While CISOs may feel more confident in their security posture emerging from the pandemic, new research suggests that doesn't mean organizations are better prepared for large-scale attacks.

Cybercrime reached heightened levels of intensity and sophistication in the past year. We saw greater complexity in ransomware, supply chain, and critical infrastructure attacks. Despite the threat escalation, CISOs feel more confident in their security posture. But does that feeling of confidence actually translate into organizations being better prepared for large-scale attacks? New research suggests that is not the case.

The "2022 Voice of the CISO" report, Proofpoint's global survey of 1,400 CISOs, found that only 48% are concerned about their organization suffering a material cyberattack in the next 12 months, a sharp drop from the previous year's 64%. This shift reveals CISOs feel more in control, even as new events such as the Great Resignation and geopolitical tensions in Europe are elevating their stress levels.

But the increased confidence of CISOs shows a disconnect with their actual preparedness — despite their greater trust in themselves, 50% acknowledge their organization is not prepared to cope with a targeted attack. This misalignment shows that CISOs have simply reached a state of relative tranquility after the disruption of the pandemic. The psychological effects of the chaos are finally wearing off.

Having met the pressure to react quickly and shore up resources to support remote work in 2020, CISOs accepted the realities of our new world of elevated cyber threats. But once the pandemic demands eased up, new, pressing issues developed — and CISOs accepted their new normal of always operating at high alert.

**CISOs Adapt but Vulnerabilities Remain**

As CISOs moved to adapt to the new realities of their job, insider threats became their biggest concern, rising from the third spot in 2020 to the top in 2021. The increased awareness about insider threats likely played a big part in this change, especially in the life sciences sector, where vaccine research received prominent media attention. Pfizer is one example. The company filed a highly publicized lawsuit against an employee who allegedly stole trade secrets pertaining to the company's vaccines and medications.

Geopolitical tension also contributed to concerns about insider threat. Last year, for instance, the FBI warned technology companies that employees with ties to China and Russia may spy on them. And let's not forget that negligent insiders pose almost as big a threat — CISOs ranked negligent, malicious, and compromised insiders as nearly equal risks in terms of breach exposure.

Data protection is at the heart of the challenge, especially given the impact of the Great Resignation and hybrid work. Some 56% of surveyed CISOs still view human error as the biggest threat to their organization, with compromised insiders as the most likely vector. The ongoing transition, as employees continue to leave or return to the workplace, exacerbates the insider threat, making data protection an even more urgent priority.

**Finally, a Seat at the Table — With Mixed Results**

Ransomware is another threat that received media attention last year, forcing C-suites finally to take notice of these high-profile attacks. In the past, CISOs often had to plan special strategies to gain an audience with the board. Corporate directors and top officers viewed CISOs as simply technologists, relegating cybersecurity to a mere IT problem. Today, CISOs are finally getting a seat at the table. This is an encouraging change.

With their role now elevated, CISOs are also subject to a higher level of job expectations. Only 49% feel the expectations of their role are excessive, compared with 57% in the previous year's study. This may be another indicator of the post-pandemic calm, leaving CISOs feeling less pressured yet more in control.

Unfortunately, the rise in prominence of the CISO's role does not mean that security leaders feel more supported by their organizations. There was only a slight decrease in the number of CISOs who see eye-to-eye with their boards (52% in 2021 vs. 54% in 2020).

This strain in their relationship will continue to impact the effectiveness of CISOs in making cybersecurity a strategic part of their organization's business objectives — and the survey data show the implications of this struggle. For instance, 42% of surveyed organizations still do not have a ransomware policy in place. Although this threat has been on CISOs' radar for a long time, it took the nonstop media coverage in the past year for boards and executives to finally pay attention. They are just now viewing their CISOs as risk or business strategists.

**Bolstering Defenses Is Vital in the New Workplace**

As organizations acclimate to the new ways of operating in a post-pandemic world, CISOs are ready to leave uncertainty in their rearview mirror. But is this the calm before the next storm?

With geopolitical tensions mounting in Europe and other areas of the globe, targeted attacks, insider threats, and critical infrastructure risks keep rising. While CISOs are much more confident in their cybersecurity posture, bolstering defenses remains a critical imperative.

Organizations have emerged from the pandemic as transformed workplaces, and strengthening the human perimeter is especially critical in this evolved, hybrid environment. Now that CISOs have a voice, they are in a stronger position to make the case for better organizational preparedness. Considering that people remain the biggest risk factor, making the argument for closing the gaps in the human perimeter must remain at the top of every CISO's agenda.

CISOs Gain False Confidence in the Calm After the Storm of the Pandemic

New (ISC)² survey shows employment levels for entry-level cyber pros lag behind every other experience level.

Even as the global cybersecurity skills gap continues to widen, many organizations still cling to the idea that if they hold out long enough, they will be able to find rock-star veterans to fill out their security team rosters. A new survey shows that cybersecurity hiring managers are less likely to take a chance on promising entry-level candidates than they are to hire veteran staffers or those with at least a year of experience.

This hesitance of many organizations to train up newbies into the industry highlights a huge opportunity that many hiring managers have in improving the state of their cybersecurity workforce, according to the "(ISC)² Cybersecurity Hiring Managers Guide." Based on a survey of 1,200 cybersecurity hiring managers from the US, UK, Canada, and India, the report details hiring practices around the globe.

"The study shows us that, with the exception of the smallest organizations, employment levels for entry-level cybersecurity professionals trail far behind every other experience level," says Tara Wisniewski, executive vice president of advocacy, global markets, and member engagements for (ISC)². "It's also a particularly notable challenge in the US and UK, compared to Canada and India where entry-level employment levels are higher overall."

In the US, for example, just 26% of security teams are composed of entry-level employees, compared with 38% who have four or more years of experience and 36% with one to three years of experience. The proportion of entry-level candidates may actually even be lower than that, considering that the survey methodology included only those managers who have hired entry-level or junior-level candidates sometime in the last two years. With those managers who only hire experienced candidates self-selecting out, the real numbers are likely even more stark than the report illustrates.

    

Regardless, the lag in entry-level employment rates occurs despite the fact that it takes a relatively short amount of time for these new practitioners to get up to speed on their job duties. Approximately 65% of hiring managers say it takes nine months or less to train entry-level staff. While these candidates improve their skills or knowledge, they're typically tasked with the repeatable security scut work that plagues security teams on the daily. 

The top two tasks delegated to entry-level workers are alert and event monitoring and documenting processes and procedures, which were respectively named by 35% of hiring managers. In open-ended comments within the survey, managers said that entry-level team members often bring "fresh ideas and perspectives to the table" and they often are willing to go the extra mile to get ahead not only in their job but in the cybersecurity profession.

    

One of the likely reasons why hiring managers struggle to keep their cybersecurity roster freshened up with greater proportions of newcomers to the field is that they aren't necessarily looking in the right places to find them.

    

"Organizations rely heavily on external factors and resources to find staff, including looking for certifications and looking within the memberships of certification organizations to find candidates," says Wisniewski, who notes that more than half of respondents rely on external recruitment professionals to fill these roles.

She believes that one of the highest-value things that cybersecurity managers can start doing to attract entry-level and junior-level practitioners is to search for talent beyond the world of cybersecurity and even IT. The survey shows that just 18% of study participants have hired individuals from within the organization who were working in different job functions.

"Transferrable skills and eager-to-learn people can be found in sales, marketing, engineering, legal, the military, hospitality, and more," she says. "It's also about ensuring that roles, organizations, and the cybersecurity sector at large are more inclusive and accessible for all."

**Reality Check for Training Dollars**

Wherever the candidates are found, the investment to get them to the point where they can meaningfully contribute to the team is likely less expensive than some managers might expect. Over eight in 10 respondents said the costs are less than $5,000, and 42% said it costs less than $1,000 for newcomers to start handling assignments.

Even with more significant investments in professional development, Wisniewski says that hiring managers shouldn't hold off in hiring and training entry-level staff in fear that their training dollars will walk out the door. She believes that these practitioners are crucial for the sustainability of an organization's cybersecurity workforce.

