Program provides financial assistance to aspiring information security professionals, enabling students toward long-term career success.

**ALEXANDRIA, Va.****,** **Jan. 26, 2023** **/PRNewswire/ --** The Center for Cyber Safety and Education, the charitable arm of (ISC)² - the world's largest nonprofit association of certified cybersecurity professionals – announced it is now accepting applications for its 2023 scholarships. The scholarships award qualifying information security students financial support as they pursue associate, undergraduate, and graduate degrees. The application period began January 17 with the (ISC)² associates and undergraduate, graduate, and women's scholarships and KnowBe4's women's scholarship all opening for applications. 

The scholarships were created to provide financial assistance to aspiring cybersecurity professionals from diverse backgrounds from around the world. Applicants must be pursuing, or plan to pursue, a degree with a focus on cybersecurity, information assurance or a similar field in the fall of 2023 and have at least a 3.3 GPA on a 4.0 scale. The Center for Cyber Safety and Education evaluates applicants based on academic excellence, passion for the industry, and financial need.

"Since the launch of our scholarship program in 2011, the Center for Cyber Safety and Education has provided financial aid to more than 700 students pursuing a cybersecurity career path," said Holly Schneider Brown, Center Senior Director. "We aim to remove financial barriers and foster greater diversity by providing additional pathways into the cybersecurity field." 

In addition to the financial award, the Center for Cyber Safety and Education's scholarship program provides opportunities for recipients to learn from cybersecurity professionals and past scholarship recipients and get more information about internship and career opportunities. As part of their scholarship, recipients can pursue the Certified in Cybersecurity certification exam for free through the (ISC)² One Million Certified in Cybersecurity program.

The deadline to submit a scholarship application is February 28, 2023. To complete an application and learn more about the scholarship opportunities, please visit https://www.iamcybersafe.org/Scholarships/.

**About the Center for Cyber Safety and Education** 

The Center for Cyber Safety and Education, formerly (ISC)² Foundation, is a non-profit charity formed by (ISC)² in 2011 as a means to reach the general public and empower students, parents, teachers, and members of society across all age groups and demographics to secure their online life with cybersecurity education and awareness programs. The Center breaks down barriers in exposure and access to the cyber profession and provides opportunities for underserved individuals, groups, and organizations to benefit from the commitment of (ISC)² to the profession. 

Visit www.iamcybersafe.org.

**About (ISC)²**

 (ISC)² is an international nonprofit membership association focused on inspiring a safe and secure cyber world. Best known for the acclaimed Certified Information Systems Security Professional (CISSP®) certification, (ISC)² offers a portfolio of credentials that are part of a holistic, pragmatic approach to security. Our association of candidates, associates, and members, nearly 280,000 strong, is made up of certified cyber, information, software, and infrastructure security professionals who are making a difference and helping to advance the industry. Our vision is supported by our commitment to educate and reach the general public through our charitable foundation – The Center for Cyber Safety and Education™. For more information on (ISC)², visit www.isc2.org, follow us on Twitter, or connect with us on Facebook and LinkedIn.

Center for Cyber Safety and Education Opens 2023 Cybersecurity Scholarship Applications

Advanced workflow, approval process, and management dashboard enhance control, distribution, and supervision, while reducing errors and streamlining the entire SBOM management process.

**TEL AVIV, Israel****,** **Jan. 26, 2023** **/PRNewswire/ --** Cybellum, provider of the award-winning Product Security Platform for connected product and device manufacturers, announced today the release of version 2.22, providing enhanced SBOM management and security capabilities for the automotive, medical device, and industrial sectors. Generation of reliable SBOMs is only the first step in the process. Version 2.22 offers greater visibility for managing SBOMs via advanced workflows for approval process and management dashboards, and improved support for protecting against supply chain vulnerabilities.

Increased pressure from regulatory bodies and asset owners requires that manufacturers provide better visibility into their software components using Software Bill of Materials (SBOM). But generating SBOMs is not enough. It is only the first step for manufacturers who need to monitor and manage the multitudes of SBOMs created, now and into the future. 

"There is heightened focus on Software Bill of Materials in connected devices, especially since the Presidential Executive Order 14028 was released in May 2021, and as a result of the work that CISA and the NTIA have been doing in this area," said Eran Rosenberg, VP of Products and Strategy at Cybellum.

