STE WILLIAMS

(Image: Kavzov – stock.adobe.com)

If you ask the average consumer about the Dark Web, chances are good they won’t have a positive response. Most people assume the Dark Web is malicious – if they know about it at all.

Over the years, and especially of late with breaches and hackers making headlines, the Dark Web’s reputation has been crafted by high-profile arrests and sensational news stories. Films and television shows have also shaped public perception. Even four to five years ago, people within the technology and security industries had a skewed opinion of what the Dark Web is.

“Anyone who was familiar with it typically had an outlandish view of what was happening there,” says Emily Wilson, vice president of research at Terbium Labs. In recent years, the industry has begun to have more developed conversations, discussing how the Dark Web is changing, how it’s responding to different events, and how it fits into their cyber-risk strategies. Employees in the finance and tech spaces, where security is paramount, are especially aware.

Still, she adds, most modern consumers are a few years behind. More have heard of the Dark Web, but those who have are afraid of it. “Their feeling about the Deep and Dark Web is it’s just this bad place,” adds Flashpoint chief strategy officer Chris Camacho.

So what exactly is the Dark Web, and how is it different from the Deep Web? How do they both work, and what goes on there? Here, we hope to fill in the gaps. We spoke with Dark Web experts, who answer your FAQs about the unknown Internet.

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/risk/demystifying-the-dark-web-what-you-need-to-know/d/d-id/1334681?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

This summer Black Hat USA is coming to Las Vegas with a bumper crop of practical Trainings, Briefings, and other unique opportunities to get ahead of today’s most pressing cybersecurity threats.

To give you a taste of what’s in store, let’s highlight some of the most exciting new Briefings that have been lined up for this year’s event.

Trust and Transformation: The Post Breach Journey is a rare chance to learn all about what happened inside one of the biggest security breaches in modern memory, from someone who was there. Speaker Jamil Farshchi helped rebuild (among others) the cybersecurity systems of both The Home Depot and Equifax after their devastating data breaches in 2014 and 2017, and at Black Hat USA he’ll share vital lessons learned about issues like workplace culture, controls and compliance.

Inside The Apple T2 offers you a deep dive into the inner workings of Apple’s T2 security chip, going way beyond the limited technical details the company has made public up to now. In addition, the speakers will share their methodology along with the tools they developed and released in order to help others better understand (and research) the T2 system.

In Information Security in the Public Interest cybersecurity luminary Bruce Schneier will show you why computer security is now, fundamentally, a public policy issue. While an understanding of the technology involved is fundamental to crafting good policy, there is little involvement of technologists in policy discussions. This is not sustainable. Schneier will show you why it’s so important to have public interest technologists, and present a way forward for both you and the industry as a whole.

For more information about these great Briefings and many others check out the Black Hat USA Briefings page, which is regularly updated with new content as we get closer to the event.

Black Hat USA will return to the Mandalay Bay in Las Vegas August 3-8, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/bumper-crop-of-new-briefings-added-for-black-hat-usa-/d/d-id/1334667?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

It’s breach report season and one of the prevailing trends uncovered by security researchers is that organizations are ever-so-slowly improving the window between when a compromise occurs and when it gets detected. In spite of this slight gain, the fact solidly remains that the typical breach timeline still completely favors attackers. 

Two different reports this spring showed that organizations are shortening the time to discovery of data breaches. Most recently, the Trustwave 2019 Global Security Report released late last month found that the time between an intrusion and detection of that incident shrank almost in half. That study showed that the median time between intrusion and detection fell from 26 days in 2017 to 14 days in 2018.  

This corroborates the downward trend in this statistic identified in March by the FireEye 2019 Mandiant M-Trends Report, though that study showed a more modest reduction and a much higher time between these important breach milestones. Mandiant found that the time between intrusion and detection went down from 101 days in 2017 to 78 days in 2018. That’s marked improvement from 2011, when Mandiant put that number at 426 days.

Mandiant uses a common parlance of “dwell time” for this statistic, though other experts have their own colorful terms. But they all agree that reduction should be a big priority for cybersecurity teams.  