"Hiring junior staff is not a risk or a compromise. If anything, it is a proactive move to improve cybersecurity resilience," she says. "You would not hold off investing in critical infrastructure today just because there's a chance the vendor might change strategy tomorrow. The same applies with investing in your people."

Are You Hiring Enough Entry-Level Security Pros?

Digital transformation helps businesses keep operating and stay competitive. Here are the ways to think about security so that businesses reap the benefits without taking on associated risks.

**Question: How should I think about security when considering digital transformation projects?**

**Niv Weisenberg, Senior Director of Cyber Digital Transformation, Optiv**: Multiple factors contribute to the sheer number of digital transformation projects underway today: the proliferation of the Internet of Things (IoT), expanding artificial intelligence (AI) capabilities, the sudden shift to a remote workforce prompted by the global COVID-19 pandemic, and the rapid rate of cloud migration. Digital transformation is no longer a nice-to-have; it’s a must-have in order to survive and thrive in today’s business world. 

CISOs and their security teams need to think about security in the digital age from both an internal and an external perspective. For the former, security teams should introduce and adopt digital enablers to transform the information security organization. Digital enablers include the cloud, IoT, AI/machine learning (ML), and automation to transform the information security organization.   

For the latter, they should address potential risks as new digital enablers are introduced by the business to drive growth.

Here are five specific areas security teams should prioritize to achieve security-first digital transformation:

**1\. Security operations modernization**: Help security operations adopt a proactive posture when balancing the need to match technology adoption acceleration with cost management.

**2\. Developer-centric security**: Enhance overall security posture and optimize DevOps performance by embedding a culture of proactive security in the DevOps process, enabled by orchestration and automation. For example, “shift security left” in the application development process to integrate security products as developers code and into build/test processes — rather than leaving it as an after-the-fact bolt-on. This will help organizations solve issues at the point of origin, detect and remediate vulnerabilities before they hit production, and, most importantly, build a DevSecOps program that prioritizes security throughout all development phases.

**3\. Cloud strategy and execution**: Shifting security left applies in the cloud transformation journey, too. Develop a strategic roadmap for secure cloud migration, operation, and management, as well as secure architecture modernization. Also consider standing up cloud native app protection (CNAP) capabilities that will scour cloud environments and alert staff to compliance risks and configuration vulnerabilities in cloud services.

**4\. Connected devices:** Enforce critical network, device, and data protection by doing things such as hardening connected entry points to the data fabric, modernizing the data paths for IT/OT convergence, bringing legacy networks under a modern security architecture, and implementing zero trust and a software-defined perimeter.

**5\. Big data and analytics**: Maximize the value extracted from data and secure big data at scale with AI/ML-enabled analytics.

As important as it is to keep the business operating _and_ competitive, organizations must transform _securely._ Keeping security at the forefront gives the business the benefits of digital transformation without the associated risks.

How Should I Think About Security When Considering Digital Transformation Projects?

Ash Devata, Vice President & General Manager, Cisco Zero Trust and Duo Security, sits down with Dark Reading’sTerry Sweeney for a Fast Chat on the future of secure access.

Authentication used to be binary: I give you access or I don’t give you access. But with the rise of remote/hybrid work and the growing number of cloud applications in use, organizations need an even more precise approach to authentication, says Ash Devata, vice-president and general manager of Cisco Zero Trust and Duo Security.

“Every time you're giving access, you have to inspect the user \[and\] inspect the device,” Devata says. “End users just want to get their work done. They don't want to go through all the security checks.“

The security landscape has increased in complexity, with the rise of remote and hybrid work and the accelerated pace of cloud adoption. “The key thing is around, how do we make sure only the right people have access to the applications?” Devata says in his Fast Chat with Dark Reading’s Terry Sweeney.  

Devata also expands on the concept of post-login security. “You log into \[xbox.com\]. You just have the login cookie for six months,” Devata says, in reference to session cookies. So long as the cookies don’t expire, the session is valid and users don’t have to log back in again. However, the session cookie presupposes that nothing has changed to affect the security of the session. It could be the device needing new security updates, or the geographic location.

This is more than risk-based authentication, though. The idea behind continuous password access is to continuously measure all the signals – such as whether device encryption is turned on, if there are pending patches, if the firewall is enabled, and the network location -- completely in the backend, without adding friction to the user experience. Once a signal changes, details about what has changed is then communicated back to the application. Depending on the change, the user may be prompted to re-authenticate, even if the session hasn’t expired.

“Once we give trust, how long can the trust last?” Devata asks.

Cisco’s Ash Devata on the Future of Secure Access

Academic researchers are developing projects to apply artificial intelligence to detect and stop cyberattacks and keep critical infrastructure secure, thanks to grants from the C3.ai Digital Transformation Institute.

Editors' Choice

Jai Vijayan, Contributing Writer, Dark Reading

Kelly Jackson Higgins 2, Editor-in-Chief, Dark Reading

Nathan Eddy, Contributing Writer, Dark Reading

Joshua Bevitz, Partner, Newmeyer Dillion

Gabriella Stevens, Associate, Newmeyer Dillion

Prashant Sharma, Co-Founder & CTO, Secuvy Inc.

Webinars

*   Outsourcing Cybersecurity: A Decision Maker's Guide
*   Using Threat Modeling to Improve Enterprise Cyber Defenses
*   Vendors as Your Largest BEC Threat
*   Implementing Zero Trust in Your Enterprise
*   How Data Breaches Happen and What To Do When They Happen To You

White Papers

*   Understanding DNS Threats and How to Use DNS to Expand Your Cybersecurity Arsenal
*   5 Critical Cyber Range Exercises from the Experts
*   De-identifying Analytics Data with Skyflow
*   Securely Work From Anywhere With the Fortinet Security Fabric
*   Endpoint Detection Net Suite Use Cases

Events

*   Dark Reading Virtual Event - June 23 - Learn More
*   Black Hat USA - August 6-11 - Learn More

More Insights

White Papers

*   Understanding DNS Threats and How to Use DNS to Expand Your Cybersecurity Arsenal
*   5 Critical Cyber Range Exercises from the Experts

Webinars

*   Outsourcing Cybersecurity: A Decision Maker's Guide
*   Using Threat Modeling to Improve Enterprise Cyber Defenses

Reports

*   Incorporating a Prevention Mindset into Threat Detection and Response
*   Practical Network Security Approaches for a Multicloud, Hybrid IT World

7 Ways to Bring AI to Cybersecurity

A novel timing attack allows remote attackers with low privileges to infer sensitive information by observing power-throttling changes in the CPU.

A side-channel timing attack dubbed "Hertzbleed" by researchers could allow remote attackers to sniff out cryptographic keys for servers. It affects most Intel processors, as well as some chipsets from AMD and likely others.

The issue is a timing side-channel flaw (tracked as CVE-2022-24436 for Intel and CVE-2022-23823 for AMD) found in the CPU-throttling technology known as dynamic voltage and frequency scaling (DVFS). DVFS regulates power consumption and electrical current use so that a CPU doesn't overheat when processing large amounts of data, and it conserves battery power during low-activity times.

As Intel explains in guidance published this week, observing these regulation changes can allow attackers to infer sensitive information.

"CPU frequency throttling is triggered when one of these limits is reached, which results in CPU frequency," according to Intel. "This frequency change and derived behavior may be correlated with information being processed by the CPU, and it may be possible to infer parts of the information through sophisticated analysis of the frequency change behavior."

"In the worst case, these attacks can allow an attacker to extract cryptographic keys from remote servers that were previously believed to be secure," according to a technical research paper (PDF) by the team who discovered the attack, from the University of Texas at Austin, the University of Illinois Urbana-Champaign, and the University of Washington.

Hertzbleed – its name a take on the infamous "Heartbleed" timing attack from 2014 – is significant because it allows remote attacks without the need to subvert a power-measurement interface, the researchers note, thus widening the attack surface.

