The all in one place for non-profit security aid.
Cybersecurity firm Trellix has addressed an incompatibility issue causing Endpoint Security Agent’s Exploit Guard module to block some Microsoft Office and third-party apps from opening after installing June 2023 cumulative updates. […] Read More
BleepingComputer
Atlassian patches critical flaw in Confluence Data Center and Confluence Server.
Androxgh0st malware described. Lazarus Group shares money laundering networks with Southeast Asian criminal gangs. Read More
The CyberWire
87% of UK Organisations are Vulnerable to Cyberattacks : Microsoft AI Research
[[{“value”:”
In a groundbreaking report released by Microsoft, in collaboration with Dr. Chris Brauer of Goldsmiths, University of London, an alarming 87% of UK organizations have been identified as vulnerable to cyberattacks, highlighting a critical juncture in the nation’s cybersecurity and AI ambitions.
The study, titled “Mission Critical: Unlocking the UK AI Opportunity Through Cybersecurity,” underscores the urgent need for the UK to bolster its cyber defenses to achieve its goal of becoming a global AI superpower.
The comprehensive research, which surveyed over 1,000 senior leaders from private and public sectors, including 200 senior cybersecurity decision-makers and over 1,000 employees across the UK, reveals a concerning landscape.
89% of organisations were classified as ‘Vulnerable’, with 39% facing an even more dire ‘At High Risk’ status. This classification is based on self-reported performance against the research team’s newly developed academic model of cyber resilience.
Despite the grim findings, the report also illuminates a significant opportunity for the UK to enhance its cybersecurity infrastructure. By embracing AI in cybersecurity strategies, organizations could potentially reduce financial losses from cyberattacks by 20%.
This integration of AI into cybersecurity promises to strengthen the nation’s defenses and position the UK as a leading figure in the safe and responsible use of AI, making it an attractive destination for investors.
“Cyber criminals, some armed with the resources of a nation state, are ‘tooling up’ with AI to increase the sophistication and intensity of their attacks,” says Paul Kelly, Director of the Security Business Group at Microsoft UK.
The UK must rapidly improve its cybersecurity measures to protect against the increasing threat of cyberattacks and secure its ambition of becoming an AI superpower.
Cyberattacks cost the UK an estimated £87 billion annually, and such attacks are increasing in number and complexity. Microsoft said the report reveals that more robust cybersecurity could save the UK economy £52 billion a year.
The report emphasizes that 69% of decision-makers acknowledge the pressing need for more robust cybersecurity defenses to pave the way for the UK’s leadership in the global AI arena.
Document
Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.
:
The problem of vulnerability fatigue today
Difference between CVSS-specific vulnerability vs risk-based vulnerability
Evaluating vulnerabilities based on the business impact/risk
Automation to reduce alert fatigue and enhance security posture significantly
AcuRisQ, that helps you to quantify risk accurately:
Providing a blueprint for AI
Unlocking the UK AI Opportunity Through Cybersecurity” is a blueprint for the nation’s path forward. It highlights the dual imperative of enhancing cybersecurity resilience while advancing AI capabilities, ensuring the UK’s position on the global stage as both a cybersecurity and AI leader. The time to act is now, with the future of the UK’s economic and technological landscape at stake.
Five primary areas of concentration are recommended by 87% of UK organisations are vulnerable to cyberattacks Microsoft.
Encourage widespread use of AI in cybersecurity: Make it easier for security professionals to use AI for protection quickly and to think of new ways to stay safe online.
Focus on smart investing: Money should be spent carefully, and businesses should be encouraged to either build their own solutions or use ready-made ones.
Build skills in the UK: The UK should offer special programs and partnerships with schools to improve local skills. For example, Microsoft invested a lot in the UK in data centers, AI skills, and security. To make the most of these investments, everyone needs to support cybersecurity.
Promote research and sharing ideas: Keep funding research with public and private money and help new businesses explore AI. Sharing what is learned from cyberattacks can help everyone be more prepared and better at stopping them.
Help businesses adopt AI safely: Continue guiding companies from all areas, like healthcare and finance, on how to use AI securely, following international safety rules.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
The post 87% of UK Organisations are Vulnerable to Cyberattacks : Microsoft AI Research appeared first on Cyber Security News.
“}]] Read More
Cyber Security News
Update Chrome now! Google releases emergency security patch
Google has released an emergency security update for its Chrome browser. The update includes a patch released four days earlier for a vulnerability which Google say is already being exploited.
The easiest way to update Chrome is to allow it to update automatically, but you can end up lagging behind if you never close the browser or if something goes wrong—such as an extension stopping you from updating the browser.
Click Settings > About Chrome. If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is relaunch the browser in order for the update to complete, and for you to be safe from those vulnerabilities.
After the update, the version should be 124.0.6367.207, or later
If you have already updated to version 124.0.6367.201/.202 for Mac and Windows or 124.0.6367.201 for Linux, this will provide protection against the first vulnerability. The patch Google issued four days ago covered this actively exploited vulnerability.
The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The actively exploited CVE patched in this update is:
CVE-2024-4671 a use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Use after free (UAF) is a type of vulnerability that is the result of the incorrect use of dynamic memory during a program’s operation. If, after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to manipulate the program. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. In this case, by exploiting the vulnerability, the attacker can escape the sandbox that should contain any threats to the browser.
Exploitation is possible by getting the target to open a specific, specially crafted webpage, so the vulnerability is suitable for exploitation as a drive-by attack.
CVE-2024-4761: An out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
An out-of-bounds write or read flaw makes it possible to manipulate parts of the memory which are allocated to more critical functions. This could allow an attacker to write code to a part of the memory where it will be executed with permissions that the program and user should not have.
V8 is Google’s open-source high-performance JavaScript and WebAssembly engine and is part of the Chromium project. Among others it runs the JavaScript code included in webpages.
Again, exploitation is possible by getting the target to open a specific, especially crafted webpage, which makes the vulnerability suitable for exploitation as a drive-by attack.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.