Since requirements differ for users who work both from home and in the office, policies — and underlying technology — must adapt.

The demand for remote work has only grown since the serious transition began almost three years ago. Organizations have seen the benefits of working remotely. Still, they have also been transitioning into much more of a hybrid work environment, where employees are allowed to work both from home and in the office, choosing the days they want to collaborate in person. Several companies have seen success in this hybrid work environment, having begun testing this new way of working since the fall of 2022.

The transition to a hybrid workforce has meant that security teams are on high alert, since they now have to protect the internal office network and secure connectivity from multiple locations their users are working. The looming fear of more outbreaks and recession has IT leaders considering robust solutions to protect their hybrid workforce in the longer term. The following are predictions for hybrid work in 2023.

**Return to the Office Will Demand Better Access**

Hybrid work is here to stay! Yes, yes, I know it's been said many times, but it really is. While this is the reality of the foreseeable future, employees demand a better user experience while working from the office and remote locations.

During the sudden switch to remote work, IT leaders turned to VPNs as an easy way to fix a short-term problem. However, given the current scenario of a long-term hybrid workforce, this strategy needs to be reconsidered. And that's what several organizations are doing as they find zero trust to be a more reliable and scalable solution. Having tested zero trust for remote employees, we fully expect zero trust to apply universally to remote and in-office users.

**Ransomware, Multifaceted Extortion Will Continue to Grow**

With the increase in locations of connectivity, so too is the attack surface growing. The number of exposed vulnerabilities has increased, and so has the risk. Hybrid work will increase the adoption of bring your own device (BYOD) in 2023. With the multitude of devices, we'll see the general attack surface expand with the potential for profound impact. Over the past couple of years, we have heard several cases of ransomware being introduced to company networks due to exploited VPN servers. These stories will continue to make headlines in 2023 as well. There needs to be an additional emphasis on security for the work-from-anywhere workforce and a fundamental change to how security teams look at securing the perimeter and resources.

**Final Nail In VPN Coffin**

Virtual private networks are old news. Traditional networks, VPNs, and DMZs use IP addresses and network locations to establish network connectivity for users. This architecture was built over 30 years ago to provide users access to data center applications, not modern cloud-based ones. In addition, VPNs are being used as a conduit for cyberattacks due to legacy architecture, and there is a need for continuous assessment to manage appliances. Finally, due to their slow connectivity, users complain about VPNs hampering their productivity. Users are looking for seamless, scalable, and secure access to applications in your data center or a public cloud without needing a VPN.

**Security Is Now a Shared Responsibility**

Networking and IT leaders have had to adopt new technologies and infrastructure to match the modern way of work. News surrounding security exploits in the recent past has forced increased attention to cyber-risks. Businesses globally are increasingly exposed, placing security teams under immense pressure. Security is now vital and will be a shared responsibility that spans from individuals to IT, supply chains, and the C-suite. 2023 will see an increase in the adoption of zero trust for the hybrid workforce to provide complete security from the users to the applications, no matter where they connect.

**Cloud Security Solutions At the Forefront**

Protecting users, data, and applications is integral to providing a secure hybrid work environment. We predict cloud security as the primary security solution as security appliances and hardware security solutions slowly fade away. Organizations will also look for platforms that offer a broader solution set to ensure they are secure and can justify their investment. Security service edge (SSE) is fast becoming a reliable solution for remote work, the cloud, secure edge computing, and digital transformation. Delivered as a unified cloud-centric platform, SSE enables organizations to break free from the challenges of traditional network security.

Read more _Partner Perspectives_ from Zscaler.

Predictions For Securing Today's Hybrid Workforce

The demand is unmistakeable and the business case is readily justified — it's time to implement zero trust.

It's been nearly three years since the business world was catapulted into remote work, yet many organizations are still grappling with making essential technology upgrades. They're looking to provide better security for hybrid working, along with digitized production infrastructure, while managing emerging dependencies on the Internet of Things, operational technology, and 5G cellular. Now, they're also contending with challenging economic conditions, supply chain uncertainty, changing business demands, and budget pressures in a macro economy.

To succeed in this new climate, organizations need the agility and efficiency enabled by the cloud along with the security to protect their valuable assets and data. That's why more businesses are discovering they must accelerate digital transformation and adopt zero-trust security to address today's complex business needs.

**Securing the Case For Zero-Trust Security**

Embracing zero-trust security as a part of any digital transformation strategy has profound impacts, from changing company culture to creating new business models where technology enables innovation, change, and growth. As such, IT and security leaders have a key opportunity to bridge the gap and join forces in educating decision makers on the wide-reaching benefits of zero-trust infrastructure.

The common divide between the different business teams can lead to many misunderstandings around the rationale of embarking on a journey of zero-trust transformation. For instance, executive leaders tend to see digital transformation as a technology issue, moving spending from infrastructure to cloud providers, rather than an integral part of the business strategy that enables their organization to forge new revenue models, increase productivity, and scale without limitation.

Security leaders may confuse a zero-trust initiative as just another digital transformation IT project they have to help support while overlooking the workload reduction impacts on their own day-to-day operations. The deeper value of implementing inline threat prevention and continuous policy enforcement from a zero-trust architecture shifts the primary strategy from detection to prevention, combined with continuous authentication and visibility to limit the impact of incidents and provides rich telemetry to improve response times.

For their part, IT leaders focused on driving the business tend to best understand that transformation is not only about migrating apps to the cloud, but about futureproofing the business so it has all the requirements needed to safely scale, grow, and effectively reach new goals. The majority of IT decision makers agree that secure cloud transformation is impossible with legacy network infrastructure and that zero trust has clear advantages over traditional firewalls and VPNs for securing remote access.

With all the financial, social, and operational pressures on organizations today, it is critical for business leaders to shift perspective and recognize that now is the time to join forces and embrace zero trust as a requirement for enabling our remote workforces, protecting against the most damaging types of cyber threats, and as a high-value growth and business impact driver capable of delivering the significant cost savings organizations need to thrive.

**Unlocking Value with Zero-Trust Architecture**

Disrupting decades of legacy security and networking principles, the concept of zero trust has evolved into a framework for critically securing our users, devices, applications, and data. IT and security leaders globally are waking up to this imperative to transform their legacy infrastructure as they face more complex business, access, data, and security challenges than ever before. Against a backdrop of rapid digital transformation, a disappearing network perimeter, and evolving threats, organizations turn to zero-trust architecture as the gold standard for reducing risk and enabling productivity in a remote, distributed, and cloud-enabled world.

A comprehensive zero-trust platform has the power to redesign business and organizational infrastructure requirements. It can become a business driver that provides the hybrid work support employees need to succeed, and enables complete agility with:

*   **Cyber protection**: a holistic approach to better risk reduction by stopping things before they ever get to the enterprise or the customer.
*   **Data protection**: ensure only verified users with appropriate permission can access policy-enforced applications.
*   **Zero-trust connectivity**: zero trust eliminates access to the company network and the lateral threat movement enabled by access to traditional routable networks.
*   **Digital user experience**: frustration-free access for increased productivity.

Zero-trust architecture brings solving major IT, workforce, and security business challenges within reach by driving greater innovation, supporting better collaboration, and preventing large-scale cyberattacks. On top of these benefits, the right solution will also help deliver significant cost savings. Heeding the call means recognizing that full zero-trust digital transformation is the missing link helping businesses empower and ready themselves today for whatever threats and technologies the future brings.

Read more _Partner Perspectives_ from Zscaler.

Unleash the Full Potential of Zero-Trust Security

The incidents are the latest indication of the growing popularity of dangerous disk wipers, created to disrupt and degrade critical infrastructure and other organizations.

Sandworm, an advanced persistent threat (APT) group linked to Russia's foreign military intelligence agency GRU, has deployed a medley of five different wipers on systems belonging to Ukraine's national news agency Ukrinform. 

The attack was one of two recent wiper offensives from Sandworm in the country. The efforts are the latest indications that the use of destructive wiper malware is on the rise, as a popular weapon among Russian cyber-threat actors. The goal is to cause irrevocable damage to the operations of targeted organizations in Ukraine, as part of Russia's broader military objectives in the country.

**A Medley of Wipers**

According to Ukraine's Computer Emergency Response Team (CERT-UA), the Ukrinform attack was only partially successful and ended up not impacting operations at the news agency. But had the wipers worked as intended they would have erased and overwritten data on all the infected systems and essentially rendered them useless.

CERT-UA reported the attack publicly last Friday after Ukrinform asked it to investigate the incident on Jan. 17. In an advisory, CERT-CA identified the five wiper variants that Sandworm had installed on the news agency's systems as CaddyWiper, ZeroWipe, SDelete, AwfulShred, and BidSwipe. Of these, the first three targeted Windows systems, while AwfulShred and BidSwipe took aim at Linux and FreeBSD systems at Ukrinform. Interestingly, SDelete is a legitimate command line utility for securely deleting Windows files.

"It was found that the attackers made an unsuccessful attempt to disrupt the regular operation of users' computers using the CaddyWiper and ZeroWipe malicious programs, as well as the legitimate SDelete utility," a translated version of CERT-UAs advisory noted. "However, it was only partially successful, in particular, to several data storage systems."

**"SwiftSlicer" Wiper Comes to Light**

Separately, ESET disclosed another attack last week where the Sandworm group deployed a brand-new wiper dubbed SwiftSlicer in a highly targeted attack against an unidentified Ukrainian organization. In the attack, the Sandworm group distributed the malware via a group policy object, suggesting that the threat actor has already gained control of the victim's Active Directory environment, ESET said. CERT-UA had described Sandworm as employing the same tactic to try and deploy CaddyWiper on Ukrinform's systems.

Once executed, SwiftSlicer deletes shadow copies, recursively overwrites files in system and non-system drives, and then reboots the computer, ESET noted. "For overwriting it uses 4096 bytes length block filled with randomly generated byte(s)," the security vendor said.

Sandworm's use of disk wiper malware in its campaigns against Ukrainian organizations is one indication of the destructive power that threat actors perceive these tools as having. Sandworm is a well-known, state-backed threat actor that became infamous for its high-profile attacks on Ukraine's power infrastructure, with malware such as BlackEnergy, GreyEnergy, and, more recently, Industroyer.

Sandworm's rampant use of disk wipers in its new campaigns is consistent with a broader increase in threat actor use of such malware in both the weeks leading up to Russia's invasion of Ukraine, and in the months since then.

At a session during Black Hat Middle East & Africa last November, Max Kersten, a malware analust from Trellix, released details of an analysis he had conducted of disk wipers in the wild in the first half of 2022. The researcher's study identified more than 20 wiper families that threat actors had deployed during the period, many of them against targets in Ukraine. Some examples of the more prolific ones included wipers that masqueraded as ransomware, such as WhisperGate and HermeticWiper, and others such as IsaacWiper, RURansomw, and CaddyWiper.

The researcher's study showed that, from a functionality standpoint, disk wipers had evolved little since the "Shamoon" virus of more than a decade ago that destroyed thousands of systems at Saudi Aramco. The major reason is that attackers usually deploy wipers to sabotage and destroy systems and therefore have little need for building in the stealth and evasiveness required for other types of malware to be successful.

So far, threat actors have used disk wiping malware only relatively sparingly against organizations in the US, because their motivations have been typically different than those going after targets in Ukraine. Most attacks targeting organizations in US tend to be financially motivated, or involve a spying or cyber-espionage bent. However, that doesn't mean threat actors cannot launch the same kind of destructive attacks in the US if they choose too, analysts have cautioned.

Russia's Sandworm APT Launches Swarm of Wiper Attacks in Ukraine

**Mountain View, Calif.– January 31, 2022 –** SentinelOne (NYSE: S), an autonomous cybersecurity platform company, today announced an alliance with KPMG LLP, the audit, tax and advisory firm, to accelerate investigations and response to cyberattacks.

“Our customers are global in nature and find themselves rethinking cybersecurity,” said David Nides, KPMG Principal and National Cyber Threat Management Services Co-Leader. “The future of cybersecurity is autonomous, and SentinelOne, coupled with the industry experience of KPMG, helps prepare enterprises for tomorrow’s threat landscape. SentinelOne Singularity XDR can help our customers respond to incidents as well as collaborate on preventive services.”

Cyberattacks are a daily occurrence for enterprises in every geography and sector.Together, KPMG cyber response services and SentinelOne Singularity XDR can help organizations gain visibility, protection, and response against advanced threats to mitigate risk. Today’s threat landscape targets the modern enterprise perimeter, spanning endpoints, clouds, and identities. With KPMG and SentinelOne, enterprises are more protected against the loss of intellectual property, customer data, and other sensitive information that can cause financial and reputational damage.

“The KPMG and SentinelOne alliance helps provide integrated support to our clients. This is critical during an incident related deployment, and a term benefit that assists our clients in making the most of a cyber security investment,” said Jonathan Fairtlough, KPMG Principal, Cyber Threat Management Services.

“Our experience with KPMG and SentinelOne has resulted in a whole new cybersecurity posture,” said Michael Labate, Director of Global IT, The Middleby Corporation. “Combining the industry’s most autonomous cybersecurity technology with the tested and tenured cybersecurity expertise, helps scale our security operations as well as bring cybersecurity assurance to our executives.”

For enterprises that have previously fallen victim to an attack, the KPMG Digital Responder (KDR) integrates with Singularity XDR’s data ingest, helping enterprisesrapidly ingest and correlate data so incident response teams cango back in time and perform true enterprise forensics and understand the root cause of attacks. The alliance empowers enterprises to contain breaches, remediate impacted assets, and return to productivity in a rapid and complete fashion.

“The KPMG cyber team is consistently on the front-lines of the most critical breaches of today, many of which compromise identity access, penetrate cloud instances and endpoints, and exfiltrate data,” said Nicholas Warner, President, Security, SentinelOne. “Our technology provides the backbone to deliver best-in-class incident response at speed and scale as well as proactive cybersecurity readiness services. Together, KPMG and SentinelOne help the world’s leading enterprises reduce risk and stay protected.”

To learn more about SentinelOne’s alliance with KPMG visit https://www.sentinelone.com/partners/cyber-risk-partners/.

**About SentinelOne**

SentinelOne’s cybersecurity solution encompasses AI-powered prevention, detection, response and hunting across endpoints, containers, cloud workloads, and IoT devices in a single autonomous XDR platform.

**About KPMG LLP**

KPMG LLP is the U.S. firm of the KPMG global organization of independent professional services firms providing audit, tax, and advisory services. The KPMG global organization operates in 143 countries and territories and has more than 265,000 people working in member firms around the world. Each KPMG firm is a legally distinct and separate entity and describes itself as such. KPMG International Limited is a private English company limited by guarantee. KPMG International Limited and its related entities do not provide services to clients. Some or all of the services described herein may not be permissible for KPMG audit clients and their affiliates or related entities.

KPMG is widely recognized for being a great place to work and build a career. Our people share a sense of purpose in the work we do, and a strong commitment to community service, inclusion and diversity and eradicating childhood illiteracy. Learn more at www.kpmg.com/us.

SentinelOne and KPMG Announce Alliance To Accelerate Cyber Investigations and Response

The complex nature of cyberattacks has increased demand for software developers, reverse engineers, and offensive specialists —  attracting workers facing financial insecurity.

Over a 30-month period, cybercriminal gangs and threat groups posted more than 200,000 advertisements seeking workers with skills in software development, maintaining IT infrastructure, and designing fraudulent sites and email campaigns.

The demand for technically skilled individuals continues, but it peaked during the coronavirus pandemic, with double the average job advertisements coming during March 2020, the first month of the pandemic, according to a new report from cybersecurity firm Kaspersky. The analysis collected messages from 155 Dark Web forums posted between January 2020 and June 2022, selecting those that mentioned employment — either posted by a cybercriminals groups or sent by individuals seeking work.

The lion's share (83%) of employment-related posts were threat groups seeking highly skilled workers, including developers (61%), attack specialists (16%), and fraudulent website designers (10%).

Improving defenses have forced attackers to improve their tools and techniques, driving the need for more technical specialists, explains Polina Bochkareva, a security services analyst at Kaspersky.

"Business related to illegal activities is growing on underground markets, and technologies are developing along with it," she says. "All this leads to the fact that attacks are also developing, which requires more skilled workers."

The underground jobs data highlights the surge in activity in cybercriminal services and the professionalization of the cybercrime ecosystem. Ransomware groups have become much more efficient as they have turned specific facets of operations into services, such as offering ransomware-as-a-service (RaaS), running bug bounties, and creating sales teams, according to a December report. In addition, initial access brokers have productized the opportunistic compromise of enterprise networks and systems, often selling that access to ransomware groups.

    

Posts both advertising jobs and searching for jobs increased on the Dark Web. Source: Kaspersky

Such division of labor requires technically skilled people to develop and support the complex features, the Kaspersky report stated.

"The ads we analyzed also suggest that a substantial number of people are willing to engage in illicit or semilegal activities despite the accompanying risks," the report stated. "In particular, many turn to the shadow market for extra income in a crisis."

**Pandemic Caused a Spike**

In early 2020, such a crisis caused a surge in activity on Dark Web forums.

The pandemic — with its sudden layoffs and work-from-home mandates — drove significant activity in the cybercrime underground, and the highest number of employment-related posts appeared in 2020. Overall, the year accounted for 41% of advertisements and job-seeking inquiries that were posted on the Dark Web — about average. March 2020, however, was the first month of worldwide lockdowns and saw about 6% of all postings, about double the average rate.

"Some ... living in the region suffered from reduction of income, took a mandatory furlough, or lost their jobs altogether, which subsequently resulted in rising unemployment levels," Kaspersky stated in the report. "Some jobseekers lost all hope to find steady, legitimate employment and began to search on Dark Web forums, spawning a surge of resumes there. As a result, we observed the highest ad numbers, both from prospective employers and jobseekers."

    

Dark Web flow chart. Source: Kaspersky

Personal crises also appeared to cause some technically inclined workers to seek employment from cybercriminals groups. A common refrain among the job advertisements is that applicants should not have substance addictions.

"Teamwork skills, stable connection, no alcohol or drug addictions," read the translated requirements for one job posting included in the Kaspersky report.

**"Dirty Jobs"**

In many cases, the Dark Web jobs offered terms similar to those for legitimate jobs, such as full-time employment, paid time off, and regular pay increases, with salaries starting from $1,300 to $4,000 per month. Yet most also did not have an employment contract, and only 10% included a pledge to promptly pay salaries.

The report dubbed the underground employment opportunities as "dirty jobs."

"Many are drawn by expectations of easy money and large financial gain," the report stated. "Most times, this is only an illusion. Salaries offered on the Dark Web are seldom significantly higher than those you can earn legally."

Reverse engineers had the highest potential median salaries at $4,000 a month, with attack specialists and developers having the No. 2 and No. 3 most lucrative salaries, with promises of $2,500 and $2,000. However, the majority of offers (61%) focused on developers.

Those workers are the key to the cybercriminal underground, Kaspersky's Bochkareva says.

"The most sought-after professionals were developers and attack specialists, particularly for coding malicious programs, phishing websites, and planning and implementing attacks," she says.

Cybercrime Ecosystem Spawns Lucrative Underground Gig Economy

UK sportswear retailer asks exposed customers to stay "vigilant" against phishing attempts following cyberattack.

UK sportswear retailer JD Sports is warning some 10 million of its customers that their personal data — including name, billing address, delivery address, email address, phone number, order details, and last four payment card digits — might have been exposed in a recent cyberattack.

Affected customers placed online orders with JD Sports between November 2018 and October 2020 for items branded JD Sports, Size?, Millets, Blacks, Scotts, and MilletSport, the company said in a statement.

JD Sports said while it cannot definitively say whether the data was accessed, the system holding the data was, so as a precaution, JD Sports is notifying and advising impacted customers to remain on the lookout for social engineering scams.

JD Sports does not store full payment card details, the retailer said, and there is no evidence that account passwords were compromised.

"We want to apologize to those customers who may have been affected by this incident," Neil Greenhalgh, JD sports chief financial officer said in the cyber-incident disclosure. "We are advising them to be vigilant about potential scam emails, calls, and texts and \[are\] providing details on how to report these. We are continuing with a full review of our cybersecurity in partnership with external specialists following this incident. Protecting the data of our customers is an absolute priority for JD."

**Stolen Data Could Fuel Follow-on Cyberattacks**

While disclosure is the right thing to do for the retailer, notes Lior Yaari, CEO of Grip Security, letting the public as well as potential threat actors know about the breach without first resetting account credentials might in itself attract the wrong kind of attention.

"Retailers should approach a breach of customer data similar to an internal breach of employees — requiring every customer to reset their account credentials," Yaari said in a statement provided to Dark Reading. "The official announcement from JD Sports and the news coverage sets the stage for the hackers to start sending out password reset phishing emails to the 10 million customers to harvest their credentials."

Yaari predicts additional attacks will be fueled by this breach.

In fact, companies like JD Sports should avoid downplaying the significance of a compromise of customer data, according to Chris Denbigh-White, security strategist at data protection firm Next DLP.

"In JD Sports' press release, the company took great steps to reassure customers that the extent of potentially compromised information was 'limited,'" Denbigh-White explained in a statement provided to Dark Reading. "To a consumer, this exposure of personal information, which cannot be changed, is not a trivial matter and is likely to lead to further phishing and fraud attempts."

10M JD Sports Customers' Info Exposed in Data Breach

New research from Drata shows compliance remains a business challenge for many organizations.

**SAN DIEGO****,** **Jan. 30, 2023** **/PRNewswire/ --** Drata, a continuous security and compliance automation platform, today announced the results of its inaugural 2023 Compliance Trends Report, highlighting common pain points, objectives, and opportunities with security and IT compliance programs. The report surveyed 300 IT and security professionals in fast-growing organizations across the U.S.

From the American Institute of CPAs' SOC 2 framework to ISO 27001 certification established by the International Organization for Standardization, or the European Union's GDPR law, requirements for data protection are quickly becoming normalized, calling for companies of all industries to continuously manage effective compliance programs. According to the 2023 Compliance Trends Report, 87% of respondents have faced consequences as a result of not having continuous compliance, including slowed sales cycles, security breaches, business interruption, loss of a business relationship, a damaged reputation, or fines. With limited staff as a leading challenge in maintaining compliance, the majority of survey respondents cite that increasing budgets and automating processes would improve their abilities.

Drata's research also shows:

*   68% of respondents believe compliance opens new business opportunities or acts as a differentiator, while 32% view it as burdensome or just a checkbox
*   74% admit to vulnerabilities in their risk or security programs that are not being addressed or covered due to a lack of bandwidth or resources
*   For those who already have continuous compliance automated processes, the number one benefit was the ability to easily attract new customers (67%)

"It's clear to see that most IT and infosec professionals understand the importance and value of their compliance programs," said Adam Markowitz, Drata Co-Founder and CEO. "But without proper budgeting and automation, they unfortunately feel stuck in the manual management of those programs, and that's where long-term issues arise and where growth is ultimately prohibited."

Please view Drata's 2023 Compliance Trends Report for more information.

**About Drata**

Drata is the world's most advanced security and compliance automation platform with the mission to make compliance effortless and accessible. With Drata, thousands of companies streamline over 14 compliance frameworks—such as SOC 2, ISO 27001, GDPR, and more—through continuous, automated control monitoring and evidence collection, resulting in a strong security posture, lower costs, and less time spent preparing for annual audits. The company is backed by ICONIQ Growth, Alkeon Capital, Salesforce Ventures, GGV Capital, Cowboy Ventures, S Ventures, Leaders Fund, Okta Ventures, SVCI, SV Angel, and many key industry leaders. For more information, visit drata.com.

SOURCE Drata Inc.

IT and Security Professionals Spend an Average of 4,300 Hours Annually Achieving or Maintaining Compliance

**NEW YORK****,** **Jan. 30, 2023** **/PRNewswire/ --** While reports of professional cyberthieves breaching corporate and public sector servers dominate the news, a recent survey of business executives found that 71% worry about accidental internal staff error as one of the top threats facing their companies, almost on par with concern about outside hackers (75%). An additional 23% said they worry about malicious intent by an employee.

The survey, conducted by EisnerAmper's Outsourced IT Services practice during November 2022, found somewhat muted faith in current safety measures, with the largest share (51%) saying they are only "somewhat prepared," 39% feel "very prepared," 6% feel they are not at all prepared in their _overall_ cyber defense strategies, and 4% are unsure. When asked about _internal_ cyber defense, 57% are "somewhat confident," 37% are "very confident," and 6% are "not at all confident."

**Training**

The survey points to the need for ever-increasing vigilance via employee training and awareness, along with continued investment in system upgrades and staff. Only half (50%) said they are conducting cybersecurity training on a regular basis. A total of 44% held a training within the prior six months, 25% held a training more than seven months ago, and an alarming 31% said they had never held a single training event.

"A decade ago, business leaders likely equated cybersecurity breaches with external hackers, but the new normal of virtual and hybrid work has exposed a wide array of new cybersecurity threats, many coming from the inside," said Rahul Mahna, Partner and Head of Outsourced IT Services at EisnerAmper. "Businesses need to optimize their resources to ensure they are sparing no proactive measures. An important first step is training staff and refreshing that education at regular intervals. Given the increase in virtual/hybrid work, most companies should be conducting cybersecurity training at least quarterly. It's far more efficient to spend up front on education, state of the art software and hardware and, most of all, reliable IT staff who feel a stake in the company's success."

 **Budget**

Seventy-one percent (71%) said they will keep their IT budget the same even during a recessionary economy, 21% said they will decrease their IT budgets, and only 8% expect to increase budgets.

The largest share of respondents (32%) said their annual spend on cybersecurity as a percentage of overall technology outlays was just 1%-3%, while 30% said that budget line was 4%-6%. Just 23% said the spending level was 10% or higher.

"This plays right into the hands of malicious actors," noted Mahna. "When times are tough, these criminals expect companies to cut back, essentially leaving doors unlocked. In good times or bad, cybersecurity spending should always remain a top priority that yields significant return in losses avoided."

**Staffing**

Businesses are not pulling back on IT staffing in the face of a looming recession, with only 5% of those surveyed saying they plan to reduce staff, while 24% plan increases. The largest share, 67%, said they will keep staffing the same, and 4% are unsure.

**Methodology**

The electronic survey was taken by 113 predominantly chief executive officers/owners/presidents, chief risk officers, chief finance officers, chief technology officers, chief operating officers and vice presidents of finance in November 2022.

Companies surveyed include financial services, real estate, manufacturing and distribution, and technology, with representation from other sectors such as health care, professional services and nonprofit. Most companies are in the annual revenue range of $50 million to $500 million and have 10-99 employees.

Click here to review the complete cybersecurity survey results.

**About EisnerAmper** 

EisnerAmper, one of the largest business consulting firms in the world, is comprised of EisnerAmper LLP, a licensed independent CPA firm that provides client attest services; and Eisner Advisory Group LLC, an alternative practice structure that provides business advisory and non-attest services in accordance with all applicable laws, regulations, standards, and codes of conduct. Clients are in all business sectors and leverage a complete menu of service offerings. Our combined entities include more than 300 partners and 3,000 employees. For more information, please visit eisneramper.com, and be sure to follow us on Twitter and LinkedIn.

SOURCE EisnerAmper

The Threat from Within: 71% of Business Leaders Surveyed Think Next Cybersecurity Breach Will Come from the Inside

Those who are wrangling code every day could fuel a genuinely transformational approach to security — if they are adequately upskilled.

As businesses navigate the ebb and flow of growth, innovation, and digital transformation, it's only natural that some areas remain in a holding pattern. This often happens to an organization's cybersecurity program, especially as security leaders fight to stay one step ahead of new threats, vulnerabilities, and technological developments that increase risk exposure.

Unfortunately, many businesses are falling behind in their cybersecurity strategy and existing infrastructure. The power of skilled people is often missed in a functioning defensive program. It's time we assessed the viable quick wins that are right in front of us and utilized the human resources we already have in-house.

**Sustainable Cybersecurity Is a Process**

It is easy for the public to assume that every business has a robust cybersecurity program, and that protection is just a matter of selecting the right software and activating it like a force field to stop threat actors in their tracks. With 2022 being one of the worst years on record for cyber incidents — including the entire Costa Rican government being held for ransom — many security professionals could only wish it was that simple.

While many industries — especially in the financial sector — are compliance-driven and bound by increasingly complex regulatory frameworks that demand strict security measures, the reality is that most organizations are lacking in cyber resilience. More than half of large companies worldwide are not effective in stopping cyberattacks, nor are they finding and fixing exploited vulnerabilities quickly.

Even organizations considered advanced — with a defined, mature program encompassing a best practice triple-threat of people, processes, and technologies — can struggle to keep up with the fast-paced demands of the threat landscape. One critical area in which many companies fall short is role-based security awareness, especially for the development team. While every person in an organization must understand the role they play in reducing the attack surface, those who are wrangling code day in, day out, could be in the driver's seat of a genuinely transformational approach to security ... if only they were adequately upskilled.

A holistic, defensive security program demands continuous improvement, and it requires careful attention to laying solid foundations. If those foundations are predominantly tools-based, chances are good that maturity levels are lower than security leaders are banking on. A study by the Ponemon Institute revealed that 53% of enterprises were not confident that their security tech stack could effectively stop breaches. With human error a leading cause of successful cyberattacks on companies great and small, leaving developers out of a strategic security uplift is playing with fire.

**Developers Drive Software Security Excellence**

The uncomfortable truth surrounding cyberattacks is that, in almost every instance, attackers are at a distinct advantage over their target enterprise, no matter where it is in its security maturity journey. They have the time, tools, and motivation to meticulously scan for any weakness to exploit, dedicating themselves to breaking through and reaching paydirt.

Organizations, on the other hand, are juggling business and customer needs, and while they can't afford the immense risk of a show stopping cyberattack, it is not practical for business operations to slow to a crawl in order to accommodate an abundance of security controls that may end up obstructing performance. This is where security-skilled developers represent an X factor in cyber defense outcomes.

Traditionally, developers have not been enabled to share the responsibility for security in a meaningful way. This can and must change. Organizations can create viable upskilling pathways for the development cohort, but they need to select education options that deliver relevant course material in ways that make sense in their world. At a minimum, it should be conveyed in the languages and frameworks developers actively use and address the vulnerabilities they are most likely to encounter in their codebase.

When courses are structured with the developer's workflow in mind, there is a far greater likelihood that the poor coding patterns that perpetuate common vulnerabilities and misconfigurations can be replaced with good, safe patterns that significantly increase software quality over time. Low-quality software cost the United States $2.41 trillion this year alone, and this can only be remedied by breaking the cycle of errors that sustain risky technical debt.

It takes an organization-wide commitment to create a more positive, holistic security program; one that harnesses the people power required to make a difference in people-driven issues. And if staying out of tomorrow's headlines is essential, it's certainly worth the effort.

Make Developers the Driver of Software Security Excellence

**LONDON****,** **Jan. 30, 2023** **/PRNewswire/ --** Watching the latest film or Netflix series is becoming more accessible than ever, with $100 buying a complete suite of hacked accounts on the Dark Web, the latest Whizcase review has revealed.

The most abundantly available accounts are social media, with darknet markets full of hacked social media profiles retailing for just $6 per hacked account.

The report unearthed a flourishing marketplace for hacked entertainment service accounts:

*   LinkedIn account: $45
*   Facebook account: $14
*   Instagram account: $12
*   Discord account: $12
*   Snapchat account: $12
*   TikTok account: $6

You can find the full research here: https://whizcase.com/dark-web-social-media-prices/

Most of these are obtained from social engineering or phishing campaigns after hackers have compromised users' email addresses used at registration.

Usually, these accounts are linked to their original owners' payment processing solution, which the hackers often compromise. The original owners are locked out of these accounts, unable to unlink their card details from them. The only solution in these situations is to cancel the attached credit or debit card.

Whizcase revealed that for just $127, one could buy a hacked account from all major social media networks. The cheapest is Reddit at $6, rising to an Instagram account for $12. The most expensive social profile was LinkedIn at $45.

Hacked Gmail accounts are the most expensive items at $45 when it comes to communication tools. Considering that most businesses use Gmail daily, this is of little surprise. WhatsApp, Skype, and Telegram accounts range from $18 to $8.

This could allow cybercriminals to use these accounts to reset passwords their original owners used to sign up for various services. This could include financial and payment accounts as well.

The review says that many hackers use compromised accounts to run "sophisticated bot farms" for social media engagement manipulation. The advantage is that the manipulation campaigns are much harder to detect by social networks.

Buying social media engagement is also extremely cheap. For just $25, one could buy 1,000 Twitter retweets from seemingly legitimate accounts. Just $8 buys 1,000 Facebook likes on a page or a post.

It is possible to choose the country of origin for the Likes or retweets for a few extra bucks. This again shows one should be cautious when looking at popular or highly engaging things on social media. For the price of a hot dog, someone could make a profile look more popular than it is.

Whizcase said keeping social media and entertainment software accounts secure reduces social disruption, identity fraud, and outright theft. Otherwise, cybercriminals can use cybercrime exploits or social media campaigns to spread misinformation, scam or rob others of money or gaming tokens, and even steal their identity.

The Whizcase 2022 Review: https://whizcase.com/dark-web-social-media-prices/

**About Whizcase**

Whizcase is a library of guides and how-to tips about social media platforms, including Instagram, Facebook, Snapchat, TikTok, Twitter, and YouTube. They research articles extensively and test solutions, and discuss issues and how-to tips for messaging apps like Telegram, Discord, and WhatsApp. 

SOURCE Whizcase

Source

DARKReading