Episodes

  • What is the State of Ransomware in 2024

    What is the State of Ransomware in 2024
    Nov 20 2024
    In this eye-opening episode of the Security Swarm Podcast, host Andy Syrewicze and one of our regular guests, Eric Siron, examine the latest ransomware survey findings. They explore the evolving landscape of cyber threats, discussing key trends in ransomware attacks, including a decrease in overall incidents but an increase in the severity of successful breaches. The conversation provides crucial insights for IT professionals and business leaders, highlighting the importance of user training, cybersecurity awareness, and strategic approaches to mitigating ransomware risks. Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! Key Takeaways: Ransomware attacks decreased to 18.6% in 2024, continuing a downward trend. 16.3% of ransomware victims paid the ransom in 2024, a significant increase from 6.9% in 2023. 55.8% of ransomware attacks targeted small organizations with 50 or fewer employees. Over 52.3% of attacks were initiated through email/phishing attempts. 32.6% of ransomware victims were unsure if their data was exfiltrated. 81.3% of organizations provide end-user security awareness training. 54.6% of organizations have purchased ransomware-specific insurance. Threat actors are becoming more sophisticated in targeting and executing attacks. Living off the land attack techniques are increasingly common. Timestamps: (01:15) History of Ransomware Attacks (03:37) 2024 Ransomware Attack Statistics (08:59) Double Extortion Tactics (15:02) Target Selection and Organization Size (29:52) Security Awareness Training Insights (36:15) Ransomware Insurance Trends (41:44) Disaster Recovery and Insurance Strategies Episode Resources: Hornetsecurity Q3 2024 Ransomware Attacks Survey What is ransomware? How can you protect against Ransomware? -- Protect your organization from ransomware with Hornetsecurity's innovative Security Awareness Service - because your employees are your first line of defense! Why Security Awareness Training is critical against ransomware: 52.3% of ransomware attacks are caused by email/phishing attempts 81.3% of organizations provide end-user security awareness training Half of organizations want more time-friendly training methods An effective security awareness training works best when it's bite-sized, consistent and a part of the organization's security culture. Click here to schedule a free consultation with a Hornetsecurity specialist.
    Show More Show Less
    36 mins
  • The Tech Industry Has a Software Quality Issue

    The Tech Industry Has a Software Quality Issue
    Nov 8 2024
    In this episode of the Security Swarm Podcast, the dynamic duo Andy Syrewicze and Paul Schnackenburg discuss the software quality problem in the cybersecurity and technology industry, as highlighted by Jen Easterly, the director of CISA. They delve into the risks associated with software selection, the role of industry analysts, the importance of software stability and security over innovation, and the need for developers to focus on secure coding practices. One area Andy and Paul focus on are the risks associated with software selection, highlighting the importance of evaluating factors such as the software's origin, reputation, and security features when making decisions. Andy and Paul also discuss the role of industry analysts like Gartner and Forrester, and how their focus on innovation and feature sets may not always align with the critical need for stability, security, and reliable support. Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! Key Takeaways: The cybersecurity industry has a software quality problem, not just a security problem. Selecting software requires careful risk assessment, considering factors like the software's origin, reputation, and security features. Industry analysts often focus on innovation and features rather than software stability and security. The technology industry should reward software that is stable, secure, and operates as intended, not just the latest innovative features. Developers need to be trained in secure coding practices, as many graduates lack this knowledge. Understanding how threat actors could exploit vulnerabilities is crucial for developers to write secure code. The software landscape is constantly evolving, and the threat landscape is changing, requiring ongoing education and adaptation. Supply chain risks, such as pre-installed malware on refurbished devices, highlight the need for comprehensive security measures. Timestamps: (06:04) Assessing Software Risks (16:50) The Analyst Approach (21:11) Rewarding Stability and Security (27:16) Secure Coding Practices in Academia (32:59) Developers Understanding Threat Actors (34:33) Supply Chain Risks (37:32) Valuing Stability and Security over Innovation Episode Resources: Paul’s Article Andy and Eric’s Episode on Vendor Risk -- Proactively protect your organization's email from the growing threat of software vulnerabilities and malicious attacks. 365 Total Protection provides comprehensive security for Microsoft 365, safeguarding your business with advanced threat detection, spam filtering, and email encryption. Ensure your software is secure and your data is protected with Hornetsecurity's industry-leading 365 Total Protection. Defend your organization against sophisticated cyber threats with Hornetsecurity's Advanced Threat Protection, powered by cutting-edge technology. Our advanced system analyzes email content and attachments to detect and block even the most evasive malware and phishing attempts. Stay one step ahead of threat actors and protect your business with Hornetsecurity's Advanced Threat Protection.
    Show More Show Less
    39 mins
  • Security of the Windows Boot Process

    Security of the Windows Boot Process
    Oct 30 2024
    In this episode, Andy and Paul, the dynamic duo of the Security Swarm Podcast, delve into the often-overlooked security of the Windows boot process, revealing how recent leaks have compromised its integrity. Join Andy Syrewicze and Paul Schnackenburg as they break down how the boot process has evolved from the BIOS days to today's sophisticated UEFI system. They explore features like Trusted Boot and Secure Boot, which are designed to stop rootkits and other malware from hijacking the system. But things aren't as secure as they seem. Recent leaks of platform keys, including the infamous "PKFail" incident, have exposed vulnerabilities that threaten the whole system. Listen on to discover how these vulnerabilities are being exploited by attackers, the potential risks they pose to your system, and what you can do to safeguard your devices. Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! Key Takeaways: The Windows boot process is more complex than you think: It includes multiple phases, from basic hardware checks to kernel initialization and anti-malware checks, all before you even see the login screen. Secure boot and measured boot aim to protect against rootkits and bootkits: These security features check for trusted components and fingerprint the boot process to detect unauthorized changes. PKFail exposes a major vulnerability: A leaked test key used across 800 motherboard models allows attackers to bypass secure boot and load malicious software during the boot process as if it were legitimate. Firmware vulnerabilities are widespread: The boot process isn't the only place where attackers can hide malware. Network cards, storage devices, and other components with firmware can also be compromised. Rootkits and bootkits are persistent and difficult to remove: They can survive operating system reinstallation and are incredibly difficult to detect and remove, making them highly effective for attackers. Updating firmware is crucial: You need to keep your firmware updated just like you update your operating system and software to protect yourself from vulnerabilities. Beware of the dangers of compromised hardware: While less common than other attacks, these vulnerabilities should be addressed seriously. If you suspect a machine is infected, it's often best to discard it entirely. Timestamps: (01:27) Overview of Boot Process (05:39) Breakdown of the Boot Process Steps (08:44) Secure Boot and its Features (12:13) The PKFail Leak: Leaked Platform Key Weakens Secure Boot (17:18) Bootkits and Rootkits - The Types of Attacks (22:41) Digital Supply Chain Issues and the Leaked Keys (27:42) Mitigating PK Fail & Updating Firmware (30:15) Balancing Risk Profile & Protecting Against Other Attacks (31:39) Why Rootkits are a Major Persistence Threat Episode Resources: Github Repo of known compromised devices Ars Technica Article regarding UEFI Malware Intel Boot Guard News -- Hornetsecurity's Advanced Threat Protection (ATP) can help you stay ahead of these threats. ATP provides: Threat intelligence: Stay informed about emerging security threats like bootkit and rootkit vulnerabilities. Advanced detection: Identify and block these highly sophisticated threats before they can compromise your systems. Real-time protection: Prevent malicious code from executing, even at the boot level. Don't wait for a breach! Contact Hornetsecurity today to learn how Advanced Threat Protection can help you secure your boot process and protect your organization from the most persistent malware threats. Click here to schedule a free consultation with a Hornetsecurity specialist.
    Show More Show Less
    35 mins
  • The Psychology of Cybercrime

    The Psychology of Cybercrime
    Oct 24 2024
    This episode of the Security Swarm Podcast dives deep into the psychological landscape of cybersecurity, exploring the driving forces behind different threat actors. Host Andy Syrewicze welcomes first-time guest Angelica Ortega, Founder & CEO of Novify and an active member of the cybersecurity community with a sharp focus on the psychology of cybercriminals. Together, they unravel the motivations of nation-state actors, hacktivists, and cybercriminals, highlighting the role of narcissism, risk-taking behavior, and ideological beliefs. Angelica shares personal experiences with pig butchering, a devastating form of romance scam, and discusses the emotional toll it took on a friend. The episode also delves into the mental health challenges facing cybersecurity professionals, including burnout and the need for psychological safety in teams. Through insightful discussions and personal anecdotes, Andy and Angelica emphasize the importance of understanding and addressing the human element in cybersecurity, both on the defensive and offensive sides. This episode sheds light on the often-overlooked psychological dimensions of cybercrime and cybersecurity, urging listeners to consider the human impact of these activities and the need for greater awareness and support for both professionals and victims. Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! Key Takeaways: Threat actors can be categorized into three main groups: nation-state actors, hacktivists, and cybercriminals, each with distinct psychological motivations. Narcissism and risk-taking behavior are common traits observed in cybercriminals, while hacktivists are driven by ideological beliefs, and nation-state actors are motivated by political goals. Cybersecurity professionals, particularly blue teams and ethical hackers can also exhibit narcissistic tendencies due to the psychological stress and pressure of their roles. The rise of cryptocurrency has enabled cybercriminals to more easily obfuscate illicit payments and profits, further fueling their motivations. Romance scams and "pig butchering" schemes, where threat actors slowly gain the trust of victims over time, can have devastating psychological and financial consequences for the victims. Educating the public, especially vulnerable groups like the young and elderly, and providing psychological support for victims of cybercrime are crucial in addressing the psychological aspects of cybersecurity. The fear of missing out (FOMO) can be a powerful motivator for individuals to engage in risky or unwise financial decisions, which threat actors often exploit, particularly in the cryptocurrency space. Timestamps: (04:19) Categorization of threat actors (07:17) Psychological traits of different threat actor groups (09:50) Narcissism in cybersecurity professionals (18:22) Impact of cryptocurrency on cybercrime (25:16) Romance scams and "pig butchering" schemes (31:36) Educating the public and providing psychological support for victims (35:44) The role of FOMO in enabling cybercrime Episode Resources: Old Hornetsecurity Roundtable with some Psychology discssions -- Your organization is vulnerable to more than just technical exploits. Hackers target the human element, leveraging emotions like fear, greed, and trust to gain access and compromise systems. Learn how to protect your employees and organization with Hornetsecurity's Security Awareness Service. Hornetsecurity's Security Awareness Service empowers your employees to be your first line of defense against sophisticated attacks. Don't wait until you've been a victim of a psychological attack. Schedule a demo today to learn about our comprehensive security solutions and protect your organization from the inside out.
    Show More Show Less
    42 mins
  • How Threat Actors Use Copilot

    How Threat Actors Use Copilot
    Oct 16 2024
    In this episode of the Security Swarm Podcast, the host Andy Syrewicze and the guest Philip Galea discuss the security implications of Microsoft's AI assistant Copilot, which is integrated into the Microsoft 365 suite. They explore how Copilot's ability to surface information from an organization's Microsoft 365 data can create significant security risks, especially for companies that lack the operational maturity to properly manage permissions and access controls. The discussion also covers Microsoft's reactive approach to security in some of its products, where default settings are often not secure enough, and the company is slow to address these issues. The host and the guest emphasize the need for organizations to take a proactive approach to security, continuously reviewing and updating their security posture to mitigate the risks posed by Copilot and other Microsoft 365 features. The episode also introduces Hornetsecurity's Tenant Manager tool, which aims to help organizations better manage and enforce their Microsoft 365 security settings, providing a centralized and automated way to ensure that their environments are configured according to best practices. Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! Key Takeaways: Copilot makes it easy for nosy or malicious insiders to quickly surface sensitive information that they may not have proper access to. Copilot could be abused by threat actors who compromise a user account with an active Copilot license, allowing them to easily gather intelligence and move laterally within the organization. Microsoft's default security settings and permissions in Microsoft 365 are often too open, creating challenges for organizations to properly secure their data. Jailbreaking Copilot to bypass its security restrictions is an ongoing concern, as it could allow users to access restricted information. Solutions like sensitivity labels and disabling search on sensitive SharePoint sites have significant drawbacks and may not be practical for many organizations. Tools like Hornetsecurity's Permission Manager and Tenant Manager can help organizations better manage and enforce security policies across Microsoft 365. Continuous security awareness and training for employees is crucial to mitigate the risks posed by Copilot and other AI-powered tools. Timestamps: (04:37) Challenges with managing permissions and sharing in Microsoft 365 (11:20) Microsoft's history of security-related missteps and reactive responses (16:17) Attempts to jailbreak Copilot and bypass its security restrictions (21:08) Insider threat scenarios enabled by Copilot's data surfacing capabilities (23:40) Threat actor scenarios and the potential impact of a compromised Copilot-enabled account (34:16) Hornetsecurity's 365 Permission Manager and 365 Multi-Tenant Manager for MSPs solutions to help manage Microsoft 365 security. Episode Resources: Andy and Phil’s first Episode on Sharepoint Permissions 365 Multi-Tenant Manager -- As an MSP, managing security and compliance policies across multiple Microsoft 365 tenants can be a complex and time-consuming task. The new 365 Multi-Tenant Manager for MSPs from Hornetsecurity provides a centralized solution to easily configure, enforce and monitor security settings across all your clients' environments. With 365 Multi-Tenant Manager, you can: Quickly create and apply security baseline policies to new and existing tenants Automatically remediate configuration drift to ensure continuous compliance Monitor policy adherence and receive alerts on risky changes Streamline Microsoft 365 administration and reduce your clients' security risks Stop juggling multiple portals and start taking control of your clients' Microsoft 365 security. Try the 365 Multi-Tenant Manager for MSPs today and simplify your Microsoft 365 management. Schedule your demo today and learn more. -- Streamline your Microsoft 365 security with 365 Permission Manager - the tool that provides visibility, control, and automated remediation of SharePoint, OneDrive, and Teams permissions. Take back control of your data and protect against insider threats and external breaches.
    Show More Show Less
    40 mins
  • CrowdStrike Saga Continues, CUPS Vulnerability and More

    CrowdStrike Saga Continues, CUPS Vulnerability and More
    Oct 9 2024
    In this episode of the Security Swarm Podcast, our host Andy Syrewicze and one of our regular guests, Eric Siron discuss the latest quarterly threat report from Hornetsecurity. They dive into data points such as the breakdown of email threats, most common malicious file types, targeted industry verticals, and brand impersonations. The conversation also covers recent security news, including Microsoft's efforts to address the aftermath of the CrowdStrike incident and a high-severity vulnerability in the Linux CUPS system. The hosts provide valuable insights and analysis, highlighting trends in the threat landscape and the evolving tactics of cybercriminals. Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! Key Takeaways: Quarterly threat report data shows an increase in email threats in Q3 compared to Q2, driven by the ending of the summer vacation months. PDF, archive, and HTML files remain the top malicious file types used by threat actors. Microsoft is exploring ways to reduce security vendors' kernel-mode access after the Crowdstrike incident. NIST has updated password guidelines, including recommendations to remove password composition rules and avoid forced password rotations. A high-severity vulnerability in the Linux CUPS system allows remote code execution, highlighting the need to secure critical services. The importance of securing the digital supply chain and the risks of supply chain attacks. The challenges of convincing users to adopt secure practices, such as using password managers. Timestamps: (03:33) Breakdown of email threats by category (06:58) Most common malicious file types (11:46) Targeted industry verticals (19:52) Impersonated brands (22:33) Discussion of Microsoft's efforts after the Crowdstrike incident (37:19) NIST's updated password guidelines. Episode Resources: Hornetsecurity Monthly Threat Reports can be found here -- Protect Your Business from Advanced Threats! Ensure your organization is safeguarded against sophisticated attacks by leveraging Hornetsecurity's Advanced Threat Protection (ATP). Stay secure and informed—discover more here!
    Show More Show Less
    49 mins
  • New Password Requirements from NIST

    New Password Requirements from NIST
    Oct 2 2024
    In this episode of the Security Swarm Podcast, host Andy Syrewicze and guest Michael Posey discuss the new password guidelines and recommendations released by NIST (National Institute of Standards and Technology). They cover a range of topics related to password security, including the importance of password length over complexity, the move away from composition rules and periodic password changes, the risks associated with knowledge-based authentication, the concept of password entropy, and more! Throughout the conversation, Andy and Michael draw on their extensive experience in the cybersecurity field to offer practical advice and perspectives on the changing landscape of password security. Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! Key Takeaways: NIST recommends a minimum password length of 8 characters, with a suggested length of 15 characters or more. NIST has recommended removal of the requirement for password composition rules, such as the need for special characters, numbers, and uppercase letters. NIST states that password providers SHALL NOT require periodic password changes unless there is evidence of a breach, as this can lead to users creating predictable password patterns. The use of ASCII and Unicode characters is now encouraged, allowing for more diverse and random password options. Password entropy (randomness) is more important than password complexity, as modern computing power can quickly crack simple but complex-looking passwords. For mission-critical systems, organizations may still choose to implement more rigorous password policies, even if they deviate from the NIST recommendations. The industry is exploring new hashing methods and technologies, such as passkeys, to address the challenges posed by GPU-based brute-force attacks. Timestamps: (07:40) Credential Service Provider (CSP) Requirements and Recommendations (10:02) Removing Password Composition Rules (14:21) Ending Periodic Password Changes (19:48) The Importance of Password Entropy and Length (28:30) Phasing Out Knowledge-Based Authentication (30:30) The Impact of Password Length on Cracking Time Episode Resources: NIST Publication 800-63B -- To enhance your organization's security posture, consider implementing Hornetsecurity's Advanced Threat Protection. This solution provides AI-powered defense against sophisticated attacks, ensuring your emails and data remain secure. By adopting best practices in password management and utilizing advanced security features, you can significantly reduce the risk of breaches. Protect your business today and stay one step ahead of cyber threats. Learn more about Advanced Threat Protection here.
    Show More Show Less
    36 mins
  • Top Spear Phishing Methods

    Top Spear Phishing Methods
    Sep 27 2024
    In this episode of the Security Swarm Podcast, host Andy Syrewicze and guest Romain Basset dive into the top spear phishing methods used in both the enterprise space and across all businesses, based on internal research conducted by Hornetsecurity. The conversation covers spear phishing techniques, including initial contact, tax/W2, C-suite/CEO, lawyer, banking, and gift card fraud. They analyze the differences in the prevalence of these methods between enterprises and smaller businesses and provide insights on how organizations can combat these threats through training and robust processes. Do you want to join the conversation? Join us in our Security Lab LinkedIn Group! Key Takeaways: Spear phishing attacks have evolved from obvious wire transfer requests to more subtle techniques like initial contact fraud, where threat actors establish a relationship to build credibility. Tax fraud and W-2 phishing remain prevalent, especially around tax season, as attackers try to obtain personal information like Social Security numbers. C-suite fraud, where attackers impersonate executives, continues to be a major threat, highlighting the importance of robust processes to verify requests. Lawyer fraud, targeting enterprises more than smaller businesses, leverages the credibility of legal communications to extort money or gather information. Gift card fraud has emerged as the top spear phishing attack across enterprises and smaller businesses, as it is less likely to raise red flags than larger financial transactions. Adaptability and creativity of threat actors are key factors, as they continuously evolve their techniques to bypass security measures and user awareness. Timestamps: (03:26) Discussion on initial contact fraud (07:12) Exploration of tax fraud and W-2 phishing (13:35) Examination of C-suite fraud and the importance of processes (19:25) Lawyer Fraud and Enterprise vs. SMB Differences (23:47) Banking Fraud and Processes (26:39) Gift Card Fraud Episode Resources: Security Lab LinkedIn Group What is a Spear Phishing attack? The Top 5 Spear Phishing Examples and Their Psychological Triggers -- Hornetsecurity's Phishing Simulation, as part of its Security Awareness Service, is invaluable for organizations looking to protect themselves from the evolving spear phishing threats discussed in this episode. This solution provides realistic phishing simulations and comprehensive security awareness training, enabling employees to recognize and respond effectively to spear phishing attempts. By fostering a culture of security awareness, SAS is crucial for businesses aiming to strengthen their overall security posture and mitigate the risk of successful phishing attacks.
    Show More Show Less
    34 mins