Google's Android and Chrome Vulnerability Reward Programs (VRPs) in particular saw hundreds of valid reports and payouts for security vulnerabilities discovered by ethical hackers.

Google addressed more than 2,900 security vulnerabilities in its products and platforms last year, awarding more than $12 million in bug bounty rewards to researchers in a record-breaking cash storm.

The total well outpaces last year's total of $8.5 million in rewards paid.

According to the tech behemoth's annual "Vulnerability Reward Program" (VRP) report, several VRP segments saw record highs in 2022, including the Android ecosystem, which doled out a cool $4.8 million to bug hunters. That total included the highest paid bounty in Google VRP history ($605,000), for a critical-rated exploit chain submitted by a white-hat known as "gzobqq."

    

Total 2022 stats. Source: Google

Meanwhile, the invite-only Android Chipset Security Reward Program (ACSRP) — which is run in tandem with manufacturers of Android chipsets — awarded $486,000 in collective bounties in 2022, across 700 valid security reports.

Over at the Chrome VRP, $4 million was paid across approximately 470 valid security bug reports. Of that, $3.5 million was rewarded to researchers for 363 reports of security bugs in Chrome Browser, and nearly $500,000 was rewarded for 110 reports of security bugs in ChromeOS.

And finally, the company's relatively new open source software (OSS) VRP — launched last August to cover supply chain issues in Google packages — released more than $110,000 in rewards to its roughly 100 participating bug hunters.

**Changes Afoot for Google Bug Bounty Hunters in 2023**

Sarah Jacobus, technical program manager at the Vulnerability Rewards Team, noted in a blog post today that more opportunities are coming for Google's bug hunters, including an expansion of the Android and Google Devices VRPs to include the latest versions of Google Nest and Fitbit as in scope.

Also, "2023 will be the year of experimentation in the Chrome VRP," she wrote. "Please keep a lookout for announcements of experiments and potential bonus opportunities for Chrome Browser and ChromeOS security bugs."

She also noted that the relatively new Google Play Security Reward Program (GPSRP) will look to expand its stable of bug hunters throughout this year and plans to sponsor various bounty events focused on Android and Google Play apps in order to attract new talent.

Google Delivers Record-Breaking $12M in Bug Bounties

**BLOOMFIELD, N.J., Feb. 21, 2023 (GLOBE NEWSWIRE) --** Xcitium, a security platform provider focused on preventing damage caused by Malware, today announced availability of its advanced endpoint security solution, ZeroDwell Containment, for customers with or without legacy EDR products.

Xcitium multi-patented technology closes the gaps in enterprise cybersecurity defenses left by traditional detection methods.

According to Tim Bandos, EVP of SOC services at Xcitium: “However sophisticated your security stack, there will always be new threats that slip through the cracks. With an estimated 560,000 new pieces of malware created every day, legacy EDR vendors will fail to detect anywhere between 1% and 5% of Unknown hostile payloads that cause immense damage.”

ZeroDwell Containment is the only solution in the marketplace that assures zero dwell time for cyber-attacks, and the only solution capable of preventing unknown threats without compromising productivity.

Dwell time is the amount of time it takes to detect an initial infection by an attacker from the moment it enters the system. As dwell time increases, so do the chances of damage, disruption or theft from malware, phishing, ransomware and other forms of cyber-attack. The mean average dwell times in the industry are well documented at ~21 days.

Xcitium’s ZeroDwell Containment isolates all unknown or suspect code entering an organization until it can be verified as trustworthy: all unknown objects are guilty until proven innocent. Unlike rival solutions, end users, applications, data, and business operations are never interrupted by ZeroDwell Containment, and contained attacks are no longer threats.

Ken Levine, Chief Executive of Xcitium: “No system that relies on detection alone can ensure all malware will be found and eliminated before it causes damage. Traditional detection is unable to detect unknown objects, and this is why breaches and ransoms persist worldwide! Xcitium, however, contains all unknown objects that have no known signature or hash, preventing attacker damage. This protection-first approach closes the cyber security gap. Organizations that run Zero Dwell Containment either with our full endpoint or alongside their existing solutions are more secure. To prove the point, Xcitium publishes weekly statistics.” 

Xcitium recently won a multi-year contract with Positivo Tecnologia, one of the leading provider of computers, cell phones, tablets, accessories, servers, educational technologies, smart homes devices, and mobile payment terminal in the Brazilian market.

Julio Guapo, CIO of Positivo Tecnologia, said: “We selected Xcitium as the cybersecurity solution to protect our internal company environment and users. During the POC process, the Positivo Tecnologia IT Security team put Xcitium through its paces, testing and repeatedly challenging its ZeroDwell Containment technology. Xcitium isolated the attacker’s execution path every single test period, so the threat was prevented from harming any endpoint.”

Nandor Feher, Positivo Tecnologia’s CISO further commented, “Xcitium’s ZeroDwell Containment offered to Positivo Tecnologia a compelling differentiation with patented breach prevention technology helping the Brazilian tech company to compose the corporate zero thrust architecture, as well as becoming one of the most important layers to neutralize and protect against ransomware, malware, and cyber-attacks. This is now one of the top tools in our department. It is enabling Positivo Tecnologia to face the cybersecurity challenges of modern attacks. It also helps us to fill so many of the roles of other tools. By consolidating, simplifying and being more efficient in our security operations and the ability to do all of that in one system, it proves its value every day.”

