Unhappy infosec leaders, a list not to be on and more.
Welcome to Cyber Security Today. It’s Wednesday, November 2nd, 2022. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.
 |
 |
 |
Ever had one of those days when you thought, ‘I’ve had it! To hell with this job’? If you are a cybersecurity leader you have some company. One-third of 400 infosec leaders in the U.S. and the United Kingdom recently surveyed said they are considering leaving their job. Of those, one-third would do it in the next six months. This is according to research done for a security company called BlackFog. What may be surprising is the numbers aren’t bigger considering the pressures of cybersecurity-related jobs. Thirty per cent of respondents said the part of the job they disliked the most is the lack of work-life balance. An almost equal number, 27 per cent, said too much of their time is spent fighting fires rather than focusing on strategic issues. On the other hand, 44 per cent said what they most like about their job is being the company’s protector.
Something else to consider: Twenty-eight per cent said they had resigned from a previous job after a damaging cyber attack at their organization. And 13 per cent said they were let go because of a cyber attack.
Is your organization on the list? This is not a list of the best, the most profitable or the most beautiful companies. These are the companies that allegedly have been penetrated by hackers who are selling their access for further exploitation by other threat actors. Depending on the month, an average of 190 organizations are regularly listed by about 100 initial access brokers. That’s according to a recent report from Israeli cybersecurity firm Kela. The access would be through things like compromised remote desktop portals for employees. An average price would be around $2,800. Access to some victims is sold by auction. For example, in July one broker set a starting price of $20,000 for access to an electric utility in France.
I’ve warned before that clicking on an ad when doing an internet search can be risky. Unlike a standard link in a search, an ad-related link can go to a malicious website. Here’s the latest example, as reported by the Bleeping Computer news site: Recently people searching for the open source image editor called GIMP would see a result — labeled ad — that linked to the legitimate site ‘www.gimp.org.’ But those who clicked went to ‘gilimp[.]org.’ If they didn’t look closely at the address bar, it looked like ‘gimp.’ And to be convincing the headline on the fake website said GIMP in big letters. And of course, that was the point — to fool unsuspecting victims into thinking was the real GIMP site so they’d download software. They would think it was the GIMP editor, but instead was malware. Remember, ads on any search page don’t look like an ad with a photo. They are pieces of text with a link. But on most good search engines an ad is labeled ‘ad.’ Google, Apple, Mozilla and other search engine companies try hard to screen out bad ads. Sometimes they fail.
Remember links to details about podcast stories are in the text version at ITWorldCanada.com.
Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.
