whitepaper - Jason’s Feed

Security Awareness Training: Snoozefest or Superhero Training?

Today we will review a new study that was recently released: Understanding the Efficacy of Phishing Training in Practice.

Here is an ai generated podcast summary of the paper, but also below is a great overview.

Mandatory security awareness training sounds about as fun as watching paint dry! It’s no surprise that employees aren’t exactly jumping for joy at the thought of completing these modules. And let’s be honest, who can blame them?

The study at UCSD Health suggests that these annual training sessions might not be worth the time and effort. Employees who completed the training were just as likely to fall for phishing scams as their colleagues who hadn’t. It’s like sending someone to a self-defense class where they learn all the moves but still get knocked out in the first round.

The sources also question the effectiveness of embedded phishing training. This type of training is supposed to be more engaging because it’s delivered in the moment when an employee clicks on a phishing link. The idea is to create a “teachable moment.” The problem is that most employees simply aren’t paying attention! Many close the training window immediately, and less than a quarter actually bother to complete the modules. It seems that getting tricked into clicking a phishing link isn’t enough of a wake-up call to get people to invest in their cybersecurity education!

However, there is a glimmer of hope in the sources. The UCSD Health study found that interactive training, where employees have to answer questions about phishing warning signs, was more effective than simply presenting them with information about phishing. Think of it as the difference between reading a textbook about swimming and actually getting in the pool with a coach. Hands-on experience tends to be more effective.

But even the most interactive training won’t help if employees aren’t paying attention. The sources suggest that organizations should explore new ways to make training more engaging and relevant to employees’ daily work. Maybe gamification, personalized content or even a little friendly competition could spice things up.

In the end, the sources argue that organizations need to go beyond training and implement stronger technical measures to protect their employees. Think of it this way: It’s great to teach people how to avoid poison ivy, but it’s even better to build a fence around the patch! Technical solutions like multi-factor authentication can provide an extra layer of protection that doesn’t rely solely on human vigilance.

Cloudy With a Chance of Hackers: Key Takeaways from the IBM X-Force Cloud Threat Landscape Report 2024

Hold onto your hard drives, folks, because the cloud, as convenient as it is, isn’t exactly a hacker-free haven. The IBM X-Force Cloud Threat Landscape Report 2024 is here to remind us that while cloud computing might be soaring to new heights (think USD 600 billion!), so are the threats targeting it.

Let’s break down the key takeaways with a dash of wit and a sprinkle of cybersecurity wisdom:

XSS is the MVP (Most Valuable Vulnerability): Move over, gaining access, there’s a new vulnerability in town. Cross-site scripting (XSS) vulnerabilities made up a whopping 27% of newly discovered CVEs. This means hackers can potentially snag your session tokens or redirect you to shady websites faster than you can say “two-factor authentication.”
Cloud Credentials: A Buyer’s Market: It seems the dark web is having a clearance sale on compromised cloud credentials. While demand is steady, the price per credential has dipped by almost 13% since 2022. This suggests a possible oversaturation of the market, but don’t let that lull you into a false sense of security!
File Hosting Services: Not Just for Cat Videos Anymore: Hackers are getting creative (and sneaky) with trusted cloud-based file hosting services like Dropbox, OneDrive, and Google Drive. They’re using them for everything from command-and-control communications to malware distribution. Even North Korean state-sponsored groups like APT43 and APT37 are in on the action.
Phishing: The Bait Never Gets Old: It’s official: phishing is the reigning champion of initial attack vectors, accounting for a third of all cloud-related incidents. Attackers are particularly fond of using it for adversary-in-the-middle (AITM) attacks to harvest those precious credentials.
Valid Credentials: The Keys to the (Cloud) Kingdom: Overprivileged accounts are a hacker’s dream come true. In a surprising 28% of incidents, attackers used legitimate credentials to breach cloud environments. Remember folks, with great power (or access privileges) comes great responsibility (to secure them!).
BEC: It’s Not Just About the Money: Business email compromise (BEC) attacks are also after your credentials. By spoofing email accounts, hackers can wreak havoc within your organization. And they’re quite successful, representing 39% of incidents over the past couple of years.
Security Rule Failures: The Achilles’ Heel of the Cloud: The report highlights some common security misconfigurations, particularly in Linux systems and around authentication and cryptography practices. These failures scream opportunity for hackers, so tighten up those security settings!
AI: The Future of Cyberattacks (and Defense): While AI-generated attacks on the cloud are still in their infancy, the potential is there. Imagine AI crafting hyper-realistic phishing emails or manipulating data with terrifying efficiency. On the bright side, AI can also be a powerful ally in defending against these threats.

The bottom line? The cloud is a powerful tool, but it’s not invincible. Organizations must be proactive in implementing robust security measures, including:

Strengthening identity security with MFA and passwordless options
Designing secure AI strategies
Conducting comprehensive security testing
Strengthening incident response capabilities
Protecting data with encryption and access controls

So, there you have it, a whirlwind tour of the cloud threat landscape. Stay informed, stay vigilant, and maybe invest in a good cybersecurity course. Your data (and sanity) will thank you!

Google’s Cybersecurity Forecast 2025: Key Takeaways

The Google Cloud Cybersecurity Forecast 2025 report offers insights into the evolving cybersecurity landscape and predicts key trends for the upcoming year. The report, drawing on the expertise of Google Cloud security leaders and researchers, highlights the growing role of artificial intelligence (AI), escalating cybercrime, and geopolitical influences on cybersecurity. Here’s a summary of some of the key predictions:

AI Generated Podcast

Cybersecurity Landscape Shifts: Key Takeaways from Microsoft’s 2024 Digital Defense Report

Summary: The Microsoft Digital Defense Report 2024 provides an overview of the evolving cyber threat landscape and offers guidance for organizations to improve their security posture. The report examines a range of threats, including nation-state attacks, ransomware, fraud, identity and social engineering, and DDoS attacks. It also explores the use of AI by both defenders and attackers and discusses the importance of collective action to address cybersecurity challenges. Key takeaways include the rising sophistication of cybercrime, the need for robust deterrence strategies, the importance of strong authentication, and the potential impact of AI on cybersecurity.

AI created podcast of this white paper:

Key Developments:

The State of Mobile Security: Verizon Index Reveals Alarming Trends

Your phone is an extension of yourself, but it’s also a gateway to your personal data. Unfortunately, many of us are leaving our digital doors wide open – and the consequences can be devastating. The latest Verizon Mobile Security Index sheds light on some alarming trends in mobile security, from password pitfalls to app vulnerabilities. In this post, we’ll explore what you need to know about keeping your phone (and yourself) safe online.

Here is a 15 minute podcast summarizing the report created by NotebookLM.

Here are the key findings:

Here is a summary of the findings in the 2024 Verizon Mobile Security Index:

Mobile devices and the Internet of Things (IoT) are becoming increasingly important in all industries because they offer new opportunities for efficiency, productivity, and innovation.
The widespread adoption of mobile and IoT is expanding the attack surface and increasing security risks. Attackers can exploit vulnerabilities in these devices to gain access to sensitive data, disrupt operations, and even cause physical harm.
This risk is especially high in critical infrastructure sectors such as energy, public sector, healthcare, and manufacturing. Attacks on these sectors can have significant downstream impacts on society.
Despite growing awareness of these risks, many organizations are not doing enough to secure their mobile and IoT devices. Many organizations lack comprehensive security policies, centralized oversight, and adequate security investments.
There is a disconnect between the perceived and actual state of mobile security. While many respondents express confidence in their mobile defenses, the data suggests that many organizations are vulnerable to attack. For example, a significant number of organizations have experienced security incidents involving mobile or IoT devices.
Shadow IT is a growing concern, as employees use their own devices and applications for work without the knowledge or oversight of IT or security teams. This lack of visibility and control increases the risk of security breaches.
Organizations need to take mobile and IoT security more seriously. They need to:
- Develop comprehensive security policies that cover all aspects of mobile and IoT security.
- Centralize oversight of all mobile and IoT projects.
- Invest in effective security solutions such as mobile device management (MDM), secure access service edge (SASE), and zero trust security.
- Educate employees about the risks of mobile and IoT security and how to protect themselves.
The use of artificial intelligence (AI) by threat actors is an emerging threat. AI-assisted attacks can be more sophisticated, targeted, and difficult to defend against. Organizations need to be prepared for this new generation of threats.
AI can also be used to enhance mobile and IoT security. AI-powered security solutions can help organizations to detect and respond to threats more quickly and effectively.
The cybersecurity industry is making progress in developing new technologies and solutions to address the challenges of mobile and IoT security. These advancements will help organizations to better protect their mobile and IoT devices and data.
The report highlights the importance of taking a proactive and comprehensive approach to mobile and IoT security. By taking the necessary steps, organizations can mitigate the risks associated with these technologies and reap the many benefits they offer.