Category Archives: Internet Security
WatchGuard Threat Lab Report Reveals New Browser-Based Social … – Dark Reading
SEATTLE June 28, 2023 WatchGuard Technologies, a global leader in unified cybersecurity, today announced the findings of its latestInternet Security Report, detailing the top malware trends and network and endpoint security threats analyzed by WatchGuard Threat Lab researchers in Q1 2023. Key findings from the data show phishers leveraging browser-based social engineering strategies, new malware with ties tonation states, high amounts of zero day malware, living-off-the-land attacks on the rise, and more. This edition of the report also features a new, dedicated section for the Threat Lab teams quarterly ransomware tracking and analysis.
"Organizations need to pay more active, ongoing attention to the existing security solutions and strategies their businesses rely on to stay protected against increasingly sophisticated threats," said Corey Nachreiner, chief security officer at WatchGuard. "The top themes and corresponding best practices our Threat Lab have outlined for this report strongly emphasize layered malware defenses to combat living-off-the-land attacks, which can be done simply and effectively with a platform for unified security run by dedicated managed service providers."
Among its most notable findings, the Q1 2023 Internet Security Report reveals:
Consistent withWatchGuardsUnified Security Platform approachand the WatchGuard Threat Labs previous quarterly research updates, the data analyzed in this quarterly report is based on anonymized, aggregated threat intelligence from active WatchGuard network and endpoint products whose owners have opted to share in direct support of WatchGuards research efforts.New for this Q1 2023 analysis, the Threat Lab team has updated the methods used to normalize, analyze, and present the report findings. While previous quarterly research results have primarily been presented in the aggregate (as global total volumes), this quarter and going forward the network security results will be presented as per device averages for all reporting network appliances.The full report includes additional detail around this evolution and the rationale behind the updated methodology, as well as details on additional malware, network, and ransomware trends from Q1 2023, recommended security strategies, critical defense tips for businesses of all sizes and in any sector, and more.
For a more in-depth view of WatchGuards research, read the complete Q1 2023 Internet Security Reporthere.
About WatchGuard Technologies, Inc.
WatchGuard Technologies, Inc. is a global leader in unified cybersecurity. Our Unified Security Platform approach is uniquely designed for managed service providers to deliver world-class security that increases their business scale and velocity while also improving operational efficiency. Trusted by more than 17,000 security resellers and service providers to protect more than 250,000 customers, the companys award-winning products and services span network security and intelligence, advanced endpoint protection, multi-factor authentication, and secure Wi-Fi. Together, they offer five critical elements of a security platform: comprehensive security, shared knowledge, clarity & control, operational alignment, and automation. The company is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visitWatchGuard.com.
For additional information, promotions and updates, follow WatchGuard on Twitter (@WatchGuard), onFacebook, or on theLinkedIn Companypage. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them atwww.secplicity.org.Subscribe to The 443 Security Simplified podcastatSecplicity.org, or wherever you find your favorite podcasts.
WatchGuard is a registered trademark of WatchGuard Technologies, Inc. All other marks are property of their respective owners.
See original here:
WatchGuard Threat Lab Report Reveals New Browser-Based Social ... - Dark Reading
Security news from the week beginning 26th June 2023 – – Enterprise Times
Check Point Software, Sophos, Trend Micro, WatchGuard, and Zimperium published security reports last week. ManageEngine revealed that it had attained a Spanish cybersecurity certification. LogRhythm published a press release rounding up its success in H1 2023, and VMWare announced a partnership with AMD and Samsung.
Check Point released the 2023 Cloud Security Report. Key findings from the report based on over 1000 responses included:
TJ Gonen, VP of Cloud Security at Check Point Software Technologies, commented, Our survey found that cloud misconfigurations are the foremost concern for todays CISOs. However, what sets successful cloud security organizations apart, is not only the ability to identify misconfigurations, but also to grasp their contextual relevance and prioritize their resolution.
Understanding which misconfigurations truly pose a risk to business operations is paramount. As is the capability to swiftly and effectively address those vulnerabilities to maintain a strong security posture. It is imperative for enterprises to select a comprehensive solution that goes beyond surface-level detection.
Check Point Software also published its Environmental, Social, and Governance (ESG) report for 2022. The report covers Check Points sustainability-related projects, technology, business and activities over the last twelve months.
Key highlights include how Check Point is increasing Digital resilience, focusing on Carbon neutrality, its social responsibility, governance and ethics.
Gil Shwed, Founder and CEO at Check Point, said: Our report is an accurate reflection of what weve achieved so far, as well as a glimpse of our future plans. ESG is of paramount importance to us, and were taking definitive steps to continuously improve. From committing to achieving carbon neutrality by 2040, to extending cyber education programs to eager learners worldwide, these actions and many more embody what I believe to be the essence of Check Point making the world safer while also making it better.
LogRhythm reviewed its success, and the product updates rolled out over the first half 2023. It reviewed the improvements to its Axon, SIEM, and NDR solutions.
Chris OMalley, CEO of LogRhythm, commented, LogRhythm demonstrates in our actions a dedication to improving security analysts experience by providing them with the tools they need to navigate the evolving threat landscape effectively. Our latest product enhancements empower security analysts, improve operational efficiency, and offer unparalleled visibility into potential risks. We remain committed to our customers success and resilience against cyber threats.
LogRhythm also celebrated achievements such as:
The company also won several notable awards, including the Frost & Sullivan Competitive Leadership Awards, the Colorado Technology APEX Awards and the Globee Gold Awards.
