Vietnamese cybercrime groups are using multiple different MaaS infostealers and RATs to target the digital marketing sector.

Cybersecurity researchers have uncovered a connection between the notorious DarkGate remote access trojan (RAT) and the Vietnam-based financial cybercrime operation behind the Ducktail infostealer.

WithSecure's researchers, who spotted Ducktail's activity in 2022, started their investigation into DarkGate after detecting multiple infection attempts against organizations in the UK, US, and India.

"It rapidly became apparent that the lure documents and targeting were very similar to recent Ducktail infostealer campaigns, and it was possible to pivot through open source data from the DarkGate campaign to multiple other infostealers which are very likely being used by the same actor/group," the report noted.

**DarkGate's Ties to Ducktail**

DarkGate is backdoor malware capable of a wide range of malicious activities, including information stealing, cryptojacking, and using Skype, Teams, and Messages to distribute malware.

The malware can steal a variety of data from infected devices, including usernames, passwords, credit card numbers, and other sensitive information and be used to mine cryptocurrency on infected devices without the user's knowledge or consent.

It can be used to deliver ransomware to infected devices, encrypting the user's files and demanding a ransom payment to decrypt them.

WithSecure senior threat intelligence analyst Stephen Robinson explains that at a high level, DarkGate malware functionality hasn’t changed since the initial reporting in 2018.

"It has always been a Swiss-army knife, multifunctional malware," he says. "That said, it has been repeatedly updated and modified by the author since then, which we can assume has been to improve the implementation of those malicious functions, and to keep up with the AV/Malware detection arms race."

He notes DarkGate campaigns (and the actors behind them) can be differentiated by who they are targeting, the lures and infection vectors they are using, and their actions on the target.

"The specific Vietnamese cluster that the report focuses on used the same targeting, file names, and even lure files for multiple campaigns using multiple strains of malware," Robinson says.

They created PDF lure files using an online service that adds its own metadata to each file created; that metadata gave further strong links between the different campaigns.

They also created multiple malicious LNK files on the same device and did not wipe the metadata, enabling further activity to be clustered.

The correlation between DarkGate and Ducktail was determined from nontechnical markers such as lure files, targeting patterns, and delivery methods, collated in a 15-page report.

"Nontechnical indicators like lure files and metadata are highly impactful forensic cues. Lure files, which act as bait to entice victims into executing the malware, offer invaluable insights into an attacker's modus operandi, their potential targets, and their evolving techniques," explains Callie Guenther, senior manager of cyber threat research at Critical Start.

Similarly, metadata — information like "LNK Drive ID" or details from services like Canva — can leave discernible traces or patterns that might persist across different attacks or specific actors.

"These consistent patterns, when analyzed, can bridge the gap between varied campaigns, enabling researchers to attribute them to a common perpetrator, even if the malware's technical footprint differs," she says.

Ngoc Bui, cybersecurity expert at Menlo Security, says understanding the relationships between different malware families linked to the same threat actors is essential.

"It helps in building a more comprehensive threat profile and identifying the tactics and motivations of these threat actors," Bui says.

For example, if researchers find connections between DarkGate, Ducktail, Lobshot, and Redline Stealer, they may be able to conclude that a single actor or group is involved in multiple campaigns, which suggests a high level of sophistication.

"It may also help analysts determine if more than one threat group is working together as we see with ransomware campaigns and efforts," Bui adds.

**MaaS Impacts Cyber-Threat Landscape**

Bui points out the availability of DarkGate as a service has significant implications for the cybersecurity landscape.

"It lowers the entry barrier for aspiring cybercriminals who may lack technical expertise," Bui explains. "As a result, more individuals or groups can access and deploy sophisticated malware like DarkGate, increasing the overall threat level."

Bui adds that malware-as-a-service (MaaS) offerings provide cybercriminals with a convenient and cost-effective means to conduct attacks.

For a cybersecurity analyst, this poses a challenge because they must continually adapt to new threats and consider the possibility of multiple threat actors using the same malware service.

It also can make tracking the threat actor using the malware a little more difficult as the malware itself may cluster back to the developer and not the threat actor using the malware.

**Paradigm Shift in Defense**

Guenther says that to better comprehend the modern, ever-evolving cyber-threat landscape, a paradigm shift in defense strategies is overdue.

"Embracing behavior-based detection sequences, as well as leveraging AI and ML, allows for the identification of anomalous network behaviors, surpassing the previous limitations of signature-based methods," she says.

Furthermore, pooling threat intelligence and fostering communication about emergent threats and tactics across industry verticals can catalyze early detection and mitigation.

"Regular audits, encompassing network configurations and penetration tests, can preemptively unearth vulnerabilities," Guenther adds. "Moreover, a well-informed workforce, trained in recognizing contemporary threats and phishing vectors, becomes an organization's first line of defense, reducing the risk quotient substantially."

Ducktail Infostealer, DarkGate RAT Linked to Same Threat Actors

Users could hold up to five SIM cards previously, but now they can only have two; it's a move that the government says is intended to cut down mobile spam levels.

Burkina Faso aims to increase mobile security in the African country with a new bill that says users can only hold two SIM cards (i.e., lines of service) from a mobile provider.

And the sale of SIM cards will only be made in approved agencies and points of sale.

The use of multiple SIM cards can allow for SIM farms to be built, which are typically connected to organizations where the SIM cards are connected to computer servers to send large amounts of SMS spam.

Aminata Zerbo-Sabané, Burkina Faso's Minister of Digital Transition, Posts, and Electronic Communications, said this measure is aimed at reducing the improper use of electronic communication services.

The bill will better regulate the identification of customers of electronic communications service providers, and reduce the illicit use of mobile services, she said.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

SIM Card Ownership Slashed in Burkina Faso

To make cybersecurity an organizationwide priority, CISOs must avoid these common input, empathy, and alignment obstacles.

Whether they're earned or not, there are certain stigmas associated with chief information security officers (CISOs): They work in isolation, with only a vague sense of how various departments contribute to the organization's greater good. They impose controls without considering business impact. They focus on highly technical metrics with unclear net positive value. They aren't good at listening. Or empathy.

Be honest. Does this describe you and your team — even just a bit? Or more so? If you concede that it does, that's a good thing. The first step toward a solution is acknowledging that a problem exists. Improvement requires change, which is sometimes uncomfortable, because change starts with you.

Accountability, then action. For CISOs and their teams, that means transforming into ubiquitous advocates for cybersecurity — and then leading the transformation for everyone in the enterprise into advocates for the same.

CISOs will thrive within this change by focusing on input, empathy, and alignment. This will enable lasting success for the shift by allowing CISOs to fully identify and understand information asymmetries throughout the organization and then remove them to clear the path to optimal communications and awareness.

However, there are several obstacles that hinder these efforts. Here are three and how to overcome their traps.

**Assigning Tasks to the Wrong Subject Matter Expert (SME)**

CISOs are responsible for an extremely wide scope and frequently deal with high stress — but are consistently biased toward taking action themselves. They lead the organization well, but at times miss opportunities to leverage SMEs' soft skills to optimize resolution. As leaders, it is necessary that CISOs remain cognizant of the balance between SMEs' skill sets, shared values between them and the target organization, and the true goal of this collaboration.

The solution requires raising engagement between security and the enterprise across the board, building relationships that ensure the right expert is assigned to the right issue to give the right support.

CISOs must rely on the people around them to truly know what is going on. They must create pathways so that the right information flows freely everywhere and that this knowledge is committed to organizational and institutional memory. By interfacing with external teams, CISOs create contacts that result in the effective ingestion of information and the proper application of personnel and responses to the information.

**Failing to Tie Actions to Organizational and Business Goals**

If CISOs don't connect their work to broader goals, it's pretty much impossible for non-IT managers and employees to appreciate the value of their actions. CISOs know why certain controls and responses to threats are needed. But they can never assume those outside their team do.

To overcome these potential credibility gaps, I've proactively communicated with my heads of finance, marketing, sales, and other key departments to learn about their roles. Because I've invested that time — to find out what they do every day, along with their strategic goals and challenges — I gain their trust in myself and my team. They are confident we will approach threats, risks, and remediation with an appreciation of business objectives.

**Executing Without Making Broad Impact**

I push my team members to constantly ask themselves: "Am I implementing a fix that benefits people outside our team? Or am I just trying to make my own life easier?" Obviously, we seek to achieve the former and avoid the latter. Simply stated, we need to think big. Our return on investment (ROI) growth is directly tied to our ability to sow seeds once and reap the fruits of our labor in multiple seasons to come. 

"Everyone has a plan," boxer Mike Tyson is credited with saying, "until they get punched in the mouth." If we work within security silos — isolated in our knowledge, dogmas, and execution — every security issue is like the first time in the ring, and we consistently take punches that we have little understanding of how to handle. 

But if we proactively pursue empathy and alignment as part of our core values, we gain a level of trust that builds pathways throughout the enterprise. Subsequently, we can remove those informational asymmetries, elevate the conversation across the organization, and lead strategically. And we will walk out of the ring with our arms raised — stronger and together.

Change From Within: 3 Cybersecurity Transformation Traps for CISOs to Avoid

Cybersecurity exceptions are a fact of life in most organizations, but there's work that should be done to make sure those exceptions are justified and worth the risk.

There is always a new shiny object to chase in cybersecurity: zero trust, AI, passwordless authentication, quantum computing. These are just some of the latest hot topics, and organizations are feeling pressure to adopt them to stay ahead of current threats.

While these new technologies are certainly relevant, they may not be as important as getting the "cyber basics" right. Buying new cutting-edge tools or planning a whole new architecture won't replace excelling at those foundational, structural underpinnings that build a successful security program. One example of these fundamental considerations is the area of "exceptions." 

It is simply a given in any enterprise that there will be exceptions to cybersecurity policies and procedures. These range from patching exceptions to multifactor authentication (MFA) exceptions to access and firewall exceptions. How an organization processes and tracks exception requests, and evaluates risks associated with exceptions, can have a major impact on how easy or difficult it is for the organization to monitor, detect, and respond to cyberattacks.

**Are Cybersecurity Exceptions Justified? **

Attackers will leverage exceptions because they provide an easier path into an organization's environment. For example, I supported a military contract and the command was rolling out application allowlisting. The aides to senior officers requested exceptions for those seniors because they were concerned that the technology might "interfere" with the senior officers' work. However, the senior officers were the exact group needing additional security protection. 

We were able to meet and explain to the aides how the tech would better protect these VIPs, and we would coordinate with their offices to quickly resolve any issues with the technology. Despite some misgivings, the VIPs ultimately were better protected and the exception requests were dropped. All it took was sitting down and discussing the users' worries and patiently explaining how to ease those worries. 

Exceptions ultimately indicate how good your security could be — if there were fewer exceptions (or none at all). Here are some things to keep in mind:

*   Ensure you have a clear and concise process for requesting and approving exceptions. (Hint: Convenience is not a good basis for granting exceptions!) That process should align with other security policies, such as the organization's acceptable use policy.
*   The process should include a risk assessment to determine the impact of the exception.
*   Track all exceptions to ensure they are not being abused.
*   If you have too many exception requests, you may need to modify your policy so that employees can get their work done securely.
*   Exceptions should expire. If necessary, they can be reviewed to see if they are still valid.

If you're falling short on cybersecurity fundamentals, such as an exception process, you're going to be facing security issues regardless of how much time and money you invest in new technologies. Automation and other solutions can help, but they don't erase every problem, including those that require new human behaviors and processes. Just like Achilles from Greek mythology, it’s easy to forget a weak spot if you’ve lived with it for a long time. And just like Achilles, such forgetfulness can have severe consequences.

_Read more_ Partner Perspectives from Google Cloud

What are Your Exception Expectations?

**PRESS RELEASE**

**PALO ALTO, Calif.****,** **Oct. 19, 2023** **/PRNewswire/ --** Artificial intelligence (AI) provides a powerful tool for energy companies to deliver an affordable, reliable clean energy transformation. Today before a U.S. House Energy and Commerce Subcommittee, EPRI Senior Technical Executive Jeremy Renshaw testified that parties need to collectively work on addressing today's AI challenges and tomorrow's opportunities.

For more than a decade, EPRI has been studying AI and its potential impacts on the energy sector, and in the last five years, the institute has accelerated its activities around AI and data science. To date, EPRI has been involved in more than 70 projects related to AI applications in the energy sector.

As EPRI research has found, AI can help energy companies improve efficiency of existing assets, assist with wildfire risk evaluation and early-stage detection, aid vegetation management and storm recovery, and optimize energy usage, among other benefits.

"AI allows computers and humans to interact more effectively to improve safety and reliability while reducing costs," Renshaw testified before the House Energy and Commerce Subcommittee on Energy, Climate, and Grid Security. "This is done by allowing humans to do what humans do best - creative thinking and dealing with new or unforeseen situations, while computers do what computers do best - rapid, accurate computations," he said.

"While AI has come a long way in a short amount of time, there are still many more opportunities to solve existing challenges today, as well as considerations for ethical and responsible use of AI," Renshaw noted. Among pressing considerations:

*   **Data privacy and security**: AI models are typically trained on large datasets, which may contain personally identifiable information or other sensitive data. Steps should be taken to ensure the security and privacy of the data.
*   **AI-assisted cybersecurity**: EPRI and other companies are developing tools to proactively monitor and address suspicious cyber-related activity.
*   **Data**: Without sufficient quantity and quality of data, AI systems can potentially produce erroneous results that can be used in decision-making processes.
*   **Workforce training**: People need to be trained on how and when AI is the right tool to use and when it is not.

"Clearly, AI will have a significant impact on the energy industry, likely both positive and negative. It is anticipated that, through the introduction of AI, utilities will be able to utilize its benefits for maintaining or improving safety, affordability, reliability, efficiency, and environmentally friendly energy production," Renshaw concluded.

A copy of Renshaw's prepared testimony is available here. To learn more about EPRI's AI work, visit www.ai.epri.com.

**About EPRI**

Founded in 1972, EPRI is the world's preeminent independent, non-profit energy research and development organization, with offices around the world. EPRI's trusted experts collaborate with more than 450 companies in 45 countries, driving innovation to ensure the public has clean, safe, reliable, affordable, and equitable access to electricity across the globe. Together, we are shaping the future of energy.

SOURCE EPRI

AI 'Will Have a Significant Impact on Energy Industry,' EPRI Tells Congress

**PRESS RELEASE**

**TEMPE, Ariz.** **& PRAGUE****,** **Oct. 19, 2023** **/PRNewswire/ --** Norton, a consumer Cyber Safety brand of Gen™ (NASDAQ: GEN), today unveiled new features included with Norton Password Manager and Norton AntiTrack. Norton Password Manager offers a premium password management experience that continues to be available at no cost, and a new Private Email feature now available in Norton AntiTrack helps consumers quickly and easily take back control of their online privacy.

