STE WILLIAMS

Many of us, for most of our lives, have heard about the necessity of “climbing the ladder of success.” When you reach a certain age, the expectation is that you naturally will have progressed into middle or upper management. In the security industry, I’ve seen quite a few incredibly talented and passionate individuals burn out or leave their jobs due to the lack of a clear, authentic path for career progression. Even for those of us who have remained, there can be a lingering sense of confusion or a lack of motivation if we are uncertain about the road ahead as we achieve a certain level of seniority.

This is a fairly new industry, which means there are fewer identifiable “next steps” as far as careers go. Many of us seem to fly by the seat of our pants and take whatever position that sounds appealing rather than be directed by specific goals. And when that no longer works, some feel it necessary to get out of the industry entirely.

Another complication is that the sorts of job transitions into management that might be sensible in other industries are less applicable in tech and information security. The skills needed to configure a corporate network or code a complex widget are significantly different from getting a group of unpredictable hominoids to do your bidding. As a result, it becomes perfectly acceptable (and often more efficient) to hire people into management positions who are less technically savvy but better at motivating a group of technical subject-matter experts.

That’s not to say that brilliant engineers can’t be amazing people-managers. These skill sets can and often do overlap. Plus, there are ways to improve your management skills, if this is something you want to pursue. On the other hand, if you find you’ve achieved your “highest level of incompetence” in management, it does not have to be a career-limiting maneuver if you decide to go back to a technical trajectory.

Considering the Options
There is usually a short list of things people are after when they think about “climbing the corporate ladder”: money, intellectual enrichment, and respect. While joining the C-suite is certainly one way to achieve that, it’s not the only way. Here are a few suggestions to help you find a career path in line with your abilities and interests:

Focus on technology. Many higher-level positions revolve around technology management rather than people. Think of these as architect-type positions where you plan or design research and development projects rather than direct the people implementing them. These are often higher-paying positions, if more money is your objective.

If this is too far removed from the nitty-gritty, consider two alternative directions. The first is to explore laterally: are there projects or subjects you’d be interested in investigating? Sometimes a departmental “exchange program” can be an interesting change of pace. The second is to specialize: Can you get a much more in-depth knowledge of your area of interest? Specialist roles may also allow you to command a higher salary. While this choice carries some risk — all areas of specialization eventually will go extinct — if you’re willing to move laterally, it need not be a dead end.

Find inspiration. Sponsorship and mentorship are great ways to get ahead once you’ve decided on a pathway, as is having a peer who is on a similar career expansion journey. Having someone who can amplify your voice as well as your insight can make your own trek seem less overwhelming. And don’t be deterred by the people who express concern about their ability to attract mentors and sponsors when they don’t get the reflected glory of having a protégé climbing the ranks. It’s certainly possible to find people who are intrinsically motivated to offer assistance. But performing well at a high-profile project can also offer extrinsic motivation.

Inspire others. It’s also very possible to act as a leader without having official management responsibilities. “Thought leadership” can raise the profile of individuals and their organizations by giving others the benefit of expert experience. Team leaders can raise the skill level of a single mentee, a group, or a whole organization. And, as with mentorship and sponsorship, this type of leadership can provide both extrinsic and intrinsic motivation.

With an ever-growing skills gap, we can scarcely afford to lose any talent, much less people with significant experience. Don’t let career stagnation be an exit ramp. Use it as an opportunity to explore and to deepen your enthusiasm.

Related Content:

• Why Security Leaders Can’t Afford to Be Just ‘Left-Brained’
• The ‘Team of Teams’ Model for Cybersecurity
• What CISOs Need to Know about the Psychology behind Security Analysis

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/who-says-brilliant-security-engineers-cant-be-amazing-people-managers/a/d-id/1330248?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft Office 365 missed 9.3% emails containing spam, phishing, and malware from the beginning of September through early October, report Cyren researchers, who analyzed 10.7 million messages.

The threat intelligence firm gauges clients’ email security with its Email Security Gap Analysis tool. Inbound emails are processed by its email security system, and all messages that go on to users’ inboxes are BCC’d to Cyren’s system for automated analysis.

“It’s a standard engagement we have with clients,” says Pete Starr, Cyren’s director of field engineering. “But occasionally we get some interesting nuggets of information.” Researchers were curious about how Office 365 was performing, which led to evaluating its security.

During the month of September, Cyren analyzed 10.7 million emails forwarded by Office 365 to user mailboxes for companies tested during that time frame. Of the messages evaluated, 9.75 million (90.7%) were found to be clean. This included 4.6 million newsletter emails, which made up nearly half of legitimate email traffic.

Nearly one million (9.3% of) messages were spam or malicious emails missed by Office 365, says Cyren, noting that the standard Office365 email service has Exchange Online Protection (EOP) to protect against malware and spam. The “false negatives” should not have made it to inboxes.

Researchers found 957,039 emails, or 8.93% of all email traffic, turned out to be spam. Usually, these messages are filtered out through content scanning or pattern detection applied to elements of the email message or its distribution pattern.

Spam aside, 34,077 emails delivered to Office 365 users were phishing messages. Of these, 18,052 were financial phishing emails requesting banking details or account access, 5,424 were password phishing emails, and 10,601 were general phishing emails.

“The biggest shock was just how much was coming through,” says Starr. “Yes, the majority of it is spam, but quite a lot is something you don’t want.”

He refers to the malware attachments found on 3,900 emails delivered to users. While a tiny percentage (0.04%) of all emails delivered, it’s also the most dangerous. Of those malware emails, 1,438 were zero-day attachments with no previously known malware signatures. However, malware attached to 2,462 emails was known and should have been detected.

“What really surprised me was the two-and-a-half thousand samples of known malware,” Starr says. “Stuff caught by basic, signature-based detection. You expect that kind of stuff to be filtered out.”

Is the customer at fault, or is Microsoft? Starr puts some blame on both parties. “Your average Office 365 customer is less well-configured; they perhaps don’t have the best policies on average,” he explains.

However, he continues, Microsoft’s solution is particularly reliant on reputation-based filtering, meaning the extent of their knowledge is only as good as their database. Today, with the rise of distributed attacks involving malware, phishing, spam, and botnets, many machines involved are fresh IPs. There’s a good chance they won’t exist inside an IP reputation database, he says.

“Being able to track new IPs is very, very difficult,” says Starr. “You find out about them when it’s too late.”

For businesses hoping to improve their email security, he advises being more sensible about whitelists, noting that many organizations are too broad when adding domain names to their whitelists and letting potentially harmful messages in.

Another mistake is not appreciating how much valid email exists in other languages, like Chinese or Russian. “People either completely block, or completely allow them,” he adds, suggesting users take full advantage of email features to set more specific filters.

Related Content:

• Phishing Kits Regularly Reused by Cybercriminals
• Stop Counting Vulnerabilities Start Measuring Risk
• 10 Scariest Ransomware Attacks of 2017
• Web Attacks Spike in Financial Industry

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/cloud/office-365-missed-34000-phishing-emails-last-month/d/d-id/1330282?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

South Korea’s Ministry of Defense alleges a recent security breach of Daewoo Shipbuilding Marine Engineering’s database was committed by North Korea, according to a Reuters report.

The defense ministry believes copies of Daewoo’s warship blueprints were taken in the breach, which occured in April, states the Reuters report.

South Korea’s investigators claim the hacking techniques used on Daewoo were similar to ones North Korea is believed to have used in other attacks, a South Korean opposition lawmaker told Reuters.

North Korea hackers allegedly stole a cache of South Korea’s classified military documents, including operational plans from the US-Korean War, the report states.

Read more about the Daewoo breach here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/north-korea-faces-accusations-of-hacking-into-warship-builder-daewoo/d/d-id/1330286?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A whopping 59% of employees who have sustained a ransomware attack at work personally paid the extortion money, according to a report released today by Intermedia.

The 2017 Data Vulnerability Report Part 2, a survey of 1,000 office workers at small-to midsized businesses, also found 68% of business owners and executives personally paid ransom payments. The average ransom paid was approximately $1,400, the study notes.

Potential Payment Drivers

“I think employees pay it because it’s fast,” speculates Jonathan Levine, Intermedia’s CTO. “While everyone is trying to figure out the company’s policy on paying ransom, the people still need to get the work done.”

He believes most employees do not back up their work, and adds it’s not surprising a majority of the workers personally paid the ransom.

But Chris Hornick, president-elect of the Northern California Human Resources Association and CEO of HBSC Strategic Services, has a different view on why employees are willing to shell out hundreds of dollars of their own money.

If an employer learns that company equipment is used for non-work related activities, it could be a fireable offense, Hornick says.

For example, if an employee clicks on a bogus email attachment touting details for a free luxurious vacation to the Bahamas and it results in a ransomware attack, the employee may face termination.

“This could be why employees don’t want to disclose it and pay the ransom themselves,” Hornick says. “It’s a double-edged sword because usually employees know their employer wants them to disclose ransomware attacks.”

Workforce Ransomware Education

The survey also reports that 70% of respondents say their employer regularly communicates about cyberthreats, and that 69% are familiar with ransomware. However, given that the majority of office workers still pay the ransom themselves, Levine says it suggests companies have not yet taken the extra step to inform employees what to do if they are attacked by ransomware.

“A lot of the security education is around how not to get hit, versus what to do once you get hit,” Levine says, adding, “People are bad when it comes to planning for low-probability events, even catastrophic ones.”

Thirty-seven percent of survey respondents note their employers paid the ransom. The Intermedia report advises companies to inform workers about the possible dangers of dealing with ransomware attackers directly.

The report also advises creating an environment where employees realize there is no shame in becoming a ransomware victim, and that personally paying ransom should never be an option.

Related Content:

• 3 Simple Steps For Minimizing Ransomware Exposure
• Awareness Training Can Help Quell Ransomware Attacks
• How Businesses Should Respond to the Ransomware Surge

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/endpoint/majority-of-employees-hit-with-ransomware-personally-make-payment/d/d-id/1330267?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Phishing kits get re-used across multiple websites in 27% of cases, a new study shows.

All it takes to generate a new phishing kit is a single change to a file, the Duo Security report says. “Seeing so many unique phishing campaigns shows it is easy to make these kits and re-use them,” says Jordan Wright, senior research and development engineer at Duo.

In its report – which examined 66,000 URLs over the course of a month and more than 7,800 phishing kits – researchers found two kits used on more than 30 hosts.

Re-using phishing kits ups the return on investment (ROI) for cybercriminals, who don’t need to spend time to recreate various assets from a legitimate site to make a bogus one to steal users’ credentials and information.

To create a phishing kit, attackers clone a legitimate site and alter the login page to point to a credential-stealing script, Duo notes in its report. The website’s modified files, such as logos, images, and other features, are put into a zip file to create a phishing kit, which is then uploaded to the hacked website where the files are unzipped. The attacker then blasts out phishing emails, hoping to lure victims to click on the bogus malicious website.

“These kits are being used for commodity phishing, so the spoofed pages are not as convincing as spear phishing,” Wright notes. “Some kits are bad and I don’t think will fool anyone and some kits are almost exact replicas. The actors want to spoof large service providers like Gmail and get as many credentials as possible.”

Typical phishing kit users include both beginners who favor the ease-of-use of the kits, as well as seasoned attackers who want to expand their phishing campaigns quickly, Wright explains.

Tracking the Bad Guys

And bad actors have no qualms when it comes to stealing from each other. Some of the phishing kits that were sold, traded, or offered for free had backdoor shells in the kits, allowing the initial phishing kit owner to pilfer any data gleaned from the new campaigns launched by the subsequent attacker.

“The backdoor also allows the author to run system commands on the host, so it can take over the host,” Wright adds.

Duo also tracked the email addresses found in the phishing kits to correlate actors to specific campaigns and kits. As a result, they discovered 24% of the email addresses were tied to multiple phishing kits, according to the report.

One email address, wirez[@]googledocs[.]org, had more than 115 unique phishing kits to spoof multiple service providers.

The prevalence of phishing kits tracks with a general trend in cybercrime that is focusing on attacking the end-user as a means to get credentials to go deeper into the bowels of a company’s network, rather than directly breaking into the network, Wright notes.

Duo, meanwhile, has released a free phishing tracking tool for others to use.

Related Content:

• 91% Of Cyberattacks Start With A Phishing Email
• How to Beat Phishing Attacks
• Security Gets Social: 10 of Dark Reading’s Most Shared Stories
• Phishing, Whaling The Surprising Importance Of Privileged Users

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/endpoint/phishing-kits-regularly-reused-by-cybercriminals/d/d-id/1330269?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

As a security team, you are what you measure. The problem is that too many security teams are counting vulnerabilities, not measuring risk. It’s time we examine how vital it is for security teams to establish risk-based metrics, while offering some examples of both the right and wrong measures to use.

Why is the distinction between these approaches so vital? It’s essential for security teams to understand the spectrum of risk, based both on the likelihood of an incident and the potential damage that may result.

• The Open Group has published an extensive standard,“Risk Taxonomy (O-RT), Version 2.0.”
• Daniel Miessler has written an informative post, “The Difference Between Threats, Threat Actors, Vulnerabilities, and Risks.“

It’s often easiest to think of risk as uncertainty, and our job as security professionals is to remove as much uncertainty as we can.

The Problem: Security Can’t Go It Alone
The security team has started taking a risk management approach and everything is going to be rosy, right? Not exactly. Once a security team embraces risk management, the hard work is just beginning. The rest of the organization needs to start following the team’s example. How does security build support for risk management across teams?

For security teams and the business to succeed in reducing uncertainty, risk management must be incorporated into operations across the organization. When security starts to be part of operations — rather than an ad hoc afterthought— the critical efforts that need to happen, do happen.

To begin, focus on two key steps:

• Measurement. Practitioners must make sure they’re measuring actual risk. All key stakeholders should buy off on what is being measured and ensure actual risk reduction is being addressed.
• Integration. Once you’re reporting on risk, it’s critical to make sure risk management is part of operations.

Step 1: Selecting the Right Metrics for Measuring Risk
I meet with practitioners from a wide range of industries and often see the same missteps. Chief among these is that security teams are measuring the wrong things.

More often than not, teams take a “best practices” approach. Security analysts may run a report and find their checklist of vulnerabilities has been unaddressed for longer than 90 days. Then they’ll prioritize efforts based on this aging data, focusing on how long a vulnerability has existed. Likewise, I often see companies focusing on the security news of the day over items that may be less attention-getting but pose a greater risk.

Contrast these somewhat arbitrary approaches with a risk-based strategy. With a risk-based approach, you may realize that those older vulnerabilities don’t pose as much risk, but that three vulnerabilities discovered yesterday pose both a great likelihood of resulting in an incident and significant potential damage to the business. With this insight, the need to remediate these three vulnerabilities sooner is clear.

When you focus on the quantity or aging of vulnerabilities, you deprioritize higher-risk items that have a high likelihood or impact.

These contrasting scenarios underscore the importance of tracking and reporting with the right metrics. Metrics are vital in guiding behavior and play a key role in measuring success, tracking progress, getting buy-in, and investing in new approaches

It can be far better to address one high-risk vulnerability than even 100 low-risk vulnerabilities. The key is to establish metrics and analytics that measure risk in an empirical, meaningful way, so you can make these calculations with clarity.

While specific metrics that are optimal will vary somewhat depending on the nature of the business and environment, there are some common do’s and don’ts when it comes to choosing metrics.

Here are some metrics to avoid:

Organizations that use a risk-based approach can consider tracking a number of key metrics:

• 10 Social Engineering Attacks Your End Users Need to Know About
• Security Training Awareness: 3 Big Myths
• What’s Next After HTTPS: A Fully Encrypted Web?

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Ed Bellis is a security industry veteran and expert and was once named Information Security Executive of the Year. He founded Kenna Security to deliver a data-driven, risk-based approach to remediation and help IT teams prioritize and thwart would-be security threats. Ed is … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/stop-counting-vulnerabilities-and-start-measuring-risk/a/d-id/1330220?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple