Juan Perez

Check out best practices for preventing mobile communications hacking. Plus, how the U.S. government can improve financial firms' AI use. Meanwhile, the FBI warns about a campaign to hack vulnerable webcams and DVRs. And get the latest on a Chinese APT's hack of the Treasury Department; the federal government's AI use cases; and cyber tips for SMBs.

Shopping for OT systems? A new CISA guide outlines OT cyber features to look for. Meanwhile, the U.S. government publishes a playbook for collecting AI vulnerability data. Plus, a White House EO highlights AI security goals. And get the latest on IoT security; secure app dev; and tougher HIPAA cyber rules.

Check out tips for adopting AI securely from the World Economic Forum. Plus, the EU's DORA cyber rules for banks go into effect. Meanwhile, a report warns about overprivileged cloud accounts. And get the latest on ransomware trends; CIS Benchmarks; and data privacy.

The case will be decided by eight justices as Justice Amy Coney Barrett plans to recuse herself.

Even as school administrators and Democratic leaders repeat their promise to shield students and teachers from U.S. Immigration and Customs Enforcement agents, they appear unsure exactly how far to go to prevent federal agents from making arrests on campus.

The order will also reinstate the 1776 Commission that Trump created during his first term in office to promote patriotic education and counter lessons that he says divide Americans on race and slavery.

Check out the Cloud Security Alliance’s recommendations for rolling out AI apps securely. Meanwhile, a Deloitte survey found GenAI initiatives by cyber teams deliver the highest ROI to their orgs. Plus, the NSA urges orgs to combat GenAI deepfakes with content provenance tech. And get the latest on CISO trends; patch management; and data breach prevention.Dive into six things that are top of mind for the week ending Jan. 31.1 - CSA: Best practices for secure AI implementationLooking for guidance on how to deploy AI systems securely? You might want to check out the Cloud Security Alliance’s new white paper “AI Organizational Responsibilities: AI Tools and Applications.”Published this week, the paper covers three key areas: the security of large language models and generative AI applications; supply chain management; and additional implementation elements, such as employee use of generative AI tools. Each of those three areas is analyzed according to six areas of responsibility for teams deploying AI systems:Evaluation criteria: To assess AI risks, organizations need quantifiable metrics. That way, they’ll be able to measure elements such as model performance, data quality, algorithmic bias and vendor reliability.RACI model: It’s key to be clear about who is responsible, accountable, consulted and informed (RACI) regarding AI decisions, selection of tools and vendor management.High-level implementation strategies: Teams should outline the process for integrating AI tools and applications into existing workows, and particularly how they’ll address challenges such as data integration and model deployment.Continuous monitoring and reporting: The paper recommends continuously monitoring elements such as AI tool performance and data drift, and regularly generating reports on AI system health and vendor compliance.Access control: It’s critical to implement strong access-control mechanisms to protect algorithms, data and AI infrastructure.Adherence to AI standards and best practices: Complying with AI standards, regulations and guidelines will help teams, for example, secure AI applications, conduct responsible AI development and mitigate supply chain risks.“As AI technologies evolve and their adoption expands across industries, the need for strong governance, security protocols, and ethical considerations becomes increasingly critical,” Michael Roza, the paper’s lead author, said in a statement.Some of the white paper’s key takeaways include:AI security requires addressing both traditional and AI-specific cybersecurity concerns.Effective third-party and supply chain management is critical. Organizations need clear policies and guidelines for employees’ AI use.AI governance requires clear role definitions and specialized skills.For more information about AI security, check out these Tenable blogs:“Securing the AI Attack Surface: Separating the Unknown from the Well Understood”“6 Best Practices for Implementing AI Securely and Ethically”“How AI Can Boost Your Cybersecurity Program”“Never Trust User Inputs -- And AI Isn't an Exception: A Security-First Approach”“Harden Your Cloud Security Posture by Protecting Your Cloud Data and AI Resources”2 - Report: Cybersecurity use of GenAI produces highest ROIAs enterprises deploy generative AI across their business, cybersecurity initiatives are generating the highest return on investment (ROI).Moreover, cybersecurity initiatives are more deeply integrated into work processes than initiatives from other departments, such as sales, research and development, and finance.Those findings come from Deloitte’s “The State of Generative AI in the Enterprise: Generating a new future” report, based on a survey of about 2,770 directors and CxOs from organizations piloting or implementing generative AI.“Relative to other types of advanced GenAI initiatives, those focused on cybersecurity are far more likely to be exceeding their ROI expectations,” reads the report from Deloitte, which polled respondents in 14 countries.Specifically, the survey found that 44% of respondents' cybersecurity initiatives are delivering an ROI that is “somewhat or significantly above expectations.” (Source: Deloitte’s “The State of Generative AI in the Enterprise: Generating a new future” report, January 2025)While these findings reflect positively on how cybersecurity departments are deploying generative AI, the technology still faces adoption challenges in enterprises in general, the report notes, including:Regulatory uncertaintyRisk managementData deficienciesWorkforce issuesSpecifically, regulatory concerns have become the top barrier for generative AI adoption, while almost 70% of respondents estimate that it’ll take their organizations more than a year to fully implement a generative AI governance strategy.The report’s recommendations for successful adoption of generative AI in enterprises include:CxOs must ensure IT and business leaders work in tandem.Ensure generative AI initiatives deliver measurable ROI by, for example, focusing on high-impact use cases; establishing centralized governance; and continuously iterating.Plan for the eventual adoption of agentic AI systems, which can act with a high degree of autonomy, requiring little or no human intervention.To get more details, check out the report’s announcement, the full report and this video of a panel discussion about the report:For more information about using generative AI for cybersecurity:“GenAI’s Impact on Cybersecurity” (InformationWeek)“Generative AI in Cybersecurity: Assessing impact on current and future malicious software” (The Alan Turing Institute)“How Can Generative AI Be Used In Cybersecurity?” (eWeek)“Building a Generative AI-Powered Cybersecurity Workforce” (SANS Institute)“GenAI use cases rising rapidly for cybersecurity — but concerns remain” (CSO)3 - How content provenance tech helps flag AI deepfakesOrganizations must get acquainted with a key technology designed to track the origin of media files and that way verify if they have been maliciously created or modified to spread falsehoods and misinformation.That’s the message from the Australian, Canadian, U.K. and U.S. governments, which this week jointly published the document “Content Credentials: Strengthening Multimedia Integrity in the Generative AI Era.”“Advanced tools that allow the easy creation, alteration, and dissemination of digital content are now more accessible and sophisticated than ever before,” the 25-page document reads. “This escalation threatens organizations’ security, with AI-generated media being used for impersonations, fraudulent communications, and brand damage. Therefore, restoring transparency has never been more urgent,” the document adds.The technology in question is called Content Credentials, and, according to the document, it’s in the process of becoming global ISO standard 22144. It tracks the provenance of media files by logging their creation and subsequent changes, and storing that information as encrypted, tamper-evident metadata.Co-authored by the U.S. National Security Agency, the Australian Cyber Security Centre, the Canadian Centre for Cyber Security and the U.K. National Cyber Security Centre, the document seeks to:Explain how Content Credentials can provide media-provenance transparencyCreate awareness about how Content Credentials is being developedRecommend best practices for how to preserve provenance dataStress why broadly adopting Content Credentials is criticalThe Content Credentials technical specification is developed and maintained by the Coalition for Content Provenance and Authenticity (C2PA) and implemented by the Content Authority Initiative (CPI). For more information about Content Credentials:“The inside scoop on watermarking and content authentication” (MIT Technology Review)“Best Inventions of 2024: Content Credentials” (Time Magazine)“What are Content Credentials? Here's why Adobe's new AI keeps this metadata front and center” (ZDNet)“New technology to show why images and video are genuine launches on BBC News” (BBC)“Not Sure if an Image Is AI? Check Its Nutrition Label, Thanks to a New Adobe App” (Cnet)VIDEOJoin the movement for content authenticity (Content Authenticity Initiative)4 - Study: CISOs’ access to the board and CxOs is criticalOrganizations where the CISO works closely with the board of directors and with fellow CxOs have stronger security programs than organizations where this collaboration is weaker.In addition, CISOs with strong ties to their boards and CxOs tend to be happier at work and to earn more.Those are two findings from the “State of the CISO 2025 Report” from IANS Research and Artico Search, based on a survey of 830 security executives.“This report demonstrates that board engagement and C-suite access is critical in shaping the future of a security program and a CISO’s career,” Steve Martano, IANS Faculty and Executive Cyber Recruiter at Artico Search, said in a statement.Yet, only 28% of survey respondents fell into the category of “Stragegic CISO,” defined as one with outstanding C-suite access and boardroom influence. The majority – 50% – were deemed as “Functional CISOs,” who despite having “significant influence” nonetheless lack consistent visibility with the board or CxOs.The rest – 22% – were classified as “Tactical CISOs” because they focus mostly on technology and have minimal interaction with the C-suite and the board. (Source: “State of the CISO 2025 Report” from IANS Research and Artico Search,” January 2025)Obviously, the recommendation is for all CISOs to rise to the category of “Strategic CISO,” as close communication and collaboration with the board and fellow CxOs -- including CFOs -- is essential to align the security program with the business strategy.For CISOs to have optimal communication with board members and CxOs, the report recommends that they:Volunteer for projects and committees to explain to fellow business leaders the security angle of these cross-functional initiatives.Delegate tactical and operational tasks on team members so CISOs have more time for strategic work.Instead of limiting themselves to technical topics, CISOs should address strategic governance issues and that way act as a partner to the other CxOs.To get more details, check out:The blog “Build CISO Strategic Impact and Visibility”The “State of the CISO 2025 Report”The announcement “IANS Research and Artico Search Unveil The State of the CISO, 2025 Report”5 - Tenable: What are your patch management challenges?During our recent webinar “From Reactive to Proactive: Expert Guide to Effective Remediation Automation,” we polled attendees about their struggles with patch management. Check out what they said. (124 webinar attendees polled by Tenable, January 2025)Check out the on-demand webinar to learn about actionable strategies and proven approaches for streamlining remediation, improving patching efficiency and reducing risk.To learn more about patch management and vulnerability management, check out these Tenable resources:“Elevate Your Vulnerability Remediation Maturity” (white paper)“Context Is King: From Vulnerability Management to Exposure Management” (blog)“The State of Vulnerability Management” (white paper)“What is patch management?” (article)VIDEOKey Elements of Effective Exposure Response6 - Data breach report: Many incidents preventable with standard cyberAlmost 200 data breaches that occurred in the U.S. last year -- including several of the largest ones -- could have been prevented via the use of well-known cybersecurity practices.That’s one of the findings from the Identity Theft Resource Center’s “2024 Data Breach Report,” which was published this week and is the latest reminder of the importance of adopting foundational cybersecurity tools and procedures.“A significant number of data compromises could have been avoided with basic cybersecurity,” ITRC President James E. Lee wrote in the report’s introduction.Specifically, four of 2024’s “mega-breaches,” which collectively resulted in the issuance of 1.24 billion victim notices, were deemed preventable through cybersecurity processes and techniques, including:multi-factor authentication (MFA) or passkeyssecure software software developmentvulnerability patchingsecurity awareness trainingHere are other key findings from the report:The 3,158 U.S. data compromises recorded in 2024 fell 1% compared with 2023. Most of the incidents – 90% – were categorized as data breaches.Cyberattacks caused the majority – 80% – of data breaches. The rest were caused by system and human errors; physical attacks; and supply chain attacks.Victim notices skyrocketed 312% to 1.72 billion, driven by 2024's six “mega-breaches,” each of which generated at least 100 million notices.The hardest hit industry was financial services, followed by healthcare and professional services.To get more information, check out the ITRC’s report announcement and the full report.For more information about data security:“How To Protect Your Cloud Environments and Prevent Data Breaches” (Tenable)“Protecting Sensitive and Personal Information from Ransomware-Caused Data Breaches” (CISA)“Know Your Exposure: Is Your Cloud Data Secure in the Age of AI?” (Tenable)“Preventing data breaches” (Australian Cyber Security Centre)“Why data breaches have become ‘normalized’ and 6 things CISOs can do to prevent them” (VentureBeat)

An executive order — which President Donald Trump is expected to sign sometime this month — was expected to lay out a two-part strategy for shuttering the agency.

Check out recommendations from CISA and others on how to protect network edge devices. Plus, OWASP has published the 10 risks associated with non-human identities. In addition, find out why ransomware payments plunged in 2024. And a new U.K. non-profit will categorize cyber incidents' severity. And much more!

Check out recommendations from CISA and others on how to protect network edge devices and applications. Plus, OWASP has published the 10 risks associated with non-human identities. In addition, find out why ransomware payments plunged in 2024. And a new U.K. non-profit will categorize cyber incidents’ severity. And much more!Dive into six things that are top of mind for the week ending Feb. 7.1 - New cyber guides unpack how to secure network edge waresLooking for insights and best practices for preventing and mitigating cyberattacks against network edge hardware and software devices, such as routers, VPN gateways, IoT devices, web servers and internet-facing operational technology (OT) systems? You might want to check out new guidance published by several cybersecurity agencies this week.“Foreign adversaries routinely exploit software vulnerabilities in network edge devices to infiltrate critical infrastructure networks and systems,” reads a statement from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).“These guidance documents detail various considerations and strategies for a more secure and resilient network both before and after a compromise,” the statement adds. These are the new guides, jointly published by cyber agencies from various countries:Security Considerations for Edge Devices, led by the Canadian Centre for Cyber Security (CCCS), includes:A description of common threats to edge devices, such as misconfigurations and mismanagement; vulnerability exploitation; and denial of service attacksExamples of edge device compromisesRecommendations for mitigating threats to edge devicesDigital Forensics Monitoring Specifications for Products of Network Devices and Applications, led by the U.K.’s National Cyber Security Centre (NCSC), explains why and how edge devices should support event logging and forensic data acquisition.Mitigation Strategies for Edge Devices: Executive Guidance and Mitigation Strategies for Edge Devices: Practitioner Guidance, two guides led by the Australian Cyber Security Centre (ACSC), focus on threat mitigation and are aimed, respectively, at executives responsible for enterprise network security; and at operational, cybersecurity and procurement staff for edge devices.“As organizations scale their enterprises, even though securing all devices is important, prioritizing edge device security is vital to defend the many endpoints, critical services, and sensitive data they protect,” Eric Chudow, a U.S. National Security Agency cybersecurity vulnerability analyst, said in a statement.For more information about network edge vulnerabilities, check out these Tenable blogs:“New CISA Hardening Guidance Provides Valuable Insights for Network Security Engineers”“Salt Typhoon: An Analysis of Vulnerabilities Exploited by this State-Sponsored Actor”“Volt Typhoon: U.S. Critical Infrastructure Targeted by State-Sponsored Actors”“CVE-2025-0282: Ivanti Connect Secure Zero-Day Vulnerability Exploited In The Wild”“CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability”“Rockwell Automation: Disconnect OT Devices with Public-Facing Internet Access, Patch or Mitigate Logix, FactoryTalk CVEs”“CVE-2023-20198: Zero-Day Vulnerability in Cisco IOS XE Exploited in the Wild”2 - OWASP ranks top cyber risks of non-human identitiesRecognizing the significant growth in non-human identities (NHIs), such as access keys and service accounts, OWASP has published a list of the 10 most critical risks associated with them.The goal of the “OWASP Non-Human Identities Top 10” project is to make software developers and security pros aware of NHI risks and of the best practices to prevent and mitigate related threats.“Non-human identities are prevalent in usage for facilitating creation of applications by developers, and the project is aimed at helping security professionals thoroughly understand their non-human attack surface, so they can better protect and manage it,” reads the project’s home page.Here’s the OWASP list of the top 10 NHI risks:NHI1:2025 - Improper Offboarding, which refers to inadequate deactivation or removal of NHIs after they’re no longer needed NHI2:2025 - Secret Leakage, which refers to the insecure exposure of NHIs such as API keys, tokens and certificates in a way that could allow attackers to exploit themNHI3:2025 - Vulnerable Third-Party NHI, which refers to NHIs from external sources that are integrated into a development environment and that have a security flawNHI4:2025 - Insecure Authentication, which refers to NHIs whose authentication methods are unsafe because, for example, they’re obsolete or vulnerable to attacksNHI5:2025 - Overprivileged NHI, which refers to NHIs that are assigned excessive privileges, making them a major risk if they’re ever compromisedNHI6:2025 - Insecure Cloud Deployment Configurations, which refers to the use of insecure NHIs, such as dedicated service accounts with static credentials, to authenticate cloud services in CI/CD pipelines NHI7:2025 - Long-Lived Secrets, which refers to the use of NHIs, such as API keys and encryption keys, that either expire too far off in the future or that never expireNHI8:2025 - Environment Isolation, which refers to the use of the same NHIs throughout an application’s lifecycle, including in its development, testing, staging and production environmentsNHI9:2025 - NHI Reuse, which refers to the use of the same NHIs in different applications, services or componentsNHI10:2025 - Human Use of NHI, which refers to the manual use by people of NHIs, which can result in elevated privileges for NHIs and other risks“This comprehensive list highlights the most critical challenges in integrating NHIs into the development lifecycle, ranked based on exploitability, prevalence, detectability, and impact,” reads the project’s home page.For more information about securely managing digital identities:“Who’s Afraid of a Toxic Cloud Trilogy?” (Tenable)“The State of Non-Human Identity Security” (Cloud Security Alliance)“Non-Human Identities Gain Momentum, Requires Both Management, Security” (TechTarget)“Managing Non-Human Identity Risks” (Non-Human Identity Management Group)“What are non-human identities and why do they matter?” (CSO)3 - Report: Ransomware payments dropped in 2024If your organization suffers a ransomware attack, would it be less willing to pay the attackers than, say, it would have been a few years ago? If so, then you’d be part of a growing trend.Last year, ransomware gangs collectively pocketed less money than in 2023, as victims refused to shell out ransom payments in more than half of 2024 incidents. That’s according to blockchain analytics firm Chainalysis, which this week said that although ransomware incidents grew in 2024, ransom payments shrunk significantly compared with 2023.Another factor that disrupted ransomware activity was a variety of global law enforcement efforts that hobbled major ransomware players.Specifically, ransomware groups collected about $814 million from victims last year, down 35% from $1.25 billion in 2023.Interestingly, ransomware payments in the first half of 2024 were up about 2.4%, compared with the same period in 2023. However, payments then declined about 40% in 2024’s second half.(Source: Chainalysis, February 2025)Two large ransomware gangs whose activity plummeted in the second half of 2024 were LockBit, which was hit by law enforcement actions, and ALPHV/BlackCat.Although lone actors and smaller new groups emerged, they weren’t able to fully fill the ransom-payment void left by disrupted larger groups, which also included Blacksuit and Silent/Luna Moth.“Ransomware in 2024 reflected shifts driven by law enforcement action, improved victim resilience, and emerging attack trends,” reads Chainalysis’ report.For more information about recent ransomware trends and incidents:“Ransomware: Predictions and Actions in 2025” (SC Magazine)“New ransomware group Funksec is quickly gaining traction” (CSO)“Lynx Ransomware Group 'Industrializes' Cybercrime With Affiliates” (Dark Reading)“Ransomware crew abuses AWS native encryption, sets data-destruct timer for 7 days” (The Register)“Act fast to blunt a new ransomware attack on AWS S3 buckets” (CSO)4 - New non-profit will analyze and rate U.K. cyber incidentsThe Cyber Monitoring Centre (CMC) went live this week with the charter of using a standard and uniform criteria for rating the severity of cybersecurity incidents that impact U.K. businesses.An independent non-profit organization, the CMC hopes its work will help organizations more clearly grasp the consequences of cyber incidents so that they can improve their mitigaton and response.“The CMC has the potential to help businesses and individuals better understand the implications of cyber events, mitigate their impact on people’s lives, and improve cyber resilience and response plans,” reads a CMC statement.The CMC has developed a framework for assessing and analyzing cyber incidents that affect multiple companies and could potentially cause more than £100 million in losses. The CMC’s technical committee will gather cyber incident data and use the framework to analyze it.“Measuring the severity of incidents has proved very challenging,” Ciaran Martin, the CMC’s technical committee chairman and a former head of the U.K. National Cyber Security Centre, said in the statement.“I have no doubt the CMC will improve the way we tackle, learn from, and recover from cyber incidents,” he added. Once it has completed its analysis of an incident, the CMC will rate it between 1 (least severe) and 5, and create a free report available to any interested organization.To get more details about the CMC, check out the announcement “Cyber Monitoring Centre officially starts categorising cyber events” and the organization’s “Event Categorisation Methodology.”5 - CISA alerts healthcare orgs about backdoor in Contec toolHere’s one security warning for hospitals, clinics and other healthcare facilities.The product Contec CMS8000, used to monitor patients’ vital signs, has a backdoor that can allow data leakage, remote code execution and device modification, CISA has warned.The Contec CMS8000’s embedded backdoor function with a hard-coded IP address is present in three versions of the product’s firmware, according to CISA’s factsheet. Two CVEs have been assigned to the issue: CVE-2025-0626 and CVE-2025-0683. The Contec CMS8000 is also sold under different names, including Epsimed MN-120. The manufacturer, Contec Medical Systems, is based in Qinhuangdao, China.To get more details about healthcare security, check out:CISA’s alert “CISA Releases Fact Sheet Detailing Embedded Backdoor Function of Contec CMS8000 Firmware”CISA’s factsheet “Contec CMS8000 Contains a Backdoor”CISA’s medical advisory “Contec Health CMS8000 Patient Monitor”The U.S. Food & Drug Administration’s safety communication “Cybersecurity Vulnerabilities with Certain Patient Monitors from Contec and Epsimed”6 - E-marketplaces for cybercrime wares shut downThe U.S. Department of Justice and and Dutch National Police took down almost 40 domains and their servers that a Pakistan-based group had used for years to sell phishing toolkits, hacking wares and other cybercrime tools.The group, known as Saim Raza and as HeartSender, had operated the now shuttered websites since at least 2020. Its customers were organized cybercrime groups that inflicted losses of more than $3 million on U.S. victims, mostly via business email compromise schemes. “The seizure of these domains is intended to disrupt the ongoing activity of these groups and stop the proliferation of these tools within the cybercriminal community,” reads a DOJ statement.In addition to selling cybercrime tools, Saim Raza also provided training via instructional videos posted on YouTube on how to use these products and on how to carry out cyber fraud operations.For more information about cybercrime trends:“3 Cybercrime Trends Tech Pros Must Watch in 2025” (Dice)“Insider fraud and AI threats top forecasts of 2025 cybercrime” (American Banker)“DoJ Shutters Cybercrime Forums Behind Attacks on 17M Americans” (Dark Reading)“Cybercrime is increasingly complex. Here's how data awareness can help” (World Economic Forum)“Cybercriminals are using AI to target macOS in 2025” (Apple Insider)