Investment bolsters Shift5’s traction within commercial aerospace and defense industries.

Arlington, VA, July 14, 2022 (GLOBE NEWSWIRE) -- Shift5, the OT cybersecurity company that defends military platforms and critical transportation systems from cyberattacks, today announced that AEI HorizonX, AE Industrial Partners’ venture capital group formed in partnership with The Boeing Company, has joined the company as an investor in its oversubscribed Series B funding round led by Insight Partners. Through the longevity and deep networks of AE Industrial Partners and Boeing, AEI HorizonX will enable Shift5 to capitalize on its momentum within the broader aviation ecosystem.

“Amid a shifting regulatory environment, Shift5 brings to market a solution that has been long-needed in the aviation ecosystem,” said Brian Schettler, Partner, Head of AEI HorizonX. “The company’s ability to transform previously inaccessible data from within aircraft into useful insights, paired with the credibility of the company’s founders and its extensive work within the U.S. Department of Defense, make clear that Shift5 is blazing a trail that many will follow.”

Shift5 unlocks the serial networks and data that control planes, trains, and tanks, providing visibility into fleet assets where operators have historically been locked out. Shift5 allows operators to gain complete observability, detect threats, and maintain resilience of operational technology (OT) systems as cyber-physical attacks become an increasingly attractive strategy for digital attackers. By providing visibility into the data that powers their most expensive, longest-lived, and most consequential fleet assets, Shift5 allows rail, aerospace, and defense companies to make data-informed decisions once considered impossible, to improve cybersecurity and increase operational efficiency.

“As security leaders from CISA and FBI warn critical infrastructure operators about the risk of cyberattacks, it’s imperative that the transportation and defense industries heed these warnings,” said Josh Lospinoso, CEO and co-founder, Shift5. “The only way for aerospace and defense operators to ensure the resiliency of their business-critical assets is by gaining complete visibility into them. Access to OT data enables teams to have more productive discussions and make mission-critical decisions in real-time. We’re thrilled to work with AEI to bring modern cybersecurity capabilities and situational awareness to planes, trains, and tanks.”

“There’s a direct correlation between the OT data Shift5 can access and value delivered to an organization. The depth of access, accuracy of information, and usability of insights enable customers to gain federal compliance with strict industry regulations, make smarter business decisions, and enable greater safety aboard fleet assets,” said Joe Lea, President, Shift5. “Working with AEI will amplify our ability to help aerospace and defense organizations capitalize on the data existing above the wheels of their planes and weapon systems.”

To learn more about how the Shift5 is unlocking operational technology (OT) to help the world’s transportation and weapon systems defend against cyberattacks and improve operations, please visit https://shift5.io.

**About Shift5**  
Shift5 is the OT cybersecurity company that protects the world’s transportation infrastructure and weapons systems from cyberattacks. Created by founding members of the U.S. Army Cyber Command who pioneered modern weapons system cyber assessments, Shift5 defends military platforms and commercial transportation systems against malicious actors and operational failures. Customers rely on Shift5 to detect threats and maintain the resilience of a wide variety of operational technology systems, including aviation, rail and metro, defense, helicopters, and other heavy fleet machinery. For more information, visit https://shift5.io.

**About AE Industrial Partners  
**AE Industrial Partners is a private equity firm specializing in aerospace, defense & government services, space, power & utility services, and specialty industrial markets. AE Industrial Partners invests in market-leading companies that can benefit from its deep industry knowledge, operating experience, and relationships throughout its target markets. AE Industrial Partners is a signatory to the United Nations Principles for Responsible Investment and the ILPA Diversity in Action initiative. For more information, visit https://www.aeroequity.com.

AEI HorizonX Ventures Joins Shift5 Series B Funding Round

Professional Finance Company (PFC) was hit in February 2022 by a ransomware attack.

Debt-collection company Professional Finance Company (PFC) this month disclosed that data on healthcare patients from hundreds of its medical organization clients had been breached in a ransomware attack on the firm in February. PFC provides collection services for some 650 hospitals and healthcare facilities in the US.

"PFC found no evidence that personal information has been specifically misused," the company said its data breach disclosure notice, but added that "it is possible" some patient data was "accessed by an unauthorized third party."

Among that data: patient names, addresses, account balances, and in some instances, birth dates, Social Security numbers, health insurance information, and treatment data, PFC said. According to a report on Tech Crunch, PFC told the US Department of Health and Human Services that the attack affected 1.91 million patients.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Data of Nearly 2M Patients Exposed in Ransomware Attack on Healthcare Debt Collection Firm

Bitcoin is down more than 70% from its highs late last year, causing disruptions for cybercriminals and the underground exchanges that fuel the dark markets.

