Cyber trends for 2023

Nothing is more difficult than making predictions, especially in fast advancing cyber security field. Instead of me trowing out wild ideas what might be coming, I have collected here some trends many people and publications have predicted for 2023.

HTTPS: These days HTTPS has effectively become the default transport for web browsing. Most notably, the Chrome browser now marks any older HTTP website as “Not Secure” in the address bar. Chrome to attempt to “upgrade” to the HTTPS version of websites, if you ever accidentally navigate to the insecure version. If a secure version isn’t available, an on-screen warning is shown, asking if you would like to continue. As HTTPS has become more common across the web, Google Chrome is preparing to launch a security option that will block “insecure” downloads through HTTP on Chrome browser.

Malwertising: Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users also in 2023. The FBI is warning US consumers that cybercriminals are placing ads in search engine results that impersonate well-known brands, in an attempt to spread ransomware and steal financial information. Cybercriminals are purchasing ads that show up at the very top of search engine results, often purporting to link to a legitimate company’s website. However, anyone clicking on the link is instead taken to a lookalike page that may appear identical, but is in fact designed to phish for login credentials and financial details, or even trick the unwary into downloading ransomware. The FBI has advised consumers to use ad blockers to protect themselves from such threats.

Encrypted malware: The vast majority of malware arriving over encrypted connections that are typically HTTPS web sessions. The vast majority of cyber-attacks over the past year have used TLS/SSL encryption to hide from security teams traditional firewalls and many other security tools. Over 85% of Attacks Hide in Encrypted Channels. WatchGuard Threat Lab Report Finds Top Threat Arriving Exclusively Over Encrypted Connections. If you are not inspecting encrypted traffic when it enters your network, you will not be able to detect most malware at network level. Hopefully, you at least have endpoint protection implemented for a chance to catch it further down the cyber kill chain.

Software vulnerabilities: Weak configurations for encryption and missing security headers will be still very common in 2023. In 2022 nearly every application has at least one vulnerability or misconfiguration that affects security and a quarter of application tests found a highly or critically severe vulnerability. Read more at Misconfigurations, Vulnerabilities Found in 95% of Applications

Old vulnerabilities: You will see attackers try to use old vulnerabilities again in 2023 because they work. Attackers will take the path of least resistance, and as long as vendors don’t consistently perform thorough root-cause analysis when fixing security vulnerabilities, it will continue to be worth investing time in trying to revive known vulnerabilities before looking for novel ones. There are many companies that do not patch their systems at reasonable time or at all, so they stay vulnerable. Also new variations of old vulnerabilities are also developed: approximately 50% of the observed 0-days in the first half of 2022 were variants of previously patched vulnerabilities.

Security gaps: There are still big gaps in companies’ cyber security. The rapid advancement of technology in all industries has led to the threat of ever-increasing cyberattacks that target businesses, governments, and individuals alike. Lack of knowledge, maintenance of employees’ skills and indifference are the strongest obstacles in the development of many companies’ cyber security. While security screening and limiting who has access to your data are both important aspects of personnel security, they will only get you so far.

Cloud: In a hyperscale cloud provider, there can be potentially several thousand people, working around the globe that could potentially access our data. Security screening and limiting alone still leaves a significant risk of malicious or accidental access to data. Instead, you should expect your cloud provider to take a more layered approach.

MFA: MFA Fatigue attacks are putting your organization at risk in 2023. Multi-factor auth fatigue is real. A common threat targeting businesses is MFA fatigue attacks a technique where a cybercriminal attempts to gain access to a corporate network by bombarding a user with MFA prompts until they finally accept one. This attempt can be successful, especially when the target victim is distracted or overwhelmed by the notifications or misinterprets them with legitimate authentication requests. t’s a huge threat because it bypasses one of the most effective the security measures.

Passwords: Passwords will not go away completely even though new solutions to replace then will be pushed to users. When you create passwords or passphrases, make them good and long enough to be secure. Including a comma character to the password can make it harder for cyber criminals to use if for some reason it leaks out. The reason us that comma in password can obfuscate tabular comma separated values (csv) files, which are a common way to collect and distribute stolen passwords.

EU: The Network and Information Security (NIS) Directive was the first piece of EU-wide legislation on cybersecurity: Network and Information Security 2 also known as NIS2. Rules requiring EU countries to meet stricter supervisory and enforcement measures and harmonise their sanctions were approved by MEPs on late 2022. They will start to affect security decisions in 2023. The new rules will set tighter cybersecurity obligations for risk management, reporting obligations and information sharing. The requirements cover incident response, supply chain security, encryption and vulnerability disclosure, among other provisions. The new rules will also protect so-called “important sectors” such as postal services, waste management, chemicals, food, manufacturing of medical devices, electronics, machinery, motor vehicles and digital providers. All medium-sized and large companies in selected sectors would fall under the legislation. The NIS Directive has impacted the cybersecurity budget of operators over the past year with deep-dives into the Energy and Health sectors. Cybersecurity Investments in the EU: Is the Money Enough to Meet the New Cybersecurity Standards?