Frost & Sullivan named Xcitium as the 2022 Competitive Strategy Leader of the Endpoint Security industry. Sarah Pavlak, industry principal with Frost & Sullivan noted: “Xcitium’s ZeroDwell technology, utilizing patented kernel-level API virtualization, prevents unknown malware from accessing critical system resources that cause damage, while providing complete use of the unknown file or application—this is a distinct departure from all existing vendors that terminate the offending unknown only after their engine makes a threat determination.”

Xcitium was also named Product of the Year 2022 earlier this month by AV Labs, an independent malware test lab based in the European Union.

For additional details, please visit Xcitum.com.

**About Xcitium**

Xcitium, formerly known as Comodo Security Solutions, is used by more than 5,000 organizational customers and partners around the globe. Xcitium was founded with one simple goal – to put an end to cyber breaches. Our patented ZeroDwell technology uses CPU-Virtualization to isolate and remove threats like zero-day malware and ransomware before they cause any damage. ZeroDwell is the cornerstone of Xcitium’s endpoint suite, which includes preemptive endpoint containment, endpoint detection & response (EDR), managed detection & response (MDR), and extended managed detection & response (XDR). Since its inception, Xcitium has a track record of zero breaches when fully configured.

Xcitium Brings 'Zero Dwell' Capability to Legacy EDR Platforms

Technology tuck-in enhances industry's broadest XDR security platform.

**DALLAS****,** **Feb. 22, 2023** **/PRNewswire/ --** Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, has announced the signing of a definitive agreement to acquire Anlyz, a leading provider of security operations center (SOC) technology. The acquisition will extend Trend's orchestration, automation and integration capabilities and will enable enterprises and Managed Security Service Providers (MSSPs) to improve operational efficiencies, cost effectiveness and security outcomes.

The deal encompasses intellectual property, industry expertise and more than 40 technical employees all focused on bolstering Trend's security platform strategy. With this acquisition, the company will expand its engineering team of over 3000, adding a new research & development center in Bangalore, India.

Managed Security Service Providers (MSSPs) will be empowered to grow their strategic SOC services while minimizing the complexity of the underlying security stack by reducing the number of technology vendors needed. Trend's enterprise customers will benefit from a comprehensive extended detection and response (XDR) and incident response orchestration platform that can maximize analyst productivity and help relieve resource constraints.

Gartner research stated, "As buyers, both end customers and service providers, continue to consolidate vendors/providers, buyers will seek best-of-suite and integrated solutions over best-of- breed point solutions. Preferred technology vendors will be those that ease integration with other IT and security technology and tools within the environment, supporting efforts toward use-case-based outcomes."\[1\]

"We are happy to welcome the Anlyz team into the Trend family – together we are increasing SOC effectiveness and reducing both the technology and resources burdens," said Kevin Simzer, Chief Operating Officer at Trend Micro. "Due to market pressure, we see organizations moving past security point-solution experiments in preference for platform breadth that allows for vendor consolidation, maximized return on investments and efficiencies."

Trend Micro and Anlyz have been technology alliance partners since 2021 and share more than 30 joint customers that are positioned to move forward quickly to capitalize on the opportunities ahead.

\[1\] Gartner®, Emerging Trends: Future of Security Services, Shawn Eftink, John Collins, November 2021 GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

Eventus TechSol is one of the many MSSPs powering joint customers delivering measurable "XDR Powered SOC" improvements for clients. "We have reduced the mean-time-to-detect and mean-time-to-respond ratio, down from weeks to hours for incidents," said Jay Thakker, Practice Head at the company. "We use playbooks for log enrichment and automated response as well as threat intelligence and threat hunting capabilities provided by the platform to proactively hunt for known and behavioral attacks."

Anlyz has primarily focused on security orchestration and case management delivering powerful SOAR capabilities for MSSPs to manage the incident response process across multiple clients. It also offers intelligent log aggregation enabling data ingestion and enrichment across a range of data sources and security solutions, using a high performance, scalable architecture. Trend will leverage Anlyz's SOAR solution and rich set of product connectors to broaden its platform and enable additional integration and automation options across customers' IT ecosystems.

Trend's MSSP channel customers will benefit from:

*   An anchor technology platform to manage the SOC function for their clients
*   A reduced requirement to architect individual custom solutions for their customers, thanks to an integrated core stack and multi-tenant view out of the box
*   Visibility, analysis, and automation across Trend, third-party products, and customer instances, making it easier to manage XDR across multiple customers
*   A scalable, flexible, and feature-rich platform to appeal to all types of customers no matter the size and complexity of their IT environment

**Notice Regarding Forward-Looking Statements**

Certain statements included in this press release that are not historical facts are forward-looking statements. Forward-looking statements are sometimes accompanied by words such as "believe," "may," "will," "estimate," "continue," "anticipate," "intend," "expect," "should," "would," "plan," "predict," "potential," "seem," "seek," "future," "outlook" and similar expressions that predict or indicate future events or trends or that are not statements of historical matters. These forward-looking statements include, but are not limited to, statements concerning the future plans or prospects for the acquisition. These statements are based on our current expectations and beliefs and are subject to a number of factors and uncertainties that could cause actual results to differ materially from those described in the forward-looking statements. Although we believe that the expectations reflected in our forward-looking statements are reasonable, we do not know whether our expectations will prove correct. You are cautioned not to place undue reliance on these forward-looking statements, which speak only as of the date hereof, even if subsequently made available by us on our website or otherwise. We do not undertake any obligation to update, amend or clarify these forward-looking statements, whether as a result of new information, future events or otherwise, except as may be required under applicable securities laws.

**About Trend Micro**

Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's cybersecurity platform protects hundreds of thousands of organizations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, the platform delivers a powerful range of advanced threat defense techniques optimized for environments like AWS, Microsoft, and Google, and central visibility for better, faster detection and response. With 7,000 employees across 65 countries, Trend Micro enables organizations to simplify and secure their connected world. www.TrendMicro.com.  

The Gartner Report(s) described herein, (the "Gartner Report(s)") represent(s) data, research opinion or viewpoints published, as part of a syndicated subscription service, by Gartner, Inc. ("Gartner"), and are not representations of fact. Each Gartner Report speaks as of its original publication date (and not as of the date of this Prospectus) and the opinions expressed in the Gartner Report(s) are subject to change without notice.

SOURCE Trend Micro Incorporated

Trend Micro Acquires SOC Technology Expert Anlyz

Organizations are urged to update to the latest versions of FortiNAC to patch a flaw that allows unauthenticated attackers to write arbitrary files on the system.

Researchers have released details for how to exploit a critical remote code execution (RCE) bug in Fortinet's FortiNAC product, which allows an unauthenticated attacker to write arbitrary files on the system and achieve RCE as a root user.

Organizations use FortiNAC as a network access control solution to oversee and secure all digital assets connected to the enterprise network. The product can be used to manage a range of devices, including: corporate endpoints, Internet of Things (IoT), operational technology and industrial control systems (OT/ICS), and connected medical devices (IoMT), among others. The idea is to provide visibility, control, and automated response for everything that connects to the network, and as such, the device offers a golden opportunity for attackers to pivot and move deep into networks, enumerate environments, steal sensitive information, and more.

Researchers at Horizon3.ai released a blog post with a technical analysis of and proof of concept (POC) exploit for the vulnerability, tracked as CVE-2022-39952, and revealed and patched by Fortinet last week. They subsequently released the exploit code on GitHub.

Fortinet's Gwendal Guégniaud discovered the vulnerability, which earned a critical rating of 9.8 on the CVSS vulnerability-severity scale. The bug allows attackers to take external control of a file name or path vulnerability in the FortiNAC Web server, Fortinet said in its advisory, thus allowing unauthenticated arbitrary writes on the system.

Fortinet has patched in its affected product versions, with customers urged to update to FortiNAC version 9.4.1 or above, FortiNAC version 9.2.6 or above, FortiNAC version 9.1.8, or FortiNAC version 7.2.0 or above.

**How to Exploit the Fortinet FortiNAC Flaw**

While there are several ways for attackers to obtain RCE by exploiting arbitrary file write flaws, the researchers wrote what's called a "cron job to /etc/cron.d/" to take advantage of the vulnerability, they said.

The researchers extracted filesystems from both the vulnerable and patched versions of the product to examine the flaw, finding that Fortinet removed an offending file called /bsc/campusMgr/ui/ROOT/configWizard/keyUpload.jsp in the update that patches the bug. It turns out that file allowed an unauthenticated endpoint to parse requests that supply a file in the key parameter and then write it to /bsc/campusMgr/config.applianceKey, the researchers said.

To exploit this flaw, researchers successfully wrote the file and made a call that executes a bash script, which in turn can unzip the file that was just written. The unzip process "will allow placing files in any paths as long as they do not traverse above the current working directory," Horizon3.ai's chief attack engineer Zach Hanley wrote in the blog post. "Because the working directory is /, the call unzip inside the bash script allows any arbitrary file to be written."

"Immediately, seeing this call on the attacker-controlled file gave us flashbacks to a few recent vulnerabilities we’ve looked at that have abused archive unpacking," he added.

Researchers used the aforementioned cron job — which entails using the code /etc/cron.d/payload — to weaponize the flaw. The job gets triggered every minute and initiates a reverse shell to the attacker. To do this, researchers created a zip archive that contains a file and specifies the path for extraction, and then sent the malicious zip file to the vulnerable endpoint in the key field, they said.

"Within a minute, we get a reverse shell as the root user," which then can allow for remote code to be executed, Hanley wrote.

**History of Attacker Interest**

Historically, attackers have had a tendency to pounce on Fortinet flaws — sometimes even before the company knows they exist. Since they offer a prime opportunity to gain a foothold on enterprise networks, it would be prudent for any organizations running affected versions of FortiNAC to update to the patched products ASAP. So far, neither Fortinet nor Horizon3.ai are aware of any instances of attackers taking advantage of the flaw, but now that the latter's proof of concept is released, with step-by-step details on how it can be exploited, this is likely to change. 

As recently as January, the researchers tied a sophisticated new backdoor dubbed BoldMove to a zero-day vulnerability that Fortinet discovered in multiple versions of its FortiOS and FortiProxy technologies in December. The flaw allowed an unauthenticated attacker to execute arbitrary code on affected systems. In the zero-day attack, a China-based threat actor engaged in cyber-espionage operations apparently had written the malware to run specifically on Fortinet's FortiGate firewalls even before the vulnerability was made public and patched, the researchers discovered.

In October, attackers also showed significant interest in a critical authentication bypass vulnerability in multiple versions of Fortinet's FortiOS, FortiProxy, and FortiSwitchManager technologies, particularly after exploit code for the flaw was released.

Exploit Code Released for Critical Fortinet RCE Bug

How to stay safe, even when tech-savvy admins can't tell the difference between a scam and the truth.

Threats to corporate social media are evolving along with perpetrators' social engineering skills at a blistering pace. Sometimes their techniques reach such a high level that even the tech-savvy administrator of a corporate network can't tell the difference between a scam and the truth. Since so many businesses use social media, these threats are relevant to an extremely large number of companies. To help them stay safe, here are a few points of advice to mitigate the cyber-risks associated with today's social media landscape.

**Use Caution With DMs, Drafts, Old Messages**

Companies should be careful about keeping sensitive information in direct messages — it can pose cybersecurity risks. People often use corporate social media to write directly to brands, asking for help with the account holder's product or service. Also, some partnerships, such as those with bloggers, can be negotiated in direct messages. Sometimes personal or financial information is shared during these conversations, which could remain in the messages folder long after the interaction, vulnerable to intruders.

To avoid this risk, company representatives should make it a habit to delete irrelevant messages when the dialogue is finished and the information it contains is no longer relevant. It's also worth regularly reviewing what's saved in the drafts folder for old posts.

**Review Old Posts, Minimize Reputational Risks **

If sensitive or embarrassing information resurfaces from an old post, it can hurt a company's reputation or even result in financial losses. Spend some time reviewing old posts, as they might contain information that doesn't fit into the current reality. That might be anything from inappropriate jokes to controversial advertising campaigns.

**The Potential Downside of Success**

Having signed a lucrative contract or deal, we often want to post about it. But we also want to avoid unwanted attention from cybercriminals. If a potential attacker knows who your suppliers or contractors are, they could conduct an attack impersonating them or breaching their accounts and acting on their behalf. 

The more clearly you reflect your company's structure and working methods on social media, the easier it is for perpetrators to organize an attack. For example, if it is possible to trace who is responsible for finance, an attacker can pretend to be this person's supervisor and try to lure them into urgently transferring a large sum of money to a fake account to close a deal or purchase equipment.

**New Hires and Risks With New-Job Posts on Social Media**

Once hired, newcomers usually share the news on social, but they may not yet understand company cybersecurity processes, like how identification works or with whom they can share sensitive information.

Imagine a perpetrator tracks this person on social media and then writes them a malicious letter on behalf of the company's IT administrator, asking to share the password to set up a technical account. The newcomer may not know that the administrators would never write such a letter. They may also hesitate to ask their colleagues if the letter is authentic.

To mitigate the risk, offer newcomers a course on information security immediately, and tell them to be extremely careful when posting about their job. 

**Control Account Access, Especially When an Employee Leaves**

Logins, passwords, and email addresses used to create a social media account are just as valuable as other internal corporate documents. If an employee who has access to these accounts leaves the company, it is useful to apply the same rules as when blocking their access to the corporate network. Change the password for the email account linked to the corporate social network; then unlink the ex-employee's mobile phone number.

**Don't Ignore Other Protections**

Any account on a social network, not to mention a corporate one, must be securely protected. Two-factor authentication is an absolutely necessary setting for any type of account.

The email address linked to the account should be as protected as the social media account itself. Often the attack begins with an initial access to email. After breaching an account, an attacker can configure filters in the mailbox settings to delete all support emails from the social network. Therefore, a user will not be able to restore access to their account.

It is best to register a corporate social media account using a corporate email address, since it can be better protected than a personal one.

It's equally important to conduct training for employees on information security, phishing, and other threats. According to recent cyber skills training statistics, just 11% of nearly 4,000 employees demonstrated a high level of cybersecurity awareness in 2022, while 28% could not prove sufficient cybersecurity proficiency.

7 Tips for Mitigating Cyber-Risks to Your Corporate Social Media

Attackers are now using multiple types of distributed denial-of-service (DDoS) attacks to take down sites. Here are some ways to defend and protect.

Distributed denial-of-service (DDoS) attacks occur when an individual device, known as a bot, or a network of devices, known as a botnet, is infected with malware. These bots or botnets flood websites with increased traffic volumes over a period of hours or even days in an attempt to take services offline. Recently, hacktivist groups have begun leveraging DDoS attacks to extort site owners for financial, competitive advantage, or political reasons. This can represent a serious threat for enterprise businesses.

Planning and preparation are key to developing an effective DDoS defense. But first you need to understand how these attacks work.

**DDoS Attack Types**

New DDoS attack vectors emerge every day thanks to innovative artificial intelligence (AI) technology and a growing cybercrime ecosystem. But in general, there are three main types of DDoS attacks, each of which encompasses a variety of cyberattacks. The first is known as a volumetric attack, which primarily focuses on bandwidth and is designed to overwhelm the network layer with traffic. For example, domain name server (DNS) amplification attacks leverage open DNS servers to flood a target with DNS response traffic.

Another type of DDoS is a protocol attack, which exploits weaknesses in Layers 3 and 4 of the protocol stack, targeting critical resources. For example, synchronization packet floods (SYN) will consume all available server resources as a way to make servers unavailable.

Finally, a resource layer attack disrupts data transmission between hosts by targeting web application packets. For example, SQL injection attacks will insert malicious code into strings. These strings are subsequently passed to a SQL server to be parsed and executed.

And while these categories can cover a broad range of DDoS attacks, security teams also need to be aware that cybercriminals can compromise their networks by using multiple attack types from different categories.

**Protecting Against, Responding to DDoS Attacks**

When websites or servers go down, companies risk losing sales and customers, incurring high recovery costs and damaging their reputations. In some regions and industry sectors, they may even be subject to penalties and fines. Here are four ways to respond to DDoS attacks.

**1\. Evaluate Your Risks and Make Sure You're Protected**

The first step is to identify the publicly exposed applications within your organization. Make sure you note typical application behavior patterns so you can identify anomalies and respond accordingly. Because DDoS attacks typically spike during peak business seasons, such as the holidays, organizations should look for scalable DDoS protection services with advanced mitigation capabilities. Specific service features include traffic monitoring; adaptive real-time tuning; DDoS protection telemetry, monitoring, and alerting; and access to a rapid response team.

**2\. Get Prepared With a DDoS Response Strategy**

One proactive measure that all companies should take is to develop a rapid response strategy. Start by forming a DDoS rapid response team that knows how to identify, mitigate, and monitor attacks. This team should also be able to work with internal stakeholders and customers.

**3\. Identify Potential Weaknesses**

Use attack simulations to understand how your services will respond in the event of an attack. These simulations should confirm that your services or applications will be able to function normally without disrupting users' experiences, and they should happen during off-business hours or within a staging environment to minimize business impact. When conducting an attack simulation, make sure you identify potential technology and process gaps to inform your DDoS response strategy.

**4\. Respond, Learn, Adapt In the Face of Attacks**

In the event of an actual DDoS attack, contact an established DDoS response team or other technical professionals to conduct your attack investigation and post-attack analysis. This retrospective analysis is especially critical as it can help to clarify whether service or user disruptions were due to a lack of scalable architecture. Focus your evaluation on which applications or services experienced the greatest disruptions, as well as the effectiveness of your DDoS response strategy.

Of course, DDoS attacks are just one type of emerging cyberthreat. For more information on ongoing cybersecurity developments and best practices, check out Microsoft Security Insider.

4 Tips to Guard Against DDoS Attacks

Attribute-based encryption could help keep sensitive metadata off of the Dark Web.

Even before COVID-19 disrupted operations, organizations had accelerated their digital transformation initiatives to meet changing customer expectations. One sector that particularly embraced this shift is the healthcare sector, as organizations rapidly developed and adopted a range of digital health solutions, such as electronic health records and using artificial intelligence (AI) to aid drug discovery.

Healthcare is "an industry that had been moving forward with digitization under numerous different names and approaches well before the onset of COVID," says Guy Becker, director of healthcare products management at cybersecurity company Sasa Software. However, this rapid digitization has also resulted in a sharp spike in criminal cyberattacks on the healthcare industry.

Check Point reported a global increase in attacks on organizations between November and December 2020. The report showed a 137% increase in East Asia, a 112% rise in Latin America, 67% in Europe, and 37% in North American healthcare organizations. In recent years, there has been a dramatic increase in cybersecurity incidents in the healthcare sector, such as computer virus infections, ransomware, and the theft and publication of patient data.

The reality is grimmer today, especially when you consider that scanned medical documents and other healthcare images often contain sensitive data. NTT Research recently held a hackathon to find ways to use attribute-based encryption (ABE) to address that situation and others.

"Metadata stored within medical images, including X-rays and CT scans, can disclose confidential information, like patient names, photographed body parts, and the medical centers or physicians involved, leading to patient identification," explains Jean-Philippe Cabay, data scientist at NTT Global in Belgium, whose team won the hackathon. "Attribute-based encryption ensures that only authorized users with the appropriate attributes can access medical images, keeping them secure and private."

**Health Imaging Data Is a Hacker's Goldmine**

Hospitals and healthcare organizations are working to protect digital imaging and communications in medicine (DICOM) files, according to Becker. This development is a result of the convergence of several factors, increased attacks on healthcare due to its high value (worth at least 10 times more than credit card data on the Dark Web) and traditionally weak security posture, demand for heightened healthcare security by governments and the EU, increased need for remote healthcare services due to COVID, and a general digital transformation trend to streamline and digitize services.

