Tag: Recent News

Black Hat USA 2022 marked the twenty-fifth year that security researchers, security architects, and other security professionals have gathered to share the latest research, developments, and trends. Microsoft was among the companies participating in the conference, which was from August 6 to 11, 2022, in Las Vegas, Nevada. This year’s event was hybrid, with some attendees attending in-person and others joining online.

We were excited to join members of the Black Hat security community representing 111 countries.¹ Along with more than 17,000 in-person attendees—and more than 15,000 virtual attendees—we heard security insights and shared the latest in Microsoft Security solutions, including two new security solutions—Microsoft Defender Threat Intelligence to track threat actor activity and Microsoft Defender External Attack Surface Management to discover unknown and unmanaged resources that are visible and accessible from the internet.

Booth excitement

What energizes us the most about conferences like Black Hat is the opportunity to meet people. During the conference, we welcomed hundreds of security professionals to our booth. There, we talked about cybersecurity threats, shared our perspective on the need for comprehensive security, listened to their stories of cybersecurity challenges, and gave them demonstrations of the latest innovations from Microsoft Security in the threat intelligence and protection space, including Microsoft Defender Experts for Hunting.

We’re passionate about security and it’s always a thrill to be among others who feel the same way. Our team in the booth was kept happily busy. Some attendees chatted in groups of two or more while others crowded around four demo stations—Microsoft Security Experts, threat protection, threat intelligence, and identity and access management—to see how Microsoft product solutions can help catch what others miss.

During our Diversity and Inclusion Hour on Wednesday, Black Hat attendees gathered in the Microsoft booth to socialize and talk about diversity, equality, and inclusion in the workplace. As a bonus, Microsoft enlisted a professional photographer to take headshots for anyone who attended and wanted to update their LinkedIn profiles.

Conference sessions

Microsoft Security team members stay up on the latest news, solutions, and strategies in the security world. We were thrilled when several of these security professionals received the opportunity to share their thought leadership insights with Black Hat attendees.

• “Advancing Investigations with Threat Intelligence”: Microsoft Incident Response Consultant MacKenzie Brown shared how Microsoft’s Detection and Response Team (DART) harnesses the power of threat intelligence while in the trenches helping customers challenged by cyberattacks. MacKenzie also walked through how DART responded to recent threats from the North Korean nation-state actor believed to be behind HolyGh0st and Lapus$. 163 attendees viewed the session virtually.
• “AAD Joined Machines—The New Lateral Movement”: Microsoft Senior Security Researcher Mor Rubin talked about new research about a mechanism designed to allow authentication between Microsoft Azure Active Directory-joined machines. Mor also explored the foundation of the new network protocol, presented a way (and a tool) to perform pass-the-certificate attacks, and talked through an open-source solution that can help companies hunt for attacks.
• “CastGuard: Mitigating Type Confusion in C++”: Microsoft Software Security Engineer Joe Bialek discussed type confusion vulnerabilities, which have incredibly powerful primitives to exploit writers. Joe introduced a new mitigation called CastGuard that’s being deployed to a set of Windows components (with more in the works). With a tiny instruction sequence and the virtual function table pointer of an object, CastGuard helps prevent illegal static down-casts in C++ code.
• “Malware Classification With Machine Learning Enhanced by Windows Kernel Emulation”: Microsoft Security Software Engineer Dmitrijs Trizna presented a hybrid machine learning architecture that combines static and dynamic malware analysis methodologies. This architecture surpasses the capabilities of the modern AI classifiers and records a detection rate of 96.7 percent with a fixed false positive rate of 0.1 percent.

Conference social events

It wouldn’t be a conference without plenty of fun social events to get everyone chatting, networking, and celebrating the achievements of security professionals. At the Cybersecurity Women of the Year Awards (CSWY Awards) on August 9, 2022, attendees gathered at the Luxor, enjoyed a gourmet meal, and toasted to female cybersecurity and privacy leaders who are changing the world.

“The CSWY Awards recognize women protecting businesses, schools, and governments from cyber threats actors,” said Carmen Marsh, creator of the CSWY Awards. “We give security pros the opportunity to talk about what’s happening or not happening in cybersecurity and how to make it better. It’s wonderful to bring women from around the world to Las Vegas for this important event while creating inspiring role models for the new generation of cybersecurity professionals.”

As a Signature Sponsor, Microsoft was honored to recognize three barrier breakers serving as role models for future generations of cybersecurity professionals. Microsoft Corporate Vice President of Cloud and Microsoft 365 Security, Aanchal Gupta gave out the Cybersecurity Woman Privacy Woman Law Professional of the Year 2022 award, while Microsoft Senior Director of Security Narrative and Strategy, Shelli Strand awarded the Cybersecurity Woman Influencer of the Year 2022 award. Abhilasha Bhargav-Spantzel, Microsoft Partner Security Architect, gave out the Cybersecurity Woman Volunteer of the Year award.

After dinner and the awards ceremony, attendees networked and danced to a DJ spinning hits.

“Today, we have an incredible opportunity to attract a talented and impassioned generation of defenders and to change the deep gender disparity in our industry. I am so grateful to the Cybersecurity Woman of the Year program organizers for spotlighting the amazing work being done by those superheroes who are setting a powerful example for us all,” said Vasu Jakkal, Microsoft Corporate Vice President of Security, Compliance, Identity, Management, and Privacy, “Microsoft is proud to take part in an event that is helping to cultivate inclusivity, inspire and facilitate mentorship, and celebrate the important field of cybersecurity.”

On August 10, 2022, Microsoft Security Response Center (MSRC) hosted Microsoft’s annual Researcher Celebration event at the Illuminarium in Las Vegas, Nevada. The event brought together some of Microsoft’s Most Valuable Researchers (MVRs), and many security leaders and professionals. Attendees met with the head of MSRC, Aanchal Gupta, MSRC leadership, and other key Microsoft attendees to thank the MVRs and researcher community for their contributions. Check out the list of MSRC 2022 Most Valuable Researchers!

Throughout the evening, more than 500 guests from more than 200 organizations across the information security community participated in space-themed activities and experiences while connecting and re-connecting in person for the first time in many years. Thanks to everyone that attended and helped make the event memorable.

More threat intelligence resources

We can’t wait for future opportunities to connect with everyone again in person. Until then, there are a few ways for you to stay connected and up to date on the latest from Microsoft in threat intelligence solutions:

• Join us on September 15, 2022, for the free digital event Stop Ransomware with Microsoft Security to hear key insights from Microsoft’s leadership, including a fireside conversation between Charlie Bell, Executive Vice President of Microsoft Security, and Vasu Jakkal, Corporate Vice President of Microsoft Security, Compliance, Identity, and Privacy Business.
• Explore details on Microsoft’s threat intelligence solution in our blog post about new solutions for threat intelligence and attack surface management.
• Check out the latest Cyber Signals report.
• If you attended Black Hat and interacted with Microsoft, please share your feedback with us. 

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

¹Black Hat USA 2022 Closes on a Record Breaking Event in Las Vegas & Online, AP News. August 19, 2022.

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Runa Sandvik, Former Senior Director of Information Security at The New York Times and member of CISA’s Technical Advisory Council. She recently was interviewed about her new startup, Granitt, in TechCrunch.¹ The thoughts below reflect Runa’s views, not the views of Microsoft, and are not legal advice. In this blog post, Runa talks about security for journalists and media organizations.

Brooke: How did you get into cybersecurity?

Runa: I got my first computer when I was 15. I studied for a bachelor’s in computer science at a university in Norway, where I’m from. One thing I really enjoy about this industry is that within computer science and cybersecurity, there are so many different challenges to take on. There are so many problems that you can work on and so many things to be curious about and I’ve always really loved that.

During the summer of 2009, before the last year of my bachelor’s, I worked for the Tor Project as part of Google Summer of Code. Once that internship wrapped up, I stayed on with the Tor project and I volunteered to continue maintaining my project. Over time, Tor offered me a part-time contract and later, a full-time contract.

A lot of the work that I do today has been shaped by the four years that I spent working with the Tor project. When I first heard about Tor, I thought it was cool that you could be anonymous online by using a piece of technology. I didn’t consider who’s using it or for what reason. But over the four years with Tor, I got to meet not only other people working in the same space but also people around the world who told me about their experiences with the tool and what it enabled them to do, which was a hugely positive experience for me.

Brooke: What excites you the most about protecting journalists?

Runa: Around 2011, four projects got funding to train reporters on how to use the Tor browser and I ended up leading that project. We were building out a curriculum and we felt very quickly that it was not super helpful to teach someone how to use a Tor browser to be safe online if they’re not also familiar with general security best practices, like passwords and two-factor authentication and the importance of software updates. So, we built a curriculum around that. I later took that experience with me to the Freedom of the Press Foundation and The New York Times.

The work that I’ve done with journalists was something that I stumbled into, but looking at it now, I think investigative journalism has a lot of the same themes as security research. It has the same puzzles, same challenges, and the same digging that gets me really curious and really interested. It also has this incredibly important mission behind it.

Brooke: What do you do to protect journalists and at-risk groups or organizations?

Runa: For an individual to work safely or securely, I consider digital security, physical security, emotional safety, and legal issues. Journalism security really needs to encompass all four buckets, so some of the work that I do has been one-on-one discussions with reporters who want everyday security guidance, and I help them figure out what they can do to improve. They are usually preparing for a specific investigative project or preparing for a trip to an at-risk area.

I have worked closely with groups of people at media organizations that are a mix of reporters, IT, security, and legal to produce a security plan based on the challenges they face and the kind of support the newsroom needs. Years ago, if you were a big enterprise like The New York Times, Washington Post, Microsoft, or Google, there were a lot of big, complex cybersecurity frameworks to help you get a baseline and the steps to take to improve moving forward.

If you’re an individual looking to improve your security, there are guides from the Electronic Frontier Foundation and the Freedom of the Press Foundation giving you information like “here’s how you use a password manager” and “here’s how you set up two-factor authentication,” but Ford Foundation fellow, Matt Mitchell, found that if you’re a small organization or small team, there’s not a good option available. He put together a committee to develop the Ford Foundation Cybersecurity Assessment Tool, which is designed for smaller organizations. It is a really effective way to figure out where I am today and where the focus should be on the next year or two.

Brooke: What are the biggest threats you’ve seen in your line of work?

Runa: If we are talking about security issues that a journalist as an individual might face, we could talk about online account takeover and phishing scams. I recently gave a talk at Paranoia in Oslo about how the media gets hacked and the root cause behind all these issues. If we are talking about the organization that the journalist works for, it comes down to a lack of two-factor authentication credential stuffing, poor passwords, phishing, and outdated systems.

Over the years, my work has focused on the individual, but 10 years ago, Tor was clunky and complex. We had VPNs. We had tools to fully encrypt the drive in your laptop, but they were clunky to use. There was a long text of steps to get it all up and running. People needed a lot of help to use it. These days, we have all the tools and they’re either free or not super expensive. What is missing now is that buy-in from leadership to create the processes and the workflows to ensure that the newsrooms have all these tools provided to them. Currently, it is more of a building-the-bridges type of challenge. I don’t think we are necessarily missing any tools. We just need to figure out how to piece it together.

Brooke: What are the biggest security challenges for journalists?

Runa: A journalist is a journalist all day, every day. That is not just a job, it is an identity. They are journalists, whether they are in a movie theater with a personal phone or at work with their company laptop. Regardless of the device they are using, the time of day, and location in the world, they are still journalists, and they are going to report if there is something to report on. In a corporate context, historically, we have been focused on securing corporate accounts, corporate systems, and corporate devices, but for roles like journalism and other activist groups, which starts to break down a bit. I think there needs to be a greater conversation around how we go about securing identities as opposed to just the 9-to-5 corporate bits and bobs.

Another big challenge is building sufficient support on the business side of the company to be able to provide adequate support to the newsroom. Reporters who I have talked to are not questioning that they need to be more secure and that they need processes or tools. Once that is provided, they are very willing to try things. You just need to build that bridge and help the business side understand the challenges in the newsroom and the potential challenges that presents for the business, whether from a physical, digital, or legal standpoint, and then produce ways to address that.

Supporting the work that the newsroom is doing means developing products, developing the content management system (CMS), getting stories out, producing new ways to report, retaining subscribers, and funding reporters who go out on investigative trips. All of these things are incredibly important and sometimes more important than security. The challenge is where do I spend my resources knowing that everything is so strapped?

There are a lot of diverse ways that you could improve security at your organization and even if you do not have the resources currently for the best and biggest and greatest product, there are still small things that you can do. It is a matter of figuring out how to focus on this one thing you do have to focus on, even if it’s just one person, two people, or a small team. At this point, not focusing on cybersecurity is not an option.

Learn more

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

¹Runa Sandvik’s new startup Granitt secures at-risk people from hackers and nation states, Zack Whittaker. July 15, 2022.

Today, Microsoft is excited to publish our second edition of Cyber Signals, spotlighting security trends and insights gathered from Microsoft’s 43 trillion security signals and 8,500 security experts. In this edition, we pull back the curtain on the evolving cybercrime economy and the rise of Ransomware-as-a-service (RaaS). Instead of relying on what cybercriminals say about themselves through extortion attempts, forum posts, or chat leaks, Microsoft threat intelligence gives us visibility into threat actors’ actions.

RaaS is often an arrangement between an operator, who develops and maintains the malware and attack infrastructure necessary to power extortion operations, and “affiliates” who sign on to deploy the ransomware payload against targets. Affiliates purchase initial access from brokers or hit lists of vulnerable organizations, such as those with exposed credentials or already having malware footholds on their networks. Cybercriminals then use these footholds as a launchpad to deploy a ransomware payload against targets.

The impact of RaaS dramatically lowers the barrier to entry for attackers, obfuscating those behind initial access brokering, infrastructure, and ransoming. Because RaaS actors sell their expertise to anyone willing to pay, budding cybercriminals without the technical prowess required to use backdoors or invent their own tools can simply access a victim by using ready-made penetration testing and system administrator applications to perform attacks.

The endless list of stolen credentials available online means that without basic defenses like multifactor authentication (MFA), organizations are at a disadvantage in combating ransomware’s infiltration routes before the malware deployment stage. Once it’s widely known among cybercriminals that access to your network is for sale, RaaS threat actors can create a commoditized attack chain, allowing themselves and others to profit from your vulnerabilities.

While many organizations consider it too costly to implement enhanced security protocols, security hardening actually saves money. Not only will your systems become more secure, but your organization will spend less on security costs and less time responding to threats, leaving more time to focus on incoming incidents.

Businesses are experiencing an increase in both the volume and sophistication of cyberattacks. The Federal Bureau of Investigation’s 2021 Internet Crime Report found that the cost of cybercrime in the United States totaled more than USD6.9 billion.¹ The European Union Agency for Cybersecurity (ENISA) reports that between May 2021 and June 2022, about 10 terabytes of data were stolen each month by ransomware threat actors, with 58.2 percent of stolen files including employees’ personal data.²

It takes new levels of collaboration to meet the ransomware challenge. The best defenses begin with clarity and prioritization, which means more sharing of information across and between the public and private sectors and a collective resolve to help each other make the world safer for all. At Microsoft, we take that responsibility to heart because we believe security is a team sport. You can explore the latest cybersecurity insights and updates at our threat intelligence hub Security Insider. 

With a broad view of the threat landscape—informed by 43 trillion threat signals analyzed daily, combined with the human intelligence of our more than 8,500 experts—threat hunters, forensics investigators, malware engineers, and researchers, we see first-hand what organizations are facing and we’re committed to helping you put that information into action to pre-empt and disrupt extortion threats.

Learn more

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

¹Internet Crime Report, Federal Bureau of Investigation. 2021.

²Ransomware: Publicly Reported Incidents are only the tip of the iceberg, European Union Agency for Cybersecurity. July 29, 2022.