Contrast Security Releases Modern Heist Bank Report 2025 Which Revealing Critical Concern Over Zero-Day Attacks

Posted in Commentary on February 4, 2025 by itnerd

Contrast Security, the runtime security leader, today released Modern Heist Bank Report 2025, revealing that the financial sector faced a surge in attacks, with 64% of respondents reporting cybersecurity incidents in the past 12 months. Contrast Security’s annual report sheds light on the cybersecurity threats facing the financial sector, providing an eye-opening perspective on the changing behavior of cybercriminals and defensive shifts in today’s environment.

Contrast Security researchers found that 71% of respondents reported zero-day attacks as the key concern to safeguarding applications and APIs, followed by dwell time (43%) and lack of visibility into the application layer (38%). The overwhelming concern with zero-day attacks aligns with key industry research and trends showing significant increase in zero days being exploited year-over-year. The rise in zero days is largely due to heavy spending from nation states. China and Russia are increasing their efforts to discover and create zero days to infiltrate Western critical infrastructures. 

Financial institutions are further challenged by legacy technology, with 82% overrelying on web application firewalls (WAF) and 61% saying they considered their WAFs to be effective. However, reliance on WAFs alone is inadequate against zero-day exploits and modern application attacks. In light of all this, it’s no surprise that zero days were the top application-related security concern. In fact, fewer than 25% said they were confident that their current security controls could mitigate such an attack.

The report’s key findings include:

  • Two-thirds of financial institutions have experienced a cyber incident in the last 12 months
  • Respondents reported a 12.5% increase in destructive cyber attacks, which are launched punitively to destroy data and burn the evidence as part of a counter-incident response 
  • Over two-thirds experienced attacks focused on stealing non-public market information, with cybercriminals using it for insider trading, digital front running, and shorting stock before they dox the stolen, confidential data to the regulators
  • Over 71% said zero-day attacks were the biggest issue they faced in regard to safeguarding their applications and APIs
  • Over half experienced a supply chain attack
  • Top two attack vectors were APIs and cloud environments, followed by applications
  • 60% said their investments in XDR did not provide visibility into behavioral anomalies at the application layer

Offense must inform defense, and as zero days and API attacks surge, financial institutions need to implement ADR solutions purpose-built to provide ground truth at the application layer.  

ADR is the only real-time and always-on application and API security solution that prevents exploits in production and insecure programming during development. As a result, organizations are enabled to block attacks and easily scale to protect the entire software portfolio, including applications, APIs, and third-party applications.

To download the full report, visit https://www.contrastsecurity.com/modern-bank-heists-report-2025-adr.

Zoho Corporation Announces Zia Agents; AI Platform Supporting Autonomous Agents Across Organization’s Broad Portfolio

Posted in Commentary with tags on February 4, 2025 by itnerd

Zoho Corporation, a global technology company, today expands the scope of Zia with the announcement of Zia Agents, Agent Studio, and Agent Marketplace. Together, these solutions empower enterprises to access, build, and distribute intelligent, autonomous digital agents across their organizations. Beginning today, Zoho and ManageEngine will be previewing pre-built, task-specific Zia Agents, which will deploy across Zoho Corporation’s combined portfolio of 100+ products in the coming weeks. 

Zoho Corporation’s in-house AI has evolved over the past decade from proactive to prescriptive to generative to agentic: 

Zia: Launched in 2015, Zia is Zoho Corporation’s foundational AI, facilitating all intelligent and contextual actions across the company’s ecosystem of apps. Zia possesses a vast and diverse skillset. New skills are being implemented regularly to boost customer experience and drive productivity.

Ask Zia: Launched in 2018, Ask Zia has developed into a system-wide conversational assistant that helps employees work smarter and accomplish tasks more effectively. For example, an account manager can review a report of customers at risk of churn, summarize the outcomes of each customer’s recent interactions, filter and summarize helpdesk tickets, analyze trends in their industry, and reach out to that customer for a meeting based on the employee’s upcoming travel schedule, without leaving the Ask Zia interface. Ask Zia is powered by Zoho’s unified data platform and will be contextually embedded across all applications.

Zia Agents: Today, Zoho Corporation has previewed some of the several dozens of pre-built Zia Agents that will be rolled out in the coming months, including an Account Manager Agent, SDR Agent, HR Agent, Customer Support Agent, IT Help Desk Agent, and a SalesCoach Agent. For customers, partners, and developers looking to create their own agents, Zoho is launching Zia Agent Studio, allowing them to build and deploy customized agents with inherited skillsets, which can then be distributed through Zoho’s Agent Marketplace.