“We refer to the time between compromise and discovery as the ‘detection deficit,’ and a prime goal should be to have the delta between the two be as small as possible,” explained Bob Rudis, chief data scientist for Rapid7, in a blog post this week. “Note that it’s not the only goal—nor should it be the entire focus of your response plans—but it should be ‘up there’ on any top ‘x’ list you have.”

One of many industry contributors to the 2019 Verizon Data Breach Investigations Report (DBIR) released yesterday, Rudis pointed out that this year’s report shows that this detection deficit is often not even accurately measured at many organizations, which means they’re “already ceding the game’s outcome” to adversaries.

More tellingly, though, this latest DBIR shows that even with reductions like those outlined in the Trustwave and Mandiant reports, the bad guys are in another league when it comes to speed.  

“The time from the attacker’s first action in an event chain to the initial compromise of an asset is typically measured in minutes,” the 2019 DBIR report said. “Conversely, the time to discovery is more likely to be months.”

Asymmetric Battleground

A different report out last month from Ponemon Institute and IBM on cyber resilience indicates that security automation is the most likely way that the security world can effectively win this asymmetric battle over dwell time.

That study showed that many gains that are being made in shortening the window between intrusion and detection are due to automation: automation improved detection and containment times by 25%. However, most organizations studied admitted they only use automation moderately, insignificantly, or not at all. Just 23% of respondents are significant users of automated tools that can reduce incident detection and response times, the study found.

Meantime, after organizations have detected and contained an event, they’re also grappling with disclosure times. This is a big issue for regulators and lawmakers these days, what with rollout of GDPR this year and rumblings of potential new laws in the US to mandate shorter disclosure times.

A report released this week by Risk Based Security showed that while the time window between discovery and reporting has fallen quite a bit since 2014, that number may be on the uptick. Last year the time interval increased ever so slightly—by exactly one day—up to an average of 49.6 days. That was after a fall of more than 12 days the previous year.

The report showed that activity in first quarter of 2019 says we might be seeing a big jump in the average by the end of 2019. In the first quarter of 2019, that number increased to 54 days. 

Related Content:

• Orgs Are Quicker to Disclose Breaches Reported to Them Via External Sources
• The Big E-Crime Pivot
• 8 ‘SOC-as-a-Service’ Offerings
• 6 Things To Know About the Ransomware That Hit Norsk Hydro

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/risk/hackers-still-outpace-breach-detection-containment-efforts/d/d-id/1334669?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Symantec this week announced an executive shakeup that included the departure of CEO Greg Clark and the naming of a new chief financial officer.

Clark, who took over the helm of Symantec in 2016 after the firm acquired Web and cloud security vendor Blue Coat Networks, where he served as CEO, for $4.65 billion. Under Clark’s tenure, Symantec acquired identity protection vendor LifeLock in late 2016 for $2.3 billion, and in 2017 formed a cybersecurity venture capital arm, Symantec Ventures, an incubator for new startups.

Richard S. Hill, Symantec director and former chairman and CEO of Novellus Systems, will serve as interim president and CEO while the company searches for a new CEO.

Meanwhile, Vincent Pilette, CFO of Logitech, was named executive vice president and CFO of Symantec. Pilette fills the slot of former Symantec CFO Nicholas Noviello, who stepped down in January.

The executive changes came as Symantec reported missed earnings for its fiscal fourth quarter. It announced earnings of $34 million on $1.19 billion in sales, a drop from $1.21 billion one year ago, according to MarketWatch.

Read more here and here. 

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/symantec-ceo-greg-clark-steps-down/d/d-id/1334679?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

At the 2019 RSA Conference earlier this year, Chris Krebs, director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), outlined several key priorities the agency is focused on for protecting US critical infrastructure. The US government is at the forefront when it comes to cybersecurity trends, so being aware of its focus can help private sector organizations improve cyber situational awareness and reduce risk.

Protecting Networks and Data from Nation-State Actors
CISA watches the usual suspects: Russia, China, Iran, and North Korea. Its key focus here is supply chain risk and minimizing the government’s attack surface by keeping what it views to be risky vendors’ equipment and applications out of US critical infrastructure networks.

In 2018, the US government banned technology from Russia-based Kaspersky Labs. With a heavy focus on China and 5G, it is now heavily focused on Huawei. Overall, the government is concerned that technology equipment from perceived risky foreign vendors could be used for malicious purposes.

Another area of focus is foreign VPN applications and, specifically, China-based applications from Dolphin, Opera, and Yandex.

Collective Cyber Defense
Krebs also discussed the importance of “collective cyber defense.” A key issue here is that we can’t fight the cyber battle alone. He indicated that multiple stakeholders have some piece of information about what’s going on — whether that’s a specific threat; tactics, techniques, and procedures; and/or vulnerabilities. It is critical that threat information is shared in a timely and practical way, and it’s hard to get the maximum effect if this information is sitting in a limited number of hands.

On a broad basis, with collective cyber defense, CISA is refining its Automated Indicator Sharing (AIS) program to include more context and specificity in order to provide more value-added threat intelligence to the private sector. 

Election security is another area in which CISA is facilitating collective defense. CISA facilitated the signing up over 1,400 local jurisdictions to the recently formed Elections Infrastructure ISAC in just a nine-month period. CISA also facilitated the deployment of intrusion detection and prevention sensors, with these now covering 90% of elections infrastructure (based on votes cast), up from 32% in 2016.

Key Takeaways
Based on CISA’s focus, there are three key things that private sector organizations can do to improve their cyber operations:

1. Increase your focus on supply chain and third-party risk. Third-party risk is a key area in security, and many large security organizations have established dedicated organizations in this area. All organizations should make moves to assess and manage this risk. This includes risks related to technology platforms that are powering your business as well as risks related to the various third-party entities with which you do business.

2. Revisit some basics regarding attack surface reduction. One easy step is to limit the use of technology from “questionable” vendors. Revisit the “who” and “what” is on your network and “whether” they should be on there. For example, if you aren’t doing business with Russia, don’t allow traffic from Russia on your network. Of course, given the global nature of business and computing, that’s not that easy for many companies, but advanced filtering capabilities like dynamic whitelisting can allow you to block traffic from a country by default while allowing access from trusted sources, such as Office 365, Amazon Web Services, content delivery networks, etc.

3. Expand your usage of threat intelligence and information sharing to benefit from collective defense.Today’s cyber threat environment requires a broader view of attacker activity than any one entity or cybersecurity vendor can provide. Expanding your use of threat intelligence can improve your cyber situational awareness and reduce risk. Easy steps here range from incorporating high-quality open source threat intelligence sources to joining DHS’s AIS program to consuming and sharing threat information with industry peers through sharing communities (information-sharing and analysis centers and organizations).

Related Content:

• 7 Types of Experiences Every Security Pro Should Have
• A Shift from Cybersecurity to Cyber Resilience: 6 Steps
• Tackling Cybersecurity from the Inside Out
• The Three Dimensions of the Threat Intelligence Scale Problem

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Todd Weller, Chief Strategy Officer at Bandura, works with large organizations in acting on their threat intelligence to prevent future attacks. He brings over 20 years of cybersecurity industry experience with a unique blend of operational and hands-on proficiency. He … View Full Bio

Article source: https://www.darkreading.com/risk/how-we-collectively-can-improve-cyber-resilience/a/d-id/1334606?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft SharePoint vulnerability CVE-2019-0604 is under active attack, according to ATT Alien Labs researchers, who cite instances of exploitation from around the world.

CVE-2019-0604 is a remote code execution vulnerability that exists when SharePoint fails to verify the source markup of an application package. Exploitation requires a user to upload a specially crafted SharePoint application package to affected versions of the software. If successful, an attacker could exploit the bug and run arbitrary code in the context of the SharePoint application pool and SharePoint server farm account. Microsoft has issued a patch.

When the vulnerability was first disclosed, it was not believed to be under active attack. Now it seems a wave of attacks are exploiting this flaw and using the China Chopper web shell to gain initial access. The Saudi Arabia National Cyber Security Center reports evidence that shows several organizations have been affected by hackers using the web shell for network access. Another report, from the Canadian Cyber Security Centre, describes similar China Chopper activity.

It seems multiple attackers are now using the exploit, Alien Labs reports. Researchers found malware they say is likely an earlier version of the second-stage malware used in the Saudi attacks; the malware sample was reportedly shared by another target in China.

Read more details here.

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/microsoft-sharepoint-bug-exploited-in-the-wild/d/d-id/1334683?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple