Home About Black Hat Contact Essays Fireside Chats My Take News Alerts Q&A Reels RSAC Videocasts ☰
 

Guest Blog Post

 

GUEST ESSAY: Massive NPD breach tells us its high time to replace SSNs as an authenticator

By Ambuj Kumar

Ever since the massive National Public Data (NPD) breach was disclosed a few weeks ago, news sources have reported an increased interest in online credit bureaus, and there has been an apparent upswing in onboarding of new subscribers.

Related: Class-action lawsuits pile up in wake of NPD hack

So what’s the connection? NPD reported the exposure of over 2.7 billion records. The breach was initially caused by a third-party malicious actor who infiltrated NPD’s systems in December 2023.

The data began leaking in April 2024, and by summer, it was being sold on the dark web for $3.5 million. The stolen information included full names, Social Security numbers, mailing addresses, phone numbers, and email addresses of millions of U.S., Canadian, and British citizens.

While NPD claimed that around 1.3 million individuals were directly affected, analysts like Troy Hunt found evidence of much wider exposure, including 134 million unique email addresses and even criminal record data. Investigations are ongoing, and several class-action lawsuits have been filed, alleging that the company failed to implement sufficient security measures.

There is little doubt that high-profile breaches like this will persist. This drives public awareness of the risks associated with identity theft. As a result, many people rush to protect themselves by subscribing to services that offer credit monitoring, identity theft protection, and fraud alerts.

GUEST ESSAY: How cybercriminals are using ‘infostealers’ to sidestep passwordless authentication

By Trevor Hilligoss

Passwords have been the cornerstone of basic cybersecurity hygiene for decades.

Related: Passwordless workpace long way off

However, as users engage with more applications across multiple devices, the digital security landscape is shifting from passwords and password managers towards including passwordless authentication, such as multi-factor authentication (MFA), biometrics, and, as of late, passkeys.

But as secure and user-friendly as these authentication methods are, cybercriminals are already busily sidestepping all forms of authentication – passwords, MFA, and passkeys – to sometimes devastating effect.

Passwordless work arounds

Without a doubt, passwordless authentication is a significant improvement over traditional passwords and effectively addresses the persistent risk of easy to guess passwords and password reuse. Most passkeys available to consumers leverage unique biometric authentication data and cryptographically secure means to authenticate users when they access websites and applications.

This new authentication technique is gaining traction, especially since the FIDO Alliance has advocated for its implementation over the last year. Moreover, leading tech companies like Google, Microsoft, and Apple have developed robust frameworks to integrate this system of authentication.

GUEST ESSAY: NIST’s Cybersecurity Framework update extends best practices to supply chain, AI

By Jeremy Swenson

The National Institute of Standards and Technology (NIST) has updated their widely used Cybersecurity Framework (CSF) — a free respected landmark guidance document for reducing cybersecurity risk.

Related: More background on CSF

However, it’s important to note that most of the framework core has remained the same. Here are the core components the security community knows:

Govern (GV): Sets forth the strategic path and guidelines for managing cybersecurity risks, ensuring harmony with business goals and adherence to legal requirements and standards. This is the newest addition which was inferred before but is specifically illustrated to touch every aspect of the framework. It seeks to establish and monitor your company’s cybersecurity risk management strategy, expectations, and policy.

•Identify (ID): Entails cultivating a comprehensive organizational comprehension of managing cybersecurity risks to systems, assets, data, and capabilities.

GUEST ESSAY: Essential cyber hygiene practices all charities must embrace to protect their donors

By Zac Amos

Charities and nonprofits are particularly vulnerable to cybersecurity threats, primarily because they maintain personal and financial data, which are highly valuable to criminals.

Related: Hackers target UK charities

Here are six tips for establishing robust nonprofit cybersecurity measures to protect sensitive donor information and build a resilient organization.

•Assess risks. Creating a solid cybersecurity foundation begins with understanding the organization’s risks. Many nonprofits are exposed to potential daily threats and don’t even know it. A recent study found only 27% of charities undertook risk assessments in 2023 and only 11% said they reviewed risks posed by suppliers. These worrying statistics underscore the need to be more proactive in preventing security breaches.

•Keep software updated. Outdated software and operating systems are known risk factors in cybersecurity. Keeping these systems up to date and installing the latest security patches can help minimize the frequency and severity of data breaches among organizations. Investing in top-notch firewalls is also essential, as they serve as the first line of defense against external threats.

GUEST ESSAY: Everything you should know about the cybersecurity vulnerabilities of AI chatbots

By Zac Amos

AI chatbots are computer programs that talk like humans, gaining popularity for quick responses. They boost customer service, efficiency and user experience by offering constant help, handling routine tasks, and providing prompt and personalized interactions.

Related: The security case for AR, VR

AI chatbots use natural language processing, which enables them to understand and respond to human language and machine learning algorithms. This helps them improve their performance over time by gaining data from interactions.

In 2022, 88% of users relied on chatbots when interacting with businesses. These tools saved 2.5 billion work hours in 2023 and helped raise customer satisfaction to 69% for $0.50 to $0.70 per interaction. Forty-eight percent of consumers favor their efficiency prioritization.

GUEST ESSAY: Why internal IT teams are ill-equipped to adequately address cyber risks

By Michael Cocanower

Every industry is dealing with a myriad of cyber threats in 2024. It seems every day we hear of another breach, another scam, another attack on anything from a small business to a critical aspect of our nation’s infrastructure.

Related: The case for augmented reality training

Because of this, cybersecurity investments and regulatory oversight are increasing at an astounding rate, especially for those in the financial services industry, bringing an overwhelming feeling to chief compliance officers without dedicated security teams.

And the solution they are turning to is not one that will solve their problems in the long run: handing cybersecurity responsibilities to internal IT teams.

It’s a tale as old as the first computer. When a technical issue arises, hand it over to IT. However, from the sheer amount of regulations coming down the pipeline to the tools necessary to counter threat actors, internal IT is not the right resource for this monumental task.

Regulatory overload

Firms in the financial services industry are staring down the bottom of the regulatory barrel coming into 2024. From identity theft to greater oversight on risk management, internal IT teams

GUEST ESSAY: Best practices to shrink the ever-present risk of Exchange Server getting corrupted

By Bharat Bhushan

Even in the cloud era, Microsoft Exchange Server remains a staple business communications tool across the globe.

Related: The need for robust data recovery policies.

One critical issue faced by organizations that rely on Exchange Server is the risk of a corrupt Exchange Server database cropping up.

Fortunately, effective tools and wise best practices can help mitigate this this exposure enabling companies to indefinitely leverage Exchange Server as a productive, resilient and secure communications tool.

Navigating new risks

Today, heavy reliance on cloud-centric IT infrastructure and cloud-hosted applications has become the norm. Yet a significant number of enterprises and small and mid-sized businesses (SMBs) continue to rely on Exchange Server.

Microsoft introduced this e-mail and calendaring server in 1996 and over time it has over time become ubiquitous in enterprises and small and mid-sized businesses (SMBs) alike.