"But it's not enough to just create SBOMs," Rosenberg stressed."SBOMs must be managed - vetted, edited and approved - so they correctly represent the software make-up of a device. In addition, security and compliance stakeholders should be able to seamlessly share the SBOMs and support must-have use-cases for vulnerability management, supply chain security and support of product security incident response teams (PSIRT)."

Version 2.22 includes new features and capabilities for product security teams to streamline the management process including:

*   **Management dashboards** - for managing the control of SBOMs, their distribution and approval processes across product, security, compliance and management teams.
*   **SBOM approval process** - locks an SBOM for further editing, designates it as "approved" for further usage, and logs approver details in the platform's audit log.
*   **Improved Access Control** - for role-based access control with SBOM-level access permissions.
*   **Ability to track KPIs and Risk -** reveals the organization's SBOM readiness and cyber risk status, helping managers identify areas requiring immediate attention.
*   **Multiple SBOM formats** - support for managing formats including CycloneDX, SPDX, SWID.
*   **Hierarchical product configuration** \- including system, product and component level.
*   **Support for NTIA minimal elements for SBOMs** - component vendor, name, CPE, CPE aliases, version, latest version, website, reference and dependencies.
*   **Lifecycle support** - for SBOM lifecycle phase, component End-of-Life and End-of-Support.

To schedule a demo of the SBOM management capabilities, click here.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Cybellum Releases Enhanced SBOM Management and Compliance Oversight for Manufacturers with New Release of its Product Security Platform

New guidance seeks to cultivate trust in AI technologies and promote AI innovation while mitigating risk

**January 26, 2023-****WASHINGTON —** The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has released its _Artificial Intelligence Risk Management Framework_ (AI RMF 1.0), a guidance document for voluntary use by organizations designing, developing, deploying or using AI systems to help manage the many risks of AI technologies. 

The AI RMF follows a direction from Congress for NIST to develop the framework and was produced in close collaboration with the private and public sectors. It is intended to adapt to the AI landscape as technologies continue to develop, and to be used by organizations in varying degrees and capacities so that society can benefit from AI technologies while also being protected from its potential harms.

“This voluntary framework will help develop and deploy AI technologies in ways that enable the United States, other nations and organizations to enhance AI trustworthiness while managing risks based on our democratic values,” said Deputy Commerce Secretary Don Graves. “It should accelerate AI innovation and growth while advancing — rather than restricting or damaging — civil rights, civil liberties and equity for all.” 

Compared with traditional software, AI poses a number of different risks. AI systems are trained on data that can change over time, sometimes significantly and unexpectedly, affecting the systems in ways that can be difficult to understand. These systems are also “socio-technical” in nature, meaning they are influenced by societal dynamics and human behavior. AI risks can emerge from the complex interplay of these technical and societal factors, affecting people’s lives in situations ranging from their experiences with online chatbots to the results of job and loan applications.   

The framework equips organizations to think about AI and risk differently. It promotes a change in institutional culture, encouraging organizations to approach AI with a new perspective — including how to think about, communicate, measure and monitor AI risks and its potential positive and negative impacts.

The AI RMF provides a flexible, structured and measurable process that will enable organizations to address AI risks. Following this process for managing AI risks can maximize the benefits of AI technologies while reducing the likelihood of negative impacts to individuals, groups, communities, organizations and society.

The framework is part of NIST’s larger effort to cultivate trust in AI technologies — necessary if the technology is to be accepted widely by society, according to Under Secretary for Standards and Technology and NIST Director Laurie E. Locascio. 

“The AI Risk Management Framework can help companies and other organizations in any sector and any size to jump-start or enhance their AI risk management approaches,” Locascio said. “It offers a new way to integrate responsible practices and actionable guidance to operationalize trustworthy and responsible AI. We expect the AI RMF to help drive development of best practices and standards.”

The AI RMF is divided into two parts. The first part discusses how organizations can frame the risks related to AI and outlines the characteristics of trustworthy AI systems. The second part, the core of the framework, describes four specific functions — govern, map, measure and manage — to help organizations address the risks of AI systems in practice. These functions can be applied in context-specific use cases and at any stages of the AI life cycle.

Working closely with the private and public sectors, NIST has been developing the AI RMF for 18 months. The document reflects about 400 sets of formal comments NIST received from more than 240 different organizations on draft versions of the framework. NIST today released statements from some of the organizations that have already committed to use or promote the framework.

The agency also today released a companion voluntary AI RMF Playbook, which suggests ways to navigate and use the framework. 

NIST plans to work with the AI community to update the framework periodically and welcomes suggestions for additions and improvements to the playbook at any time. Comments received by the end of February 2023 will be included in an updated version of the playbook to be released in spring 2023.

In addition, NIST plans to launch a Trustworthy and Responsible AI Resource Center to help organizations put the AI RMF 1.0 into practice. The agency encourages organizations to develop and share profiles of how they would put it to use in their specific contexts. Submissions may be sent to \[email protected\].

NIST is committed to continuing its work with companies, civil society, government agencies, universities and others to develop additional guidance. The agency today issued a roadmap for that work.

The framework is part of NIST’s broad and growing portfolio of AI-related work that includes fundamental and applied research along with a focus on measurement and evaluation, technical standards, and contributions to AI policy.

NIST Risk Management Framework Aims to Improve Trustworthiness of Artificial Intelligence

Expect more regulatory and enforcement action in the US and around the world.

In 2022, we saw broad support behind federal privacy legislation in the US Congress. While the American Data Privacy Protection Act (ADPPA) did not see the president's pen prior to the midterms, the fact that such a bill saw a committee vote in the House — approved 53–2, with bipartisan support — and both industry and advocates promoted passage is notable. The question is no longer whether we will see federal privacy law, but when. And while the ADPPA took up much of the attention in the US in 2022, the year also brought a progressive Federal Trade Commission (FTC) launching a broad regulatory initiative, continued growth of state privacy issues in California and beyond, and the introduction of an executive order to repair the Privacy Shield program. In 2022, US privacy was searing hot.  

Last year also saw continued growth in the international realm. China's new law began to show the significant risks of noncompliance. India continued its parliamentary moves toward passage of a comprehensive data protection law. And the Europen Union saw significant traction in enforcement activity. More than 100 countries now have national privacy laws, and the field grows every day.

These trends will continue, and accelerate, in 2023. Expect more state law in the US, more regulatory and enforcement action from the Federal Trade Commission, an active enforcement environment in the EU — major cases are expected in Ireland, very soon — and continued maturity and growth around the world as privacy professionals grapple with the complexity and risk of these laws.

**Predictions for 2023**

2023 will be a turbulent year in privacy. Economic headwinds and disruption in the tech industry may give rise to calls for additional privacy protections and stronger enforcement. M&A activity may highlight the fact that corporate privacy policies may be modified or ignored when competing interests take priority. Data transfers will still be a central concern, with the EU assessment of adequacy for the updated Privacy Shield emerging early in the new year.

Here are a few key trends to watch:

*   **Tighter budgets, but an even tighter talent pool.** Privacy leaders will struggle with two competing themes. On the one hand, privacy budgets, like all expense lines in organizations, will feel the pressure of recessionary forces in the global market. Privacy leaders will need to do more with less in many cases. Conversely, the talent shortage in the privacy field will continue to get worse with experienced privacy pros commanding greater salary levels and poaching of top talent across the field.

*   **Who's your data privacy officer (DPO)?** The EU Data Protection Board has announced that the appointment and role of the DPO under the General Data Protection Regulation (GDPR) will be a shared enforcement priority across the EU for 2023. Now is a good time to make sure that: (1) you have a DPO; (2) you have registered them appropriately with your DPA; (3) they are adequately trained, experienced, and resourced for the job; (4) they have independence in their duties; and (5) they have access to the top levels of management. Expect more from the European Data Protection Board (EDPB) guidance too. We may see expectations emerge around proper qualifications, independence, and conflicts within the DPO role.

*   **Something old, something new.** New laws take up much of our focus in the privacy field, and rightly so. The American Data Privacy Protection Act (ADPPA), Brazil's General Data Protection Law (LGPD), and China's Personal Information Protection Law (PIPL) all present new compliance complexity for privacy pros. But do not lose sight of the number of laws that are being updated, even overhauled, around the world. Canada, Australia, New Zealand, and more have completed or initiated major reform of their existing privacy laws. These changes can be just as consequential as a new law.

*   **Enforcement risk and creativity.** Often, we focus on the monetary size of an enforcement action. But there are other enforcement tools available to regulators around the world. Watch for the rise of executive liability (sometimes criminal!), data disgorgement, and board oversight obligations as regulators look to change corporate behavior. These tools undoubtedly change the risk profile for privacy and may elevate attention to the highest levels in organizations.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Organizations Must Brace for Privacy Impacts This Year

One of the most closely watched security startups continues to build bank because its platform appeals to both developers and security pros.

Developers, security professionals, and investors all find something to like about Snyk and its developer security platform, which helps organizations mitigate their risk of exposure to software supply chain attacks.

After closing $196.5 million in Series G investment late last month, Snyk on Tuesday said it secured an additional $25 million from ServiceNow. ServiceNow's investment brings the total amount Snyk has secured to $1.4 billion since 2020.

During those three years, the company behind the developer security platform has been adding on customers. Snyk claims its revenues last year grew 100%, with net revenue retention growing 130%. Snyk reports that it closed out 2022 with over 2,300 customers who remediated more than 5.1 million vulnerabilities. Identity verification provider Veriff ranked Snyk first in an analysis of security startups based on funding amounts, number of investors, employee counts, Twitter following, and the uniqueness of the product portfolio.

**Integrating Snyk With ServiceNow**

Following this investment, ServiceNow will embed Snyk's open source software component analysis (SCA) and intelligence tools into ServiceNow's Vulnerability Response. While Snyk can boost ServiceNow's vulnerability detection capabilities, its developer-focused tools can bring Snyk to more DevSecOps organizations.

"Snyk's vision is all the way from code to cloud, and cloud is really code," Snyk chief product officer Manoj Nair says. "We get people to build security in from the start, rather than putting firewalls and scanners and all that after the fact to catch what's wrong."

ServiceNow VP and general manager of security products Lou Fiorello envisions the Snyk platform extending his company's vulnerability detection capabilities. "This significantly furthers ServiceNow's ability to provide a single view into vulnerabilities across the enterprise technology environment, driving workflows to better prioritize and expedite vulnerability management," Fiorello said in a statement.

**Appealing to Developers and Security Professionals**

Founded in 2015, Snyk has stood out amid escalating growth in software supply chain attacks. Snyk's Developer Security Platform helps organizations reduce the risk of an attack by letting those who build container-based applications generate software bills of materials (SBOMs) during the development process.

"Snyk has been successful at building security tools that the developers like," says Enterprise Strategy Group senior analyst Melinda Marks. Marks emphasizes that developers find especially appealing Snyk's tools to test open source code using SCA and to scan infrastructure as code.

"Snyk was a pioneer in the developer-first security category," she adds. "It's very easy for developers to use while giving security teams visibility and control for setting policies and related functions."

The ServiceNow announcement is significant, Marks adds, given how many large enterprises use ServiceNow for IT service management. ServiceNow says it serves 80% of Fortune 500 companies and approximately 7,400 enterprise customers.

**Recent Security Moves**

Organizations are increasingly looking at how to efficiently make SBOMs, especially in light of software supply chain attacks, vulnerabilities such as Log4j, and government mandates. In November, Snyk released an update to make it easier to automatically generate SBOMs during the software build process. Snyk added a "developer-first" API and command-line interface (CLI) to create SBOMs, which the company says provides broader visibility into customers' complete software supply chains.

Snyk also released an SBOM Checker, a free tool that scans SBOMs for vulnerabilities. Snyk also has added Bomber Integration, which scans SBOMs with the open-source Bomber application, testing them against its open source Snyk Vulnerability Database.

In November, Snyk Cloud — the outgrowth of the company's acquisition of Fugue last year — went live. Snyk Cloud has a common policy engine designed to ensure organizations' cloud applications are secure before deploying them.

"Snyk Cloud will help you secure your cloud environment with common policies for infrastructure code and cloud deployments," Nair said during the November launch event. "Taking a code-centric approach to find and fix cloud issues is something that we were fundamentally focused on."

Snyk Gets Nod of Approval With ServiceNow Strategic Investment

Delivering secure, global IoT device connectivity, deployment, and management at scale.

**ATLANTA, January 2023 --** KORE (NYSE:KORE), a global leader in Internet of Things (IoT) solutions and worldwide IoT Connectivity-as-a-Service (CaaS), is using Amazon Web Services (AWS) to simplify deploying, managing, and securing massive IoT solutions.

An expanding set of use cases are broadening the segment of Massive IoT, wherein organizations can implement widespread use of connected devices to drive efficiencies, optimize operations, and monitor conditions in industries including logistics, industrial, fleet, healthcare, agriculture, energy, utilities, and more.

With myriad network connectivity technologies, and widespread and oftentimes remote or hard-to-reach devices, the security risks can be heightened. KORE has introduced its OmniSIM™ SAFE using AWS IoT Core to decrease security challenges associated with global Massive IoT and large-scale IoT deployments.

The KORE OmniSIM SAFE connectivity solution is an innovative eSIM approach that uses the Global System for Mobile Communications Association (GSMA) IoT SIM Applet For Secure End-2-End (SAFE) standard. This standard enables device manufacturers and IoT providers to use the SIM as a root of trust to protect IoT data communications. This enables a standardized, device-level approach to security.

AWS IoT Core connects with the SIM to simplify secure device provisioning and management, as well as message routing to AWS services. From deployment to management, this is a holistic approach to widespread device security and dovetails with Massive IoT, because the KORE OmniSIM SAFE supports zero-touch provisioning – pairing device to cloud with minimal physical intervention.

"IoT is positioned to grow exponentially through this decade as organizations seek ways to optimize and streamline operations. An estimated 75 billion devices are expected to be connected by 2030, but with those connected devices comes a unique set of challenges," said KORE President and CEO Romil Bahl. "IoT security can be an area of concern across industries due to a lack of standardization and a fragmented ecosystem – this broadened landscape of devices exposes more security attack surfaces in kind. We are proud to deliver innovation in IoT security by using AWS."

KORE first launched its OmniSIM SAFE solution working with Energy Web, a nonprofit organization focused on building open-source software to accelerate the energy transition. The Energy Web stack enables enterprises to build and operate production-grade applications by leveraging decentralized technologies. One of the significant aims of Energy Web is to lower the use of carbon to meet global decarbonization targets.

"We are incredibly proud of KORE's leadership in the eSIM space and could not be more excited about the power of their technology powered by AWS and the Energy Web stack," said Jesse Morris, CEO of Energy Web Foundation. "We are on the cusp of a digital revolution for energy systems across the world; technologies like these must be deployed at scale in order for governments and corporations around the world to achieve decarbonization targets by 2030."

The participation of multiple organizations to simplify the use of IoT is the next evolution of how this technology is adopted.

"It is critical for end-to-end IoT security that devices are provisioned with individual, unique security credentials that are securely stored with the device. The logistics of managing the provisioning of large fleets of IoT devices can be complex for customers and not all IoT devices may offer secure on-device storage for credentials," said Yasser Alsaied, vice president of IoT at AWS. "We are excited to offer our AWS IoT Core customers a holistic approach to IoT security."

**About KORE**

KORE is a pioneer, leader, and trusted advisor delivering mission critical IoT solutions and services. We empower organizations of all sizes to improve operational and business results by simplifying the complexity of IoT. Our deep IoT knowledge and experience, global reach, purpose-built solutions, and deployment agility accelerate and materially impact our customers' business outcomes. For more information, visit www.korewireless.com.

**About Energy Web**

Energy Web is a global, member-driven nonprofit accelerating the low-carbon, customer-centric energy transition by unleashing the potential of open-source, digital technologies. We enable any energy asset, owned by any customer, to participate in any energy market. The Energy Web Chain — the world's first enterprise-grade, public blockchain tailored to the energy sector — anchors our tech stack. For more information, visit https://www.energyweb.org/.

KORE Delivers IoT SAFE Solution for Massive IoT Use Cases with AWS

**January 25, 2023 - California, US;** In 2023 there will be a global increase in data privacy regulation enforcement, new regulations in the United States leading to further fragmentation, investment in privacy-enhancing technologies, and hopes for agreement on a data transfer mechanism between the EU and US, among other developments. In light of Data Privacy Day 2023, data privacy technology Privado is today announcing **Data Privacy All-Stars** and **Rising Stars**, recognizing the efforts of these individuals within their industry as they share their insights on the challenges that lie ahead in 2023. 

Privado received over 2,000 nominations for its inaugural Data Privacy Stars listing. The list recognizes All-Star and Rising Star recipients for the exceptional work done by individuals who are taking privacy and security to the next level within their organization and beyond by spreading awareness of data privacy across the world. 

The **All-Stars 2023** list celebrates those who have considerable data privacy related achievements to show over the years. The **Rising Stars 2023** list commends those who are passionately driving data privacy initiatives.

Data Privacy Stars shared their insights, tips and predictions for 2023. 

2023 top data privacy challenges: 

*   More fines and enforcement that holds leadership (CEOs, CISOs) accountable. 
*   New regulations leading to more complexity and fragmentation.
*   Focus on protecting children and healthcare data including more direct guidance from the FTC and the HSS.
*   AI will bring new risks we haven’t seen before as it finds and exploits loopholes.
*   Skepticism on an agreement for a data transfer mechanism between EU and US.
*   User demand for more visibility and controls over consent.

2023 data privacy top tips: 

*   Data mapping as the undisputed foundation of any privacy program. 
*   Make privacy second nature by embedding privacy processes into stakeholder teams’ existing processes.
*   Implement Privacy by Design practices.
*   Having leadership acknowledge and champion how important data privacy is to make a difference.
*   Rightsizing privacy strategy for the current stage of your organization.
*   Step away from making privacy a policing role. Engage developer teams by bringing empathy, some social intelligence but most of all understanding business needs.
*   Proactive scanning capabilities and data lineage capabilities will be important. 

January 28, 2023 marks Data Privacy Day, an international effort to create awareness about the importance of respecting privacy, safeguarding data and enabling trust. Initiated in 2007 by the Council of Europe and adopted in 2009 by the United States, Data Privacy Day is now observed by over 50 countries around the world.

**Vaibhav Antil, CEO of Privado** commented: "Ahead of Data Privacy Day, we wanted to recognize individuals doing exceptional and innovative privacy work within their organizations. We want to highlight their accomplishments and share their insights with peers across the world."

"Data Privacy Day gives us all an opportunity to take a second and think about what we share about ourselves, when and where we share it, and who we are sharing it with. Organizations are taking the challenge of safeguarding our data head-on while continuing to deliver value to consumers, and so today is also a good opportunity to raise awareness of the magnitude this effort represents for every company and how every individual must be solving for privacy."

Founded in 2020, Privado was created to address the privacy issues facing businesses around the world. Privado offers open-source and enterprise code scanning solutions purpose-built for privacy that identifies data usage, discovers data flows & flags privacy issues like excessive user permissions or data leakages to logs.

**About Privado**

Privado is the privacy code scanner for privacy & security teams who want unparalleled visibility into data flows from applications & helps developers fix privacy vulnerabilities like personal data leakages to logs or third parties. Founded in 2020, Privado has enabled Headspace, Zego, Thrasio, TrendyOl & many more enterprises to embed privacy checks in their Software Development Life Cycle. For more information please visit https://www.privado.ai/ or follow via Twitter and LinkedIn.

Data Privacy Day: Privado Flags Data Privacy Challenges In 2023 As It Hails Industry Stars

Two common attacks against on-premises Kerberos authentication servers — known as Pass the Ticket and Silver Ticket — can be used against Microsoft's Azure AD Kerberos, a security firms says.

Microsoft's Azure AD Kerberos service, a cloud-based identity and access management (IAM) service based on Kerberos authentication, can be attacked using techniques similar to those used by attackers against on-premises Kerberos servers.

Kerberos is a widely used protocol used to authenticate users and devices via symmetric key cryptography and a key distribution center; it enables modern authentication mechanisms such as single sign-on (SSO). Because Kerberos authentication is a standard security measure for many enterprises, attackers have frequently tried to compromise or bypass the authentication servers using identity attacks that spoof legitimate users.

In the on-premises world, a pair of common identity attacks are the Pass the Ticket and Silver Ticket approaches, which allow an attacker to use stolen credentials or mint their own credentials, respectively, and authenticate with enterprise services. Both techniques continue to work to some degree against the cloud versions of Kerberos authentication servers, according to cybersecurity services firm Silverfort, which dubbed the cloud-based iterations of the attacks the Bounce the Ticket and Silver Iodide threats.

"Identity attacks that have existed for some time are still a risk as organizations move into the cloud," says Dor Segal, senior security researcher at the firm. "Azure AD Kerberos is a new implementation but not a new protocol. Security teams need to be aware of this fact and put appropriate mitigations in place."

The fact that variants of the two attacks still work in the cloud show that moving security infrastructure to the cloud has little impact on the threat, Segal says.

"The issues outlined could impact anyone using the new Azure AD Kerberos protocol," he says. "While Azure AD Kerberos is still in initial stages of adoption, as with anything released by Microsoft, the scale of usage will increase. In the past, this type of lateral movement was an issue affecting the on-premises enterprise network. These \[new\] attacks break this perimeter."

Microsoft added Kerberos functionality to its Azure Active Directory service last August, and attackers are sure to follow, Silverfort argued in a research report issued Jan. 25. After all, IAM systems have become linchpins for many companies' zero-trust security efforts, with Microsoft Active Directory, for example, a target of attacks in nine out of 10 incidents. In addition, Kerberos is a frequent target of attackers, who often go after "tickets" — i.e., encrypted authentication credentials or tokens, used by the Kerberos protocol as proof that a client or device has authenticated to the server. 

A successful attempt to duplicate a ticket gains attackers access to protected resources for a limited time, generally on the order of hours, allowing them to move around a corporate network or use SSO services like email that might be protected by the Kerberos credential.

**Bouncing & Silver Tickets**

In the first attack, dubbed a Bounce the Ticket attack, an attacker who has compromised one user's system and who steals a Kerberos ticket from the machine's memory can then then use the secret key to gain access to cloud workloads. This attack bears similarities to the on-premises Pass the Ticket attack on Kerberos authentication services and gives the attack the ability to "access cloud-based resources that rely on Azure AD Kerberos," according to Silverfort's research.   

    

The Bounce the Ticket attack flow. Source: Silverfort

In the second attack, dubbed a Silver Iodide attack, an attacker who gains access to one user's Azure AD account can connect to a specific service — in the example given by Silverfort, the Azure Files cloud sharing service — after finding a "security gap" in the service. The security weakness, which Silverfort did not describe, can be used to create a new server ticket to access or manipulate information. The technique, which resembles the Silver Ticket attack against on-premises Kerberos servers, could be used against other cloud services as well, as long as attackers can find ways around specific controls, Silverfort stated. 

**No Fix Ahead**

Overall, the two issues represent ways an attacker — who has compromised either a system on the network or an Azure AD account — could recover Kerberos tickets and reuse those secrets to extend access to other infrastructure. 

Silverfort disclosed the issues to Microsoft, and while the company is aware of the weaknesses, it does not plan to fix them, because they are not "traditional" vulnerabilities, Segal says. Microsoft also confirmed that the company does not consider them vulnerabilities. 

"This technique is not a vulnerability, and to be used successfully a potential attacker would need elevated or administrative rights that grant access to the storage account data," a Microsoft spokesperson tells Dark Reading. "We recommend customers regularly review their role definitions that include 'listkeys' permissions, and enable software that prevents attackers from stealing credentials, such as Credential Guard."  

Silverfort's Segal acknowledges that to fix the issues, the Kerberos protocol would have to be redesigned, and that is unlikely.

"Fixing a weakness in any implementation of Kerberos is not as straightforward as patching a traditional software vulnerability because it would require re-engineering the entire protocol," he says. "This would be a significant undertaking which would take a large amount of resource and impact the compatibility of legacy applications using Kerberos."

Companies can make it harder to exploit any security weakness in their cloud-based Kerberos infrastructure, however. Organizations should review any changes to the Azure Access Control service and monitor updates to the permissions. Reducing the number of systems authorized to hold some of the more critical cloud-based credentials — such as the Ticket-Granting Ticket (TGT) — will harden an enterprise's infrastructure to Bounce the Ticket attacks, Silverfort stated in its report.

Microsoft Azure-Based Kerberos Attacks Crack Open Cloud Accounts

Zacks Elite sign-ups for the period 1999–2005 were accessed, including name, address, email address, phone number, and the password associated with Zacks.com.

An older database of Zacks Market Research was accessed by an unauthorized party, compromising the personal data associated with 820,0000 users' Zacks.com accounts.

The company, which offers financial markets research, disclosed the breach as required to the Maine attorney general, and reported that the cyberattack occurred sometime between November 2021 and last August. Specifically, the records of Zacks Elite product customers who signed up between 1999 and 2005 were accessed, the company explained in a letter notifying those impacted users.

