The number and complexity of cybersecurity tools have grown at a dizzying pace in recent decades. As cyber threats like ransomware became more numerous and complex, antivirus and threat management tools expanded to meet these challenges. Security experts now often find themselves with too many choices and a market too rich with options. Choosing, running and training on these tools can become a problem.

From the first computer worm to ransomware, lets review the evolution of cyber threats and the expanding cybersecurity ecosystem.

With no public internet, computer security in the early days focused mainly on passwords protecting computer systems one at a time. Even 60 years later, passwords remain a foundation of a healthy cybersecurity practice.

In the 1970s, an ethical coder created a program called Creeper, a worm that moved from system to system, leaving a message behind on the ARPANET. (ARPANET was the Advanced Research Projects Agency Network, an arm of the U.S. Department of Defense and the forerunner of todays internet.) A colleague of the Creeper programmer created a program to destroy it called Reaper. It found and deleted the virus, creating the first antivirus program. These were the first virus and antivirus programs, but that didnt remain true for long.

In the late 1980s, the Morris Worm, a self-replicating malware program, served as a wake-up call to the industry. Designed to demonstrate a known vulnerability, it slowed down the internet and caused widespread damage. The Morris Worm clarified the need to hold back a growing threat landscape and gave rise to the first firewall. Firewalls slowly emerged from labs in the late 1980s, but the firewall industry would take off in the next decade.

In 1987, the first true commercial antivirus solution came out from the German company G Data Software for Atari systems. McAfee was also founded that year and launched VirusScan. Several more antivirus products followed.

The 1980s began with no real commercial cybersecurity products. They ended with several firewall projects and antivirus products on the market, and the trend would only continue.

The history of the worldwide web began in 1989, and its spread in the early 1990s made the internet mainstream. The decade started with fewer than 3 million internet users and ended with around 281 million. With millions of people putting their personal and financial information online, cyber criminals emerged to exploit it.

In the 1990s, cybersecurity tools focused on perimeter protection firewalls and intrusion prevention systems as well as antivirus software. Firewalls transitioned from lab projects to commercial products, with the second generation coming out of AT&T Bell Labs, which called their technology Circuit Level Gateway. This introduced the first stateful firewall, a firewall that monitors the complete state of active network connections. In 1994, Check Point launched Firewall-1, which was a milestone among commercial firewall solutions by offering a popular and easy-to-administer cybersecurity tool that used a graphical user interface.

With a firewall, packet filters could protect a safe internal network by hunting for known malicious traffic. These steadily became more refined and varied, but the basic concept stayed the same. Building a moat around corporate networks and applications was the method of the era.

The first virtual private network (VPN) was developed inside Microsoft in 1996 to extend the protection of the firewall to remote users dialing in with modems. It would later be used broadly for both security and privacy, enabling remote user activity to be hidden from internet service providers and public Wi-Fi. The technologies underlying VPN products Internet Protocol Security (IPSec), Internet Key Exchange (IKE ) and, by the end of the decade, Layer 2 Tunneling Protocol (L2TP) vastly improved VPN security as products spread.

Many of the attack types spreading widely today, like ransomware (the first instance of which happened via floppy disk in 1989), emerged as a more widely used technique in the mid-2000s. During this time GPCode, TROJ.RANSOM.A, Archiveus, Krotten, Cryzip, MayArchive and other new ransomware attacks emerged. Ransomware became more attractive to threat actors with the rise of difficult-to-trace cryptocurrencies. Malware posing as antivirus became a major point of social engineering around ransomware attacks.

After 2000, the concept of the SOC (security operations center) came into vogue, an all-hands-on-deck control center featuring a room full of specialists monitoring and stopping security events across the whole enterprise. In the case of smaller teams, a Managed Security Service could accomplish this job. Either way, they probably used a security information and event management (SIEM) platform. This approach was an early attempt to deal with overcomplexity in both attack variants and security tools.

A SIEM is a collection of software systems that find, analyze and display data from devices, software and logging systems, or external sources. Today more than 60 companies sell SIEM solutions.

The SIEM idea has been more recently replaced by the emergence of real-time security intelligence platforms aimed to prevent problems like ransomware rather than find them after the fact. These use big data analytics to discover trends.

This kind of control room approach to cybersecurity could involve thousands of different solutions and products. They not only deal with a wide range of attack types but also with a wide range of solutions.

Next-generation firewalls emerged in 2008 and proliferated in the 2010s. Driven by Palo Alto Networks, these firewalls used application-aware packet filtering, user-based access control (regardless of the systems IP address or device type), built-in IPS filtering and other advanced techniques that proved powerful when combined. By the end of the decade, there would be hundreds of firewall solutions.

The ransomware worm WannaCry emerged in 2017, spreading virally and demanding Bitcoin payment. During this decade, cybersecurity tools got way more modern, using network behavioral analysis and web application firewalls.

We start the new decade paralyzed by choice. Every security solution, starting with passwords and including firewalls, antivirus and antimalware, VPNs, two-factor authentication solutions, biometric tools, encryption products, hardware-based security, enterprise key management, container and Kubernetes security, confidential computing and many more, began as single solutions. More providers emerged, more solutions emerged and the tool landscape became more complex.

We find ourselves where market size itself is a security threat. The time and energy it takes to evaluate and choose from the incredible variety of solutions has become a significant investment, and the mastery and training of these solutions is another challenge altogether.

The proliferation of threats and solutions is unlikely to change. So for todays cybersecurity and the battle against ransomware, the focus is on solutions that bring order to the chaos. Threats will continue to evolve at a faster pace and solutions must evolve with them. The next historic milestones for the cybersecurity ecosystem will be cloud-based tools paired with artificial intelligence and intelligent automation to target ransomware and todays other threats.

Learn why IBM Security is recognized as a leader in managed security services, combining AI, threat intelligence and response to deliver better security outcomes.

Freelance Technology Writer

Continue Reading

Here is the original post:
A History of Ransomware and the Cybersecurity Ecosystem - Security Intelligence

Without prior Congressional review or a legislative amendment, the DOJs selective enforcement of a key Federal statute neither provides risk mitigation to the industry facing billions of dollars of losses nor deters industrial espionage and cyber theft, which are rampant.

Recent policy announcements by the U.S. Department of Justice (DOJ) regarding the selective prosecution under the Computer Fraud and Abuse Act of 1986 (CFAA) has had the unintended consequence of alerting cyber criminals that the DOJ cannot walk and chew gum at the same time.

The CFAA, a landmark 1986 legislation, prohibits accessing a computer without authorization or in excess of authorization. Enacted in the aftermath of press coverage of high-profile criminal hacking incidents, heightened national security threats from rogue foreign actors, and a finding that traditional theft and trespass statutes were ill-suited to address cybercrimes, the CFAA imposed criminal penalties, including fines and imprisonment, granting the FBI and the Justice Department the authority to investigate and prosecute. The CFAA further provides private civil causes of action for individuals or entities harmed by the perpetrators unauthorized access.

Since then, the CFAA has been amended by Congress multiple times, including via the USA Patriot Act, and each time the law expanded its definition of criminalized computer acts and broadened its jurisdiction to include any internet-enabled electronic device, including computers and cell phones, due to the interstate nature of most Internet communication.

The CFAA prohibitions broadly apply to hacking for malicious purposes (i.e., breaking in with stolen passwords to steal data or encrypted files), to insider threats where employees who have authorized access to a certain portion of their employers computer gain unauthorized access to other portions of the same computer, and to former employees who gain access to their work computers after access is revoked upon termination of employment.

TheU.S.SupremeCourtinVanBurenv. UnitedStates, 14 S.Ct 1648 (2021) ended the decades long split in federal circuit courts rulings on the definition of unauthorized access and access in excess of authorization with a finding that the burden of authorized access or access in excess of authorization rests on the employer to restrict access and establish security protocols to regulate access; an employee exercising permissible access does not lose access if the purpose of that access is not as intended by the employer. However, the enforceability of unauthorized access or access in excess of authorization is strengthened by the Supreme Court decision where access had been definitively terminated or restricted by the employer.

Contrary to the extensive statutory guidelines and case law precedents, the DOJ has recently announced that the Department will not charge defendants in certain types of exceeds authorization cases based on the theory that a defendants authorization to access a particular file, database, folder, or user account was conditioned by a contract, agreement, or policy, with the narrow exception of contracts, agreements, or policies that entirely prohibit defendants from accessing particular files, databases, folders or user accounts on a computer in all circumstances. The DOJ further states that defendants will not be charged where authorization to access a computer, or a particular area on a computer, was automatically withdrawn under the terms of a contract or other written document once the user did something, or some other particular condition was met.

The DOJs prosecutorial discretion, exercised in this policy directive, appears to be overbroad and vague. Without prior Congressional review or a legislative amendment, the DOJs selective enforcement of a key Federal statute neither provides risk mitigation to the industry facing billions of dollars of losses nor deters industrial espionage and cyber theft, which are rampant. Twin cases, one in the real estate industry (CREXi) and a second in the entertainment industry (Ticketmaster), conspicuously illustrate the DOJs unequal application of the CAs mandate despite their similarity in fact pattern.

In both cases, the fact pattern conforms to the type of without authorization cases that the DOJ has specifically identified for prosecution in its policy directive: Unlike the exceeds authorization cases, which the DOJ has directed it will only prosecute for the narrow exception of contracts, agreements, or policies that entirely prohibit defendants from accessing particular files, databases, folders, or user accounts on a computer in all circumstances, the DOJ has provided no such limiting guidance for without authorization cases. Inexplicably, the DOJ chose to bring criminal charges in one case (Ticketmaster), while the other case (CREXi) has languished in court for three years.

CoStarGroupetal.v.CommercialReal EstateExchange,Inc. is a civil case pending in the Central District Court of California Court in Los Angeles for alleged theft of intellectual property for the purpose of developing a competing business. The complaint alleges that defendant Commercial Real Estate Exchange, Inc. (CREXi} employees accessed CoStars subscription database without permission; CREXis former account executives hacked into CoStars password protected database by using passwords issued to CoStar customers, and then downloaded CoStars broker directories to build a clone directory on CREXi, using the stolen data to generate customer leads. The complaint specifies that at least one of theCREXi executives involved, the head of its New York office, used credentials to which he had never had any entitlement. According to the complaint, two of the other executives used a former employers credentials after they left to work for CREXi.

In a second case with a similar fact pattern, which was before the Eastern District of New York, in Brooklyn, the DOJ intervened with criminal charges against the defendant, Ticketmaster, because its employees repeatedly - and illegally accessed a competitors computers without authorization using stolen passwords to unlawfully collect business intelligence. Ticketmaster agreed to pay a criminal penalty of $10 million in exchange for deferred prosecution and a compliance and ethics program designed to prevent and detect violations of the Computer Fraud and Abuse Act and other applicable laws, and to prevent the unauthorized and unlawful acquisition of confidential information belonging to its competitors.

According to William Sweeney, FBI Assistant Director-in-Charge assigned to the Ticketmaster case; When employees walk out of one company and into another, its illegal for them to take proprietary information with them. Ticketmaster used stolen information to gain an advantage over its competition, and then promoted the employees who broke the law. This investigation is a perfect example of why these laws exist to protect consumers from being cheated in what should be a fair marketplace. Should the same standard not apply to the CoStarcase?

EvenundertheDOJsnewandundulyrestrictivepolicy,the alleged accesstoCoStarsdatabase by theheadof CREXisNewYork office was reportedly never authorizedunder any circumstances. Indeed, even the two CREXi executives who purportedly used credentials issued to their former employers pose a problem, as said credentials would have been revoked upon their separation from the company. And, arguably, even that point need not be reached as no authorization existed for any CREXi employee in the first place.

