Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label CISO. Show all posts
LLM security
AI Models AI technology AI tools CISO Cyber Security Cybersecurity Researchers GenAI Generative AI generative AI tools LLM LLM Model LLM security

Security Teams Struggle to Keep Up With Generative AI Threats, Cobalt Warns

 

A growing number of cybersecurity professionals are expressing concern that generative AI is evolving too rapidly for their teams to manage. 

According to new research by penetration testing company Cobalt, over one-third of security leaders and practitioners admit that the pace of genAI development has outstripped their ability to respond. Nearly half of those surveyed (48%) said they wish they could pause and reassess their defense strategies in light of these emerging threats—though they acknowledge that such a break isn’t realistic. 

In fact, 72% of respondents listed generative AI-related attacks as their top IT security risk. Despite this, one in three organizations still isn’t conducting regular security evaluations of their large language model (LLM) deployments, including basic penetration testing. 

Cobalt CTO Gunter Ollmann warned that the security landscape is shifting, and the foundational controls many organizations rely on are quickly becoming outdated. “Our research shows that while generative AI is transforming how businesses operate, it’s also exposing them to risks they’re not prepared for,” said Ollmann. 
“Security frameworks must evolve or risk falling behind.” The study revealed a divide between leadership and practitioners. Executives such as CISOs and VPs are more concerned about long-term threats like adversarial AI attacks, with 76% listing them as a top issue. Meanwhile, 45% of practitioners are more focused on immediate operational challenges such as model inaccuracies, compared to 36% of executives. 

A majority of leaders—52%—are open to rethinking their cybersecurity strategies to address genAI threats. Among practitioners, only 43% shared this view. The top genAI-related concerns identified by the survey included the risk of sensitive information disclosure (46%), model poisoning or theft (42%), data inaccuracies (40%), and leakage of training data (37%). Around half of respondents also expressed a desire for more transparency from software vendors about how vulnerabilities are identified and patched, highlighting a widening trust gap in the AI supply chain. 

Cobalt’s internal pentest data shows a worrying trend: while 69% of high-risk vulnerabilities are typically fixed across all test types, only 21% of critical flaws found in LLM tests are resolved. This is especially alarming considering that nearly one-third of LLM vulnerabilities are classified as serious. Interestingly, the average time to resolve these LLM-specific vulnerabilities is just 19 days—the fastest across all categories. 

However, researchers noted this may be because organizations prioritize easier, low-effort fixes rather than tackling more complex threats embedded in foundational AI models. Ollmann compared the current scenario to the early days of cloud adoption, where innovation outpaced security readiness. He emphasized that traditional controls aren’t enough in the age of LLMs. “Security teams can’t afford to be reactive anymore,” he concluded. “They must move toward continuous, programmatic AI testing if they want to keep up.”
Read more »
karnataka
CISO Cyber Crime Digital Security karnataka

Karnataka Sets Up India’s First Cyber Command Centre to Tackle Online Crimes

 


Karnataka has taken a big step to fight the rising number of online crimes. It has launched the country’s first Cyber Command Centre. This new centre will handle all matters related to cyber safety and crime under one roof. It aims to respond faster and more effectively to online threats.

The number of cybercrime cases in the state has grown a lot in the past three years. In 2022, about 18,000 cases were reported. That number rose to 22,000 in 2023 and around 23,000 in 2024. In total, Karnataka has seen over 60,000 cybercrime cases in just three years. Officials say that 20% of all cybercrime cases in India are reported from this state.

These cases include many serious issues. Some examples are online scams, hacking, blackmail, cyberstalking, fake news, and financial fraud. Crimes targeting women and children have also increased. Criminals are using fake profiles, deepfakes, and other tricks to fool people and steal their money or personal data.

A senior officer explained that many of these crimes are hard to solve. Very few cases are taken to court, and almost none end in punishment. There is also concern that many investigating officers do not have the right training to deal with high-tech crimes. To fix this, the new command centre will provide special training for both police and legal teams.

The new command will also focus on protecting the state’s digital systems. A major hacking incident recently affected the Kaveri 2.0 portal, which is used for property records. This caused major delays and losses for the state government. Officials say such incidents show how important it is to secure public digital platforms.