ManageEngine announced that it has successfully obtained the Spanish governments Esquema Nacional de Seguridad (National Security Framework) certification. The company achieved this certification in the INTERMEDIATE (medium) category in its first attempt after a rigorous evaluation of all its cloud and on-premises solutions by BDO, an independent audit firm.
The evaluation, encompassing audits of the companys European Union data centres (located in Dublin and Amsterdam), announced ManageEngine as a certified company that met all the compliance policy requirements.
Rajesh Ganesan, president of ManageEngine, commented, Regulatory frameworks ensure high levels of trust for citizens using government, public and private digital services. Over the last 13 years, the National Security Framework (ENS) has evolved into a comprehensive framework that helps companies make modern technologies more secure so people can use them with confidence.
We at ManageEngine are excited to receive this certification, which is a testament to our continued efforts to fulfil the needs of our Spanish customers.
Sophies published the The State of Ransomware in Manufacturing and Production 2023 report. It found that the adversaries successfully encrypted data in 68% of ransomware attacks against this sector. This is the highest reported encryption rate for the sector over the past three years and is in line with a broader cross-sector trend of attackers more frequently succeeding in encrypting data.
Manufacturers are increasing the use of backups, 73% (58% 2022) but are taking longer to recover, 55% recovered in less than a week (2022 67%)
John Shier, field CTO Sophos, commented, Using backups as a primary recovery mechanism is encouraging, since the use of backups promotes a faster recovery. While ransom payments cannot always be avoided, we know from our survey response data that paying a ransom doubles the costs of recovery. With 77% of manufacturing organizations reporting lost revenue after a ransomware attack, this added cost burden should be avoided, and priority placed on earlier detection and response.
Longer recovery times in manufacturing are a concerning development. As weve seen in Sophos Active Adversary reports, based on incident response cases, the manufacturing sector is consistently at the top of organizations needing assistance recovering from attacks. This extended recovery is negatively impacting IT teams, where 69% report that addressing security incidents is consuming too much time and 66% are unable to work on other projects.
Sophos recommend several actions for manufacturers that other sectors are already taking:
Trend Micro sponsored and published a SANS Institute report, Breaking IT/OT Silos With ICS/OT Visibility. The report reveals that enterprise Security Operation Centers (SOCs) are expanding their capabilities to the OT domain, but major visibility and skills-related challenges are causing roadblocks.
Bill Malik, vice president of infrastructure strategies at Trend Micro, said, IT-OT integration is already driving digital transformation for many industrial organizations, but to effectively manage risk in these environments, IT and OT security operations (SecOps) must also converge. OT security programs may be lagging, but theres a fantastic opportunity to close the visibility and skills gap by consolidating onto a single SecOps platform like Trend Vision One.
The study also reveals the top challenges organisations looking to expand SecOps face.
Trend Micro also published an Omdia report that revealed that most enterprises invest 5-10% of their IT budgets specifically on private 5G network security, despite an assumption that the technology is secure by default. They will spend $12.9B on Private Network Security by 2027.
The research reveals that 72% of global enterprises believe the 3GPP approach1 to private 5G security is sufficient. These network architectures were built with security in mind, and because they are private, they are inherently more secure than public 5G. However, that doesnt mean they are impenetrable to determined attackers. The report highlights requirements and priorities shared by security leaders for their 5G deployments.
Greg Young, vice president of cybersecurity at Trend Micro, commented, When it comes to private 5G network technology, theres no such thing as secure by default, so its reassuring that enterprises are looking to add their own protections. What will be crucial going forward is educating this new user base about where the most critical security gaps are and what a shared responsibility model will look like in these environments.
VMWare has announced that it is joining forces with AMD, Samsung, and members of the RISC-V Keystone community to simplify the development and operations of confidential computing applications. VMware researched, developed and open-sourced the developer-focused Certifier Framework for Confidential Computing project.
AMD, Samsung and VMware aim to address a significant barrier to adopting confidential computing by standardising on an easy-to-use, platform-independent API for creating and operating confidential computing applications.
Kit Colbert, CTO of VMware, said, Confidential Computing has the potential to secure workloads no matter where they run including in multi-cloud and edge settings. The challenge has been to help customers adopt and implement the standard with ease. The collective efforts of the growing ecosystem of contributors to Certifier Framework will help bring those benefits to bear to ISVs, enterprise customers, and Sovereign Cloud providersenabling them to use this emerging technology more easily and effectively.
WatchGuard announced the findings of its latest Internet Security Report, detailing the top malware trends and network and endpoint security threats analyzed by WatchGuard Threat Lab researchers in Q1 2023. The key findings included the following:
Corey Nachreiner, the chief security officer at WatchGuard, commented, Organizations need to pay more active, ongoing attention to the existing security solutions and strategies their businesses rely on to stay protected against increasingly sophisticated threats.
The top themes and corresponding best practices our Threat Lab have outlined for this report strongly emphasize layered malware defenses to combat living-off-the-land attacks, which can be done simply and effectively with a platform for unified security run by dedicated managed service providers.
Zimperium published its Global Mobile Threat Report 2023. Key findings included the following:
Jon Paterson, CTO of Zimperium, commented, There is a fundamental issue that todays modern organizations must contend withhow can they capitalize on the opportunities of being mobile-powered without being exposed to evolving risks.
To thrive, it is critical that they employ a mobile-first security strategyone where they continually prioritize and assess risk as close to the user and device as possible, and baseline and continuously assess vulnerability posture to operate in a known state with complete visibility.
They must take responsive action on risk detection: leverage zero trust and conditional access workflows, leverage XDR and autonomous, 3rd party integrations and ensure they assess and stay updated on global privacy regulations and the risks that affect apps they develop and use.
Security News from the week beginning 19th June 2023
See original here:
Security news from the week beginning 26th June 2023 - - Enterprise Times
Dont Get Hacked. The Increased Risk Of Cyber-Threats And How Family Offices Can Protect Themselves – Forbes
not all about the technology. Many attacks originate from complex social engineering.Pawel Czerwinski on Unsplash
As any person operating in the digital world will know, you open yourself up to vulnerability, simply by opening an internet browser. But for family offices, this risk is even more pernicious and cybersecurity attacks are increasingly on the rise. As Boston Private points out, Over a quarter (26%) of family offices have suffered a cyberattack. In almost two-thirds of these cases, it happened within the last 12 months. As the discussion around the importance of daily offices digitising their operations picks up pace, if ever there was a time for family offices to get serious about their digital security, its now.
Like any cyber attacks, the biggest threats posed to family offices arent that different from those experienced by the rest of the world. The difference, however, comes in what is at stake for family offices. Family offices should be acutely aware of several key cybersecurity risks. This includes phishing and ransomware attacks, data breaches, insider threats, and third-party risks, all of which can lead to significant financial and reputational damage, says Eton Solutions CIO Muralidhran Nadarajah. The emergence of generative AI has introduced new threat vectors, with hackers now capable of creating sophisticated deep fakes and phishing/vishing attacks using analyzed voice, video, email, and social media data.
The need for heightened vigilance is paramount in this new era of threats, especially as many of these sophisticated attacks are orchestrated by state actors. Naturally, the biggest concern for family offices is financial, due to the level of wealth theyre dealing with, but this isnt the only theyre at risk of losing. Sophisticated modern cyberattacks today will almost always have a physical-world component. In the case of family offices, this can be deep research or intel that the attackers obtained or compiled, which will bring the quality of their phishing attack or social engineering to the next level, says Tobias Jaeger, Founder & CEO of Falcone International. A family office is often run by a small group with a lot of power and doesn't necessarily follow the same decision-making routes and operational rules as an investment firm with similar AUM (assets under management). This makes it easier for attackers to shortcut certain actions that these individuals would never do otherwise.
The reality is that social engineering is often where attacks start and not necessarily highly technical hacking or exploits.
The reality of knowing that your family office could be so vulnerable is a pretty grim one, but fortunately for family offices, theyre in a slightly better position than most to protect themselves. Etons Muralidhran Nadarajah notes that large single family offices have the resources to create dedicated security departments and infrastructure for effective data protection.
So, what are some ways they can protect themselves? According to Tony Gebely CEO of Annapurna, tackling family office cybersecurity isnt one-dimensional and should be approached internally, as well as externally. Cybersecurity is not a technology problem, it is a multifaceted challenge that extends far beyond the realm of technology, he says, and trying to resolve it alone isnt the way to go. Employing best practices will bolster efforts to some extent, but this is a very risky approach. Utilizing a third-party expert to identify and prioritize risks within the family system is the best approach to achieving cyber resilience.
Concierge Cyber, CEO Kurtis Suhs echoes this, and adds the priority to audit processes should be on par with auditing people and technology. Family offices need to address people, processes and technology. People: Does the family office require security awareness training for all employees? Processes: Does the family office network have a Written Information Security Plan (WISP) that addresses policies such as email security, mobile devices, business continuity, disaster recovery, physical security, and incident response? Technology: Does the family office utilize multi-factor authentication and endpoint protection?
The bottom line is, there is no silver bullet when it comes to cyber protection and in the same way a family office would default to external expertise when engaging in an unfamiliar asset class, they should consider the same here. Annapurnas Tony Gebely advises family offices to understand what they seek to gain by investing in cybersecurity, but ultimately, this cost would be lower than dealing with a breach. Falcones Tobias Jaeger seconds this, The cost of fixing a problem can easily be a factor of 100x compared to an investment into measures that would have prevented the issue in the first place.
Before launching any process updates, Concierge Cybers Kurtis Suhs suggests starting with a vulnerability test. This would include an external scan of their network for outsider threats and an internal scan for insider threats. Any discovered high vulnerabilities should immediately be remediated and medium threats should be addressed within 30 days.
From there, he says the entire organization must embrace a protective mindset. Cybersecurity risk management involves the entire C-Suite. For example, Legal should evaluate third-party contracts, particularly those vendors that maintain PII, with respect to mutual indemnity and hold harmless provisions, says Suhs. The CFO should ensure the family office has a call back requirement with their financial institutions. The Chief Security Officer should implement multi-factor authentication, endpoint protection and oversee vulnerability testing. The Facilities Manager should ensure that the family office has physical security to protect tangible assets. And most importantly, the family office should have a cyber incident response plan and annually test that plan to ensure business continuity, he continues.
And even once a strategy has been put in place, it will only succeed with constant monitoring and status updates. Etons Nadarajah says Implementing security measures, continuous staff training, consistent system monitoring, crafting incident response plans, conducting third-party assessments, backing up data, and enforcing multi-factor authentication are all vital practices for robust cybersecurity. An essential addition to these practices is a regular audit of the family office's security posture and a vulnerability assessment by a recognized external party. This process instils confidence in the sufficiency of the security framework in place. The work concerning family offices cybersecurity is not a once-off task. It is a constantly evolving process due to the ever-changing threat landscape.
In short, the more that family offices think about embracing tech, the more they will have to grapple with increasing cybersecurity risks that can result in significant financial and reputational damage. To protect themselves, family offices should prioritize digital security and employ best practices but most crucially seek external expertise. A two-factor approach that combines internal and external audits and processes is advised for long-term safeguarding.
By investing in cybersecurity measures, family offices can mitigate risks and avoid costly breaches, but this wont succeed without also conducting vulnerability tests, implementing protective measures, and continuously monitoring the organizations security framework.
I help design and incubate the family offices of the future. Starting with a clear purpose, we help plan for continued family involvement over the coming generations and build solid, innovative businesses. Founder of Simple, a family office insight & strategy company, that supports the future private wealth owners to use their capital to create the better world they would like to live in.
See the article here:
Dont Get Hacked. The Increased Risk Of Cyber-Threats And How Family Offices Can Protect Themselves - Forbes
International Experts Share Cybersecurity Tips at Hong Kong Forum … – PR Newswire
Two-day Event Provides Primer on Latest Internet Security and DNS Industry Trends
SINGAPORE, June 28, 2023 /PRNewswire/ -- The second Asia Pacific (APAC) Domain Name System (DNS) Forum 2023 will be held on 45 July 2023 at the Hong Kong Convention and Exhibition Centre in Hong Kong. Approximately 400 people from the Asia Pacific region have registered for the hybrid event, which will take place in Hong Kong for the first time. The forum is co-organized by the Hong Kong Internet Registration Corporation Limited (HKIRC) and the Internet Corporation for Assigned Names and Numbers (ICANN).
The event will bring together experts from different fields, including DNS architects, network engineers, cybersecurity experts, and business leaders. The forum provides a platform for stakeholders from around the world to convene and discuss issues related to the latest Internet developments, such as DNS abuse, big data applications, digital transformation, cybersecurity, and the marketization of Internet infrastructure.
"The DNS is the fundamental 'glue' that holds the Internet together. Continued growth of the Internet, as well as emerging technologies and services, all rely on the Internet's unique Identifier systems, which ICANN helps to keep working through its coordination role. We look forward to sharing more on this with the participants," said ICANN Senior Vice President and Chief Technology Officer, John Crain.
Expressing his pleasure with working with ICANN, HKIRC Chairman Simon Chan, B.B.S., J.P. said, "We are honored to work with ICANN to host this regional event in Hong Kong. As a leading player in the Internet industry, HKIRC is committed to promoting the development of a secure, stable, and resilient Internet infrastructure in Hong Kong and beyond. This event provides a unique opportunity to bring together industry experts to discuss critical issues facing the Internet today."
The forum features a range of topics related to the diverse applications of DNS and its significance in shaping the digital landscape, with particular emphasis on the contribution of DNS to digital transformation and the digital economy.
One of the key topics to be discussed at the event is cyber-attacks and DNS abuse. Experts will highlight the importance of implementing comprehensive security measures and DNS management practices to prevent cyber-attacks and DNS abuse, which are two different but related issues that organizations need to be aware of in today's digital environment. Attendees will gain actionable insights on how to combat these threats and protect their DNS infrastructure.
The forum will also showcase the latest trends and innovations in big data, digital infrastructure, blockchain technology, and artificial intelligence. These developments offer great potential to facilitate the adoption of big data, digital infrastructure, and the digital economy, encouraging users to embrace the digital future. Attendees will be provided with practical strategies for success in these areas.
The growth of the Internet has played a key role in fostering the digital economy, digital infrastructure, and promoting smart cities. As technology continues to advance, the importance of the Internet and digital infrastructure is likely to only continue to grow, providing new opportunities for economic growth and improving the quality of life for people in cities around the world.
Visit the APAC DNS Forum 2023 website for more information. Registration is free and required to attend the event (virtually or in person). The closing date for registration is 2 July 2023.
About ICANN
ICANN's mission is to help ensure a stable, secure, and unified global Internet. To reach another person on the Internet, you have to type an address - a name or a number - into your computer or other device. That address must be unique, so computers know where to find each other. ICANN helps coordinate and support these unique identifiers across the world. ICANN was formed in 1998 as a not-for-profit public-benefit corporation and a community with participants from all over the world.
About HKIRC
Hong Kong Internet Registration Corporation Limited (HKIRC) is a not-for-profit and non- statutory corporation designated by the HKSAR Government to administer the registration of Internet domain names under .hk and country-code top level domains. HKIRC provides registration services through its registrars for domain names ending with .com.hk, .org.hk, .gov.hk, .edu.hk, .net.hk, .idv.hk, ., .., .., .., .., .., .hk and ..
Photo - https://mma.prnewswire.com/media/2142767/HKIRC.jpgLogo - https://mma.prnewswire.com/media/1810953/ICANN_Logo.jpg
SOURCE ICANN
Read the original:
International Experts Share Cybersecurity Tips at Hong Kong Forum ... - PR Newswire
Surfshark VPN Review (2023): Features, Pricing, and More – TechRepublic
With the rise in data breaches, many businesses look for ways to improve internet security and enhance online privacy. One way is by deploying a Virtual Private Network (VPN). One VPN provider making waves in the industry is Surfshark. Founded in 2018, with more than 3,200 servers in 100 countries, Surfshark provides businesses with many capabilities, such as malware protection, an ad blocker, identity protection, data breach alert and an antivirus utility. This comprehensive review delves into the latest Surfshark VPN software examining its pricing and notable features as well as its pros and cons.
Pricing
Surfshark offers a seven-day free trial and three pricing plans, each providing a slew of features including unlimited devices, leak protection, a kill switch and AES-256 encryption. All plans come with a 30-day money-back guarantee. Below is the breakdown of the costs.
Apart from the above plans, there are additional costs for customers who want to add extra services like antivirus, real-time alerts and an anonymous search engine option.
Highlighted below are the key features that make Surfshark a compelling choice for those seeking a reliable VPN solution.
One of Surfsharks notable strengths is its extensive multiplatform support. Surfshark can be used on Windows, macOS, Linux, iOS, Chromebook and Android. Its also compatible with multiple devices, such as PCs, smartphones, routers and smart TVs. This cross-platform compatibility allows users to protect their online activities across all their devices.
The unlimited device connection offered across all pricing plans is what sets Surfshark apart from many VPN providers. With a single subscription, users can connect to unlimited devices simultaneously. This feature is particularly beneficial for businesses with many employees or individuals with an extensive device ecosystem. This feature also ensures that users can safeguard all their devices without worrying about hitting connection limits or incurring additional costs.
To ensure secure and private connections, Surfshark provides users with a selection of VPN protocols, including WireGuard, OpenVPN, and IKEv2. Surfshark employs robust AES-256-GCM encryption, which is regarded as a highly secure encryption standard.
Surfshark also ensures the security of user logins by encrypting them in their database, guaranteeing that no unauthorized individuals can decrypt or access the stored login information. Even in the unlikely event of a server data breach, Surfshark says that encrypted user logins will remain indecipherable and protected from unauthorized access.
SEE: The best encryption software
The split tunneling feature or bypasser, as Surfshark labels it, allows users to selectively encrypt their data, making it easier to choose the information they want to protect. With this feature, users can use two different IP addresses simultaneously, ensuring a higher level of privacy and security. This feature also allows users to maintain their original internet speed on the traffic they dont want to encrypt, ensuring a seamless browsing experience.
Figure A
Surfsharks MultiHop feature is for users who require an extra layer of anonymity and security. By routing connections through multiple servers in different locations, MultiHop adds an additional level of encryption and anonymity, making it harder for anyone to trace online activities. This feature is particularly valuable for businesses handling sensitive data or IT professionals working with confidential information that needs adequate protection.
Figure B
Intrusive ads and online trackers can hinder productivity and may even compromise privacy. Surfshark includes a built-in ad and tracker blocker known as CleanWeb, which helps eliminate annoying ads, cookie pop-ups and tracking attempts on computer devices. This feature has recently been upgraded and can be installed separately as a browser extension on Chrome, Edge and Firefox or together with the Surfshark VPN service. By enabling this feature, users can enjoy a cleaner and more focused browsing experience while minimizing the risk of being tracked by advertising networks or malicious entities.
Figure C
While Surfshark offers a range of impressive features and benefits, its always a good idea to explore alternative VPN options to find the one that best suits your specific requirements. There are three notable alternatives to Surfshark worth considering.
NordVPN is a popular name in the VPN market and stands as a worthy alternative to Surfshark. The VPN has about 5,710 servers in 60 countries and provides a lot of features such as Meshnet, which allows users to create their own private encrypted network for file sharing, a dedicated IP for easy access to IP-restricted networks and a threat protection feature that helps combat malware, intrusive ads and web trackers. NordVPN is also compatible with multiple operating systems like Windows, macOS, Android, iOS and Linux. With a single subscription, users can connect up to six devices.
ExpressVPN is another top contender known for its exceptional speed and security features. With servers in 94 countries, ExpressVPN offers features like smart location, which automatically selects the best VPN server location based on various factors, including download speed, latency and distance. Express VPN also offers split tunneling, a network lock kill switch, private DNS and a threat manager that blocks sites and apps from communicating with trackers.
CyberGhost VPN is another VPN option worthy of consideration. This VPN service is known for its extensive server network. With a straightforward and intuitive interface, its a good choice for business users seeking a hassle-free VPN experience. With 9,107 servers in 91 countries, CyberGhost VPN provides a large server network, offering broader options for accessing geo-restricted content and maintaining a stable connection. With one subscription, users can connect up to seven devices a bargain compared to some other VPN providers. CyberGhost is compatible with Windows, macOS, Android, iOS and Linux operating systems. Users can also configure CyberGhost VPN to work on routers, smart TVs and the Amazon Fire TV Stick.
Surfshark, like every other software product, has its strengths and weaknesses.
SEE: Get 3 years of rock-solid protection with Surfshark VPN
Surfshark is most suitable for small and medium-sized businesses looking for a VPN service that offers unlimited device connection, multiplatform device support and strong security and no-log policy features. With Surfsharks unlimited device connection offering available on all plans, businesses with an extensive collection of computing devices can get the best value for their money. Additionally, Surfshark is also ideal for individuals with streaming needs that require bypassing geolocations, as the VPN enables users to bypass geo-restrictions and access their favorite streaming platforms from anywhere in the world.
This review involved a detailed assessment of Surfsharks features, including its security protocols, server network, device compatibility and cost. Examining these features helped us to evaluate its overall performance and user experience. Furthermore, we supplemented our research by studying user reviews and testimonials from reputable review sites, to ensure a well-rounded understanding of its strengths and weaknesses as experienced by customers.
Visit website
NINJIO prepares organizations to defend against cyber threats through their engaging, video-based training courses. They earned the highest score among providers named "Customer's Choice" in Gartner's 2022 "Voice of the Customer Security Awareness Computer-Based Training report. Teams love NINJIO because of their Hollywood-style microlearning episodes, each based on recent, real-world breaches. Click below to get the full Gartner report and 3 free episodes, and see why everyone loves NINJIO.
Learn more about NINJIO Cybersecurity Awareness Training
Visit website
Dashlane secures your data with a patented security architecture and AES256-bit encryption, the strongest method available. Employees can securely share encrypted passwords with individuals or groups- instead of sending them unsecurely over email or Slack. Try Dashlane Business for free
Learn more about Dashlane
Visit website
Endpoint Central is one super app to manage your enterprise IT, from endpoint management to end-user security. Streamline and scale every IT operation from device enrolling/onboarding to retiring for multiple device types across different platforms. Perform patching, distribute software, manage mobile devices, deploy OS, keep track of hardware/software inventory, and remotely troubleshoot end-user issues while shielding them from cyberattacks. Get a free 30-day trial on unlimited endpoints.
Learn more about ManageEngine Desktop Central
Read next: Surfshark vs NordVPN (2023): In-depth comparison
Read the rest here:
Surfshark VPN Review (2023): Features, Pricing, and More - TechRepublic
Iowa Air National Guardsman Pleads Guilty to Possessing Child … – Department of Justice
Kevin Swanson, 35, from Sioux City, Iowa, entered a guilty plea in federal court on May 4, 2023, to possession of child pornography.
In a plea agreement, Swanson admitted that between August 2020, and August 2021, he used an Internet-based, peer-to-peer (P2P) network to knowingly receive visual depictions of minors engaged in sexually explicit conduct, including depictions involving prepubescent minors who had not reached the age of 12. Swanson had over 1,168 images and 4 video files of child exploitation materials.
Sentencing before United States District Court Chief Judge Leonard T. Strand will be set for a later date after a presentence report is prepared. Swanson was taken into custody by the United States Marshal pending sentencing. Swanson faces a sentence of up to 20 years imprisonment without the possibility of parole, a fine of not more than $250,000, a mandatory special assessment of $100 and a term of supervised release of at least 5 years to life.
This case was brought as part of Project Safe Childhood, a nationwide initiative launched in May 2006 by the Department of Justice to combat the growing epidemic of child sexual exploitation and abuse. Led by the United States Attorneys Offices and the Criminal Division's Child Exploitation and Obscenity Section, Project Safe Childhood marshals federal, state, and local resources to locate, apprehend, and prosecute individuals who sexually exploit children, and to identify and rescue victims. For more information about Project Safe Childhood, please visit http://www.usdoj.gov/psc. For more information about internet safety education, please visit http://www.usdoj.gov/psc and click on the tab resources.
The case was investigated by Homeland Security Investigations, the Sioux City Police Department, and the Nebraska State Patrol. The case is being prosecuted by Assistant United States Attorney Kraig R. Hamit.
Court file information at https://ecf.iand.uscourts.gov/cgi-bin/login.pl.
The case file number is 22-4080. Follow us on Twitter @USAO_NDIA.
Read this article:
Iowa Air National Guardsman Pleads Guilty to Possessing Child ... - Department of Justice
Signing in to Pocket just got even more secure – Mozilla & Firefox
The Pocket app and web experience are trusted by millions of people everyday to stay up to date and informed on the topics they care about most, free from clickbait, fake news and the pressure and anxiety often felt while on social media platforms. Since being acquired in 2017, Pocket is part of the family of products made by Mozilla, the nonprofit-backed tech company building responsible technology that prioritizes people over profits, so internet safety and security are top of mind for our customers.
In order to provide additional security benefits such as two-factor authentication to our users, all Pocket accounts will be converted to Firefox accounts, an authentication service powered by Mozilla. For those of you who enjoy logging in to Pocket via Google or Apple, youll still benefit from the enhanced security thats enabled by having Pocket backed by Firefox accounts.
We want you to have the best security for your account and were lucky to be a part of the Mozilla family of products that have a team working full-time on creating the best authentication experience possible. By using a Firefox account to access Pocket in any browser or mobile device, you will benefit from Mozillas privacy policy, which always puts people first. (To learn how to manage your Firefox account and the data associated with it, click here).
Starting July 11, 2023, Pocket users will be prompted to transition to a Firefox account in order to log in and access their Pocket account. Aside from changing how you log in to Pocket, this does not affect your saved items. While optional at first, the transition to a Firefox account in order to log in will be required by August 15, 2023.
For Pocket Premium subscribers, converting your account will not impact your subscription.
And from then on, simply use Continue with Firefox to log into Pocket.
*For people who login with their Apple ID and Google login
If you use Apple ID or Google login to access your Pocket account, you dont need to do anything. Your account will be auto-migrated on July 11, 2023. The next time you log in after this date, youll access Pocket with your new Firefox account using the same Apple ID or Google login.
Note that if you have already signed into Pocket with your Firefox account, your account has already been converted. Theres nothing else to do!
While well now require a Firefox account to sign up or log in to Pocket, you can continue using your preferred web browser to access Pocket. Our Pocket browser extensions for many popular browsers and apps for iOS and Android will continue to be available as well.
Creating a Firefox account also comes with other features that will make your time online more enjoyable, including other Mozilla products such as Monitor and Relay, both of which do not require using a Firefox browser.
If you have any other questions regarding signing up and transitioning to Firefox accounts to log in to your Pocket account, you can visit our Frequently Asked Questions (FAQ) page.
If you need any other assistance with your Pocket account, click here to contact Pocket Support.
Save and discover the best articles, stories and videos on the web Get Pocket
See the original post:
Signing in to Pocket just got even more secure - Mozilla & Firefox
The everyday words people really SHOULD know how to spell – Daily Mail
There are all kinds of embarrassing Google searches. A weird rash, your ex, common knowledge you really should know and all the words you cant spell.
Lots of people use search engines as a dictionary these days.
But which words are the hardest to spell?
The folks at unscrambled words - a Scrabble cheater/helper site - looked at a year of Google Search data to spill the beans.
It's as simple as pie, right? Think again! That cluster of vowels in the middle makes this one challenging. Break it down into syllables: res-tau-rant. Or, hey, picture yourself taking a rest, holding a "U" sign and ranting about something.
The silent p will get you every time. Pneumonia is an infection in one or both lungs. The word itself is packed with pesky extra letters. Hey, at least you probably wont need to spell it often.
How many people doing a Google search for this one gave up and said thanks? It starts tricky with the double "P." Picture someone handing you an apple as a thank you.
Kim Komando hosts a weekly call-in show where she provides advice about technology gadgets, websites, smartphone apps and internet security.
Listen on 425+ radio stations or get the podcast. And join over 400,000 people who get her free 5-minute daily email newsletter.
Finally, one with a classic rule you probably know: I before E, except after C. This checks the boxes, though that PT combo at the end is tricky, too. Sorry, youre just going to have to memorize it.
Yeah, a little harder than pretty. It helps to focus on the "beau" part handsome or attractive. After that, it's pretty smooth sailing.
Fear not, dear aunts and uncles, theres a phrase you already know for this one: I before E. The C might throw you off, but its after the IE combo.
You're in complicated territory whenever multiple spots could be one letter or another. It doesn't help that maintain a word that feels like it should be spelled the same is a little different. For this word, break it down into syllables: main-te-nance.
This slang term means fancy or characteristic of luxury. And youll find lots of people spelling it boujee. Remember, its a fancy word and a G feels a little fancier than a J, right? Right. After all, it comes from the word "bourgeoisie."
Bet you knew that one was coming. Imagine the urgency with which Google users typed those letters. Theres no shortage of ways to spell this one wrong. To spell this stomach-churning word correctly, remember the double R + H.
We're willing to be it's that "T" in the middle that trips people up the most. The way most of us pronounce it, it could be a "D" instead. Just remember "congrats" or that you "congratulate," and you're on the right track.
The rest is here:
The everyday words people really SHOULD know how to spell - Daily Mail
Stolt-Nielsen deploys fully integrated Orange SASE solution to optimise global connectivity and security for hybrid workforce – TelecomTV
Stolt-Nielsen, a global expert in bulk liquid logistics and sustainable land-based aquaculture, has chosen Orange Business to provide a secure access service edge (SASE) solution. It combines SD-WAN connectivity with global Security Service Edge (SSE) to securely support the companys global, hybrid workforce and drive business growth.
Stolt-Nielsen has a diverse business portfolio, including the worlds largest fleet of chemical tankers, terminals for the safe storage and handling of bulk liquids, and bulk door-to-door chemical delivery logistics. It prides itself on being a trailblazer in adopting technology in its field.
The multinational enterprise was an early adopter of SD-WAN and is now moving to the next generation of advanced solutions. It was looking to replace a set up of internet providers and network solutions with one integrated service to optimize performance and security for its 2,500 hybrid users globally.
Phased SASE deploymentStolt-Nielsen wanted a trusted partner to help migrate from its former infrastructure and develop a phased SASE strategy. It chose Orange as the integrator, impressed by its global network capabilities, security expertise, and broad portfolio of services.
The fully managed Orange SASE Advanced offering, created for Stolt-Nielsen in partnership withNetskope, provides enhanced global connectivity and consistent internet security on and off the network. With Netskopes SSE infrastructure located across more than 70 regions globally, plugging it into the Orange network ensures data security can be managed centrally without affecting business productivity.
As part of our transformation, we needed to define a secure, centralized, future-proofed digital infrastructure to support our business growth and innovation. We chose Orange because of its ability to provide seamless, reliable global connectivity with the highest security standards delivered via SASE,explains Peter Koenders, CIO at Stolt-Nielsen.
Stolt-Nielsen will reap the benefits of Orange SASE Advanced with a secure, flexible infrastructure built on our Evolution Platform and secured by Orange Cyberdefense. This innovative approach will help to drive the companys secure digital transformation plans, advancing operational efficiency and propelling digital business growth,adds Nemo Verbist, Senior Vice President, Europe, at Orange Business.
Read the original post:
Stolt-Nielsen deploys fully integrated Orange SASE solution to optimise global connectivity and security for hybrid workforce - TelecomTV
Russian Cybersecurity Executive Arrested for Alleged Role in 2012 … – Krebs on Security
Nikita Kislitsin, formerly the head of network security for one of Russias top cybersecurity firms, was arrested last week in Kazakhstan in response to 10-year-old hacking charges from the U.S. Department of Justice. Experts say Kislitsins prosecution could soon put the Kazakhstan government in a sticky diplomatic position, as the Kremlin is already signaling that it intends to block his extradition to the United States.
Nikita Kislitsin, at a security conference in Russia.
Kislitsin is accused of hacking into the now-defunct social networking site Formspring in 2012, and conspiring with another Russian man convicted of stealing tens of millions of usernames and passwords from LinkedIn and Dropbox that same year.
In March 2020, the DOJ unsealed two criminal hacking indictments against Kislitsin, who was then head of security at Group-IB, a cybersecurity company that was founded in Russia in 2003 and operated there for more than a decade before relocating to Singapore.
Prosecutors in Northern California indicted Kislitsin in 2014 for his alleged role in stealing account data from Formspring. Kislitsin also was indicted in Nevada in 2013, but the Nevada indictment does not name his alleged victim(s) in that case.
However, documents unsealed in the California case indicate Kislitsin allegedly conspired with Yevgeniy Nikulin, a Russian man convicted in 2020 of stealing 117 million usernames and passwords from Dropbox, Formspring and LinkedIn in 2012. Nikulin is currently serving a seven-year sentence in the U.S. prison system.
As first reported by Cyberscoop in 2020, a trial brief in the California investigation identified Nikulin, Kislitsin and two alleged cybercriminals Oleg Tolstikh and Oleksandr Vitalyevich Ieremenko as being present during a 2012 meeting at a Moscow hotel, where participants allegedly discussed starting an internet caf business.
A 2010 indictment out of New Jersey accuses Ieremenko and six others with siphoning nonpublic information from the U.S. Securities & Exchange Commission (SEC) and public relations firms, and making $30 million in illegal stock trades based on the proprietary information they stole.
[The U.S. Secret Service has an outstanding $1 million reward for information leading to the arrest of Ieremenko ( ), who allegedly went by the hacker handles Zl0m and Lamarez.]
Kislitsin was hired by Group-IB in January 2013, nearly six months after the Formspring hack. Group-IB has since moved its headquarters to Singapore, and in April 2023 the company announced it had fully exited the Russian market.
In a statement provided to KrebsOnSecurity, Group-IB said Mr. Kislitsin is no longer an employee, and that he now works for a Russian organization called FACCT, which stands for Fight Against Cybercrime Technologies.
Dmitry Volkov, co-founder and CEO, sold his stake in Group-IBs Russia-based business to the companys local management, the statement reads. The stand-alone business in Russia has been operating under the new brand FACCT ever since and will continue to operate as a separate company with no connection to Group-IB.
FACCT says on its website that it is a Russian developer of technologies for combating cybercrime, and that it works with clients to fight targeted attacks, data leaks, fraud, phishing and brand abuse. In a statement published online, FACCT said Kislitsin is responsible for developing its network security business, and that he remains under temporary detention in Kazakhstan to study the basis for extradition arrest at the request of the United States.
According to the information we have, the claims against Kislitsin are not related to his work at FACCT, but are related to a case more than 10 years ago when Nikita worked as a journalist and independent researcher, FACCT wrote.
From 2006 to 2012, Kislitsin was editor-in-chief of Hacker, a popular Russian-language monthly magazine that includes articles on information and network security, programming, and frequently features interviews with and articles penned by notable or wanted Russian hackers.
We are convinced that there are no legal grounds for detention on the territory of Kazakhstan, the FACCT statement continued. The company has hired lawyers who have been providing Nikita with all the necessary assistance since last week, and we have also sent an appeal to the Consulate General of the Russian Federation in Kazakhstan to assist in protecting our employee.
FACCT indicated that the Kremlin has already intervened in the case, and the Russian government claims Kislitsin is wanted on criminal charges in Russia and must instead be repatriated to his homeland.
The FACCT emphasizes that the announcement of Nikita Kislitsin on the wanted list in the territory of the Russian Federation became known only today, June 28, 6 days after the arrest in Kazakhstan, FACCT wrote. The company is monitoring developments.
The Kremlin followed a similar playbook in the case ofAleksei Burkov, a cybercriminal who long operated two of Russias most exclusive underground hacking forums. Burkov was arrested in 2015 by Israeli authorities, and the Russian government fought Burkovs extradition to the U.S. for four years even arresting and jailing an Israeli woman on phony drug charges to force a prisoner swap.
That effort ultimately failed: Burkov was sent to America, pleaded guilty, and was sentenced to nine years in prison.
Alexei Burkov, seated second from right, attends a hearing in Jerusalem in 2015. Image: Andrei Shirokov / Tass via Getty Images.
Arkady Bukh is a U.S. attorney who has represented dozens of accused hackers from Russia and Eastern Europe who were extradited to the United States over the years. Bukh said Moscow is likely to turn the Kislitsin case into a diplomatic time bomb for Kazakhstan, which shares an enormous border and a great deal of cultural ties with Russia. A 2009 census found that Russians make up about 24 percent of the population of Kazakhstan.
That would put Kazakhstan at a crossroads to choose between unity with Russia or going with the West, Bukh said. If that happens, Kazakhstan may have to make some very unpleasant decisions.
Group-IBs exodus from Russia comes as its former founder and CEO Ilya Sachkov remains languishing in a Russian prison, awaiting a farcical trial and an inevitable conviction on charges of treason. In September 2021, the Kremlin issued treason charges against Sachkov, although it has so far refused to disclose any details about the allegations.
Sachkovs pending treason trial has been the subject of much speculation among denizens of Russian cybercrime forums, and the consensus seems to be that Sachkov and Group-IB were seen as a little too helpful to the DOJ in its various investigations involving top Russian hackers.
Indeed, since its inception in 2003, Group-IBs researchers have helped to identify, disrupt and even catch a number of high-profile Russian hackers, most of whom got busted after years of criminal hacking because they made the unforgivable mistake of stealing from their own citizens.
When the indictments against Kislitsin were unsealed in 2020, Group-IB issued a lengthy statement attesting to his character and saying they would help him with his legal defense. As part of that statement, Group-IB noted that representatives of the Group-IB company and, in particular, Kislitsin, in 2013, on their own initiative, met with employees of the US Department of Justice to inform them about the research work related to the underground, which was carried out by Kislitsin in 2012.
View original post here:
Russian Cybersecurity Executive Arrested for Alleged Role in 2012 ... - Krebs on Security