Guide to Phishing

 Been Phished? I have.   Schneier sends along a nice piece from TidBits on the topic.   A useful guide, history and much more.   Schneier's piece has lots of comments on experiences    . 

An Annotated Field Guide to Identifying Phish   in TidBits  and VentureBeat.

Do you like phish? Not the band, not tasty seafood dishes, and not the pretty tropical variety. I refer instead to the intellectual challenge of identifying phishing emails that attempt to get you to reveal personal information, often including login credentials or financial details, or entice you to call a phone number where trained operators will attempt to separate you from your money.

Phishing is a big deal, with a State of Phishing report  from security firm SlashNext claiming that there were more than 255 million phishing attacks in 2022, a 61% increase from the year before. The Verizon Data Breach Investigations Report for 2022 says that only 2.9% of employees click through from phishing emails, but with billions of email addresses available to target, the raw numbers are still high.   ... ' 

Machine Generated Text, Threat Models,

Part of a current survey of mine.  intro below, more at the link

Machine Generated Text: A Comprehensive Survey of Threat Models and Detection Methods

By EVAN CROTHERS, NATHALIE JAPKOWICZ, and HERNA VIKTOR

Advances in natural language generation (NLG) have resulted in machine generated text that is increasingly difficult to distinguish from human authored text. Powerful open-source models are freely available, and user-friendly tools democratizing access to generative models are proliferating. The great potential of state-of-the-art NLG systems is tempered by the multitude of avenues for abuse. Detection of machine generated text is a key countermeasure for reducing abuse of NLG models, with significant technical challenges and numerous open problems. We provide a survey that includes both 1) an extensive analysis of threat models posed by contemporary NLG systems, and 2) the most complete review of machine generated text detection methods to date. This survey places machine generated text within its cybersecurity and social context, and provides strong guidance for future work addressing the most critical threat models, and ensuring detection systems themselves demonstrate trustworthiness through fairness, robustness, and accountability. CCS Concepts: • Computing methodologies → Machine learning approaches; Neural networks; Natural language generation; • Security and privacy → Human and societal aspects of security and privacy.

Additional Key Words and Phrases: machine learning, artificial intelligence, neural networks, trustworthy AI, natural language generation, machine generated text, transformer, text generation, threat modeling, cybersecurity, disinformation   ... ' 

See also a Schneier summary, with thoughtful added comments. 

Top Phone Security Threats

Useful overview, security an increasing concern.    

Here are the top phone security threats in 2022 and how to avoid them  As reported in ZDNet

Your handset is always at risk of being exploited. Here's what to look out for.

Written by Charlie Osborne, Contributing Writer on July 23, 2022

Our mobile devices are now the keys to our communication, finances, and social lives -- and because of this, they are lucrative targets for cybercriminals. 

Whether or not you use a Google Android or Apple iOS smartphone, threat actors are constantly evolving their tactics to break into them. 

This includes everything from basic spam and malicious links sent over social media to malware capable of spying on you, compromising your banking apps, or deploying ransomware on your device. 

The top threats to Android and iOS smartphone security in 2022:  ... '

Social Engineering Kill-Chain

Threat intelligence community by Feedly

Social Engineering Kill–Chain: Predicting, Minimizing & Disrupting Attack Verticals in Ahead

Christina Lekati  on Jun 02, 2022

It was a Friday afternoon when Bill was on his way back home from work when he received a call that made him take the next U-turn back to his office. It was one of these calls that he was dedicating all of his working hours to avoid. He was not given much detail through the phone, but it seems that Andre, someone working in the account payments department, had just fallen victim to a scam and had proceeded to a hefty payment. A scam? Bill recalled all the training videos he had put this department through. What went wrong?

"They had inside information – it was so believable!" were some of Andre's first words when he saw Bill, the head of their cyber security team. Someone had called Andre a few minutes before his shift ended, claiming to be an employee from a partner company they had recently started collaborating with for an important project. The person on the call sounded distressed and almost panicked. They claimed that one of their invoices had not yet been paid. Since the project's next phase was scheduled to start on Monday, this was their last chance to get the payment through. Alternatively, they would have to temporarily freeze the project (which would have a domino effect on the project's overall timeline and deliverables). All of this sounded entirely plausible to Andre. They were indeed collaborating on the project the caller mentioned, the timeline was accurate, and the names the caller mentioned were indeed the project owners. The caller insisted on sending the invoice via email, and Andre processed that invoice. But he was left with a strange feeling. So he went back to his database and checked the account details. Sure enough, they were different. But it was too late.

Bill immediately realized -it was a spear-phishing attack combining vishing (a scam carried over the phone) and a potential phishing email (the attachment and overall email still needed to be examined). He now had to report the incident and investigate the matter. As the investigation later showed, the caller had spoofed the phone number and made it look as if the call was indeed coming from the partner company. That was also one of the main reasons Andre trusted that the call was a legitimate one and one of the main tools that cyber attackers utilize to initiate trust with their targets.

Protecting an organization from social engineering attacks is not an easy task. Rather, it is an asymmetric game in which information, education, and strategy are paramount. Social engineering is a pretty attractive option for cybercriminals. It is a low cost, low risk, and high reward approach. While security technology has been advancing, human vulnerabilities have remained the same. The stimulus-response effect in human triggers is consistent, and exploiting these vulnerabilities is consistently successful. It is not surprising, that most of our industry’s threat landscape reports or cybersecurity insight reports (including the ones from ENISA and the World Economic Forum) have been listing social engineering attacks and human errors as one of the top 3 threats during the past few years. This is not a trend that seems to be going away. Rather, it looks like cybercriminals continuously find more ways to exploit humans within their attack kill-chains.  ..... ' 

RiskIQ Looks at sites Targeting Ukraine

 Examining targeted Threat Intelligence

RiskIQ Threat Intelligence Roundup: Trickbot, Magecart, and More Fake Sites Targeting Ukraine 

APRIL 07, 2022,     BY TEAM RISKIQ

Threat intelligence is more crucial than ever to attack surface management and cyber resilience in today's volatile threat landscape. RiskIQ continues to leverage our global telemetry to develop relevant, actionable intelligence that gives security teams line-of-sight to attackers and threat systems and infrastructure.

This week's roundup again builds on powerful research published by the cybersecurity community about cyberattacks against Ukrainian citizens, refugees, and armed forces, including fraudulent sites attempting to fool people that want to donate money. It also breaks down new research in collaboration with the Microsoft Defender for IoT Section 52 research team about Trickbot malware targeting Mikrotik routers, updates with Magecart, and additional insight into nation-state activity targeting Chinese casinos.

What's New in C2

Trickbot Abuse of Compromised MikroTik Routers for Command and Control: In collaboration with Section 52, RiskIQ researchers investigated MikroTik routers acting as reverse proxies for Trickbot command and control (C2). Section 52's article details how threat actors compromise MikroTik devices and configure them to work as C2 reverse-proxies for Trickbot malware. We analyzed examples of compromised MikroTik routers in RiskIQ data and document indicators that can help identify devices under threat actor control.

Based on new findings, indicators surfaced by Section 52, and previous third-party research, RiskIQ created detection logic that enables our systems to flag compromised MikroTik routers working as communication channels for Trickbot C2. Be sure to read more about our findings and access the more than 70 new indicators in our Threat Intelligence Portal (TIP).

Recent Magecart-Injected URLs and C2 Domains: Today, digital credit skimming malware like Magecart affects hundreds of e-commerce sites and shouldn't be overlooked. February saw a wave of attacks, which showed "low-hanging fruit" is still available for these actors, which take advantage of new vulnerabilities and issues with plugins and other third-party code. Between March 15th and 21st, RiskIQ detected 149 Magecart and skimmer-injected URLs and 186 unique C2 domains used by known Magecart operatives.

A Closer Look at Campaigns Targeting Ukraine   (See remainder of article at link) 

Charging Stations Increasing Threats?

More is being talked about how changes in infrastructure will enable threats.    This is a good example of how such approaches can be examined.

ACM NEWS   Do EV Charging Stations Open the Power Grid to Attack?