"Our enhancements to Norton Password Manager and Norton AntiTrack exemplify our passion for constantly improving our products and services to help our customers protect their online privacy and stay one step ahead of threats to their security," said Leena Elias, Chief Product Officer at Gen. "Free password managers are traditionally basic, difficult to access on different devices, and lack multi-layered security. With Norton Password Manager, you no longer have to choose between conveniently accessing your accounts and having excellent password protection. And, our addition of Private Email as part of Norton AntiTrack allows you to easily take steps to protect your online privacy when you're engaging with the digital world and protect your personal email address, which is often the gateway to your personal information and accounts. We are committed to helping our customers safeguard their online privacy through the launch of these solutions."

Accessible via the web, and available as a browser extension or mobile app, Norton Password Manager has been rebuilt with improvements to password security and privacy and redesigned to provide a seamless, intuitive customer experience.

Norton Password Manager now delivers greater convenience, security, and privacy with the following upgrades:

*   **Strengthened Vault Security and Recovery:** We notify you if your vault password needs to be strengthened and monitor the dark web for your vault password to help keep your passwords secure. New vault access recovery helps you recover the vault password if it's forgotten without compromising security.
*   **Improved Password Assessment:** Password strength is automatically assessed. If a weak password is detected, it's now easier to change it to be more complex and difficult to crack.
*   **Easy to Use:** A modern look and feel that's simple to set up and access the most used features from more locations; auto-filling and credential saving options appear seamlessly as you browse the web to provide quick access to accounts.

In addition to Norton Password Manager enhancements, Private Email is now available in Norton AntiTrack on Windows PCs. Private Email improves email privacy by masking your personal email addresses so they're unrecognizable, and removes hidden trackers often found in sent emails that can be used to gather private, personally identifiable information, including location, device usage, interests, and shopping behaviors.

Norton Password Manager is compatible with Windows PC, Mac, Android, and iOS, and available as a browser extension on Chrome, Firefox, Microsoft Edge, Safari, as well as browsers from Gen brands, Norton, Avast and Avira. For more information and to download Norton Password Manager, visit us.norton.com/products/norton-password-manager. Norton AntiTrack with Private Email is available to download at https://norton.com/products/norton-antitrack.

**About Norton**

Norton is a leader in Cyber Safety, and part of Gen™ (NASDAQ: GEN), a global company dedicated to powering Digital Freedom with a family of trusted consumer brands. Norton empowers millions of individuals and families with award-winning protection for their devices, online privacy, and identity. Norton products and services are certified by independent testing organizations including AV-TEST, AV-Comparatives, and SE Labs. Norton is a founding member of the Coalition Against Stalkerware. Learn more at www.norton.com.

Norton Boosts Security and Privacy With Enhanced Password Manager and AntiTrack

**PRESS RELEASE**

**SAN JOSE, Calif.****,** **Oct. 18, 2023** **/PRNewswire/ --** Spec, a leading cybersecurity firm specializing in advanced frauddetection and defense, is thrilled to announce the successful closure of its $15M Series A funding round, marking a significant milestone in the company's journey. This funding round was led by SignalFire, with participation from Legion Capital, and Rally Ventures.

From its beginnings as a "hello world" prototype during the early days of the pandemic, the Spec platform has advanced to invisibly protect enterprises processing billions in online transactions. Today, Spec's platform scans the entire customer journey, allowing for the identification of all threats and attacks, and then deploys active countermeasures, especially against the AI-powered attack tools that threaten to disrupt online businesses.

This funding round will power Spec's continued growth and innovation. With this new investment, the company is poised to:

*   Advance the Spec platform to deliver increased visibility and control over attack detection and exploit remediation
*   Expand its threat labs, the R&D powerhouse that deconstructs the tools and tactics used by modern attackers and develop countermeasures that neutralize their impact
*   Co-develop specialized products with partners that resolve the fraud problems that customers cannot fix with single point solutions

"I'm excited about our continued partnership with SignalFire, who led this funding round," said Spec co-founder and CEO Nate Kharrl. "The firm's deep expertise in cybersecurity and AI at enterprise scale is a perfect match for our mission. We're equally grateful for the continued support from Legion Capital and Rally Ventures, whose insights and experience are invaluable."

Kharrl further expressed gratitude to everyone who has been part of Spec's remarkable journey, emphasizing that trust and support forms the very foundation of the company's success. "I'm proud of what this team has accomplished. I'm also grateful for the support of the enterprise customers that helped us grow our platform into what it is today, bolstered by the incredible support and guidance of our board and investors," he said. "We're excited to forge ahead on our mission to protect customer journeys against a landscape of evolving threats."

About Spec: Spec is a leading cybersecurity firm specializing in advanced fraud detection and defense, providing enterprises with unparalleled fraud security solutions. With a commitment to innovation, Spec is dedicated to protecting businesses against emerging threats and security challenges.

For more information, visit www.specprotected.com.

SOURCE SPEC

Spec Secures $15M Series A Funding, Accelerating Innovation in Fraud Defense

**PRESS RELEASE**

**CHICAGO****,** **Oct. 17, 2023** **/PRNewswire/ --** Fingerprint, the world's most accurate device intelligence platform, raised $33 million in Series C funding led by Nexus Venture Partners with participation from Uncorrelated Ventures. Fingerprint aids developers in building device identification with flexible APIs capable of identifying fraudsters while ensuring low-friction experiences for trusted users. The Fingerprint platform leads with best-in-class accuracy, identifying 99.5% of returning users in less than 500 milliseconds of processing time. The new funding brings the company's total funding to $77 million.

"With the gradual death of cookies and proliferation of VPNs, high accuracy device identification has never been more important. Companies battle sophisticated attacks from online fraudsters while needing to ensure their trusted customers have a frictionless experience," said Dan Pinto, Fingerprint's co-founder and CEO. "Fingerprint solves this challenge for thousands of companies by enabling accurate device identification and providing additional signals to inform visitor intent without inconveniencing legitimate users."

Since its last round of funding in 2021, Fingerprint has seen significant growth stemming from its ease of integration, instant value for new customers via API and extensive documentation. Industry leaders like Dropbox trust Fingerprint to detect and block account takeover attempts, while Neiman Marcus relies on the same technology to create personalized experiences for its most valued customers.

"Fingerprint is becoming a modern utility for the internet economy to combat fraud," said Abhishek Sharma, Managing Director of Nexus Venture Partners. "Any business that processes online transactions or payments should use Fingerprint. Its device intelligence API helps high-scale websites and apps prevent fraudulent transactions. We're impressed by the product's ability to deliver 10x+ ROI for its customers consistently. We love Fingerprint's developer-focused go-to-market approach coupled with its ubiquitous open-source library, FingerprintJS. The company has commercially grown 20x over the past three years. It has a resounding product-market fit, from small businesses to large public companies. We're thrilled to triple down and further strengthen our partnership with Fingerprint."

Unlike other device identification methods, Fingerprint's persistent visitor identifier continuously improves and maintains accuracy, even as browsers are upgraded. Providing a complete view of all users across web and mobile devices — whether or not they are logged in or concealing their identity — enables companies to build superior frauddetection and user experiences. Companies use Fingerprint for a variety of use cases, including:

*   Protecting login pages from automated account takeover attacks and phishing attempts.
*   Preventing payment fraud of all forms for payment processors and eCommerce retailers.
*   Account sharing detection and prevention for SaaS and subscription services.
*   Securing cryptocurrency exchanges.
*   Building paywalls that can't be evaded by going incognito, changing IP addresses or clearing cookies.
*   Restricting access for bad actors in online gaming and gambling.

Fingerprint also makes it easy for any developer to get started with popular third-party integrations such as Cloudflare, Segment, CloudFront and many more. Additionally, Fingerprint partners with software vendors, including Dodgeball, Okta and Spec, to generate additional value for customers and increase customer retention.

The funding will enable Fingerprint to accelerate adoption within larger Enterprise customers, which have been a critical driver of the company's recent growth. Fingerprint aims to build new tools and capabilities to tackle the most complex challenges in device identification.

For more information on Fingerprint device intelligence, visit Fingerprint.com.

**About Fingerprint**

Fingerprint, powered by the most accurate device intelligence platform, enables companies to prevent fraud and improve user experiences. Fingerprint processes almost 100 signals from the browser, device, and network to generate a stable and persistent unique visitor identifier that can be used to understand visitor behavior. With a commitment to best-in-class data security and privacy, Fingerprint is proud to be ISO 27001 certified, SOC 2 Type II, GDPR, and CCPA compliant. Fingerprint is trusted by over 6,000 companies worldwide, including 16% of the top 500 websites, to help catch sophisticated fraudsters and personalize experiences for trusted users. Learn more at fingerprint.com.

**About Nexus Venture Partners**

Nexus Venture Partners is a venture capital firm that supports extraordinary founders in building product-first companies. The firm takes a high-conviction approach, serving as inception, seed, or series-A stage partner to founders, actively engaging with them throughout the company lifecycle. With $2.6B capital in management, Nexus portfolio includes Postman, Apollo.io, MinIO, Fingerprint, Nx, Druva, Observe.ai, Rancher, Pubmatic, Delhivery, H2O.ai, Hasura, Kaltura, Quizizz, Sibros, TileDB, Turtlemint, Unacademy, Zepto, and Zomato. For more information, visit www.nexusvp.com or follow @nexusvp on X.

Fingerprint Raises $33M in Series C Funding to Accelerate Enterprise Device Intelligence and Fraud Prevention Adoption

**PRESS RELEASE**

**AUSTIN, Texas** – **Oct. 10, 2023** – SailPoint Technologies, Inc., a leader in enterprise identity security, today released the findings from the 2023 edition of its annual research report, ‘The Horizons of Identity Security,’ at Navigate 2023. Produced in collaboration between SailPoint and Accenture, a leading global professional services company, the report is based on insights from more than 375 global cybersecurity executives across the Americas, Europe and Asia. The goal was to examine the current state and future direction of the identity security market.

With 90% of cybersecurity breaches being identity related, identity security is the most important security aspect that every organization must get right. Yet, findings from the Horizons of Identity Security report show that 44% of companies are still at the beginning of their identity journeys. And, concerningly, even mature companies cover less than 70% of the identities in their organizations through foundational governance capabilities. However, respondents noted that communicating the business value of identity security to executives is a key challenge. This underscores the need for identity security advocates to build executive-friendly business cases that are tailored to their audiences’ strategic priorities and value-driven mindset.

A worrying 77% of respondents indicate that “limited executive sponsorship or focus” is a primary obstacle to investment in identity security, second only to budgetary constraints (91%). However, report findings clearly demonstrate that a strong identity security program can power business agility and innovation, risk mitigation, efficiency gains, and advancement of tech initiatives. For example, it can accelerate organizational change by as much as 30% through quicker integration of identities, applications, data and infrastructure. 

“A strong identity security program can generate real value for today’s organizations, but that value isn’t always obvious to business stakeholders,” said Matt Mills, President of Worldwide Field Operations, SailPoint. “In today’s threat landscape, stopping just one breach can save millions of dollars in lost revenue, regulatory fines, and reputational damage. It’s important for security teams to have the information they need to communicate their needs in an outcomes-based way. Focusing on the business value that identity security drives is going to resonate best with executives and help them understand the pressing need to accelerate their identity maturity if they want to avoid becoming the next major victim.”

Identity ecosystems are becoming increasingly complex and a preferred attack vector for threat actors. According to the report findings, on average more than 30% of the identities in an organization are not properly covered by identity solutions, with particular gaps around third-party identities, machine identities and data. Bringing those identities under the umbrella of a strong identity management program is essential for breach avoidance. Foundational security capabilities accelerate incident response, prevent bad actors from authenticating into internal systems and limit excessive access rights for employees — which survey respondents selected as the most common security deficiency enabling breaches.

Among other notable findings in the report was the fact that AI-based solutions have proven to be a potent accelerator, helping businesses add advanced new capabilities and drive greater agility. Encouragingly, the report shows a growing number of organizations are exploring AI-backed dynamic trust models to evolve access based on user behavior. The findings also show that companies leveraging SaaS, AI and automation scale a notable 10-30% faster and get more value for their security investment through increased capability utilization. More specifically, an identity platform leveraging automation and AI enables companies to scale identity-related capabilities up to 37% faster than companies without AI enablement. 

“Organizations are facing unprecedented challenges when it comes to managing their complex identity environments and massive data sets,” said Damon McDougald, the global Security Digital Identity lead at Accenture. “While advanced technologies like artificial intelligence and generative AI are making it easier to expedite, manage and scale identity security initiatives many organizations are still at the start of their journeys. Organizations should view this as an opportunity to accelerate their identity maturity timetable and establish a foundation for a secure digital transformation.”

**Adoption Assessment tool**

SailPoint is launching a new adoption assessment tool that can help organizations assess their current capabilities, as well as how they stack up against their peers. The tool can help businesses identify what their greatest barriers to stronger identity security are, and how they can generate greater business value by investing in identity. To access the adoption assessment tool, click here. 

SailPoint’s flagship ‘Navigate: Identity Security Accelerated’ conference kicks off in Austin, Texas on October 9th, and will be followed by a series of global events in London, Singapore, Sydney, Washington DC, Toronto and São Paulo. To register, visit the Navigate website.

**2023 Horizons of Identity Security Resources**

*   To download a copy of the 2023 Horizons of Identity Report, click here. 
*   Read more about the report’s top findings in this SailPoint blog. 
*   For a snapshot of the report’s key findings, click here. 
*   To reference the 2022 Horizons of Identity Report or take the maturity assessment, click here. 

**About SailPoint**

SailPoint is a leading provider of identity security for the modern enterprise. Enterprise security starts and ends with identities and their access, yet the ability to manage and secure identities today has moved well beyond human capacity. Using a foundation of artificial intelligence and machine learning, the SailPoint Identity Security Platform delivers the right level of access to the right identities and resources at the right time—matching the scale, velocity, and environmental needs of today’s cloud-oriented enterprise. Our intelligent, autonomous, and integrated solutions put identity security at the core of digital business operations, enabling even the most complex organizations across the globe to build a security foundation capable of defending against today’s most pressing threats.

SailPoint Unveils Annual 'Horizons of Identity Security' Report

Two weeks after the first data leak from the DNA ancestry service, the threat actor produces an additional 4 million user records they purportedly stole.

A threat actor who claimed responsibility for the compromise of the 23AndMe site earlier this month has released a new dataset, including the records of more than 4 million people's genetic ancestry.

The cybercriminal, known by the handle Golem, alleges in a cybercrime Dark Web forum the stolen data includes information on, "the wealthiest people living in the US and Western Europe," according to reports.

23andMe spokesperson Andy Kill said in a statement the organization is still trying to confirm whether the most recently leaked data is genuine.

Prior to this most recent leak, an Oct. 1 post on a Dark Web forum by Golem claimed they have a total of 20 million individual pieces of 23andMe data and leaked 1 million lines of data as a teaser, along with an offer to bulk sell data profiles.

23andMe confirmed in early October that users who opted to share information through its "DNA Relatives" were impacted and suggested the breach was a result of a credential stuffing cyberattack.

"After learning of suspicious activity, we immediately began an investigation," 23andMe's disclosure said. "While we are continuing to investigate this matter, we believe threat actors were able to access certain accounts in instances where users recycled login credentials — that is, usernames and passwords that were used on 23andme were the same as those used on other websites that have been previously hacked."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading