Cybersecurity firms are booming thanks to Russian hackers

When the Democratic National Committee discovered in April that its computer networks had been hacked, leaders there did not just alert government intelligence. They called CrowdStrike, a five-year-old cybersecurity firm that makes millions from mercenary work sold with a promise: “We Stop Breaches.”

The contractor last month revealed what it had found: Two Russian intelligence groups, code-named Cozy Bear and Fancy Bear, had spearheaded competing hacks over the last year using a barrage of malicious “implants” and “backdoors.” CrowdStrike’s experts knew the hackers well: They’d also recently infiltrated the White House, State Department and Joint Chiefs of Staff.

Their weapon of choice: The cybersecurity equivalent of “a neighborhood watch program on steroids,” said CrowdStrike co-founder George Kurtz. That same offering has helped them turn their young business into a juggernaut, with sales of $100 million this year.

“Our clients now include the crème de la crème of companies,” said Kurtz, a former chief technology officer of anti-virus giant McAfee. “From a growth perspective, it’s just been explosive.” For the full article click here 

from cyber security caucus http://ift.tt/2aEe8OE
via IFTTT

Infographic: The 5 phases of a ransomware attack

Ransomware is the most profitable type of malware attack in history—and attacks will only get worse in the future, according to Cisco Systems’ midyear report on the state of cyber security, released Tuesday. It’s now important for employees to understand the different phases of an attack and best practices to prevent them.

Ransomware is “weaponized encryption,” said James Scott, senior fellow and co-founder of the Institute for Critical Infrastructure Technology, and co-author of the 2016 Institute for Critical Infrastructure Technology Ransomware Report. Attacks involve malware delivered through spear phishing emails that lock up valuable data assets and demand a ransom to release them.

Hackers who previously used ransomware only to secure money from individual users are now looking to steal data from larger hospitals and corporations and sell it on the Dark Web, Scott said. For the full article click here 

from cyber security caucus http://ift.tt/2ahGaPT
via IFTTT

Should You Stop Sending Private Messages Over Email?

With another high profile hack in the news, it’s worth asking: Can anyone trust email anymore?

The breach of the Democratic National Committee’s email by the website Wikileakspublished a trove of over 20,000 emails. It reminds us of the urgency of concerns surrounding cyber security.

“No email that you’ve ever written is ever deleted. There’s always a copy out there,” says Stephen Ward, a vice president with Pinkerton, an expert in risk management and security who specializes (among other things) in electronic security. “So you should always use that common sense approach: If this is something that’s groundbreaking for my company or it could change the world, should I send that in an email? Probably not.

One of the biggest problems with cyber theft, he explained, is the online data can’t be destroyed. Once a user’s secrets are released, they’re gone.  For the full article click here 

from cyber security caucus http://ift.tt/2awhxvL
via IFTTT

How to avoid ransomware attacks: 10 tips

Nigerian princes are no longer the only menaces lurking in an employee’s inbox. For healthcare organizations, schools, government agencies and many businesses, ransomware attacks—an especially sinister type of malware delivered through spear phishing emails that locks up valuable data assets and demands a ransom to release them—are a rapidly-growing security threat.

“We’re currently seeing a massive explosion in innovation in the types of ransomware and the ways it’s getting into organizations,” says Rick McElroy, security strategist for cyber security company Carbon Black Enterprise Response. “It’s a big business, and the return on investment to attackers is there—it’s going to get worse.” While ransomware has existed for years, 2015 saw a spike in activity. The FBI received 2,453 complaints, with losses of over $1.6 million, up from 1,402 complaints the year before, according to annual reports from the bureau’s Internet Crime Complaint Center. And the numbers are only growing in 2016, the FBIreports.

“The Dark Web and Bitcoin allow almost anyone to sell stolen data without identification—cyber criminals understand they can make easy cash without the risk of being jailed,” says Ilia Kolochenko, CEO of web security company High-Tech Bridge. And hackers—most of which are located in developing countries—are growing more sophisticated, even developing downloadable ransomware toolkits for less-experienced hackers to deploy, according to the 2016 Institute for Critical Infrastructure Technology Ransomware Report.

For the full article click here 

from cyber security caucus http://ift.tt/2aiHzQ7
via IFTTT

Overcoming Security Overload

There are too many security tools not providing comprehensive solutions.

You have to be reactive and proactive when it comes to IT security. There is always some vendor or service that states that they have a different, better, more inclusive security solution. You buy these solutions to protect your organization against security breaches. You install firewalls, SBCs, and other perimeter solutions, but a new threat seems to emerge every day. You invest in training your users, but they still cause the majority of security headaches. The CISO and staff are on overload.

Too Few – Too Many Tools

You install the proper security tools, but is this enough? Should you work with a cloud service that has more resources and staff than you, or implement DIY solutions? There appears to be no absolute answer to these security questions. If you have the budget, you could duplicate what the cloud service offers, but that is assuming the cloud security service is invulnerable — not likely.

Cloud Security Alliance surveyed more than 200 IT/IT security professionals, and the resulting report, “IT Security in the Age of Cloud,” explores how recent trends in IT management and security are shaping IT security budgets and talent acquisition. The charts in this article are taken from the report. For the full article click here 

from cyber security caucus http://ift.tt/2aiIX5e
via IFTTT

£3 million funding approved for Berkeley cyber security centre

MILLIONS of pounds of funding has been approved for a new cyber security training and conference centre in Berkeley.

The board of GFirst LEP, Gloucestershire’s local enterprise partnership, approved £3million of funding from the Gloucestershire Growth Deal to be spent on the new centre.

The Cyber Security Training and Conference Centre is a joint initiative between the University of Gloucestershire (UoG) and South Gloucestershire and Stroud College (SGSC) and will create new cyber security facilities in Cheltenham and at Berkeley Green.

Facilities at Gloucestershire Science and Technology Park, Berkeley will be used to deliver science, technology, engineering and maths (STEM) skills development, and will support business development and training in Gloucestershire.

It will be connected into existing activity in the region with the aim of making Gloucestershire a regional force in cyber security training, employment and expertise.

The Cheltenham site will become the main regional hub for higher education courses and research in computing and cyber security at undergraduate, postgraduate and doctoral level. For the full article click here 

from cyber security caucus http://ift.tt/2aPjkv3
via IFTTT

Week-in-Review: IT talent crisis creates cybersecurity risks

Gaps in security talent pose significant risk to businesses

The IT talent crisis creates many challenges for CIOs and business leaders – making it harder to keep up with emerging technology trends and even putting their own careers on the line. According to a new report from Intel Security, the IT skills shortage is also putting organizations directly at risk for an attack. The research found, “82 percent of respondents admitting a skills shortage, with 71 percent claiming that this lack of trained information security professionals has directly led to damage to the organization as it’s become a bigger target for hackers.” The outlook of the survey appeared grim, with respondents “predicting an average of 15 percent of cybersecurity positions in their company will go unfilled by 2020.”

The research highlighted four ways for organizations to address the gap in security talent: increase cybersecurity budgets, impose stricter policies, boost cybersecurity training, and find new and creative ways to recruit and retain security experts.

In addition to these tips, business leaders facing their own talent issues might learn from the criticism of Yahoo’s talent acquisition strategy in Fast Company this week. The article, by Cale Guthrie Weissman, argues that the company, “simply did not have the system in place to cultivate the new talent and make them feel part of the new company.” A key takeaway for enabling new talent to thrive and making them feel wanted: they “must feel free to innovate.” For the full article click here 

from cyber security caucus http://ift.tt/2aPiI8t
via IFTTT