By Paul Marks, Commissioned by CACM Staff, March 29, 2022

Forget about range anxiety, the fear you'll drive your electric vehicle (EV) too far to make it back home before running out of power. Another concern rearing its ugly head to drivers of electric cars now is the digital security of the charging stations where they may replenish their batteries when away from home.

Vulnerabilities in the complex software used to control charging stations, it turns out, could allow attackers to mount debilitating hacks on power grids, disrupting electrical supplies, or even taking them down completely.  

An international team of penetration testers reverse-engineered the way software at the mobile, Web, and embedded firmware levels is used to control commercial EV charging stations. The pentesters (penetration testers) found that Internet-connected EV Charging Station Management Systems (EVCSMS) that track and manage charging stations at drive-in sites were prone to a swathe of remote cyberattacks, some of them critical.

In addition to putting the power grid's stability at risk, some of the susceptibilities they identified could allow attackers to gain complete control of charging stations, letting them configure the systems as they wished—perhaps letting compatriots charge their EVs for free, or allowing them to claim illicit refunds. Some were also capable of being used as platforms from which distributed denial of service (DDoS) attacks could be mounted.

The research team published its findings in the January 2022 edition of peer-reviewed  journal Computers & Security, at a time when EV charging station networks are fast proliferating globally to service the switch from hybrid and gasoline cars to EVs, as governments the world over pursue net-zero carbon dioxide emissions by 2050.

In the U.S., for instance, the Biden administration introduced plans as part of the bipartisan Infrastructure Law passed by Congress in November 2021 to encourage American states to roll out no less than 500,000 new EV charging stations coast-to-coast by 2030, with $5 billion in seed funding available to help make it all happen.

Tony Nasr, a cybersecurity engineer at the Concordia Institute for Information Systems Engineering in Montreal, Canada, wondered what such massive growth in this specialized form of Internet-based infrastructure would mean for urban security, especially since the charger networks are fed by critical infrastructure we all depend on: the power grid.  

"Given the exponential growth in the number of EVs, and the resulting increase in the numbers of deployed EV charging stations, there is the utmost need to examine the cybersecurity of charging stations and their networks," Nasr says. 

So, alongside his Concordia colleagues Sadegh Torabi and Chadi Assi, plus Elias Bou-Harb at the University of Texas at San Antonio and Claude Fachka at the University of Dubai in the United Arab Emirates, Nasr set about finding out more about the risks. However, as EV charging stations are based on a blizzard of commercial products developed by a variety of international vendors, how could they even begin to assess their security?

Their answer was to harness "dorking"—a precision form of Websearch—to find functional details on the mobile app and Web-based components of some 15 EVCSMS applications, used to manage the charging devices, plus the embedded firmware, the charging stations they are installed in, and their networking capabilities. ... ' 

Serious Cyber Attacks Imminent?

 Given some of the strong language being used lately,  we should be aware of possible attacks on our key infrastructure, including power, water, internet and beyond.     There have seen some indications by Google and other players that they are sending ou emergency security updates and warnings.  Panic not advised, but do secure your key systems.  Imagine your world without an operational internet.     Here from the BBC an outline of key possibilities:  https://www.bbc.com/news/technology-60841924.

Microsoft Better Tighten Up

Good, they have gotten to some real issues far too late.  Being the premier general computational systems provider, they need to fix threats better and faster,  if they don't want to lose that distinction.   I still like microsoft's capabilities, but can see the slipping.  Ransomware and other related threats are a huge challenge.  Now. 

Microsoft acquires cybersecurity firm RiskIQ as the threat of ransomware intensifies

Microsoft is trying to tighten up its security

By Tom Warren@tomwarren  Jul 12, 2021, 11:48am EDT

Microsoft is officially acquiring RiskIQ, a security software vendor. RiskIQ provides management tools and threat intelligence gathering against a wide range of cyberattacks across Microsoft’s own cloud services, AWS, on-premises servers, and supply chain attacks. While Microsoft hasn’t valued the deal, Bloomberg reported that the company is said to be paying more than $500 million for RiskIQ.

The cloud-based RiskIQ software detects security issues across networks and devices, and the company lists Box, the US Postal Service, BMW, Facebook, and American Express as customers. RiskIQ was originally founded in 2009 and has gradually become an important player in analyzing security threats.

Microsoft hasn’t laid out a detailed plan for how it will integrate RiskIQ into its own security offerings, but it’s bound to utilize RiskIQ’s software across Microsoft 365 Defender, Microsoft Azure Defender, and Microsoft Azure Sentinel eventually.  .. ' 

Google's Method For Software Supply Chain Attacks

 Quite interesting  ...  a  'Software Supply Chain Attack', is inserting malware during its creation, transport or inclusion in some system. 

Google dishes out homemade SLSA, a recipe to thwart software supply-chain attacks  in TheRegister

Thomas Claburn in San Francisco Fri 18 Jun 2021 // 00:05 UTC

Google has proposed a framework called SLSA for dealing with supply chain attacks, a security risk exemplified by the recent compromise of the SolarWinds Orion IT monitoring platform.

SLSA – short for Supply chain Levels for Software Artifacts and pronounced "salsa" for those inclined to add convenience vowels – aspires to provide security guidance and programmatic assurance to help defend the software build and deployment process.

"The goal of SLSA is to improve the state of the industry, particularly open source, to defend against the most pressing integrity threats," said Kim Lewandowski, Google product manager, and Mark Lodato, Google software engineer, in a blog post on Wednesday. "With SLSA, consumers can make informed choices about the security posture of the software they consume."

Supply chain attacks – attempting to exploit weaknesses in the software creation and distribution pipeline – have surged recently. Beyond the SolarWinds incident and the exploitation of vulnerabilities in Apache Struts, there have been numerous attacks on software package registries like npm, PyPI, RubyGems, and Maven Central that house code libraries developers rely on to support complex applications.

According to security biz Sonatype [PDF], attacks on open source projects increased 430 per cent during 2020. One of the various plausible reasons is that compromising a dependency in a widely used library ensures broad distribution of malware. As noted in a 2019 TU Darmstadt research paper, the top five npm packages in 2018 "each reach between 134,774 and 166,086 other packages, making them an extremely attractive target for attackers."    ... ' 

Vinton Cerf Discusses CMEs

Vint Cerf Discusses a number of environmental dangers to the earth.   And in particular Coronal Mass Ejections (CME).   I recall that when our enterprise was thinking of using the internet for  transfer of data the potential dangers of CME was brought up.   And because of my background in astronomy I was asked for an opinion and researched it.  Even talked to a local electricity provider, who had barely heard of it.  It is one of those very real, but very rare extra-terrestrial events we should at least consider thinking about.  Been following it since then.  Cerf provides a good overview, intro below, more at the link.  

It Came From Outer Space!  By Vinton G. Cerf

Communications of the ACM, June 2021, Vol. 64 No. 6, Page 7  10.1145/3462461

 "   ... But there is another, less predictable but potentially equally devastating threat to our modern dependence on electricity. It goes by the name of coronal mass ejection (CME) and occurs sporadically as the sun burns its hydrogen into helium and heavier elements. A CME consists mostly of masses of ionized protons in a plasma that are ejected at high speed from the sun's corona and propagated outward by the solar wind. These ionized ejections create power magnetic fields, which themselves can induce large currents in electrical conductors. One of the best documented CMEs occurred on Sept. 1, 1859 and is known as the Carrington Event after the English astronomer, R.C. Carrington who, along with R. Hodgson, observed and reported the event. Telegraph equipment and wires were overheated and damaged over a wide area. Not all CMEs threaten the Earth; they must intercept Earth in its orbit to do damage. 

There have been subsequent events in 1921 and 1989, but of lower intensity and causing less damage than the 1859 event. We are, however, far more deeply dependent on electricity and its transport than ever in human history. In the parts of the planet that are most heavily electrified, we find increased dependence on electrical equipment, especially including computing and communications. Along with an enormous number of devices dependent on electricity, our communication systems, including satellites, ground radio transceivers, and optical fiber systems are at risk. Subsea optical fibers are especially vulnerable. The CME does not affect the optical fiber but could severely damage the electrically powered repeaters needed to reinforce optical signals for long haul cables.  ..."   (more) 

Re the Future of Info Warfare

Increasingly a dangerous direction. Need to  analyzse threats, determine risks and address appropriately. We have the skills, build ahead to emerging threats. 

DOD Isn't Armed to Combat Growing Threat of Info Warfare, Experts Warn  By The Washington Post

National security experts will warn Congress today that the U.S. government isn't doing enough to fight back against the growing national security threat of information warfare aimed at sowing distrust in the U.S. government at home and abroad.

"Cyber-enabled disinformation, whether domestically or foreign generated, is a national security problem, corroding our democracy and governmental institutions, and threatening our public health and, potentially, public safety," former NSA general counsel Glenn Gerstell will testify in front of the House Armed Services subcommittee on cyber, innovative technologies and information systems.

Other witnesses include Nina Jankowicz, a disinformation fellow at the Wilson Center; Herb Lin, senior research scholar at the center for international security and cooperation at Stanford University; as well as Joseph Kirschbaum, director of the defense capabilities and management team at the Government Accountability Office.

The hearing underscores how the United States has struggled to combat the emerging cyberthreat of information warfare.

From The Washington Post

Need for Continuous and Dynamic Threat Modeling

Well done post from Cisco, with useful explanatory visuals. Strongly agree. Using and applying specific risk models.

The Need for Continuous and Dynamic Threat Modeling  From Cisco

By Sujata Ramamoorthy

This blog is co-authored by Mohammad Iqbal and is part four of a four-part series about DevSecOps.

The trend towards accelerated application development, and regular updates to an architecture through an agile methodology, reduces the efficacy and effectiveness of point-in-time threat modeling. This recognition led us to explore and strategize ways to continuously, and dynamically, threat model an application architecture during runtime.

Today, thanks to a robust DevOps environment, developers can deploy a complex architecture within a public cloud such as Amazon Web Services (AWS) or Google Cloud Platform without requiring support from a network or database administrator. A single developer can develop code, deploy an infrastructure through code into a public cloud, construct security groups through code, and deploy an application on the resulting environment all through a continuous integration/continuous delivery (CI/CD) pipeline. While this enables deployment velocity, it also eliminates multiple checks and balances. At Cisco, we recognized the risks introduced by such practices and decided to explore strategies to continuously evaluate how an architecture evolves in production runtime to guard against architecture drift.

Dynamic threat modeling must begin with a solid baseline threat model that is done in real-time. This can in turn be monitored for architecture drift. Our approach to obtain such a real-time view is to use dynamic techniques to allow security and ops teams to threat model live environments instead of diagraming on paper or whiteboards alone.

How Does Dynamic Threat Modeling Work?

Threat modeling is the practice of identifying data flows through systems and various constructs within an architecture that exhibit a security gap or vulnerabilities. A crucial element that enables the practice of threat modeling is generating the right kind of visual representation of a given architecture in an accurate manner. This approach can differ based on context and from one team to another.  At Cisco, we instead focused on elements and features that need to exist to allow a team to dynamically perform a threat modeling exercise. These elements include the ability:  .... " 

Cyber Threats to Supply Chains

Schneier reports on the DNI annual assessment.  With lots of interesting comments and other coverage in his blog.   Would also like to emphasize supply chain implications.  We move so much, from raw materials to finished products, that these components have become major threat targets as well as new dimensions of needed security.    An  increasing amount of defining and supporting data also becomes a significant target that can be stolen or manipulated.   Below just a hint at consequences:

DNI’s Annual Threat Assessment

The office of the Director of National Intelligence released its “Annual Threat Assessment of the U.S. Intelligence Community.”   Cybersecurity is covered on pages 20-21. Nothing surprising:

Cyber threats from nation states and their surrogates will remain acute.

- States’ increasing use of cyber operations as a tool of national power, including increasing use by militaries around the world, raises the prospect of more destructive and disruptive cyber activity.

- Authoritarian and illiberal regimes around the world will increasingly exploit digital tools to surveil their citizens, control free expression, and censor and manipulate information to maintain control over their populations.

- During the last decade, state sponsored hackers have compromised software and IT service supply chains, helping them conduct operations — espionage, sabotage, and potentially prepositioning for warfighting.

The supply chain line is new; I hope the government is paying attention.  ... " 

IBM and Recorded Future Threat Webinar

Reported yesterday, have often mentioned Recorded Future now working with IBM on threat management here.  See upcoming Webinar, mentioned at the link.  

IBM Security and Recorded Future: Better Together  by Ellen Wilson

Today, IBM Security and Recorded Future are joining forces in a live webinar, Better Together: IBM Security + Recorded Future, to support security operations teams in developing an end-to-end threat management and security operations strategy. Now more than ever, speed to detect, investigate and remediate threats is key to reduce dwell time and impact of security cyberattacks. Register now to see how a tightly integrated end-to-end process of threat management can improve your team’s ability to make decisions quickly and mitigate risk.   ... '

MS Exchange Server, Patched Late

Why did it take so long for Microsoft to respond?    I have been getting updates, including I assume  patches, from Microsoft once a week since the beginning of the year.    ' Zero day', means there were existing potentially dangerous bugs at shipment,  ready to use.   And apparently known for some time to Microsoft.  

Microsoft Exchange Server Attack Escalation Prompts Patching Panic  By Kelly Sheridan   3/8/2021 in DarkReading

US government officials weigh in on the attacks and malicious activity, which researchers believe may be the work of multiple groups.

The critical Exchange Server vulnerabilities patched last week by Microsoft are being weaponized in widespread attacks against organizations worldwide. Attacks have escalated over the past two weeks, prompting responses from US government and the security community. 

News of the four vulnerabilities emerged on March 2, when Microsoft issued patches for CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. These flaws affect Microsoft Exchange Server versions 2013, 2016, and 2019, though the company notes Microsoft Exchange Server 2010 is being updated for Defense in Depth purposes. Exchange Online is not affected.

Microsoft, which learned of these vulnerabilities in early January, initially reported they were being exploited in "limited and targeted attacks" by Hafnium, a group it believes is state-sponsored and operates out of China. Officials said this was the only actor it had seen weaponizing these exploits, which it used to primarily target organizations in the US. 

But other security experts say there are likely multiple threat groups behind the wave of malicious activity going after Exchange Servers.

This activity accelerated toward the end of February, when Volexity researchers who found some of the zero-days noticed an increase in instances of remote code execution (RCE). In all cases, attackers were writing Web shells to disk and doing operations to dump credentials, add user accounts, steal copies of Active Directory databases, and move laterally to other systems.

What had previously been "low and slow" activity had quickly escalated into a lot of noise. 

"While it started out as targeted espionage campaign, they engaged in reckless and dangerous behavior by scanning/compromising Exchange servers across the entire IPv4 address space with webshells that can now be used by other actors, including ransomware crews," Dmitri Alperovitch, chairman of the Silverado Policy Accelerator and cofounder of CrowdStrike, said in a tweet.     ... " 

Microserver Exchange Server Attack

The Web Continues to move into a More Dangerous State

Microsoft Exchange Server Attack Escalation Prompts Patching Panic

US government officials weigh in on the attacks and malicious activity, which researchers believe may be the work of multiple groups.

The critical Exchange Server vulnerabilities patched last week by Microsoft are being weaponized in widespread attacks against organizations worldwide. Attacks have escalated over the past two weeks, prompting responses from US government and the security community. 

News of the four vulnerabilities emerged on March 2, when Microsoft issued patches for CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. These flaws affect Microsoft Exchange Server versions 2013, 2016, and 2019, though the company notes Microsoft Exchange Server 2010 is being updated for Defense in Depth purposes. Exchange Online is not affected.

Microsoft, which learned of these vulnerabilities in early January, initially reported they were being exploited in "limited and targeted attacks" by Hafnium, a group it believes is state-sponsored and operates out of China. Officials said this was the only actor it had seen weaponizing these exploits, which it used to primarily target organizations in the US.  ... '

Microsoft and McAfee headline newly-formed 'Ransomware Task Force'

Need new push forward to address these attacks.

Microsoft and McAfee headline newly-formed 'Ransomware Task Force'  (RTF) 

The newly-founded Ransomware Task Force will work to put together a standard framework for dealing with ransomware attacks. ... 

By Catalin Cimpanu 

Ransomware threats mean SMBs must focus on cyber basics

A group made up of 19 security firms, tech companies, and non-profits, headlined by big names such as Microsoft and McAfee, have announced on Monday plans to form a new coalition to deal with the rising threat of ransomware.

Everything you need to know about ransomware: how it started, why it's booming, how to protect against it, and what to do if your PC's infected.

Named the Ransomware Task Force (RTF), the new group will focus on assessing existing technical solutions that provide protections during a ransomware attack.  The RTF will commission expert papers on the topic, engage stakeholders across industries, identify gaps in current solutions, and then work on a common roadmap to have issues addressed among all members.

The end result should be a standardized framework for dealing with ransomware attacks across verticals, one based on an industry consensus rather than individual advice received from lone contractors.  ... ' 

Anomaly Detection with Lacework

Brought to my attention: 

Lacework covers topics and issues around threat defense, intrusion detection, cloud containers, workloads, accounts, devops, and more.

Anomaly Detection and Behavioral Analytics Focus on user and Application Behavior and how it changes over time. 

Identify and Analyze Anomalies in Cloud and Container Environments

Public clouds enable enterprises to implement infrastructure-as-code and allows them to rapidly develop, test, and deploy services at scale. In this environment, network resources are in constant flux, providing ample opportunities for attackers. Unfortunately, legacy security solutions are ill-equipped to handle these and leave organizations vulnerable. IT security teams need solutions that leverage anomaly detection to safeguard cloud data.

Employ Big Data to Do Security

Traditional security solutions rely on signatures, or rule-based approaches, where rules are readily understandable – but the drawbacks are that these rules are manually entered and do not catch new attack profiles. To reduce false-positive rates, the rules are often written for very well-defined threat scenarios, limiting their effectiveness in production environments. ... " 

Increasing Cyberattacks on Healthcare

Financial pressures likely.   How do address these increasing threats? 

As Coronavirus Cases Surge, So Do Cyberattacks Against the Healthcare Sector

By ZDNet, January 12, 2021

Healthcare organizations are being hit with cyberattacks.

Cybersecurity firm Check Point calculated a 45% increase in cyberattacks against the global healthcare sector since November.

Cybersecurity firm Check Point calculated a 45% increase in cyberattacks against the global healthcare sector since November, versus a 22% uptick against all worldwide industries over the same period.

Attack vectors include distributed denial-of-service hacks, social engineering, botnets, phishing, and ransomware. The last is particularly troubling, and Check Point researchers said the Ryuk ransomware strain is currently the most popular malware in such exploits, followed by Sodinokibi.

Overall, an average 626 attacks against healthcare organizations were recorded weekly in November, compared with 430 in October; most attacks are concentrated in Central Europe, rising 145% in the past two months, followed by East Asia, Latin America, and the rest of Europe and North America.

Check Point cited financial reasons behind the increase in cyberattacks, with malefactors hoping to profit from the Covid-19 pandemic's global turmoil.

From ZDNet, ACM

Small Data, Short Term Global Risks, GRR

 Nicely put, perhaps on every risk analysis we should list these calculate how they might be of threat to our contexts.   At the link below some good charts and analysis, plus links to much deeper analyses.

January’s most engrossing Small Data

The Global Risks Report   By David Aldous

As a mathematician of the old school, I don’t seek to engage Big Data. Instead, this post is about Small Data on a Big Subject. Each January since 2006 the annual Global Risks Report (GRR) has been published, as background material for the annual World Economic Forum (see Footnote 1 below). The reports are lengthy documents, freely available here  analyzing risks in the sense of events that would have substantial effect on the world economy over the next few years (“medium term”). The reports provide a consensus view derived from a large panel of experts. For my purpose here, the centerpiece is a graphic showing the perceived likelihood and economic effect of each of 36 risks (see Footnote 2). Look at this graphic below from January 2020 (or click this link).   .... '