The officer leading this new centre is Pronab Mohanty. He is already in charge of internal security and cybercrime for the state. Now, all 45 cyber police stations in Karnataka will report directly to him. This central system is expected to improve coordination and case tracking.

The officer will also serve as the Chief Information Security Officer, or CISO, for Karnataka. That means he will look after both investigations and the security of government digital systems.

The goal of the Cyber Command Centre is not just to track and stop cybercriminals, but to make sure they face legal action. Officials believe that stronger action and more convictions will help create fear among those involved in online crimes.

This new setup could become a model for other states to follow. As cybercrime spreads its rampant growth across India, Karnataka’s decision to create a single, expert-led team could lead the way for better digital safety in the country.


Read more »
Security Issues
CISO CVE vulnerability CVEs Cyber Security Hacking News Information Security IT Security Security Issues

Cisco Fixes Critical CVE-2024-20418 Vulnerability in Industrial Wireless Access Points

 

Cisco recently disclosed a critical security vulnerability, tracked as CVE-2024-20418, that affects specific Ultra-Reliable Wireless Backhaul (URWB) access points used in industrial settings. These URWB access points are essential for maintaining robust wireless networks in environments like manufacturing plants, transportation systems, and other infrastructure-intensive industries. The vulnerability allows remote, unauthenticated attackers to perform command injection attacks with root privileges by exploiting the device’s web-based management interface. 

This vulnerability results from inadequate validation of input data within Cisco’s Unified Industrial Wireless Software, specifically affecting the web management interface of URWB access points. By sending specially crafted HTTP requests, attackers could exploit this flaw to execute arbitrary commands with root-level access, potentially leading to unauthorized control over the device. This level of access could compromise critical network infrastructure, posing serious risks to businesses relying on URWB technology for uninterrupted connectivity. The vulnerability specifically impacts Cisco Catalyst models IW9165D, IW9165E, and IW9167E when URWB mode is enabled. 

For users concerned about their device’s security, Cisco advises checking vulnerability status by using the “show mpls-config” command in the command-line interface (CLI). If the command confirms URWB mode is active, the device may be vulnerable to potential attacks. Cisco’s Product Security Incident Response Team (PSIRT) has stated that it is not aware of any instances of this vulnerability being actively exploited in real-world scenarios. However, given the nature of this vulnerability, Cisco urges users to update their devices promptly to mitigate the risk. Currently, Cisco has not issued workarounds for this issue. 

As a result, companies relying on these models are advised to stay alert for firmware updates or patches that Cisco may release to resolve the vulnerability. The lack of a temporary fix underlines the importance of applying any future updates immediately, especially as remote exploitation could have significant consequences for the affected systems. For organizations using these Cisco models, securing network access and strengthening device-level defenses can be critical in mitigating potential risks. Limiting access to the web-based management interface, monitoring device activity, and conducting frequent security audits are some proactive steps administrators can take. These actions may help limit exposure while waiting for Cisco’s permanent fix. This incident serves as a reminder of the evolving threat landscape in industrial and operational technology environments. 

As organizations adopt more wireless technologies to improve operational efficiencies, the need for robust cybersecurity practices is crucial. Regularly updating network devices and addressing vulnerabilities promptly are fundamental to protecting systems from cyber threats. Cisco’s disclosure of CVE-2024-20418 underscores the vulnerabilities that even the most reliable industrial-grade devices can exhibit. It also highlights the critical importance of proactive device management and security measures in preventing unauthorized access. Industrial environments should consider this a timely reminder to prioritize cybersecurity protocols across all network-connected devices.
Read more »
security leaders
AI Attacks AI cybersecurity CISO Cyber Security Cyberattack threats Ransomwares security leaders

The Cybersecurity Burnout Crisis: Why CISOs Are Considering Quitting

 

Cybersecurity leaders are facing unprecedented stress as they battle evolving threats, AI-driven cyberattacks, and ransomware. A recent BlackFog study reveals that 93% of CISOs considering leaving their roles cite overwhelming job demands and mental health challenges. Burnout is driven by long hours, a reactive security environment, and the increasing complexity of threats. Organizations must prioritize support for their security teams through flexible work options, mental health resources, and strategic planning to mitigate burnout and retain talent. 

The Rising Pressure on Cybersecurity Leaders The role of the Chief Information Security Officer (CISO) has drastically evolved. They now manage increasingly sophisticated cyberthreats, such as AI-driven attacks and ransomware, in an era where data security is paramount. The workload has increased to unsustainable levels, with 98% of CISOs working beyond contracted hours. The average CISO adds 9 hours a week, and some are clocking over 16 hours extra. This overwork is contributing to widespread burnout, with 25% of CISOs actively considering leaving their roles due to overwhelming stress. The high turnover in this field exacerbates existing security vulnerabilities, as experienced leaders exit while threats grow more sophisticated. 

CISOs face ever-evolving cyberthreats, such as AI-powered attacks, which are particularly concerning for 42% of respondents. These threats use advanced machine learning algorithms to bypass traditional security measures, making them hard to detect and neutralize. Additionally, ransomware is still a major concern, with 37% of CISOs citing it as a significant stressor. The combination of ransomware and data exfiltration forces organizations to defend against attacks on multiple fronts. These heightened risks contribute to a work environment where cybersecurity teams are continually reactive, always “putting out fires” rather than focusing on long-term security strategies. This cycle of incident response leads to burnout and further stress. 

Burnout doesn’t just affect productivity; it also impacts the mental health of CISOs and security teams. According to the study, 45% of security leaders admit to using drugs or alcohol to cope with stress, while 69% report withdrawing from social activities. Although some prioritize physical health—86% allocate time for exercise—many CISOs are still struggling to maintain work-life balance. The emotional toll is immense, with security professionals experiencing the pressure to protect their organizations from increasing cyberthreats while facing a lack of sufficient resources and support. 

To combat the burnout crisis and retain top talent, organizations must rethink their approach to cybersecurity management. Offering flexible work hours, remote work options, and additional mental health resources can alleviate some of the pressure. Companies must also prioritize long-term security planning over constant reactive measures, allowing CISOs the bandwidth to implement proactive strategies. By addressing these critical issues, businesses can protect not only their security infrastructure but also the well-being of the leaders safeguarding it.
Read more »
Ransomware
CISO cyber theft Cyberattacks Cybersecurity Data Breach Deloitte Ransomware

Cyber Theft Hits Providence School District Data

 


On Friday, Providence Public School officials were on their way to finalizing an agreement about credit monitoring for the district's teachers and staff following a recent ransomware attack on the district's network that affected teachers and staff last Friday. Then, over the weekend, information about the theft of data from Providence Public School District (PPSD) was shown on a regular website with a video preview. 

A cybercriminal group called Medusa appears to have taken control of the dark web ransom page where the 201 gigabytes of data from the CIA were allegedly leaked by cybercriminals in September, simply because they can access it through any internet browser. The district hired an undisclosed "vendor with expertise in cyber-security" to conduct an ongoing analysis of the network and audit it on behalf of a third-party IT agency. 

This cyberattack was reported to the FBI, the Department of Homeland Security, and the Rhode Island State Police. It took the district until now to disclose the nature of the security breach, as there has been a tight-lipped stance on the matter. On Sept. 11, IT staff was instructed to shut down the entire network as a result of abnormal activity that was detected, and they wouldn't be able to provide any further details. More than a week has passed since teachers and students were unable to access online curriculum, email, or use computers. 

As the district works on forensics to determine what caused the breach, a credit monitoring agreement has been finalized with a vendor not yet identified and a letter containing information about how staff can access these services is being written for distribution to employees “very soon,” district spokesperson Jay G. Wégimont said in a letter to staff. According to BCC spokesperson Brian Hodge, the Rhode Island Attorney General’s office still has not been officially notified of the data breach and is awaiting formal notification from the company.

Upon confirmation of a breach of personal information, any municipal or government agency must notify the Attorney General's office, credit reporting agencies, and individuals affected by the breach within 30 days of the incident. In a letter from Superintendent Javier Montaez to the Providence School Board on Sept. 25, the PPSD first used the term "unauthorized access" to refer to the breach, though the term "breach" was also used in the public statement that the Providence School Board issued on September 18.

It is "encouraging" that the Providence school district is informing potentially affected employees and finalizing the credit monitoring contract as soon as possible, spokeswoman Anthony Vega said in an email sent to Rhode Island Current on Tuesday, that he received from the mayor. It was reported in an e-mail sent by a spokesperson for the Providence City Council that the council would not be able to comment. Despite requests for comment, the governor's office did not get back to the Guardian with a response. 

Despite repeated requests for comment from Rhode Island Current, Rogel has not responded to any of those requests. There seemed to be a discrepancy between the school board president's use of the term "breach" and that of the district's official language which avoided stating the exact nature of the problem. The PPSD community was informed on Sept. 12 that the district's network had experienced "irregular activity," which ultimately led computer staff to cut off internet access to the district's offices and schools across the district. 

There is still a large lack of broadband availability in Providence schools, aside from a fleet of WiFi hotspots that are being deployed to provide connectivity in the absence of a main network. There was a letter from PPSD to residents sent on Sept. 16 informing them that a forensic analysis was still being conducted and that no evidence had been found that PPSD data had been compromised.  

However, Medusa appeared to claim credit for the "irregular activity" on Monday by posting a message to their publicly accessible ransom blog claiming 41 watermarked, sometimes partially obscured screenshots that preview the contents of the 201 gigabytes of data that the hackers claim to have stolen. The hackers also included identifying information — including serial numbers of employee cell phones and parent contact information — that helped identify the content of the data.   

Medusa ransomware is an extremely dangerous malware that works quietly in the background after it has penetrated a system and accumulated exploitable data. Once the bounty has reached a sufficient amount, the database will encrypt the files to prevent users from accessing them. Ransom notes are then sent to victims demanding that they pay a ransom in exchange for the release of their files. There has also been a growing trend of "double extortion", where the hackers are not only stealing files but are also selling or releasing the data to the public if they do not receive payment.   

A ransom page indicates that, in exchange for a payment of $1 million, PPSD can retrieve or delete its data. An additional day would be added to the timer if $100,000 was paid. Based on the hackers' countdown timer, the deadline for submitting the hack will be Sept. 25 in the morning.  Deloitte, however, released a report on Monday showing that state-level IT officials and security officers are unsure about the budgets that will be allocated to their state's telecommunications network infrastructure due to the uncertainty around it. 

"The attack surface is increasing as state leaders become more reliant on information when it comes to operating government itself as the use of information is becoming more central," Srini Subramanian, a principal at Deloitte & Touche LLP, told States Newsroom in an interview. Chief information security officers (CISOs) face an increasing number of challenges, and they have to make sure that the IT infrastructure survives ever-increasing cyber threats posed by hackers. This difficulty was reflected in the survey results, which revealed that almost half of all respondents did not know their state's cybersecurity budget, which resulted from these challenges. Around 40% of state IT officers reported that they needed more money to comply with regulations or meet other legal requirements to comply with government regulations. 

Those findings were confirmed this year by a report published by Moody's Ratings in 2023, which scores and analyzes municipal bonds. Robust cybersecurity practices can reduce exposure to threats to the enterprise, but initiatives that are difficult to implement and take resources away from core business functions may pose a credit challenge, according to Gregory Sobel, a Moody analyst and assistant vice president.

One study by Moody's also revealed that 92% of local governments have cyber insurance, an unprecedented two-fold increase over the last five years, according to Moody's. It is important to note that the popularity of this system did come with higher rates: a county in South Carolina went from paying a $70,000 premium in 2021 to a $210,000 premium in 2022 for this system. Aside from the higher costs, there are also stricter stipulations on risk management practices that need to be followed before a policy can be paid, such as better firewalls, consistent data backups, and multi-factor authentication, all of which make it difficult to get it to pay out. 

During an email exchange with Rhode Island Current, Douglas W. Hubbard, CEO of Hubbard Decision Research, a consulting firm, and the author of “How to Measure Anything in Cybersecurity Risk,” informed the paper that schools should make use of the low-cost, free, or shared resources available to them to manage cyber risk more effectively.
Read more »
Marketing
Advertising CISO Cybersecurity influencers Marketing

Why Trust Drives the Future of Cybersecurity Marketing

 




With the changing nature of threats in cyberspace becoming sharper by the day, business houses are seen as shy about entrusting their precious data to the cybersecurity firm of choice. Shallow, flashy, and blanket marketing tactics that worked a few years ago are increasingly losing their impact. It is against this backdrop that demand for trust-based marketing continues to increase within the precincts of the cybersecurity industry.


Role of Trust in Cybersecurity Marketing

Unlike manufactured goods, cybersecurity services offer safety and security. It is the customers-again, usually major decision-makers like CISOs or CTOs, though-with their wallets, on companies that demonstrate real acumen and trustworthiness. More specifically, as threats increasingly complicated nature, those companies need to be perceived as forward-thinking in terms of embracing and addressing new threats.


Tacky ad campaigns and blanket marketing initiatives will have a hard time breaking into the space needed to develop that feel of trust. Cybersecurity customers will respond less to bright colours and more to the content marketing strategy: one that focuses on distributing utility-laden articles, case studies, webinars, and other materials that can inform.


This strategy enables companies to reach maturity with credibility as a thought leader, comforting clients that they are one step ahead of cyber threats.


Flaws of the Old Advertising Model

Traditional advertising is, therefore, ineffective for many in cybersecurity. Ads are saturated, and the "fatigue" caused by overexposure leads potential clients to dismiss or simply ignore them. Added to increasing scepticism surrounding inflated or erroneous advertisements, especially within cybersecurity, can cause damage. Customers want to see authentic, transparent marketing approaches. Approaches that are not authentic fall short within an industry where trust is paramount.


In response to the above issues, many firms now rely extensively on recommendations from key industry personalities. Here is where influencer marketing comes in as one of the most effective ways through which brands can reach customers based on authentic and knowledgeable voices.


Industry Experts Influence

Those authentic influencers in cybersecurity will bring a specific value by discussing insights with followers who trust their words already. Companies engaged in cybersecurity will then have the chance to reach the stakeholders when they team up with such influencers. This is how they come into audiences that are more open to the knowledge of solutions that the company has. These influencers can help dilute complex information, which may make it accessible to a client and, consequently, reinforce the authority of that brand in the field.


Challenges of Choosing the Correct Influencers

It is even more challenging than in other sectors to select the right influencer because the industry demands very high expertise and credibility. In identifying influencers, companies need to consider those whose audiences are high-level decision-makers with a real interest in cybersecurity solutions. The number of followers is irrelevant; reputation and history of creating relevant, correct content are critical. Misaligned partnerships waste resources, but more importantly, they can affect the reputation of the brand if the influencer lacks credibility.


Simplify this: many companies use influencer marketing platforms. They vet influencers, understand engagement metrics, and help companies reach the right influencers-that is, reach CISOs, CTOs, or other key decision-makers.


Technology for Influencer Marketing Optimization 

For instance, there is Presspool.ai that offers platforms whereby the companies in cybersecurity can connect with verified influencers. Through data-driven insights for effective engagement, it works on spotting effective influencer partnerships, which then these systems identify influencers who have audiences that benefit the brand's objectives when using them based on an analysis of engagement data.


This data-driven approach helps firms track the performance of each campaign in real-time. Conversion and engagement levels evaluate the performance of every campaign, thereby enabling companies to target with maximum effect and guarantee a high return on investment. These insights make influencer marketing efficient and scalable.


Influencer Marketing: The Future Focus for Cybersecurity

With careful usage, influencer marketing creates great benefits for cybersecurity businesses. It brings them closer to the most intent clients-by those who are looking for cybersecurity-through a trusted voice. Here's an example; if a highly respected influencer supports a product then his followers will look and consider the solution much more seriously because it has been reviewed by a respected voice.


Additionally, these influencers teach potential clients the deconstructed version of complicated cybersecurity concepts and facilitate building credibility toward the brand as a thought leader. Not only will this create trust but also will make the clients perceive the company as an industry leader committed to the ongoing advancement of cybersecurity.


Authenticity and Analytics Are the Keys

This is a world of cyber security and a traditional ad won't work and the clients look for real voices. Here, influencer marketing can fill the gap so that a company may establish meaningful relationships through the voice of trusted figures as it changes their approach of establishing credibility in the field.

Influencer marketing platforms, through real-time data, will make these partnerships measurable and adaptable to a trust-based marketing approach rather than an ad-centric approach. Trust is now the bed on which influencer marketing will play a major role in shaping cybersecurity marketing for the future.


Read more »
Ransomwares
CISO Cyber Security cybersecurity solutions Healthcare Healthcare Cyberattacks IT Infrastructure Ransomware attack Ransomwares

Preparing Healthcare for Ransomware Attacks: A 12-Step Approach by Dr. Eric Liederman


Dr. Eric Liederman, CEO of CyberSolutionsMD, emphasizes that healthcare organizations must be prepared for ransomware attacks with a structured approach, describing it as akin to a “12-step program.” He highlights that relying solely on protective measures is insufficient since all protections have the potential to fail. Instead, planning and creating a sense of urgency is key to successfully handling a cyberattack. 

According to Liederman, organizations should anticipate losing access to critical systems and have a strategic recovery plan in place. One of the most important components of such a plan is designating roles and responsibilities for the organization’s response. During an attack, the Chief Information Security Officer (CISO) essentially takes on the role of CEO, dictating the course of action for the entire organization. Liederman says the CISO must tell people which systems are still usable and what must be shut down. 

The CEO, in this situation, plays a supporting role, asking what’s possible and what needs to be done to protect operations. A significant misconception Liederman has observed is the assumption that analog systems like phones and fax machines will continue functioning during a ransomware attack. Often, these systems rely on the same infrastructure as other compromised technology. For example, phone systems that seem analog still resolve to an IP address, which means they could be rendered useless along with other internet-based systems. 

Even fax machines, commonly thought of as a fail-safe, may only function as copiers in these scenarios. Liederman strongly advises healthcare institutions to conduct thorough drills that simulate these kinds of disruptions, enabling clinical and IT staff to practice workarounds for potentially critical outages. This level of preparation ensures that teams can still deliver care and operate essential systems even when technological resources are down for days or weeks. 

In terms of system recovery, Liederman encourages organizations to plan for bringing devices back online securely. While the need to restore services quickly is essential to maintaining operations, the process must be carefully managed to avoid reinfection by the ransomware or other vulnerabilities. Given his extensive experience, which includes almost two decades at Kaiser Permanente, Liederman advocates for resilient healthcare IT infrastructures that focus on readiness. This proactive approach allows healthcare organizations to mitigate the potential impacts of cyberattacks, ensuring that patient care can continue even in worst-case scenarios.
Read more »
Technology
advanced technologies Artifical Inteliigence CISO Technology

CISO Role Expands as Cybersecurity Becomes Integral to Business Strategy

Over the past decade, the role of Chief Information Security Officers (CISOs) has expanded significantly, reflecting cybersecurity’s growing importance in corporate governance and risk management. Once primarily responsible for managing firewalls and protecting data, CISOs now play a critical role in shaping business strategies and aligning cybersecurity with broader company objectives. 

This evolution is underscored by increasing industry investment, as Gartner predicts that global spending on security and risk management will rise by 14.3 per cent this year, surpassing USD 215 billion. CISOs are no longer viewed solely as technical experts. 

Today, they are seen as strategic business leaders, responsible for driving business success by mitigating cyber risks and enhancing security measures to support long-term goals. 

As Saugat Sindhu, Partner and Global Head of Advisory Services for Cybersecurity & Risk Services at Wipro Limited, explains, “CISOs can shift from being seen as technical experts to strategic business leaders by building awareness and translating technical risks into business terms that are understandable for board members and executives.” 

This shift is essential for gaining leadership buy-in and ensuring that cybersecurity supports overall business growth. Emerging technologies such as generative AI are further transforming the CISO’s role. A recent ISC2 survey found that 88 per cent of cybersecurity professionals believe AI will significantly impact their roles, either now or in the near future. 

CISOs must continually educate themselves and their teams to stay ahead, integrating advanced technologies into cybersecurity strategies to strengthen security and drive business goals. To successfully transition from a technical to a strategic role, CISOs should adopt three key strategies.  

First, they need to shift from being purely “tech guardians” to becoming enablers of business growth, understanding how cybersecurity can help their companies gain a competitive edge. Second, they must build strong partnerships with senior leaders like the CFO and CRO to integrate cybersecurity into the company’s risk management framework and secure the necessary resources. 

Finally, CISOs should foster a culture of continuous learning and awareness across the workforce, ensuring all employees are equipped to handle emerging cyber threats.
Read more »
Subscribe to: Posts (Atom)