As the value of Bitcoin plunged in the last eight months, some security firms have observed an impact on ransomware activity.

Since the beginning of the year, for example, ransomware attacks have dropped by about a quarter, according to cybersecurity firm Arctic Wolf. In another measure of the disruption, most of the fly-by-night cryptocurrency exchanges serving to launder ransoms have stopped advertising their services, suggesting that as cash-outs surged — essentially, creating a bank run — they could not satisfy demand, according to a new blog post from cyber-threat intelligence firm Cybersixgill.

And according to new data released this week from the Identity Theft Resource Center, ransomware attacks leading to data breaches fell 20% in the second quarter of 2022 compared with the first quarter of this year, and have declined quarter over quarter.

Most major ransomware groups cash out cryptocurrency quickly, but smaller players are more likely to hold onto their assets, leading to a panicked response, says Dov Lerner, security research lead at Cybersixgill.

"I don't know how much reserves Binance or Coinbase might have, but these Dark Web exchanges, they certainly don't have millions of dollars in reserves," he says. "If everyone is dumping cryptocurrency for dollars, they can't keep up."

The volatility in cryptocurrency markets has led to massive disruption among the nascent companies attempting to find their place in what had been a burgeoning marketplace. This week, cryptocurrency lending firm Celsius Network filed for Chapter 11 bankruptcy after locking out customers from making withdrawals last month. Two other firms — crypto hedge fund Three Arrows Capital and Voyager Digital — have both declared bankruptcy in the past two weeks. The whereabouts of the two founders of Three Arrows Capital are currently unknown.

Behind the financial culling is a 71% drop in the value of Bitcoin — and similar drops in other cryptocurrencies — since November 2021.

    

Bitcoin has dropped 71% since its peak in November 2021. Chart: Robert Lemos, Source: Yahoo Finance historical prices

**Dark Web Shaken by Crypto's Decline**

The underground market has fared no better. In an analysis of 34 Dark Web cryptocurrency exchanges, which typically charge high fees of 2% to 15% of transactions for anonymity, Cybersixgill found that every one of them no longer advertises any capability to exchange cryptocoins for cash.

Yet cybercriminals are typically agnostic to fluctuations in cryptocurrency. They typically sell services and tools in US dollars, and they research business victims' revenues before making a ransom demand in dollars or euros.

"If the value of Bitcoin declines, ransomware attackers will simply ask for more Bitcoin," says Jackie Koven, head of threat intelligence at cryptocurrency-monitoring firm Chainalysis. "They generally cash out ransom payments quickly and do not hold them in crypto as investments."

The shake-up in Dark Web cryptocurrency exchanges could account for the drop in ransomware since the beginning of the year. However, cybercriminals may also be shifting tactics.

Business email compromise (BEC), for instance, has always outpaced ransomware in terms of profitability for the cybercriminals and damages to companies. In 2017, for example, ransomware accounted for only 0.2% of losses tracked by the Internet Crime Complaint Center (IC3), while BEC accounted for 27% of losses. In 2021, BEC accounted for 35% of dollar losses, while ransomware had climbed slightly to 0.7%, according to IC3 data.

As governments focus more on dissuading the criminal use of cryptocurrencies, schemes that do not rely on cryptocurrency — BEC steals actual funds from businesses — will take off, says Crane Hassold, director of threat intelligence for cybersecurity firm Abnormal Security. The company has observed a growing number of BEC-related emails over the past five years — a trend he expects to continue.

"Inserting more friction into cryptocurrency transactions and making them more difficult to use for illicit purposes ... are things that cybercriminals can't compensate for and would likely drive down the overall ROI for cryptocurrency-driving cybercrimes, like ransomware," he says, adding: "We've ... observed a growing number of more sophisticated actors from countries like Russia and Israel enter the BEC space in recent years, which indicates that an expanding population of actors are realizing how lucrative BEC attacks can be."

Other explanations for a drop in ransomware attacks include the disruption of the Conti — associated with an 18% drop in ransomware activity — and Russia's invasion of Ukraine, since both countries are home to some of the primary actors in the ransomware scene.

**"Ebb and Flow"**

However, other data suggests that ransomware groups are recovering quickly. Threat intelligence firm Digital Shadows found that the 88 data-leakage websites that it tracks had listed 705 victims in the second quarter of 2022, up 21% from the previous quarter.

The recovery suggests that ransomware groups are fairly immune to the price fluctuations in their primary way of monetizing infections. The groups have few other options for getting paid, and until cryptocurrency poses more risk, they will continue, says Mark Manglicmot, senior vice president of security services at Arctic Wolf.

"There is no good alternative to cryptocurrency at this point, so I don't see cybercriminals asking for anything else," he says. "I don't think that cryptocurrency will totally collapse and go away, so what we see happening — the ebb and flow — will continue."

However, the volatility may convince cybercriminals to make the handling of cryptocurrency more flexible in their tools kits. The cryptocurrency used in different campaigns could just be a swappable piece that cybercriminals will change regularly, like servers, IP addresses, and malware signatures, says Manglicmot.

"Changing the way they operate, changing the infrastructure, while maintaining the fundamental infrastructure behind the operations is something that they already do, so I could see them seeing them using one cryptocurrency for some time and then switching to another," he says. "It would be almost like diversifying their portfolio."

Is Cryptocurrency's Crash Causing Headaches for Ransomware Gangs?

A poor, permanent hire can be a very expensive error, whereas a mis-hire on a virtual CISO can be rapidly corrected.

The cybersecurity challenges that companies are facing today are vast, multidimensional, and rapidly changing. Exacerbating the issue is the relentless evolution of threat actors and their ability to outmaneuver security controls effortlessly.

As technology races forward, companies without a full-time CISO are struggling to keep pace. For many, finding, attracting, retaining, and affording the level of skills and experience needed is out of reach or simply unrealistic. Enter the virtual CISO (vCISO). These on-demand experts provide security insights to companies on an ongoing basis and help ensure that security teams have the resources they need to be successful.

**How a vCISO Works**  
Typically, an engagement with a vCISO is long lasting, but in a fractional delivery model. This is very different from a project-oriented approach that requires a massive investment and results in a stack of deliverables for the internal team to implement and maintain. A vCISO not only helps to form the approach, define the action plan, and set the road map but, importantly, stays engaged throughout the implementation and well into the ongoing management phases.

The best vCISO engagements are long-term contracts, such as 12 to 24 months. Typically, there's an upfront effort where the vCISO is more engaged in the first few months to establish an understanding, develop a road map, and create a rhythm with the team. Then, their support drops into a regular pace which can range from two to three days per week or five to ten days per month.

**What to Expect From a vCISO**  
When bringing a vCISO on board, it's important that person has three key attributes: broad and extensive experience in addressing cybersecurity challenges across many industries; business acumen and the ability to rapidly absorb complex business models and strategies; and knowledge of technology solutions and dynamics that can be explored to meet specific organizational needs.

The first thing a vCISO will focus on is prioritization, beginning with understanding a company's risks. They will then organize actions that provide the greatest positive influence on mitigating these risks while ensuring sustainability in the program. The goal is to establish a security approach that addresses the greatest risks to the business in a way that has staying power and can provide inherent value to additional downstream controls.

Having extensive experience in the technical space, a vCISO can take into consideration the full spectrum of options — those existing within the business environment, established products and services in the marketplace, and new solutions entering the market. Just within that context, a vCISO can collaborate with the technical team to take advantage of existing solutions and identify enhancements that can further capabilities in a cost-efficient manner.

**The Value of a vCISO**  
One of the most common findings is that companies often have a large portfolio of cybersecurity technology, but very little is fully deployed. Additionally, most tech teams are not leveraging all of the capabilities, much less integrating with other systems to get greater value. Virtual CISOs help companies save money by exploiting existing technical investments that dramatically improve security. And, since the improvement is focused on existing tools, the transition for the IT and security staff is virtually eliminated due to established familiarity with the environment.

Another essential value point of a vCISO is access to an informed and well-balanced view on risk and compliance. While cybersecurity is dominated by technical moving parts, the reality is the board, executive leadership, and management team needs to incorporate cyber-risks and related liabilities into the overall scope of risk across the business at an executive level. In this sense, leadership has a vast array of competing challenges, demands, and risks and some can be even more impactful than cybersecurity.

**How to Convince the Executive Team**  
A CEO is under a constant barrage of challenges, problems, risks, and opportunities. Cybersecurity needs to be part of that formula. If one of the core values of having a vCISO is getting meaningful cyber-risk insights, then trust and confidence in that person is paramount and needs to be established from the beginning.

Another challenge is the team dynamic — at the heart of being a CEO is their success as a leader. Introducing what is essentially a consultant can be an adjustment for the team. It's important that the vCISO hire fits the culture and can easily integrate with everyone on the team including the CIO, CTO, CPO, CRO, etc.

The conversation with the CFO will understandably have a heavy financial tone. For companies debating between a full-time CISO or a vCISO, it's clear a poor permanent hire can be a very expensive error, whereas a mis-hire on a vCISO can be rapidly corrected.

As organizations continue to come to grips with the byproducts of digitization and new security challenges that often seem insurmountable, a vCISO can be an enormous value. Beyond offering an efficient and cost-effective model, they bring many advantages to businesses with fewer risks than a dedicated resource.

Virtual CISOs Are the Best Defense Against Accelerating Cyber-Risks

To be truly effective, threat detection and response need to combine the strengths of people and technology.

There is a debate in the world of cybersecurity about whether to use human or machine expertise. However, this is a false dichotomy: Truly effective threat detection and response need both kinds of expertise working in tandem.

It will be years before machines completely replace the humans who perform typical detection and response tasks. What we predict for the meantime is a symbiotic relationship between humans and machines. The combination means that detection of and response to threats can be faster and more intelligent. It leaves humans to focus on what humans do best, while artificial intelligence (AI) shines at tasks better suited for machine processing.

Threat detection is very much an adversarial problem. Attacks rely on stealth, which often makes detection difficult, especially among billions of data points. Technologies we've relied on for the past 20 years are not sufficient to combat threats or sift through the "noise" to find the "signal." Yet skilled humans can find threats that rule-based systems cannot identify.

Any system that uses AI for the next generation of threat detection will need to harness the power of both human and machine expertise and be able to learn and adapt based on human feedback.

**Perfection Is Not the Goal, Human Performance Is**

There's a misconception that AI can't really make decisions, and we need vastly experienced human experts with irreproducible human intuition.

Looking at this through the lens of the classic Turing test, we asked: Can a machine outperform a security analyst in 80% of the work currently done by humans? If the answer is yes, imagine the productivity gains and efficiency for security operations.

We see reason for optimism here. Forty years ago, a chess engine beating a human was unthinkable, but the problem was settled in half that time. Just 10 years ago, automated audio transcription was poor, and humans were better at the task. Now machines can transcribe at least as well as humans.

**Teaming Up for the Best Outcome**

Most companies can't hire enough staff to deal with all of the security alerts. The ideal solution to this talent crunch employs intelligent automation to assist security analysts, incident responders, and threat hunters. There are three main ways to successfully apply security automation:

**1\. Alert triage.** Turning millions of alerts and thousands of events into a handful of actionable cases with context about what happened and why helps prioritize tasks for human workers.

**2\. Incident response.** Automating repetitive tasks reduces the mean time to detect (MTTD) and mean time to respond (MTTR). This frees up human analysts to respond to more important threats and make more effective, immediate decisions.

**3\. Threat detection.** Threat detection is an offensive game, focused on identifying and correlating new threats across the network, different endpoints, and applications while prioritizing actions over alerts. Of the three, this is also the main area for improvement: How can we apply automation _more_ effectively to threat detection?

**Automating Threat Detection**

There are two kinds of automation. The first is replicating simple human actions to build into an AI-driven process. Threat detection, however, is essentially a decision-making process.

The second kind of automation requires us to determine which incidents genuinely require escalation by human security analysts. The current quality of automation technology is clear — in some security operations, machines exceed human accuracy. The goal is to build a decision engine that makes decisions as well as human beings, if not better.

But how can we trust that machine decision-making equals or supersedes human decision-making? Simple. Look at the data!

Automation may mark an alert as an incident that a human security analyst later closes without escalation. Ask them why, and the analyst will walk you through their thought process. Those "whys" are the basis of what we call a factor. Factors that are not immediately obvious may play an important part in the final decision.

The more factors we gather, the sharper the accuracy of both human and machine expertise. Meanwhile, we can also reduce false positives. Every difference between human and machine may uncover additional factors, or human analysts may combine factors in different ways than the automated system.

**Improving the Decision Engine**

A rules engine is limited to modeling just the "bad" qualities or behavior we observe in a pool of data. As a result, it can only identify and respond to incidents that fall within those criteria. In contrast, a decision engine teaches the machine both "bad" and "good" and enables the model to progressively learn.

Mimicking a human's approach to learning and replicating it delivers the same decision, only automated. Hundreds of decisions can be made in just one minute, and resolution time plummets. Instead of running through 20 routine alerts, human analysts could focus their time and energy on one or two actionable cases.

Triage presents thousands of alerts a day. But in threat hunting, the problem is three or four orders of magnitude larger. Hundreds of millions of events mean we're looking for the proverbial needle in a haystack. So how do we apply the same factor analysis approach to threat hunting as we do to alert triage?

Factors can be mapped to each of these hundreds of millions of events with feature engineering. If we extract a given factor, we can apply transformations and reduce the number of different values the factor has (its dimensionality), which is especially useful when dealing with 100 different values or more.

This allows us to map each factor to a score and combine them for a final score, which the AI can use to make decisions. But because there will always be differences in decisions made by human analysts and decision engines, the AI must be able to accept human feedback.

This is supervised algorithmic machine learning in action. Humans provide feedback via labeling, and this input "educates" the system to build a model. It's even possible to build an unsupervised system for tasks that fit it. To work effectively, AI needs to be explainable, customizable, and adaptable.

When we build a decision engine with human expertise and incorporate automation wherever possible, this is what the next generation of SOC technology will look like.

The Next Generation of Threat Detection Will Require Both Human and Machine Expertise

Phishing retained its place as the top root cause of data compromises, according to new data from the Identity Theft Resource Center (ITRC).

Ransomware attacks leading to data breaches fell 20% in the second quarter of 2022 compared with the first quarter and dropped quarter over quarter, according to new data from the Identity Theft Resource Center.

"Security researchers believe that the decline in ransomware attacks is due to a combination of factors, including the ongoing conflict in Ukraine and the collapse of cryptocurrencies favored by cybercriminals," the ITRC report notes. "All of these trends – fewer compromises, fewer victims, few ransomware attacks – can be reversed quickly with just a handful of large breaches or a series of smaller ones."  

The ITRC report also says that phishing remained the No. 1 root cause of data compromises in the first half of 2022. Data compromises rose slightly in the second quarter of the year, although the pace of data compromises for the first half of 2022 is down 4% compared with the same period in 2021.

But the ITRC study also shows that the data indicating a downward trend in breaches and ransomware numbers could be an illusion, masked by the nearly 40% of data breach notices that don't include basic information, such as attack vector or a victim count. This is the first time that "unknown" topped the list of data breach causes since the ITRC began tracking data breaches.

So far in 2022, there have been 817 publicly reported data breaches with 53,350,425 victims, down from the record-high 851 recorded by the ITRC in 2021. This includes 802 data breaches with 46,209,107 victims, 10 data exposures affecting 7,136,948 victims, and 5 unknown events numbering 4,370 victims, according to ITRC data.  

In the first half of 2022, 367 entities were affected by 44 third-party/supply chain attacks, including 10 attacks reported in the two previous years. Among those singled out by the report were the Illuminate Education, Ciox Health, and Eye Care Leaders supply chain attacks.

System errors and human errors also contributed to data exposures and included failures to configure cloud security, misconfigured firewalls, and email correspondence containing sensitive information. Physical attacks, which include device theft and improper disposal, resulted in 13 breaches in the second quarter of 2022, for a total of 115,395 victims.

**Ransomware, Phishing Threat to Businesses Still Acute**

As malicious actors move their focus away from individuals, organizations are bearing the brunt of attacks, with global ransomware incidents targeting everything from enterprise servers to grounding an airline.

Data pulled from incident response cases by Unit 42 earlier in the year showed cyber-extortion attacks jumped by 85% as ransomware attackers demanded dramatically higher ransom fees in 2021.

A February report by the ITRC showed phishing is also one of the primary data-breach causes at many organizations in 2021. According to the ITRC, 537 out of 1,613 publicly disclosed breaches in 2021 — or one-third — involved phishing, smishing, or business email compromise.

Malicious actors are moving their focus to small businesses, which are likely to have fewer security resources to combat such attacks — a QuickBooks vishing scam targeting SMBs was just the latest in a string of incidents.

Data Breaches Linked to Ransomware Declined in Q2 2022

"Retbleed" bypasses a commonly used mechanism for protecting against a certain kind of side-channel attack.

Researchers at ETH Zurich have found a way to overcome a commonly used defense mechanism against so-called speculative execution attacks targeting modern microprocessors.

In a technical paper published this week, the researchers described how attackers could use their technique — dubbed "Retbleed" — to steal sensitive data from the memory of systems with Intel and AMD microprocessors that are vulnerable to the issue. The researchers built their proof-of concept code for Linux but said some Windows and Apple computers with the affected microprocessors likely have the issue as well.

Their discovery prompted Intel and AMD to issue advisories this week describing mitigations against the new attack method. In an emailed statement, Intel said it had worked with industry partners, the Linux community, and Virtual Machine Manager (VMM) vendors to make mitigations available to customers. "Windows systems are not affected as they already have these mitigations by default," Intel noted.

AMD said the issue the researchers had identified potentially allows arbitrary speculative code execution under certain microarchitecture conditions. "As part of its ongoing work to identify and respond to new potential security vulnerabilities, AMD is recommending software suppliers consider taking additional steps to help guard against Spectre-like attacks," AMD said in an emailed statement. "That guidance is found in a new AMD whitepaper now available."

Both chipmakers said they were not aware of any active exploits in the wild related to the issue that the researchers at ETH Zurich discovered and reported.

**A Dangerous Attack Vector**

Security researchers consider speculative execution attacks as dangerous because they give attackers a way to access and steal sensitive data — including passwords and encryption keys — in a computer's memory. It's an issue that is especially of concern in shared environments such as public cloud services and shared enterprise infrastructure.

Speculative execution is a performance-enhancing mechanism in modern microprocessors where instructions in code are executed in advance of when they are needed, without waiting for previous instructions to be completed. The technique can help speed up microprocessor performance. If the microprocessor guesses wrong and executes an instruction that is not needed, it discards that instruction. But in doing so, it sometimes leaves artifacts from system memory in the processor's buffers or cache.

Threat actors have taken advantage of this fact to devise so-called side channel attacks where they get the microprocessor to speculatively execute code in such a way as to get it to access — and reveal — sensitive information in the system memory. The issue became a major concern in 2018 with the disclosure of the Spectre and Meltdown vulnerabilities in most microprocessors used in everything from servers to PCs, laptops, and mobile devices.

Since then, chipmakers like Intel and AMD have introduced changes and mitigations to make it harder for adversaries to carry out speculative execution side-channel attacks.

One widely used mitigation against speculative execution attacks is called "Retpoline," a Google-developed approach for controlling how a microprocessor performs speculation when handling certain instructions — so-called indirect "jumps" and "calls".

**'Crazy Trick'**

Retpolines work by replacing indirect jumps and calls with the "return" function, says Johannes Wikner, one of the researchers at ETH Zurich who developed the new exploit. "Retpoline replaces indirect jumps with returns using a crazy trick," Wikner says. "It tricks the processor to believe there has been a 'call' made from the location where the indirect jump was intended to lead."

The motivation for replacing indirect jumps and calls with returns was because the return function was considered impractical to exploit, he says.

But that is not the case, Wikner says. Their research showed that it is possible to trigger microarchitectural conditions on Intel and AMD CPUs that force the return function to be speculatively executed just like was possible with indirect jumps and calls. "Retpoline does not \[consider\] the fact the returns can be exploited, into account," he says. "This allows us to bypass the Retpoline defense."

Wikner says it took the researchers some work to exploit the issue on Intel microprocessors and required their finding a sequence of deep function call stacks to trigger it. "We found on AMD that all returns can be exploited regardless of the function call stack," he says. "We built a framework to make it easy also on Intel."

Bogdan Botezatu, director of threat research at Bitdefender, which last year developed a side-channel attack of its own against Intel CPUs, says Retbleed appears to be a side-channel attack as well one that bypasses a mitigation set in place for Spectre. "This is yet another way in which modern CPUs can be exploited to inadvertently leak information that should be considered secret — and for which hardware defenses are burnt into the silicon," he says.

He says two things are worth mentioning when talking about this type of attack. Conceptually, it beats measures built into chips to prevent data from leaking from one realm to the other. "In the hands of a patient and properly positioned attacker, this vulnerability can exfiltrate important information from shared computers or virtualized servers. This is bad," he says.

**Complex to Execute**

At the same time, such attacks require significant knowledge and logistics to successfully result in exfiltration of the data sought by a potential attacker. High-profile targets should be worried about the existence of this vulnerability and should deploy Intel and AMD's recommended mitigations. "Side-channel attacks are effective, but difficult to execute and exfiltrate exactly that piece of information that attackers are after," Botezatu says.

Intel said that two security advisories it published Tuesday address the research. One of them is here and the other here. The company described the issue as impacting some of its Skylake generation processors that do not have a feature called enhanced Indirect Branch Restricted Speculation (eIBRS). "Intel worked with the Linux community and VMM vendors to provide customers with software mitigations to enable Indirect Branch Restricted Speculation (IBRS), and enhanced Indirect Branch Restricted Speculation (eIBRS) where supported."

Windows systems are not affected because they use IBRS by default, the Intel statement noted.

Researchers Devise New Speculative Execution Attacks Against Some Intel, AMD CPUs

Forcepoint's test results are second in a series of publications on this new technology.

AUSTIN, Texas, July 13, 2022 /PRNewswire/ -- CyberRatings.org, the non-profit entity dedicated to providing transparency on cybersecurity product efficacy, has completed an independent test of the Forcepoint Cloud Network Firewall (CNFW). Forcepoint received the highest possible overall rating of 'AAA' with excellent security and performance. The instance used for this test was c5.9xlarge (36 vCPU, 72 GB memory, and 10+ Gbps network Bandwidth).

Forcepoint's test report is the second in a series of CNFW publications from CyberRatings. Management & Reporting Capabilities, Routing and Policy Enforcement, SSL/TLS Functionality, Threat Prevention and Performance were all tested using Amazon Web Services (AWS) as the cloud provider. More products are being added to the test before the comparative report is published in the second half of 2022. The group test is the first-ever cloud network firewall evaluation provided to the market.

The CyberRatings exploit repository contains exploits that demonstrate a wide range of protocols and applications. Exploit sets for individual tests are selected based on CVSS score (how widely used is an application + what can an attacker do?), use case, and relevance to customers. Forcepoint's Threat Protection was rated excellent, blocking 35 out of 35 evasion techniques, 977 out of 977 exploits, with an excellent combined Rated Throughput of 943 Mbps.

While the firewall market is one of the largest and most mature security technology segments, this latest evolution virtualizes this functionality to provide scalable and elastic policy enforcement in a cloud environment.

"We were impressed with Forcepoint's security and performance," said Vikram Phatak, CEO of CyberRatings.org. "This product is a worthy contender and should be considered by enterprises," added Phatak.

A blog addressing the timeline for more CNFW to be published was issued today. To read the CyberRatings in-depth report on the various CNFW capabilities offered by Forcepoint, go to CyberRatings.org.

**Additional Resources**

*   Follow CyberRatings.org on Twitter
*   Follow CyberRatings.org on LinkedIn

**About CyberRatings.org**

CyberRatings.org is a non-profit 501(c)6 entity dedicated to quantifying cyber risk and providing transparency on cybersecurity product efficacy through testing and ratings programs. To become a member, visit www.cyberratings.org

CyberRatings.org Issues AAA Rating on Forcepoint's Cloud Network Firewall

New research report finds most financial organizations have experienced a breach due to an authentication weakness, yet only a third took action

New York, NY – July 13, 2022 – HYPR, The Passwordless Company™ and Vanson Bourne, today released a new report that reveals the financial sector is failing to combat the biggest threat in cybersecurity – compromised credentials. Findings show that 80% of financial service organizations experienced at least one cyber breach in the past 12 months related to a weakness in authentication, yet only one-third of organizations changed their authentication methods following the breach, leaving a significant number highly exposed to future attacks and breaches. The State of Authentication in the Finance Industry report also shows there is a recognized solution to combat such attacks, with a resounding 89% stating that passwordless authentication is needed to reach the highest levels of security.

The report, which shares insights from 500 IT security decision-makers in the financial sector, represents a cross-section of small and medium businesses and enterprise companies spanning the U.S, U.K, France and Germany. Findings uncover the burden that current authentication practices are leaving on financial organizations globally, specifically the high-risk cracks in security, strain on budgets and overall operational disruption. More importantly, the results identify the discrepancies around “perceived” and “actual” authentication security.

Over the last 12 months, an alarming 85% of surveyed organizations faced a cyber breach; more startlingly, nearly three quarters (72%) experienced multiple breaches in the same timeframe – driving the annual average to a staggering 3.4 breaches per year. Remarkably, 90% of these victims still believe their current authentication approach is secure, despite data proving otherwise. Of these attacks:

● 36% reported phishing as the most prevalent type of attack, followed closely by malware and credential stuffing, equally at 31%, and push notification attacks at 29%.

● The annual average direct cost of authentication-related cyber breaches was $2.19 million, not factoring in intangible and hidden costs.

● Nearly one third lost customers to their competitors and experienced a loss of employee (29%) and customer data (26%) in the aftermath of the breach.

“The finance industry is at the forefront of cybersecurity. As one of the most targeted sectors for attack, financial services companies have an impressive track record of adopting new, innovative defense technologies to deliver the protection that clients need,” said David Reilly, Security and Financial Services Strategic Advisor and former CIO and CTO for Bank of America. “While improvements in perimeter, network and behavioral analytics have advanced, authentication security has not moved at the same pace. We now have the opportunity to make a step-function change and improve authentication security by removing the risk of static passwords and credentials which can be learned and leveraged by attackers. Eliminating the static password risk is the strategic path forward.”

**Financial Organizations Have a False Sense of Security Regarding Multi-Factor Authentication**

The financial sector is the most highly targeted industry for cyberattacks, and the most forward-thinking and progressive with technology adoption. Despite that, a substantial proportion of respondents (32%) admit that their employees are using legacy authentication methods such as SMS and OTPs, and close to one-quarter (22%) use usernames and passwords only. The report findings spotlight a disconnect as 84% feel that traditional MFA provides complete security and at the same time, 99% agree that their current authentication methods are inadequate.

"The Financial Services industry, like many others, is facing a paradox. Data shows that traditional authentication methods are perceived to be effective but the data also clearly shows that these methods don’t provide enough protection, leaving organizations exposed to unacceptable risk. At the same time, the scale of attacks and malicious strike techniques are rapidly growing, widening this vulnerability gap," says Bojan Simic, co-founder, CEO and CTO of HYPR. "Ongoing guidance and mandates from government bodies such as CISA are a critical step forward in raising the red flag and calling for immediate action for stronger controls. Passwordless MFA is the gold standard and must be the foundation of all security strategies – the data speaks for itself.”

**Benefits of Passwordless Authentication Are Known with Improved User Experience and Security Leading The Way**

89% of financial organizations understand that passwordless authentication is needed both to achieve the highest level of authentication security and to ensure user satisfaction. Nine out of ten also agree that the cost benefits are a dominant factor for passwordless adoption. Factors such as password fatigue, impacts to productivity and help desk costs are major adoption drivers. Additionally, respondents named meeting cyber insurance requirements (31%), improving supply chain security (31%) and supporting Zero Trust initiatives (27%) as benefits of passwordless authentication.

For more information on HYPR visit https://www.hypr.com.

Report: Financial Institutions Overly Complacent About Current Authentication Methods

In the wrong hands, the changes could enable state-sponsored internet surveillance says Mozilla's Chief Security Officer

BRUSSELS, July 13, 2022 /PRNewswire/ -- There is a serious threat to existing internet security measures stemming from the European Commission's proposed revision to the eIDAS regulation. If implemented, experts say it could open individuals browsing online to additional security risks and set a precedent to allow state-sponsored internet surveillance. As currently drafted, article 45.2 could undermine the EU's own ambitions to be the frontrunner of a more secure, responsible and competitive internet that protects people from illegal activity.

Under the revised article 45.2 of the eIDAS regulation, browsers would be mandated to accept the EU-designed Qualified Web Authentication Certificates (QWACs) even though they have weaker security properties than those most browsers currently allow. Moreover, browsers would be prevented from applying any of the existing security due diligence checks to the entities which issue these certificates, thereby bypassing the critical first line of defense against cybercrime.

Article 45.2 is attracting growing attention from parliamentarians and cybersecurity experts alike. In her draft report, MEP Romana Jerković, the file's rapporteur, deleted it in order to have more time to figure out an approach that doesn't compromise security. Meanwhile, in a letter sent to MEPs and EU countries, academics said that mandating the use of QWACs could introduce "_significant weaknesses into the global multi-stakeholder ecosystem for securing web browsing._" They added that the move could make it "_more difficult to protect individuals from cybercriminals_."

Attempts have been made in the past to forcefully bypass browser security checks for rights-interfering ends, most notably in Kazakhstan in 2020 and Mauritius in 2021. In both cases, the governments aimed to use so called "man-in-the-middle" attacks to carry out state-sponsored surveillance of internet traffic.

Marshall Erwin, Chief Security Officer at Mozilla, said: "_While this is not the intent of the EU, the inclusion of article 45.2 in eIDAS will make it more difficult to push back on these surveillance attempts in future. The EU sets many global standards and we're concerned that if this is copied elsewhere, the regulation will give the tools to governments to carry out state-sponsored surveillance of internet traffic. Such actions present a very real and dangerous unintended consequence of the EU's digital identity plans._"

For more information see **here.**

SOURCE Mozilla

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading