CIRA unveils new Internet Performance Test to help Canadians better understand broadband speeds

Posted in Commentary with tags on January 30, 2025 by itnerd

Today, CIRA is proud to unveil a completely redesigned version of its popular Internet Performance Test (IPT) as part of its Net Good program. First launched in 2015, CIRA’s Internet Performance Test enables Canadians to test their mobile and home broadband performance across dozens of data points while gathering comprehensive and accurate data on broadband coverage and quality nationwide. The latest version of IPT provides users with an enhanced test-results dashboard, to ensure users understand critical aspects of their internet performance including how their connection supports common online activities like streaming services or video calls.

While Canada has made great strides to bridge the digital divide in the past few years, there is still work to be done to ensure the speeds that are being promised are actually attained. The new IPT will allow Canadians to verify whether they are receiving the speeds and quality of service advertised. CIRA will then leverage Canadians’ anonymous broadband data and real-world daily experience to help municipalities, local and federal governments and consumers create a heat map of where connectivity upgrades are most urgently needed.

Key features

  • The new user interface guides participants intuitively through the testing process, improving accessibility for users of all technical backgrounds.
  • Enhanced user interface makes running a test faster and easier on smartphones, tablets and desktops.
  • Through a new, interactive dashboard, users can now explore trends and performance data from previous tests, gaining a deeper understanding of internet performance changes. These insights empower individuals, researchers and policymakers to track progress and identify gaps.
  • More accurate user location estimation improves the quality of location-specific internet performance data, which is vital in analyzing broadband access across regions or within a community or neighbourhood.

To run a test and learn more about CIRA’s Internet Performance Test, visit: https://www.cira.ca/en/net-good/internet-performance-test/


Leave a comment »

KnowBe4 Launches Threat Labs Research and Analysis Initiative to Mitigate Human-Targeted Cybersecurity Attacks

Posted in Commentary with tags on January 29, 2025 by itnerd

KnowBe4, the world-renowned cybersecurity platform that comprehensively addresses human risk management, today announced its new Threat Labs to mitigate human-targeted cybersecurity attacks. 

This initiative specializes in researching and mitigating email threats and phishing attacks, using a combination of expert analysis and crowdsourced intelligence. The cybersecurity researchers and analysts behind KnowBe4 Threat Labs discover and investigate the latest phishing techniques and develop strategies to preemptively combat these threats.

The first publication from KnowBe4 Threat Labs, Using Genuine Business Domains and Legitimate Services to Harvest Credentials, analyzes a sophisticated phishing campaign targeting multiple organizations to harvest Microsoft credentials. During this campaign, threat actors utilized a compromised domain, its subdomains, bulk email services, and open redirect vulnerability to evade detection and increase click success rates.

Research conducted by KnowBe4 Threat Labs will be published on the KnowBe4 Blog. For more information on KnowBe4, visit www.knowbe4.com.

Leave a comment »

IBM and Palo Alto Networks Find Platformization is Key to Reduce Cybersecurity Complexity

Posted in Commentary with tags , on January 29, 2025 by itnerd

New global research from the IBM Institute for Business Value (IBV) and Palo Alto Networks, found that surveyed organizations are facing security complexity challenges as they juggle an average of 83 different security solutions from 29 vendors. It also shows 7 out of 10 surveyed companies with a high degree of security platformization report their cybersecurity investments have helped business outcomes such as operational efficiencies and revenue generation.

In the study, “Capturing the cybersecurity dividend: How security platforms generate business value,” more than half (52%) of surveyed executives note fragmentation of security solutions is limiting their ability to deal with cyber threats, but 75% of organizations that have embraced security platformization agree that better integration across security, hybrid cloud, AI, and other technology platforms is crucial. The analysis suggests the trend of adding more solutions to combat evolving security threats is contributing to inefficiency – impacting both performance and the bottom line – while moving to a platformized security approach can help businesses achieve reduced response times and costs without sacrificing security efficacy.

Cybersecurity Complexity is a Daunting Reality
Increased digital interconnectedness expands attack surfaces and can create new cybersecurity vulnerabilities. Cyberattacks are becoming more sophisticated and harder to defend against, while AI is being used by both defenders and attackers, creating a race in cybersecurity capabilities.

In an evolving threat landscape, surveyed executives estimate security fragmentation and complexity costs their organizations an average of 5% of their annual revenue. For a $20 billion annual revenue company, that’s a $1 billion cost to the business in aggregate. Tally the costs of security incidents, lost productivity, failed digital transformations, stalled AI initiatives, loss of customer trust and reputational damage and the numbers add up.

Key insights from surveyed business leaders:

  • 52% of executives say complexity is the biggest impediment to their cybersecurity operations;
  • 80% agree they face pressure to reduce the cost of security, and 41% say security fragmentation has driven up procurement costs;
  • 4 out of 5 non-platform organizations say their security operations cannot effectively deal with the sheer quantity of threats and attacks;
  • 80% of platformization adopters say they have full visibility into potential vulnerabilities and threats; and,
  • For platformized organizations, mean time to identify (MTTI) and mean time to contain (MTTC) security incidents are shorter by an average of 72 and 84 days, respectively.

Enhancing Businesses with Platformization: Unleashing the Power of Digital Transformation
In today’s world, the research finds effective security requires platformization. Consolidating multiple tools into a unified platform not only bolsters security posture but enables organizations to experience nearly 4 times better return on investment (ROI) from their cybersecurity investments, leading to revenue generation and increased operational efficiencies.

When it comes to AI, a platform approach can also enable an organization to better ingest and analyze data to deliver actionable insights. With 90% of surveyed executives expecting to scale, optimize, or innovate with AI within the next two years, integrating AI into their platforms can play a critical role in advancing their security preparedness. For example, accelerating adoption of agentic AI for security and tapping platformization for fewer investment cycles; or, using platformization to create the common governance needed to deliver the AI capabilities shaping the future.

By adopting a platformization approach, businesses can align technologies, drive innovation, and prioritize security as a core business requirement. Through IBM and Palo Alto Networks’ strategic partnership, the companies are bringing together leading security platforms, AI, and transformation capabilities to help organizations confidently navigate their digital transformation journey, achieve their desired outcomes and drive substantial business value.

Tips for Platformization Success

  • Choose partners that streamline your security mission and trim those that don’t. Critically evaluate current and potential technology, services, and support partners, and make hard decisions about where to double down and when to part ways.
  • Run your playbook. Stage incident response drills to assess where a unified platform can deliver the greatest impact. Take action to improve your incident response capabilities.
  • Help your business get prepared to respond to threats by putting it to the test. Visit a cyber range to prepare business and technical teams to address the latest cyber threats through an immersive, organization-wide business-focused engagement. IBM and Palo Alto Networks now provide a joint Cyber Range experience in Cambridge, Massachusetts, where clients can leverage the facility to support continuous improvement, training, and change management as they transform their security operating models with platformization.

Additional Resources:

Study Methodology
This IBM Institute of Business Value (IBV) research, conducted in collaboration with Oxford Economics and published in partnership with Palo Alto Networks, surveyed 1,000 executives across 21 industries and 18 countries from July through September 2024. The IBM IBV team then analyzed insights and data from respondents to facilitate the creation of a “platformization index,” which measures the extent to which an organization has moved toward security platformization, then used that index to ascertain the relationship between security platformization and security and business outcomes.

The IBM IBV, IBM’s thought leadership think tank, combines global research and performance data with expertise from industry thinkers and leading academics to deliver insights that make business leaders smarter. For more world-class thought leadership, visit: www.ibm.com/ibv.

Leave a comment »

SailGP selects Ericsson as global technology supplier for the 2025 Season

Posted in Commentary with tags on January 29, 2025 by itnerd

 SailGP, the most exciting racing on water, is set to benefit from the fastest mobile connectivity possible as the SailGP F50 catamaran fleet teams up with Ericsson at iconic venues across the globe in 2025. 

Ericsson Enterprise Wireless Solutions will provide teams and personnel with seamless, high-quality 5G connectivity, improving fan experiences and race operations. Additionally, the solutions will support SailGP umpires to adjudicate on race protocol through the enhanced capabilities of 5G-enabled live camera streaming from competing F50s and insights into team locations, tactics, and strategy. 