"Also, while Zacks is constantly monitoring and updating our system to safeguard customer information, including in consultation with our outside cybersecurity expert, as a result of this incident, we are conducting an investigation and continuing our ongoing efforts to evaluate and implement additional measures to further enhance our protocols for the protection of your personal information," the company said.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Zacks Investment Research Hack Exposes Data for 820K Customers

In the Play Store's ToS, a paragraph says Google may remove "harmful" applications from users' devices. Is that a step too far?

Privacy has become more than a key component of corporate cybersecurity policies and procedures — it also is a lightning rod for lawsuits by consumers who believe their rights have been violated. While privacy laws have become commonplace, periodically what might seem to be relatively common language from contracts turn out to be problematic for the vendors.

Google, for example, has a long history of searching the Play Store, its apps repository, for programs that contain malware. Less than a year ago, Google removed multiple apps from the Play Store that had the banking Trojan SharkBot hidden inside.

However, while removing troublesome apps from the Play Store would seem prudent, Google takes this one step further into a legal gray area.

In Google's Play Store Terms of Service (ToS), Google notes that it scans for malware and reserves the right to remove it from a user's computer if it deems it necessary. Google's ToS reads:

**Malware protection.** To protect you against malicious third party software, URLs, and other security issues, Google may receive information about your Device's network connections, potentially harmful URLs, the operating system, and apps installed on your Device through Google Play or from other sources. Google may warn you if it considers an app or URL to be unsafe, or Google may remove or block its installation on your Device if it is known to be harmful to devices, data or users. You can choose to disable some of these protections in the settings on your Device, however, Google may continue to receive information about apps installed through Google Play, and apps installed on your Device from other sources may continue to be analyzed for security issues without sending information to Google.

This 130-word paragraph in the 3,537-word document is raising eyebrows among some privacy experts. Debbie Reynolds, CEO of data privacy consultancy Debbie Reynolds Consulting, says Google's ToS differs widely from those of other companies, in part because Google offers a variety of interconnected services that operate within the Google ecosystem.

Google's ToS is ambiguous, she says, because it is not clear about exactly what it might block or remove that is "known to be harmful to the device, data or users." The ToS also does not commit Google to tell users when it makes such a deletion.

A user might have a reason to want a program on their system that Google considers harmful, determining the risk is within their risk tolerance range. If Google deletes that without informing the user, it could have unexpected consequences.

"It is likely that Google's ambiguous stance on informing users about actions taken on their devices will face legal challenges in the future, particularly if a significant number of individuals voice complaints about Google's lack of transparency and perceived harm caused by their actions," Reynolds says.

**Deleting Apps, Not Data**

However, Rebecca Herold, CEO of consulting firm Rebecca Herold & Associates and popularly known as The Privacy Professor, says, "I do not see that they are claiming a right to delete or modify data. They are reserving the right to delete an app, which is software, if it is harmful to data, users or devices."

She clarifies that there's a difference between applications and user data. "An app is not data in the context of how this is written," Herold says. "I do not see anything within the paragraph you provided that they are going to delete data. It is possible that deleting the app will remove access from that device to the associated data, but the data would still likely exist somewhere else."

"I think the open-ended way they have worded this, giving users the ability to disable 'some' of these protections, without saying specific which protections, does not make it clear whether or not they are overstepping their legal rights," Herold notes.

"\[Google\] does not indicate they are deleting or changing data," she says. "It indicates they may uninstall an app they determine to be harmful, and/or block a website they determine to be harmful, which could remove access to the data. So, they have established their own legal requirements and limits for the boundaries of their actions."

**How Much Access Should Google Have?**

Irina Tsukerman, an attorney whose firm specializes in national security, cyber law, and emerging threats, says, "Adhesion contracts, which are one-sided and non-negotiable, are considered legal; however, if any specific clauses represent a significant burden on the consumer/client's rights, it may be deemed disputable/unenforceable, and the company may be forced by courts to change the language. In this case, the clause is far beyond the mere 'warning' or even 'blocking' language fairly typical to tech companies, because it involves the additional step of actively intervening and entering a user's system."

This intervention step is "extremely questionable in itself, because Google arguably does not have the right to access the user's entire system," she adds. Removing a program could impact other parts of the system.

Anytime such language is overbroad, it is very likely to be found illegal and violating the other party's — in this case, the user's — rights. Tsukerman says that in this case, the language is "extremely problematic due to excessive vagueness."

Source

DARKReading