The sooner CISOs become proactive in understanding the flip side of the organizations they protect, the better they'll be at their jobs.

Not too long ago, cybersecurity was seen as something separate from the rest of a business (think two guys in hoodies working in a separate room). But in the past decade, it has finally received well-deserved and long-needed recognition and attention. An increasing number of companies are hiring chief information security officers (CISOs) to help shape their overall business strategy, making security a top priority for corporate boards of directors. On their end, CISOs are starting to understand and outline the role of security as a business enabler, not as a department of "no."

Things are evolving, and it is exciting to witness these changes, although there seems to be an important gap.

Much of the discussion about the evolving place of security in business is centered around the role and ever-expanding responsibilities of CISOs: recruit and grow high-performing teams, build relationships with leaders from other departments, communicate and manage up and across, enable the business to achieve its goals and objectives, and the like. What is missing in most of these conversations are security practitioners and how important it is for them to understand the business side of security.

There are two important reasons why having CISOs be the only people who think about business won't work well: 1) Without an understanding of the business, it is hard for security practitioners to do good work securing it; and 2) without an understanding of the business side of cybersecurity, it is hard for technical security professionals to be effective in building the future of the industry. Let's take a closer look at each of these factors.

**You Can't Secure What You Don't Understand**

Every organization's environment is different. There are different tools and applications used by employees, different ways people collaborate, different types of data companies collect, and most importantly, different crown jewels that need protection. Many (I would even say most) of these differences are direct results of the business the company is in. A fridge manufacturer has different types of risks and different types of parties with access to its data than a marketing agency or a biotech lab would.

Every day, security professionals are making decisions that impact their organization's security posture; they cannot rely on CISOs to be the only people with critical knowledge about the business. Understanding how the company generates revenue, how salespeople share information with one another and with their prospects, how finance teams access information when working remotely, and how vendors get paid is critical to properly securing the organization's environment. Statistically, it is more likely that a company will suffer a breach because of how some department has set up its business process, not because of the latest zero-day found by Apple (although learning about the latter might rightly be more exciting).

**You Can't Innovate What You Don't Understand**

Not all security practitioners should become entrepreneurs, but some inevitably will. Future cybersecurity founders typically spend many years in the industry before finding a painful problem worth solving and building a determination to go do it. This means that by the time they launch a startup, security entrepreneurs have a deep understanding of the technical side of the industry. Unfortunately, the same isn't true about the business side of cybersecurity.

Staying curious, asking questions, and building relationships with people from other parts of the company helps future founders and security leaders with the following:

*   Understanding how the purchasing process in organizations works, who is involved, and how the decisions are made.
*   Building an understanding of what areas of a business are being overlooked by current security solutions, and what problems haven't been solved yet.
*   Developing a broader view of what it takes to run a company, and how different functions contribute to the overall success.
*   Getting a broad view of different types of companies, different revenue models, and organizational structures, and how these factors impact business outcomes.

While understanding the business of the organization one is trying to protect is critical to building the right defensive measures, knowing what the business side of cybersecurity looks like is useful to make sure that founders won't get excited about technology so much that they forget that there needs to be a sustainable business model for the company to grow.

**Looking Into the Future**

There was a time when software development was where security is today, with engineers not having to think about the business side of things. A product manager would bring the requirements, and developers would turn them into working software without asking any questions. Nowadays, product development is seen as collective problem solving — developers, designers, and product managers work together to achieve business goals. For that, product people need to understand the basics of technology, and engineers need a strong grasp of the business their company is in.

The sooner security practitioners become more proactive in understanding the business side of the organizations they are hired to protect, and the industry overall, the better they will be able to do their jobs, and the more likely they are to build the innovations that change the way things work in the industry for the better. While nobody will expect them to get MBAs, every security practitioner would benefit from getting some visibility into areas like marketing, sales, customer service, finance, operations, and the like. After all, business processes are where many vulnerabilities come from.

Why Security Practitioners Should Understand Their Business

Smaller firms are boosting cybersecurity budgets, but there's a long way to go to address a deep lack of cyber preparedness among SMBs.

Nearly half of small and midsize businesses (SMBs) plan to spend more on cybersecurity in 2023 — which is a good thing given that six in 10 firms (61%) have no dedicated cybersecurity staff, about half (47%) have no incident response plan, and 40% fail to conduct formal awareness training.

That's according to a survey of IT professionals at SMBs with 250 to 2,000 employees from Huntress, published on March 15, which found that while respondent organizations deploy a variety of cybersecurity products — such as email security (86%), endpoint protection (79%), and network protection (73%) — they tend to forgo "basic defensive measures," such as supplementing workers' password security with two-factor or multifactor authentication — a recommendation recently made by the US Cybersecurity and Infrastructure Security Agency (CISA). 

"A significant number of these businesses feel either unprepared, understaffed, and/or under-resourced for responding to evolving threats, and a significant number face challenges in securing cyber insurance coverage and proper security awareness training for their workforces," the Huntress report stated, adding that "midsize businesses are aware of the need for multiple cybersecurity layers, \[but that\] notable gaps exist in their current tools and planning processes."

To boot, a full third (34%) of respondents said they didn't believe they could detect advanced threats.

"There's a percentage out there that doesn’t know they're actively being targeted or have already been compromised," says Roger Koehler, CISO at Huntress. "Visibility is key for these businesses, as threat actors can be sitting in their networks for weeks or even months finding footholds and collecting information before they execute their attacks."

The Huntress survey found that 14% of this business segment had confirmed an attack in the past year, while another 10% of those IT professionals surveyed were not sure whether a cyberattack occurred. Given that there are about 6 million businesses with 250–2,000 employees in the United States, those numbers can add up.

**Additional Cyber Spending on the Way**

The report did offer some good news: Huntress also found that 49% are planning to spend more on cybersecurity in the coming year to address the shocking need for more knowledge and preparedness. The fact that so many SMBs are taking a proactive approach going forward, rather than reacting to attacks, is hopeful, Koehler says. That said, sourcing the right staff will be the biggest challenge for figuring out how to spend that budget.

"Midsize businesses aren't just waiting until they face an incident to respond, but are actually investing in preventative measures that will stop the attacks in the first place," he says. "However, you can't put a dollar value on having the right people on your team that have the skills to fight off attacks — and that's where midsize businesses could improve." 

As of last fall, there were more than 700,000 openings in cybersecurity jobs, a 43% increase over 2021, according to CyberSeek. And with cybersecurity pros facing burnout and dissatisfaction, finding people to hire is tougher than ever.

The combination of more budget and a tight market for knowledgeable cybersecurity people will lead to strong growth in managed cybersecurity services, according to an October analysis by consulting firm McKinsey. The company's consultants argue that half the market will go to managed security service providers (MSSPs) and security-and-operations management.

"Across all segments, forecasted changes in allocated security spending is increasing as a percentage of services between internal and third-party services," McKinsey stated in its analysis. "So long as talent remains a problem, outsourced services will be essential for companies that need to support strong security outcomes."

SMBs Orgs Want Help, but Cybersecurity Expertise Is Scarce

Organizations are coming under pressure to protect their data, but does all data need the same security? To secure it, you first need to know what and where it is.

Let's start by examining those two broad-brush data categories: structured and unstructured.

Structured data refers to the data resident within relational databases, often presented via customer relationship management (CRM) systems and corporate applications. Tables and rows of related information in limited formats, structured and only accessible to users with suitable authorization.

Unstructured data is much less easy to ring-fence, being comprised of all the different, unrelated files present on end-user devices. The data is stored in a wide array of locations locally, across the network and in cloud-based services. When considering all these formats and types on local and network-based devices, it is easy to see how vital it is to include all this data into the overall data security equation. Omdia estimates that as much as 80% of an organization's data is resident in this unstructured category.

Now let's consider how all the data needs to be protected.

Due to the general level of sensitivity of structured data (personally identifiable information, payroll, financials, legal, etc.) security strategies will often focus on this tier. Organizations typically separate and secure the various types of data here. However, even these measures are potentially far from sufficient to protect against a determined hacker. Can any organization really say with confidence that it is adequately protected when the next attack could be from an entirely unknown quarter?

Questions of security robustness aside, for structured data, organizations do tend to treat data differently, considering the actual content (and risk to the business if it were lost) and thus appropriate controls are reasonably applied.

Given the sheer volumes, can it be said that unstructured data receives proportional (or even anything like) the same consideration structured data receives? The answer is most likely "no."

First, let's ask a more fundamental question. Can an organization, hand on heart, say it even knows where all its unstructured data is? Most organizations may struggle here. File authors may have difficulty remembering a specific file or what they did with it, or even may have left the business altogether.

This then presents this challenge: "If the organization doesn't know where a file is or what it contains, how can it be protected?"

**Discovery Solutions**

Data discovery solutions can make retrospective retrieval more palatable, but it's better to be able to classify documents at time of creation and then store them clearly and appropriately according to their value (or risk) to the business.

Omdia argues that the authors of these documents are best placed to apply a suitable mark, but artificial intelligence (AI) tools can also be employed. Today, organizational culture tends to determine if the preference is for a user or AI-centric approach. Either way, a visual and a similar embedded mark classifying the document, working in tandem with a data loss prevention (DLP) tool, will not only indicate the sensitivity of the document and with it how it should be handled, the labels will also dictate how the document can be distributed. This is the foundation to protecting unstructured data.

A consideration here. Adopting a one-size-does-not-fit-all approach does get granular quite quickly when considering all the different types and levels of data sensitivity circulating within a business. This is a necessary part of the planning process, however, and clarity and time taken to construct a hierarchical data framework at this stage will bear dividends later. Thorough and well-defined data type definition and a prioritization strategy mapped across all the various data types will not only deliver enhanced security, but also ensure that if, or when, an attack occurs, the regulators can be subsequently assured that every possible measure was in place to preserve the security of an organization's data, and, moreover, that all data was being handled in the right way. It is also worth considering at this point that highly restricted, legally sensitive data one day can become public information the next.

In terms of working with end users, views about this group and security of any type are highly polarized. Omdia firmly believes in thorough cybersecurity training for the workforce. It is vital to include users in an organization's security posture, employing them as a resilient part of the data security defensive fortification rather than sideline them as a part of the problem. Cybersecurity training is vital, but it should be ongoing and frequent to create a "security culture" within the organization.

No organization can claim to be 100% secure against the ever-evolving threat landscape. By working to understand data and accordingly implementing appropriate security controls across the varying types and sensitivities, together with proactive involvement of the end users, both the impact of unauthorized or malicious data loss can be mitigated and expensive costs associated with a blanket data security approach can be avoided.

Are We Doing Enough to Protect Our Unstructured Data?

Organizations will likely have until the end of 2024 to gain visibility and control over their keys and certificates.

Google is proposing to reduce the life span of digital certificates used to secure websites and other online communications to just 90 days. Currently, public Transport Layer Security (TLS) certificates have a maximum validity of 13 months, or 398 days.

Certificate authorities issue TLS certificates (also called Secure Socket Layer, or SSL, certificates) with an expiration date. The life span of these certificates have been shrinking over the last few years, since frequently cycling them makes it harder for attackers to use fraudulent certificates.

In the Chromium Project's “Moving Forward, Together” roadmap, Google suggested the change to 90 days could be made either in the form of a future policy update or as a CA/B Forum Ballot Proposal. If the CA/B Forum, a consortium of browser makers, certificate authorities, and other stakeholders in the digital certificate ecosystem, doesn't formally make 90 days the industry standard, Google can unilateral force this change on the industry by making the shorter validity period a requirement for the Chrome root program. Browsers control their own root program requirements, so browser makers don't have to wait for formal rule changes from the CA/B Forum. By virtue of Chrome's market share, if Google makes this change for Chrome, that makes it a de facto standard that every commercial public certificate authority would have to follow.

The impact goes beyond browser makers and certificate authorities as organizations will need to renew their digital certificates more often. The process, if handled manually, can be a brittle process, as it involves identifying certificates about to expire, getting new ones issued, revoking the old ones, and deploying the new certificates. With the new validity period, IT security teams will have to handle renewals four times a year for each certificate -- an arduous task considering most enterprises have many certificates and that number is growing rapidly.

Google did not provide a specific timeline in its roadmap but based on how the changes have unfolded in the past, the new validity period will likely take effect by the end of 2024, which gives organizations time to gain visibility and control over their keys and certificates.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Google Proposes Reducing TLS Cert Life Span to 90 Days

Patch Tuesday turned security updates from chaotic events into a routine. Here's how we got here and where things might be heading.

On Oct. 9, 2003, Microsoft CEO Steve Ballmer announced that the company would issue security patches only once a month to "reduce the burden on IT administrators by adding a level of increased predictability and manageability."

Two decades later, Microsoft continues to issue its security updates on the second Tuesday of every month, with occasional exceptions for emergency situations. Many other companies, like Oracle and Adobe, follow similar rules.

Patch Tuesday turned risk management into a monthly appointment, but like many innovations it was founded from crisis. At the beginning of 2002, shortly after the world experienced two of its first cyber doomsdays, Code Red and Nimda, Microsoft decided to change its philosophy around security. The two worms, which infected hundreds of thousands of machines in a matter of hours, exploited vulnerabilities for which patches were available.

"The problem was not that we weren't building patches; the problem was that people weren't deploying them quickly enough," says Christopher Budd, who was with Microsoft from 2000 to 2010 and is now a senior manager for threat research at Sophos.

At that time, the trauma of 9/11 was palpable in North America, and there was a growing concern within Microsoft regarding security. On Jan. 15, 2002, Bill Gates sent his famous Trustworthy Computing memo, highlighting the importance of protecting customers and their systems.

One way to improve security was to change how patches were delivered. So instead of announcing them unpredictably, on a ship-when-ready basis, several times during a week, Microsoft began to stack them together to make it easier for customers to keep up.

At first, the idea was implemented as a "silent pilot project," Budd says. But as it showed promising results, it was soon made official. The first official Patch Tuesday report was published on Oct. 14, 2003, and it included seven vulnerabilities, five of which were seen as critical.

"Tuesday was the earliest day in the week that we felt we could sustainably offer these," says Budd, who helped build Patch Tuesday.

This fixed-schedule approach has become a standard industry practice. But the road was not always smooth.

**The Early Days of Patch Tuesday**

Throughout the years, Microsoft has evolved and refined its approach to security patches, adapting to changing threats. Notable worms that followed Code Red, such as Sasser and Blaster, helped Patch Tuesday to grow and eventually mature.

Budd and his colleagues in the Microsoft Security Response Center, who "suddenly became incredibly important" after the Trustworthy Computing memo, tried to make improvements around patch deployment and detection. One key achievement was to build tools that enabled admins to do a scan and identify the systems that needed security updates — an idea that, while simple, proved to be a game-changer.

The entire process of releasing patches required extensive work, particularly on the Monday before Patch Tuesday, when everything had to be checked. Security experts put in long hours, missed birthday parties, and even showered in Microsoft's headquarters because they didn't have the time to go home.

It is why the releases of the bulletins were celebrated with music blasting over loudspeakers. "When the bulletins were live, it was a big deal for us," says Dustin Childs, who was with Microsoft between 2008 to 2014 and is now the head of threat awareness at Trend Micro's Zero Day Initiative.

Typically, the music was picked by the release manager for that bulletin. "I remember one month it was Klingon music, but it was usually rock and roll," Childs says.

Occasionally, soon after the music stopped, chaos would ensue because some patches caused unintended consequences. One notable incident happened in February 2010, when thousands of customers reported blue screens almost immediately.

When security experts in Redmond heard about the issue, they tried to replicate it but were unsuccessful. For the lack of a better solution, Microsoft bought the computer of a customer who called a support center near Dallas to report the issue.

"And as soon as we got that computer, we found that it had a rootkit installed in it," Childs says.

The Alureon rootkit made modifications to Windows Kernel binaries, which caused the systems to be unstable. The company reissued the patch and fixed the problem.

"The really funny part, though, was that the people who made the rootkit figured it out faster than we did, and they had updated their rootkit to avoid the patch within 48 hours \[of the release\]," Childs says. "It took us a week to fix it!"

And it wasn't the only bizarre episode in Patch Tuesday's history. For instance, Childs remembers that an Internet Explorer patch crashed online banking in South Korea, while a Windows Media Player patch broke an entire country — twice.

"For some reason, on systems in Denmark, it blue-screened," he says. "So we had to recall that patch, fix it and re-release it. And then, the very next month, the same thing happened again. I don't know what was specific about the systems in Denmark."

Even today, some patches released by software companies in general, not just Microsoft, can cause issues, which can be frustrating for those installing them. Childs argues that if vendors improve the reliability of these fixes, customers might be more willing to apply them promptly, as opposed to waiting weeks or months to see if others experienced issues.

Taking the waiting approach can be risky, as it leaves their systems vulnerable to known vulnerabilities. It is why Childs recommends users apply patches as soon as possible. He also tells them to call attention to poor-quality patches.

"Let's hold vendors accountable," Childs says. "Let's make sure that they're producing good patches."

Aanchal Gupta, deputy CISO at Microsoft, says the company is doing "extensive testing" of patches.

"Before we issue any patch to our customers, it goes through rigorous testing not just within Microsoft. ... \[W\]e also have a set of beta testers, external companies, and they get the patches early on before these are actually made public," she says. "They can test in their environment and report back to us whether there is something unique in their environment which could make the patch not work."

**Patch Tuesday Today**

Patch Tuesday has come a long way since those early days when Klingon music blasted from the speakers. Over time, the releases have become quieter and even automated, becoming invisible to some users.

In the past decade, Microsoft has made several changes to streamline the process. In the mid-2010s, for instance, it announced cumulative updates so that a customer who missed, for instance, five patches only needed to apply the last one because the other ones were included in it. The company also launched machine-readable Security Update Guides, which meant that organizations with huge fleet deployments could rely on automation.

But not every change was welcomed by the community. When Microsoft decided to eliminate security bulletins and replace them with Security Update Guides, customers complained that the information they received was less intuitive. Something similar happened in the fall of 2020, when the tech giant removed executive summaries that included detailed information on vulnerabilities. Once again, many in the industry argued that they didn't receive enough information, which made their decision-making processes difficult.

That was "probably the most disruptive" decision Microsoft made, says security researcher Claire Tills. "I know some defenders also really had trouble with that."

More recently, in 2022 Microsoft took yet another step toward making Patch Tuesday a regular Tuesday, when it announced Autopatch, which promised to ease the process of addressing vulns for customers with Windows Enterprise E3 and E5 licenses. The move made organizations wonder whether Patch Tuesday as we know it might disappear — a rumor Microsoft denied.

The publicity around Patch Tuesday is getting smaller and the number of Patch Tuesday vulnerabilities may have peaked. In 2020, a particularly "aggressive year," Tills counted around 1,200 vulns, while in 2022, she saw 663.

"In terms of the types of vulnerabilities, it's consistently elevation of privilege and remote code execution," she says. "Every once in a while, we'll get peaks in information disclosures and security feature bypass — those two also pop up."

But despite the features meant to streamline the process of applying patches, this task can still be daunting for small businesses that can't afford a dedicated tech support team. It is why Gupta recommends these clients to move to the cloud.

"Then you can purely focus on your business and you don't have to worry about patching and managing systems," she says. "I also encourage people to not disable the default upgrades."

But as we transition toward automating the processes, is dedicating one day for updates obsolete?

**Is Patch Tuesday Becoming Obsolete?**

It is hard to fathom a world of cybersecurity without Patch Tuesday, which has been an integral part of the industry for two decades. As threats become more sophisticated and geopolitics becomes more volatile, however, the traditional model of Patch Tuesday may no longer be sufficient to keep systems secure.

Organizations operating in complex environments, such as in those competitive fields or based in hot areas like Ukraine, cannot afford to make mistakes when it comes to patch management. Threat actors often "targeted technical vulnerabilities rather than specific individuals or organizations," says Nazar Tymoshyk, founder and CEO of cybersecurity startup UnderDefense, which has protected several organizations during the ongoing war with Russia.

"The exploitation of unpatched vulnerabilities in technology stacks or outdated Web resources still accounts for 50% of \[Russia's\] success in cyber-intelligence operations," he says.

Tymoshyk believes that Patch Tuesday is still necessary and should not be retired. However, organizations should build on top of it, adopting additional patching routines depending on the size and complexity of their infrastructure or the types of software and systems they use.

Satnam Narang, senior staff research engineer at Tenable, also favors keeping Patch Tuesday alive because routines can help organizations foster a security-focused culture.

"Each week the folks come to pick up the trash from our street, and we know that that's happening every week on a specific day," he says. "The reason why Patch Tuesday is a valuable resource is that it happens every month on a specific day, so it allows organizations to carve out the time necessary to patch these vulnerabilities."

A chaotic patching system might not work, Narang says, because security teams are already overwhelmed. Aviv Grafi, CTO and founder at Votiro, agrees. "Time is of the essence, and we need to focus on leveraging technologies and software that give security teams more time back in their day," Grafi says.

Security researchers also add that continual patch cycles and automatic updates might not always be feasible at enterprise level in some cases. "In the event of a problem, large organizations need to be able to revert systems to a known state, and that requires planning," says David Farquhar, solutions architect at Nucleus.

Patch Tuesday is a crucial element in the routines of many organizations, but despite that, it can be unpredictable. The past years have shown that its structure can change without prior warnings. "Even though Patch Tuesday feels so foundational and so solid, it can change at the drop of a hat," Tills says. "The end of Patch Tuesday could feel disastrous for a lot of organizations."

For the time being, though, it appears that Microsoft will keep the program running. "I wouldn't worry about Patch Tuesday going away anytime soon," Gupta says.

How Patch Tuesday Keeps the Beat After 20 Years

Convergence of two leading cybersecurity companies creates federal sector powerhouse.

**DENVER — March 14, 2023 —** Optiv, the cyber advisory and solutions leader, today announced it has acquired Maryland-based ClearShark LLC and ClearShark Services, Inc. (collectively ClearShark), a premier advisor and top value-added reseller of cybersecurity and modernization technology to the United States federal government. The transaction more-than doubles Optiv’s federal presence, while significantly deepening its bench of government expertise and expanding the breadth of its federal capabilities.

“ClearShark is now the cornerstone of a vibrant Optiv federal business where we will together bring a new level of world-class federal capabilities to the market at scale,” said Optiv CEO Kevin Lynch. “Between the uptick in cyberattacks, the recentBiden-Harris Administration’s National Cybersecurity Strategy and other security regulations, cybersecurity has never been more vital. Together with ClearShark, we are primed to better help federal agencies and contractors ensure a strong cybersecurity posture and build a lasting legacy in the public sector space.”

“Joining forces with the largest pure-play cybersecurity company in the world provides us, our clients and partners with a tremendous growth opportunity. We couldn’t be more excited about this partnership or more bullish on the future,” said Brian Strosser, ClearShark LLC president.

ClearShark Services President Marshall Bailey added, “Leveraging Optiv’s comprehensive suite of cybersecurity solutions and services, we can continue to expand our already dominate delivery capabilities and operate at scale while also providing employees with new career opportunities.” 

The acquisition brings together two leading cybersecurity companies to create a powerhouse partnership that will better serve current and new clients by providing:

*   An expanded federal presence with more direct connections to the public sector.
*   An even broader federal team that builds on the exceptional Optiv service and expertise clients and partners have come to depend on.
*   A vast and comprehensive portfolio of cybersecurity services and solutions, technical capabilities and federal resources.
*   Exceptional relationships with the industry’s leading security technology companies and product manufacturers.

The terms of the transaction are not being disclosed.Holland & Hart LLP provided counsel to Optiv during the transaction.IzenbergLaw PLLC,Fontana Law GroupandPilieroMazza PLLC provided counsel to ClearShark.

For the latest news and updates from Optiv, visit https://www.optiv.com/newsroom

**Follow Optiv**

Twitter: www.twitter.com/optiv

LinkedIn: www.linkedin.com/company/optiv-inc

Facebook: www.facebook.com/optivinc

YouTube: www.youtube.com/c/OptivInc

Blog: www.optiv.com/explore-optiv-insights/blog

**Optiv Security: Secure greatness.****®**

Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.

**ClearShark**

ClearShark is an IT solutions provider, comprised of ClearShark LLC (including FedBiz) and ClearShark Services, Inc., focusing on providing cybersecurity, datacenter and cloud infrastructure, AI and data analytics and DevSecOps solutions and services. Our first-class engineering team is made up of mission-focused, results-driven subject matter experts from the intelligence community, Department of Defense and Department of Energy. We are focused and innovative, making investments in technologies we believe in, and being free to pivot and find disruptive technologies. For more information, visit www.clearshark.com.

Optiv More Than Doubles Federal Presence With ClearShark Acquisition

**Brescia, Istanbul,** **Tel** **Aviv,** **March** **14th,** **2023** **—** Camozzi Group, a leading provider of Industrial Automation solutions, and Radiflow, part of Sabanci Holding and a global player in Industrial Cybersecurity and Operational Technology (OT), have announced a collaboration agreement to implement cybersecurity technologies across Camozzi's production sites.

The collaboration between Camozzi Group and Radiflow aims to strengthen the resilience and security of industrial infrastructures in any sector, recognizing cybersecurity as a core strategic business pillar. The risks of OT Cybersecurity attacks aimed at productive systems have become a fast-growing phenomenon in Italy and around the world. The collaboration seeks to identify vulnerabilities and sources of attacks while relying on high-performance risk management systems.

According to Exprivia's latest threat report, the total number of detected threats in Italy was 2,600 in 2022, which is double the number registered in 2021 and four times higher than those registered in 2020. Therefore, it is crucial for enterprises to understand the level of risk exposure and secure their technology systems by adopting advanced software and platforms, as well as through organizational and training models suitable for the new challenges of OT and IIOT (Industrial Internet of Things) security.

The collaboration with Radiflow will enable Camozzi Group to maximize security and stability further. Already characterized by an elevated level of technology reliability, this collaboration reinforces Camozzi Group's commitment to its customers' security and stability.

The partnership between Camozzi Group and Radiflow will undoubtedly lead to strengthened cybersecurity for industrial systems, making Camozzi Group a safer and more secure provider of Industrial Automation solutions.

**About Camozzi Group**

Founded in 1964, Camozzi Automation proposes a product range including components, systems and technologies for the Industrial Automation field, the control of fluids - both liquids and gases - and applications dedicated to the Transportation and Life Science industries.

Camozzi Automation’s offering includes ever more IIoT products and solutions. We work on both the digitalisation of production processes and the creation of real cyber-physical systems, to enable the integration of mechanical, electronic and digital elements, constantly improving process performance and the management of the data chain.

**About Radiflow**

Radiflow is an OT Cyber Security company that has unique tools to protect and manage digital OT assets for the long term. Radiflow works directly with Managed Security Service Providers to oversee the discovery and management of all relevant data security points. Radiflow’s unique pinpoint approach brings the businesses’ team into the fold, trading the industry’s one-size-fits-all approach for a calculated, focused, and secured system without inhibiting communication or productivity. With offices in Europe and the US, Radiflow’s solution is installed in over 6000 sites around the globe.

Camozzi Group and Radiflow Announce Collaboration on Industrial Systems Cybersecurity

Security vendors urge organizations to fix the actively exploited bugs, in Microsoft Outlook and the Mark of the Web feature, immediately.

IT teams should prioritize the patching of two zero-day vulnerabilities, one in Microsoft Outlook's authentication mechanism and another that's a Mark of the Web bypass, security experts said today. The two are part of a cache of 74 security bugs that Microsoft disclosed in its March Patch Tuesday security update.

In a blog post, researchers from Automox recommended that organizations patch both vulnerabilities within 24 hours since attackers are exploiting them in the wild. 

In addition, several of the critical flaws in the March update enable remote code execution (RCE), making them a high priority for patching as well. 

Vendors had slightly different takes on the total number of new critical vulnerabilities in Microsoft's March update — likely because of differences in what they included in the count. Trend Micro's Zero-Day Initiative (ZDI), for instance, identified six of the vulnerabilities in Microsoft's March update as critical, while Tenable and Action1 pegged the number at nine.

**Privilege Escalation Zero-Day**

One of the zero-days is a critical privilege escalation vulnerability in Microsoft Outlook tracked as CVE-2023-23397, which allows an attacker to access the victim's Net-NTLMv2 challenge-response authentication hash and then impersonate the user. 

What makes the bug dangerous is that an attacker could trigger it simply by sending a specially crafted email that Outlook retrieves and processes before the user even views it in the Preview Pane.

"This is because the vulnerability is triggered on the email server side, meaning exploitation would occur before a victim views the malicious email," said Satnam Narang, senior staff research engineer at Tenable in an emailed comment. An attacker could use the victim's Net-NLMv2 hash to conduct an attack that exploits the NTLM challenge-response mechanism and allows the adversary to authenticate as the user.

That makes the bug more of an authentication bypass vulnerability than an privilege escalation issue, added ZDI researcher Dustin Childs, in a blog post that summarized the most important flaws in Microsoft's March Patch Tuesday update. Disabling the Preview Pane option will not mitigate the threat because the bug gets triggered even before that, he wrote.

Microsoft attributed the bug's discovery to researchers from Ukraine's Computer Emergency Response Team (CERT) as well as one of its own researchers.

Organizations that cannot patch CVE-2023-23397 immediately should consider implementing Microsoft's mitigation for the flaw, which prevents the use of NTLM as an authentication mechanism, Automox said.

**Actively Exploited Security Feature Bypass Flaw**

Microsoft identified the second zero-day bug as CVE-2023-24880, a Windows SmartScreen security feature bypass issue than at attacker could use to bypass the Mark of the Web designation that Microsoft uses to identify files that a user might download from the Internet. 

The feature is designed to warn users about potentially unsafe content. CVE-2023-24880 affects all desktop systems running Windows 10 and above and systems running Windows Server 2016, 2019, and 2022.

Chris Goettl, vice president of security products at Ivanti, cautioned administrators not to be lulled into a sense of false security by Microsoft's relatively low severity rating for the flaw. 

"The CVSSv3.1 score is only 5.4, which may avoid notice by many organizations," Goettl said in a statement. On its own, the CVE may not be all that threatening, "but it was likely used in an attack chain with additional exploits," he warned.

**Other Security Bugs at High Patching Priority**

One of the RCE flaws to make a special note of is CVE-2023-23415, which exists in the Internet Control Message Protocol (ICMP) that network devices use to diagnose communications issues. 

"An attacker can remotely exploit this vulnerability through the use of a low-level protocol error containing a fragmented IP packet in its header that is sent to the target machine," Microsoft said. The vulnerability affects multiple Microsoft products, including Windows 10, Windows 11, Windows Server 2008, 2012, 2016, 2019, and 2022.

ZDI, Automox, and Action1 also all identified a RCE vulnerability with a near maximum severity of 9.8 on the CVSS scale in the HTTP Protocol Stack as another issue that organizations might want to prioritize. 

The vulnerability (CVE-2023-23392) allows an unauthenticated attacker to send a specially crafted packet to a server that uses the HTTP Protocol Stack leading to RCE. "The vulnerability affects Windows Server 2022 and Windows 11, and has a low-complexity attack vector that requires no privileges or user interaction," Action1 warned. Because of this, Microsoft has assessed the vulnerability as one that threat actors are more likely to exploit than other flaws.

Automox also recommended that organizations address CVE-2023-23416, a RCE bug in the Windows Cryptographic Services protocol, within 72 hours. That's because, among other things, it affects all versions of desktops Windows 10 and above, and all Windows server editions from Server 2012 on.

In addition to patches for new vulnerabilities, Microsoft also issued updates for four older flaws — all from 2022 — in its March patch cycle. The update expands the number of Microsoft software and applications affected by the vulnerabilities and provides a patch for them, Ivanti said. The security vendor identified the four updated patches as CVE-2022-43552, CVE-2022-23257, CVE-2022-23825, and CVE-2022-23816.

Microsoft Zero-Day Bugs Allow Security Feature Bypass

Financing will help support increasing customer demand while continuing to transform incident response for cloud and SaaS environments

**NEW YORK, March 14, 2023 –** Mitiga, the cloud and SaaS incident response leader, today announced the completion of its $45 million Series A Round, bringing total funding to $45 million, led by ClearSky Security, with participation from Samsung Next and existing investors Blackstone, Atlantic Bridge and DNX. This news comes on the heels of Mandiant’s former President/COO, John Watters, joining Mitiga as an independent board member.

"When we founded Mitiga, we had one goal in mind — to help organizations accelerate their responses to the rising tide of cloud and SaaS attacks," stated Tal Mozes, co-founder and CEO, Mitiga. "We knew we could do it better than traditional incident response (IR) solutions because they’re reactive by nature, and tremendously time-consuming. Our proactive and automated approach enables organizations that experience cloud and SaaS breaches to respond immediately and recover faster than any other solution on the market. We are thrilled to include Samsung Next as one of our investors and look forward to our next growth phase in 2023 and beyond."

Mitiga will use the investment to accelerate its growth, helping to meet the high demand for cloud incident response services from the overwhelming number of organizations that now rely on cloud and SaaS environments—because today's harsh reality is that cloud attacks are inevitable. Mitiga’s modern approach offers cloud-driven companies a new level of cyber and organizational resilience. By enabling ongoing readiness and compressing the investigation time from weeks or months to hours, Migita's solution reduces incident-related damage and gets customers back to business fast.

"As more and more companies are advancing their cloud journeys, they're beginning to understand that growing their cyber resiliency is a vital part of that transformation" stated Tal Achituv, CTO, Samsung Next. "Mitiga's modern incident response solution combined with the team’s deep cloud forensics expertise enables companies to prepare for cloud breaches before they happen — so they get back to business immediately. It's an important capability and we're happy to be supporting Mitiga to enable it."

To learn more about Mitiga, please visit www.migita.io, or if attending the 2023 RSA Conference, stop by Moscone North Expo, Booth 5624. 

**About Mitiga**

Mitiga is the cloud and SaaS incident response leader. In a world filled with cloud risks, we help organizations return to business as usual 90% faster than traditional incident response. Our IR2 solution provides instant answers to the most burning breach-related questions, enabling teams to speed investigations, minimize impact, and enhance cyber resilience against future attacks. Mitiga’s approach leverages automated insights from our leading-edge SaaS platform and combines them with support from Mitiga's world-leading cloud incident responders. The result not only accelerates and improves incident response, but it also minimizes enterprises' breach-related costs through a subscription-based model that makes cloud and SaaS IR expenditures more predictable.

Samsung Next Invests in Mitiga, Brings Total Funding to $45M

The ransomware group sent a message directly to Elon Musk: Pay or the confidential SpaceX information goes up for grabs on the Dark Web.

The LockBit ransomware group is reportedly threating to release stolen SpaceX schematics unless Elon Musk pays to keep them under wraps.

Musk has until March 20 to make an extortion payment, according to a recent LockBit post shared on Twitter by cybersecurity analyst Dominic Alvieri. The confidential drawings were reportedly lifted not from SpaceX itself, but from a third-party vendor: Maximum Industries, which produces parts for SpaceX projects.

"Elon Musk we will help you sell your drawings to mother manufacturers — build the ship faster and fly away," the LockBit ransomware demand read.

“When people hear of extortion, their mind immediately goes to ransomware. However, ransomware is just one tool in an attackers arsenal," says Javvad Malik, lead awareness advocate at KnowBe4,. "The data is the actual gold dust that the criminals are after. If they can exfiltrate it, then they have immense leverage over the victim."

He adds, "This raises the important questions of how criminals get into organizations, how they spend so long undetected, and how can sensitive data be exfiltrated without being blocked. The answers to these extend beyond simply looking at point products, but is really about looking at the overall security culture in an organization and how it can be strengthened in a positive manner to reduce the overall risk.”

Ransomware accounted for about $34 million in adjusted losses reported to the FBI last year, according to the FBI's Internet Crime Report (PDF).

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading