This week: How attackers make a hit. IT service providers and consultants are top of the wrong charts. And why CISA are becoming “The Beatles” of the cybersecurity world.
3 – The making of a cyber hit.
“Microsoft has published a detailed profile of a native English-speaking [cyber gang] with advanced social engineering capabilities [..] that targets companies in data extortion and ransomware attacks.”
According to Microsoft (and recently reported on Bleeping Computer), the gang targets companies in many industries, including “technology, and financial sectors, as well as managed service providers (MSPs)”. In other words, you’re probably in the gang’s target market. The research goes on to describe the specific steps that the gang takes during an attack, including direct physical threats to force a staff member to reveal their login details.
So what? Glass half empty? The research shows how cyber attackers use multiple methods to gain initial access and to expand their reach. Glass half full? If you have appropriate defences in place, there could be multiple opportunities to spot an attack and shut it down before significant damage is done.
2 – IT Services & Consulting firms are top of the (wrong) charts.
In the last 6 months, the IT Services & IT Consulting industry was top of the Cyber Attack Victims charts.
This is according to analysis by Cyber News, and recently shared by The Cyber Security Hub. Apparently, they are twice as popular as insurance companies (as shown in the graphic below).
So what? If you rely on an IT services company to manage your IT systems, what have you done lately to ensure they are not your weakest link?
1 – CISA: The Beatles of the Cybersecurity World.
“Guidance for all organizations to reduce the impact and likelihood of ransomware incidents and data extortion” and “a checklist of best practices for responding to these incidents”.
That’s what we get from CISA’s (The US Cybersecurity and Infrastructure Security Agency’s) recently-updated Stop Ransomware Guide. The recommendations align to another of CISA’s recent hits, called Cross-Sector Cybersecurity Performance Goals (CPGs). “The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement “to protect against the most common and impactful threats, tactics, techniques, and procedures”.
So what? CISA are becoming “The Beatles” of the cybersecurity world: Every release is almost a certain hit. Make sure whoever manages your cybersecurity listens to them.