"Software-based power-analysis attacks can be mitigated and easily detected by blocking (or restricting \[10\]) access to power-measurement interfaces," according to the paper. "Up until today, such a mitigation strategy would effectively reduce the attack surface to physical power analysis, a significantly smaller threat."

**Actual Threat or Not?**

While the researchers acknowledge that any real-world attacks would require a high level of complexity, they demonstrated successful proofs of concept for extracting keys as remote attackers authenticated with low privileges and no user interaction requires. This makes "Hertzbleed is a real, and practical, threat to the security of cryptographic software," they say.

Intel begs to differ. 

"While this issue is interesting from a research perspective, we do not believe this attack to be practical outside of a lab environment," said Jerry Bryant, Intel's senior director of security communications and incident response, in a recent posting. "Also note that cryptographic implementations that are hardened against power side-channel attacks are not vulnerable to this issue."

However, he also explained that the issue may extend past Intel and AMD.

"CVE-2022-24436 is not architecture-specific and any modern CPU that has dynamic power and thermal management is potentially affected," he said. "Intel shared its findings with other silicon vendors so they could assess their potential impact."

Neither Intel nor AMD are issuing microcode to address the issue; instead, they recommend that developers achieve mitigation through masking and blinding techniques that would hide the timing changes from observation.

'Hertzbleed' Side-Channel Attack Threatens Cryptographic Keys for Servers

The ability to handle intense pressure is just one of the skills that veterans bring to corporate cybersecurity work.

The contributions of ex-military personnel expand beyond their time of public service. They come to private-sector cybersecurity roles ready to take on foes that range from harbingers of mischief to deliverers of destruction.

"The importance of paying attention to even the tiniest of details due to potential impact and lives on the line is drilled into every military member," says Devon Bryan, global chief information security officer at Carnival Corp. and co-founder of the International Consortium of Minority Cybersecurity Professionals, now known as Cyversity. "Irrespective of branch of service and without regard to rank or station, the military emphasizes the necessity of working hard and with a passion for excellence, which are key for the infosec challenges of today."

It's no secret that former service members come prepared with training that many companies in the private sector find beneficial. But just which military skills transfer best to private cybersecurity jobs?

"An understanding of physical security and access control," says Oxana Parsons, senior cyber intelligence analyst at LookingGlass Cyber Solutions.

Many skills, even those seemingly unrelated to cybersecurity or IT, easily transfer, she adds. 

"In the military I have learned how to set up a local network — and I did it as a HUMINTer \[human intelligence collector\], so \[even\] not really an IT-related job can still provide some related training," Parsons says. "Also, in the military there are lots of opportunities to receive foreign language training and intelligence training, which taught me to understand the tradecraft behind intelligence collection and analysis."  

Other experienced vets point out that their collaboration and self-assessment skills alone can prove priceless to private-sector defense measures.

"Cybersecurity is such a broad field. The ability to be comfortable both knowing and accepting what you don't know, while being humble enough to seek out who does, is a particularly powerful skill to master," says Alex Diaz, customer success leader at Horizon3ai, who served both as a military intelligence officer and an enlisted all-source intelligence analyst in the US Army.

**Fulfilling Private Cybersecurity Needs**

"As cybersecurity grows in prominence as a risk factor for organizations, private firms will need experienced and capable leaders to manage their security postures," says Matt Georgy, chief technology officer at Redacted. "Veterans bring a unique perspective working in chaotic situations and often making consequential decisions in high pressure situations." 

Previously, Georgy served as chief of intelligence of the US Air Force 18th Fighter Squadron, lead US government forensics analyst in Baghdad, and held several technical leadership roles at the National Security Agency (NSA).

While one could argue that all military service is security-related, not all ex-military personnel currently employed in cybersecurity served in security-related positions. Even so, their training often transfers to a new position in the private sector.

"I did not work in security while in the military. But I can find similarities to when I worked in a Navy Combat Information Center (CIC) or a Tactical Operations Center (TOC)," says Josh Smith, cybersecurity analyst at Nuspire, who previously served as operations supervisor, mission control and evaluation supervisor, and operations and logistics department head in the US Navy. "All require the ingestion of data, analyzing what was received, disseminating it to the appropriate parties, and taking action based on the findings."  