Split-second human responses across the various teams will make the difference between victory and defeat across the SailGP fleet. To support those decisions, each team will have access to the fastest connectivity possible under some of the most challenging physical conditions. Ericsson’s solutions deliver instant real-time data and statistical feedback, despite the F50s reaching speeds up to 100 km (about 62.14 mi) per hour over open waters. 

Ericsson’s Cradlepoint edge routers – installed in the wings of each F50 – are expected to handle more than 53 billion data points across the fleet per race day, including IoT, video and critical communications from competing boats connecting to Ericsson Private 5G during each race day. It was important that 5G connectivity solutions could be deployed across a diverse landscape and connect to multiple carriers. They also required a ruggedized edge router in each F50 that could withstand rough maritime conditions. For the safety of the athletes and the boat, neither may leave the dock until the F50 and its crew are fully connected and communicating.

SailGP initially worked with Ericsson and T-Mobile to test and deploy the Ericsson Private 5G solution over T-Mobile’s 5G spectrum at U.S. events in Season 4. The solution will be installed and deployed in all F50s and rolled out globally for the 2025 season. Key outcomes include:

  • Performance Optimization: The real-time transport of extensive data between off- and on-shore teammates on boat speed, wind conditions, and other factors, allowing real-time data analysis to maximize speed and efficiency by adjusting sail settings and boat trim.
  • Enhanced Tactical Decision-Making: The immediate availability of data on race position, course layout, and wind direction enables teams to make informed tactical decisions during races, such as choosing optimal sailing angles, deciding when to tack or gybe, and strategizing for mark roundings.
  • Increased Fairness and Transparency: The real-time transportation of data directly and securely into Oracle Cloud (OCI) enables racers to share data with all teams, including boat speed, wind direction and course layout, and race position. This helps SailGP prevent any unfair advantages and promotes fair competition.
  • Enhanced Spectator Engagement: Data sharing and improved bandwidth also enhance the spectator experience by providing insights into the intricacies of sailing tactics and strategy, making races more engaging and understandable for viewers.

You can learn more about how Ericsson’s 5G solutions support SailGP here.

Leave a comment »

Wallarm Releases 2025 API ThreatStats Report Revealing that APIs are the Predominant Attack Surface

Posted in Commentary with tags on January 29, 2025 by itnerd

Wallarm, a global leader in API security, today released its 2025 API ThreatStats Report, revealing that APIs have emerged as the predominant attack surface over the past year, with AI being the biggest driver of API security risks. Wallarm’s annual report bridges a critical gap between technical and strategic aspects of API security by sharing actionable insights tailored to the distinct responsibilities of CISOs and CIOs.

Wallarm’s researchers tracked 439 AI-related CVEs, a staggering 1,025% increase from the prior year. Nearly all (99%) were directly tied to APIs, including injection flaws, misconfigurations, and new memory corruption vulnerabilities stemming from AI’s reliance on high-performance binary APIs. With the exponential rise in AI adoption and exploits, Wallarm introduced a new ThreatStats Top 10 category, Memory Corruption and Overflow. This new category addresses vulnerabilities that arise from improper memory handling and access, resulting in security breaches such as unauthorized data access, crashes, and arbitrary code execution, and was driven by Wallarm’s analysis of how AI workloads interact with hardware, exposing APIs to issues like buffer overflows and integer overflows.

Additionally, more than 50% of all recorded CISA exploited vulnerabilities were API-related for the first time, a 30% increase from the year before, and this highlights the growing prevalence and criticality of API security in modern threat environments. API vulnerabilities surpass traditional exploit categories like kernel, browser, and supply chain vulnerabilities, underscoring their central role in cyberattacks.

Key insights and observations include:

  • AI as a catalyst for new vulnerabilities: In Wallarm’s survey of 200 US-based enterprise leaders on AI and API security, over 53% reported engaging in multiple AI deployments. These deployments are primarily enabled by API technology, cementing APIs as the foundation of enterprise AI adoption. However, while AI integration drives rapid API adoption across industries, it also introduces unique risks. For instance, Wallarm’s threat intelligence flagged significant vulnerabilities in AI tools like PaddlePaddle and MLflow, which underpin enterprise AI deployments. These tools were exploited at API endpoints, compromising training data, siphoning intellectual property, or injecting malicious payloads into machine learning pipelines. Additionally, APIs facilitating real-time data exchanges between AI models and applications often lack adequate security measures, making them susceptible to injection, abuse, and memory-related exploits.
  • Legacy and modern APIs both under attack: While legacy APIs such as those used in Digi Yatra and Optus incidents remain vulnerable due to outdated designs, modern RESTful APIs are equally at risk due to complex integration challenges and improper configurations. APIs now represent the largest category of exploited vulnerabilities in CISA KEV, with modern APIs representing over 33%. Exploits include improper authentication, injection attacks, and API endpoint misconfigurations, targeting enterprise-grade platforms with prominent attacks, including Invanti and Palo Alto Networks. Legacy APIs in web applications represent over 18% of exploited vulnerabilities. These vulnerabilities arise in older APIs typically used within web applications for AJAX backends, URL parameters, or direct calls to .php files. Often integrated into devices like cameras or IoT systems, these APIs lack the robust security measures of their modern counterparts, with key exploit types including URL-based injection, CSRF attacks, and outdated session handling mechanisms.
  • Growing exploitation of authentication and access control: The Twilio and Tech in Asia breaches demonstrated how attackers exploit weak authentication and access control mechanisms to gain unauthorized access. These issues are exacerbated by the decentralized nature of API management in large organizations, as API-related breaches escalate in frequency and severity. For instance, in last year’s Wallarm Annual Report based on 2023 data, API-related breaches were significant but sparse, with only a few incidents reported each quarter. In 2024, this picture changed dramatically, with an average of three monthly incidents—and, at times, as many as five to seven breaches each month. The rise of API-driven systems in sectors like healthcare, transportation, technology, and financial services has led to a surge in vulnerabilities, placing APIs squarely at the center of the cybersecurity landscape.

Underscoring the report’s central findings is that AI security is API security. As APIs drive innovation, particularly in AI-enabled systems, organizations need real-time API controls to protect their business operations, customer trust, and long-term success. Looking ahead to 2025, organizations must prioritize API security to safeguard their systems and unlock the full potential of APIs as the key driver of business transformation.

To download the report, visit https://www.wallarm.com/resources/2025-api-threatstats-tm-report.

Leave a comment »

Deepgram Accelerates Into 2025, Empowering 200,000+ Developers From Startups to Global Enterprises to Build Voice AI

Posted in Commentary with tags on January 29, 2025 by itnerd

Deepgram, the leading voice AI platform for developers building speech-to-text (STT), text-to-speech (TTS), and full speech-to-speech (STS) offerings, today announced record business growth and technical milestones achieved in the past year. Today, over 200,000 developers build with Deepgram’s voice-native foundational models, choosing Deepgram due to its unmatched accuracy, low latency, and pricing, as well as the flexibility for all voice-native AI models to be accessed through cloud APIs or self-hosted / on-premises APIs. Organizations that build on Deepgram’s infrastructure for STT, TTS, and AI Voice Agents include technology ISVs building voice products or platforms, co-sell partners working with large enterprises, and enterprises solving internal use cases. 

Looking forward to 2025, Deepgram will continue to innovate to extend its unique value proposition of offering the highest accuracy and lowest COGS at scale and highest model adaptability, and lowest latency. Through continued innovation, Deepgram expects to end 2025 as the industry’s only end-to-end speech-to-speech solution built to solve the four critical challenges of enterprise-ready voice AI:

  1. Accuracy / audio perception: Enterprise use cases require high recognition, understanding, and generation of specialized vocabulary in often challenging audio conditions. Deepgram solves this through novel, non-lossy compressions of these spaces for rapid processing paired with generation, training, and evaluation on synthetic data that precisely matches Deepgram customers’ real-world conditions.
  2. COGS at scale: Deepgram customers need to profitably build and scale voice AI solutions. Deepgram delivers this through its unique latent audio model with extreme compression combined with deep expertise in high-performance computing.
  3. Latency: Real-time conversation requires near-instantaneous responses. Deepgram achieves this using streaming state space model architectures, optimized specifically for the underlying hardware to deliver minimal processing delays.
  4. Context: Effective conversations are deeply contextualized. Deepgram will pass the speech Turing test thanks to its ability to train on vast bodies of data that thoroughly represent its customers’ use cases and pass that context through the entire system and interaction.

Additional Resources:

●      Read about Deepgram’s groundbreaking voice agent API

●      Watch a fun demo of Deepgram’s voice agent API

●      Try Deepgram’s interactive demo

●      Get $200 in free credits and try Deepgram for yourself

Leave a comment »

Threat Actors Mimic Amazon Prime Membership to Steal Credit Card Data 

Posted in Commentary with tags on January 28, 2025 by itnerd

Researchers have uncovered a new hacking campaign using PDF documents announcing an expired Amazon Prime membership with links to phishing pages that impersonate Amazon and request credit card data:

Javvad Malik, lead security awareness advocate at KnowBe4, commented:

“The initial attack vector, where users are beguiled into opening an email attachment containing a PDF file, is a stark reminder of the importance of remaining vigilant of emails. Emails still remain the most popular attack avenue for phishing, so it’s important that people have the right education and tools at their disposal to be able to effectively identify and report any suspicious activity. 

“Amazon’s proactive steps, including the takedown of numerous phishing websites and the implementation of advanced email verification technology, are commendable. However, the incident is a reminder that takedowns are like a game of whack-a-mole and more malicious sites will continue to crop up. So it’s important that users remain ever vigilant and informed about the potential threats we face online.”

This serves as a reminder that you need to treat anything and everything that hits your inbox with suspicion. On top of that, you should never click on links from any random email because bad things may happen to you.

Leave a comment »

KnowBe4’s Top 10 Tips to Take Charge of Your Data on Data Privacy Day

Posted in Commentary with tags on January 28, 2025 by itnerd

KnowBe4, the world-renowned cybersecurity platform that comprehensively addresses human risk management, celebrates Data Privacy Day with practical and impactful recommendations to help individuals and organizations take charge of their data security.

In an age where data is constantly collected, shared, and monetized, Data Privacy Day serves as an annual reminder about the importance of protecting and facilitating online privacy. Data Privacy Day began in the United States in January 2008 as an extension of the Data Protection Day celebration in Europe and is officially led by NCSA in North America. The National Cybersecurity Alliance has expanded it into Data Privacy Week, with the 2025 theme ‘Take Control of Your Data’, which encourages individuals to reclaim their digital autonomy through simple, actionable steps to make informed privacy choices. For organizations, the message emphasizes the need to respect and prioritize users’ data privacy.

Data privacy is more critical than ever, especially when social media platforms, AI chatbots and connected devices have increased publicly available digital footprints. This creates opportunities for the misuse of personal information and data traces which can lead to incidents of identity theft, financial fraud, and even psychological harm.

Recognizing the shared responsibility of safeguarding data, DePaula shares the 10 top tips for individuals and organizations to help take control of their data in 2025:

Tips for Individuals

  1. Vet your apps and tools: Before using new apps, check their data usage policies, control options, and origin to ensure they are trustworthy.
  2. Optimize IoT device privacy: Adjust settings in your IoT device apps to enhance privacy, such as disabling voice recordings, limiting data storage, or controlling ad preferences.
  3. Educate your family: Discuss online safety with family members, especially children, covering topics like avoiding sharing personal information, recognizing suspicious links, and managing location sharing.
  4. Set up a reputable password manager: Use it for critical accounts and generate strong, unique passwords.
  5. Enable multi-factor authentication (MFA): Activate MFA, preferably with a FIDO token, for critical accounts as an added layer of protection.

Tips for Organizations

  1. Minimize data collection: Only collect and store data that is essential for business operations. Eliminate unnecessary personal or payment information.
  2. Communicate transparency in privacy policies: Clearly explain what data is collected, how it is used, and with whom it is shared.
  3. Train employees: Educate all employees on data protection regulations, while training them to recognize the latest social engineering attacks and other security risks.
  4. Encrypt personal data: Protect personal data—at rest and in transit—from unauthorized access or exposure.
  5. Vet vendors and partners: As a ‘responsible party’, your organization is responsible and accountable for protecting the data of its subject – even if the processing is outsourced to third parties. Ensure that any external parties handling your organization’s data maintain a high standard of privacy and protection.

For more insights and best practices on data privacy, visit www.knowbe4.com.

Leave a comment »

Cyware Launches Industry’s First Pre-Configured Threat Intelligence Platform with Team Cymru

Posted in Commentary with tags on January 28, 2025 by itnerd

Cyware, the leading provider of threat intelligence management, low-code/no-code security automation, and cyber fusion solutions, today announced an important collaboration with Team Cymru to pre-configure Team Cymru’s industry-leading threat feeds into Cyware’s Threat Intelligence Platform (TIP). This packaged solution delivers real-time visibility into botnets, malware, command and control (C2) infrastructure, and external malicious activity, empowering organizations to detect and respond faster to even the most sophisticated adversaries.

By incorporating Team Cymru’s threat feeds—including the Botnet Analysis and Reporting Service (BARS) feed and the Controller (C2) Feed—into Cyware’s advanced TIP, organizations gain access to more accurate and up-to-date intelligence. This enhanced intelligence is designed to allow security teams to identify, analyze, and mitigate malware and botnets with precision and speed to help fortify their defenses against cyberattacks.

With this solution, customers benefit from approximately 10,000 unique IPs daily and the processing of approximately 6-7 million unique events, providing detailed threat indicators and attributes that are often missing in traditional threat feeds. When combined with Cyware’s operationalized threat intelligence capabilities, it is designed to enable security teams to:

  • Stop malware and DDoS attacks before they impact networks and infrastructure
  • Harden network defenses by integrating threat indicators with firewalls, intrusion prevention systems (IPS), and intrusion detection systems (IDS)
  • Automate threat hunting for DNS-based attacks and monitor malicious communications
  • Gain geolocation, victimology information, and detailed campaign histories to contextualize threats

The combined solution also offers unique and critical insights into malware families, unique control protocols, and encryption mechanisms, allowing organizations to prioritize and block malicious activity more effectively. With these capabilities, Cyware and Team Cymru are redefining what it means to stay ahead of cyber threats as global adversaries gear up for disruption.

For more information on Cyware and Team Cymru’s integration, visit https://www.cyware.com/partners/technology-alliances/team-cymru.

Leave a comment »

Deepseek Is Apparently Under Attack

Posted in Commentary with tags on January 28, 2025 by itnerd

Chinese AI startup Deepseek says it is temporarily limiting registrations due to large-scale malicious attacks on its services. Here’s a look at their status page which can be found at https://status.deepseek.com/:

Erich Kron, security awareness advocate at KnowBe4, commented:

“One of the key tenets of cybersecurity is availability. Combined with confidentiality and integrity of data, these make up what is known as the CIA triad. Although most people think of confidentiality and battling data breaches when it comes to cybersecurity, the lack of availability can be just as crippling to an organization if they are not able to provide the services they promise to their customers. With the popularity of DeepSeek growing, it’s not a big surprise that they are being targeted by malicious web traffic. These sorts of attacks could be a way to extort an organization by promising to stop attacks and restore availability for a fee, it could be rival organizations seeking to negatively impact the competition, or it could even be people who have invested in a competing organization and want to protect their investment by taking out the competition.

“The cybersecurity world has become global, with attacks originating from any continent on the planet and targeting any organization with a web presence. Unfortunately many counter moves, such as pausing new user registration to allow computing resources to be freed up for other services, can bring back the use of the platform for some, but also makes for a bad experience for potentially new subscribers and can be very damaging to the organization. In a time where internet outages can impact organizations to the tune of millions of dollars lost per hour, or more, the threat of attacks such as this is very real and should be carefully considered and planned for.”

I find it interesting that Deepseek is under attack given how much “noise” that they’ve made in the last few days. Ignoring the fact that no citizen of a western country should sign up for this service, it will be interesting to see if an how they recover, and how they defend against attacks like this in the future.

1 Comment »

« Older Entries
Newer Entries »