In any event, given the lack of prosecution for this seemingly plain lack of authorization for CREXIs New York office heads database access, it is clear that the DOJs new unduly restrictive approach to exceeds authorization cases is having a chilling effect on prosecutions of the other type cases where no authorization existed at all. In short, the pernicious impact of the DOJs new policy regarding selective prosecutions under the Computer Fraud and Abuse Act of 1986 (CFAA) appears to be stymieing even those prosecutions that on their face fall outside its overly narrow restrictions.

In mid-May, the DOJ announced criminal charges including export violations, smuggling, and theft of trade secrets, in connection with the Disruptive Technology Strike Force, which it co-leads with the Department of Commerce, to counterefforts by hostile nation-states such as Russia and China to illicitly acquiring sensitive U.S. technology. Once again, the DOJs prosecutorial discretion, exercised in this policy directive involving rogue foreign actors, appears to be overbroad and vague, and with an unequal application of CFAA mandates in cases with a similar fact pattern.

The DOJ, in two of the five criminal cases, charged former software engineers for stealing software and hardware source code from U.S. tech companies to sell to China. In the Central District of California, a senior software engineer wasarrested and charged with theft of trade secrets for allegedly stealing source code used in meteorology software, used insmart automotive manufacturing equipment, which the defendant then allegedly marketed to multiple Chinesecompanies. In the Northern District of California, a citizen of the Peoples Republic of China (PRC) and former Apple engineer is charged with allegedly stealing thousands of documents containing the source code for software and hardware.

In the CREXi case, which similarly involves theft of an American companys intellectual property and trade secrets by offshore agents in India, the DOJ has failed to consider intervening with criminal charges against the defendant, CREXi. According to the CoStar complaint, CREXi not only has substantial financial backing from venture capital firms, including Industry Ventures, Jackson Square Ventures, Freestyle Capital, and TenOneTen Ventures, but the company has also used its Indian vendors to steal CoStars intellectual property. Three of its vendor companies are facing court proceedings in India.

Duringa timeof escalating cybersecurity threats,both domesticand foreign, theDOJsfailure to fullyenforce the mandates of theCFAA as intended byCongress anddecided bycase law precedent weakens thelaws broad legal protections against industrial espionage and cyber theft of intellectualproperty and trade secrets.

Image Source: Deposit PhotosImage ID: 68350515Author: stevanovicigor

View original post here:
DOJ Falters on Prosecution of Cybercrimes Due to Unequal ... - IPWatchdog.com

KANSAS CITY, Mo. A Blue Springs, Mo., man who watched online as a 7-year-old girl was raped and sexually abused was sentenced in federal court today for his role in a conspiracy to produce child pornography.

Justin W. Hardin, 46, was sentenced by U.S. District Judge Stephen R. Bough to 27 years and three months in federal prison without parole. The court also sentenced Hardin to spend the rest of his life on supervised release following incarceration.

On Feb. 2, 2023, Hardin pleaded guilty to one count of conspiracy to produce child pornography, two counts of receiving child pornography over the internet, one count of distributing child pornography over the internet, and one count of possessing child pornography.

According to court documents, investigators identified an individual who was posting photos and videos of his sexual abuse and rape of a 7-year-old girl online. Hardin engaged in numerous chats with this individual on Google Hangouts between Aug. 1 and Sept. 3, 2019. During the chats, Hardin viewed in real time the individuals sexual abuse and rape of the child victim. In addition, Hardin asked the individual to write Abbi Dillon (Hardins online screen name) on the childs body while the abuse was occurring.

On Sept. 11, 2019, law enforcement officers seized Hardins Apple iPhone. A forensic evaluation found evidence of the receipt and distribution of child pornography, as well as images of the sexual abuse of the 7-year-old victim.

The individual who sexually assaulted the child victim was sentenced in another jurisdiction to 25 years imprisonment for aggravated indecent liberties with a child and 155 months for rape, to be served consecutively.

This case was prosecuted by Assistant U.S. Attorney Catherine A. Connelly. It was investigated by Homeland Security Investigations and the Western Missouri Cybercrimes Task Force.

Project Safe Childhood

This case was brought as part of Project Safe Childhood, a nationwide initiative launched in May 2006 by the Department of Justice to combat the growing epidemic of child sexual exploitation and abuse. Led by the United States Attorneys' Offices and the Criminal Division's Child Exploitation and Obscenity Section, Project Safe Childhood marshals federal, state, and local resources to locate, apprehend, and prosecute individuals who sexually exploit children, and to identify and rescue victims. For more information about Project Safe Childhood, please visit http://www.usdoj.gov/psc . For more information about Internet safety education, please visit http://www.usdoj.gov/psc and click on the tab "resources."

Originally posted here:
Blue Springs Man Sentenced to 27 Years for Conspiracy to Produce ... - Department of Justice

Table of ContentsThere are several threats in existence in the world. Yet, not all these dangers are directly physical. Many threats exist in cyberspaces. As such, these persistent problems necessitate the need for cybersecurity education.

In an era defined by rapid technological advancements and an increasingly interconnected world, the significance of cybersecurity education cannot be overstated. The digital landscape presents numerous opportunities, but it also exposes individuals, organizations, and even nations to significant risks.

Cyber threats continue to evolve and grow in complexity, making it crucial for individuals to understand the importance of cybersecurity and acquire the necessary skills to protect themselves and others.

To understand the need to study internet security, this article highlights reasons for security on the internet. Acquiring this knowledge is essential in the fight against hackers and other malicious elements who consistently find new ways to propagate harm.

There are several benefits of learning cybersecurity. Below are some you should consider.

Although a lot of information is in the public domain, not every detail should be accessible to every person. Some details may not be suitable for the public, especially:

Therefore, protecting these details is essential as these contents are continuous targets for cybercriminals. Many hackers try to break digital firewalls, aiming to cause financial loss, reputational damage, identity theft, or national security compromise. With adequate internet security education, these threats can be significantly reduced.

There are lots of digital assets that require protection on the internet. These properties may include cryptocurrencies, NFTs, intellectual property, and creative work. Bad actors frequently cause data breaches and ransomware attacks, which can lead to the destruction of these assets. Acquiring the knowledge of cybersecurity tips and best practices can protect your properties from damage.

Although you may be physically detached from people, the internet is not as safe as you think. Things that happen in cyberspaces can lead to real-life problems. For example, many individuals' encounters with stalkers begin online. After finding personal details about their victims, many of these stalkers transition to physical confrontation.

If you are unaware of a problem, you would not know the importance of seeking protection. As such, internet security education helps increases awareness by highlighting the dangers hackers and other bad actors pose.

In addition, it presents ways people can effectively protect their information and digital assets, even if they are a student. Similarly, you can safeguard your grades by researching find someone to write my paper for me. Buying papers from a reliable online platform ensures you receive unique and qualitative content.

Your digital platform requires passwords, updates, and other security adjustments. Therefore, acquiring cybersecurity education helps you maintain digital hygiene through regular software updates, password management, safe email access, and secure browsing. Adhering to these practices helps protect your information and reduces the chances of cyber-attacks.

Learning about the need for cybersecurity and hoping it is implemented can completely change your mindset. It should help you cultivate an analytical, critical, and careful approach to technologies, which enables you to make appropriate decisions, anticipate threats, evaluate risks, and manage problems. Acquiring this mindset should positively impact your personal and professional life.

As most human activities require technology, the need for cybersecurity continues to increase. More employers are looking for internet security experts. Even in non-technical roles, businesses and institutions prefer hiring individuals with the right mindset on cybersecurity. As such, being proficient in this field makes you employable. If you decide to take this field as a career path, you have several options to choose from. Any way you take allows you to make a meaningful contribution to the public.

As cyberspace changes, you must continue to educate yourself about emerging threats and solutions as follows.

Cybersecurity education is crucial as it helps you protect information and safeguard digital assets. Also, it ensures safety online and offline. It increases your vigilance and awareness and enhances digital hygiene. It helps develop the required mindset and improves career opportunities. On the other hand, it helps you to advance your cybersecurity knowledge continuously.

About the Author

Mary Herd works as a programmer. She is also an online educator and tutor. Therefore, Mary frequently writes educational content related to programming and edtech solutions.

See original here:
The Importance of Cybersecurity Education - Cyber Kendra

As Mac owners, we often hear about the importance of security software in protecting our data and privacy. Avast is a popular antivirus software choice for Mac owners, but what happens when it is not working anymore? In this article, we will explore the issues you may encounter with Avast on Mac and solutions for resolving them.

Yes, Avast does work on Macs. It is a well-known antivirus program designed to protect computers from malware and other security threats. Avast offers a range of products for Mac, including Avast Security for Mac which provides protection against viruses, ransomware, and other malware threats, and Avast Premium Security which adds additional features like Wi-Fi intruder alerts and ransomware protection.

If you find that Avast is not working on your Mac, there may be a compatibility issue between the version of macOS you are running and the version of Avast installed. Heres how to update your macOS and Avast:

After updating macOS, check if Avast is working properly.

Apple has often been known to suggest that its macOS is secure and does not necessarily require an antivirus. However, in reality, no system is immune to threats. An additional layer of security is never a bad idea. As the number of Mac users grows, so does the interest of cybercriminals in targeting this platform. Moreover, even your iPhone and iPad can use an extra layer of protection.

While Avast is a reputable antivirus program, it is not the only option for Mac users. One notable alternative worth considering is Intego Internet Security. The antivirus is built exclusively for Mac, which means that its developers focus solely on Mac security. This specialization allows Intego to offer features finely tuned to the macOS environment.

Intego Internet Security offers a suite of tools, including VirusBarrier (antivirus protection), NetBarrier (firewall), and Washing Machine (system optimization tool). This provides comprehensive protection from viruses, malware, and unauthorized network access, and helps optimize your Mac for peak performance.

Intego is often praised for its low impact on system performance. This is particularly important for Mac users, as one of the attractions of using a Mac is its smooth and responsive user experience.

Time needed:2 minutes.

If updating macOS doesnt resolve the issue, you may need to reinstall Avast:

Once reinstalled, Avast should now work correctly.

While Macs are known for their robust security features, its essential to remain vigilant and take extra precautions. Avast is an excellent choice for keeping your Mac safe. However, like any software, issues can arise. Keeping macOS and Avast updated ensures compatibility and that your Mac is protected against the latest security threats. For further reading, we recommend checking out the best USBantivirus softwarethat you can use to scan to ensure that the USB drives that you use are safe and free of any viruses.

Avast for Mac does include a firewall feature in its premium offering, Avast Premium Security. The firewall monitors all network traffic and helps in blocking unauthorized access to your Mac. It acts as a barrier between your computer and the internet, controlling what can enter and leave your network.

The debate about the safety of MacBooks compared to Windows PCs has been ongoing for years. MacBooks have historically been considered safer due to the macOS operating system being less targeted by malware authors compared to Windows. This is partially because there are more Windows users, making it a more attractive target for cybercriminals. However, Macs are not immune to malware and other cyber threats. Over the years, the gap between the security of Mac and Windows has narrowed, and both systems are vulnerable to attacks if not properly protected.

Macs tend to have a reputation for being harder to hack compared to Windows computers. This is due to a combination of factors including macOS being built on Unix, which has some inherent security features, and Apples strict control over its software ecosystem. However, this does not mean that Macs are impervious to attacks.

Excerpt from:
How To Easily Fix Avast Not Working on Mac - The Mac Observer