STE WILLIAMS

You all know why you should encrypt your cloud data – now learn where and how…

Promo You know it makes sense to go to the cloud, and you know it makes sense to encrypt your data. But just what should you be encrypting – and where? And what’s the most efficient way of carrying it out, and managing your encryption strategy in the future?

If these are the sort of questions you’d like answered, you’ll be happy to know that Amazon Web Services (AWS) is hosting a security webinar on The Key to Effective Cloud Encryption on September 26, between 0930 and 1130 BST.

Your hosts will be Tim Rains, AWS regional leader for Security and Compliance Business Acceleration, Worldwide Public Sector and Dave Walker, security specialist solutions architect at AWS.

Tim’s CV includes stints as director of Cyber-Security Strategy at Las Vegas Sands, the world’s largest gaming company, and the global chief security advisor for Microsoft, while Dave has spent over two and a half decades advising companies and public sector organisations meet industry-specific and Critical National Infrastructure security requirements since 1993.

Together, they’ll take you on a deep dive into how to use encryption to protect your data in the cloud, and how AWS’s encryption features such as AWS Key Management Service and AWS CloudHSM can help.

Sound good? of course it does. In which case, step right this way to register.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/16/aws_encryption_webinar/

  • 16/09/2019
  • adm

US Sanctions 3 Cyber Attack Groups Tied to DPRK

Lazarus Group, Bluenoroff, and Andariel were named and sanctioned by the US Treasury for ongoing attacks on financial systems.

Today, three North Korean state-sponsored malicious cyber groups were sanctioned by the U.S. government for their role in North Korea’s malicious cyber activity on critical infrastructure. Lazarus Group, Bluenoroff, and Andariel were identified as “agencies, instrumentalities, or controlled entities of the Government of North Korea” by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) in documents announcing the sanctions.

The announcement of sanctions includes specific campaigns, attacks, and actions that the U.S. government has attributed to the three groups. According to Dmitri Alperovitch, CrowdStrike CTO and co-founder, “This is yet another indication of how forward-leaning US government’s position has become in a relatively short period of time on doing attribution of malevolent cyber actors. A few years ago, this type of action would have been unprecedented.”

According the Department of the Treasury, the groups have targeted financial systems, financial institutions, and government agencies in their campaigns. The activities have largely been responsible for hard currency returns to North Korea’s government. John Hultquist, director, intelligence analysis for FireEye says, “The sheer scale [of the campaigns] suggests that they are a financial lifeline for a regime that has long depended on illicit activities to fund itself. It’s important to remember that this activity appears to be very lucrative, and the choice for the cash-strapped regime to give it up will be a hard one.”

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Escaping Email: Unlocking Message Security for SMS, WhatsApp.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/us-sanctions-3-cyber-attack-groups-tied-to-dprk/d/d-id/1335805?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 14/09/2019
  • adm

Malware Linked to Ryuk Targets Financial & Military Data

A newly discovered campaign, packing traces of Ryuk ransomware, aims to steal confidential information.

New malware bearing similarities to Ryuk ransomware has been discovered in a campaign attempting to steal files containing confidential military, financial, and law enforcement data.

This campaign, which was detected by the MalwareHunterTeam, does not encrypt the target’s data and demand a ransom as Ryuk normally does. Instead, it searches victims’ computers for sensitive files, steals them, and uploads the information to a site under the operators’ control.

It has not yet been determined how the Ryuk lookalike lands on target machines. When it does, it scans for specific Word and Excel files, checking for strings kept on a blacklist, BleepingComputer explains in a report. When a file or folder matches a string, the malware stops checking it. If a document passes the blacklist, it verifies whether the file is valid.

If so, the malware compares its name to a list of 77 strings seemingly picked to lead the operator to sensitive information: “military,” “classified,” “finance,” “SWIFT,” “report,” “secret,” “clandestine,” “checking,” “saving,” and “routing” are all examples of terms on the list. When a file matches a term in this string, it’s uploaded to a server controlled by the attackers.

Jeff Warren, general manager of products for STEALTHbits Technologies, emphasizes the simplicity of the techniques used to identify sensitive files. “With nothing more than comparing file names to a list of 77 strings, the malware is able to identify and exfiltrate sensitive information,” he says. The stealer uses basic scanning to identify and mount additional shared folders, so anywhere a user has access is vulnerable to these types of attacks, Warren adds.

Ryuk Relations
This particular infection shares a few curious qualities with Ryuk ransomware. For one, it contains specific string references to “.RYK” and “RyukReadMe.txt,” says cybersecurity researcher Vitali Kremez in a conversation with Dark Reading. Ryuk typically leaves victim notes as “RyukReadMe.txt,” and encrypted files have the “.RYK” extension. The stealer malware seems to intentionally skip files like these, which are linked to the Ryuk ransomware.

Also like Ryuk, this malware contains specific references to the Ahnlab antivirus company and it checks for a file called Ahnlab on target machines. It also has a link to “UNIQUE_ID_DO_NOT_REMOVE,” which is a string present in Ryuk ransomware, Kremez adds. The malware’s file searcher and extension with blacklist logic are similar to the Ryuk routines.

“Overall, it looks like someone with the Ryuk code added additional code to make it a stealer and compiled in a different environment,” he says. The code indicates this wasn’t an advanced attacker. “It feels like if someone less experienced took the Ryuk code and/or tried to mimic Ryuk routines, then they copy/pasted some own code logic/code and created a new malware.”

The code quality related to upper/lowercase extension check, external library dependency, and recursive routine is not good, Kremez notes. Still, the act of taking Ryuk and transforming it into a stealer is new, he points out. Ryuk’s ransomware operations are linked to the TrickBot malware group, and they have robust code development. While there is no way to know who is behind this, the actor may be linked to the core Ryuk group if code was taken from them.

“We know that Ryuk is a very targeted ransomware,” Kremez explains. “If this malware is part of the same group, we suspect it to be also very targeted.”

Ryuk ransomware has been seen targeting businesses around the world. In April, it struck the city of Stuart, Florida, and forced servers and computers offline; last year, it hit C.E. Niehoff Co., a small manufacturing firm. Earlier this summer, the UK’s National Cyber Security Centre (NCSC) issued a warning for a new global Ryuk ransomware campaign packing Emotet and TrickBot.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Escaping Email: Unlocking Message Security for SMS, WhatsApp.”

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/malware-linked-to-ryuk-targets-financial-and-military-data/d/d-id/1335808?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 14/09/2019
  • adm

Intel: SSH-stealing NetCAT bug not really a problem

There’s another vulnerability in Intel chips, with another catchy name: NetCAT. The researchers who discovered it say that attackers could use it to find out what other users on a server are typing. Don’t recoil in horror yet, though – exploiting it would be a challenge.

The attack revolves around a technology called Data Direct I/O (DDIO). Intel embedded it in all its server processors since 2012, and turned it on by default. It writes data from peripherals directly into the server CPU’s cache memory, bypassing system RAM to speed up processor communications in latency-sensitive applications.

According to the research from scientists at VU Amsterdam, a weakness in the technology means that an attacker can indirectly snoop on what others are typing in secure shell (SSH) sessions. SSH is an encrypted telnet replacement that lets people log into servers using a command-line interface.

When another user types a character in an SSH session, it goes directly to the server in a network packet, dislodging a piece of data in the server cache. The attacker can watch that happening.

Now, here’s the part that takes us into Hollywood movie territory. A hacker wouldn’t be able to read the characters that you type directly. Instead, they’d have to time the replacement of the data to work out the time between the user’s keystrokes. Then, they’d have to guess at the words you’re typing by analysing keyword patterns. They said:

… humans have distinct typing patterns. For example, typing ‘s’ right after ‘a’ is faster than typing ‘g’ after ‘s’. As a result, NetCAT can operate statistical analysis of the inter-arrival timings of packets in what is known as a keystroke timing attack to leak what you type in your private SSH session.

Should you set the sirens off in your server room and declare a company-wide emergency? That’s what people did with two other side-channel attacks on Intel hardware, Spectre and Meltdown. This isn’t anywhere near as serious, though. For one thing, the attacker has to connect to the server directly using another feature called remote direct memory access (RDMA) over a high-speed InfiniBand network. It’s a pretty specialist piece of infrastructure which would already need to be set up, and they’d have to gain access to it.

Predicting your typing is also a stretch. We’ve certainly seen researchers claim this before, on smartphones, so perhaps it’s technically possible to guess some typed words. But you’d hope that any developer or admin typing in an SSH password wouldn’t be using a dictionary-listed word in the first place. You might have a chance of predicting “password1234”, but you’d find it far more difficult to guess “3X6ACpK8ohhvrW”.

Intel responded:

This issue has a low CVSS base score of 2.6. In scenarios where Intel DDIO and RDMA are enabled, strong security controls on a secured network are required, as a malicious actor would need to have read/write RDMA access on a target machine using Intel DDIO to use this exploit. In the complex scenarios where Intel DDIO and RDMA are typically used, such as massively parallel computing clusters, malicious actors typically don’t have direct access from untrusted networks.

There’s no patch for this but Intel said that if you’re worried you could use software modules that regulate timing using constant-time code. The researchers responded that this won’t stop NetCAT because it operates at the network card level, but that it might stop similar “NetCAT-like” attacks.

Instead, they recommend disabling DDIO if you don’t use it, and/or switching off RDMA.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/REq_6yIOVLY/

  • 13/09/2019
  • adm

Just how private are your browsing habits?

In the past few days, we’ve written about both Mozilla and Google adopting DNS-over-HTTPS in their browsers.

We’re supposed to use HTTPS wherever we can, so “something-over-HTTPS” sounds as though it ought to be more secure than “the-same-something-not-encrypted-at-all”…

…and yet not everyone is happy about this whole DNS-over-HTTPS thing.

Can more security really mean less privacy? We went live to discuss the issues:

(Watch directly on YouTube if the video won’t play here.)

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Vgrb8xzh4VM/

  • 13/09/2019
  • adm

Charmin’. Garmin admits customers’ full credit card data nicked from South African web store

Updated GPS and wearables maker Garmin has warned customers in South Africa that their personal info and payment data were pinched after they shopped on the shop.garmin.co.za portal.

The stolen data, which the emailed notice said was limited to Garmin’s South Africa site, included customers’ home addresses, phone numbers and emails as well as all the information needed for a criminal to make purchases using their payment cards, not to mention gain a foothold into identity fraud.

In the breach notice, attributed to Garmin’s South Africa MD, Jennifer Van Niekerk, the firm explained the “recently discovered theft of customer data from orders” included “the number, expiration date and CVV code for your payment card, along with your first and last name, physical address, phone number and email address”.

A Reg reader based in South Africa, who made a purchase from the vendor in early 2018, said Garmin’s response had fallen short, with no offer on the table for fraud protection and no explanation given.

Our reader was also concerned about what looked to them like an apparent storing of payment data, opining: “It’s weird that they were still hanging on to my (since expired) card details, and I wonder why it hasn’t occurred to them that the less customer info they hold, the lower the risk to the company itself if a breach does happen.”

The shopping portal (https://shop.garmin.co.za) has been hauled offline but appears to have been running on the popular Magento ecommerce platform – formerly owned by eBay and last year acquired by Adobe to be borged into its Experience Cloud enterprise CMS platform. As Reg readers will recall, cross-site scripting vulns were first found on versions of Magento back in 2016, prompting urgent calls for merchants to patch their installations.

The flaws made unpatched Magento shops vulnerable to carding malware, and miscreants flinging the Magecart card-slurping variant, among others, took full advantage in the months and years after.

Dutch developer Willem de Groot found in October of the same year that hackers had installed skimming scripts on more than 6,000 online stores running vulnerable versions of Magento, and as recently as November last year, toff tat bazaar Sotheby’s Home was struck. It is not known if this is how the Garmin data was snaffled, and we’ve asked the firm to clarify.

Such skimming badware would allow miscreants to slurp the data as it was being typed into a form, rather than, say, accessing any stored data. The implication for customers in that scenario is that the malware could theoretically have been in place for some time.

Readers who use Magento can make sure their systems are patched as per the recommendations from the Magento Security Center here.

We’ve asked Garmin South Africa about the number of people whose data was accessed, its storage and encryption of payment data, the nature of the problem, and how it intended to protect its customers and will update if we hear more.

The South African arm is listed in Garmin US’s annual reports and on its website as a subsidiary, though the sales data is not broken down into countries. Garmin hauled in total revenue of $3.34bn in fiscal ’18 (PDF), ended December 29, $1.2bn of which was attributable to the EMEA region. Its operating income for the year was $778m, 14 per cent growth over the prior year’s $683m.

The notice did contain an apology along with the expected bit about taking data protection “seriously” along with a piece of advice. “We recommend that you review and monitor your payment card records to make sure there were no unauthorized purchases.”

Quite. ®

Updated at 16:36 UTC 13 September to add:

Garmin confirmed to The Reg that criminals had indeed used “card skimming tech” to capture details as they were input and fingered a contractor which it did not name. It told us the e-commerce site “was operated by a third party on behalf of Garmin South Africa.

“Promptly after learning of this incident, we immediately shut down the impacted system, began an investigation, and contacted the South African Information Regulator.

“While Garmin does not store credit card information, the unauthorized party leveraged virtual skimming technology to capture customer details at the time of input, including credit card information.” It added that the incident was isolated to a few thousand customers who accessed the SA portal: “This incident affected less than 6,700 customers in South Africa and does not affect customers who purchased from other Garmin websites in other regions.”

It said it was “working on safeguards to prevent future attacks”.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/13/garmin_breach_notification/

  • 13/09/2019
  • adm

Consumer ransomware insurance? You could be painting a target on us all for avaricious crims

Fire, theft, flood – and now cyber attack. Customers of a Californian biz offering payouts of up to $50,000 in case your cat videos get Wannacry’d but experts worry it could make the problem worse.

Los Angeles-based firm Mercury Insurance reportedly began offering “cyber protection coverage” to its retail customers in the USA earlier this month.

“Homeowners and renters have enjoyed the added convenience provided by computers, tablets and smartphones, but these devices create new opportunities for cybercriminals to infiltrate your home,” the firm’s Jane Li informed the Orange County Register (no relation to Vulture Central).

Thus, should your stock of cat videos and unpublishable memes become subject to a ransomware attack, you can make a claim for the cost of the ransom. On top of that, you can also get hold of “professional assistance from cyber extortion experts”, which we hope isn’t like the sort of “help” coming from Red Mosquito that we covered previously. With an excess of $500 on an annual premium of just $30, and cover within and without the home, it seems like a reasonably good deal on the face of it.

“An example of a cyber-attack claim is if you receive a ransom demand on a computer after noticing your files are locked,” Li told the OCR. “The demand states that you need to pay $2,000. Mercury will review the claim and if credible, cover the insured’s loss.”

But what about unintended consequences

Brett Callow of antivirus biz Emsisoft opined that while “ransomware attacks against home users have been in steady decline” because businesses are more lucrative targets, “if policies such as this become popular, it could change that dynamic.”

“In the past, threats actors would’ve had a near-zero chance of getting a $50k ransom from a home user to unlock their collection of cat memes, but an insured victim could be willing and able to pay,” warned Callow. “And, of course, home users likely make for softer targets than businesses, making them an even more attractive target.”

Jason Nurse, a cybersecurity boffin from the University of Kent, was skeptical about whether the product would trigger increased attention and large payouts by insurers.

finger

Massachusetts city tells ransomware scumbags to RYUK off, our IT staff will handle this easily

READ MORE

“£50k is quite substantial for an average consumer ransomware attack, and would almost certainly – depending on the wealth of the individual – result in no payment,” he told us.

“Cybercriminals that target consumers via ransomware are more interested in making ‘some’ money from large amounts of people rather than hoping that they will make £50k from a single person/home. This may well change in the future – say in 5-10 years – when entire homes/cars are connected (the smart home/city dream) and a ransomware attack locking down an entire home becomes much more impactful.”

While cynical minds might think that offering a clearly defined $50,000 limit on payouts might trigger ransomware crooks into upping their ransom demands to, say, $50,000 a pop, and encourage them to target ordinary consumers instead of businesses, for now we might get lucky.

For now. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/13/california_ransomware_insurance_50k_payout/

  • 13/09/2019
  • adm

Whoa, bot wars: As cybercrooks add more AI to their arsenal, the goodies will have to too

Infosec techies should prepare to both fend off AI attacks and welcome the technology into their armoury of tools, reckons Trend Micro’s director of cybercrime research.

The security world is standing on the brink of an AI-powered arms race, claimed Rob McArdle at the firm’s Cloudsec conference in London today.

Speaking on stage alongside Rik Ferguson, Trend’s refreshingly British research veep, McArdle warned that “deepfake ransomware” was one potential attack vector of the near future.

Describing the technique, McArdle said an attacker could use deepfake tech to create a video with blackmail potential: the obvious use case is something involving nudity, or perhaps someone making outrageous statements. The attacker could then upload that video somewhere and send the mark a private link along with threats to publish the video widely unless large sums of money were paid immediately.

“It works against politicians and teenagers in particular,” warned McArdle. “Politicians have the problem that even if it’s found out to be fake, nobody fact-checks any more,” referring to the infamously doctored video of American politician Nancy Pelosi, which was slowed down to make her seem drunk or unwell.

As for teenagers, the attack vector is hideously obvious: adolescents in relatively high-pressure social situations filled with lots of immaturity. “Teens are very judgy,” observed McArdle. “That’s exactly what happens today with sextortion scams… teens have committed suicide.”

The technique is less likely to work against you or I, though: “My friends will say Bob drinks too much Guinness, his chest doesn’t look like that.”

No need to live on a remote mountain

Away from the misery of modern scammers targeting individuals, McArdle also waxed lyrical about how we could potentially end up in an AI-on-AI arms race. Building on one of Ferguson’s points made earlier in their talk, about the rate at which machine learning tech improves over time, Trend’s cybercrime research director said we could see techniques used to play Go reconfigured to help breach corporate networks – needing a similar escalation by human defenders.

“AI kind of brings two things,” he told The Register after his on-stage talk. “It comes into play on the defensive side to deal with the scale of the attacks we’re seeing today.”

“Dealing with tens or hundreds of thousands of alerts per hour. Simply put, humans can’t process that kind of data. On the defensive side we need AI to make smart decisions; not ‘if packet bad, drop it’.”

And it’s not a case of buying some magical black box to make all the nasties go away: humans will still need to be in the loop, but with added information at their fingertips. Security operations centre inhabitants of the near future are “going to have to start trusting AI decisions” before they become overwhelmed.

“Even if it’s triaging for them,” said McArdle, “there’s a point we’re going to have to say we trust the algorithms to take action in these swathes of scenarios. They should be there to help those analysts [and] give them way more intelligence about the things that do bubble up.”

mouse

Who will save us from deepfakes? Other AIs? Humans? What about vastly hyperintelligent pandimensional beings?

READ MORE

Lest we be disheartened by the idea of computers racing ahead of humans’ ability to fend off deepfakes and ever more sophisticated attempts to compromise networks and extract ransoms, it’s not all bad news. Deepfake tech is “still determinable” in McArdle’s view: humans (and mice, as it happens) can still spot the subtle signs that a video isn’t all that it seems, even if it’s “harder for your ears to recognise a fake voice”.

“It’s very easy on the infosec side to talk about the doom and gloom but all these technologies bring with them some real positives,” said McArdle after El Reg pondered whether taking up a new life as a Tibetan monk on a remote mountain top might be the ultimate defence against cybercrime. “At least in my mind it outweighs the things we use for negative purposes but those don’t necessarily make as good news.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/09/13/ai_deepfakes_infosec/

  • 13/09/2019
  • adm

Taking a Fresh Look at Security Ops: 10 Tips

Maybe you love your executive team, your security processes, tools, or strategy. Maybe you hate them. Whatever the situation, it’s likely at some point that things will have changed.

A few months back, someone asked me to help him take apart a bed frame. He had a problem stemming from a stripped screw that could not be removed. When I came over, I noticed another screw on the other arm of the bracket. The second screw was not stripped, and so I loosened it. This freed the bracket, which allowed me to easily take apart the bed frame.

I’m relaying this incident not to brag about my talent as a brilliant problem solver or because I am exceptionally handy. In fact, the person who asked me for help is a particularly brilliant problem solver — a far better one than I. The reason I was able to solve the bed frame problem is because I looked at it with fresh eyes, a state of mind that is also useful in the realm of cybersecurity, as these 10 examples demonstrate:

  1. Executive support: Struggling to get the attention of executives and the board? Not able to make security a priority for the business and advance items important to security? Try looking at the problem through new eyes — namely theirs. How do executives view the business? What risks and threats to the business are they concerned with? If you can view issues from the perspective of the C-suite, you might have better luck communicating why security is important in a language they’ll understand far better.
  2. Security strategy: Sure, you may have a formal security strategy that was written a few years back. But have you looked at it with your present-day eyes? The environment in which the security team operates changes constantly. It might be time to take a fresh look at the overall direction of the program.
  3. Risk: Do you understand the risks that the business faces? Are you sure? Risks evolve continuously and understanding what they are and how they affect the business today is paramount to successfully securing the business.
  4. Threats: Are you familiar with the information security threat landscape that you face? Are you certain that your knowledge is up to date? It might be time to take a new look at the threat landscape as it pertains to your enterprise.
  5. Goals: When was the last time you set goals for the security team? Was it at a time when you may have looked at the information security world differently? If the last time you examined goals was not so recently, you will likely see the topic differently now. Give goals a glance through your present-day eyes.
  6. Priorities: The security team’s priorities are likely shifting constantly. New challenges arise continuously, as do old challenges. So why is it that you set priorities only once per year, or even less frequently than that? Of course, priorities cannot be reset daily, but there is a balance here. Try looking at priorities more frequently than annually.
  7. People: You’re likely quite fond of and proud of the security team you’ve built. You’ve probably assembled a group of skilled and talented contributors. But there is more to the equation than just the quality of the team you’ve put together. There is also consideration of the alignment of the team and their skill sets to your strategic objectives. Has it been a while since you took a look at your team from that perspective? It might be worth a new look.
  8. Process: I’ve seen my share of bad processes over the course of my career. Even the good processes I’ve come across were written for a given purpose under a specific set of circumstances. What if the purpose and/or the circumstances change? Over a period of time, this is almost always the case. Given that, doesn’t it make sense to reevaluate whether or not different processes make sense in the current environment? Casting a fresh look upon processes often produces more effective and efficient ones.
  9. Technology: Maybe you love your security tooling. Maybe you hate it. Maybe you painstakingly architected your security stack with an eye for detail. Maybe you inherited some or all of it. Whatever the situation, it’s likely that things have changed quite a bit since the tooling in place was procured and deployed. Isn’t it time to ensure that the technology in place still fits the bill? My guess is that you’ll find several pieces that are no longer appropriate.
  10. External organizations: You probably have a membership in a few different external organizations. Perhaps you are a part of mailing lists, attend conference calls, or participate in meetings with these organizations on a fairly regular basis. When was the last time you stopped to think about what you’re actually getting out of these organizations versus what you’re putting into them? What once made sense may no longer be the case. Definitely worth a glance with fresh eyes.

Related Content:

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO – Emerging Technologies at FireEye and as Chief Security Officer for … View Full Bio

Article source: https://www.darkreading.com/risk/taking-a-fresh-look-at-security-ops-10-tips-/a/d-id/1335744?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 13/09/2019
  • adm

No Quick Fix for Security-Worker Shortfall

Security professionals see acquiring skills as the way forward, but only half of companies are training their workers, with more continuing to search for highly skilled employees.

Although companies realize that skilled security professionals are difficult to hire, they continue to focus on increasing head count rather than training their current employees, according to a survey conducted by the 451 Group.

Yet, offering an opportunity for employees to learn new skills and the potential to advance and develop their careers could actually help firms acquire more dedicated and loyal security teams, according to a report based on the survey results and published this week by managed-security solutions provider eSentire. Eighty-seven percent of respondents maintain that the staffing levels at their organizations are adequate, while 78% of security professionals believe that companies have a gap in needed skills, not in the number of people performing security-related work. 

So, what if your company wants to develop its security team? Train and focus on career path, says Chris Braden, vice president of global channels and alliances at eSentire.

“When you have that sort of shortage, simply getting someone on board in the first place can be a challenge, but companies also need to focus on their strategy to be able to retain them,” he says.

The survey underscores one of the paradoxes of the tight labor market in cybersecurity. While training is necessary to develop the skills to allow the security team to do its job, many companies fear that training and certification will allow their security experts to find better-paying jobs at other companies.

And there is some evidence of that. In 2018, the number of cybersecurity-related job posting in the United States increased by 7.2%, but the number of clicks on US cybersecurity jobs decreased by 1.3%, according to job aggregation platform Indeed.com. Currently, the cybersecurity sector does not have enough incoming skilled workers to fill all the necessary positions. Instead, companies are cannibalizing the teams at other firms.

“If you are a company who does not have a series of advanced security-skilled positions available in your organization, you are probably not going to be very proactive about encouraging your employees to get the training, because they are going to use the training to exit the business, more than likely,” Braden says.

Train to Retain
At the same time, such training is what convinces skilled workers to stay. Almost two-thirds (63%) of security professionals believe that ongoing education and helping employees get security certifications is the No. 1 effort that could help companies hire and retain personnel, according to the survey. Higher salaries and better benefits came in at No. 2, with 57% of respondents believing that raising pay would help retain employees.

The survey also found a strong link between training opportunities and job satisfaction, with approximately six in 10 of security professionals saying they are satisfied with their jobs also being satisfied with the educational opportunities offered to them, while seven in 10 of those workers unsatisfied with their jobs also are unsatisfied with their options for continuing education.

It even applies to managed service providers, such as his company, Braden says.

“We are not immune to this,” Braden says. “But the size of our SOC and the number of people we employ led us to develop an internal training capability — we can train college students into an entry level role and train them as they move up the [career] stack.”

A third of respondents — the largest segment — rate learning new skills as their top consideration in job satisfaction. Security professionals who have stayed at their current jobs for longer than five years have the greatest satisfaction with the level of education and training offered by their employers.

Still, not all companies have the need for more advanced positions. Part of the problem for many companies is that they have little way for cybersecurity professionals to advance their careers, says Braden.

“Even with large midmarket companies with 5,000 or 10,000 employees, there may not be a lot of roles requiring security skills that would allow that type of advancement,” he says. “I think that skills-gap alignment is really a bigger issue in some ways than the shortfall in security talent itself.”

Managed service providers can help mitigate the impact of the lack of security talent, but companies have to take the right approach, Braden says.

“Our model is really not to enable a company to displace their IT security team — those people are valuable and they are hard to get, as we identify in the report,” he says. “Instead, companies can use those resources for other purposes. And, if you look at the litany of operational debt items that are typically in a SOC or an IT department, we are talking about the ability to be able to implement software updates and patches, retiring login credentials when someone leaves an organization — they can repoint their people to more productive activities to which they are better suited, rather than processing alerts off a SIEM.”

For companies that want to develop their own in-house team, the survey seems to indicate a way forward. Organizations need to have good executive support for whoever is designing and managing the security program, and roles have to be developed that both support the program and allow employees to advance into new positions, Braden says.

Then the head of information security must work with human resources to develop a program to develop and acquire the right talent for those positions and retain them. And, Braden adds, a key part of that is education.

Related Content

 

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Escaping Email: Unlocking Message Security for SMS, WhatsApp.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/no-quick-fix-for-security-worker-shortfall/d/d-id/1335803?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 13/09/2019
  • adm