The constant shape-shifting of threats and attackers is familiar to military-trained professionals. That alone is a major plus to employers looking to protect themselves from whatever digital abomination is cresting the horizon next.

"Military veterans have a very wide skill set, as we're often asked to work outside of our specific roles," Smith says. "We're exposed to numerous situations that are dynamic, stressful, 24/7, and leave no room for error. Cybersecurity is very similar in this respect. Cybersecurity never sleeps and is consistently changing. Veterans can easily adapt to this lifestyle."  

For those who transferred their cybersecurity skills directly from public to private concerns, commonalities between the sectors smoothed the transition.

"Military operations are steeped in risk and threat by their very nature, so military veterans develop a keen sense for assessing and weighting threat and risk," says Mac McMillan, CEO of healthcare cybersecurity, privacy, and compliance consultancy CynergisTek. Formerly, McMillan was director of security at the Defense Threat Reduction Agency for the Department of Defense (DoD).

"On a personal level, their sense of urgency, structure, discipline, etc., is well-suited for cyber and IT jobs," McMillan adds.

**Rank Is Optional**

Higher ranks in any military branch generally signify accomplishment and experience that are also highly prized in the civilian world. However, limiting hiring to high-ranking ex-military applicants is shortsighted.

"As CISO of the US Marine Corps, I dealt with many early-day cyber incidents from both nation-state threat actors and crime syndicates ... like the Melissa virus and ILOVEYOU," says Carl Wright, chief commercial officer at AttackIQ. 

Officers and enlisted members participate in training programs worth millions of dollars to earn Military Occupational Specialty (MOS) designations. 

"One of those areas is cybersecurity, and within cyber you have defensive operations and offensive operations," Wright says. "The level of training these individuals receive to protect our most critical infrastructure and carry out cyber operations against our adversaries goes far beyond most private-sector offerings and is highly transferable to a career in the private sector."  

Ex-military personnel bring excellent security practices to other areas as well.

"While I did not directly work in a security billet, my team worked to design software and had security requirements we had to align with," says Heath Anderson, VP of information security and technology at LogicGate and former system test architect for the US Air Force. "This experience was some of the best education around security principles I could have asked for, since we had to focus on the intent of the requirement in order to make it actionable in our code for the software we were designing and testing."

For his part, Andrew Maloney, chief operations officer and co-founder of Query.AI, worked on a help desk and in systems administration until 2003, when he was deployed to Oman, in the Middle East, to manage the base's perimeter security firewalls and proxy servers. 

"This was my break into cyber," says Maloney, formerly systems administrator/security engineer for the US Air Force.

**Bringing Softer Skills to Bear**

Skills including leadership, planning, and organization and traits like duty, responsibility, and loyalty make military vets excellent team members and leaders in civilian roles, McMillan adds.

"The military not only expects these things from its members, they spend time teaching these skills to their members," he said. "All too often these are not things that are either taught or stressed in the private sector, which is a shame because there is nothing particularly proprietary about any of them."  

Successful in cybersecurity and in the military means sharpening soft skills as much as hard skills.

"The one common denominator that I have seen be the most successful is the insatiable desire to learn," says Brad LaPorte, a security consultant who served as systems administration branch chief in the US Army Pacific Command. "Cybersecurity is technically difficult and not for the faint at heart. It requires long hours and constant diligence to keep up with the multidaily changes that occur in this field. Those \[who\] constantly read, write, learn, and mentor others are exponentially more successful. Anyone can learn this stuff, but it requires them to put the work in."

It isn't just the hard-nosed tactics that win battles. Almost always, adding soft skills to the mix hones the best defenses.

"The skill that I found most beneficial is the ability to think in terms of the 'big picture' but act at a lower level." says Phil Hagen, faculty fellow at SANS Institute and formerly a computer network defense analyst and IT manager with the US Air Force. "Knowing the overall strategic or tactical arc of your actions is a big part of infosec. Infosec is a huge effort, and if you try to solve it all, it's going quickly to turn into a fool's errand. Seeing the long-term goals but identifying the dozens of smaller, interim milestones has been very helpful."

Responding to conflict and always being ready to assume command also top the soft skills most in demand from ex-military personnel.

William Mendez, managing director of operations at CyZen, says all military personnel are trained as leaders, since the nature of conflict creates uncertainty around when you may land in a situation where you have to assume command.

"Personnel with military backgrounds have the skills to lead successful teams," he says. "They often gain the respect of other members through leadership traits such as empathy and motivation. They often lead by example, always mentoring and never asking anyone to do something they would not be willing to do themselves." 

Every day, those who previously served their country can still stand guard. Their paths to cybersecurity careers are as varied as those of their civilian counterparts. Their dedication and sense of duty, however, remains intense.

"Employers have a cybersecurity skills gap to overcome, and they should see the military as a hugely untapped resource," says Susan Peediyakkal, infosec operations manager at NASA Ames Research Center. "Companies should consider building their own mentoring programs or partnering with organizations that have programs in place to ensure that veterans get the essential training and networking resources they need to build a successful career in cybersecurity."

Veterans Explain How Military Service Prepared Them for Cybersecurity Careers

Citrix ADM vulnerabilities could lead to admin password reset and disruption of ADM license service, company warns.

Citrix is advising users of its Application Delivery Management (ADM) solutions to update their systems against a pair of newly discovered vulnerabilities. 

Tracked under CVE-2022-27511, the first vulnerability could allow system corruption leading to the admin password being reset after reboot. The second, CVE-2022-27512, if exploited, could allow a threat actor to temporarily disrupt the ADM license service. 

Although a fix has been issued, customers using outdated, unsupported versions are advised by Citrix to upgrade. 

Also, "Citrix strongly recommends that network traffic to the Citrix ADM’s IP address is segmented, either physically or logically, from standard network traffic," the vulnerability notice from Citrix recommended. "Doing so diminishes the risk of exploitation of these issues."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Critical Citrix Bugs Impact All ADM Servers, Agents

As the public cloud matures, enterprises are converging on two platforms that meet their workload protection needs via a strategy based on zero-trust security.

In the early days of a new B2B information technology market, it is common for the vendor community to step up with dozens of point products, each with its own differentiators within its niche. Nowhere is this phenomenon more evident now than in public cloud security, where there is a nearly incomprehensible acronym soup of solutions, each of which solves its own slice of the broader cloud protection problem. Examples include CSPM, CIEM, DLP, IAM, multicloud networking, microsegmentation, IaC scanning, container runtime security, and vulnerability assessment, to name a few.

Even if you had the budget to buy all of these tools separately, the operational complexity associated with training the staff, integrating the products, and meeting the deadline with a dozen different vendors would be a nightmare. Fortunately, as public clouds mature, enterprises converge on two key platforms that meet their workload protection needs via a strategy based on zero-trust security: Cloud Native Application Protection Platforms (CNAPP) and Secure Access Service Edge (SASE).

Zero-trust security is a framework built around the concept of least-privileged access, in which no user or application should be inherently trusted. This framework is the opposite of a traditional secure perimeter approach in which employees and data reside in an office building.

With zero trust, every user and application is deemed hostile. But if you keep everything out, it is difficult for users and applications to communicate, so access is granted only to the specific resource that is necessary once identity and risk context have been established and verified. While zero trust has gained wide adoption for user access to applications over the last several years, many enterprises are extending it to application-to-application communication use cases.

Enter CNAPP and SASE …

**CNAPP and Zero Trust**

The job of a CNAPP is to identify, prioritize, and help mitigate cloud workload risks. These platforms provide visibility into both public cloud infrastructure and the workloads running on that infrastructure. A CNAPP also helps identify and remediate risks before deployment to the cloud by combining DevOps tools and integrated development environments (IDEs).

