What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-11-28 00:00:00 | Enquêter sur le risque de références compromises et d'actifs exposés à Internet explorez le rapport révélant les industries et les tailles d'entreprise avec les taux les plus élevés d'identification compromises et d'actifs exposés à Internet.En savoir plus Investigating the Risk of Compromised Credentials and Internet-Exposed Assets Explore the report revealing industries and company sizes with the highest rates of compromised credentials and internet-exposed assets. Read More (lien direct) |
IntroductionIn this report, Kovrr collected and analyzed data to better understand one of the most common initial access vectors (1) - the use of compromised credentials (Valid Accounts - T1078) (2) to access internet-exposed assets (External Remote Services - T113) (3). The toxic combination of these two initial access vectors can allow malicious actors to gain a foothold in company networks before moving on to the next stage of their attack, which can be data theft, ransomware, denial of service, or any other action. There are numerous examples of breaches perpetrated by many attack groups that have occurred using this combination, for example, breaches by Lapsus (4) and APT39 (5), among others. âThis report seeks to demonstrate which industries and company sizes have the highest percentage of compromised credentials and number of internet-exposed assets and face a higher risk of having their networks breached by the toxic combination of the initial access vectors mentioned above.âIt should be noted that having an asset exposed to the internet does not inherently pose a risk or indicate that a company has poor security. In our highly digitized world, companies are required to expose services to the internet so their services can be accessed by customers, vendors, and remote employees. These services include VPN servers, SaaS applications developed by the company, databases, and shared storage units. However, there are some common cases when having an asset exposed to the internet can be extremely risky, for example:âWhen a company unintentionally exposes an asset due to misconfiguration.When a malicious third party obtains compromised credentials of a legitimate third party and accesses an exposed asset.  âTo limit unnecessary internet exposure, companies should employ the following possible mitigations:âUse Multi-Factor Authentication (MFA) for any services or assets that require a connection so that compromised credentials on their own will not be enough to breach an exposed asset.Limit access to the asset to only specific accounts, domains, and/or IP ranges.Segment the internal company network and isolate critical areas so that even if a network is breached through access to an external asset, attackers will not be able to use that access to reach wider or more sensitive areas of the company network. âSummaryâThe following are the main findings from the collected data:âThe Services industry is by far the most exposed to attackers. Companies from that industry have the highest percentage of compromised credentials (74%). However, they have a relatively low amount of internet-exposed assets per company (34%). However, given that an average cyber loss in this industry has been shown to be about $45M, this is highly concerning (6). The Services industry (SIC Division I) is followed by Division E (Transportation, Communications, Electric, Gas, and Sanitary Services, with an average loss of around $58M), which is followed by Division D (Manufacturing, with an average loss of around $25M). The revenue range for companies with the highest number of compromised credentials is $1M-$10M, followed by $10M-$50M. A similar trend is also observed when evaluating company size by the number of employees. Indeed, companies with fewer employees have a higher share of compromised credentials. On average, the larger the company (both in terms of revenue and number of employees (7)), the greater the number of internet-exposed assets.There is a correlation between the industries and revenue ranges of companies targeted by ransomware and those with the highest share of compromised credentials.   âMethodologyâThe data for this research was collected as follows:âData regarding compromised credentials was first collected from Hudson Rock, a provider of various cybercrime data. Data was collected for the previous six months, beginning March 2023. This data | Ransomware Threat Studies Prediction Cloud | APT 39 APT 39 APT 17 | ★★★ |
|
2023-11-14 00:00:00 | Les évaluations de la cybersécurité et la fortification des défenses numériques avec CRQ évaluant les cyber-risques sont essentielles pour développer des plans d'action basés sur les données pour stimuler les défenses numériques.Découvrez quelle évaluation vous soutient le mieux pour atteindre les objectifs de cybersécurité.En savoir plus Cybersecurity Assessments and Fortifying Digital Defenses With CRQ Assessing cyber risk is critical for developing data-driven action plans to boost digital defenses. Discover which assessment best supports you in reaching cybersecurity goals. Read More (lien direct) |
The Vital Role of Cyber Assessments and Fortifying Digital Defenses âAs cyber attacks become more sophisticated and complex and regulatory bodies impose stricter cybersecurity requirements, organizations worldwide are facing mounting pressure to adopt security solutions. Understandably, many executives have reacted by implementing a multitude of security tools that supposedly complement one another and better protect organization systems.  âHowever, this strategy often falls short, preventing stakeholders from comprehensively understanding their unique cyber environments. Instead of developing an intimate knowledge of the business units most vulnerable to threats, organizations risk exposing their assets due to their adopt-as-many-tools-as-possible approach. âAfter all, providing effective protection against what remains relatively unknown is impossible.âThis widespread ignorance about the cyber environment is precisely why cyber assessments are so crucial. These evaluations offer a structured approach to identifying, analyzing, and mitigating digital vulnerabilities and provide organizations with a detailed blueprint of their most susceptible business units.âNot All Assessments Are Created Equal âWhile all cyber assessments help businesses become more aware of their cyber risk levels, itâs essential to note that not all reveal the same insights. There are various types of assessments, each tailored to meet specific goals. Some analyze overall cybersecurity posture, while others dive deeper into specific areas, such as compliance and incident response planning. âEach of the available assessments offers organizations valuable data, security leaders can leverage to make informed decisions. Before choosing which IT environment evaluation to invest in, itâs important to discuss with key stakeholders and executives what youâd like to achieve with the new information youâll discover. âDefining a Goal: Risk, Governance, or Compliance âA great place to start when determining organizational goals for the assessment is cybersecurity risk, governance, and compliance (GRC). Cyber GRC is a commonly used industry framework and set of practices that businesses of all sizes harness to manage and secure their information systems, data, and assets. Each of these components serves a specific purpose.  âRisk âA cyber risk assessment aims to identify the factors that make a company vulnerable, generate conclusions regarding the vectors most likely to be the origin of an attack (due to those vulnerabilities), and offer insights about the level of damage a cyber event would cause. âCompanies can proactively address the relevant business units by revealing threat likelihood levels. This information also helps cyber teams determine which areas they want to devote the most resources to. It\'s important to note that both qualitative and quantitative risk assessments exist. âGovernance âThe role of cyber governance is to establish a framework of policies, procedures, and decision-making processes to ensure that cybersecurity efforts are embedded within the broader company culture and align with business goals. It likewise evaluates how well cyber strategies match overall objectives, offering cyber teams an opportunity to better coordinate with other executives and teams. âAn assessment focused on governance also determines if cybersecurity responsibilities are appropriately distributed throughout the organization, such as whether employees are required to use multi-factor authentication (MFA). Other included evaluation points are training programs, incident reporting mechanisms, and event response planning, all of which directly impact an organizationâs risk level. âCompliance âOne would conduct a compliance assessment to ensure an organization | Data Breach Tool Vulnerability Threat Technical | ★★★ | |
|
2023-10-04 00:00:00 | Fortune 1000 Cyber Risk Reportkovrrrr \\\'s Fortune 1000 Report tire des motifs de quantification innovante pour fournir aux entreprises une référence pour évaluer les fréquences relatives de cyber-risques et la gravité Fortune 1000 Cyber Risk ReportKovrr\\\'s Fortune 1000 report leverages our innovative quantification models to provide companies with a benchmark for gauging relative cyber risk frequencies and severitiesRead More (lien direct) |
Executive SummaryThe growing rate of global cyber events, throughout all industries, has elevated cybersecurity governance to the forefront of corporate concern. Indeed, this rising prevalence spurred the US Securities and Exchange Commission (SEC) in July 2023 to mandate the disclosure of "material" cyber threats and incidents, albeit within a framework of somewhat ambiguous materiality definitions. Â This report leverages Kovrrâs risk quantification models to highlight the likely occurrence and relative costs of âmaterialâ cyber incidents companies might experience in the coming year, potentially eliciting consequences significant enough for SEC disclosures. Ultimately, Kovrr aims to provide insights for those companies seeking a deeper understanding of the types of cyber events and their respective financial impacts that are most likely to be disclosed in the coming years.MethodologyThe results of this report were determined via a comprehensive benchmarking exercise, using the US Fortune 1000 companies as the sample set due to the companies\' diverse range of industries. Kovrr\'s models capture a detailed representation of each company\'s technological profile and simulate yearly cyber event scenarios tailored to each companyâs exposure to risk. âThe models reveal âmaterialâ incidents in the form of data breaches, extortions, interruptions, and service provider events1. This report defines materiality as an interruption incident lasting over one hour or an incident where confidential data is breached. Smaller, non-material incidents are grouped and modeled in aggregate.âKovrrâs models produce an assessment of the likely frequency and severity of cyber breaches experienced by Fortune 1000 companies, harnessing our industry insights from previously disclosed breaches, insurance claims data, and incidents that have not been publicly disclosed.----1Event incidents (data breaches, extortions, interruptions, and service provider events) are defined at the end of the report.âKey FindingsCyber Risk Across All IndustriesThe Oil, Gas Extraction, and Mining sector exhibits the highest probability of experiencing a material cyber event, with a frequency of 0.82 events per year (or approximately one material event every 1.2 years). However, the anticipated financial impact remains relatively modest, with a median cost of $28m. In contrast, the Utilities and Infrastructure industry faces a cyber event frequency of 0.62 events per year and a substantial financial impact of $57.9m.Annual Cost ScenariosAverage Annual Loss (AAL), which combines event frequency and cost across the full range of possibilities, allows us to compare the overall risk between industries. The Finance and Real Estate industry has the highest AAL at $34.3m, owing to the substantial financial ramifications of infrequent but high-impact events. Conversely, the Construction industry has the lowest AAL at $7.3m , indicative of its relatively lower exposure to cyber risk.Event DriversThe cyber event types reviewed in this report were interruptions, third-party service provider incidents, extortion events, and data breaches. The report reveals that interruption events are prevalent across industries. Also notably, the Retail Trade industry faces an annual frequency of 0.47 for data breaches (or approximately one material incident every 2 years), while the Finance and Real Estate sector follows closely with 0.42, underscoring their heightened exposure to data-centric cyber incidents.Cost DriversHighly regulated industries, notably Finance and Retail Trade, record the highest median costs per cyber event, totaling $70.5M, due to their extensive accumulation of PII. Third-party liability, regulatory compliance, and productivity loss augment the financial impact. The report also breaks down these costs further according to event type.Secondary Loss ConsiderationsWhile the primary financial impact is evident almost immediately, secondary losses often extend widely | Ransomware Data Breach Threat Studies | ★★★ | |
|
2023-07-13 00:00:00 | Le Ransomware Threat Landscape H1-23 Ce rapport fournit une analyse complète de toutes les attaques de ransomwares connues qui ont été signalées au cours des deux premiers trimestres de 2023. The Ransomware Threat Landscape H1-23This report provides a comprehensive analysis of all known ransomware attacks that were reported during the first two quarters of 2023.Read More (lien direct) |
IntroductionâIn this comprehensive report, Kovrr collected and analyzed data on all known ransomware attacks reported during the first two quarters of 2023. The data was collected from multiple sources, all aggregated and updated regularly in Kovrrâs Threat Intelligence Database. The database includes data on many different types of cyber incidents, but this report includes only data on ransomware attacks, excluding data on any other type of attacks. The ransomware groups covered in this report all operate as a RaaS (Ransomware as a Service), a business model through which the ransomware binary and operation are sold or leased to operators, called affiliates. This means that a ransomware operation is composed of many different individuals, with separate roles, and the extortion profits are divided between them. Some individuals are responsible for initial access to the targets, others to lateral movement to interesting and profitable areas in the victim network, while others are responsible for the ransomware infection itself, and others negotiate with the victim after infection. âSummaryâThese are the main insights from the collected data:There is a 32% drop in attack amounts in H1-23 compared to H2-22. It is important to note that this drop can also be due to delayed reporting of cyber incidents by attacked companies.The top ten most active groups observed during the first half of 2023 are AvosLocker, Bianlian, BlackBasta, BlackCat, Clop, Lockbit 3.0, MedusaLocker, Play, Royal, and ViceSociety. All 10 actors accounted for 87% of attacks during this period, while the top 3 groups (Lockbit 3.0, BlackCat, and Clop) accounted for 53% of all claimed attacks during this period. The average lifespan of a ransomware group is 262 days, while the median is 167 days. In an average month, 18.3 different ransomware groups are active.The most targeted industry is the Services industry, while companies with a revenue of $10M-$50M are the most common targets. âData Collection Methods and Possible BiasesâThe data for this research was collected from Kovrrâs Threat Intelligence Database, that collects data from multiple sources, and includes information on different types of cyber incidents. Specifically for this report, data was collected mainly from ransomware leak sites, public filings of attacked companies, and news reports on ransomware attacks. The data from ransomware leak sites was collected mainly from Double Extortion (https://doubleextortion.com), a data source providing up to date information from ransomware leak sites. The rest of the data was collected using proprietary sources and methods. This data was then combined with additional sources to collect company business information and is limited to ransomware attacks that occurred and were reported in the first two quarters of 2023, between January 1st 2023 and June 31st 2023. There are several possible biases in the data that may affect the results presented in the report. Data collection for this research relied either on a company filing a notification on a ransomware attack, or a ransomware group uploading information about a victim. Therefore, in the case that a company decided not to file a notice of a ransomware attack, for example due to not being legally required to do so, it will not be included in our data. This means that companies located in countries that require data breach notifications, such as companies in the United States or the European Union, are expected to have a higher representation in our data. This is also true for companies in more regulated industries, such as healthcare. Regarding data retrieved from ransom group sites, there may be cases where an attacker did not upload data on the attack victim, as the victim paid the ransom, or for other reasons. This means that some victims that have quickly paid ransoms following an attack might not appear in our data. Additionally,, we have previously researched | Ransomware Data Breach Vulnerability Threat Cloud | APT 17 | ★★★ |
|
2023-06-12 00:00:00 | Ransomware in Transportation: une plongée profonde dans les menaces de cybersécurité et la tendance comprise l'impact de la cybersécurité sur l'aviation, la maritime et l'industrie du transport Ransomware In Transportation: A Deep Dive into Cybersecurity Threats and TrendsUnderstanding the impact of cybersecurity on aviation, maritime, and transportation industriesRead More (lien direct) |
Ransomware attacks have become a significant cybersecurity issue, causing severe financial loss and reputational damage for those affected. The use of sophisticated techniques and various delivery channels, such as phishing emails and software vulnerabilities, have made these attacks more challenging to prevent. This report provides a short synopsis of data and statistics from Kovrrâs cyber incident database spanning the previous three years.âMaritimeThe maritime industry involves all activities related to sea transportation, including the operation, maintenance, and management of ships and other vessels. It encompasses both commercial and military maritime activities, such as cargo and passenger shipping, offshore oil and gas exploration, and naval operations. The maritime industry is critical to global trade, supporting the movement of goods and commodities around the world. The industry is also subject to international regulations, ensuring safety, security, and environmental protection. Advancements in technology and increasing concerns about sustainability are shaping the future of the maritime industry.Main ransomware actors 2020-2022: 1. LockBitLockBit is a ransomware gang that emerged in 2019. They use advanced techniques to encrypt files and demand large ransoms. LockBit has targeted various organizations globally and is known to steal sensitive data and threaten to release it if the ransom is not paid. The group is believed to operate from Russia and is linked to other cybercriminal organizations in the region.2. REvil (Sodinokibi)Revil is a prominent ransomware group that has been active since 2019. They are infamous for their sophisticated attacks on high-profile organizations, including celebrities and large corporations. The group is known for their double-extortion tactics. Revil is believed to be a Russian-speaking group, and their ransom demands are usually in the seven-figure range. The group has also been linked to other cybercriminal organizations and is known for their use of zero-day exploits to bypass security measures.3. Mespinoza (Pysa)Mespinoza is a relatively new ransomware gang that appeared in 2020. They are known for their targeted attacks on high-profile organizations and their use of double-extortion tactics. Mespinoza\'s ransom demands are usually in the six-figure range, and they threaten to release sensitive data if the ransom is not paid. The group is believed to be based in Eastern Europe and has targeted industries such as healthcare and education.âDistribution of Company Revenue Range According to the Amount of Ransomware Attacks:âââââââAviationThe aviation industry encompasses all activities related to air transportation, including the design, manufacture, operation, and maintenance of aircrafts. It includes both commercial and military aviation, as well as the infrastructure and regulations that support air travel. The aviation industry has a significant impact on global commerce and tourism, facilitating the movement of people and goods around the world. The industry is highly regulated to ensure safety and security, and technological advancements continue to shape the future of air transportation.âMain ransomware actors 2020-2022: 1. LockBitLockBit is a ransomware gang that emerged in 2019. They use advanced techniques to encrypt files and demand large ransoms. LockBit has targeted various organizations globally and is known to steal sensitive data and threaten to release it if the ransom is not paid. The group is believed to operate from Russia and is linked to other cybercriminal organizations in the region. They were also main actors in the Maritime industry. 2. AvaddonAvaddon is another relatively new ransomware gang that appeared in early 2020. They use advanced double-extortion tactics, targeting various industries and operating as a Ransomware-as-a-Service. Avaddon\'s ransom demands are usually high, and is believed to be based in Russia or Eastern Europe.3. Maz | Ransomware Malware Threat | ★★★ | |
|
2022-10-25 00:00:00 | Importance des modèles de risque validés par l'assurance pour quantifier le temps de cyber-risque, les modèles de risque de haute qualité deviennent de plus en plus précis en raison de la validation et de l'étalonnage continus. Importance of Insurance-Validated Risk Models to Quantify Cyber RiskOver time, high-quality risk models become increasingly accurate due to continuous validation and calibration.Read More (lien direct) |
By its nature, cyber risk is dynamic. New events happen and evolve all the time, making it difficult for enterprises to financially quantify their financial exposure to cyber attacks. Around two years ago, for example, distributed denial-of-service (DDoS) attacks were making headlines, and now ransomware has come into heightened focus. It\'s reasonable to believe that other types of attacks will emerge in another two years and continue to change thereafter.Yet even though cyber risk evolves, itâs possible to understand what the financial implications of an attack might be by using whatâs known as a cyber risk quantification (CRQ) model. These models analyze past events to predict what the financial impacts of future cyber events might be.But not just any model will do. Enterprises need insurance-validated risk models, meaning the model is strong enough and has both the breadth and depth of data to be trusted to quantify cyber risk across an insurerâs large portfolio. Enterprises need this level of sophisticated models, which are continuously validated at scale, if they want to be prepared. Otherwise, they may be using a stagnant quantification method that limits their ability to account for their financial cyber exposure to current and future new threats.Modeling the UnknownPart of quantifying something dynamic like cyber risk means having a robust modeling framework. Using whatâs known as impact-based modeling allows for quantifying âknown unknowns.â In other words, a modeling framework that can reflect new emerging threats and utilize risk models that tie together multiple areas of risk â for example, certain events affecting an enterprise, the severity of past attacks, the frequency of events, etc. â can come to a conclusion about the financial impact of future events. Even if the specific type of attack remains unknown, enterprises can at least have a sense of what their exposure would look like by relying on impact-based modeling, which provides an estimation for potential financial losses that will be driven by cyber events. âContinuous Validation and Calibration Over time, high-quality risk models become increasingly accurate due to continuous validation and calibration. As new cyber threats emerge, so too does a deeper understanding of event footprints, the technology or third party service provider involved, and the propagation pattern of the infection. While itâs important for companies to be aware of evolving cyber threats and types of attacks from a risk management perspective, such as to educate employees and mitigate attacks, putting a financial quantification on cyber risk is the most efficient way to understand âhowâ the attack landscape can affect a specific company. A $1 million loss, for example, is still $1 million whether it came from ransomware or a DDoS attack. By focusing on an impact-based approach, the emphasis is still on quantifying the loss, rather than trying to predict exactly how cyber events may evolve. A cyber risk quantification model can also be calibrated by looking at what the model projected and seeing how that aligns with events that actually occur over time. Doing so requires data at scale. If you only know the financial implications of events that occurred at, say, three companies, then that doesnât give much information to feed and calibrate the model. Yet if there are thousands of events to analyze, such as by looking across an insurerâs entire portfolio, that provides a much better view into whatâs happening across the cyber risk landscape. From there, this data can be used to improve the model. âBreadth and Depth of Data SourcesAs alluded to, a robust cyber risk quantification model requires data scale. Yet itâs important to have both a significant breadth and depth of data sources. Doing so enables a model to understand whatâs happening across indust | Ransomware Prediction | ★★★ | |
|
2022-07-28 00:00:00 | 2022 semble être sur la cible de l'année la plus basse des violations signalées par les grandes sociétés américaines dans les six premiers mois de 2022, les grandes sociétés américaines [de revenus> 2 milliards] ont déclaré le moins de violations de données au cours des cinq dernières années. 2022 seems to be on target for the lowest year of reported breaches by large US corporationsIn the first six months of 2022, large [Revenue >2bn] US corporations reported the fewest data breaches in the past five years.Read More (lien direct) |
âThe number of data breaches reported in the first 6 months of 2022 has put this year on track to be the lowest year of reports in the last 5 years for large [Revenue >2bn] US corporations. By looking at the rate at which data breach events have been reported so far this year, we predict that the number of events reported is expected to be15-20% of the number of breaches reported in 2021âPossible causes:Increased reporting delays: But the time to report has shown a decreasing trend over the last 4 yearsGenuine improvement in cyber defenses preventing data exfiltration Reduction in reporting requirements, or public disclosure preventionIn this analysis we look at all the reported cyber events which involve data exfiltration (data breach), allocated to the year in which the event started. Comparing the number of events reported at each point during the year then gives us an indication for the rate which can be compared between years.The data and populationThe data collected represents public reports of data breaches from US companies with an annual revenue above $2bn (Excluding public services).The data used includes breach events reported up to end of Q2 2022It is this area where the cyber reporting requirements are highest, there is a high level of data available. It is important to note that this will not be all events which occur, only those disclosed, but by looking for changes in the behavior we can look at the potential causes.Overall Breach CountAs of the end of Q2 2022, we have seen 18 breach reports of events occurring in 2022 compared to the 160 cyber events reported from 2021, and 292 from 2020. While we are only 50% through 2022, the number of events reported so far from the first half is 25% of the 2021 total reported at the same point through 2021. To fully compare 2022 against prior years we need to take into account a number of factors:Events not yet reported: some events have occurred but have not yet been reported either because they have not yet been discovered, or because the have been discovered but not publicly disclosedEvents not yet occurred: events which have yet to occur, in the second half of 2022 (and have not yet been reported)âââHow the year unfoldsTo explore how 2022 is emerging, we can look at the rate at which events are being reported. That is to show not just the total report to date, but how the total number of events reported in a year has emerged from the start of the year. To do this we plot the cumulative number of events reported vs the number of days from the start of each incident year.What we see is an indication of how many incidents have been reported from each year have been reported after the same number of days. A steep curve indicates a greater number of incidents reported per month.** Note that the event counts are lower because we do not have exact disclosure dates for all events.ââFrom the chart we can see that the number of reported cyber incidents after 6 months (180 days) of experience is low for 2022 compared with all other years since 2015. This leads us to believe that 2022 is on track to have a very low number of overall incidents reported.There could be a few explanations for thisReporting Delay: The time taken to report incidents has increased in 2022, and there will be a correction in the later part of the yearCybersecurity Investment: The overall number of incidents reported will be lower due to improvements in security postureRegulatory Action: the overall number of incidents reported will be lower due to changes in how the events are reported (or required to be reported)âReporting DelayTo consider if the low reported number of events in 2022 is being driven by an increase in a delay between a cyber event starting and it being reported, we have looked at the trend over the last 10 yearsThe chart below shows the trend over the last 10 years.âââThere has been a steady reduction in median reporting delay from 204 days in 2017 to 63 days | Data Breach Prediction Cloud | ★★★ | |
|
2022-07-11 00:00:00 | Why Hackers Love Credentials: Parsing Verizonâs 2022 Breach ReportWith CRQ, itâs possible to make decisions about how much of a priority to place on credential risk, and plan a budget accordingly.Read More (lien direct) | The 2022 Verizon Data Breach Investigations Report (DBIR), the fifteenth such report in as many years, leads off with a startling statistic: Credentials are the number one overall attack vector hackers use in data breaches. Use of stolen credentials accounts for nearly half the breaches studied by Verizon, far ahead of phishing and exploit vulnerabilities, which account for 19% and 8% of attacks, respectively. Botnets, the fourth most common entry path for hackers, represent a mere 1% of attacks.Credentials are the number one attack vector in several categories of attack covered in the report. In cases of web application attacks, for example, Verizon research attributes over 80% of attacks attributed to stolen credentialsâsurpassing exploited vulnerabilities and brute force attacks, which occur in fewer than 20% of cases. Forty three percent of Business email compromise (BEC) involve the use of stolen credentials as the way into the target organization.Why credentials are such a popular targetIf youâre a hacker, stealing user credentials makes a great deal of sense. After all, with valid credentials, you can legitimately gain access to networks and applications. Thereâs not a lot of hacking to do. You just log in like you belong there. Once youâre in, you enjoy the same system privileges as the user whose log in you have swiped. If that user is an administrator, all the better. You can modify systems, delete data, create new user accounts and on and on.Additionally (and unfortunately), legitimate user credentials are not that hard to get. In some cases, hackers donât even have to engage in elaborate cyberattacks to get their hands on them. They can just buy them on the dark web. For not a lot of money, a low-skilled hacker can purchase real, current credentials for corporate system users.âââThe scale of the credential vulnerabilityAccording to the Verizon report, credentials are not just a popular mode of attack. They are also among the most commonly breached forms of data. In system intrusion attacks, for example, credentials are the number one type of data compromised, targeted in 42% of attacks. In social engineering attacks, credentials are also the most popular targets, stolen in 63% of breaches.Of course stolen credentials are scary, but what are the true costs behind these types of attacks? Analysis of data from Kovrrâs cyber incidents database, which contains both threat intelligence and financial data on a vast collection of cyber incidents show specific industries being specifically targeted by a breach of credentials.The table below represents the percentage of total stolen credentials from a specific industry out of all stolen credentials across industries i.e., if 100 records were stolen globally, 32.94 of these were stolen from the education industry. âThe fact that education makes up such a large portion of total can be attributed to any number of factors. We assert that two of these are the most important: the large number of users that exist within the organization, and their tendency to change very often. Combined with the COVID-19 pandemic, and the sudden transition to remote studying and teaching, that factor became even more severe.The other industries that are most often victims of credentials theft (Information,Public Administration) are all natural targets for credential theft. By their nature, not only do they handle many user credentials, but they are also prime targets for spreading to new organizations.âCosts Behind Stolen Credentials The most common motivation for credential theft is ransomware. It is one of the most useful leverages used, after an organization has been compromised, in order to monetize on the access achieved by the attacker.âIf we are to analyze the financial impact of a ransomware attack, we can see it consists of several components: the obvious extortion cost (in case the ransom is paid), response and restoration costs, le | Ransomware Data Breach Vulnerability Threat | ★★★ | |
|
2022-01-19 00:00:00 | Quelles tendances émergentes de cybersécurité devraient-elles être conscientes? Alors que le monde devient plus connecté numériquement, les entreprises doivent être conscientes des risques croissants de cybersécurité. What Emerging Cybersecurity Trends Should Enterprises Be Aware Of?As the world becomes more digitally connected, enterprises need to be aware of the growing cybersecurity risks.Read More (lien direct) |
As the world becomes more digitally connected every year â and with the pandemic further accelerating digital transformation â all types of enterprises need to be aware of the growing cybersecurity risks that come with this shift. In Europe, for example, significant attacks on critical sectors more than doubled in 2020 compared to 2019, according to data from the European Union Agency for Cybersecurity, as reported by CNN. In 2021, the picture arguably became even bleaker around the world, with major ransomware attacks causing disruption to companies in industries ranging from energy to meat processing.In the first six months of 2021 alone, ransomware-related reported activity in the U.S. had a higher total value ($590 million) than all ransomware-related reported suspicious activity in the U.S. in 2020, according to the U.S. Department of Treasury\'s Financial Crimes Enforcement Network (FinCEN). The total number of suspicious events filed in the first six months of 2021 in the U.S. also exceeded all of what occurred in the country in 2020 by 30%, the agency reports. Yet itâs not just ransomware thatâs wreaking havoc. Enterprises also need to be prepared for cyber threats like denial of service (DoS) attacks, where a flood of network activity can interrupt servers, thereby causing business interruption. Cisco predicts that distributed denial of service (DDoS) attacks (a subset of DoS, which involves using multiple devices to send a flood of traffic, as opposed to just using one device with a DoS attack) globally will roughly âdouble from 7.9 million in 2018 to 15.4 million by 2023.âIn addition to preparing for these types of cyberattacks, enterprises will also increasingly need to be aware of and comply with privacy-related regulations. As governments around the world try to bolster their cybersecurity responses, they are passing or at least considering new rules and guidance around how companies need to handle sensitive data and privacy issues. Amidst this preparation, enterprises also need to recognize that cybersecurity plans arenât foolproof, especially as attacks evolve. That means assets could be at risk even with solid defenses in place. So, enterprises increasingly need to think about not just how to prevent cyber attacks but also consider the dollar-value cost of risk, given that events will inevitably occur. This process, known as cyber risk quantification â a form of financial quantification â helps enterprises think about and discuss cyber risk in definitive business terms. Knowing how much money is at stake and how different cyber events could affect revenue and profit can help businesses prioritize defenses and take mitigating action like securing cyber insurance. In this report, weâll take a closer look at these emerging cybersecurity trends that enterprises should be aware of. Understanding these areas can help organizations potentially improve their risk management, both from a cybersecurity and overall governance standpoint. ââEvolving Ransomware RisksWhile ransomware is not a new type of threat, the scale and intensity of ransomware continue to broaden. Enterprises large and small, across all types of industries, need to be prepared for these cyber attacks.For one, ransomware-as-a-service, âwhere ransomware variants are licensed to individuals and accomplices to execute attacks,â as Reuters explains, has been on the rise. Based on suspicious activity reports, FinCEN identified 68 ransomware variants in the first half of 2021.âThe resulting emergence of new attackers has led to increased uncertainty and volatility for companies in responding to attacks due to the lack of information on the growing number of ransomware threat actors,â adds Reuters.Part of the problem is also that ransomware attacks arenât just being launched on an ad-hoc basis by individuals. Instead, thereâs in | Ransomware Tool Threat Prediction Cloud | ★★★ | |
|
2021-12-20 00:00:00 | 7 Rapports qui peuvent vous aider à comprendre l'assurance contre le paysage de cyber-assurance continue de faire face à des marges d'érodage, les assureurs ayant du mal à quantifier les risques 7 Reports That Can Help You Understand the Cyber Insurance LandscapeCyber insurance continues to face eroding margins, with insurers having trouble quantifying the risks enterprises faceRead More (lien direct) |
The explosion of ransomware attacks and cybersecurity risk as a whole have made life tough for so many organizations across industries globally. Enterprises need to face these risks in whatâs often a challenging business market anyway, and turning to potential solutions like cyber insurance comes with its own difficulties. The cyber insurance market continues to harden, with insurers facing eroding margins and often struggling to quantify the risk enterprises face. But itâs not all bad news. Cyber insurance companies and other enterprises who want to know the cyber landscape better have a wide range of resources to turn to. As the market matures, many quality research reports have emerged, including several that provide overviews and predictions for what will happen within cyber insurance and cybersecurity as a whole for 2021 and beyond. But which of these research reports should you read to strengthen your cyber knowledge and feel more prepared for what may come? In this article, weâll provide a brief overview of seven of the top cyber insurance research reports for you to consider diving into more.1) Munich Re: Cyber insurance: Risks and trends 2021In the report âCyber insurance: Risks and trends 2021,â the reinsurer Munich Re shares the results of the companyâs first âGlobal Cyber Risk and Insurance Survey.âSome of the key findings include that amidst rapid digitization within companies, approximately four out of five C-suite executives do not think their company has adequate cyber threat protection. The top cyber threats feared by this group include fraud, data breaches and ransomware. The survey also finds gaps in cyber insurance knowledge, but the market could soon grow, with 35% of C-level respondents likely to soon take out a policy.Munich Re also notes the importance of cyber risk accumulation. While the company mentions its own accumulation models, âit is important to monitor the market and seek external expertise from different vendors in order to assure state of the art accumulation management,â the company says.2) Aon: Cyber Insurance Market Insights Q1 2021In one report from Aon, âCyber Insurance Market Insights Q1 2021,â the firm highlights how the cyber insurance industry is changing amidst evolving cyber risks. In particular, the company highlights how issues such as ransomware, silent cyber exposure and the SolarWinds event have affected the cyber insurance market.With SolarWinds, for example, the âtheft of investigative tools from a globally recognised cyber security and forensics firm is likely to lead to improved hacking tools in the hands of cyber criminals,â notes Aon.Amidst this backdrop, Aon sees more hardening within the market through 2021 and 2022. Insurers are looking closely at their underwriting practices while also assessing retention, limits and premiums to figure out the right mix to make cyber insurance viable. 3) Aon: 2021 Cyber Security Risk ReportAnother report by Aon, the â2021 Cyber Security Risk Report,â focuses more on the overall risk landscape from an enterprise perspective. In particular, Aon highlights four main cyber-related risks facing organizations today:Digitization: As companies rapidly digitize, particularly with Covid-19 changing the way many companies work, only 40% say they have âadequate remote work strategies to manage this risk.âThird-Party Risk: Organizations need to be aware of risks in their supply chains and among the various vendors they work with, yet only 21% have implemented âbaseline measuresâ to oversee third-party risk.Ransomware: Ransomware attacks have been prevalent and damaging recently, and many are unprepared. Less than one-third of organizations say theyâve implemented âadequate business resilience measuresâ to handle this risk.Regulation: As stronger data security laws come into place, o | Ransomware Tool Threat Prediction | ★★★ | |
|
2021-10-19 00:00:00 | A Sneak Peek into Kovrrâs Data SourcesA sneak peek into Kovrr\\\'s unique data sources used exclusively for modeling purposesRead More (lien direct) | Modeling impacts from cyber events requires extensive understanding of the cyber threat landscape. A core aspect of Kovrrâs cyber risk modeling data pipeline combines unique data sources to better inform the data points taken into account when building out the frequency and severity of cyber events. Access to these data sources is derived via partnerships reserved for Kovrrâs use exclusively for modeling purposes, developed among others with Israeli cybersecurity emerging vendors which continuously bring new exciting data and create a unique ecosystem. Hudson RockHudson Rock is a cybercrime intelligence startup with a database composed of millions of machines compromised in global malware spreading campaigns. The data is augmented monthly with tens of thousands, to hundreds of thousands of new compromised machines. Data includes Info Stealers, ransomware bots and other types of malware. Hudsonâs high-fidelity data help protect employees, partners, customers, and digital assets with unprecedented granularity of threat vectors including Ransomware, Business Espionage, Breaches & Network Overtakes.âHow Kovrr uses this dataâKovrr has extended capabilities to recognize ransomware trends and emerging techniques. This information is crucial for formulating accurate attack distributions. Kovrr leverages the data in order to enrich different parameters of its datasets. We can improve our understanding of the target audience profile by applying additional analytics on the data, Kovrr can deduct the entities who have suffered from the breach, this information may include location, job description and company. We also have extended information on the attack vector. Kovrr uses metadata regarding the attack to understand the attack vector used to install the malware, which is critical to understanding attack and exploitation patterns. Cynerio Medical and IoT devices in healthcare environments grow more numerous and vulnerable every day, and mitigating their risk is becoming more complex. The Cynerio platform uses a granular inventory classification taxonomy which tracks device types, functions, vendors, models, serial numbers, firmware/OS, MAC, and IP+ methods of medical devices. Drilldowns into VLANs, ports, kernels, HW, services, browsers, and FDA class, classification, and recalls are also provided. Cynerio then leverages this data to monitor, verify, and reduce the risk of IoT and IoMT device vulnerabilities through direct communication with vendors, third-party solution providers, and cybersecurity governance organizations.How Kovrr uses this dataKovrr has secured unique cyber information sources per industry to have more detailed data reflecting the cyber risk landscape. Kovrr receives aggregated data on compromised medical IoT devices and relevant vulnerabilities, corresponding to companiesâ geographic location, size and industry that shows instances of potential attack per type of device. For this specific source, Kovrrâs extended insights surrounding healthcare cybersecurity feeds into the industry exposure database. In turn this provides more accurate data on the frequency and severity of events affecting organizations in the healthcare industry and assists in better analysis of understanding a companyâs cyber resilience.Sedric.me Sedric integrates into all communication systems of organizations and provides cyber risk management teams with a solution to securely store company interactions with internal and external users. By monitoring a wide range of interactions, Sedric uses AI to detect intentions related to regulatory, compliance, and company misconduct without the need for explicit exact phrase or rule matches.  The platform securely cleans ,encrypts and stores data associated with GDPR, PCI, PHI, and other violations before it enters a companyâs system.âHow Kovrr uses this dataKovrr receives aggregated data of sensitive data records corresponding to companiesâ g | Ransomware Malware Vulnerability Threat Prediction Medical | ★★★ | |
|
2021-10-06 00:00:00 | Using CRIMZON⢠to assess cybersecurity hazards with an insurance portfolioThe CRIMZON⢠framework allows insurance carriers to gain insights into the hazard of cyber without needing to run external scans.Read More (lien direct) | In recent years, the rise to prominence of cyber risk, both as a peril and as a line of business, has created opportunities and threats to insurance companies in equal measure. Insurance executives, exposure managers and underwriters need now more than ever to understand, quantify and manage their exposures, in order to sustain profitability and to protect their balance sheets. By definition, cyber events occur due to vulnerable technology. It is therefore tempting to conclude that understanding these exposures requires knowing the full map of technologies and service providers an insured relies upon, including the granular details on how data is stored and accessed. The issue with this approach is that while this information is certainly valuable to assess the risk, it is challenging to obtain atscale due to the difficulties that arise from accessing and analyzing the data properly. Help in solving this dilemma is provided by using techniques to analyze the cyber footprint of an insured,mapping the technologies and service providers most exposed to the external world. The premise being that such analysis provides insurers with the same point of view of potential threat actors. It is fair to say this is currently the gold standard of cyber hazard analysis. Insurance carriers with large affirmative cyberbooks rely on external scans for underwriting as well as for portfolio management, often augmenting this data with information provided by the insured, mostly from third-party vendors. A direct relationship with the insured is the best way forward to understand their level of risk, however,itâs disingenuous to assume every stakeholder in the insurance industry is able to access the same level of data. Within the same company, portfolio managers often donât have access to the same level of details as underwriters, and across entities reinsurers rely on their clients passing on data, which requires overcoming hurdles around data confidentiality as well as technical limitations on data volumes.Moreover, external scans are expensive and might not be a viable option when cyber coverage is offered as an endorsement on other lines of business.Assessing hazard insured by insured is therefore not always possible and cannot be expected to be the only way. Kovrr has developed an open framework, CRIMZON, which allows insurance stakeholders to understand hazard without running expensive analysis tools and collecting only a minimum amount of data points. This framework is designed to answer basic questions on cyber risk accumulations and estimates of Probable Maximum Loss (PML). It allows full flexibility around the type of risk analyzed,whether the focus is ransomware or cyber liability, and is consistent and compatible with the catastrophe model methodology deployed in our probabilistic cyber risk quantification solution.âââMr. Hetul Patel, Advisor to Kovrr and Chief Actuary atLiberty Mutual Re said: âCRIMZON⢠are a novel way to address the very real need for better cyber risk aggregation.Recent events have clearly highlighted that cyber loss events canât be managed through the traditional tools that reinsurers currently use. CRIMZON have the potential to create a market standard, similar to the way cresta zones are used for natural catastrophe modelling. The use of which goes beyond aggregate and risk management, and into outward reinsurance purchasing and attracting third party capital.â ââGrouping Companies Together by CRIMZONâ¢Kovrrâs open framework Cyber Risk Accumulation Zones (CRIMZONâ¢) groups companies together based on three characteristics: industry, location and entity size. This framework for grouping is based on research that shows that companies sharing these characteristics tend to share cyber risks. Cyber attacks would then be more likely to spread through companies within the same CRIMZON rather than hitting companies randomly.For example, a cyber attack might b | Ransomware Tool Threat | ★★★ | |
|
2021-09-12 00:00:00 | Règlements et ransomwares: un aperçu rapide de la vue d'ensemble de ce que les entreprises doivent savoir sur les ransomwares et les réglementations connexes. Regulations & Ransomware: A Quick OverviewAn overview of what enterprises need to know about ransomware and related regulations.Read More (lien direct) |
As cybersecurity threats continue to evolve, ransomware has recently come into focus as one of the more prominent and challenging types of attacks to deal with. Not only do companies need to face the security implications of having their data fall into the hands of cybercriminals, but there can be significant costs around paying ransoms and/or recovering systems and files. Plus, paying ransoms can raise some ethical if not legal issues. There are already several existing regulations that enterprises need to keep in mind if hit with a ransomware attack. And as the risk grows, a number of new regulations are under consideration around the world.In this brief overview, weâll explore what enterprises need to know about ransomware and related regulations.What Is Ransomware?Before diving into what to do about ransomware and what regulations to follow, itâs important to understand what ransomware is.âRansomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption,â explains the U.S. Cybersecurity & Infrastructure Security Agency (CISA).In other words, ransomware can lock a user out of their own files/systems, which can bring work to a halt. Even if the ransom is paid and everything gets unlocked, itâs possible that the cybercriminals stole data meanwhile. While some of the more headline-grabbing attacks have been at large, well-known companies, ransomware can essentially affect anyone, regardless of size, industry or location.How to Reduce the Risk of RansomwareAlthough ransomware is on the rise, there are still several steps organizations can take to reduce the risk of a ransomware attack or at least mitigate the damage.âAs with all risks posed by external actors, the likelihood that a ransomware attack is successful can be drastically reduced by tightening the security of the data controlling environment,â notes the European Data Protection Board (EDPB).From updating software and systems with appropriate security patches, to using anti-malware software or related monitoring services, there are many cybersecurity best practices that can potentially keep ransomware out, as the EDPB highlights.If ransomware does take hold, having complete backups can help. As the EDPB notes, the impact of ransomware âcould effectively be contained,â by resetting systems to wipe out the ransomware and then âfixing the vulnerabilities and restoring the affected data soon after the attack.âOrganizations can also get a better handle on ransomware risk via cyber risk quantification (CRQ), such as through Kovrrâs insurance-validated risk models. CRQ works by analyzing factors such as past cyber events and the technologies and service providers that a company uses to then quantify what companies might lose if a cyber attack like ransomware occurs. Part of being prepared means knowing how much is at stake financially, and CRQ can help organizations focus on the areas that present the largest financial risk. âWhat Ransomware Regulations Exist?Current ransomware regulations differ around the world, so the specific rules an enterprise needs to follow depends on factors like what markets they operate in and whether they fall under certain jurisdictions.Communicating AttacksOne of the more notable rules that relates to ransomware is the EUâs General Data Protection Regulation (GDPR), which can still apply to companies outside Europe, such as those that have customers in the EU. Under GDPR, explains the EDPB, a personal data breach needs to be reported to relevant authorities and potentially to the people whose data gets exposed. So, for example, if a ransomware incident involves a cybercriminal locking up files that contain personal information, such as financial or medical records, then the affected company may need to report that to those affected.In the U.S. the | Ransomware Data Breach Malware Vulnerability Prediction Medical | ★★★ | |
|
2021-07-27 00:00:00 | Un été des exploits d'été des exploits de ransomware qui ont eu lieu à l'été 2021 A Summer of ExploitsA summary of ransomware exploits that took place in the summer of 2021Read More (lien direct) |
Over the past few weeks several dramatic vulnerabilities were exposed in different ubiquitous products and platforms, including the Microsoft Windows OS, the Solarwinds Serv-U Managed File Transfer and Serv-U Secure FTP products, and Kaseyaâs services.â1. Print Night Mare2. Print Nightmare Update3. Kaseya\'s Clients Important Notice4. CISA\'s public alert5. Reuters Article about Data ransom6. Microsoft\'s emergency patch fails7. SolarWinds Zero-day vulnerability8. SolarWinds alerted by Microsoft9. Kaseya restores servicesâSummary of the EventsâKaseyaWhat happened? On July 2nd, a cyber attack was launched against the IT solutions company Kaseya. Kaseya provides IT solutions including VSA, a unified remote-monitoring and management tool for handling networks and endpoints. In addition, the company provides compliance systems, service desks, and a professional services automation platform to over 40,000organizations worldwide.The cyberattack has been attributed to the REvil/Sodinikibi ransomware group whose ransomware was first detected in April 2019. The groupâs usual propagation method is phishing emails containing malicious links. Some of the groupâs most prominent victim industries in the last two years were healthcare facilities and local governments. REvil has offered a decryption key, allegedly universal - able to unlock all encrypted systems, for the âbargainâ price of $70 million via bitcoin (BTC) cryptocurrency. On July 13th, all of REvilâs online activity stopped and the groups data-dump websites were shut down without further information, leaving the victims of their latest attacks hostage with encrypted files and no valid payment address or decryption keys.Who was impacted? On July 2nd Kaseya claimed that the attack affected only a small number of on-premise clients, In a press release published on July 5th the company estimated that the number of clients impacted by the attack is between 800 and 1500 businesses.âPrintNightmareWhat happened? On June 8th, Microsoft published a CVE advisory for a vulnerability in the Windows PrintSpooler service which is enabled by default in all Windows clients and servers across almost all modern Windows versions. This vulnerability was initially categorized as a low severity local privilege escalation (LPE) vulnerability by Microsoft and a patch for it was released on June 21st. A week later, researchers published a successful PoC of the exploitation and claimed that the vulnerability is in fact a high severity RCE and PE vulnerability. On July 1st, a separate vulnerability in the same Windows Print Spooler service was discovered, similar to the first vulnerability, this new âPrintNightmareââ was also a RCE andLPE vulnerability that would allow attackers system privileges with which they could install programs; view, change, or delete data; or create new accounts with full user rights.After the high severity of the vulnerability was acknowledged, Microsoft published an out-of band patch on July 6th and claimed to have fully addressed the public vulnerability. However, on July 7th researchers presented additional successful PoCs and claimed that the patch can be bypassed.Who was impacted? This vulnerability affects all modern unpatched client and server versions of Windows.According to Kaspersky, the vulnerability was already exploited but no further information regarding victims is currently available.âSolarwindsWhat happened? On July 9th, Solarwinds published an announcement claiming that they were informed by Microsoft of an exploited zero-day vulnerability in their Serv-U Managed File Transfer and Serv-U Secure FTP products.On July 10th, Solarwinds released a patch to fix the vulnerability and claimed that this event is unrelated to the Solarwinds supply chain attack that occurred in December of 2020.The vulnerability allows an attacker to run arbitrary code with privileges, and then install programs; view, change, or delete data; or | Ransomware Tool Vulnerability Studies | ★★★ | |
|
2021-04-22 00:00:00 | Travailler à domicile: une année en revue les entreprises sont obligées de permettre à leurs employés de travailler à distance, la surface d'attaque devient plus large. Working From Home: A Year in ReviewAs companies are obliged to allow their employees to work remotely, the attack surface becomes broader.Read More (lien direct) |
Cyber Trends, Risks and the Global PandemicAs we mark a year of working from home through the global pandemic, this is a good time to discuss and delve into the IT changes and trends in our day-to-day work environment and their implications for user privacy, corporate cyber security and cyber insurance. The 3 main categories of software and applications that saw a significant increase in usage over the past year include:Video Conferencing and online communication platformsVPNs and Remote Desktop (RDP) softwaresTwo Factor (2FA) and Multiple Factor Authentication (MFA) applicationsWorking from home has increased the usage of the aforementioned technologies as well as other similar applications, broadened the attack surface and provided new opportunities for various malicious actors as there are more external-internal connections compared to the past, meaning more types of services to keep track of and monitor. This also implies a heavier traffic load due to video streaming, database connections and more. âEasier communication, but at what cost?Away from our colleagues and offices, employees have had to adapt quickly to various methods of online communication and meetings in order to keep things running, whether itâs Zoom, Webex, Microsoft Teams, Google meet or any other platform, co-workers are now able to chat, share video and documents easily from computers and phones. Right from the start of the pandemic, Zoom solidified itself as the dominant platform for video conferencing with an increase of 67% in usage between January and the middle of March 2020. By April 2020 it already had more than 300 million daily Zoom meeting participants in comparison to 10 million meeting participants in December 2019.(1)Number of daily Zoom users, December 2019 - April 2020This convenience comes with significant underlying risks to users and corporate networks, as poorly implemented encryption protocols and other security measures can result in unauthorized participants access to otherwise personal or confidential calls. This sort of intrusion, commonly referred to as âZoom Bombingâ, can be at best innocent trolling and cause annoyance but at worst allow access to a malicious actor who can gather sensitive information on the company for espionage purposes(2), harvest participants\' credentials and other PII and leak the callâs content and video as well as use the meeting chat to send phishing links which could escalate to a full-blown ransomware attack on the company\'s network(3). This sort of attack can be carried out by an attacker exploiting vulnerabilities such as (or similar to) CVE-2019-13450(4) which would allow them to forcefully join a meeting. âMultiple Factor Authentication - double the safety but not without risks Multiple Factor Authentication (MFA) and Two Factor Authentication (2FA) have been adopted in recent years as an additional security tool to ensure the safety of oneâs accounts and personal information. As previously mentioned, the migration to a remote work routine necessitated a secure and verified method for each employee to access their companyâs assets online on a daily basis. This basic work necessity came with restrictions and guidelines such as remote desktop applications to create a virtual work environment and 2FA applications in an attempt to strengthen the companyâs cybersecurity posture. By May 2020, around 70% of British businesses were already using some type of MFA and a VPN for better cyber security risk management of the changed work environment(5).There are numerous ways by which MFA or 2FA methods can be bypassed, either through brute force (if the requested code is between 4-6 numbers), social engineering or a conventional session management in which attackers use the password reset function. This is due to the fact that 2FA is often not implemented on the systemâs login page after a password reset.VPNs and RDPs - work from anywhere and be attacked from anywhereVi | Ransomware Data Breach Malware Tool Vulnerability | ★★★ | |
|
2021-03-24 00:00:00 | Cyber ILS: Les gestionnaires ILS ILS à risque ILS suivant recherchent de nouvelles opportunités, le cyber-risque devrait être une considération clé pour étendre le marché ILS. Cyber ILS: The Next ILS Risk ClassAs ILS managers look for new opportunities, cyber risk should be a key consideration for expanding the ILS market.Read More (lien direct) |
The Next ILS Risk ClassâInsurance linked securities (ILS) are an asset class comprised of catastrophe bonds, collateralized reinsurance instruments and other forms of risk-linked securitization. Their value is affected by an insured loss event .Insurance Linked Securities are currently dominated by natural catastrophe risk (Nat Cat). However, recent loss affected years have shown that a reliance on peak Nat Cat can lead to high percentage draw-downs and large volumes of trapped collateral. Similar returns to Nat Cat can be derived from other classes with similar characteristics. If blended with Nat Cat risk, they can be used to develop better diversified portfolios with lower exposure to any one event or class, which would also lower capital exposure to any one event, while producing similar gross returns and improved net returns in the long run. In order for investor performance to continue to develop in a positive trend, it is necessary for ILS managers to improve their risk profiles. As ILS managers look for new opportunities, cyber risk should be a key consideration for expanding the ILS market. In the whitepaper, Cyber Catastrophes Explained, cyber catastrophes are defined as: An infrequent cyber event that causes severe loss, injury, or property damage to a large population of cyber exposures.A cyber event that starts with a disruption in either a service provider or a technology, and unfolds by replicating this disruption whenever possible. Nat Cat has traditionally dominated the ILS market due to its inherent characteristics, including only deep tail correlation to financial markets and short tail of loss development. Additionally, the market boasts well developed and transparent third party pricing models and a wealth of availability of investor educational material. Nat Cat is favorable for the ILS market due to the substantial and growing need for capacity from (re)insurers and its consistent definition of risk and event. It has also proven itself in its positive risk and reward transaction metrics and is accessible due to the availability of transactions through the risk and reward profile from insurance, reinsurance and retrocession. In many ways cyber risk has many parallel characteristics to Nat Cat and therefore is an ideal peril to be incorporated in ILS portfolios. In the early days of the market there was less consistency in coverage and risk definition, and modelling agencies tended to provide only a âblack box,â leaving underwriters of the risk with little transparency into the methodology or numbers derived from the model. However, the cyber insurance market has rapidly matured, it is growing at 21.2% CAGR with substantial new wholesale capacity required to meet the demands of a growing consumer base across all geographies. Additionally, similarly to Nat Cat, cyber risk exhibits limited correlation with major global financial markets performance except in the deep tail. It should also be noted that cyber risk is a short tail class with clarity and standardization in the definition of risk covered. In order for the market to develop, third party models will need to provide a stable and transparent pricing methodology which can be simply implemented as the core of the underwriting process. The model will need to be effective at the insurance, reinsurance and retrocession levels, and provide accuracy and functionality across the range of data types (both aggregated and detailed data can be modeled). A modeling vendor must be transparent and provide the user with the ability to educate both themselves and their investors. Kovrr provides a stable and transparent pricing methodology which can be simply implemented at the core of the underwriting process. The model is effective at the insurance, reinsurance and retrocession levels, and has been developed to provide accuracy and functionality across the range of data types (Both aggregated and detailed data can be modelled)Quantifying risk frequencies in the cyber landsca | Threat | ★★★ | |
|
2021-02-02 00:00:00 | (Déjà vu) Mélanges clés de la montée des ransomwares en 2020: Ransomware-as-a-service et double extorse. Key Drivers of Rise of Ransomware in 2020: Ransomware-as-a-Service and Double ExtortionThe key drivers in the rise of ransomware have been double extortion and RaaS.Read More (lien direct) |
Ransomware-as-a-Service and Double ExtortionâRansomware has been a known method for cyber attacks for more than 30 years and has significantly evolved within this timespan. The growth in the number of ransomware attacks in 2020 has marked a pivotal milestone in the ransomware evolution. According to a Check Point study, Global Surges in Ransomware Attacks, in Q3 2020 the daily average of ransomware attacks has increased by 50%, and has specifically increased by 98.1% in the United States. Additionally, the average amount of money requested by attackers in Q3 2020 increased by 178% compared to Q4 of 2019. Supporting this trend, Coalitionâs Cyber Insurance Claims Report stated that more than 40% of the cyber incident claims in Q1 and Q2 2020 were due to ransomware attacks. âTaking into account these statistics, Kovrr has conducted research that included monitoring the activity of trending threats actors, the attacks they were involved with and the victims of these operations through 2020. The research included data from various proprietary and third party data sources including leaked data from the dark web. The research revealed that ransomware attacks have evolved in the following two areas:âMethodology - unlike ransomware attacks witnessed in the past, the last half year of 2020 was characterized by adoption of a new attack method which includes - stealing the companyâs data along with encrypting the attacked companyâs data. This practice is also known as âDouble Extortionâ because the attacker not only encrypts the data but also threatens to publish the companyâs stolen data.  Ransomware as - a - service (RaaS) - a method that recently became popular, which enables potential attackers to purchase already existing ransomware and use it for their desired purposes. âKovrr has researched 16 active âdouble extortionâ ransomware attack campaigns in the last year. Of the campaigns studied, 75% use social engineering (phishing emails) to propagate, while 25% of them involve exploiting a vulnerability in remote access software. In order to fully understand the effect of the ransomware campaigns, Kovrr applied the CRIMZON⢠framework to better analyze and report findings of the research. CRIMZON are an easy to use open framework to measure and understand cyber risk exposure that focus on the minimal elements needed to describe cyber risk accumulation. Elements of the CRIMZON include location, industry, and entity size. Applying the CRIMZON framework to the ransomware campaign research found the top 5 CRIMZON exposed were: âUS_NY_I_S [United States_New York_Services_Small Company]GB_I_S [Great Britain_Services_Small Company] CA_I_S [Canada_Services_Small Company] CA_E_S [Canada_Transportation & Communications_Small Company] US_CA_I_S [United States_California_Services_Small Company]âMost of the attacked companies are located in the U.S. (more than 50% of the targets), followed by Canada, the United Kingdom, Germany and France. Within the U.S., the main states affected were California, Texas, Florida and New York. The industries to which most of the attacked companies belong to are Services (20% of the services category is attributed to educational services), Transportation and Communication, and Manufacturing. âThese findings have a significant impact on the cyber insurance market both in terms of rising claim numbers and entity of the amount claimed. The increase in attacks is more concentrated in particular combinations of location, industry, and entity size (CRIMZON), meaning certain CRIMZON are more susceptible to an attack than others. This paper addresses new ransomware trend characteristics by providing an overview of two major ransomware campaigns encountered in the research; provides examples of ways in which a portfolio can be influenced as a result of the wide a | Ransomware Data Breach Tool Vulnerability Threat Prediction | ★★★ | |
|
2020-11-17 00:00:00 | CRIMZONâ¢: The Data Behind the FrameworkA report that highlights a subset of the empirical validation for the CRIMZON⢠framework.Read More (lien direct) | âAbstract The CRIMZON⢠framework defines the minimal elements needed to provide a view of accumulated cyber risk. For natural catastrophe risk, individual policy exposures can be aggregated within geographic zones.Similarly, cyber exposures can be aggregated using CRIMZONâ¢. Location also holds importance when assessing cyber catastrophe risk, however, two additional elements must be taken into account to properly assess cyber risk accumulation: industry and company size. Insured companies with common characteristics related to location, industry, and entity size tend to be exposed to similar types of cyber events because these elements also correspond to technologies or service providers used. Based on an analysis of millions of cyber events in the last 20 years, Kovrr conducted extensive research, to serve as the core empirical validation for the CRIMZON framework. Below is a subset of the research, in which a study group of 120 CRIMZON was determined by selecting CRIMZON with the highest relevance to the cyber insurance market(he research group was compiled according to criteria detailed in (Appendix A) The total number of unique companies in the study group is 20,000, with an average number of 152 companies within a CRIMZON, and a median of 86 companies. The research criteria focused on companiesâ location industry, entity size, and the hosting and mail technology and service providers used by companies. The results showed a concentration of technologies and services when grouping by location, and further concentration when adding the additional elements of the CRIMZON, entity size and industry to the analysis. The research shows that companies within the same CRIMZON have the tendency to use the same service providers and technologies, and that different compositions of service providers and technologies can be found across CRIMZON. When trying to estimate accumulations of potential losses from cyber, insurance and reinsurance companies face two main challenges: identifying which policies are exposed to the same cyber events and determining how many policies will be affected at the same time. The former is related to the problem of enumerating all technologies and service providers each insured relies upon, the latter is equivalent to estimating the footprint of a cyber event. Analyzing accumulations by CRIMZON enables risk professionals to make sense of the size and extent of potential losses from cyber, without necessarily needing to collect detailed information about technologies and service providers for each insured. The framework is completely agnostic to the line of business, therefore unlocking a full range of possible applications across both silent and affirmative cyber coverages. Among these applications is the development of aggregate models. This research shows it is possible to estimate the two key ingredients needed for the development of industry loss curves, the hazard and the exposure, using the CRIMZON as the atomic unit of aggregation. By identifying the correlation across CRIMZON, an aggregate model can then be developed.âIntroduction - What are CRIMZONâ¢? The Cyber Risk Accumulation Zones (CRIMZONâ¢) framework defines the minimal elements needed to provide a view of aggregated cyber exposure. Kovrr launched CRIMZON during participation in the fourth cohort of the Lloydâs Lab, the insurance technology accelerator operated by Lloydâs of London. CRIMZON is an open framework created to facilitate better communication across players in the cyber insurance value chain. The framework allows users to overlay their data pertaining to loss, cyber attack frequency, as well as additional data onto the CRIMZON for additional insights of risk per zone and to detect correlations between different zones. The framework was created to support efforts for setting a standard for data collection for cyber risk management.The CRIMZON are composed of the following three elements:Location - country-level worldwide a | Vulnerability Studies Cloud | ★★★ | |
|
2020-07-27 00:00:00 | (Déjà vu) Cyber Black Swansgaining Visibility dans les événements de queue lors de la gestion des portefeuilles de cyber-assurance. Cyber Black SwansGaining visibility into tail events when managing cyber insurance portfolios.Read More (lien direct) |
Gaining visibility into tail events when managing cyber insurance portfoliosâIn March 2011, a powerful earthquake hit off the coast of TÅhoku, Japan, generating a devastating tsunami that overwhelmed all flood defenses. Up until then, scientists did not expect an earthquake in that region beyond magnitude eight but this specific event exceeded all accepted scientific predictions and expectations with a magnitude nine. The event was unanticipated, caused major financial impact, and called upon scientists to review their understanding of subduction zones. Events like this have come to be known as black swans. Cyber is a relatively new peril in the insurance landscape; companies have limited experience in underwriting and modeling the risk, and the risk itself has evolved in line with the advances of technology. Moreover, cyber insurance is still a developing market:scope of coverage is not very consistent, and policy terms are evolving rapidly. Against this backdrop, the industry is still interrogating itself about what a cyber black swan might look like, and how much it would cost.Black swans were first discussed by Nassim Nicholas Taleb in his 2001 book Fooled by Randomness, which aptly concerned financial events. His definition was based on three main characteristics: unexpected; causing a major impact; and most importantly, explainable, event hough only in hindsight. Black swans are particularly undesirable events in the financial sector. Actuaries and exposure managers aim to avoid black swans, or to put it another way avoid unexpected volatility of losses. To be prepared for this kind of occurrence is key not only for an insurance companyâs survival but also for its success.Insurance professionals need to be as proficient at understanding cyber risk as they are with other types of risk. The need stems mainly from three forces at play. Firstly, the risk already resides in insurance companiesâ books in a non-affirmative form, for example claims from cyber events could affect property and casualty policies. Secondly, cyber insurance buyers are becoming more sophisticated and demanding coverage fit for their risk management needs, including limits commensurate with the potential loss. Lastly, since economies with high insurance penetration recover more quickly after a catastrophe, insurance companies have an important role to play in enhancing resilience to large cyber events in the economies where they operate.âThe Footprint of a Cyber EventAn effective solution for cyber risk management allows practitioners to identify drivers of lossârisks in the portfolio that are most likely to contribute to an event. Solutions need to properly capture the correlation within a portfolio, in order to distinguish which risks will be affected, and to what extent those risks will incur serious financial loss. For natural hazards, correlation is determined by geographic proximity. For example, in an earthquake, the most affected properties will be the ones closest to the epicenter. In cyber, geographic proximity is not enough because events propagate through computer connections.To better illustrate the problem, letâs consider a major bug in a very popular technology. For example, the type of vulnerability that might allow remote code execution, that is the ability for a malicious threat actor to take control of a server or any other endpoint. Millions of businesses, all around the world, are potentially at risk. A campaign exploiting this type of vulnerability will start with the specific aim of maximizing the return for the threat actors involved, meaning an initial target will be identified based on the industry sector and country the attack is most likely to succeed in. All these factors can be modeled, using a combination of game theory and cyber security knowledgeâhowever, pinpointing exactly which company will be targeted first is a challenge.Often in such cases, several companies are targeted as starting points for the cyber event. Each of these initial | Ransomware Tool Vulnerability Threat | ★★★ | |
|
2020-03-31 00:00:00 | Cyber Risk - du péril au produit adoptant une nouvelle approche pour gérer le cyber-risque silencieux Lire la suite Cyber Risk - From Peril to ProductTaking a New Approach for Managing Silent Cyber RiskRead More (lien direct) |
A New Approach for Managing Silent Cyber RiskâCyber is a multifaceted peril that is both a threat and an opportunity for the insurance industry: an opportunity because of the ever-evolving needs of coverage for businesses of any size, and a threat because of the systemic risk arising from its potential for overlap with other lines of business. Silent cyber refers to covered losses triggered by cyber events in P&C policies that were not specifically designed to cover cyber risk. Affirmative cyber refers to coverages specifically provided to protect policyholders against cyber events and presents a premium growth opportunity for insurance companies. As exposures to cyber continue to grow, insurance companies need tools to quantify the impact on allocated capital for cyber risk, regardless of whether the risk is silent or affirmative.With some estimates for accumulation across commercial lines running in the hundreds of billions, exposure managers are under pressure to more accurately estimate the potential impact of cyber events to ensure appropriate capital is held for this risk and enable decision makers, investors and regulators to quantify financial returns on a risk adjusted basis. Additionally, they are being forced to provide more transparency into methods used for measuring and controlling cyber accumulations. With various stakeholders and types of practitioners involved, the topic of cyber risk often presents seemingly conflicting priorities around managing capital at risk, estimating potential losses in existing lines of business, and finding new ways to market, through pricing new cyber specific business.Cyber events across different lines of business share a common trait. The key is to build tools capable of estimating realistic losses for both silent and affirmative cyber based on these shared traits. The focus of cyber risk for insurers should be gaining unique insights into events that truly matter -events capable of generating equity depleting losses. Measuring the impact of cyber events on capital is a three step process: identify, quantify and manage.Lately, the insurance industry seeks to consolidate most cyber risk into one dedicated line of business by implementing exclusion clauses in existing policies and inviting policy holders to âbuy backâ coverage. Several different wordings for such exclusions and endorsements have been introduced to the market. While intending to clearly define the scope of a cyber event and the coverage provided, the introduction of some of these clauses has produced unintended consequences. One example of this would be coverage for damage to a server due to flooding. In this example, the common expectation would be for the physical damage to the server as well as recovery of the data to be covered under flood insurance, however, the latest trend suggests data recovery might be excluded, as it relates to âdataâ, leaving a gap in coverage for property which some sources consider excessive.âSilent and AffirmativeThe issue with silent cyber, as with any circumstance presenting unexpected claims activity, is ensuring the premium charged is commensurate with the level of risk, usually referred to as pricing adequacy. Both cyber exposure and the potential impact of losses triggered by cyber perils continues to trend upwards annually. Unexpected claims lead to unexpectedly high loss ratios which clearly erode profits but can also lead to significant damage to an insurerâs financial stability.Insurance companies protect their balance sheets by purchasing reinsurance, but reinsurers face similar issues, they are also vulnerable to silent cyber. Therefore, insurers face the prospect of being denied recoveries from cyber losses and reinsurers are stepping up demands for clarity of coverage. Efforts to resolve the situation have taken two complementary directions: a conscious attempt to price for cyber risk and the introduction of increasingly restrictive exclusion clauses.âThe Status of Cyber ExclusionsCyber | Tool Vulnerability Threat Prediction | ★★★ | |
|
2020-03-22 00:00:00 | Comment l'IoT industriel pourrait déclencher le prochain cyber-catastrophieffect d'urgence / 11 sur l'industrie manufacturière américaine révèle 7 milliards de dollars pour les eaux autres How Industrial IoT could Trigger the Next Cyber CatastropheEffect of URGENT/11 on the US Manufacturing Industry Reveals $7 Billion ExposureRead More (lien direct) |
IntroductionOn 29th July 2019, the cyber security firm Armis announced that it had found eleven different vulnerabilities in the operating system âVXworksâ which they believe exposed around 200 million critical devices. The team at Armis dubbed this group of vulnerabilities: URGENT/11. This report explores how the discovery of URGENT/11 demonstrates the susceptibility of global manufacturing businesses to large losses from a cyber-attack event and the potential impact on commercial P&C (re)insurers.âThe Operating System at the Heart of the IssueVxWorks is a widely used, but lesser known, lightweight IoT real-time operating system (RTOS). This operating system is embedded in over 2 billion devices in the US and worldwide. These range from large-scale industrial machinery controlling installations such as nuclear power stations and oil production platforms, to smaller systems throughout the worldâs automotive, aviation, agri-business, textile, logistics and pharmaceutical facilities. A malicious attack could affect what is known as the SupervisoryControl and Data Acquisition (SCADA), the system that allows industrial organizations to gather and monitor real-time data in their manufacturing and distribution systems. Critically, VxWorks is also part of what are known as Industrial Control Systems (ICS) â software that manages the industrial processes themselves.âNot a Quick FixAs with any type of software vulnerability, affected organizations need to patch vulnerabilities quickly. However, in the case of URGENT/11, the necessary patches can be very expensive to apply immediately, because the affected devices are critical to day-to-day operations. Patching a vulnerability requires stopping or interrupting the device, which could lead to significant business disruption. Furthermore, while very large organizations have the financial and technical resources to implement system patches quickly, smaller manufacturers â who may nevertheless be critical to the supply chain â often do not. They may buy equipment that happens to contain VxWorks, but do not expect to have to maintain the software or even be aware of its existence.âQuantifying URGENT/11âs Potential Loss Scenarios for the US Manufacturing IndustryTo understand the extent of companies that were vulnerable to URGENT/11, their susceptibility to being attacked, and the effect an attack might have industry wide, Kovrr deployed its proprietary technologies. The first step was to gather real-time information about the distribution of VxWorks in the US manufacturing sector. To achieve this, Kovrr leveraged its ability to continuously collect relevant business intelligence, cyber threat intelligence, external and internal security data. As a result, we were able to identify companies with devices that were utilizing the VxWorks operating system. For internal mapping, access to multiple security vendors\' data is essential because each vendor has its own expertise and distribution, in terms of geolocation, served industries, defense level focus, mapped devices, etc. In the case below involving an industrial sector, unique data focused on IoT devices is needed. Kovrr partners with a diverse range of data providers to detect and map beyond the firewall devices and security control mechanisms. By having access to Armis\' proprietary IoT fingerprinting technology, we were able to produce a highly granular map of any IoT device being used by one organization.We can then accurately assess any IoT related emerging vulnerability on clients\' portfolios. In order to understand the nature of these businesses, including their sector, size and place in the supply chain; we use publicly available information linked to a variety of proprietary data-sources including our own. This technique is similar in principle to the exposure-data cleansing and augmentation used by catastrophe modelers. Having developed a sophisticated view of the affected businesses, we have selected a series of events fro | Ransomware Vulnerability Threat Industrial Prediction | ★★★★ | |
|
2020-03-22 00:00:00 | Compter le coût d'une grande panne de service de messagerie de messagerie dans la panne de service de service de messagerie Ukmajor pourrait entraîner une perte brute brute de 3,25 milliards de dollars. Counting the Cost of a Major Email Service Provider Outage in the UKMajor email service provider outage could lead to $3.25B gross insured loss.Read More (lien direct) |
Modeling a Cyber CatastropheâCounting the Cost of a Major Email Service Provider Outage in the UKExecutive SummaryThe cyber books of many (re)insurers may be modest; however, their potential exposure to a cyber catastrophe could be very large. Even though overall cyber premiums are significantly lower than property in the UK, this report demonstrates that the potential for a multi-billion dollar insured loss is similar to the risk of floods catastrophes covered by property insurance.IntroductionEvery day 290 billion email messages are sent worldwide by 3.9billion users, facilitating a $15 trillion global economy comprised of over 150 million organizations. Email is an integral critical business service for organizations operating in the digital age. Businesses use email to communicate internally with staff and externally with their customers, clients, partners, and supply chain. Behind these huge numbers are a small number of email service providers (such as Microsoft, Google, and Rackspace) that account for the majority of all emails sent. This presents a potentially disastrous risk to the availability of this essential service if one was to suffer an outage as the result of a cyber-attack.A cyber-attack on an email service provider lasting hours, days or weeks and the resulting outage would lead to a substantial financial impact on a (re)insurance carrier. The key characteristics of this type of cyber catastrophe are high severity and low frequency, meaning, an event that does not occur regularly but entails great damage potential, effecting numerous businesses and leading to multiple claims on a (re) insurance carrier at a single point in time.âThe financial damage caused by a cyber catastrophe, such as an email outage, could also manifest through silent risk. Regulators are increasing requirements to quantify this potential silent cyber risk. In January 2019 the PRA(Prudential Regulation Authority) that regulates the UK Financial Services market (inc. the insurance market) demanded that UK insurance firms should seek risk models and expertise to estimate the potential silent (non-affirmative) cyber exposure across their portfolios and introduce robust mitigation strategies for limiting any potential risks.âThis report examines an attack on an email service provider in the UK leading to a service outage resulting from a single point of failure, an event that can lead to financial damage and claims due to affirmative cyber coverage. In this report the authors utilized Kovrrâs ability to quantify potential exposure to cyber catastrophes based on the composition of specific portfolios. Kovrrâs predictive modeling platform was used to map the underlying technologies and services used by the insured companies, enabling an understanding of the potential accumulation risks that are derived from the aggregation of their network of utilized technologies and service providers.âData Wipe Case Study: VFEmail.netOn the 11th February, 2019, hackers breached the servers of the email provider VFEmail.net and deleted all the data from its US servers, destroying all US customers data in the process. Users withVFEmail accounts were faced with empty inboxes and left with no recovery backup options. This was not the first occasion that VFEmail had been targeted. In 2015, VFEmail suffered a DDoS (DistributedDenial of Service) attack after the owner declined to pay a ransom demand from an online extortion group. The company was also forced to find a new hosting provider after a series of DDoS attacks in 2017.âAnatomy Of An AttackAn attack on an email service provider, larger thanVFEmail, could result in critical data being held hostage, altered or destroyed for multiple organizations. This analysis reflects the financial loss resulting from this large-scale business interruption event and the insured loss due to insurance claims that would be triggered in the event of an email service provider outage. In order to perform this analysis, we simulated multiple events includi | Malware Tool Vulnerability | ★★★ |
1
We have: 22 articles.
We have: 22 articles.
To see everything:
Our RSS (filtrered)