  • Zia Agent Studio: Offering no-code and low-code experiences, Zia Agent Studio enables users to build autonomous agents with skills relevant to their specific needs. Zia Agent Studio users can also access a wide range of pre-existing Zia Skills, tools from across the Zoho ecosystem, data from a unified data platform, and a range of language models. These can be agents within a function (like an SDR agent or email support agent) or natively cross-functional agents (like an RFP agent or loan approval agent). They can be deployed on any Zoho application and summoned using Ask Zia. Moving forward, Zia Agents will be deployable in any third-party application as well. Additionally, Zia Agents with complementary skillsets can be combined using Zia Agent Studio, creating a single agent capable of cross-functional work.
  • Agent Marketplace: Agents created using Zia Agent Studio can be published in the Agent Marketplace. Zoho Corporation will offer a pre-built roster of agents, while the company’s ecosystem of partners and developers can build and distribute specialized AI agents through the marketplace, which can be reused and instantly deployed by organizations. 

Organizational Differentiation

Today’s announcement follows record growth for Zoho Corporation, which onboarded 110,000 new customers globally in 2024. With over 850,000 customers globally in diverse industries, using a range of tools across Zoho and ManageEngine, Zoho Corporation’s AI solutions are informed by a vast range of functional data. This is a core differentiator for the company, putting it in a unique position to serve businesses with cutting-edge technology. 

Technological Differentiation

Zoho Corporation’s distinct technological breadth and depth is a fundamental differentiator, particularly in AI development and deployment. Leveraging its shared data model, owned and managed tech stack, including global data centers, and a broad application portfolio, Zoho Corporation’s highly secure, privacy-compliant, usable, capable, and deeply knowledgeable AI agents deliver superior technology at a high value to its growing customer base. 

Availability

These capabilities will begin to roll out to a limited set of customers, which will expand monthly. 

OWC Announces General Availability (GA) Launch of OWC Dock Ejector 2.0

Posted in Commentary with tags on February 4, 2025 by itnerd

 Other World Computing (OWC) today announced the general availability (GA) launch of the OWC Dock Ejector 2.0, the ultimate solution for efficiently and safely ejecting all connected devices, including SoftRAID and AppleRAID volumes. This updated version works with all docks, including non-OWC docks and hubs, expanding compatibility and drive protection to all Mac and PC users.

The newly enhanced OWC Dock Ejector takes the tedium and risk out of un-docking devices individually. By ensuring all data has been written before any disk is unmounted, you can safely eject your dock without worrying about losing or fragmenting files.

New in OWC Dock Ejector 2.0:

1.)  Streamlined install process (new for Mac) – OWC is the first to ship software that enables high-power Thunderbolt dock ports without requiring reduced macOS security settings.

  • OWC Dock Ejector 2.0 eliminates the need for Recovery Mode and simplifies the process compared to competing docks, which require users to boot into Recovery Mode, lower Mac security settings, reboot multiple times, and install system extensions. With OWC Dock Ejector 2.0, simply install the software, approve the system extension, and you’re done!

2.)  Enhanced Volume Mounting (new for Mac) – OWC Dock Ejector 2.0 simplifies volume management like never before. If you unmount a volume, you can easily remount it without the hassle of unplugging cables or using Apple’s Disk Utility application.

OWC Dock Ejector 2.0 Features and Benefits:

●     Data Security – Avoid data corruption by safely ejecting all connected drives with a single click.

●     Easy Connection Management – Optimized for seamless disconnection of storage devices and peripherals.

●     Security First – No need to compromise your macOS security settings.

●     Timesaving – Skip the tedious recovery mode process required by other docks.

●     User-Friendly – Designed for simplicity without sacrificing functionality.

OWC Dock Ejector 2.0 is now generally available (GA) and is FREE.

Visit https://www.owc.com/solutions/dock-ejector to learn more and start optimizing your workflow.

Tariffs And IT: Are They Disruptive To The Sector?

Posted in Commentary on February 3, 2025 by itnerd

President Donald Trump loves his tariffs. He sees them as an offensive weapon. Actual economists don’t see it that way. But they don’t run the US. The real question is, what effect will tariffs have? To answer that question, I got this comment from  Kevin Surace, CEO, Appvance the “Father of The Virtual Assistant” regarding the potential impacts of proposed tariffs on IT. Seeing as this is an IT focused blog:

“Tariffs will increase the cost of nearly all hardware since components are sourced from China and many products are assembled there as well. It’s a little late to mitigate! But moving sourcing out of China has been an obvious choice for a few years. Few did so. But now there is no choice but to scramble.

“In some cases where automation is possible, we will see more onshoring. In other cases nearshoring or sourcing from democracies. The days of dealing with communist countries for ultra low labor costs may be waning.

The IT industry both sources from and sells to China specifically. This will likely increase competition within China from local vendors and increase US vendors costs. It cannot have a positive effect on any customers.”

I have to admit that I am considering moving up some of my tech purchases to lessen the impact of tariffs. Because while I don’t know how long this will go on for, I do know that there will be no winners.

“Infrastructure Laundering” Exploits AWS and Azure to Launch Attacks

Posted in Commentary with tags on February 3, 2025 by itnerd

Researchers have identified a new cybercrime tactic they’ve dubbed “Infrastructure Laundering” exploiting mainstream Amazon Web Services and Microsoft Azure. Threat actors operating “hosting companies” rent IP addresses from mainstream hosting providers and map them to their criminal client websites. You can read the details of this new threat here:

 https://www.silentpush.com/blog/infrastructure-laundering/

Erich Kron, security awareness advocate at cybersecurity company KnowBe4, commented:

“It’s no secret that phishing and other scam websites don’t stay online very long, and this is a clever way to acquire the IP address needed to host credential stealing, malware spreading, or other scam websites with little or no risk and very low cost. By utilizing major providers, the bad actors make it much tougher for organizations to block IP ranges, because those major providers may also be providing legitimate IP addresses for important web services. This precludes the ability to block large chunks of addresses easily.

Because the bad actors are not likely to set up an account using their own information, they’re liable to rely on stolen accounts to acquire these new IP addresses. Because much of the account takeovers involve the use of stolen or cracked credentials, it makes the need for the use of a phishing resistant Multi-Factor Authentication (MFA) technology critical, especially on any accounts with elevated permissions.

Organizations should review the accounts with access, audit transactions, and educate people on how to spot potential malicious activity within their cloud accounts.”

I strongly suggest that you do read it as it is eye opening. Even for someone like yours truly who lives this stuff on a daily basis.

VPN Mentor Reports On Generative AI’s Impact on Cybersecurity

Posted in Commentary with tags on February 3, 2025 by itnerd

VPN Mentor just published an Q&A report in which they delve deeper into AI’s groundbreaking technology and its impact on cybersecurity. Cybersecurity expert Jeremiah Fowler sheds light on the critical role that generative AI plays in safeguarding digital environments against evolving threats. 

You’ll find the full report here: https://www.vpnmentor.com/news/genai-and-cybersecurity/

Bell Canada Seriously Needs To Fix Their Customer Service Issues

Posted in Commentary with tags on February 2, 2025 by itnerd

I’ve written about Bell’s customer service issues in the past. For example when I was a customer of their’s (technically I still am as my ISP of the moment is Distributel which is owned by Bell) I had this incident. Or this incident. But at the same time, this incident highlighted the fact that Bell is capable of stepping up and providing good customer service.

Today I’m going to tell you about a client of mine who is on the negative side of this. It stated last week when she phoned me to ask me to visit her home to troubleshoot a TV issue. This client has Bell for home phone, Internet, TV and cellular, and she couldn’t watch TV. When I arrived I quickly determined that the Bell TV box wasn’t connecting to her Gigahub, which is Bell’s name for their modem that connects you with their fibre optic service known as Fibe. Taking a look at the Gigahub, it appeared to be frozen. No problem I thought. I will reboot it and all should be right with the universe. Except unplugging it and plugging it back in resulted in a reboot loop. As it it would constantly reboot. That implied that the Gigahub was faulty. So since this client is a senior, she asked to help her talk to Bell to get this fixed. So she dialled them, verified her identity using her PIN along with a bunch of other information and then let me take control of the call to troubleshoot this with Bell. Long story short, it was determined that the Gigahub was faulty. The person on the other end of the line claimed that a new one would be sent out by FedEx or Purolator Courier preconfigured and would arrive the next day.

Now my Spidey Sense went off as I have never heard of Bell shipping replacement modems of any kind that quickly. But I dismissed that as I thought that maybe Bell had stepped up their game. I then asked the client to call or email me when the modem arrived, I would do the modem swap and drop off the old modem with whatever courier company Bell used to ship it to her.

The next day the modem didn’t arrive as Bell promised. I honestly wasn’t surprised by that. And when the client checked in with Bell to see what the problem was…. I’ll let her tell you in her own words via the email that she sent me:

So no delivery of a Bell box…. Such a nuisance!

What’s the next step?

I asked her to phone Bell. And she did. This was the next email that I got:

So…. Eventually it turns out that the order is in for a new modem but that it takes 2-3 business days… 

So we’ll see…

Cheers 

Now this sounds like the Bell that I am used to dealing with. It also meant that the guy that we spoke to together lied.

Sidebar: In my opinion, companies who provide customer facing support as part of their product offering need to aggressively monitor every employee they have to ensure that any bad actors are found and eliminated. And conversely any excellent employees are found, praised, and rewarded for the good work. That way you create a culture where providing excellent customer service is the only behaviour that is acceptable. I suspect Bell doesn’t do this at all, or as aggressively as they should because if this guy is on their payroll or part of an company that they outsource to and is able to lie to customers, it’s highly likely that other people exist within Bell or whatever company they outsource to who also do the same thing as they think that their odds of getting caught are low.

Unfortunately, things only get worse from here. I followed up with her a couple of days later when I didn’t hear from her and got this response:

So the saga continues…. No orders were put in.. I tried Sat and this am.

So I’m trying to dismantle the modem in order to return it to a Bell store (50 Bloor)

I can’t dislodge the cable.

Could you possibly swing by to do that?

The cable that she was referring to was the fibre optic cable. I was working with another client at the time and didn’t see this email until a couple of hours had passed, and by that point she got her son to come over to remove the cable. Hopefully not breaking it as fibre optic cables are fragile. But now we’ve moved from a situation where the new modem which the Bell rep said would arrive the next day, to one where the modem would arrive in two or three days, to one where an order for a new modem was never put in which forces a senior to take the old modem to a Bell store in hopes of getting a replacement.

Now the story does get better. Sort of. She did return the modem to the store after removing the cable. And then three days later a new modem did arrive and her son was able to help her to set it up. But the whole experience left her frustrated and upset and reconsidering if she should continue her relationship with Bell.

The thing is, negative experiences with Bell seem to be a common thing these days. Besides this report from the CCTS where complaints about Bell are not only up massively, but are second only to Rogers as well. And a browse of the Bell SubReddit seems to validate that Bell isn’t in a good place when it comes to customer service. Take this example, or this example, or this example. Now to be fair to Bell, these are a handful of examples that I found in five minutes of browsing on Reddit. But my counter argument to that is that if you accept that only a handful of people complain about service in public, there are many others who complain in places other than Reddit. And if you’re Bell, you should be very, very concerned.

Now Bell hasn’t posted its quarterly numbers yet. But last quarter it lost money which is absolutely mind blowing to me as Bell as long as I have been alive has just made money simply by existing. One factor in them losing money was this:

BCE added 33,111 net postpaid mobile phone subscribers, down 76.8 per cent from the same period last year, which was the company’s second-best performance on the metric since 2010.

It said the drop was driven by higher customer churn — a measure of subscribers who cancelled their service — amid greater competition and promotional offers. BCE’s monthly churn rate for the category was 1.28 per cent, up from 1.1 per cent during its previous third quarter.

“I’m not happy with where churn is. I don’t think anyone would be given the numbers,” said Bibic, adding the company is coping with “what’s arguably been the most competitively intense market we’ve seen.”

“It is a marketplace reality that consumers are continuing to shop for deals given the sustained, aggressive promotional offers that are in the marketplace. So because of that, you’re going to see a lot of switching activity.”

BCE also saw 11.6 per cent fewer gross subscriber activations. Bell’s wireless mobile phone average revenue per user (ARPU) was $58.26, down 3.4 per cent from $60.28 in the third quarter of the prior year.

This isn’t a good situation for Bell. But you fix a situation like this by having a good product at a fair price with good customer service to back it up. If Bell is going to improve their fortunes, they need to improve on all these fronts. Especially customer service. Because without that, the first two don’t matter.

Let’s see if they’re able to do that over the near term. I don’t think they can, but as always, I am free to be surprised.

LimaCharlie Free Cybersecurity Workshop On 2/12/25 In Plano, TX

Posted in Commentary with tags on February 2, 2025 by itnerd

Join LimaCharlie at Legacy Food Hall in Plano, TX for an intensive, hands-on cybersecurity workshop tailored specifically for MSSPs, MDR providers, and incident response teams.

In this technical deep-dive, industry veterans Ken Westin and Matt Bromiley will guide you through practical implementations that directly address your operational challenges. 

Learn how to streamline your Okta security monitoring through purple team exercises, and master automated incident response workflows to dramatically improve your team’s efficiency. Discover how to leverage infrastructure as code and automation to scale your security operations while maintaining the high standards your clients expect.

These free workshops provide innovative ways to enhance your service capabilities and include a post-event happy hour for networking with your peers. Space is limited – reserve your spot today.

  • What: Free cybersecurity workshops featuring hands-on training with LimaCharlie and open-source adversary emulation tools 
  • When: February 12, 2025
  • Session 1: 1:00 PM – 3:00 PM – Purple Team Okta Security with Ken Westin – Identity Security Posture Management (ISPM) is a critical component to any organization’s security program, particularly in a highly distributed environment. In this hands-on workshop we will show attendees how to onboard Okta logs to the LimaCharlie Security Operations Platform, write detections for key events, and test detections using open source adversary emulation tools. The workshop will be run in an individual lab we will build using a combination of free and open source tools. A basic understanding of YAML and writing detections is helpful but not required.
  • Session 2: 3:00 PM – 5:00 PM – IR Automation with Matt Bromiley – Incident response is an art that requires speed and precision, oftentimes racing against adversaries and their actions. In this workshop, we will look at how to utilize LimaCharlie to automate incident response workflows from end-to-end. Attendees will learn how to utilize infrastructure as code to rapidly deploy IR-focused tenants, easily ingest various telemetry types, and deploy detections to automate the classification and prioritization of a client environment. Designed for incident responders, this hands-on session will highlight how LimaCharlie can streamline incident response efforts, giving your team the advantage it needs to quickly thwart attackers.
  • Happy Hour: 5:00 PM – 7:00 PM
  • Who: Security professionals, especially those from MSSP, MDR, and IR teams 
  • Why: To provide practical, hands-on experience with cutting-edge cybersecurity tools and techniques 

These workshops offer a unique opportunity for DFW-area security teams to enhance their skills in Okta security and incident response automation. Participants will work with real tools, including LimaCharlie, under the guidance of industry experts Ken Westin and Matt Bromiley.

Today Is Change Your Password Day

Posted in Commentary with tags on February 1, 2025 by itnerd

Change Your Password Day is today. Observed every year on February 1st, the day aims to raise awareness about cybersecurity and underscores the importance of keeping passwords strong and up to date.

But going beyond an annual password change, Dr. Martin Kraemer, security awareness advocate at KnowBe4, has shared the five following practices all organizations should adopt to improve their security hygiene in 2025:

  1. Monitor new passwords automatically: Use available tools to validate new passwords against known breaches and dark web datasets, and alert users to change their passwords if a match is detected.
  2. Encourage the use of pass-phrases or randomly generated passwords: Promote pass-phrases or randomly generated passwords for greater strength and resilience against attacks.
  3. Require the use of a password manager: Mandate password managers to securely create, store, and manage unique credentials, removing the burden away from the employee to remember long character combinations. 
  4. Recommend implementing Multi-Factor Authentication (MFA): Strengthen security by requiring an additional verification step, like a code, biometric, or token.
  5. Reduce the importance of password complexity in favor of length: Where a password manager cannot be used, encourage employees to focus on longer passwords or pass-phrases rather than relying heavily on complex character requirements.

Dr. Kraemer commented: “While Change Your Password Day is a great reminder to all employees of their individual responsibility when it comes to cybersecurity, in today’s climate, it might be better named ‘Use Strong Authentication Day.’ Changing your password regularly once served as a timely reminder that cybersecurity mattered, even if the act itself did not always result in greater security. Now, the actions required of employees may be different, but the message remains the same—everyone has a part to play in safeguarding their organization against threats.”

New York Blood Center Pwned In Ransomware Attack

Posted in Commentary with tags on January 31, 2025 by itnerd

The New York Blood Center, one of the world’s largest independent blood collection and distribution organizations, says a Sunday ransomware attack forced it to reschedule some appointments.

Here’s what happened:

On Sunday, January 26, New York Blood Center Enterprises and its operating divisions identified suspicious activity affecting our IT systems. We immediately engaged third-party cybersecurity experts to investigate and confirmed that the suspicious activity is a result of a ransomware incident. We took immediate steps to help contain the threat and are working diligently with these experts to restore our systems as quickly and as safely as possible. Law enforcement has been notified.

We understand the critical nature of our services, and the health of our communities remains our top priority. We remain in direct communication with our hospital partners and are implementing workarounds to help restore services and fulfill orders.

Paul Bischoff, Consumer Privacy Advocate at Comparitech, commented: 

“Ransomware gangs don’t discriminate between charitable organizations and for-profit companies. Medical organizations are frequently targeted because they can’t operate for long without their computer systems, and those systems store a lot of sensitive patient and employee data. That makes hospitals and clinics more likely to pay ransoms. Furthermore, hospitals employ a lot of non-IT staff that attackers can phish.”

For the second time today, I am writing about a health care organization who has been pwned. Seriously, the fact that this sector is pretty much easy prey for threat actors needs to change. And it needs to change right now.