USA: CISA has released cross-sector cybersecurity performance goals (CPGs) in response to President Biden’s 2021 National Security Memorandum on improving cybersecurity for critical infrastructure control systems. Since then, the CPGs have been observed by the cybersecurity community as “the floor” and “a baseline” to cybersecurity hygiene and practices. Many organizations overlook OT as part of their cybersecurity strategy, remaining their focus solely to IT systems. Especially in the critical infrastructure sectors, overlooking OT can have serious risks to all operations. As a result, the CPGs released explicitly are scoped to include OT devices.

Android: Android security will advance in 2023 in many ways. Android is adding support for updatable root certificates in the next Android 14 release. Google Play now lets children send purchase requests to guardians.

Loosing the trust: The world’s biggest tech companies have lost confidence in one of the Internet’s behind-the-scenes gatekeepers. Microsoft, Mozilla, and Google are dropping TrustCor Systems as a root certificate authority in their products.

Need for better communication: At a time when less than a fifth (18%) of risk and compliance professionals profess to be very confident in their ability to clearly communicate risk to the board, it’s clear that lines of communication—not to mention understanding—must be improved.

Supply chain risks: Watch for geopolitical instability to continue to be a governance issue, particularly with the need to oversee third-party and supply chain risk.

Governance: For boards and management, heightened pressure around climate action dovetails with the SEC’s proposed rules about cybersecurity oversight, which may soon become law. When they do, companies will need to prepare for more disclosures about their cybersecurity policies and procedures. With fresh scrutiny on directors’ cybersecurity expertise, or lack thereof, boards will need to take their cyber savviness to the next level as well.

Privacy and data protection:Privacy and data protection are the big story for compliance officers in 2023, with expanding regulations soon expected to cover five billion citizens.

Auditing: Audit’s role in corporate governance and risk management has been evolving. Once strictly focused on finance and compliance, internal audit teams are now increasingly expected to help boards and executive management identify, prioritize, manage and mitigate interconnected risks across the organization.

Business risks: In 2023, business risks will run the gamut: geopolitical volatility, talent management, DEI (Diversity, Equity, and Inclusion), ESG (Environmental, Social, and Governance), IT security amid continued remote and hybrid work, and business continuity amid the threat of large-scale operational and utility interruptions. There is also a challenge that Executives take more cybersecurity risks than office workersleaders engage in more dangerous behavior and are four times more likely to be victims of phishing compared to office workers.

Integrated Risk Management: Look for risk to be increasingly viewed as a driver of business performance and value as digital landscapes and business models evolve. Forward-looking companies will embed integrated risk management (IRM) into their business strategy, so they can better understand the risks associated with new strategic initiatives and be able to pivot as necessary. Keep in mind that Executives take more cybersecurity risks than office workers

Zero trust: Many people think that Zero Trust is pretty optimal security practice in 2023. It is good for those new systems to whom it’s model suits, but Zero Trust has also challenges. Incorporating zero trust into an existing network can be very expensive. Zero Trust Shouldnt Be The New Normal article says that the zero trust model starts to erode when the resources of two corporations need to play together nicely. Federated activity, ranging from authentication to resource pooled cloud federation, doesnt coexist well with zero trust. To usefully emulate the kind of informed trust model that humans use every day, we need to flip the entire concept of zero trust on its head. In order to do that, network interactions need to be evaluated in terms of risk. Thats where identity-first networking comes in. In order for a network request to be accepted, it needs both an identity and explicit authorization; System for Cross-domain Identity Management (SCIM) based synchronization is used to achieve this. This securely automates the exchange of a user identity between cloud applications, diverse networks, and service providers.

Poor software: There will be a lot of poor software in use in 2023 and it will cost lots of money. Poor software costs the US 2.4 trillion: cyberattacks due to existing vulnerabilities, complex issues involving the software supply chain, and the growing impact of rapidly accumulating technical debt have led to a build-up of historic software deficiencies.

Microsoft: Microsoft will permanently turn off Exchange Online basic authentication starting early January 2023 to improve security. A future Microsoft Edge update would permanently disable the Internet Explorer 11 desktop web browser on some Windows 10 systems in February. This means that “The out-of-support Internet Explorer 11 (IE11) desktop application is scheduled to be permanently disabled on certain versions of Windows 10 devices on February 14, 2023, through a Microsoft Edge update, not a Windows update as previously communicated”

Google Workplace: Google Workspace Gets Client-Side Encryption in Gmail. Long waited Client-side encryption for Gmail available in beta .
Google is letting businesses try out client-side encryption for Gmail, but it’s probably not coming to personal accounts anytime soon. Google has already enabled optional client-side encryption for many Workspace services.

Passkeys: Google has made passkey support available in the stable version of Chrome. Passkeys use biometric verification to authenticate users and are meant to replace the use of passwords, which can be easily compromised. Passkeys are usable cross-platform with both applications and websites. Passkeys offer the same experience that password autofill does, but provide the advantage of passwordless authentication. They cannot be reused, don’t leak in server breaches, and protect users from phishing attacks. Passkeys are only available for websites that provide support for them, via the WebAuthn API,

War risks: Watch for continued war between Russia and Ukraine real world and cyber world in 2023. Cyber as important as missile defences – an ex-NATO general. The risk of escalation from cyber attacks has never been greater. A cyber attack on the German ports of Bremerhaven or Hamburg would severely impede NATO efforts to send military reinforcements to allies, retired U.S. General Ben Hodges told Reuters.

Cloud takeover: AWS Elastic IP Transfer Feature Gives Cyberattackers Free Range
Threat actors can take over victims’ cloud accounts to steal data, or use them for command-and-control for phishing attacks, denial of service, or other cyberattacks.

ISC: ICS and SCADA systems remain trending attack targets also in 2023.

Code security: Microsoft-owned code hosting platform GitHub has just announced multiple security improvements, including free secret scanning for public repositories and mandatory two-factor authentication (2FA) for developers and contributors. The secret scanning program is meant to help developers and organizations identify exposed secrets and credentials in their code. In 2022, code scanning helped identify 1.7 million potential secrets exposed in public repositories. Now the feature is available for free for all free public repositories, to help prevent secret exposures and secure the open source ecosystem. With secret scanning alerts, you can track and action on leaked secrets directly within GitHub.

Data destruction: We must develop a cloud-compatible way of doing destruction that meets security standards. Maybe cloud providers can come up with a service to provide this capability, since only they have direct access to the underlying hardware. They have never been shy about inventing new services to charge for, and certainly plenty of companies would be eager to pay for such a service, if the appropriate certificates of destruction were provided.

PCI DSS: PCI DSS 4.0 Should Be on Your Radar in 2023 if you work on field that needs to meet that. The latest version of the standard will bring a new focus to an overlooked yet critically important area of security. For a long time, client-side threats, which involve security incidents and breaches that occur on the customer’s computer rather than on the company’s servers or in between the two, were disregarded. But that’s changing with the release of PCI DSS 4.0. Now, many new requirements focus on client-side security.

SHA-1: NIST Retires SHA-1 Cryptographic Algorithm, not fully in 2023, but starts preparations for phase-out. The venerable cryptographic hash function has vulnerabilities that make its further use inadvisable. According to NIST, SHA-1 ‘has reached the end of its useful life’, given that the high computing capabilities of today’s systems can easily attack the algorithm using the technique is referred to as a ‘collision’ attack. SHA-1, whose initials stand for secure hash algorithm, has been in use since 1995 as part of the Federal Information Processing Standard and NIST has announced that SHA-1 should be phased out by Dec. 31, 2030, in favor of the more secure SHA-2 and SHA-3 groups of algorithms. The US National Institute of Standards and Technology (NIST) recommended that IT professionals start replace the 27 years old SHA-1 cryptographic algorithm with newer, more secure ones. Because SHA-1 is used as the foundation of numerous security applications, the phaseout period will take many years. Tech giants such as Google, Facebook, Microsoft and Mozilla have already taken steps to move away from the SHA-1 cryptographic algorithm. Certificate authorities stopped issuing certificates using SHA-1 as of January 1, 2017.

Cloud: Is Cloud Native Security Good Enough? Cloud native technologies enable organizations to tap into the agility required to keep up in the current competitive landscape and to create new business models. But achieving efficient, flexible, distributed and resilient cloud native security is tough. All major public cloud providers -Amazon Web Services (AWS), Microsoft Azure and Google Cloud- of course offer security features and services, which are designed to address significant threats to cloud-based data. However, in spite of this, public cloud providers’ security tools commonly fail to meet operational needs, and their limitations should prompt organizations to consider or reconsider how they are protecting public cloud environments.

Privacy: The Privacy War Is Coming. Privacy standards are only going to increase. It’s time for organizations to get ahead of the coming reckoning.

Ethical hacking: Ethical hacking has become a highly-sought after career route for emerging tech aspirants. The role of ethical hackers enables countless businesses and individuals to improve their security posture and minimize the potential attack risk for organizations. But there are several analysts who believe that becoming a self-taught ethical hacker in 2023 might not be worth it because they are at constant risk of failing to perform properly and many companies might not want to hire an ethical hacker.

MFA: Two factor authentication might not be enough in 2023 for applications that need good security. In the past few months, we’ve seen an unprecedented number of identity theft attacks targeting accounts protected by two-factor authentication (2FA), challenging the perception that existing 2FA solutions provide adequate protection against identity theft attacks. So for some demanding users 2FA is over. Long live 3FA!

Cloud APIs: With Cloud Comes APIs & Security Headaches also in 2023. Web application programming interfaces (APIs) are the glue that holds together cloud applications and infrastructure, but these endpoints are increasingly under attack, with half of companies acknowledging an API-related security incident in the past 12 months. ccording to a survey conducted by Google Cloud, the most troublesome security problems affecting companies’ use of APIs are security misconfigurations, outdated APIs and components, and spam or abuse bots . About 40% of companies are suffering an incident due to misconfiguration and a third coping with the latter two issues. Two-thirds of companies (67%) found API-related security issues and vulnerabilities during the testing phase, but more than three-quarters (77%) have confidence that they will catch issues, saying they have the required API tools and solutions-

Lack of cyber security workers: Businesses need to secure their assets and ensure the continuous readiness of employees to respond to a cyberattack if they want to move forward safely and avoid losses caused by cybercriminals or malicious attackers. There is an acute shortage of cyber security professionals. As Threat Levels remain high, companies and organizations remain on alert – but face ongoing challenges in finding and retaining the right people with the required skill levels. There is a significant skills gap and a clear need for hiring cyber security experts in organizations across the world.

VPN: Is Enterprise VPN on Life Support or Ripe for Reinvention? While enterprise VPNs fill a vital role for business, they have several limitations. To get work-from-anywhere initiatives off the ground quickly and keep their business afloat, many organizations turned to enterprise virtual private networks (VPNs). This allowed them to connect their remote employees to critical business operations at the corporate site. However, as fast as VPNs were deployed, organizations learned their limitations and security risks. So are traditional VPNs really “dead” as some industry analysts and pundits claim? Or do they simply need a refresh? Time will tell, and this will be discussed in 2023.

AI: Corporations have discovered the power of artificial intelligence (A.I.) to transform what’s possible in their operations
But with great promise comes great responsibility—and a growing imperative for monitoring and governance. “As algorithmic decision-making becomes part of many core business functions, it creates the kind of enterprise risks to which boards need to pay attention.

AI dangers: Large AI language models have potential dangers. AI is better at fooling humans than ever—and the consequences will be serious. Wired magazine article expects that In 2023, we may well see our first death by chatbot. Causality will be hard to prove was it really the words of the chatbot that put the murderer over the edge? Or perhaps a chatbot has broken someone’s heart so badly they felt compelled to take their own life?

Metaverse: Police Must Prepare For New Crimes In The Metaverse, Says Europol. It encourages law enforcement agencies to start considering the ways in which existing types of crime could spread to virtual worlds, while entirely new crimes could start to appear. ReadPolicing in the metaverse: what law enforcement needs to know report for more information.

Blockchain: Digital products like cryptocurrency and blockchain will affect a company’s risk profile. Boards and management will need to understand these assets’ potential impact and align governance with their overall risk and business strategies. Year 2022 already showed how a lot of cryptocurrency related risks realized. More “Crypto travel rules” enacted to combat money laundering and terrorism financing.

Insurance: Getting a cyber insurance can become harder and more expensive in 2023. Insurance executives have been increasingly vocal in recent years about systemic risks and now increasing cyber was the risk to watch. Spiralling cyber losses in recent years have prompted emergency measures by the sector’s underwriters to limit their exposure. There is growing concern among industry executives about large-scale strikes. As well as pushing up prices, some insurers have responded by tweaking policies so clients retain more losses. There are already insurance policies written in the market have an exemption for state-backed attacks, but but the difficulty of identifying those behind attacks and their affiliations makes such exemptions legally fraught. The chief executive of one of Europe’s biggest insurance companies has warned that cyber attacks, rather than natural catastrophes, will become “uninsurable” as the disruption from hacks continues to grow. Recent attacks that have disrupted hospitals, shut down pipelines and targeted government department. “What if someone takes control of vital parts of our infrastructure, the consequences of that?” In September, the US government called for views on whether a federal insurance response to cyber was warranted.


Asiantuntija neuvoo käyttämään pilkkua sala­sanassa – taustalla vinha logiikka

Overseeing artificial intelligence: Moving your board from reticence to confidence

Android is adding support for updatable root certificates amidst TrustCor scare

Google Play now lets children send purchase requests to guardians

Diligent’s outlook for 2023: Risk is the trend to watch

Microsoft will turn off Exchange Online basic auth in January

Google is letting businesses try out client-side encryption for Gmail

Google Workspace Gets Client-Side Encryption in Gmail

The risk of escalation from cyberattacks has never been greater

Client-side encryption for Gmail available in beta

AWS Elastic IP Transfer Feature Gives Cyberattackers Free Range

Microsoft: Edge update will disable Internet Explorer in February

Is Cloud Native Security Good Enough?

The Privacy War Is Coming

Top Reasons Not to Become a Self-Taught Ethical Hacker in 2023

Google Chrome preparing an option to block insecure HTTP downloads

Cyber attacks set to become ‘uninsurable’, says Zurich chief

The Dark Risk of Large Language Models

Police Must Prepare For New Crimes In The Metaverse, Says Europol

Policing in the metaverse: what law enforcement needs to know

Cyber as important as missile defences – an ex-NATO general

Misconfigurations, Vulnerabilities Found in 95% of Applications

Mind the Gap

Yritysten kyberturvassa edelleen isoja aukkoja Asiantuntija: Kysymys jopa kansallisesta turvallisuudesta

Personnel security in the cloud

Multi-factor auth fatigue is real – and it’s why you may be in the headlines next

MFA Fatigue attacks are putting your organization at risk

Cybersecurity: Parliament adopts new law to strengthen EU-wide resilience | News | European Parliament

NIS2 hyväksyttiin – EU-maille tiukemmat kyberturvavaatimukset

Cybersecurity Investments in the EU: Is the Money Enough to Meet the New Cybersecurity Standards?

Poor software costs the US 2.4 trillion

Passkeys Now Fully Supported in Google Chrome

Google Takes Gmail Security to the Next Level with Client-Side Encryption

Executives take more cybersecurity risks than office workers

NIST Retires SHA-1 Cryptographic Algorithm

NIST to Retire 27-Year-Old SHA-1 Cryptographic Algorithm

WatchGuard Threat Lab Report Finds Top Threat Arriving Exclusively Over Encrypted Connections

Over 85% of Attacks Hide in Encrypted Channels

GitHub Announces Free Secret Scanning, Mandatory 2FA

Leaked a secret? Check your GitHub alerts…for free

Data Destruction Policies in the Age of Cloud Computing

Why PCI DSS 4.0 Should Be on Your Radar in 2023

2FA is over. Long live 3FA!

Google: With Cloud Comes APIs & Security Headaches

Digesting CISA’s Cross-Sector Cybersecurity Performance Goals

Zero Trust Shouldnt Be The New Normal

Don’t click too quick! FBI warns of malicious search engine ads

FBI Recommends Ad Blockers as Cybercriminals Impersonate Brands in Search Engine Ads

Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users

Kyberturvan ammattilaisista on huutava pula

Is Enterprise VPN on Life Support or Ripe for Reinvention?

Cyber as important as missile defences – an ex-NATO general


  1. Tomi Engdahl says:

    Angela Fu / Poynter:
    A Las Vegas Review-Journal reporter and her colleagues faced social media attacks when users, including Elon Musk, distorted her coverage of a fatal hit-and-run — The Las Vegas Review-Journal is facing a harassment campaign stoked by Elon Musk, one year after a reporter was killed for his coverage.

  2. Tomi Engdahl says:

    Angela Fu / Poynter:
    A Las Vegas Review-Journal reporter and her colleagues faced social media attacks when users, including Elon Musk, distorted her coverage of a fatal hit-and-run — The Las Vegas Review-Journal is facing a harassment campaign stoked by Elon Musk, one year after a reporter was killed for his coverage.

    A reporter made sure a retired police chief’s death didn’t go uncovered. Then social media attacked her.

    The Las Vegas Review-Journal is facing a harassment campaign stoked by Elon Musk, one year after a reporter was killed for his coverage.

    When retired police chief Andreas Probst was killed in a hit-and-run last month, Las Vegas Review-Journal crime reporter Sabrina Schnur was the first journalist to arrive on the scene.

    Schnur was also the first local reporter to talk to Probst’s family, penning an obituary to ensure that his widow’s and daughter’s voices would be heard.

    And she was the reporter who instructed a source with video footage of the killing to go to the police, just nine hours before police announced a murder charge in the case.

    But despite her work documenting Probst’s death, Schnur became the target of anti-Semitic attacks and death wishes over the weekend as social media users questioned why the “media” wasn’t properly covering the attack. Screenshots of the month-old obituary’s headline sparked outrage among readers who falsely assumed the Review-Journal was downplaying Probst’s death.

    The obituary originally ran on Aug. 18 with the headline “Retired police chief killed in bike crash remembered for laugh, love of coffee.” At that point, police did not yet know that the killing was intentional. Thirteen days later, on Aug. 31, a source approached Schnur with a video showing the driver in the crash intentionally hitting Probst and laughing about it with the passenger. She connected the source with the police, and the Review-Journal covered the subsequent murder charge.

    But when that video went viral over the weekend, social media users shared screenshots of the old obituary, taking issue with the phrase “bike crash.” They filled Schnur’s inbox and social media mentions with increasingly personal attacks and accused her of being anti-white. They shared her photo and made anti-Semitic comments. They circulated her office phone number and told her that they hoped she would get cancer, that they hoped she would die. They found her private social media accounts and dug through her Twitter, unearthing posts she’d made as a teenager, going as far back as 2015.