CNAPPs provide insights into a broad range of cloud risks, taking the place of several previously separate categories of products. Hazards include those related to misconfigurations, excessive privileges and permissions, sensitive data-at-rest, unpatched software vulnerabilities, and more. In addition, these platforms correlate across functions to help prioritize actual exploitable issues and provide an accurate picture of how an enterprise might be compromised.

Not only does a CNAPP identify and prioritize cloud risks, it assists with remediation of those risks as well, either through automated remediation or through guided manual remediation. The CNAPP process of identifying, prioritizing, and mitigating cloud risks is continuous. In dynamic cloud environments, risk posture is constantly changing.

In a zero-trust architecture, CNAPP provides the critical element of risk context that can be used to make more informed decisions about the level of access a workload should have within and across the enterprise cloud footprint. As with users, a risky cloud workload should have limited access until those risk factors are adequately mitigated.

**SASE and Zero Trust**

With risk context established, the next step is to allow access only to what is necessary. This is where SASE comes into play. SASE uses workload identity and risk context to verify access rights, applying business policies based on that context and the transaction being attempted. As context changes, access privileges are continually reassessed. SASE has traditionally been associated with the protection of user communications and has only recently begun to gain traction as a platform for the protection of workload communications.

SASE platforms connect cloud workloads directly to other workloads — without connecting them to networks — and implementation of zero trust communications for workloads. By providing this app-to-app connectivity and segmentation, SASE reduces the ability of malicious software or bad actors to move laterally across the network. SASE enables cloud workload communications for several use cases, including:

*   Cloud-to-cloud

*   Cloud-to-data center

*   Cloud-to-internet

*   Intracloud

Traditional perimeter technologies, such as firewalls, use a "passthrough" security approach, making a lousy protection tradeoff in favor of performance. If malicious traffic is found, it is often too late to stop it. A SASE-based solution thoroughly inspects every transaction, terminating every connection to hold and check encrypted traffic before forwarding it to its destination. The inspection often includes data loss and threat prevention, and access control.

**Two Parts of One Whole**

Together, CNAPP and SASE provide a comprehensive approach to cloud workload security by securing the workloads and access to the workloads while ensuring optimal application performance and user experience. Over the next few years, there will be an increasing concentration of functionality provided by point products today into one of these two platforms. The result will be widespread adoption of zero-trust security for public cloud workloads and simplification from significant tool consolidation.

**About the Author**  

    

Rich Campagna is Senior Vice President and General Manager, CNAPP, at Zscaler, where he leads strategy for securing public cloud infrastructure and workloads. In his 20+ years in technology, Rich has held product management and marketing leadership positions at Balbix, Bitglass, F5 Networks, and Juniper Networks. Rich received an MBA from the UCLA Anderson School of Management and a B.S. in Electrical Engineering from Pennsylvania State University.

Two Platforms to Rule Them All: CNAPP and SASE

Interpol says it busted fraudsters who were operating call centers for romance scams, get-rich-quick schemes, and more.

Interpol has announced that a coordinated, global law-enforcement effort has led to the arrest of 2,000 individuals and the seizure of more than $50 million in illicit funds stolen through a variety of social-engineering scams. 

The operation, code-named First Light 2022, included police raids on call centers, where cybercriminals are alleged to have been operating a variety of social engineering telephone frauds, ranging from romance scams to connected financial crimes, according to Interpol. 

The international law-enforcement agency said the effort included coordinated policework across 76 countries. In all, 1,770 individual locations were raided, leading to the arrests of thousands of accused fraudsters, operators, and money launderers, along with the identification of other suspects. 

The investigation also revealed an uptick in social media driving human trafficking, money laundering through victims' personal bank accounts, scammers posing as bank employees to trick targets into giving up credentials, and more. 

“Telecom and \[business email compromise\] BEC fraud are sources of serious concern for many countries, and have a hugely damaging effect on economies, businesses and communities.” said Rory Corcoran, director of Interpol's Financial Crime and Anti-Corruption Centre (IFCACC), in a statement about First Light 2022. “The international nature of these crimes can only be addressed successfully by law enforcement working together beyond borders."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading