Multimodal AI systems can help enterprise defenders weed out fraudulent emails, even if the system has not seen that type of message before.

Source: Peshkova via Shutterstock

Artificial intelligence (AI) models that work across different types of media and domains — so-called "multimodal AI" — can be used by attackers to create convincing scams. At the same time, defenders are finding multimodal AI equally useful at spotting fraudulent emails and not-safe-for-work (NSFW) materials.

A large language model (LLM) can accurately classify previously unseen samples of emails impersonating different brands with better than 97% accuracy, as measured by a metric known as the F1 score, according to researchers at cybersecurity firm Sophos, who presented their findings at the Virus Bulletin Conference on Oct. 4. While existing email-security and content-filtering systems can spot messages using brands that have been encountered before, multimodal AI systems can identify the latest attacks, even if the system is not trained on samples of similar emails.

While the approach will likely not be a feature in email-security products, it could be used as a late-stage filter by security analysts, says Ben Gelman, a senior data scientist at Sophos, which has joined other cybersecurity firms, such as Google, Microsoft, and Simbian, in exploring new ways of using LLMs and other generative AI models to augment and assist security analysts and to help speed up incident response.

"AI and cybersecurity are merging, and this whole AI-generated attack/AI generated defense \[approach\] is going to become natural in the cybersecurity space," he says. "It's a force multiplier for our analysts. We have a number of projects where we support our SOC analysts with AI-based tools, and it's all about making them more efficient and giving them all this knowledge and confidence at their fingertips."

**Understanding Attackers' Tactics**

Attackers have also started using LLMs to improve their email lures and attack code. Microsoft, Google, and OpenAI have all warned that nation-state groups appear to be using these public LLMs for various tasks, such as creating spear-phishing lures and code snippets used to scrape websites.

As part of their research, the Sophos team created a platform for automating the launch of an e-commerce scam campaign, or "scampaigns," to understand what sort of attacks could be possible with multimodal generative AI. The platform consisted of five different AI agents: a data agent for generating information about the products and services, an image agent for creating images, an audio agent for any sound needs, a UI agent for creating the custom code, and an advertising agent to create marketing materials. The customization potential for automated ChatGPT spear-phishing and scam campaigns could result in large-scale microtargeting campaigns, the Sophos researchers stated in its Oct. 2 analysis.

"\[W\]e can see that these techniques are particularly chilling because users may interpret the most effective microtargeting as serendipitous coincidences," the researchers stated. "Spear phishing previously required dedicated manual effort, but with this new automation, it is possible to achieve personalization at a scale that hasn't been seen before."

That said, Sophos has not yet encountered this level of AI usage in the wild.

Defenders should expect AI-assisted cyberattackers to have better quality social-engineering techniques and faster cycles of innovation, says Anand Raghavan, vice president of AI engineering at Cisco Security.

"It is not just the quality of the emails, but the ability to automate this has gone up an order of magnitude since the arrival of GPT and other AI tools," he says. "The attackers have gotten not just incrementally better, but exponentially better."

**Beyond Keyword Matching**

Using LLMs to process emails and turn them into text descriptions leads to better accuracy and can help analysts process emails that might have otherwise escaped notice, stated Younghoo Lee, a principal data scientist with Sophos's AI group, in research presented at the Virus Bulletin conference.

"\[O\]ur multimodal AI approach, which leverages both text and image inputs, offers a more robust solution for detecting phishing attempts, particularly when facing unseen threats," he stated in the paper accompanying his presentation. "The use of both text and image features proved to be more effective" when dealing with multiple brands.

The capability to process the context of the text in the email augments the multimodal capability to "understand" words and context from images, allowing a fuller understanding of an email, says Cisco's Raghavan. LLMs' ability to focus not just on pinpointing suspicious language but also on dangerous contexts — such as emails that urge a user to take a business-critical action — make them very useful in assisting analysis, he says.

Any attempt to compromise workflows that have to do with money, credentials, sensitive data, or confidential processes should be flagged.

"Language as a classifier also very strongly enables us to reduce false positives by identifying what we call critical business workflows," Raghavan says. "If an attacker is interested in compromising your organization, there are four kinds of critical business workflows, \[and\] language is the predominant indicator for us to determine \[whether\] an email is concerning or not."

So why not use LLMs everywhere? Cost, says Sophos's Gelman.

"Depending on LLMs to do anything at massive scale is usually way too expensive relative to the gains that you're getting," he says. "One of the challenges of multimodal AI is that every time you add a mode like images, you need way more data, you need way more training time, and — when the text and the image models conflict — you need a better model and potentially better training" to decide between the two.

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

AI-Augmented Email Analysis Spots Latest Scams, Bad Content

​​​With careful planning, ongoing evaluation, and a commitment to treat cybersecurity as a core business function, SMBs can transform their vulnerabilities into strengths​​.

Source: Josie Elias via Alamy Stock Photo

COMMENTARY

Small and medium-sized businesses (SMBs) increasingly have become prime targets for cybercriminals. While large corporations often dominate headlines when breaches occur, the reality is that SMBs are at even greater risk. Almost 70% of SMBs reported experiencing at least one cyberattack in the past year. The reasons are clear: SMBs often operate with limited budgets, inadequate cybersecurity tools, and a shortage of skilled cybersecurity professionals. These factors make them particularly vulnerable to the sophisticated and evolving threats of today's cyber environment.  

SMBs are the lifeblood of our economy, and their drive and determination are truly inspiring. The businesses I interact with are exceptionally skilled and consistently deliver outstanding services and products to their customers. I must remind myself, however, that SMBs are not inherently technology companies. Because of budget challenges, they are often considered "soft targets" by threat actors.  

These smaller businesses just want their IT to work seamlessly and securely. Yet, when it comes to mitigating threats like cyber breaches, they are at a disadvantage. While many SMBs understand the importance of cybersecurity, they often need help prioritizing, implementing, and maintaining effective defenses due to limited resources — both financial and technical — compared with larger organizations.  

**Understanding the Landscape **

The range of cyber threats facing SMBs is broad and constantly evolving. Common attack vectors include phishing, ransomware, denial of service, social engineering, and session hijacking, to name a few. Each threat can cause significant harm — whether through intellectual property theft, financial extortion, or reputational damage.  

The most successful cyberattacks exploit the gaps in an organization's cyber-risk strategy. For SMBs, these gaps frequently are the result of constrained resources, limited access to skilled talent, and a reactive approach to cybersecurity. In my conversations with customers and business partners, it's clear that while the concern for cyber-risk is universal, SMBs are often the least equipped to address these risks independently.  

**People, Process, and Technology: A Comprehensive Approach **

To effectively address cyber threats, SMBs must adopt a holistic approach that focuses on three essential components: people, process, and technology.  

**1\. People: Bridging the Skills Gap **

One of the most significant challenges SMBs face is the lack of skilled cybersecurity professionals. Even the best technology and processes can fall short without the right talent. SMBs must assess their current workforce's skills and identify gaps. Addressing these gaps is crucial, whether through training existing employees, hiring new talent, or partnering with external cybersecurity firms.  

In many cases, it may be more practical for SMBs to engage with a trusted partner to supplement their in-house capabilities. Many of the customers I speak with utilize cybersecurity-focused consultancies for short- and mid-term implementations, or rely on managed service providers (MSPs). Additionally, leveraging software-as-a-service (SaaS) solutions can be a cost-effective way to access advanced security tools without requiring extensive in-house expertise. These services often have guaranteed service levels, ensuring that experienced professionals manage critical security functions.  

**2\. Process: Defining Cyber Resilience **

While each organization has unique technical requirements, the need for a well-defined cyber-resilience strategy is universal. SMBs must develop processes tailored to their specific needs and adapt to changing business demands. A one-size-fits-all approach will not suffice. Instead, SMBs should consider standard frameworks like ITIL, Agile, and DevOps as baselines for developing their cybersecurity strategies, as these frameworks can help streamline processes and strengthen the overall cybersecurity posture.  

A key takeaway from my conversations with successful SMBs is the importance of designing sustainable business processes. Cyber resilience is an ongoing journey, not a static goal requiring continuous improvement and adaptability. Every organization must regularly evaluate and update processes to keep pace with evolving needs and emerging threats. By embracing a dynamic approach to process development, SMBs can stay ahead of the curve and maintain robust defenses.  

**3\. Technology: Choosing the Right Tools **

Technology is the cornerstone of any cybersecurity strategy. Given the wide range of available tools, SMBs must carefully select the solutions that best meet their specific needs. Whether focusing on network security, data protection, or identity management, the chosen technology must be both practical and scalable.  

SMBs should focus on ensuring their technology stack aligns with their cybersecurity strategy. This means evaluating on-premises and cloud-based solutions while carefully managing access to sensitive data. The objective is to choose technology that not only addresses immediate security concerns but also strengthens long-term resilience.  

**Engaging Leadership and Industry **

A critical aspect of any successful cybersecurity program is the involvement of leadership at every level of the organization. From my discussions with business leaders who have established robust cyber resilience programs, one common theme emerges: Cybersecurity is a serious priority across the organization. It's not merely the IT department's responsibility but a critical business imperative that affects reputation, financial health, and legal compliance.  

To secure this level of commitment, SMBs must involve their leadership teams in developing and overseeing cybersecurity strategies. This entails conducting regular assessments of the program's effectiveness, incorporating feedback from both cybersecurity professionals and business leaders. When leadership is actively involved, it sends a clear message that cybersecurity is a priority, fostering a culture of security throughout the organization.  

Another critical factor is the willingness to seek external expertise. Successful SMBs often look beyond their internal resources, utilizing market analysis, user groups, vendor forums, and industry contacts to inform their cybersecurity strategies. For SMBs with limited staff and experience, these external resources offer valuable insights and support critical to the success of their programs. 

**Conclusion: A Proactive Path Forward **

Cybersecurity is not a one-time effort — it's an ongoing commitment that requires vigilance, adaptability, and strategic investment. For SMBs, the path to cyber resilience may be challenging, but it is achievable with the right approach. By focusing on the critical areas of people, processes, and technology, and engaging leadership at all levels, SMBs can develop robust defenses that safeguard their assets, reputation, and future growth.  

Ultimately, it's not just about preventing attacks. It’s about building a resilient organization that can thrive in an increasingly digital and complex business environment. As threats evolve, SMBs must continuously adapt their strategies and solutions to protect their businesses. Through careful planning, ongoing evaluation, and a commitment to treat cybersecurity as a core business function, SMBs can transform their vulnerabilities into strengths and secure their place in the digital economy.  

**About the Author**

CEO, One Identity

Mark Logan serves as Chief Executive Officer of One Identity and joined the company in June 2022. He is responsible for driving the overall growth strategy, go-to-market and P&L for One Identity. Mark is a seasoned executive with experience developing enterprise software companies to achieve successful growth. He is a proven leader with nearly two decades of C-suite experience at companies such as Emptoris (now part of IBM), Attunity, and most recently LogRhythm. Having been in the cyber security space for several years, Mark believes One Identity is in the right market at the right time to provide critically important cybersecurity protection for enterprises, public sector organizations and federal agencies.

Building Cyber Resilience in SMBs ​With ​Limited Resources

Since April, attackers have increased their use of Dropbox, OneDrive, and SharePoint to steal the credentials of business users and conduct further malicious activity.

Source: JLStock via Shutterstock

Threat actors are upping the ante on business email compromise (BEC) campaigns by combining social engineering with the use of legitimate, cloud-based file-hosting services to create more convincing attacks; the campaigns bypass common security protections and ultimately compromise the identity of enterprise users.

Since April, Microsoft has seen a rise in campaigns that have emerged over the past two years in which attackers weaponize legitimate file-sharing services like Dropbox, OneDrive, or SharePoint, which many enterprises use for workforce collaboration, Microsoft Threat Intelligence warned this week.

"The widespread use of such services … makes them attractive targets for threat actors, who exploit the trust and familiarity associated with these services to deliver malicious files and links, often avoiding detection by traditional security measures," according to the Microsoft Threat Intelligence blog post.

Attackers are combining their use with social engineering in campaigns that target trusted parties in a business user's network, and base lures on familiar conversation topics. Threat actors are thus successfully phishing credentials for business accounts, which they then use to conduct further malicious activity, such as financial fraud, data exfiltration, and lateral movement to endpoints.

Trusted cloud services are an increasingly weak enterprise security link. Indeed, various researchers have discovered attackers — including advanced persistent threat (APT) groups — using legitimate file-sharing services to deliver remote access Trojans (RATs) and spyware, among other malicious activity.

**A Typical BEC Attack Scenario**

According to Microsoft, A common attack scenario begins with the compromise of a user within an enterprise. The threat actor then uses that victim's credentials to host a file on that organization's file-hosting service and share it with the real target: those within an external organization that have trusted ties to the victim.

Attackers are specifically using Dropbox, OneDrive, or SharePoint files with either restricted access or view-only restrictions to evade common detection systems and provide a launching pad for credential-harvesting activity. The former "requires the recipient to be signed in to the file-sharing service … or to re-authenticate by entering their email address along with a one-time password (OTP) received through a notification service," establishing a trust relationship with the content. The latter can bypass analysis by email detonation systems, by "disabling the ability to download and consequently, the detection of embedded URLs within the files," according to Microsoft. "These techniques make detonation and analysis of the sample with the malicious link almost impossible since they are restricted."

To further ensure this bypass, attackers also use other techniques, including only allowing the intended recipient to view the file, or making the file accessible only for a limited time.

"This misuse of legitimate file-hosting services is particularly effective because recipients are more likely to trust emails from known vendors," according to Microsoft. Indeed, users from trusted vendors are added to allow lists through policies set by the organization on collaboration products used with the service, such as Exchange Online, so emails that are linked to phishing attacks pass through undetected.

After the files are shared on the hosting service, the targeted business user receives an automated email notification with a link to access the file securely. This is a legitimate notification about activity on the file-sharing service, so the email bypasses any protections that might have blocked a suspicious message.

**Adversary-in-the-Middle; Leveraging Familiarity**

When the targeted user accesses the shared file, he or she is prompted to verify identity by providing their email address, after which the address \[email protected\]\[.\]com sends a one-time password that the user can input to view the document.

That document often masquerades as a preview with another link purporting to allow the user to "view the message," according to Microsoft. However, it actually redirects the user to an adversary-in-the-middle (AiTM) phishing page that prompts the user is prompted to provide the password and complete the multifactor authentication (MFA) challenge.

"The compromised token can then be leveraged by the threat actor to perform the second stage BEC attack and continue the campaign," according to Microsoft.

Hosted files typically use lures to subject matter that would be a familiar topic or use familiar context based on an existing conversation held between employees of the organizations that the threat actor would be able to access thanks to the prior compromise of the anchor victim. For example, if two organizations have prior interactions related to an audit, the malicious shared files could be named "Audit Report 2024," according to Microsoft.

Attackers also leverage the oft-used psychological tactic of urgency to lure users into opening malicious files, using file names such as "Urgent:Attention Required" and "Compromised Password Reset" to get people to take the bait.

**Detecting Suspicious File-Sharing**

With these highly sophisticated BEC campaigns that neither users nor traditional email security systems detect on the rise, Microsoft recommends that enterprises use extended detection and response (XDR) systems to query for suspicious activity related to BEC campaigns that use legitimate file-sharing services.

Such queries could include identifying files with similar-sounding or the same file names that have been shared with various users. "Since these are observed as campaigns, validating that the same file has been shared with multiple users in the organization can support the detection," according to Microsoft

Defenders also can use identity-focused queries related to sign-ins from VPS or VPN providers, or successful sign-ins from a non-compliant device, "to detect and investigate anomalous sign-in events that may be indicative of a compromised user identity being accessed by a threat actor," according to the post.

**About the Author**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Microsoft: Creative Abuse of Cloud Files Bolsters BEC Attacks

Consumers are victims of online scams and have their data stolen, but they are lagging on adopting security tools to protect themselves.

Source: Consumer Cyber Readiness Report, Consumer Reports

Consumers are aware that their information can be stolen by cybercriminals and that they are vulnerable to attack. While many people are taking steps to improve their cybersecurity online, the pace they are adopting security tools remains low, according to the latest Consumer Cyber Readiness Report from Consumer Reports.

Nearly half of the respondents of a recent Consumer Reports survey on digital scams and consumer cyber readiness say they have been personally targeted by an online scam in the past year, but they don't seem to be taking any specific steps to reduce their exposure to threats or to shore up their defenses. In fact, consumer behavior remains largely unchanged from 2023 to 2024, the report found.

Despite the long list of organizations that have been breached and personal information stolen over the last few years, just 28% of respondents say they have identity theft protection services. This is a worryingly low number considering breached organizations offer identity theft protection for free.

Just 54% of consumers said they have software to block or remove malware and viruses on the personal electronic device they use the most, which is a 2% decline from the 56% who said they had such software in 2023. Less than half (42%) said they have a firewall installed on their device, but what's worrying is that a little over a quarter of respondents (26%) are not sure if a firewall is installed on their device. This is also another decline from last year, as 46% claimed to have a firewall in 2023.

Around 7 in 10 consumers (71%) said they apply software updates on their personal device as soon as the updates are available, which is a slight increase from last year's 67%.

"Staying updated is the simplest and most effective step consumers can take to safeguard their digital lives," the report quotes Tarah Wheeler, CEO of Red Queen Dynamics. "It's encouraging to see more Americans prioritizing this essential aspect of cybersecurity."

While users are generally more keen on keeping devices updated, only 10% are using encryption software on devices to keep files protected. Three-quarters of respondents said they do not, and 15% weren’t sure if they did or didn’t.

On the privacy front, things weren't much better. Nearly a quarter of respondents aren’t sure if they have browser extensions that block trackers. About a third of respondents say they do use a VPN for accessing the internet, but 17% were not sure if they do or don't.

This year's Consumer Cyber Readiness Report from Consumer Reports is based on a survey of about 4,000 people.

**About the Author**

Jennifer Lawinski is a writer and editor with more than 20 years experience in media, covering a wide range of topics including business, news, culture, science, technology and cybersecurity. After earning a Master's degree in Journalism from Boston University, she started her career as a beat reporter for The Daily News of Newburyport. She has since written for a variety of publications including CNN, Fox News, Tech Target, CRN, CIO Insight, MSN News and Live Science. She lives in Brooklyn with her partner and two cats.

Despite Prevalence of Online Threats, Users Aren't Changing Behavior

Attorneys for Joseph Sullivan argue the jury didn't hear essential facts of the case during the original trial and that his conviction must be overturned.

Source: Tetra Images via Alamy Stock Photo

Former Uber CISO Joseph Sullivan, convicted in 2023 of trying to cover up a data breach, is seeking a new trial, citing procedures omissions from his original trial that his lawyers said tainted the verdict.

Sullivan was initially convicted on charges related to Uber's 2016 data breach and was sentenced to three years of probation for his role in the subsequent coverup.

Sullivan was also ordered to pay a $50,000 fine and perform 200 hours of community service. These penalties were considered too soft by the prosecution, which argued that a 15-month prison term would have been more beneficial in deterring other executives in similar situations.

Now, Sullivan's defense attorneys argued that the jury was not informed of two "key limitations" in the nexus requirement, when Sullivan was initially tried. To convict a defendant under section 1505, the government must prove there was an agency proceeding; that the defendant was aware of that proceeding; and that the defendant intentionally tried to corruptly influence, obstruct, or impede that proceeding. According to the defense, these requirements weren't part of the jury's instructions, which undermined the entire conviction and called for a reversal.

"But at a minimum, each of these errors infects one of the government's core theories of guilt and require a new trial," Sullivan's attorneys argued during this week's hearing.

The prosecution countered that any potential errors in jury instruction were harmless and, ultimately, Sullivan's actions of falsifying documents and authorizing hush money in the form of bug bounties were a clear obstruction of justice.

The court made no decision today, but CISOs, boards of directors, and legal scholars will be watching the ruling, given how Sullivan's conviction has led to more legal scrutiny of and charges against CXOs, especially where compliance with data-handling laws is concerned.

Ex-Uber CISO Requests a New, 'Fair' Trial

Threat actors are actively exploiting two of the vulnerabilities, while three others are publicly known and ripe for attack.

Source: fadfebrian via Shutterstock

Microsoft's October security update addressed a substantial 117 vulnerabilities, including two actively exploited flaws and three publicly disclosed but as yet unexploited bugs.

The update is the third largest so far this year in terms of disclosed CVEs, after April's 147 CVEs and July's set of 139 flaws.

A plurality of the bugs (46) enables remote code execution (RCE), and 28 others give threat actors a way to elevate privileges. The remaining vulnerabilities include those that enable spoofing, denial of service, and other malicious outcomes. As always, the CVEs affected a wide range of Microsoft technologies, including the Windows operating system, Microsoft's Hyper-V virtualization technology, Windows Kerberos, Azure, Power BI, and .NET components.

**Actively Exploited Bugs**

The two vulnerabilities in the October update that attackers are actively exploiting are also the ones that merit immediate attention.

One of them is CVE-2024-43573, a spoofing vulnerability in MSHTML, or the Trident legacy browsing engine for Internet Explorer that Microsoft includes in modern versions to maintain backward compatibility. The bug is similar to CVE-2024-38112 and CVE-2024-43461 that Microsoft disclosed in MSHTML in July and September, respectively, which the Void Banshee group has been actively exploiting. Another unusual aspect of the bug: Microsoft has not credited anyone for reporting or discovering it.

Organizations should not allow Microsoft's moderate severity assessment for CVE-2024-43573 to lull them into thinking the bug does not merit immediate attention, researchers at Trend Micro's Zero Day Initiative wrote in a blog post. "There's no word from Microsoft on whether it's \[Void Banshee\], but considering there is no acknowledgment here, it makes me think the original patch was insufficient," the ZDI post noted. "Either way, don't ignore this based on the severity rating. Test and deploy this update quickly."

The other zero-day that attackers are currently exploiting is CVE-2024-43572, an RCE flaw in Microsoft Management Console (MMC). Microsoft said its patch prevents "untrusted Microsoft Saved Console (MSC) files from being opened to protect customers against the risks associated with this vulnerability."

Earlier this year, researchers at Elastic Security reported observing threat actors using specially crafted MMC files, dubbed GrimResource for initial access and defense evasion purposes. However, it is not immediately clear if the attackers were exploiting CVE-2024-43572 in that campaign or some other bug. Microsoft didn't address the point in this most recent patch update.

**Publicly Known but Unexploited — for the Moment**

The three other zero-day bugs that Microsoft disclosed as part of its October security update — but which attackers have not exploited yet — are CVE-2024-6197, a remote code execution vulnerability in the open source cURLl command line tool; CVE-2024-20659, a moderate severity security bypass vulnerability in Windows Hyper-V; and CVE-2024-43583, a WinLogon elevation of privilege vulnerability.

Mike Walters, president and co-founder of Action 1, said organizations should prioritize patching CVE-2024-6197. Though Microsoft has assessed the vulnerability as something that attackers are less likely to exploit, Walters expects to see proof-of-concept code for the flaw become available soon. "This vulnerability is particularly concerning, because it impacts the fundamental architecture of memory management in cURL, a tool integral to data transfers across various network protocols," Walters wrote in a blog post. "The affected systems include those using cURL or libcurl, the underlying library that powers numerous applications on diverse platforms."

Meanwhile, organizations using third-party input method editors (IMEs) that allow users to type in different languages are at particular risk from CVE-2024-43583, which is the WinLogon elevation of privilege flaw, Walters added. "This vulnerability is particularly pertinent in diverse settings where multilingual support is crucial, such as in global enterprises or educational institutions," he said. Attackers could exploit the vulnerability as part of a broader attack chain to compromise affected environments he said.

**Other Critical Bugs that Need Attention Now**

Microsoft assessed just three of the 117 vulnerabilities it disclosed this week as being critical. All three are RCEs. They are CVE-2024-43468 in Microsoft Configuration Manager, CVE-2024-43582 in the Remote Desktop Protocol (RDP) server, and CVE-2024-43488 in Visual Studio Code extension for Arduino Remote.

CVE-2024-43468 highlights some memory safety concerns with Microsoft Configuration Manager, Cody Dietz, a researcher with Automox, wrote in a blog post. "Successful exploitation of this vulnerability can allow for lateral movement throughout a network and offers the potential to deploy malicious configurations to other systems." In addition to immediately patching the vulnerability, organizations should consider using an alternate service account to mitigate risk, Dietz said.

Automox also highlighted CVE-2024-43533, a high-severity bug in RDP. The bug is present in the RDP client and enables attackers to execute arbitrary code on a client machine. "Unlike typical RDP vulnerabilities targeting servers, this one flips the script, offering a unique attack vector against clients," Tom Bowyer, director of IT security at Automox, wrote in the company's blog post.

"This vulnerability opens the door for back-hacks," Boyer added, "where attackers set up rogue RDP servers to exploit scanning activities from entities like nation-states or security companies."

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

5 Zero-Days in Microsoft's October Update to Patch Immediately

As healthcare organizations struggle against operational issues, two-thirds of the industry suffered ransomware attacks in the past year, and an increasing number are caving to extortion and paying up.

Source: Yuri A/PeopleImages via ShutterStock

The healthcare sector continues to grow, but without the proper focus on cybersecurity, the prognosis for the industry's resilience against ransomware and other attacks has only worsened.

Against a backdrop of non-IT disruptions — such as private equity failures, shortages of medicines, and the cutting of services — two-thirds (66%) of healthcare organizations also suffered ransomware attacks in the past year, up from 60% in the prior year, according to a report from cybersecurity firm Sophos. Major attacks on hospitals and medical-service providers have led to disruptions of services, significant financial outlay, and the exposure of sensitive patient data. In some cases, they also affected patient outcomes.

There are also new threats emerging all the time. The Trinity ransomware, for instance, first seen last May, poses a "significant threat" to the healthcare and public health sector, according to an alert this week from the US Department of Health and Human Services.  

Overall, more than 14 million US citizens — and an unknown number worldwide — have been affected by healthcare breaches in 2024, according to another data set from security firm SonicWall.

Healthcare suffers such a cyber malaise that Senate Finance Committee chair Ron Wyden (D-Ore.), and Sen. Mark Warner (D-Va.) last week announced legislation to attempt to patch up the system. The bill would require jail time for healthcare CEOs that lie to the government about their cybersecurity postures, offer federal resources to rural and underserved hospitals for cyber improvements, and introduce accountability measures and mandatory cybersecurity requirements for all organizations that hold sensitive data. The bill would also remove the existing cap on fines for data mishandling under the Health Insurance Portability and Accountability Act (HIPAA).

"Mega-corporations like UnitedHealth are flunking Cybersecurity 101, and American families are suffering as a result," Wyden said in a statement announcing the bill. "The healthcare industry has some of the worst cybersecurity practices in the nation despite its critical importance to Americans’ well-being and privacy."

**Healthcare Cyber-Profiles Are Ripe for Infection**

Healthcare organizations have three attributes that ensure ransomware gangs will continue to focus on the industry: Their operations are critical to society, their technology is often old and rife with vulnerabilities, and individual organizations are willing to pay ransoms, says Doug McKee, executive director of threat research of SonicWall.

"There's a lot of money in healthcare, \[and\] healthcare is not only notorious for having a lot of money, but they've been painted as an industry that's willing to pay the ransom," he says. "If we're going to keep paying the ransom, the attackers are going to keep ramping up in that industry. The math is that simple."

The cybersecurity problems plaguing the industry are not just affecting the business of healthcare. They're also having real impacts on patients and national health efforts. Attackers used stolen credentials, for example, to compromise UnitedHealth subsidiary Change Healthcare and infect its systems with ransomware in February, leading to stalled payments for doctors, pharmacies, and hospitals — and eventually a $22 million ransom paid to the criminals. In the United Kingdom, an attack on medical-services provider Synnovis in June led to delays in matching patient blood types and other pathology services. The same month, an attack on South Africa's National Health Laboratory Service (NHLS) disrupted the service provided by the government-run testing laboratories, while the nation found itself in the midst of an mpox outbreak.

"I can either pay the ransom, get back up and running, or I can try to rebuild it myself and pray that we get everything back set up running in a week — not an option," says Errol Weiss, chief information security officer (CISO) of the Healthcare Information Sharing and Analysis Center (Health-ISAC). "So now, we've got a sector who is more prevalent to pay, and I think the bad guys — cybercriminals, nation-states that are doing this — figured that out pretty quickly. I think it's getting worse, and I think that they've also figured out the weak spots in the sector."

**A Pound of Cure Typically Fails**

The weakest spot for healthcare entities is arguably the inter-reliance of hospitals and pharmacies on their third-party providers. When Change Healthcare suffered its weekslong outage, the incident demonstrated that efforts to shore up cyber resilience has to extend all the way to any third-party suppliers on which healthcare providers rely.

"Change Healthcare definitely rocked the sector and made us \[realize\] that it's a single point of failure for so many services," Weiss says. "We had thousands of patients across the US that couldn't get prescriptions filled because of that outage, and then ... we had hospitals that couldn't file claims."

Similarly, the attacks on Synnovis and NHLS slowed diagnostic services.

While their operational requirements — prioritizing human life, which means keeping open the access to needed data — pose challenging issues, healthcare organizations must gain oversight over their (often legacy) technology and the large variety of medical devices and equipment, which might not be kept totally up to date. Seven out of every eight breaches were caused by exploitable vulnerabilities, compromised credentials, and malicious emails — so focusing on those three areas could pay significant dividends for cybercriminals, says Christopher Budd, director of threat research for Sophos X-Ops.

"Healthcare — along with energy, oil/gas, and utilities — is challenged by higher levels of legacy technology, and infrastructure controls more than most other sectors, which likely makes it harder to secure devices, limit lateral movement, and prevent attacks from spreading," he says.

**Time for an Ounce of Prevention**

Yet, perhaps most telling is the industry's problems with backups.

In 95% of attacks targeting healthcare organizations, the attacker tried to compromise the backups. Unfortunately, they succeeded in 66%, putting healthcare organizations' defensive shortcomings behind that of only the energy, oil/gas, and utilities sector (79%) and the education sector (71%), according to Sophos' report.

While healthcare organizations continue to use backups to recover, many also pay ransoms. Source: Sophos

The loss of backups results in much worse — and more expensive — outcomes, the report stated. The value of the initial ransom demand more than tripled, to $4.4 million, compared with $1.3 million for organizations with backups, and the organizations were far more likely to pay the ransom, with 63% of organizations with a failed backup paying the ransom, compared with 27% of organizations with complete backups.

In its threat brief, SonicWall recommended the typical trio of cybersecurity best practices: patch management, strong access controls, and continuous monitoring. However, out of those three, monitoring is the most important capability for organizations to establish first, says SonicWall's McKee. Companies with good visibility can detect cybersecurity issues early and remediate them before they are attacked, he says.

While the outlook is currently messy, progress is being made, he added.

"I think that we've gotten better," McKee says. "Over the last five years, I've seen a huge improvement in healthcare, as far as being able to turn around cybersecurity best practices ... but \[technology\] has to get through all the regulatory requirements ... and that's simply going to take time ... probably years, for healthcare to get to a point that we're able to reduce some of the effectiveness of these attacks."

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Healthcare's Grim Cyber Prognosis Requires Security Booster

The annual event reinforces best practices while finding new ways to build a culture where employees understand how their daily decisions affect company security. Find out how AWS, IBM, Intuit, SentinelOne, and Gallo are spreading the word.

Source: Prostock-studio via Alamy Stock Photo

COMMENTARY

Cybersecurity Awareness Month, an annual initiative since 2004, provides organizations each October with valuable opportunities to reinforce security best practices among employees. As we engage in these activities this month, it's also an opportunity to discover ways to build a culture of security where employees understand how their daily decisions and actions can affect an organization's overall security.  

Employees remain every organization's best first line of defense. Making the most secure way of doing things the easiest way helps motivate employees to make security-first decisions. For example, getting employees to use multifactor authentication (MFA) — once again a top recommendation of the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NSA) — is one of the simplest and most effective ways to enhance security. Fifteen years ago, when AWS made MFA publicly available, we knew the criticality of using MFA would only increase as technology rapidly evolved and the cloud ushered in a new era of business transformation.  

At AWS, Cybersecurity Awareness Month is also an opportunity to foster internal cross-team collaboration and learning among employees — whether "security" is officially in their title or not. During Amazon's annual Security Week in October, employees will learn online and physical security best practices, how to easily report a security matter, proper ID badge usage, device protection, and how to opt-in for emergency messaging.  

We're also hosting our fourth annual One Amazon Security Conference, bringing our security teams from across the company together for two days in October to connect, collaborate, and amplify knowledge sharing and skill development. Through a variety of programming, including activities to enhance practical security skills, breakout sessions covering security innovations and best practices, and presentations from experts and Amazon security leaders, employees will learn about our efforts to improve security, both internally and for our customers.  

Mark Hughes, Global Managing Partner Cybersecurity Services, IBM Consulting 

At IBM, we're committed to educating and empowering our teams and clients with the knowledge and tools they need to stay secure. As innovative new solutions help advance today's businesses, we also understand the complexity of addressing new cybersecurity threats and advocate to our clients the importance of proactively embedding security into all aspects of their business. 

Cybersecurity Awareness Month provides an opportunity for IBM to drive awareness, highlight our security expertise, and engage our global community around the important role of cybersecurity. We're kicking October off with our "Cloud Threat Landscape" report that will examine cloud threats and highlight how companies can assess and address their risks in areas such as identity access management and data security. Throughout the month, we'll showcase these findings, alongside key takeaways from our recent "Cost of a Data Breach" report, through a series of digital content, including expert-led discussions and security-themed insights, equipping our consultants with the strategies needed to help clients address emerging cloud threats and effectively adopt automation and generative AI (GenAI) to strengthen their security. 

While IBM educates our employees year-round, Cybersecurity Awareness Month allows us to intensify our focus on security-based skills training for our consultants while empowering them to get security industry certifications to help provide guidance to our clients on architectures and technologies that can help them stay ahead of attacks. 

By creating an organization with a security-first mindset, and leveraging the capabilities of the cloud, automation, and GenAI, IBM educates our employees, informs our clients, and inspires new approaches to cybersecurity — like quantum-safe standards — to reinforce our commitment to a secure digital future. 

Atticus Tysen, Chief Information Security Officer, Intuit  

This year, our theme for Cybersecurity Awareness Month is Cyber Wellness, focusing on the importance of maintaining digital health alongside physical well-being. We're using this theme to highlight that protecting our digital lives is an ongoing responsibility, like looking after our physical health. Through this theme, we aim to foster a culture of continuous cybersecurity awareness, encouraging employees to take proactive steps in safeguarding themselves and Intuit. 

As part of our Cybersecurity Awareness Month program, our chief financial officer (CFO), Sandeep Aujla, and our general counsel, Kerry McLean, will join me in an opening keynote, sharing why cybersecurity is critical to our company's overall success. In addition to general sessions for all employees, we've crafted targeted sessions for groups identified as being more prone to social engineering, based on months of phishing simulation data. This focused approach allows us to directly address the needs of specific groups. 

Josh Blackwelder, Deputy Chief Information Security Officer, SentinelOne  

SentinelOne lives and breathes security, all day, every day. And while our mission — Secure Tomorrow — is most often focused on a promise and dedication to our customers, it extends far beyond the business goals of the company to securing our teammates, communities, and democracy, as whole. We see Cybersecurity Awareness Month as a way to bring our expertise into our communities — helping to create future generations of cyber-aware citizens while expanding the next generation of cyber defenders.  

For Cybersecurity Awareness Month, SentinelOne focuses on its CyberSafe University program, an in-school program that targets kids in grades K-12 and is designed to introduce the concept of cybersecurity in age- and activity-appropriate ways.  

The program provides a range of ways that kids can think about their online activities and privacy. For younger elementary students, we focus on essential skills for safeguarding personal data online. For middle schoolers, we focus on the best practices to retain cybersecurity safety, including the importance of multifactor authentication. For older students, we also include information on how to pursue a career in cybersecurity, what to major in, and leading university programs around the globe.  

Over the past two years, this massive volunteer effort has delivered amazing results — over 100 Global SentinelOne Employee Ambassadors were able to reach more than 12,000 students, in over 40 schools, in eight countries. 

Raul Sanchez, Director of Information Security, Gallo 

Gallo recognizes Cyber Awareness Month with a series of engaging, educational initiatives aimed at enhancing the cyber resilience of its workforce. The highlight is the annual Cybersecurity Awareness Day event, held at corporate headquarters. This event features keynote speakers and representation from our security partners, offering insights into the latest cyber threats and best practices. Designed to be fun and educational, the event provides employees with hands-on experiences and practical knowledge to better protect the organization and its data. Adding a twist, the event also includes a 5 kilometer run/walk, allowing employees to earn points in the company's health and wellness program while promoting physical fitness alongside cyber fitness.  

In addition to the awareness day event, Gallo hosts weekly cybersecurity webinars throughout October. These sessions cover a range of topics, from phishing prevention to secure password management, and are designed to educate employees on how to recognize and respond to potential threats. The webinars are well received, offering employees the flexibility to participate and learn at their own pace.  

To keep cybersecurity top of mind, the information security department also publishes daily security tips for all Gallo employees. These tips provide practical advice and actionable steps employees can take to improve their personal and professional cybersecurity practices. By integrating these daily reminders into the workday, Gallo ensures that cybersecurity remains a priority throughout the month, leading to a more prepared and vigilant workforce.  

About the Contributors

Mark Hughes is the global managing partner of IBM Consulting Cybersecurity Services and leads IBM's team of thousands of experts in helping organizations transform security into a business enabler and establish cyber resiliency. His role spans the sales and services delivery of threat detection and response, data security, cloud security, IAM, infrastructure, risk management and ecosystem partnerships. Mark's cybersecurity career spans across two decades, including recent roles as president of security at DXC Technology, a Fortune 500 global technology services provider, and chief executive at BT Security, a leading global telecommunications provider.  

As senior vice president and chief information security officer (CISO) of Intuit, Atticus Tysen is responsible for information security, fraud prevention, and enterprise information technology. Before assuming this expanded role, Tysen served as chief information officer (CIO) for nearly 10 years. Prior to that, Tysen was vice president of product development for Intuit's Financial Management Solutions group, leading product development efforts for the company's Small Business division. Since joining Intuit in 2002, he has also served as director of new technology and led the company's patent program, building a process to protect the company's intellectual property. Tysen earned a bachelor's degree in computer science from Stanford University. 

Josh Blackwelder has been at the forefront of enhancing security operations at SentinelOne since early 2022. His leadership extends across cloud security engineering, security operations, FedRAMP, security engineering, vendor risk, security architecture, and application security. Before joining SentinelOne, Josh held security leadership positions at Instructer (makers of the learning management software Canvas), as well as Adobe, RBS Markets & International Banking, and Verizon Business. 

Raul Sanchez, director of information security of Gallo, is a seasoned security professional with extensive experience in all facets of IT compliance, privacy, vendor risk management, security design and architecture, regulatory audits, and managing the security of mergers and acquisitions. In recent years, he has focused on implementing modern cybersecurity initiatives and enhancing cyber resilience to better protect against evolving threats. His ability to establish meaningful relationships with business teams enables the effective execution of business initiatives while ensuring the security of customer and corporate data and maintaining the company's positive brand reputation.  

**About the Author**

Chief Information Security Officer, AWS

Chris Betz is the chief information security officer (CISO) at AWS, where he oversees the security teams responsible for protecting AWS infrastructure and cloud services. Betz leads the development and implementation of comprehensive security policies and strategies aimed at effectively managing risk and aligning AWS's security posture with the company's business objectives. Betz is based in northern Virginia, where he resides with his family.

How Major Companies Are Honoring Cybersecurity Awareness Month

The massive outage involving a faulty Falcon update is an excellent illustration of what happens when organizations neglect security fundamentals.

Source: Tero Vesalainen via Alamy Stock Photo

UPDATE  
Back in July, 8 million Windows devices around the world went offline after CrowdStrike released a threat intelligence update with a buggy content validator. Hospitals could not access patient records, interrupting patient care. Airlines were forced to delay or cancel thousands of flights. Some payment platforms were unavailable, resulting in people not being paid on time. The Emergency Alert System in the United States was affected, which, in turn, disrupted 911 services in several states.

The problem ultimately boiled down to an inadvertent systems failure, intensified by poor update management issue and processes that violated third-party risk management policies and procedures. CrowdStrike's quality-control testing did not catch the bug beforehand. The outage highlighted what happens when basic IT rules are forgotten, ignored, or simply abbreviated.

Cloud-based endpoint detection and response (EDR) security tools, such as CrowdStrike's solution, work best when the sensors can process real-time intelligence from the cloud, says Eric O'Neill, a cybersecurity consultant and former undercover FBI counterintelligence operative, noting that this was mainly a update management issue. Ideally, a vendor would roll out updates to a subset of its customers, then continue the rollout in stages to ensure there were no issues. In this case, he says, all customers received the update at the same time. From a third-party risk management perspective, organizations should test updates they receive before deploying them to their systems.

In this case, most CrowdStrike customers opted for the popular automatic update installation instead of the more complex and time-consuming staged rollout, which is rarely done for endpoint applications. Because such an anomaly has never happened before with an update, the decision to forgo testing was understandable, O'Neill notes. In light of this incident, he expects to see major changes in how organizations roll out and install updates in the future.

Crowdstrike takes exception with O'Neill's assessment that testing was incomplete, and noted in a statement to Dark Reading that, "as stated in the Root Cause Analysis report: A stress test of the IPC Template Type with a test Template Instance was executed in our test environment, which consists of a variety of operating systems and workloads. The IPC Template Type passed the stress test and was validated for use, and a Template Instance was released to production as part of a Rapid Response Content update."

**Reducing the Risk**

John Young, a consulting CISO and former cloud and data center executive at IBM, likens the impact of the unintended outage to previous cyberattacks on SolarWinds and Kaseya but without the malicious intent, as with ransomware and other malware. Instead, this became an eye-opening event for boards to ensure they are conducting appropriate business risk and interruption analyses. Here, only one operating system (OS), Windows, was affected. Organizations could reduce their vulnerabilities if they spread their operational risk over multiple OSes, he says.

"If we use different operating systems \[for hot backup systems\], we could run it at 25% service delivery level," Young says. "We'd limp along, but we would have a real-time objective that we would recover in two days."

Young likens this approach to enterprises having servers around the world that run multiple OSes, so that companies can protect themselves from regional threats and vulnerabilities. While running multiple OSes could protect against similar, OS-specific vulnerabilities, the arguments against it are the high cost and the unlikeliness of such an event occurring again, he adds.

While it makes sense to trust key software vendors, Young notes, basic security practices indicate that software should not be trusted simply because it is from a known source and is identified as a security update. Many of the system failures were because "they didn't really follow best practices. There was no compartmentalization. There was no business continuity planning. There was no impact analysis on the critical system," he says. "There was too much integration with their third party."

**The Impact on Cyber Insurance**

While the outage clearly was not a cyberattack, some cyber insurance policies could include coverage for dependent systems failures that are not brought on by a malicious attacker, says David Anderson, vice president of cyber liability at Woodruff Sawyer, a national insurance brokerage. While addressing insurance coverage, in general, he says a property policy might address such losses, but it depends on the negotiated policy, any extra coverages the company might have selected, and the policy's specific language.

"A system failure event is absolutely different than a network interruption or business interruption event, which is always tied to a malicious attack," Anderson says. "It's important to know that not every cyber insurance policy affirmatively includes system failure coverage; you have to have purchased the enhancement in order for this event to be covered."

This alone could get the attention of general counsels or whichever corporate executive is responsible for their company's cyber insurance policy. While not all incidents are always covered — generally, that is based on the severity of the incident, the amount of loss, and the amount of time the company was affected — this could be a watershed moment for an organization to reevaluate its existing insurance policies.

What would be an interesting question, he notes, is: Does a property policy that clearly includes data processing equipment breakdown coverage, which are non-malicious events, have some coverage to include here? Larger commercial property policies often include human errors, errors and omissions, and unplanned failures coverage within the property policy.

"It all is going to depend if the coverage is considered mechanical breakdown, which I don't think this would be, or if it was truly a human error and unplanned outage," Anderson notes. Again, the final decisions will be up to the insurance companies, which could interpret the situation differently.

This story was updated at 3 p.m. ET on Oct. 9 to clarify that the catalyst for the CrowdStrike outage was not a software patch or bug fix, but rather an update to its threat intelligence engine with the latest threat signatures, known as Rapid Response Content.

**About the Author**

Stephen Lawton is a veteran journalist and cybersecurity subject matter expert who has been covering cybersecurity and business continuity for more than 30 years. He was named a Global Top 25 Data Expert for 2023 and a Global Top 20 Cybersecurity Expert for 2022. Stephen spent more than a decade with SC Magazine/SC Media/CyberRisk Alliance, where he served as editorial director of the content lab. Earlier he was chief editor for several national and regional award-winning publications, including MicroTimes and Digital News & Review. Stephen is the founder and senior consultant of the media and technology firm AFAB Consulting LLC. You can reach him at \[email protected\].

The Perils of Ignoring Cybersecurity Basics

Company leadership needs to ensure technology teams are managing continuous monitoring, automated testing, and alignment with business needs across their enterprise.

Source: Stu Gray via Alamy Stock Photo

COMMENTARY

This summer, a cyberattack disrupted the normal operations of thousands of auto dealerships across the United States, affecting everything from records to scheduling, causing no end to annoyances and leaving hordes of exasperated salespeople and customers at their wits' end.

The most recent and dramatic example of hacker success illustrates that IT security must become the first priority at the highest levels of an organization. This modern-day plague shows no sign of subsiding. With each successful attack, hackers become even more emboldened. 

It's an all-out assault, requiring the corporate equivalent of an all-points bulletin. In short, cybersecurity is not just an IT issue; it's a critical business risk that requires active involvement from the entire C-suite, in particular, the CEO. This is one area of the enterprise that may benefit from micromanagement in an effort to display the importance of the pursuit.

My colleagues and I regularly advise our clients that they should be asking three questions of their team: What are we doing? Is it enough? How do we know?

Effective cybersecurity requires the right balance of spending and technology value, continuous assessment, and the adoption of advanced technologies such as automation and artificial intelligence. Few regret wise investments in cybersecurity defenses.

The increasing frequency and sophistication of cyberattacks underscore the seriousness for executive-level engagement in cybersecurity. Recent incidents, such as the SEC's $10 million fine on the New York Stock Exchange's parent company and the notorious SolarWinds action, illustrate the severe impact on business operations and regulatory compliance. These events highlight the necessity for CEOs to recognize their critical role in cybersecurity. 

Ascension Healthcare's ransomware attack, among other prime examples, serves as an object lesson in the urgency of the matter, especially in healthcare. Doctors and pharmacies struggled with order and prescription issues, leading to lost revenue as patients sought services elsewhere, and virtually bringing the massive hospital system to its figurative knees, causing tremendous frustration among staff and patients. This situation underscored the need for technologists to understand business operations and implement security measures that support the business. 

CEOs must understand that cybersecurity is central to their management duties and not just "tech stuff" to be delegated. They need to receive business-outcome-focused reporting with the same level of rigor as financial and safety reporting. This reporting should answer the above three questions using system-generated metrics and integrate results into business decisions to stay ahead of the increasingly destructive capabilities of adversaries conspiring to do them harm.

CEOs set the organizational tone and ultimately are responsible for cybersecurity. Their endorsement of security measures can drive home their importance, ensure alignment with business goals across the senior leadership team, and communicate capabilities to their boards. The following steps are essential for CEOs to prioritize cybersecurity:

*   Engage in cybersecurity planning and response: CEOs and executive leaders must be actively involved in cybersecurity planning and response. Their endorsement and understanding of cybersecurity's importance can fuel organizational commitment and set the right tone. Deciding how to handle hypothetical ransom, extortion, and fraud events accelerates response when an event occurs.
    

*   Conduct business analysis for cyber spending: Utilize business analysis to determine the appropriate cybersecurity investments. Focus on preventive technologies that provide greater risk reduction and ensure that the spending aligns with business priorities.
    

*   Implement multifactor authentication: Ensure that multifactor authentication is in place and effective. Avoid inferior solutions that users can mindlessly click through, and prioritize strong authentication measures for password resets to enhance security.
    

*   Regularly review and assess cybersecurity measures: Frequently review assessment results and address important gaps. This includes adopting automation for continuous threat exposure management and ensuring cybersecurity is integrated into business operations.
    

*   Adopt advanced technologies and continuous testing: Embrace automation and advanced technologies for security testing and closing security gaps. Stay ahead of emerging threats by keeping up with advancements in AI and other technologies.
    

*   Seek independent advice and expertise: Business leaders will be called to answer for hiring well-qualified cybersecurity advisers and executives. Use the three questions to understand the current state of cybersecurity within the organization. Seek independent advice to keep up with current threats and defenses. Obtain board members' cybersecurity expertise combined with other essential business skills, or hire independent advisers to provide valuable insights.
    

What hasn't played out yet is the full impact of increased AI usage by both attackers and defenders. As AI technology advances, organizations must keep up to ensure their cybersecurity measures are effective. A recent survey of IT security officers revealed that increasing use of AI will lead to more security breaches, while, conversely, four in five intend to use AI to guard against those same breaches. The ongoing complexity and expanding surface area of systems likely will lead to an increase in cyberattacks through 2030. This necessitates continuous vigilance, adoption of automation for threat and vulnerability management, and regular reviews of cybersecurity measures. Companies will also have to understand and protect against new AI-enabled systems that they are developing. 

Cyber-risk is inherently a business risk, and effective cybersecurity measures are essential for protecting valuable information and maintaining system availability.

One might argue that cybersecurity can be managed solely by IT departments. However, without executive-level involvement, organizations may face significant business disruptions and regulatory penalties. CEOs must understand their role in cybersecurity to ensure comprehensive protection.

The consistent pattern of cyber incidents causing business disruptions and regulatory fines supports the conclusion that CEO involvement is crucial to ensure that companies can answer the three questions: What are we doing? Is it enough? How do we know? Determining business value at risk and the right amount of protection requires business input. As company leadership, now is the time to ensure that technology teams are managing continuous monitoring, automated testing, and alignment with business needs across the enterprise.

**About the Author**

Managing Director, BPM

Ken Frantz is a transformational IT leader and consultant with experience in global financial services, emerging technology, and top-tier health system networks. He focuses on innovative technology advancement with reduced risk and is interested in high impact/high value opportunities to improve IT operations, deliver value, and help companies grow efficiently and effectively.

Source

DARKReading