If you read this week’s “bad news” about the cybersecurity skills crisis, you’re probably not alone. But as I pondered the results of the workforce survey, I couldn’t help but think about all the ways in which the cybersecurity community is collectively working together to mitigate these concerns.
At RSA Conference 2022, which starts in just three days, attendees will learn about the ways organizations are working to close the skills gap by supporting women in cybersecurity. In fact, many of the sessions on the Inclusive Security agenda and in the Equality Lounge speak to the ways that hiring managers can diversify their teams. Women in Cybersecurity (WiCys) is represented on both of those agendas, and Dark Reading also reported this week that Microsoft Philanthropies will be partnering with WiCys to help close the skills gap.
Professional Development & Personnel Management is one of 24 tracks covered at RSAC2022, so be sure to checkout Transforming Security Champions and the follow up Birds of a Feather conversation with Tanya Janca to get a different perspective on attracting and retaining talented candidates.
Now let’s look at what else made industry headlines this week.
Jun. 3: The Hacker News reported, “An "extremely sophisticated" Chinese-speaking advanced persistent threat (APT) actor dubbed LuoYu has been observed using a malicious Windows tool called WinDealer that's delivered by means of man-on-the-side attacks.”
Jun. 3: “Atlassian customers have been warned that hackers are exploiting a Confluence Server zero-day vulnerability. The flaw is currently unpatched and it appears to have been exploited by multiple threat groups,” Security Week reported.
Jun. 2: Spending to protect critical infrastructure is projected to grow to more than $36 billion in 2027, which could support a claim made by Joel Fishbein, Managing Director of Software and Cloud Technology and Research at Truist, that the cybersecurity industry is recession resistant.
Jun. 2: Cyberscoop reported, “Hackers likely affiliated with the notorious Russian cybercrime group Evil Corp are using off-the-shelf ransomware to evade U.S. sanctions, researchers at security firm Mandiant have found.”
Jun.1: Wired explored the proliferation of voice recognition systems and the privacy implications that go along with them.
Jun. 1: At the Boston Conference on Cybersecurity 2022, FBI Director Christopher Wray revealed that threat intelligence aided the agency in stopping a cyberattack on Boston Children’s Hospital.
Jun. 1: The US Navy and the National Security Innovation Network (NSIN) are working to gamify cyber intrusion training.
Jun. 1: Zero trust ranked top on the priority list of 33% of cybersecurity leaders, according to a report published by Illumio and ESG.
Jun. 1: CISA, the FBI, and the Department of the Treasury released a joint warning about the Karakurt data extortion group, who have allegedly stolen data, “and threatened to auction it off or release it to the public unless they receive payment of the demanded ransom.”
May 31: Malicious actors continue to target Costa Rica, and this time have taken down the country’s public health services with a Hive ransomware attack. According to Krebs on Security, “Ransomware experts say there is good reason to believe the same cybercriminals are behind both attacks, and that Hive has been helping Conti rebrand and evade international sanctions targeting extortion payouts to cybercriminals operating in Russia.”
May 31: Days after the City of Portland reported a data breach, local cybersecurity experts said it was becoming increasingly more challenging to prevent these attacks.
May 31: A notorious Vietnamese hacker, Ngo Minh Hieu, who spent seven years in US prison for stealing the personal information of nearly 200 Americans, is now working at Vietnam’s National Cyber Security Centre.
May 30: Threatpost reported, “A zero-day vulnerability in Microsoft Office allows adversaries to run malicious code on targeted systems via a flaw a remote Word template feature.”