 The U.S. Army announced it will double its cyber corps strength as its focus shifts from counterinsurgency. The cyber corps is expected to grow by thousands. More: - The cyber corps will grow from around 3,000 personnel to over 6,000, according to an Army spokesperson. Across active duty, reserves, and National Guard, the cyber branch will expand to more than 7,000 people, up from 5,000.
- This expected growth comes as the Army grapples with multi-domain operations across land, air, sea, space, and cyber.
- Army Lt. Gen. John Morrison stated that the situation in Ukraine has made the world see how critical technology is when it comes to wars and propaganda, making this domain a key field of interest for the world powers.
Zoom Out: - The Army requested $16.6B in cyber and IT funding for Fiscal Year 2023. The bulk, roughly $9.8B, is flagged for the Army network, a modernization priority spearheaded by the Network Cross-Functional Team and the Program Executive Office for Command, Control, and Communications-Tactical. Some $2B is devoted to offensive and defensive cyber operations and cybersecurity research and development.
| |
 Security researchers uncovered a major new state-backed spear-phishing operation targeting multiple high-ranking Israeli and U.S. officials. The breach was traced to an Iranian group. More: - The attack has been credited to the Iranian Phosphorus APT group.
- Dating back to at least Dec. 2021, the attack targeted former Israeli foreign minister and deputy Prime Minister Tzipi Livni, a former major general in the Israeli Defense Forces and a former U.S. ambassador to Israel. Other targets included a senior executive in Israel's defense industry and the chair of one of the country's leading security think tanks.
- The attacker compromised the inbox of a frequent contact of the target and then hijacked an existing conversation between the two. They then opened a new spoofed email address impersonating the same contact, with a format resembling the original email. The attacker then attempted to continue the conversation using this new email address, exchanging multiple messages. Researchers added that real documents are sometimes used as part of the exchange to add legitimacy and relevance to the scam.
- In one case, deputy PM Livni was contacted by the "retired IDF major general" via his real email address and repeatedly asked to click on a link in the message and use her password to open the linked file. When she met him at a later date, he confirmed never to have sent the email.
- According to experts, the most sophisticated part of the operation was social engineering. The attackers use real hijacked email chains, impersonations of well-known contacts of the targets, and specific lures for each target. The operation implements a highly targeted phishing chain that is specifically crafted for each target.
| |
 A message from SECURITY COMPASS Current approaches to Threat Modeling simply don’t work. - They are manual and inconsistent
- They take too long
- They don’t scale
- They don’t give developers what they need
Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure software. Learn more about current threat modeling challenges. See how a new, developer-centric approach to threat modeling can help your organization deliver secure software faster. Read Series on Threat Modeling And, yes, we understand that threat modeling is a time-consuming process that requires the expertise of security professionals and figuring out the best approach to mature application security programs can be difficult, especially with increasing internal demands for a faster time to market. According to this Total Economic Impact™study, SD Elements enabled its users to decrease the time needed to develop security requirements for products by 90%. See How
| |
 A hacked Kaiser Permanente employee's emails led to a breach of 70,000 patient records. The health insurance giant didn't state how the email got hacked. More: - Kaiser Permanente is one of the largest nonprofit health plan providers in the United States, with over 12 million members, 700 medical offices, 300,000 employees, and 39 hospitals.
- In a notice to patients on June 3, Kaiser revealed that an unknown threat actor gained access to an employee's emails at the Kaiser Foundation Health Plan of Washington on April 5 that contained protected health information, including patient names, dates of service, medical record numbers, and lab test result information. Financially sensitive information, including Social Security and credit card numbers, was not exposed by the breach, according to the healthcare provider.
- The company states it terminated the unauthorized access within hours after it began and promptly commenced an investigation to determine the scope of the incident.
- Kaiser stated that it is providing extra training to its employees regarding email usage security, but it is unknown why the company didn't announce the breach sooner.
| |
 More than 40 million U.K. consumers have been targeted by digital scammers so far in 2022. The figure is a double-digit increase from the same time last year. More: - 14% more people than last year said they had been targeted. The most common scams involved delivery/postal services (55%), government spoofing (41%), investment fraud (29%), rebates and refunds (28%), and banking (27%).
- Authorities have warned that scammers are preparing to take advantage of the government’s £16B ($19.2B) cost-of-living crisis package, for example, spoofing energy regulator Ofgem in emails asking for personal details in exchange for a £400 ($480) energy rebate.
- SMS phishing (smishing) attacks more than doubled year on year in 2021. It is noted that delivery-themed scams were the most popular, accounting for 50% of the total in the U.K.
| |
 A message from ADOBE CONTENT How a cloud-native CMS makes content delivery faster and easier Stay competitive with a cloud-native CMS in a market with constantly shifting consumer expectations. Powered by AI, a cloud-native CMS is more cost-effective, scalable, and secure. It updates automatically, is low maintenance, and backs up to servers seamlessly with no downtime. Read How a Cloud-Native CMS Makes Content Delivery Faster and Easier to learn about the following: - Artificial intelligence that accelerates real-time content personalization
- Automatic security and maintenance updates with no downtime during server transfers
- Short deployment and innovation timelines
Read the article
| |
 Apple CEO Tim Cook wrote a letter encouraging the Senate to push security and privacy legislation. The letter comes after the bipartisan ADPPA bill. More: - The drafted legislation examines and discusses several facets of the privacy debate that has been ongoing in Congress for over 20 years, with some sections not yet finalized.
- Cook stated that Apple continues to support efforts at the federal level to establish strong privacy protections for consumers. Further, the letter says that while Apple "recognize that there are outstanding issues to be resolved, the areas of the agreement appear to far outweigh the differences."
- The CEO said that Apple believes privacy is a fundamental human right, and the company reinforces this by minimizing the data it collects, processing as much data as possible on a user's device, giving users transparency as to what data is collected, and control as to how it is used, and building robust systems to protect user data,
Zoom Out: - Apple's iOS 14 update raised controversy due to the limitations it puts on the ability of companies to target their users with ads. The company claims the move is a win for privacy, while critics stated the move helps Apple win against its competition.
| |
Quick Hits: - Same old marketing automation not cutting it these days? Get our eBook and power up your customer experiences.*
- Canada will now require companies to report cyber attacks and share cyber threat information.
- A new high-severity vulnerability has been disclosed in the Zimbra email suite that enables an unauthenticated attacker to steal cleartext passwords of users.
- PyPI packages "keep," "pyanxdns," and "api-res-py" were found to be containing a backdoor due to the presence of a malicious "request" dependency within some versions.
- The Cybersecurity and Infrastructure Security Agency has named new advisors who will work at individual agencies to enhance the shared cybersecurity service model and specific network defenses, Federal News Network reported.
| |
Upcoming events at Inside: - June 15 - Need To Know NoCoder - Artem Harutyunyan (bardeen.ai) (Register Here)
- June 15 - AMA with Harry Campbell (The Rideshare Guy) (Register Here)
- June 22 - AMA with Daniel Stedman (Pressto) (Register Here)
- June 29 - June 30 - Polkadot Decoded: The Biggest Polkadot Event of the Year (Register Here) *
- June 30 - HR Strategies to Retain Remote Employees (Register Here)
- July 20 - Need To Know NoCoder - Yassine Tahi (Kinetix) (Register Here)
- July 21 - The Rise of Metaverse Gaming (Register Here)
*This is a sponsored listing.
| |
 |  | Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. |   | | Editor | Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 Ford. | |
Security Compass is on a mission to accelerate software time-to-market while managing risk. | |
| |
Comments
Post a Comment