    “That’s what started to scare me — if they’re taking the time to go through my Twitter, what else are they taking the time to find on me?” Schnur said. “I started to piece together, OK, if I was going to just cyber stalk someone, what things would they be able to find on me? I started to feel genuinely unsafe at that point.”

    On Sunday morning, Elon Musk, the billionaire owner of X, formerly known as Twitter, amplified one of the screenshots, posting “An innocent man was murdered in cold blood while riding his bicycle. The killers joked about it on social media Yet, where is the media outrage? Now you begin to understand the lie.” That post had 68.2 million views as of Monday evening.

    A request for comment sent to X generated an automated email response.

    The Review-Journal’s social media accounts and other staff also received vicious attacks. When Schnur shared that she’d received 700 notifications on X and an onslaught of angry emails and voicemails, editors jumped in to support her and make sure she was safe.

    Executive editor Glenn Cook said that during his 30-plus years in journalism, he’d never seen vitriol of this volume or intensity. “It’s like a fire hose of hatred to the face,”

    In an attempt to slow the harassment, editors changed the Aug. 18 obituary’s headline — which Schnur did not write — so that it read “hit-and-run” instead of “bike crash.” The Review-Journal then published a story about the online harassment in an attempt to correct the record. Cook told staff scheduled to work on Sunday not to come into the office as a safety precaution.

    “We know firsthand that social media vitriol can turn into something worse,” Cook said. “That’s one of the takeaways from what we dealt with with Jeff German’s murder.”

    “I’m not going to stop writing because some people on Twitter are upset.”

  3. Tomi Engdahl says:

    OT/IoT and OpenTitan, an Open Source Silicon Root of Trust
    A silicon root of trust (S-RoT) is designed to provide security to those parts of a device that can be attacked by a third party. The question remains, however: can the S-RoT itself be attacked?

    OpenTitan is a project aimed at bringing the success of open source software to the silicon design space – specifically a silicon-level root of trust. The project achieved RTL Freeze in June 2023, and will be generating engineering sample silicon by the end of this year.

    The project is managed by LowRISC, a UK non-profit organization founded in the Cambridge University computer lab in 2014 by Dr Gavin Ferris and Prof Rob Mullins (who also co-founded the Raspberry Pi Foundation with Pi’s creator Eben Upton in 2008).

    LowRISC became steward of the OpenTitan project in March 2019, and has been working with partners including Google, Western Digital, Seagate and others.

  4. Tomi Engdahl says:

    Nick Huber / Financial Times:
    Research: the global cyber workforce reached 4.7M in 2022 while still short by 3.4M; Statista: average salary for cyber professionals was between $120K-$150K

    Wanted: another 3mn cyber professionals
    Ever greater demand for security staff is increasing wage inflation and skills gaps

    Governments and companies are still struggling to find cyber security staff after more than a decade in which demand has outstripped supply, and sent wages spiralling higher.

    In 2022, the global shortage of cyber security professionals stood at 3.4mn, compared with a total cyber workforce of 4.7mn, according to research by ISC2, an association for cyber security professionals. The gap was particularly wide in the aerospace, government, education, insurance and transportation sectors, it found. To fill all the current vacancies, the workforce must grow by about 70 per cent, says ISC2 chief executive, Clar Rosso.

    And the biggest skills shortages were in soft skills — communicating and dealing with other people — and cloud computing, according to separate global research by Isaca, another IT security association.

    This inability to acquire and retain cyber security workers is already creating vulnerabilities in the private and public sectors. More than half of the respondents to ISC2 who reported workforce shortages said that staff deficits put their organisations at “moderate” or “extreme” risk of cyber attack.

    In response to the heightened threat, fresh recruitment initiatives have been launched. ISC2 is offering an “entry level” certification in cyber security — part of a wider plan by the US government to partner with organisations and fill hundreds of thousands of vacancies. At the same time, smaller schemes — through institutions such as Toronto Metropolitan University — are retraining “mid-career” workers in cyber security and helping them find jobs in the industry.

    However, despite these efforts to boost supply, competition to hire cyber security workers is still fierce — keeping salaries high. In 2022, average global salaries for cyber security professionals ranged between about $128,000 and $150,000, according to Statista, a research and data provider.

    In this buoyant market, job candidates can dictate their employment terms. “[They] can choose where they work, and when they work, and how they work,” says Karoli Hindriks, chief executive of Jobbatical, an AI-powered platform that helps tech workers relocate.

  5. Tomi Engdahl says:

    These skills need not be cyber specific.

    Broad skills, such as business acumen and calmness under pressure, can be just as important in cyber security roles as technical skills, which candidates can be taught.

    However, despite signs that the pool of candidates for cyber security roles is widening, there is room for improvement. Tes.

    She feels this is a mistake. “The adversary [cyber security criminals] is diverse and, if we’re going to keep up, we need diversity of thought, diversity of skills, diversity of background,” Hopkins says.

  6. Tomi Engdahl says:

    After Meta criticized the UK’s potential E2EE rules, the UK says Meta “failed to provide assurances” over keeping its platforms “safe from sickening abusers”

    Braverman and Facebook clash over private message plans

    Facebook’s owner Meta has hit back at a government campaign strongly critical of its plans to encrypt messages.

    Protecting messages with end-to-end-encryption would mean that they could only be read by sender and recipient.

    Home Secretary Suella Braverman said encryption could not come at the cost of children’s safety, amid fears it can be used to conceal child abuse.

    Meta argues that encryption protects users from invasion of privacy.

    “We don’t think people want us reading their private messages”, the firm said.

    “The overwhelming majority of Brits already rely on apps that use encryption to keep them safe from hackers, fraudsters and criminals”, it added.

    Ms Braverman set out her concerns to Meta in a letter co-signed by technology experts, law enforcement, survivors and leading child safety charities in July.

  7. Tomi Engdahl says:

    NCSC-UK:] Building on our history of cryptographic research

    We’ve just published a paper for the cryptographic community in which we release two new designs for cryptographic algorithms known as block cipher modes of operation, or ‘modes’. We’re also sharing the supporting security analysis and design rationale. We’ve named the new modes GLEVIAN and VIGORNIAN*.

  8. Tomi Engdahl says:

    Quantum Resistance and the Signal Protocol

    Today we are happy to announce the first step in advancing quantum resistance for the Signal Protocol: an upgrade to the X3DH specification which we are calling PQXDH. With this upgrade, we are adding a layer of protection against the threat of a quantum computer being built in the future that is powerful enough to break current encryption standards.

  9. Tomi Engdahl says:

    CISA’s catalog of must-patch vulnerabilities crosses the 1,000 bug mark after
    2 years

    CISA officials explained in a statement this week that the list was created in
    2021 primarily because there are too many vulnerabilities for defenders to patch – there were more than 25,000 new bugs released in 2022 alone.

    “The purpose of the KEV is simple: while focusing on vulnerabilities that have been exploited isn’t sufficient, it’s absolutely necessary – so let’s start there,” they said. “Every organization should be prioritizing mitigation of KEVs as part of a vulnerability management program that enables prioritization based on organizational attributes such as how a vulnerable product is being used and the exploitability of the relevant system.”

  10. Tomi Engdahl says:

    India’s biggest tech centers named as cyber crime hotspots

    India is grappling with a three-and-a-half year surge in cyber crime, with analysis suggesting cities like Bengaluru and Gurgaon – centers of India’s tech development – are also hubs of evil activity.

    The report – A Deep Dive into Cybercrime Trends Impacting India from the non-profit Future Crime Research Foundation (FCRF) – identified cyber crime hot spots, as well as the most popular types of infosec assaults, from January
    2020 until June 2023.

    Report at

  11. Tomi Engdahl says:

    2023 Unit 42 Attack Surface Threat Report Highlights the Need for ASM

    Most organizations have an attack surface management problem, and they don’t even know it, because they lack full visibility of the various IT assets and owners. One of the biggest culprits of these unknown risks are remote access service exposures, which made up nearly one out of every five issues we found on the internet. Defenders need to be vigilant, because every configuration change, new cloud instance or newly disclosed vulnerability begins a new race against attackers.

    Today’s attackers can scan the entire IPv4 address space for vulnerable targets in minutes. Of the 30 common vulnerabilities and exposures (CVEs) analyzed, three were exploited within hours of public disclosure and 63% were exploited within 12 weeks of the public disclosure. Of the 15 remote code execution (RCE) vulnerabilities analyzed by Unit 42, 20% were targeted by ransomware gangs within hours of disclosure, and 40% of the vulnerabilities were exploited within 8 weeks of publication.

    80% of security exposures are present in cloud environments compared to on-premises at 19%. Cloud-based IT infrastructure is always in a state of flux, changing by more than 20% across every industry every month. Nearly 50% of high-risk, cloud-hosted exposures each month were a result of the constant change in cloud-hosted new services going online and/or old ones being replaced. Over 75% of publicly accessible software development infrastructure exposures were found in the cloud, making them attractive targets for attackers.

    Over 85% of organizations analyzed had Remote Desktop Protocol (RDP) internet-accessible for at least 25% of the month, leaving them open to ransomware attacks or unauthorized login attempts.

  12. Tomi Engdahl says:

    Singapore may split liability for phishing losses between banks and victims

    Singapore officials announced on Monday that next month they will deliver a consultation paper detailing a split liability scheme that will mean both consumers and banks are on the hook for financial losses flowing from scams.

  13. Tomi Engdahl says:

    FCC plays whack-a-mole with telcos accused of profiting from robocalls

    One Owl Telecom is a US-based gateway provider that routes phone calls from outside the US to consumer phone companies such as Verizon. “Robocalls on One Owl’s network apparently bombarded consumers without their consent with prerecorded messages about fictitious orders,” the Federal Communications Commission said yesterday.

    On August 1, the FCC sent One Owl a Notification of Suspected Illegal Robocall Traffic ordering it to investigate robocall traffic identified by USTelecom’s Industry Traceback Group, block all of the identified traffic within 14 days, and “continue to block the identified gateway traffic as well as substantially similar traffic on an ongoing basis.”

    “One Owl faces a simple choice—comply or lose access to US communications networks,” FCC Enforcement Bureau Chief Loyaan Egal said in a press release.

  14. Tomi Engdahl says:

    P2PInfect botnet activity surges 600x with stealthier malware variants

    The P2PInfect botnet worm is going through a period of highly elevated activity volumes starting in late August and then picking up again in September 2023.

    Cado Security researchers who have been following the botnet since late July 2023, report today seeing global activity, with most breaches impacting systems in China, the United States, Germany, Singapore, Hong Kong, the UK, and Japan.

  15. Tomi Engdahl says:

    The entire point of the CVE system is to identify the origin of a vulnerability so anyone making or using software downstream from the origin can easily tell if they’re vulnerable. And if the CVEs cover the same underlying vulnerability, the teams involved in its discovery should have coordinated and made that clear.

    Incomplete disclosures by Apple and Google create “huge blindspot” for 0-day hunters
    No one mentioned that libwebp, a library found in millions of apps, was a 0-day origin.

    Incomplete information included in recent disclosures by Apple and Google reporting critical zero-day vulnerabilities under active exploitation in their products has created a “huge blindspot” that’s causing a large number of offerings from other developers to go unpatched, researchers said Thursday.

    Two weeks ago, Apple reported that threat actors were actively exploiting a critical vulnerability in iOS so they could install espionage spyware known as Pegasus. The attacks used a zero-click method, meaning they required no interaction on the part of targets. Simply receiving a call or text on an iPhone was enough to become infected by the Pegasus, which is among the world’s most advanced pieces of known malware.

    Four days later, Google reported a critical vulnerability in its Chrome browser. The company said the vulnerability was what’s known as a heap buffer overflow that was present in WebP. Google went on to warn that an exploit for the vulnerability existed in the wild. Google said that the vulnerability, designated as CVE-2023-4863, was reported by the Apple Security Engineering and Architecture team and Citizen Lab.

    On Thursday, researchers from security firm Rezillion published evidence that they said made it “highly likely” both indeed stemmed from the same bug, specifically in libwebp, the code library that apps, operating systems, and other code libraries incorporate to process WebP images.

    Rather than Apple, Google, and Citizen Lab coordinating and accurately reporting the common origin of the vulnerability, they chose to use a separate CVE designation, the researchers said. The researchers concluded that “millions of different applications” would remain vulnerable until they, too, incorporated the libwebp fix. That, in turn, they said, was preventing automated systems that developers use to track known vulnerabilities in their offerings from detecting a critical vulnerability that’s under active exploitation.

    “Since the vulnerability is scoped under the overarching product containing the vulnerable dependency, the vulnerability will only be flagged by vulnerability scanners for these specific products,” Rezillion researchers Ofri Ouzan and Yotam Perkal wrote. “This creates a HUGE blindspot for organizations blindly relying on the output of their vulnerability scanner.”

    Google has further come under criticism for limiting the scope of CVE-2023-4863 to Chrome rather than in libwebp. Further, the official description describes the vulnerability as a heap buffer overflow in WebP in Google Chrome.

    In an email, a Google representative wrote: “Many platforms implement WebP differently. We do not have any details about how the bug impacts other products

    The representative noted that the WebP image format is mentioned in its disclosure and the official CVE page. The representative didn’t explain why the official CVE and Google’s disclosure did not mention the widely used libwebp library or that other software was also likely to be vulnerable.

    The Google representative didn’t answer a question asking if CVE-2023-4863 and CVE-2023-41064 stemmed from the same vulnerability.

    The number of apps, frameworks, code libraries, and other packages that incorporate libwebp and have yet to receive a patch is unknown. While Microsoft patched CVE-2023-4863 in its Edge browser, the company confirmed in an email on Thursday that other vulnerable products and code packages had yet to be patched.

    Microsoft offerings known to remain vulnerable are Teams, a widely used collaboration platform, and the developer tool Visual Studio Code.

    Both products are built on the Electron framework, which was also affected by CVE-2023-4863.

    The number of affected software packages is too large to check all of them.


Leave a Comment

Your email address will not be published. Required fields are marked *