In addition, the vulnerability presented by potentially malicious imaging files is enhanced by the growing risk of breached medical devices. For example, imaging machines operating within the hospital network can be compromised without the knowledge of the technicians and engineers looking after them. Such compromise could lead to malicious code being injected into clinical data and spread across a hospital's network. Because imaging clinics and medical centers often need to transfer imaging data, a breach of such transactions could expose sensitive patient data, with devastating consequences.

Becker says the protection of sensitive imaging networks begins with the standard recommended measures: network segmentation, timely backups, frequent updating of systems and applications, the use of advanced intrusion detection and prevention systems, and regular employee education and training.

Some of these measures pose particular challenges for healthcare organizations. Healthcare systems have to be online 24/7, which makes frequent updating — and rebooting, or taking machines offline — an impossible requirement to meet. Chronic understaffing, which frequently reduces staff compliance to the minimum clinical requirement, means nonhealthcare-related demands, such as cybersecurity, get pushed down to a distant second position, Becker says.

But in its recently concluded hackathon, NTT Research said its Belgian team successfully demonstrated "a groundbreaking application" of ABE to protect images. ABE was introduced in 2005 in a paper by Brent Waters, NTT's director of Cryptography and Information Security (CIS) Lab, and Amit Sahai, a professor of computer science at UCLA. It is a type of public-key encryption that allows for sharing data based on policies and attributes of the users — who the user is, rather than what they have.

**Protecting DICOM Images With ABE**

Essentially, ABE determines who can access data based on specific traits. ABE combines role-based encryption with content-based access and multi-authority access. For content-based access, ABE doesn't just determine who gets access to data, but also what specific data they are allowed to access. Thus a radiologist might be able to access a CT scan but not patient identity, whereas a records clerk would be able to access identity but not imaging. Multiauthority access could come into play when a patient sees a specialist — the primary care physician might issue the specialist credentials to view a patient's medical history, while a licensing board establishes credentials that allow them to write notes in that history; the specialist would need both sets of credentials to access the complete patient record.

The winning team's three-part demo involved detecting and labeling a graphical object, encrypting the images and mapping between labels and ABE policies, and storing the objects, the metadata, and the blurred images in a database. Cabay's coauthor, NTT senior software engineer Pascal Mathis, said their project uses an extract, transfer load (ETL) pipeline to transfer the images.

Mathis further explained that the AI component and encryption engine resides on an edge device, which sends only encrypted data to the database. Cabay says their project demonstrates how ABE can help to encrypt images in healthcare, such that "access is so locked-down that even the database administrator only sees images with blurred spots and encrypted information."

Other major providers of picture archiving and communications systems (PACS), such as Philips, GE, and Sectra, are advancing solutions for digitization and increased automation of the imaging workflow, as part of a general migration to cloud-based systems and an enhanced security posture. These systems feature native end-to-end encryption and robust backup and breach prevention capabilities inherent to cloud environments. However, the DICOM data itself is not examined and may well be harboring malicious content, Becker notes.

"Standard detection-based network security tools, such as EDRs, XDRs, and MDRs, currently lack the capability to scan and disinfect DICOM imaging data," he says. "It was this gap in security that moved us to develop, together with our healthcare partners, an imaging gateway that purifies the actual DICOM data stream itself."

As healthcare becomes increasingly reliant on technology for more efficiency, healthcare industry leaders must prioritize using tools that enable the secure remote transmission of imaging studies to the hospitals' PACS without incurring risk to the healthcare network.

How to Stop Attackers That Target Healthcare Imaging Data

With the fresh capital, Scrut aims to focus on simplifying risk management and infosec compliance for cloud-native SaaS, Fintech, and Healthtech companies

**Singapore, 21 February 2023 –** Furthering its rapid growth, Scrut Automation, a leading Governance, Risk and Compliance (GRC) Automation platform in APAC, has raised a new round of funding of $7.5M, led by MassMutual Ventures, with existing investors, Lightspeed and Endiya Partners, increasing their stake. MassMutual Ventures has been an active investor in the risk and security domains, with investments in leading companies across cyber-risk prediction and management, threat assessment, data security and IoT security), and comes in as a strong partner for Scrut Automation.

Founded in 2021 by Aayush Ghosh Choudhury, Kush Kaushik, and Jayesh Gadewar, Scrut Automation provides an information security monitoring platform, aimed at helping small and medium cloud-native enterprises develop and maintain a robust security posture, and comply with various infosec standards such as SOC 2, ISO 27001, GDPR, and the like with ease. With the help of the Scrut platform, customers have been able to reduce their manual effort for security and compliance tasks **by 70%**.

In the last few years, frequency and intensity of breaches have increased drastically, which have made it imperative for cloud-native enterprises to continuously monitor their Security posture, and comply with multiple frameworks across geographies. The platform plans to use the fresh capital tosimplify risk management and infosec compliance for cloud-native SaaS, Fintech, and Healthtech companies — automating ~70% of manual tasks and reducing tool fatigue from managing disparate point tools for security. Scrut will deepen its risk observability and management capabilities, as well as expand its presence in the US market with the assistance of MassMutual Ventures’ expertise. The company currently works with customers in India, Singapore, and the US, providing them with a unified view of an organization’s compliance posture.

Commenting on the latest fundraise, **Aayush Ghosh Choudhury, CEO and Co-Founder of Scrut Automation, says,** "We at Scrut have been hyper-focused on helping CISOs and InfoSec Heads across cloud-native companies build and maintain a risk-first security posture, enabling them, in turn, to become more agile in managing their risk and security posture and simplify compliance across 20+ InfoSec standards with ease. The fresh capital infusion will help us deepen our product capabilities and expand our market presence for mid-market CISOs. We are happy to have marquee investors backing us in our journey."

**Anvesh Ramineni, Managing Partner at MassMutual Ventures,** added, "We are delighted to support the Scrut team, as we believe their robust compliance and security offerings will assist rapidly growing companies around the world in accelerating revenue growth. Scrut’s leadership team’s deep domain expertise and strong understanding of customer needs, coupled with the platform’s risk-first approach and scalability have been the primary reasons for its success. The product roadmap is exciting, with significant enhancements to risk observability, control automation, monitoring, and orchestration capabilities and will position Scrut as a leader in the space."

**Dev Khare, Partner, Lightspeed said**, "The rise in cybersecurity threats around the world is real and fast-growing. We are excited to see Scrut's GRC one-stop shop solution address this threat. As a result, there is widespread acceptance of Scrut's GRC solution by mid-market enterprises in the US and Asia."

**Sateesh Andra, MD, Endiya Partners,** added, “Endiya Partners is proud to be a part of Scrut Automation's journey from the beginning. Organizations need to keep up with the ever-changing and complex information security landscape to remain compliant with SOC 2, GDPR, CCPA, and other regulations. This makes investing in the right Governance, Risk and Compliance (GRC) platforms necessary and Scrut Automation provides the perfect solution. Scrut combines multiple capabilities across cloud governance, policy and evidence management, asset management into a comprehensive risk-first approach - which reduces tool fatigue for CISOs at mid-market and growth stage companies.”

As Scrut Automation embarks on its new journey, it has introduced several cybersecurity luminaries to join the company’s Board of Advisors.

A brief snapshot of Scrut Automation’s Advisory Panel:

**Naresh Agarwal** is currently the Head of India R&D at Traceable, and will lend learnings from his ~18 years of platform engineering and infrastructure experience, across companies like inMobi, Informatica, and App Dynamics to Scrut Automation.

**Shashi Kiran** serves as the CMO at Fortranix and brings with him 25+ years of experience across Aryaka Networks, Cisco, and Quali. He also advises several early-stage cloud and security startups across the Silicon Valley.

**Shreesha Ramdas** is a two-time founder himself, who has successfully exited two of his startups (Strikedeck and Leadformix). He is a well-known name in Silicon Valley, and has invested across over 50 companies in their early stages. He also serves as part of the Board for Securin and Korbyt.

**Mel Reyes** is the global CIO and CISO at Getaround. Before that, he was in charge of security at Synchrony, Cenveo, MiMedia, Go! Productions, and other companies. He is deeply entrenched in the startup landscape and is an advisor for 10 startups like Verascore and Nomadreaming.

**About Scrut Automation**

Scrut Automation is a risk observability and compliance automation platform built to simplify information security monitoring for cloud-native companies. They help early-stage and growth-stage companies across the globe, establish enterprise-grade information security processes through an easy-to-use GRC platform. For more information, visit www.scrut.io.

**About MassMutual Ventures**

MassMutual Ventures (MMV) is a multistage global venture capital firm investing in financial technology, enterprise SaaS, digital health, climate technology, and cybersecurity companies. With teams based in Boston, Singapore, and London, MMV manages over $1 billion in investment capital across the globe. We help accelerate the growth of the companies we partner with by providing capital, connections and advice. With our deep expertise and extensive Fortune 500 network, MMV helps entrepreneurs build compelling and scalable companies of value. For more information, visit www.massmutualventures.com.

Scrut Automation Raises Funding of $7.5M, Led by MassMutual Ventures, Lightspeed, and Endiya Partners

**CAMBRIDGE, England****,** **Feb. 20, 2023** **/PRNewswire/ --** The world's leading cybersecurity conference Black Hat is to launch its first ever certification program - **Black Hat Certified Pentester (BCPen).**

Intended for professional penetration testers; bug-bounty hunters; in-house red and blue team personnel; and SOC analysts, the program will be officially launched at Black Hat USA 2023 in Las Vegas in August.

Black Hat has been an industry leading source for cutting edge security briefings and training for over 20 years, providing attendees with various avenues to learn and progress their knowledge in different sectors of information security. This new certification program, which was created in partnership with Cambridge\-based IT security firm The SecOps Group, enables participants to prove their knowledge and ability when it comes to hands-on penetration testing.

The practical, in-person exam covers a wide variety of topics and comprises eight hours of CTF-style hacking on application security and infrastructure hacking topics.

Commenting on the launch, **Sumit Siddharth**, the CEO of The SecOps Group Said, "There are currently huge gaps in the cyber certification industry. With our practical exams, we are aiming to provide an authentic and credible certification that is up-to-date and represents real life business risks. We are thrilled to have this partnership with Black Hat."

