Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Rajiv Pimplaskar
From Inspection to Authorization: Securing Networks for AI Agents
By Rajiv Pimplaskar, CEO, Dispersive Holdings, Inc. Agentic AI changes the network security problem from inspection to authorization. As more traffic is generated by agents, models, and workloads operating at machine speed, the network has to make trust decisions continuously, evaluate policy in real time, revoke access automatically, and keep communications resilient even when no human is in the loop.
What the industry can learn about resilience from Monday’s AWS outage
COMMENTARY: Cybersecurity Awareness Month this October has been quite eventful. Just within the first 22 days of the month, the industry has been stricken by a slew of devastating security or availability incidents, such as attacks on Palo Alto Networks , F5, and Monday’s AWS outage . It’s not the first time we’ve faced these threats. The dangers of excessive dependence on large entities and the downstream supply chain have been well understood by security pros over the past several years.
OSS and BSS News and Info
Article Index for the November Issue: November 2022 - Security & Assurance By: Although cybersecurity is a $155 billion industry with more than 1,800 vendors, companies still struggle to assemble holistic cybersecurity. According to IBM’s 2022 Cost of a Data Breach report, ransomware breaches increased 41 percent in the last year and now cost $4.54 million on average. With many great products available and increasing investment in cybersecurity, why aren’t these attack trends decreasing?
Cybersecurity for 5G and Critical Infrastructure
By: Rajiv Pimplaskar Several critical infrastructure sectors utilize industrial control system (ICS) and supervisory control and data acquisition (SCADA) systems and IoT devices, which can often present appealing soft targets for threat actors.
A New Paradigm for Absolute Zero Trust and Infrastructure Resiliency
By Rajiv Pimplaskar, President and CEO, Dispersive Holdings, Inc. How Secure is your Public Cloud? Public cloud is an IT model where 3rd-party-managed on-demand computing and infrastructure services are shared with multiple organizations using the public Internet. Over the last decade public cloud services and SaaS applications have exponentially grown to become mainstream across governments and enterprises worldwide.
2022 Verizon Data Breach Investigations Report, Cyber Security Experts Reactions
The stats from Verizon’s latest DBIR are not massively surprising. I think most people would agree we are seeing a huge rise in ransomware, and that phishing, stolen credentials, misconfigurations and insiders remain the primary cause of breaches. I think the most important lesson for businesses to take away from the study is that prioritising defences against these attacks is essential, because clearly none of them are going away anytime soon. In fact, they are all likely to get worse. Of .....
MS Exchange Servers Found Deploying Hive Ransomware
While Microsoft Exchange and cloud hosted SaaS applications provide some encryption at the application level, ransomware-as-a-service infections can utilize multiple attack vectors across Microsoft Azure and AWS, as these public cloud infrastructures are not natively encrypted. To maintain zero trust principles at the networking level, a 3rd party vendor provided VPN should be implemented in a mesh topology that can obfuscate and protect all public cloud traffic and eliminate vulnerabilities.
“JekyllBot:5” Allows Remote Hacking Of Hospital Robots
Medical IoT while incredibly valuable for patient care, can present soft targets that are appealing for bad actors. Such connected devices are often challenging to patch and keep updated. Also, often they don’t fall under the purview of the IT security team which further exacerbates the issue. A modern healthcare data security strategy should apply some of the same principles from the military - you can’t hack what you can’t see! This is commonly known as managed attribution where critical .....
New UK Study Shows Just 1/3rd Of Orgs Use MFA Auth, Practice Cyber Compliance
Of the 39% of UK businesses who identified an attack, the most common threat vector was phishing attempts (83%). The main goal of a phishing attack is to access the user’s credentials, that is mainly their password. Besides 37% are using two-factor authentication, the level of security depends on what that second factor is. As when it is an OTP via SMS or a link via email for example, these are not secure enough and could be under man in the middle attack vectors. Authentication is crucial for .....
FBI - Hackers Scanned 5 US Energy Firms, Expert Reaction.
Critical Infrastructure and energy sectors are prime targets for Nation state threat actors. Nation states have virtually unlimited compute and people resources at their disposal and their toolkits can be highly effective against Industry standard IPsec VPN as well as TLS encryption. Also, motivation in such situations is not just about breaking the encryption but also potential disruption or diversion. Even detection of flows of interest and reverse engineering source and destination .....
60% Of Mid-sized Indian Firms Faced 2021 Data Breach, Expert Reaction
Secure access across 3rd party partner connections is a significant challenge for most enterprises and Governments alike. Business Process Outsourcing (BPO) and offshoring trends along with the growing dependence on public cloud and SaaS has drastically eroded control on part of corporate IT. Even most zero trust strategies stop at the network and cannot protect against sophisticated threat actors who are able to identify, and intercept sensitive data for replay attacks or future analysis. IT .....
Zelle Scams Increasing For The Holidays
BACKGROUND: This may be a good comment opp as the holiday shopping season kicks off. Although Regulation E* (part of the federal Electronic Fund Transfer Act) requires banks to refund consumers for fraudulent transactions on their accounts, banks are stating that Zelle, as a peer-to-peer app, does not have the same protection.
Malware Stole 1.2TB Private Data From 3 Mil PCs
BACKGROUND: Researchers at Nordlocker have reported on Nameless malware that stole 1.2 TB of private data, discussing their case study of a 1.2-terabyte database collected from “over 3 million Windows-based computers” between 2018 and 2020 by a “Trojan-type malware.” Their analysis offers details on the malware used, data & file types and programs/ apps targeted, including: Downloaded software included illegal Adobe Photoshop 2018, a Windows cracking tool, and several cracked games Infected...
NY City Law Dept Computer Systems Hacked & Shut Down - Experts Comment
BACKGROUND: Multiple outlets are reporting the NYC Cyber Command first detected the breach on Saturday. The law dept. has over 2,000 employees and services over 1,000 lawyers, who have lost access to the network. Spokeswoman Laura Feyer said the breach occurred on Saturday and that they had limited access to the network on Sunday. In an interview with NY1, Mayor De Blasio confirmed the city law department was the target of a hack but no information was compromised. No ransom was sought.
Expert Reacted on Research that Bizarro Banking Trojan Now Hitting Accts & Bitcoin Wallets
New research from Kaspersky shows Bizarro banking Trojan expands its attacks to Europe with customers from 70 banks targeted in Spain, Portugal, France and Italy. The report reads in part: “Bizarro has x64 modules and is able to trick users into entering two-factor authentication codes in fake pop-ups. It may also use social engineering to convince victims to download a smartphone app.
TeaBot Android Bank Trojan Steals EU User Credentials
Cleafy researchers disclosed a new Android trojan TeaBot, that allows “live streaming of the device screen (on demand) and also interacts with it via Accessibility Services”. The malware, first seen in attacks against Italian banks, is now hitting banks in Belgium & the Netherlands.
A Student Pirating Software Led To A Full-blown Ryuk Ransomware Attack
BACKGROUND: A student’s attempt to pirate an expensive data visualization software led to a full-blown Ryuk ransomware attack at a European biomolecular research institute. After the research institute suffered the attack, Sophos’ Rapid Response team responded and neutralized the cyberattack. This attack lost the institute a week’s worth of research data and a week-long network outage as servers were rebuilt from scratch and data restored from backups. Experts Comments
44% of Orgs. Report Breaches Due to 3rd Parties, 74% Cite Privileged Access
The Ponemon Institute and SecureLink report “A Crisis in Third-party Remote Access Security” shows the gaps between stated third-party access threats and the security measures an organization actually uses. The report notes the threat surface increase due to remote access over the last 12 months. Among other key findings: 44% of respondent organizations experienced a breach in the last 12 months, with 74% faulting too much-privileged access among third parties.
First Horizon Bank Accts Breached by "Unauthorized Party", Millions Removed
BACKGROUND: In an SEC filing on Wednesday, First Horizon Bank of Tennessee revealed that login credentials were used by “an unauthorized party,” exploiting third-party security software to remove millions from approximately 200 accounts. Excerpt: In mid-April, First Horizon Corporation (the “Company”) became aware of a data security incident affecting a limited number of customer accounts.
77% of Q1 Ransomware Attacks Threaten Exfiltration – Experts Reaction | Information Security Buzz
RDP is a great technology, but because of its power, attackers have been leveraging it heavily as an entry point into corporate networks for attacks such as ransomware. While the issue at the surface looks to be with RDP itself, it's actually about how networks are architected - flat networks with minimal segmentation and those that focus on perimeter-based security will always be victims of these types of attacks. Networks have since evolved to become hyper-connected with a proliferation of .....
Mount Locker Ransomware Thwarts Recovery, May Target Healthcare & Biotech
GuidePoint Security researchers report Mount Locker Ransomware Steps up Counter-IR Capabilities, Hindering Efforts for Detection, Response, and Investigation. The group is using more sophisticated scripting, maybe rebranding as “Astro Locker,” and has added new security evasion features. GuidePoint indicates that campaigns may be targeting biotech and healthcare-adjacent industries. An expert with Veridium offers perspective. Experts Comments
Data Security Expert Comment On Geico Admits Fraudsters Stole Customers’ Driver’s License Numbers For Months
TechCrunch has reported that Geico, the second-largest auto insurer in the U.S., has fixed a security bug that let fraudsters steal customers’ driver’s license numbers from its website.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Rajiv
Contact Rajiv, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack