Author: esimantiras

Purdue honored for counterintelligence contributions

Posted on by esimantiras

Purdue honored for counterintelligence contributions

source: purdue.edu  |  image: purdue.edu

 

WEST LAFAYETTE, Ind. — In an on-campus ceremony on Tuesday (Aug. 16), the U.S. Defense Counterintelligence and Security Agency (DCSA) recognized Purdue University as one of four recipients of its Excellence in Counterintelligence (CI) Award for fiscal year 2020. Those chosen were among more than 10,000 contractors considered.

The honor places Purdue among the top universities in protecting sensitive national information from foreign adversaries and makes Purdue one of only two universities singled out twice to receive the award. Texas A&M University was also so honored.

Purdue was named as a recipient of the award in 2020, but the ceremony conferring the award was delayed by COVID.

Senior DCSA leaders selected the award winners based on the organizations’ CI/insider threat reports.

Continue reading “Purdue honored for counterintelligence contributions” →

How advanced technology is changing deterrence

Posted on by esimantiras

How advanced technology is changing deterrence

source: defensenews.com  |  image: pixabay.com

 

History’s bloodiest wars often begin with underestimation. The architects of the First World War expected fighting to last less than a year. In starting a war of aggression against Ukraine, Vladimir Putin incorrectly thought Kyiv lacked the will and the capability to resist.

Changes in military technology will increase the frequency of these mistakes. Wars are increasingly being decided by capabilities that are hard to observe or demonstrate before conflict begins.

Today’s would-be Putins might count divisions of tanks, aircraft carrier strike group visits or missile siloes captured on satellite imagery — and think twice. But wars in Azerbaijan and Ukraine have demonstrated that victory often rests on immaterial conditions: the ability to out-detect and out-communicate the enemy and the ability to outpace the enemy’s speed of decision.

These are difficult to assess until war has already begun. More wars of underestimation will be fought if leaders fail to appreciate the dynamic of this change.

Continue reading “How advanced technology is changing deterrence” →

TryHackMe: The Story Behind the UK’s Most Innovative Cyber SME

Posted on by esimantiras

TryHackMe: The Story Behind

the UK’s Most Innovative

Cyber SME

source: infosecurity-magazine.com  |  image: pixabay.com

One of the many highlights of this year’s Infosecurity Europe 2022 event (21-23 June 2022) was the annual UK’s Most Innovative Cyber SME competition. The contest, run by the Department for Digital, Culture, Media & Sport (DCMS) and Tech UK in partnership with Infosecurity Europe, showcases the startup community’s enormous contribution to the UK’s booming cybersecurity sector. This is highlighted by the impressive list of previous winners, which include cybersecurity reskilling provider CAPSLOCK (2021), white hacking training platform Hack the Box (2019), communication security firm KETS Quantum Security (2018) and email security specialist Check Recipient (now trading as Tessian) (2017).

 

In the past two competitions, the judges have awarded first prize to companies involved in creating innovative solutions to resolve the much-publicized cyber-skills shortage, and this trend continued in 2022. The newly crowned winner of this award is TryHackMe, a cybersecurity training platform launched in 2018 that focuses on providing gamified lessons to its users. Once the celebrations had concluded, Infosecurity caught up with TryHackMe co-founder Ashu Savani to learn more about the company’s story, journey and future aspirations.

 

Savani described the application process for the Most Innovative Cyber SME competition as “very reflective,” allowing the team to reaffirm its goals following a whirlwind few years. “The application process was quite fun as it solidified our mission and the work we’re doing in our mind,” he explained. “We were very excited to be accepted as it gave us recognition for the work we are doing, which is to make it as easy as possible for anyone to learn cybersecurity, whether you’re a construction worker or a school teacher.”

 

Did he expect TryHackMe to win though? “We weren’t sure we were going to win; we were just really happy that we got through to the final and got a chance to give TryHackMe more exposure,” Savani replied modestly. Win they did though, and the award represented the culmination of many years of hard work, challenges and innovative thinking.

 

The Beginnings

 

The idea for TryHackMe was born after Savani met co-founder Ben Spring during a summer internship at the consultancy Context Information Security. “It was during the internship that we realized there isn’t a lot of cybersecurity learning material,” and most of it was orientated towards people already proficient in security, which, Savani explained, “isn’t very conducive to learning security.”

 

Spring began a side-project that involved building systems on the cloud. He then suggested the idea of adding training material and notes to Savani. “That ended up being the very early prototype of TryHackMe, where you could launch training material with a touch of a button and have some sort of learning focus there,” explained Savani.

 

As the pair developed the prototype, they put the word out on platforms heavily used by the amateur hacking community like Reddit, “and people started using our products.” This was the motivation to keep developing the product, carefully incorporating user feedback. “Fast-forward four years, and we’ve been very fortunate to have a loyal user base still using us. We believe we’re positively contributing to closing the cyber skills gap and we’re excited to continue doing that work,” said Savani.

Overcoming Challenges 

 

As with all startups, there were significant challenges and bumps in the road to overcome in the early years. One of the key difficulties for TryHackMe was acquiring users beyond its base. After attempting a number of different strategies, the company found the most effective approach was holding events that allowed the participants to win prizes by competing in cybersecurity challenges. This included partnering with universities through events called ‘HackBack.’

 

The other major challenge was building out the product “sustainably,” which required hiring the right people to develop and scale the business. “It’s one of those things that’s tough to solve overnight,” reflected Savani. However, they now have “some really amazing people” on board. “We’ve been very fortunate to bring on people who love teaching and have that cybersecurity experience,” he noted, adding: “All our different pockets and departments at TryHackMe have an impact on the work we’re doing on a day-to-day basis.”

 

In terms of the training platform’s evolution, there has been a strong emphasis on gamification, which TryHackMe found most effective in engaging users. “We’re focusing on ensuring the users enjoy the material and stick to what they’re doing.”

 

Savani also revealed the company is now looking to expand its material, providing relevant training content for experienced professionals as well as beginners in the field of cybersecurity, which was previously the primary focus. This includes moving into “more intermediate to advanced topic areas for things like DevSecOps, red teaming and blue teaming.”

 

Long-Term Vision

 

Savani emphasized that while the training content is designed to be fun and engaging, it must have practical real-world benefits for the users. The ultimate vision is “to take a student with a little technical experience all the way to an advanced consultant who understands the complex concepts within defensive security.” Savani added that it is also increasingly working with businesses to train their security teams, “an area we’re looking to grow.”

 

In addition to the quality of the TryHackMe service, Savani acknowledged that the company’s core focus on reducing barriers to entry in cybersecurity was a crucial factor in being crowned Most Innovative Cyber SME at Infosecurity Europe 2022. Lack of diversity and accessible pathways are a major blockage to addressing the cyber skills gap, and TryHackMe is making a conscious effort to provide an opportunity to train in cybersecurity, regardless of background and ability to pay. The firm currently has a pricing scheme of £8-10 ($9.50-12) a month. “No one should be paying lots of money just to discover whether cybersecurity is a feasible career for them,” he added.

 

Looking ahead, the long-term vision for TryHackMe is to continue its mission to provide affordable and engaging training for those looking to develop a career in cybersecurity. This involves constant reflection and evolution, taking on user feedback to continuously improve the platform.

 

Solving the cyber skills shortage is a long-term challenge for the industry and requires innovative ideas and approaches. Often, startups have the most ‘out-of-the-box’ solutions, and TryHackMe has demonstrated this trait over its first few years of operation. TryHackMe’s triumph in this year’s contest, alongside other recent victors, shows that this issue is being taken increasingly seriously in the cybersecurity sector.

A new technology uses human teardrops to spot disease

Posted on by esimantiras

A new technology uses human teardrops to spot disease

 

 

 
 
 
 

source: sciencenews.org  |  image: pexels.com

 

A new method to rapidly analyze teardrops could help scientists detect molecular signatures of disease.

Human tears could carry a flood of useful information.

With just a few drops, a new technique can spot eye disease and even glimpse signs of diabetes, scientists report July 20 in ACS Nano.  

“We wanted to demonstrate the potential of using tears to detect disease,” says Fei Liu, a biomedical engineer at Wenzhou Medical University in China. It’s possible the droplets could open a window for scientists to peer into the entire body, he says, and one day even let people quickly test their tears at home.

Like saliva and urine, tears contain tiny sacs stuffed with cellular messages (SN: 9/3/13). If scientists could intercept these microscopic mailbags, they could offer new intel on what’s happening inside the body. But collecting enough of these sacs, called exosomes, is tricky. Unlike fluid from other body parts, just a trickle of liquid leaks from the eyes.

So Liu’s team devised a new way to capture the sacs from tiny volumes of tears. First, the researchers collected tears from study participants. Then, the team added a solution containing the tears to a device with two nanoporous membranes, vibrated the membranes and sucked the solution through. Within minutes, the technique lets small molecules escape, leaving the sacs behind for analysis.

The results gave scientists an eyeful. Different types of dry-eye disease shed their own molecular fingerprints in people’s tears, the team found. What’s more, tears could potentially help doctors monitor how a patient’s diabetes is progressing. 

Now, the scientists want to tap tears for evidence of other diseases as well as depression or emotional stress, says study coauthor Luke Lee, a bioengineer at Harvard Medical School. “This is just the beginning,” he says. “Tears express something that we haven’t really explored.”

 

 

 

 

 

 

 

TikTok Engaging in Excessive Data Collection

Posted on by esimantiras

TikTok Engaging in Excessive Data Collection

source: infosecurity-magazine.com  |  image: pexels.com

 

TikTok has been engaging in excessive data collection and connecting to mainland China-based infrastructure, Internet 2.0 has claimed in a new white paper.

The latest report, overseen by Internet 2.0’s head security engineer Thomas Perkins, is an analysis of “the source code of TikTok mobile applications Android 25.1.3 as well as IOS 25.1.1”, with Internet 2.0 carrying out static and dynamic testing between 1 July to 12 July 2022 that focused on device and user data collection.

The report identified multiple instances of unwarranted data harvesting, including:

  • Device mapping
  • Hourly monitoring of device location
  • Persistent calendar access
  • Continuous requests for access to contacts
  • Device information

Continue reading “TikTok Engaging in Excessive Data Collection” →

Microsoft Disrupts Russian Cyber-Espionage Group Seaborgium

Posted on by esimantiras

Microsoft Disrupts Russian Cyber-Espionage Group Seaborgium

source: infosecurity-magazine.com  |  image: pexels.com

 

Microsoft claims to have disrupted a prolific Russian state-backed threat group known for conducting long-running cyber-espionage campaigns against mainly NATO countries.

In an update on August 15, the tech giant said it had disabled accounts used by the “Seaborgium” group for reconnaissance, phishing, and email collection, and updated detections against its phishing domains in Microsoft Defender SmartScreen.

Also known by threat researchers as Callisto Group, ColdRiver, TA446 and other monikers, Seaborgium is a “highly persistent threat actor” that focuses most of its time on the US and UK, and occasionally the countries of the Baltics, Nordics and Eastern Europe.

“Once successful, it slowly infiltrates targeted organizations’ social networks through constant impersonation, rapport building, and phishing to deepen their intrusion,” said Microsoft.

Continue reading “Microsoft Disrupts Russian Cyber-Espionage Group Seaborgium” →

Listy is a simple, free way to catalog your favorite stuff

Posted on by esimantiras

Listy is a simple, free way to catalog your favorite stuff

source: fastcompany.com  |  image: pexels.com

 

You can list your favorite albums, books, movies, TV shows, video games, sites, apps, wines, beers or social posts.

 

This article is republished with permission from Wonder Tools, a newsletter that helps you discover the most useful sites and apps. Subscribe here.

Listy is a free and simple app for making lists of your favorite things. It automatically includes related images, like book or album covers, and you can create shareable visual lists with the free app on Mac, iOS, or Android. It’s a handy way to quickly share recommendations with friends.

You can list your favorite albums, books, movies, TV shows, video games, sites, apps, wines, beers, or social posts. Your list shows up with the appropriate cover art: Any book, album, TV show, or movie you list will be paired with its representative image, just as whatever wines or beers you list will include images of their bottles.

MAKING LISTS IS SIMPLE

  • To make a list you first pick a category—like books, movies, video games. Then you add items one by one. Unlike many other apps, you don’t have to register or log in to start using it.
  • When you start typing the name of something, Listy searches a database to find it. That item, along with its image and other basic info, is added to your list.
  • You can sort lists by title, genre, rating, data added, or other info, depending on the category.
  • For films, the app automatically adds the movie’s release date, description, and fan score, drawn from the Movie Database, a free, community-built platform that’s now used by 400,000 developers and companies. It also notes where the movie is available to watch online.

EDIT AND SHARE YOUR LISTS

  • Once you’ve added items, you can edit your list to change its order or to delete or update items. You can also mark items as watched, read, played, or tasted.
  • You can share any of your lists as an image, making it easy to post lists to your social network of choice. You can also text or email a list as an image.
  • You can make as many lists as you’d like, each with as many items on it as you want.
  • Lists can be backed up to iCloud so they stay in sync between your iPhone, iPad, and Mac.

LIMITATIONS

  • You can export lists as images or in Listy’s own proprietary file format, but you can’t open or edit the app’s lists in other text apps.
  • You can’t send someone a link to a list. You have to attach the list as an image.
  • You can’t yet collaborate on a list with others, though that feature is in the works. The company has been careful about privacy: Its site uses no cookies.
  • You can use Listy for to-do lists or lists of ideas, but it’s not designed primarily for that. Better to use other simple free alternatives like Apple’s Reminders or Google Tasks, or dedicated to-do apps like Things.
  • Listy has a limited number of categories. If you want to make a list of your favorite snacks, animals, cartoon characters, or other categories the app hasn’t added yet, you’re out of luck, though new categories are added monthly.

ALTERNATIVES

 

Smishing vs. Phishing: Understanding the Differences

Posted on by esimantiras

 

Smishing vs. Phishing: Understanding the Differences

 

source: proofpoint.com  |  image: pexels.com

 
What have smishing offenders learned from their phishing email counterparts?

Email-based credential theft remains by far the most common threat we encounter in our data. But SMS-based phishing (commonly known as smishing and including SMS, MMS, RCS, and other mobile messaging types) is a fast-growing counterpart to email phishing. In December 2021, we published an article exploring the ubiquity of email-based phish kits. These toolkits make it straightforward for anyone to set up a phishing operation with little more than a laptop and a credit card. Since then, we’ve tracked their evolution as they gain new functions, including the ability to bypass multifactor authentication.

In this blog post we’re going to look at smishing vs. phishing and what smishing offenders have learned from their email counterparts, as well as some significant differences that remain between the two threats.

Setting the (crime) scene

A modern email phishing setup can be as simple as one person with a computer and access to common cloud-hosted services. But for a smishing operation, the picture is somewhat different. While software smishing kits are available to buy on the dark web, accessing and abusing mobile networks requires a little more investment.

Continue reading “Smishing vs. Phishing: Understanding the Differences” →

5 Ways to Make Your Passwords Instantly More Secure

Posted on by esimantiras

 

5 Ways to Make Your Passwords Instantly More Secure

 

source: cnet.com  |  image: pexels.com

 

If you think your passwords are uncrackable, think again.

Despite years of warnings, experts say most people are still using weak passwords to protect even their most sensitive information. Many people are reusing those insecure passwords to protect multiple accounts, putting more of their data at risk should any of the accounts be compromised.

“It’s the total account takeover scenario,” said John Buzzard, lead fraud and security analyst at Javelin Strategy & Research, referring to a cybercriminal cracking one password and then using it to access other accounts. “Consumers lose control over their entire digital lives.”

World Password Day, which takes place on Thursday, is a good time to review your digital security. Sure, it’s a totally made-up celebration that Intel created in 2013. But it’s still a good reminder to take a close look at your logins and make sure they check the required security boxes.

Continue reading “5 Ways to Make Your Passwords Instantly More Secure” →

What is IoT? Guide to the Internet of Things

Posted on by esimantiras

What is IoT? Guide to the Internet of Things

 

source: eweek.com  |  image: pexels.com

The Internet of Things introduces opportunities for organizations to achieve practical gains and transformative changes.

The Internet of Things (IoT) shifts human and computer interaction to a broad and widely distributed framework. By connecting various “things” and “objects”—smartphones, lights, industrial machines, wearables, remote sensors and physical objects that have been equipped with RFID tags—it’s possible to drive advances that would have seemed unimaginable only a couple of decades ago.

The IoT—which serves as a broad term for a vast network of connected devices—has moved into the mainstream of business and life. It now serves as a fabric for far more advanced human-machine interaction. It encompasses everything from home thermostats and wearables to tracking systems and smart systems for agriculture, buildings and even cities.

Today, virtually no technology lies outside the realm of the IoT. Self-driving vehicles, manufacturing robots, environmental monitoring, supply chain tracking, transportation systems, and remote medical devices are just a few of the areas undergoing radical change due to the IoT.

Mobile phone company Ericsson reports that there are currently about 29 billion IoT devices in use worldwide. Businesses are increasingly turning to the IoT to drive innovation, trim costs, improve safety and security, and promote greater sustainability.

Continue reading “What is IoT? Guide to the Internet of Things” →