Search

A new study by cloud security company Zscaler has found a 60% increase in AI-driven phishing attacks. The report reveals that vishing (voice phishing) and deepfake phishing attacks are on the rise, with attackers using generative AI to amplify social engineering tactics. The United States, United Kingdom, India, Canada, and Germany were the top five countries targeted by phishing scams. The finance and insurance industry faced the highest concentration of phishing attacks, with a 393% year-over-year increase. Microsoft remains the most imitated brand, with 43.1% of phishing attempts targeting it. The report emphasizes the need for organizations to adopt a proactive, layered approach to counteract these evolving threats. [Extracted from the article]

Cyber criminals are increasingly targeting encrypted data in what are known as "harvest now, decrypt later" attacks. These attacks involve accumulating large amounts of encrypted data with the intention of decrypting it once quantum technology becomes advanced enough. While current encryption systems are still difficult to break, experts warn that with the development of quantum technology, interest in encrypted data will only increase. To protect encrypted data, users can minimize the risk of breaches, increase the level of encryption, and take steps towards crypto-agility. [Extracted from the article]

This article explores the implementation of zero trust architecture in industrial cybersecurity. It emphasizes the need for continuous improvement and tailoring the process to each organization's specific needs. The article outlines the DARIOM Life Cycle as a systematic method for implementing zero trust architecture, including steps such as discovery, assessment, redesign, implementation, operation, and monitoring. It also highlights the importance of identifying high-value assets, mapping assets to data and data flows, defining data sensitivity levels, and establishing clear rules for privileged accounts. The article concludes by emphasizing the need for ongoing monitoring and regular improvements to maintain a secure zero trust environment. Additionally, the article discusses the four levels of zero trust maturity defined by the Cybersecurity and Infrastructure Security Agency (CISA) and provides guidance on foundational tasks for organizations during the initial implementation phase. It emphasizes the importance of clear roles and responsibilities, securing high-value assets, network segmentation, device management, multifactor authentication, data protection, encryption, automation, and operational components. The article also highlights the need for ongoing monitoring, remediation, and incident response in a zero trust system. Overall, the article promotes the adoption of a zero trust model to enhance cybersecurity and protect organizations' high-value assets. [Extracted from the article]

This article discusses the ethical considerations of using artificial intelligence (AI) in cybersecurity, particularly in industrial networks. The interviewee, Ethan Schmertzler of Dispel, highlights the importance of being cautious about the data fed to AI systems, as they can be trained to show biases and provide inaccurate information. The article also raises concerns about the potential impact of AI on social engineering attacks and the need for greater trust and identity verification in online interactions. While there are currently no specific regulations governing the use of AI in cybersecurity, the government is holding summits and hearings on the topic. [Extracted from the article]

This article discusses the impact of artificial intelligence (AI) on industrial cybersecurity. The author interviews Ethan Schmertzler of Dispel, who explains that AI will make social engineering attacks more sophisticated and harder to detect. He also discusses the potential benefits of AI in improving training and identifying problems in industrial control systems. However, there are also risks associated with integrating AI, such as human error and the need for increased security measures. The article suggests mitigating these risks by obscuring knowledge of how humans connect to control systems and using private channels with multifactor authentication. [Extracted from the article]

This article discusses the strengths and weaknesses of artificial intelligence (AI) in the field of cybersecurity, particularly in industrial automation. AI is being used by both defenders and attackers in cybersecurity, with applications such as threat detection and social engineering attacks. The strengths of AI include adaptability and its ability to handle complex decision-making tasks. However, challenges in integrating AI into traditional industrial automation processes include a talent shortage and issues with data availability and quality. The article also mentions that companies with more automated processes are better positioned to benefit from AI. [Extracted from the article]

Most larger companies have a staff -- or at least a person -- that handles cybersecurity. Gordon The big one is what everyone is talking about, which is artificial intelligence (AI). She talked about why security is everyone's job, how artificial intelligence (AI) won't replace humans and how "Office Space" is actually a cybersecurity movie. [Extracted from the article]

Molina: I actually find the fact that we are going through more of a way to evaluate risk, which is based on engineering ways of looking at things, a total shift and something that can really prevent bad things from happening because of the advent of artificial intelligence. Molina: We OT cybersecurity people always pitch ourselves against IT people, or against, I would say, the IT tools, which are not be used in OT for cybersecurity. So going back to these more OT attacks, which are the KNX attack or the attack in the Polish railways, both use something that everybody knows. With cybersecurity tools like firewalls and gateways, there is always a slim probability that they can be breached. [Extracted from the article]

Other than that, guys: AI, AI and AI. From my point of view, the new U.S. regulation that will mandate people to report cyberattacks will open a huge window of cyberattacks on OT environments, manufacturing, just basically utilities all along. There's a reason Cybersecurity Awareness Month always focuses on a few key behaviors, such as multifactor authentication, password security, recognizing phishing and updating software. [Extracted from the article]

Industrial Cybersecurity Pulse's top 5 articles from July 2023 covered the riskiest operational technology (OT) devices on the plant floor, how artificial intelligence (AI) will impact cybersecurity and the challenges facing information technology (IT)/OT convergence. The riskiest OT and ICS devices across critical infrastructure industries By Armis Security Armis recently released new research identifying the riskiest OT/ICS devices that pose threats to key critical infrastructure industries. Risks and challenges confronting IT/OT convergence and how to manage them By Luis Narvaez, Siemens IT/OT convergence in today's interconnected industrial landscape is vital for maximizing efficiency. [Extracted from the article]

While the exact timeline and origins of OilRig may not befully known, security researchers and cybersecurity firmsbegan tracking their activities and attributing attacksto the threat group around 2014, during a wave ofdestructive attacks in the Middle East. THREATS & VULNERABILITIES Increased connectivity has produced countless benefitsfor individuals, society and companies, but it has alsocreated an ever-expanding attack surface. Over the years, OilRig has employed arange of attack techniques to compromise its targets. [Extracted from the article]

ChatGPT's opinion of itself When ChatGPT was asked by ICS Pulse about the biggestcybersecurity risks it poses to the world, it demurred atfirst, saying that as an AI language model, it poses nodirect cybersecurity threat. When OpenAI removed the waitlist for ChatGPT-3 in November2022, effectively opening the artificial intelligence (AI)-driven chatbot to the public, it democratized AI. THREATS & VULNERABILITIES The 2023 RSA Conference in San Francisco covered a widerange of cybersecurity subjects, both on the informationtechnology (IT) and operational technology (OT) sides. [Extracted from the article]

From AOL to ILOVEYOU Though the AOL attack was rudimentary in its approach andtactics, it did lay the groundwork for what has become asomewhat standard playbook. How the AOL attack launched phishing According to Sophos' recently released State ofCybersecurity 2023 report, which surveyed 3,000respondents, phishing was the second biggest area ofconcern for IT professionals in 2023, with 40% ofrespondents citing it as a threat (trailing just behinddata exfiltration at 41%). [Extracted from the article]