As Mandiant CEO Kevin Mandia's company prepares to become part of Google, the incident response company continues to investigate many of the most critical cyber incidents.

RSA CONFERENCE 2022 – San Francisco – Back in the early 2000s when Mandiant was a small consulting firm in Northern Virginia, Kevin Mandia typically worked on just one incident response (IR) case at a time. Today, Mandia's team at the now IR giant Mandiant – which Google is in the process of acquiring – works on more than a half-dozen cases concurrently.

The volume of attacks is growing, especially so over the past year, according to Mandia. In recent IR cases Mandiant has been investigating, zero-day attacks and pilfered credentials have become the weapon of choice to infiltrate an organization, overtaking phishing.

"A lot of customers are saying, 'How long do we have to have our Shields Up?'" he said, in reference to the Cybersecurity and Infrastructure Security Agency (CISA)'s current slogan for warning organizations to operate at heightened alert amid increasing cyber threat activity. "I think you have to keep \[them\] up. That's a lesson we're learning this year," Mandia said in an interview with Dark Reading this week.

"The impact of a breach is so much graver now," he said. Not only are ransomware and extortion getting more brazen and chaos-causing with public data leaks and digital blackmail, but cybercriminals are basically catching up with nation-states when it comes to exploiting expensive zero-day vulnerabilities in software, he said.

"In the early days, zero days were the purview of governments. In 2017, you started to see criminal elements arming a zero day," he said. Today, it's close to a 60-40 split, with nation-states still leading in zero-day attacks but with criminals not far behind. "That came sooner than I thought," Mandia added. "It just tells you how much money you can make hacking."

**Silver Lining**

But if there's a bit of good news, it's that organizations calling on Mandiant for help with an incident are spotting their intrusions sooner: "We're getting hired earlier in the breach process, and there's less \[attacker\] dwell time," he said.

Specifically, Mandiant saw the amount of time attackers remained unnoticed on a victim's network dropped to 21 days in 2021, down from 24 days in 2020. That trend has been steady for the past four years in Mandiant's IR cases.

There's also a sense of urgency now among cybercriminals to ensure they snag the valuable data or demand their ransom for stolen data, Mandia said. "I was told today that the time frame dwell time used to be that they had access for about seven days, and that's coming down to four to five days now. That speed means it's getting harder to monetize" and cybercriminals have to work faster and more publicly to make their money, he explained.

And the stakes are higher than ever for CISOs trying to deter and deflect a big breach. "This is the hardest year to be a CISO," he said. "Now you're \[also\] protecting your people threatened online, your employees, your customers. It's so much, and it's an unfair fight with \[mostly\] no risk of repercussions for the bad guys."

The threat includes the recent wave of phony or impossible-to-prove public data leak claims by threat actors and other fraudsters attempting to shake down or defame a victim organization. 

"It's impossible to prove a negative," Mandia said of these phony breach declarations that emerge. And organizations are forced to investigate an intrusion that may not even have occurred. 

"It's becoming more frequent," he said of this latest form of pressure by cybercriminals. There's nothing harder to respond to; something that's public, the hacker is vocal and making claims. And a company can't dispute them \[at first\] because they have to figure out the answers first. Those are terrible situations."  

That hit close to home for Mandia because, while Dark Reading was interviewing him on Monday, Mandiant itself became the subject of a fake breach assertion by the LockBit ransomware gang, which posted on Twitter that it had hacked the IR company. The claim appears to have been retribution for a recent ransomware report by Mandiant. 

"Based on the data released, there are no indications that Mandiant data has been disclosed," Mandiant said in a tweet today about the claims. "Rather the actor appears to be trying to disprove our June 2, 2022 research on UNC2165 and LockBit. We stand behind the findings of this research."

**Googling Mandiant**

Meanwhile, Mandiant is preparing for the completion of its merger with Google. Google announced its intent to acquire Mandiant in March for a whopping $5.4 billion, and Mandia at the time touted the merger as a way to build out Mandiant's planned strategy of automating specific elements of the IR process. Google's investment should accelerate that strategy.

"You have to automate as much as you can," Mandia told Dark Reading this week. Tasks such as detection, collecting artifacts, and log file analysis could be automated, he noted. But there still are parts of IR that remain human tasks, such as attribution and deep-dive forensic analysis.  

"If there's ever a deepfake or false-flag operation, it will be a human that will \[spot it\]," Mandian said.

Mandia: Keep 'Shields Up' to Survive the Current Escalation of Cyberattacks

The innovative ransomware targets NAS devices, has a multitiered payment and extortion scheme as well as a flexible configuration, and takes a heavily automated approach.

The DeadBolt ransomware family is targeting QNAP and Asustor network-attached storage (NAS) devices by deploying a multitiered scheme aimed at both the vendors and their victims, and offering multiple cryptocurrency payment options.  

These factors make DeadBolt different from other NAS ransomware families and could be more problematic for its victims, according to an analysis from Trend Micro this week.

The ransomware uses a configuration file that will dynamically choose specific settings based on the vendor that it targets, making it scalable and easily adaptable to new campaigns and vendors, according to the researchers.

The payment schemes allow either the victim to pay for a decryption key, or for the vendor to pay for a decryption master key. This master key would theoretically work to decrypt data for all victims; however, the report notes less than 10% of DeadBolt victims actually paid the ransom.

"Even though the vendor master decryption key did not work in DeadBolt's campaigns, the concept of holding both the victim and the vendors ransom is an interesting approach," according to the report. "It's possible that this approach will be used in future attacks, especially since this tactic requires a low amount of effort on the part of a ransomware group."

Fernando Mercês, senior threat researcher at Trend Micro, points out that the actors also created a functional, nicely designed Web app to deal with ransom payments.

"They also know about the internals of QNAP and Asustor," he says. "Overall, it's an impressive job from a technical standpoint."

Mercês adds that ransomware actors in general are targeting NAS devices due to a combination of factors: low security, high availability, the high value of data, modern hardware, and common OS (Linux).

"It's like targeting Internet-facing Linux servers with all kinds of applications installed and no professional security in place," he says. “Additionally, these servers contain high-value data for the user. It sounds like the perfect target for ransomware."

For organizations to protect against attacks targeting internet-facing NAS devices, he says, they could use a VPN service, although the configuration may require a few technical skills.

"Suppose there's no other way other than exposing the NAS on the Internet," he says. "In that case, I'd recommend using strong passwords, 2FA, disabling/uninstalling all unused services and apps, and configuring a firewall in front of it to only allow the ports you want to access. This can be done in a router, for example."

Mercês notes that while it doesn't seem effective, it's interesting to see criminals trying to put some pressure on vendors to "fix the problem" for their customers.

"I think criminals thought the vendors would be worried about their image in front of their customers and maybe pay to get free decryptors for all of them," he says. "It could be interesting if customers started pushing vendors to pay on their behalf, but that didn't happen."

In May, QNAP warned its NAS devices are under active attack by DeadBolt ransomware, and in January, a report from attack surface solutions provider Censys.io noted that out of 130,000 QNAP NAS devices that were potential targets, 4,988 services showed signs of a DeadBolt infection.

Nicole Hoffman, senior cyber-threat intelligence analyst at Digital Shadows, a provider of digital risk protection solutions, points out that the DeadBolt ransomware operation is interesting for several reasons, including the fact that victims do not need to contact the threat actors at any time.

"With most ransomware groups, victims need to negotiate with the threat actors, who are often in different time zones," she says. “These interactions can add a significant amount of time to the recovery process and a level of uncertainty because the outcome could rely on the success of the interaction."

However, she notes that from a technical perspective, DeadBolt ransomware attacks are different from ransomware attacks that target many enterprise devices, as initial access is gained by exploiting vulnerabilities in unpatched Internet-facing NAS devices.

"There are no social engineering or lateral movement techniques required to carry out their objectives," Hoffman says. "The threat actors do not need a lot of time, tools, or money to carry out these opportunistic attacks."

Multilevel Extortion: DeadBolt Ransomware Targets Internet-Facing NAS Devices

A full 77% of tech executives say they'll increase spending in zero-trust architecture in the coming year.

Executive leaders across organizations are prioritizing zero-trust security strategies in the next year, as organizations hope to build significantly on early baby steps in these initiatives.

According to a new survey out from the Cloud Security Alliance (CSA), 80% of CxO technology leaders report that zero trust is a significant priority for their organizations, with 77% of executives saying that they'll increase spending to support this prioritization.

The added zero-trust funding will be significant at many organizations, with more than two in five executives reporting an increase of 26% or more.

"With the advancement of digital transformation, the shift of the workforce during the pandemic, and the announcement of the US executive order on cybersecurity, zero trust has taken a front seat as a promise for protecting enterprises," says the report, which details results from a survey of more than 800 IT and security professional worldwide, including responses broken out from more than 200 C-level executives.

The study shows that zero-trust strategies are still a relatively a new cybersecurity roadmap for most organizations, with 53% of organizations saying their initial implementations of zero-trust strategies were put underway fewer than two years ago. The standards they're using to guide strategic planning are all over the map, with a fairly even distribution across CISA, Forrester ZTX, IEEE, NIST, and CSA standards. The front-runner by a plurality was the CISA standard, with 33% of organizations reporting they use it to guide their zero-trust strategy.

Zero trust is an evolving model of security developed to tie together many long-running security concepts of least privilege, conditional access based on risk factors, and segmentation — not only at network levels, but also down to the application and workload level. At its heart, the core concept is eliminating the implicit trust on the network that IT has long afforded users and devices once they log in with their password.

The goal is to replace that with a more adaptive and continuously assessed mode of granting access that provides limited access and bases it not just on identity, but also on operational and threat context. Executing on this takes a lot of moving parts, including strong identity and access management (IAM), effective network policy enforcement, strong data security, and effective security analytics. Many of these are areas that organizations have already put significant cybersecurity investment into in the past — it's just a matter of integrating and creating a more effective architecture to utilize these investments.

Given that, it's not a surprise that in spite of many organizations saying it's only been a year or two since they started on their zero-trust journey, respondents to this survey reported that they were slightly to moderately mature in core zero-trust areas like endpoint/device maturity, application security, IAM, data-flow management, network-security management, and user behavior and asset management.

Fundamental policy, architectural, and integration work separates the pretenders from the contenders when it comes to executing a zero-trust strategy. According to Eric Bednash, CEO of RackTop systems and a longtime security and tech practitioner in the defense and financial worlds, organizations have to start their zero-trust journey by understanding how IT and security stacks all tie together.

"It's about starting with a strong view of your overall architecture and business processes, and understanding how it all ties together. It goes beyond any single element. It's important to remember that zero trust is not a thing, it's a prescribed way of being," he says. "It's a guideline for how everything should interoperate. It's not like, 'This is a zero-trust thing and this is not a zero-trust thing.' It's a methodology. There are no shortcuts, which is why it's so hard to implement."

Doing it right requires a lot of executive buy-in, adequate expertise and staffing, and smart change management. According to the CSA survey, 40% of organizations reported a lack of knowledge and expertise, 34% said they didn't have internal alignment or buy-in, and 23% said a resistance to change was blocking the way.

In many ways, getting through these business and process barriers will require both diplomatic and disciplined communication, experts say.

"To effectively manage the change, you need to telegraph your moves and implement small changes gradually. You may know where you want to go, you may even have contracts signed for your cyber solutions, but you can't implement everything at once. It will be too unsettling," says Amit Bareket, CEO and co-founder of Perimeter 81. "The art of change management is knowing how much to implement — so don't change too much at once, yet don't drag out the process indefinitely."

How the C-Suite Puts Shoulders Into Zero Trust in 2022

Cybersecurity needs to shift its thinking ahead of the next disruption, RSA's CEO said during the opening 2022 conference keynote.

RSA CONFERENCE 2022 – San Francisco – A catastrophic pandemic, an escalating war in Eastern Europe, and the Colonial Pipeline ransomware shutdown are all in their own ways recent seismic disruptions that forced external change on the cybersecurity sector. 

That was the word from RSA CEO Rohit Ghal, who used the opening keynote of this year's RSA Conference to encourage cybersecurity leadership to embrace intentional transformation – with the goal of coming out on the other side of these cascading disruptions stronger and better than ever.  

"Transforming security will require us to reorient our thinking," Ghal said. 

To accomplish that goal, he shared three core ideas he thinks will help set the information-security community on a path that will enable it to use recent events to crystalize and transform into something better. 

**1\. Rethinking Identity **

First, Ghal suggested that a focus on user identities is the future, and figuring out how to center access on identity without traditional access mechanisms (i.e., passwords) is the way forward.

"Identity is the one constant in cybersecurity," he said. "It's time to hold a requiem for passwords." 

Ghal called for the industry to focus on creating a single, decentralized, infrastructure-agnostic platform that puts control back in the hands of users. 

**2\. Truth Matters **

Next, Ghal said that protecting the veracity of information is going to be a key role for cybersecurity in the coming years. Fake news and misinformation have emerged as powerful weapons to bring down institutions and more.

"What matters most is the truth, the veracity of information," he said. "Hacked brains are way more dangerous than hacked systems." 

Ghal added that a disciplined application of technology is the solution to weeding out bad information, and the only real way to verify whether information is true is to authenticate its creator . 

**3\. Convenience Shouldn't Win **

When it comes to the well-worn debate over whether security is too onerous for users to adopt, Ghal called on the industry to ditch its old "dogmas."

"We need to stop sacrificing security at the altar of convenience," he said.

The answer, Ghal said, will lie with innovators, who have the "most important role." 

"Innovation grows the pie and delivers new benefits," he said. 

The sector shouldn't wait for a comparable "cybersecurity pandemic" to force change, Ghal added.   

"Transforming security will require us to reorient our thinking," he said.

RSAC Opens With Message of Transformation

Enterprise cybersecurity awareness training has evolved to include informal lessons for employees' family members, and it has many benefits.

When I’ve talked to cybersecurity awareness training vendors about changes brought on by the pandemic — and further changes brought on by its reduction and end — I've been surprised by how few changes they've discussed.

One change, though, has been talked about by many of the players in the market, and it's one that I didn't anticipate: There's been a change in who they've been asked to train.

As employees flowed out of offices and into work-from-home (WFH) situations, cybersecurity professionals quickly realized that home networks and everyone who used them were suddenly part of the corporate infrastructure. If little Johnny visits the wrong website or grandma clicks on a phishing email, the ramifications could not only harm the household but also the companies of those WFH users.

Different organizations tried different ways to keep the ongoing WFH security risk from becoming a massive security disaster, and many of those ways involved training the employees' family members to be more responsible, security-aware computer users.

For vendors providing cybersecurity awareness training, this new training tended to require teaching those who might not have had previous awareness training the basics of phishing behaviors, malicious links on websites, ransomware, and even mobile threats like smishing and vishing. Omdia's research on how these efforts have affected enterprise security is ongoing, but we have not seen massive increases in corporate security failures over the last two years, so they certainly couldn't have hurt.

**What Are the Benefits of Cybersecurity Awareness Training?**

Beyond the benign impact, there are important long-term benefits to cybersecurity awareness training that extend to employees' family members. The benefits fall, broadly, into short-term and long-term groups.

In the short term, it's unlikely that businesses are going to go back to the simple "everyone comes to the office everyday" model that existed three years ago. More employees will be doing more work at home, at least some of the time, so the home network must now be considered part of the enterprise infrastructure from a cybersecurity standpoint.

While some organizations are installing company-controlled home routers and firewalls on employee networks, those devices aren't magic bullets; there are plenty of cybersecurity threats they won't stop. The users who share physical (and network) space with the employee can have an impact on enterprise security, so those users should receive at least some cybersecurity awareness training.

Once trained, family members will not only be less likely to fall victim to cyberattacks, but they can also become valuable early warning sensors for malicious campaigns. In addition, family members might well become important behavior-reinforcing agents for good cybersecurity hygiene for the employee. Every parent knows that there's often nothing that a little child treasures more than the opportunity to point out poor behavior on the parent's part.

Over the long term, it is unquestionably true that no organization lives as a cybersecurity island. Each is part of a global community of email, messaging, and Internet users. Making the community safer overall makes the individual organization safer by association. As the cyber hygiene of the total community improves, the risk posture of the individual organization cannot help but improve.

In addition, the family members of today are the potential employees of tomorrow. Imagine how much more effective your cybersecurity awareness training could be if employees came to the table with a better baseline understanding of risks and responses.

It is true that there is no guideline or regulation that states a company's cybersecurity program must include teaching good cyber hygiene to employees' family members. However, in the shifting business understanding of 2022, teaching those family members about cybersecurity could be an investment that pays off for years to come.

Enterprise Security Around the Dinner Table

By using artificial intelligence to predict how an attacker would carry out their attack, we can deploy defenses and preemptively shut down vulnerable entry points.

Security teams can't protect what they don't know about. But it is not enough to just understand what they have within their organizations' environment. Defenders also need to put themselves in an adversary's shoes to understand which systems are likely to be targeted and how the attack would be carried out. Technologies such as attack surface management and attack path modeling make it possible for security teams to gain visibility into which assets adversaries can see and how they might gain access.

With attack surface management, organizations are continuously discovering, classifying, and monitoring the IT infrastructure. Unlike asset management, which looks for everything the organization has, attack surface management looks at the IT infrastructure from outside of the organization to determine what is exposed and accessible. Since new assets are always being created and cloud infrastructure can be spun up dynamically, this inventory needs to be updated continuously or the organization will have gaps in its knowledge of all the potential entry points, says Pieter Jansen, CEO of Cybersprint, which was acquired by Darktrace in February for $52.3 million (€47.5 million).

Cybersprint's attack surface management platform gives customers their own "hacker's lens" that they can use to determine where an attacker could strike next, Jansen says. Attack surface management goes beyond tracking Internet-accessible systems by considering how the assets are configured, what security controls are in place, and how the various tools and devices are connected.

Someone creating new infrastructure components within the DevOps environment may think they are working within the test environment, but an attacker doesn't care whether it is in testing or production. "It's an ideal way of getting in \[to the organization's environment\] early and to move to production systems," Jansen says.

Darktrace acquired Cybersprint for its external view of the organization's environment, says Jack Stockdale, CTO of Darktrace. Darktrace's artificial intelligence (AI) technology develops a comprehensive view of the organization's infrastructure, but it is an internal view, he says. Darktrace can see what the organization has within the IT environment — the network, email, cloud assets, and endpoints — as well as OT. Bringing Cybersprint's external view into Darktrace's platform makes it possible to find more threats earlier.

"It's essential to put all those different areas into one platform" instead of maintaining individual silos of information, Stockdale says. "Trying to infer what's happening and stop attacks by looking at individual silos — we truly believe that is not the way to go."

**A Shift to Proactive AI**

Up until now, Darktrace's self-learning AI technology has focused on detection and response, which means it is reactive, Stockdale notes. "Essentially, \[the AI\] sits there and waits for a problem," he says. Teaching the AI about the attacker shifts the balance, since the AI now doesn't have to wait for an attack to do something about the organization's security.

This is where attack path modeling comes in.

Security teams are beginning to think about attack path analysis. For the past few years, Verizon's "Data Breach Investigations Report" (DBIR) has devoted a section to analyzing attack paths. Understanding the paths adversaries are likely to take helps security teams identify places they can add more controls or tools to stop the attack.

"Our job as defenders is to lengthen that attack path. Attackers tend to avoid longer attack chains because every additional step is a chance for the defender to prevent, detect, respond to, and recover from the breach," Verizon's researchers wrote.

Attack path modeling uses the existing view of the environment to determine the most likely and most effective paths attackers would take through the organization, Stockdale says. After identifying the key assets and people, as well as the organization's crown jewels, it is possible to use both the internal and external views to identify the likely path the attacker would follow to reach the crown jewels. After analyzing the path, it is possible to run a simulation to see what would happen in the case of an incident.

"What happens if ransomware was detected on a particular laptop or a particular type of compromise started in a particular environment? How will the attacker most likely move through \[the\] organization to cause the damage or to reach the crown jewels or to sell information?" he asks.

Attack path modeling is more than a red team exercise of a penetration test, Jansen notes, because it allows security teams to identify the most likely steps an attacker would take in order to compromise the organization. AI shines here because it is capable of going down every path and seeing every permutation of possible attacker scenarios. Human teams, in contrast, would be able to run only a limited number of exercises.

Once they can see all the potential entry points, security teams can start testing defenses along those particular paths and determine whether additional resources are necessary. Perhaps they discover four or five most likely routes an attacker could take from a compromised email account or system login. At this point, the team can deploy additional controls or defenses to make those paths unfeasible for the attacker.

**Adding 'Prevent' to the Cybersecurity Loop**

Darktrace's Cyber AI Research Centre has been working on ways to apply AI to attack path modeling for almost two years, Stockdale says. The research is now being incorporated into Darktrace's new product family, Darktrace Prevent, which will be generally available by the summer.

"We're now taking \[attack path modeling\] out of the research center and building it into our next set of products that will go to our customers," he says. Several customers in the early adopter program already have the new technology in their production environments.

Darktrace views security as a continuous loop where the AI learns about the organization, identifies potential attack paths, and feeds those outcomes to detect and respond to harden the environment, Stockdale says. Eventually, the plan is for AI to learn to heal from the damage caused by attacks, as well.

"When we talk to our customers, we tend to look at the areas where human beings are doing lots of repetitive work, or challenging work, that we think AI is a perfect fit for," Stockdale says. There are areas where AI can help make these teams more efficient or allow companies that don't have the resources to hire human teams to add security capabilities.

"Our vision moving forward is to be much more proactive," Stockdale says.

Harnessing AI to Proactively Thwart Threats

Brands should be vigilant to ensure sites and listings promoting NFTs for sale are legitimate and not being used as an instrument by fraudsters to swindle customers.

Brands should be vigilant to ensure sites and listings promoting NFTs for sale are legitimate and not being used as an instrument by fraudsters to swindle customers.

Source: Cor Laffra via Alamy Stock Photo

Life seems to move exponentially faster with each passing month. And while many recent innovations serve to illustrate that point, few match the nonfungible token (NFT) for the breathtaking speed with which it went mainstream. 

The global market for NFTs has grown to over $40 billion in 2021 and attracted stars like Tom Brady and big brands like Coca-Cola and Nike. Meanwhile, many consumers are still trying to figure out what NFTs are and why they even exist.

Cybersecurity always lags behind the digital innovations it's designed to protect – and therein lies the problem. The faster technology innovation becomes, the bigger the window of opportunity for cybercriminals to swoop in and exploit the vulnerabilities. Brands are destroyed, CEOs fired, customer identities swiped and sold on the Dark Web, bank accounts raided, and credit destroyed. With NFTs, we're in that window now and we're seeing seven primary ways that cybercriminals are exploiting the situation.

1.  **Celebrity/brand impersonation:** A scammer sets up a social media group or website using the name of a brand or celebrity. They then sell fake or nonexistent NFTs to people or use a fake NFT as a lure to swipe someone’s credentials.
2.  **Counterfeit NFTs:** Just like counterfeit currencies, a brand's NFTs can be reproduced without its knowledge or consent and then traded online. In some cases, artists and brands have discovered thousands of fake reproductions of their property in online marketplaces. Some marketplaces have developed tools to spot fakes, but it’s still a tangled mess of copyright issues given all the visuals, music, and logos involved.
3.  **Unprotected marketplaces**: Putting aside the irony of relying on centralized players like marketplaces to execute decentralized transactions, these third parties can also introduce significant risk. In the short span that NFTs have existed, more than 200 marketplaces have sprung up, and many lack the security needed to handle the impressive ingenuity of the attackers. In one scam, attackers targeted NFT marketplace users lacking two-factor authentication and used smart contracts to transfer ownership to their accounts.
4.  **Fake platforms:** There are so many NFT marketplaces that it’s relatively easy for cybercriminals to build new ones, hide in plain sight, and sell fake NFTs. Another tactic in this category is to create identical replicas of existing NFT marketplaces and use social media or email to lure people in.
5.  **Untraceable payments:** Because of the nature of cryptocurrencies, payments are very difficult to follow. The problem with untraceable transactions, in addition to circumventing taxes, is that they can be used for illegal activities – a vulnerability that cybercriminals exploit. By the time a company, artist, or celebrity realizes that something is amiss, the money is safely in the cybercriminal's bank account. It’s nearly impossible to trace and even harder to reverse.
6.  **Cryptocurrency scams:** Cryptocurrency, predominantly Ethereum, is the key payment method used in NFT transactions, and cryptocurrency scams are incredibly common. This is especially the case around highly anticipated NFT releases that generate a lot of buzz. In the inevitable buying frenzy, scammers create scam-minting sites that request users' private wallet keys. When customers, often the most fervently loyal and valuable, fall victim to these scams, they may sour on the brand.
7.  **Text or email scams:** A cybercriminal sends a malicious email notifying a person of "suspicious behavior" on one of their accounts. As that person logs in and enters their credentials, they are asked for their private wallet keys or 12-word security seed phrases. The scammers then use those credentials to hack into the user’s digital wallet and deplete all of the crypto and NFTs stored therein.

**How Should Companies View NFTs Today?**

NFTs represent a great opportunity for brands to build lasting loyalty with their customers. Some experts even predict they will become the central digital touchpoint between brands and their consumers. The possibilities are exciting and perhaps by then, NFTs will be mostly safe. But in this chaotic, early window where vulnerabilities are everywhere, they do pose serious risks.  

Companies, as well as executives, would be wise to allocate resources to monitoring and mitigating these types of threats. Employees that handle digital assets should also be trained on how to avoid phishing attacks that target them specifically.

Someday, it will be safer to play with NFTs, but until then, we're living in the Wild West. Brands should be vigilant to ensure sites and listings promoting NFTs for sale are legitimate and not being used as an instrument by fraudsters to swindle customers out of money.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

7 NFT Scams That Could Be Targeting Your Brand

Edge-based solution detects and blocks malicious files uploaded to Web apps and APIs.

CAMBRIDGE, Mass., June 6, 2022 /PRNewswire/ -- Akamai Technologies, Inc. (NASDAQ: AKAM), the cloud company that powers and protects life online, today unveiled Malware Protection, which shields web applications and APIs from malicious uploads. The solution expands Akamai's web application and API protection (WAAP), detecting and blocking malware at the edge, preventing it from reaching targeted systems where it can detonate and spread.

Malware Protection addresses the growing problem of malware embedded in files uploaded to web applications such as travel & hospitality, financial sites, customer portals and content management systems. The solution provides a modern approach to protection, inspecting files uploaded to applications and APIs on the Akamai Intelligent Edge network, detecting and blocking malware at the edge.

Because the malware scanning engine is hosted completely on the Akamai Intelligent Edge, there is nothing for customers to install and no changes in application code are required. This makes it easier to deploy and maintain than alternative approaches, such as Internet Content Adaptation Protocol (ICAP)-integrated solutions. Because malware is blocked at the edge, Malware Protection also provides a better security outcome, isolating threats from targeted origins.

"Business processes across a variety of industries have shifted to web applications and users are uploading far more files than before," said Patrick Sullivan, CTO, Security Strategy for Akamai. "With Malware Protection, Akamai is helping customers to easily reduce risk resulting from files uploaded via Web Apps right at the Edge.. This addresses a growing concern among Akamai customers and provides added assurance that their online assets are protected."

**About Akamai**

Akamai powers and protects life online. Leading companies worldwide choose Akamai to build, deliver, and secure their digital experiences — helping billions of people live, work, and play every day. With the world's most distributed compute platform — from cloud to edge — we make it easy for customers to develop and run applications, while we keep experiences closer to users and threats farther away. Learn more about Akamai's security, compute, and delivery solutions at akamai.com and akamai.com/blog, or follow Akamai Technologies on Twitter and LinkedIn.

Akamai Launches New Malware Protection for Uploaded Files

A coalition of over 25 industry leaders, led by NightDragon and non-profit NextGen Cyber Talent, partner to raise $1 million for collegiate cybersecurity education

SAN FRANCISCO, June 6, 2022 /PRNewswire/ -- NightDragon, an investment and advisory firm focused on the cybersecurity, safety, security, and privacy industries, and NextGen Cyber Talent, a nonprofit organization dedicated to increasing diversity and inclusion in the cybersecurity industry through education and career opportunities for underserved and underrepresented students, today announced the launch of the Coalition to Close the Cybersecurity Talent Gap ("Coalition"), a campaign to raise $1 million to help fund one year of community college courses for Bay Area students pursuing careers in cybersecurity.

The Coalition is composed of more than 25 industry-leading cybersecurity and technology leaders that are passionate about cultivating the next generation of cybersecurity talent and committed to closing the cybersecurity skills gap. Driven to make a difference in the lives of students and their local communities, at launch, the Coalition has raised more than $300,000 of the $1 million needed to fund the cybersecurity education initiative for Bay Area students.

Through leveraging its vast network, NightDragon led the formation of the coalition including NightDragon portfolio companies, go-to-market and investment partners. Founding members for the initial cohort include: AllegisCyber Capital, Carahsoft, Claroty, Coalfire, Cyderes, Deloitte, Exclusive Networks, ForgeRock, HUMAN Security, iboss, Immuta, Ingram Micro, Interos, Knight Group, Macnica, Marsh, Merlin, Mezmo, NightDragon, Onapsis, Optiv, Palo Alto Networks, Prosek, Team8, Ten Eleven Ventures, ThriveDX, SafeGuard Cyber, Snowflake, and vArmour.

"There are an estimated 2.7 million unfilled cybersecurity positions. These vacancies create a significant challenge as security teams everywhere struggle to hire talent to monitor and remediate cyberattacks, as well as develop new technology to combat today's latest threats," said Krishnan Chellakarai, Founder and Co-Chairman of NextGen Cyber Talent and CISO of Gilead Sciences. "Solving the cybersecurity talent shortage will take a collective industry-wide effort. We are calling on the industry during the RSA Conference to contribute to the campaign and look forward to the impact we can make together to close the cybersecurity talent gap."

"The cybersecurity talent shortage is an issue that impacts all of us and is one of the biggest challenges facing our industry and national security. Let's demonstrate that as an industry we can come together to help solve for the talent shortage and foster the next generation in cyber talent that will help us combat today's threats," said Dave DeWalt, Founder, and Managing Director, NightDragon, and Board Member, NextGen Cyber Talent.

"The partners who have pulled together on this important mission are an impactful group of leaders from across the industry, which speaks to the universal nature of this mission to close the cybersecurity talent gap. By reaching out to the broader industry at the RSA Conference, we hope to show the power and compassion of our industry to help the underserved and enrich the cybersecurity workforce with more diversity," said Amy De Salvatore, VP Business Development and Strategic Alliances, NightDragon, who initiated the campaign and led the formation of the Coalition.

NextGen Cyber Talent partners with Bay Area community colleges to offer several cohorts of training programs, continuous career development and mentoring, and grants to hundreds of students pursuing cybersecurity education. The funds will be distributed by NextGen Cyber Talent to students at participating Bay Area community colleges who have applied and met the qualifying grade criteria of a B- or better. In addition to capital, founding coalition partners have also contributed additional in-kind donations, including lectures, curriculum materials, and internships for students.

"As we continue to focus on the essential mission of making each day safer than the one before, we have a responsibility as an industry to encourage and educate the next generation of cyber leaders," said BJ Jenkins, President at Palo Alto Networks and NightDragon Board member. "We thank NightDragon and NextGen Cyber Talent for bringing us together on this shared vision. We look forward to helping students recognize all of the cybersecurity career possibilities."

Donations of any size can be made through the Coalition to Close the Cybersecurity Talent Gap campaign donations page.

**About NextGen Cyber Talent**

NextGen Cyber Talent is a non-profit providing a platform to increase diversity and inclusion in the cybersecurity industry. It brings together cybersecurity experts, solution providers and enterprises to make a difference in the underserved and underprivileged community and address a mounting cyber skills shortage and talent gap. To learn more, visit www.NextGencybertalent.com.

**About NightDragon**

NightDragon is an investment and advisory firm focused on growth and late-stage investments within the cybersecurity, safety, security and privacy industries. Its platform and vast industry network provide unparalleled threat insights, deal flow, market leverage and operating expertise to drive portfolio company growth and increase shareholder value. Founded by Dave DeWalt, the NightDragon team has more than 25 years of operational and market expertise leading technology companies such as Documentum, EMC, Siebel Systems (Oracle), McAfee, Mandiant, Avast and FireEye. Read more about NightDragon at www.nightdragon.com.

Cybersecurity Industry Leaders Launch Campaign to Close the Cybersecurity Talent Gap

Nation’s cyber defense agency urges America to enable multifactor authentication.

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) is announcing a collaborative effort with industry to dramatically increase adoption of multi-factor authentication (MFA) and ensure widespread understanding of why it is one of the strongest tools to prevent cyber intrusions. Launching at the 2022 RSA Conference, CISA is embarking on a campaign to encourage widespread awareness and understanding of the benefits of MFA, to ensure that every American knows the simple steps they can take to keep themselves safe online, and to urge technology companies to make MFA available as a default option. CISA’s _More Than a Password_ campaign includes a newly launched webpage with resources, how-to guides, and social media content throughout the month of June.

Adversaries are increasingly harvesting credentials through phishing emails or by identifying passwords reused from other systems. MFA increases security because even if one credential is compromised, unauthorized users will be challenged to meet the second authentication requirement, largely thwarting their ability to access the targeted device, network, or database.

“Whether you call it multi-factor or two-factor authentication, this simple step can make you 99% less likely to get hacked. Think of it like an airbag or the seatbelt in your car—an extra layer to keep you safe in the event of an accident,” said CISA Director Jen Easterly. “We need to get the word out that to stay safe online, every American needs to have _More Than a Password_ on all their sensitive accounts. And if you have an account that doesn’t offer an option for MFA, urge your provider to begin offering this essential security feature.”

There are many ways you may be asked to provide a second form of authentication:

*   **Text Message or Email**: When you login to an account, you’ll be asked to provide a code sent to you by text message or email.
*   **Authenticator App**: An authenticator app is an app that generates MFA login codes on your phone.
*   **Push Notification:** Instead of using a numeric code, the service “pushes” a request to your phone to ask if it should let you in.
*   **FIDO Key:** FIDO stands for "Fast Identity Online" and is considered the gold standard of multi-factor authentication.

Two steps are harder for a hacker to compromise. Users should implement MFA on all their sensitive accounts—email, bank accounts, social media, online stores, gaming and streaming entertainment services. In addition to protecting consumers, MFA makes it more difficult for a threat actor to gain access to an organization’s information systems. It can better protect remote access technology, email, and billing systems, even if passwords are compromised through phishing attacks or other means. On its new webpage, CISA also provides a guide for organizations that need help getting started with deploying MFA to employees and customers.

Finally, CISA is asking our industry partners to help spread the word by ensuring that MFA is available for all services and enabled by default where possible. We’re also asking partners to share the value of MFA to customers and employees, and champion MFA on communication and social media channels. Whether you sing it, shout it, or post it this June, CISA is asking everyone to take the extra step and implement #_MoreThanAPassword_!

For more information, visit: http://www.cisa.gov/MoreThanAPassword

**About CISA**

As the nation’s cyber defense agency, the Cybersecurity and Infrastructure Security Agency (CISA) leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day. Visit CISA.gov for more information.

Visit CISA on Twitter, Facebook, LinkedIn, Instagram

Source

DARKReading