromium code base, so Talon's Chromium browser should enjoy broad device and Web compatibility.

After requiring users to have Talon's browser to access their clouds, corporations then gain centralized management to control access levels. Talon ensures privileged data stays contained within the browser, as it can block saving, screen capture, or cut and paste.

Talon is not the only startup stretching our understanding of security's future. With these nine other innovative finalists, three trends have emerged.

**Core Security Still Being Reimagined**

Many of these entrepreneurs proposed bold visions for reimagining cloud security. Zero trust has been a popular approach, centralizing continuous authorization, device attestation, and taking the least-privilege approach in the cloud. Sharon Goldberg, CEO of the second-place finisher, BastionZero, takes issue with even calling today's solutions zero trust, "when really they create a single point of compromise."

BastionZero's founders came out of the cryptography world, where decentralized encryption, such as that in Bitcoin, and Transport Layer Security (TLS) are common. BastionZero enables engineers and build processes to authenticate to the cloud using multiple roots of trust. With this differentiator, if one root is compromised, organizations still maintain control.

Attack surface management company SevCo is the brainchild of JJ Guy and Greg Fitzgerald, the founders of Carbon Black and Cylance, respectively. Attempts at device inventories have always been an industry failure, and the problem has become worse with our remote and rapidly churning workforce.

SevCo's real-time streaming platform continuously correlates inventory from many sources through APIs. They record suspicious changes over time and are expecting to tame the problem of unmanaged and malicious devices reaching into clouds.

**Risk Management for Data, Privacy, and DevOps**

Unlike past years at Innovation Sandbox, the majority of 2022 finalists sell to users who do not report to the CISO. Talon's Web browser, SevCo's IT inventory, and BastionZero's authentication are more likely to fall under the CIO. Judges are surely sensitive to the demand for securing post-cloud IT infrastructure and defending digitization across organizations.

Another trio of startups in the competition emphasized working across these departments. Dasera frees data security that's been siloed within data, IT, and privacy teams. It visualizes data context, automates workflows, and coordinates policy and actions. Dasera ends up being a single pane of glass to visualize and manage data security across multiple departments and throughout its life cycle.

Torq is using a no-code approach that's seen recent success in automating cloud operations. It allows security professionals to visually build automation without the help of programmers, reducing costs. In addition to automating incident response, Torq can seamlessly coordinate with IT on the growing backlog of account provisioning, caused by identity attacks.

SecDevOps startup Cycode reaches across the organization to defend DevOps' entire pipeline: from application code to open source libraries and deployment paths. Cycode also automates remediation workflows to reduce costs.

**Cloud Security Focuses on APIs, Over-Permissioning**

Malware is still big on endpoints but receives less emphasis in cloud security. It's difficult for hackers to ensure their malware runs in the cloud near the data they target, especially with technologies like "serverless" containers and lambda functions. From what we know today, hackers are more likely to make API calls into or across the cloud, often sitting at their own devices behind anonymized IPs.

The cloud's crown jewels are applications and APIs that are exposed to the outside by design, said Neosec founder Giora Engel. Attackers can access them directly with credentials — whether legitimate or stolen. Hence the cloud security adage, "Hackers don’t break in, they log in." Neosec leverages API gateways, like Google Apigee. It discovers an organization's APIs, detects their vulnerabilities, and monitors use and abuse. Neosec wields behavioral analytics and offers a managed detection and response service on top.

Lightspin also doesn't focus on malware detection but manages cloud posture and protects workloads through a unique graph technology. Less-experienced analysts can visualize the most critical attack paths where vulnerabilities and configurations need closing. It's one of the easier products to use in its space.

Meanwhile, Cado Security brings forensics and incident response to cloud workloads. Instead of placing agents inside these workloads, Cado obtains cloned images of their disk, memory, and surrounding logfiles. Since offline forensic analysis has zero impact on high-availability workloads, cloud forensics has exciting potential.

Cado is one of the few examining binary files and processes inside workloads. It doesn't tout specific malware detection, yet allows searching for malware indicators and visualizing timelines.

Araali Networks is bucking the trend and places agents into the private cloud, leveraging Kubernetes DaemonSets and Linux's extended Berkeley Packet Filter (eBPF). Araali examines network traffic, enforces policies, and blocks malicious code.

Innovation Sandbox 2022 was a barometer for the rapid industry changes that are underway to secure the cloud. Cybersecurity must defend digitization across IT, data, privacy, and DevOps. It's a different world, where threats are a lot bigger than just malware.

RSAC Startup Competition Focuses on Post-Cloud IT Infrastructure

While CISOs may feel more confident in their security posture emerging from the pandemic, new research suggests that doesn't mean organizations are better prepared for large-scale attacks.

Cybercrime reached heightened levels of intensity and sophistication in the past year. We saw greater complexity in ransomware, supply chain, and critical infrastructure attacks. Despite the threat escalation, CISOs feel more confident in their security posture. But does that feeling of confidence actually translate into organizations being better prepared for large-scale attacks? New research suggests that is not the case.

The "2022 Voice of the CISO" report, Proofpoint's global survey of 1,400 CISOs, found that only 48% are concerned about their organization suffering a material cyberattack in the next 12 months, a sharp drop from the previous year's 64%. This shift reveals CISOs feel more in control, even as new events such as the Great Resignation and geopolitical tensions in Europe are elevating their stress levels.

But the increased confidence of CISOs shows a disconnect with their actual preparedness — despite their greater trust in themselves, 50% acknowledge their organization is not prepared to cope with a targeted attack. This misalignment shows that CISOs have simply reached a state of relative tranquility after the disruption of the pandemic. The psychological effects of the chaos are finally wearing off.

Having met the pressure to react quickly and shore up resources to support remote work in 2020, CISOs accepted the realities of our new world of elevated cyber threats. But once the pandemic demands eased up, new, pressing issues developed — and CISOs accepted their new normal of always operating at high alert.

**CISOs Adapt but Vulnerabilities Remain**

As CISOs moved to adapt to the new realities of their job, insider threats became their biggest concern, rising from the third spot in 2020 to the top in 2021. The increased awareness about insider threats likely played a big part in this change, especially in the life sciences sector, where vaccine research received prominent media attention. Pfizer is one example. The company filed a highly publicized lawsuit against an employee who allegedly stole trade secrets pertaining to the company's vaccines and medications.

Geopolitical tension also contributed to concerns about insider threat. Last year, for instance, the FBI warned technology companies that employees with ties to China and Russia may spy on them. And let's not forget that negligent insiders pose almost as big a threat — CISOs ranked negligent, malicious, and compromised insiders as nearly equal risks in terms of breach exposure.

Data protection is at the heart of the challenge, especially given the impact of the Great Resignation and hybrid work. Some 56% of surveyed CISOs still view human error as the biggest threat to their organization, with compromised insiders as the most likely vector. The ongoing transition, as employees continue to leave or return to the workplace, exacerbates the insider threat, making data protection an even more urgent priority.

**Finally, a Seat at the Table — With Mixed Results**

Ransomware is another threat that received media attention last year, forcing C-suites finally to take notice of these high-profile attacks. In the past, CISOs often had to plan special strategies to gain an audience with the board. Corporate directors and top officers viewed CISOs as simply technologists, relegating cybersecurity to a mere IT problem. Today, CISOs are finally getting a seat at the table. This is an encouraging change.

With their role now elevated, CISOs are also subject to a higher level of job expectations. Only 49% feel the expectations of their role are excessive, compared with 57% in the previous year's study. This may be another indicator of the post-pandemic calm, leaving CISOs feeling less pressured yet more in control.

Unfortunately, the rise in prominence of the CISO's role does not mean that security leaders feel more supported by their organizations. There was only a slight decrease in the number of CISOs who see eye-to-eye with their boards (52% in 2021 vs. 54% in 2020).

This strain in their relationship will continue to impact the effectiveness of CISOs in making cybersecurity a strategic part of their organization's business objectives — and the survey data show the implications of this struggle. For instance, 42% of surveyed organizations still do not have a ransomware policy in place. Although this threat has been on CISOs' radar for a long time, it took the nonstop media coverage in the past year for boards and executives to finally pay attention. They are just now viewing their CISOs as risk or business strategists.

**Bolstering Defenses Is Vital in the New Workplace**

As organizations acclimate to the new ways of operating in a post-pandemic world, CISOs are ready to leave uncertainty in their rearview mirror. But is this the calm before the next storm?

With geopolitical tensions mounting in Europe and other areas of the globe, targeted attacks, insider threats, and critical infrastructure risks keep rising. While CISOs are much more confident in their cybersecurity posture, bolstering defenses remains a critical imperative.

Organizations have emerged from the pandemic as transformed workplaces, and strengthening the human perimeter is especially critical in this evolved, hybrid environment. Now that CISOs have a voice, they are in a stronger position to make the case for better organizational preparedness. Considering that people remain the biggest risk factor, making the argument for closing the gaps in the human perimeter must remain at the top of every CISO's agenda.

CISOs Gain False Confidence in the Calm After the Storm of the Pandemic

New (ISC)² survey shows employment levels for entry-level cyber pros lag behind every other experience level.

Even as the global cybersecurity skills gap continues to widen, many organizations still cling to the idea that if they hold out long enough, they will be able to find rock-star veterans to fill out their security team rosters. A new survey shows that cybersecurity hiring managers are less likely to take a chance on promising entry-level candidates than they are to hire veteran staffers or those with at least a year of experience.

This hesitance of many organizations to train up newbies into the industry highlights a huge opportunity that many hiring managers have in improving the state of their cybersecurity workforce, according to the "(ISC)² Cybersecurity Hiring Managers Guide." Based on a survey of 1,200 cybersecurity hiring managers from the US, UK, Canada, and India, the report details hiring practices around the globe.

"The study shows us that, with the exception of the smallest organizations, employment levels for entry-level cybersecurity professionals trail far behind every other experience level," says Tara Wisniewski, executive vice president of advocacy, global markets, and member engagements for (ISC)². "It's also a particularly notable challenge in the US and UK, compared to Canada and India where entry-level employment levels are higher overall."

In the US, for example, just 26% of security teams are composed of entry-level employees, compared with 38% who have four or more years of experience and 36% with one to three years of experience. The proportion of entry-level candidates may actually even be lower than that, considering that the survey methodology included only those managers who have hired entry-level or junior-level candidates sometime in the last two years. With those managers who only hire experienced candidates self-selecting out, the real numbers are likely even more stark than the report illustrates.

    

Regardless, the lag in entry-level employment rates occurs despite the fact that it takes a relatively short amount of time for these new practitioners to get up to speed on their job duties. Approximately 65% of hiring managers say it takes nine months or less to train entry-level staff. While these candidates improve their skills or knowledge, they're typically tasked with the repeatable security scut work that plagues security teams on the daily. 

The top two tasks delegated to entry-level workers are alert and event monitoring and documenting processes and procedures, which were respectively named by 35% of hiring managers. In open-ended comments within the survey, managers said that entry-level team members often bring "fresh ideas and perspectives to the table" and they often are willing to go the extra mile to get ahead not only in their job but in the cybersecurity profession.

    

One of the likely reasons why hiring managers struggle to keep their cybersecurity roster freshened up with greater proportions of newcomers to the field is that they aren't necessarily looking in the right places to find them.

    

"Organizations rely heavily on external factors and resources to find staff, including looking for certifications and looking within the memberships of certification organizations to find candidates," says Wisniewski, who notes that more than half of respondents rely on external recruitment professionals to fill these roles.

She believes that one of the highest-value things that cybersecurity managers can start doing to attract entry-level and junior-level practitioners is to search for talent beyond the world of cybersecurity and even IT. The survey shows that just 18% of study participants have hired individuals from within the organization who were working in different job functions.

"Transferrable skills and eager-to-learn people can be found in sales, marketing, engineering, legal, the military, hospitality, and more," she says. "It's also about ensuring that roles, organizations, and the cybersecurity sector at large are more inclusive and accessible for all."

**Reality Check for Training Dollars**

Wherever the candidates are found, the investment to get them to the point where they can meaningfully contribute to the team is likely less expensive than some managers might expect. Over eight in 10 respondents said the costs are less than $5,000, and 42% said it costs less than $1,000 for newcomers to start handling assignments.

Even with more significant investments in professional development, Wisniewski says that hiring managers shouldn't hold off in hiring and training entry-level staff in fear that their training dollars will walk out the door. She believes that these practitioners are crucial for the sustainability of an organization's cybersecurity workforce.

"Hiring junior staff is not a risk or a compromise. If anything, it is a proactive move to improve cybersecurity resilience," she says. "You would not hold off investing in critical infrastructure today just because there's a chance the vendor might change strategy tomorrow. The same applies with investing in your people."

Are You Hiring Enough Entry-Level Security Pros?

Digital transformation helps businesses keep operating and stay competitive. Here are the ways to think about security so that businesses reap the benefits without taking on associated risks.

**Question: How should I think about security when considering digital transformation projects?**

**Niv Weisenberg, Senior Director of Cyber Digital Transformation, Optiv**: Multiple factors contribute to the sheer number of digital transformation projects underway today: the proliferation of the Internet of Things (IoT), expanding artificial intelligence (AI) capabilities, the sudden shift to a remote workforce prompted by the global COVID-19 pandemic, and the rapid rate of cloud migration. Digital transformation is no longer a nice-to-have; it’s a must-have in order to survive and thrive in today’s business world. 

CISOs and their security teams need to think about security in the digital age from both an internal and an external perspective. For the former, security teams should introduce and adopt digital enablers to transform the information security organization. Digital enablers include the cloud, IoT, AI/machine learning (ML), and automation to transform the information security organization.   

For the latter, they should address potential risks as new digital enablers are introduced by the business to drive growth.

Here are five specific areas security teams should prioritize to achieve security-first digital transformation:

**1\. Security operations modernization**: Help security operations adopt a proactive posture when balancing the need to match technology adoption acceleration with cost management.

**2\. Developer-centric security**: Enhance overall security posture and optimize DevOps performance by embedding a culture of proactive security in the DevOps process, enabled by orchestration and automation. For example, “shift security left” in the application development process to integrate security products as developers code and into build/test processes — rather than leaving it as an after-the-fact bolt-on. This will help organizations solve issues at the point of origin, detect and remediate vulnerabilities before they hit production, and, most importantly, build a DevSecOps program that prioritizes security throughout all development phases.

**3\. Cloud strategy and execution**: Shifting security left applies in the cloud transformation journey, too. Develop a strategic roadmap for secure cloud migration, operation, and management, as well as secure architecture modernization. Also consider standing up cloud native app protection (CNAP) capabilities that will scour cloud environments and alert staff to compliance risks and configuration vulnerabilities in cloud services.

**4\. Connected devices:** Enforce critical network, device, and data protection by doing things such as hardening connected entry points to the data fabric, modernizing the data paths for IT/OT convergence, bringing legacy networks under a modern security architecture, and implementing zero trust and a software-defined perimeter.

**5\. Big data and analytics**: Maximize the value extracted from data and secure big data at scale with AI/ML-enabled analytics.

As important as it is to keep the business operating _and_ competitive, organizations must transform _securely._ Keeping security at the forefront gives the business the benefits of digital transformation without the associated risks.

Source

DARKReading