Steven Wylie**,** General Manager at Black Hat added, "The Certification track is a natural progression for Black Hat events. Attendees will not only learn new skills via our training and briefings program, but now we are enabling our attendees (and their employers) to validate their skills which in turn will enable them to progress their career." 

"As our industry matures, being able to measure the skills you have learned is vital," added Daniel Cuthbert, a Black Hat review board member and an industry veteran.

For further information on how to apply for the **Black Hat Certified Pentester (BCPen)** certification, visit https://secops.group/blackhat-certified-pentester-bcpen/

**About Black Hat:**

Founded in 1997, Black Hat is an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Grown from a single annual conference to the most respected information security event series internationally, these multi-day events provide the security community with the latest cutting-edge research, developments, and trends.

Black Hat Briefings and Trainings are driven by the needs of the global security community, striving to bring together the best minds in the industry. Black Hat inspires professionals at all career levels, encouraging growth and collaboration among academia, world-class researchers and leaders in the public and private sectors. Today, Black Hat Briefings and Trainings are held annually in the United States, Europe, and Asia, providing premier venues for elite security researchers and trainers to find their audience.

**About The SecOps Group:**

The SecOps Group is a globally recognized IT security company having vast experience of providing cyber security consultancy and education services. Their core business comprises two units, consultancy and education. The SecOps Group offer CREST accredited security consultancy services and through the exams, they provide an authentic and credible certification program that is up-to-date and represents real life business risks. The SecOps Group also runs a free pentest learning platform called Vulnmachines.

SOURCE The SecOps Group

Black Hat to Launch Official Certification Program

**21 Feb 2023:** CREST, the global not-for-profit community of cyber security businesses and professionals working to keep our information safe in a digital world, today launches its latest best practice guide, describing how to foster greater equity, inclusion and diversity (EID) as part of national cyber security strategy.

CREST's latest good practice guide delivers practical information for government departments charged with developing not only a National Cyber Security Strategy (NCSS), but a more diverse, inclusive NCSS.

A NCSS is a framework describing a nation’s strategy to ensure a more resilient, trusted and robust cyberspace. Part of that is a clear plan to grow and nurture the talent pipeline, ensuring people have the right skills to fight ever-evolving cyber threats to national security.

And yet, as CREST CEO Nick Bensonsays: "It is surprising how few NCSS documents mention harnessing the benefits of a more inclusive and diverse cyber security workforce. As the gap between supply and demand in the cyber security workforce grows, a clear course of action exists to attract a more diverse talent pool to the sector."

"As an industry, we must encourage more people into the sector who have different backgrounds, influences and experiences. A more diverse workforce will deliver myriad benefits, including fresh, creative perspectives - on how we can solve complex security problems."

The 2021 Cyber Security Workforce Study from (ISC)2 suggests the number of _additional_ professionals organizations need to defend their critical assets adequately stands at 2.72 million people.

The 33-page free guide is now available to download on the CREST website: https://www.crest-approved.org/research-and-reports/

This latest guide includes up-to-date descriptions of what equity inclusion and diversity mean in the context of the cyber security sector, including age, disability, neurodiversity, gender, sexual orientation, race, religion and socio-economic background.

“Improving equity, inclusion and diversity at a national level is essential for any nation that wants to improve its cyber resilience,” said Allie Andrews, CEO of PRPR and author of the report. “Tapping into a diverse talent pool is not just key to alleviating the skills shortage and the right thing to do, but it is clear it also improves security teams. There are a lot of great initiatives out there, but what is needed is greater guidance in NCSS about what works and what doesn’t.”

The guide describes how to include these crucial considerations in an NCSS, with examples of international strategies which have taken EID into account. In addition, the report delivers examples of good global practice and how to measure the success of a strategy.

However, EID is about more than simply including policies in an NCSS.

Nick Benson adds: “Recruiting and retaining more diverse cyber security professionals requires more than policy. It needs genuine collaboration with all stakeholders in the cyber security ecosystem. It may also need significant societal or cultural change at a national or workplace level, which takes time, but the rewards will be worth it.”

The report is one of several produced by the not-for-profit organisation to help build capacity and consistency in the cyber security industry, aimed at companies and individuals who need to understand the importance of EID in cyber security strategy.

In 2020 CREST received a grant of US$1.4 million from the Bill & Melinda Gates Foundation to help increase cyber security capacity and cyber resilience in Bangladesh, Ethiopia, Indonesia, Kenya, Nigeria, Pakistan, Tanzania and Uganda. This latest EID Guide is created by CREST to assist in this enabling process.

**About CREST**

CREST is an international not-for-profit, membership body representing the global cyber security industry. Its goal is to help create a secure digital world for all by quality assuring its members and delivering professional certifications to the cyber security industry.

CREST accredits almost 300 member companies, operating across dozens of countries, and certifies thousands of professionals worldwide. It works with governments, regulators, academia, training partners, professional bodies and other stakeholders around the world. CREST members undergo a rigorous quality assurance process and employ competent professionals. Organisations buying their cyber security services from CREST members do so with confidence.

Source

DARKReading