ESW #302 – Brian Contos, Isabelle Roccia

There's not much funding today, but the funding we have is large and pointed at only a few companies. A few years ago, Netskope said it was doing fine, wasn't in a hurry to IPO, and didn't really need their Series G, but took the cash to 'top up the warchest'.

Four rounds of funding later, and I've got to wonder if that IPO is ever coming, if Netskope is comfortable as a private company, or if a PE sale is coming soon.

A sizable series B from a security training firm is NOT something I was expecting in 2023. The best estimate of SANS Institute revenue is around $56M. If that's accurate, there's a sizable pie for HackTheBox to take a bite out of here.

The market seems rather saturated to me, but with 1.7m users, HackTheBox does seem to be doing rather well. It's typically one of the first names I hear dropped when someone new to the industry asks for self-guided training recommendations.

A fantastic collection and analysis of the most popular open source security tools! 100% better than trying to manually search Github for the best free SAST tool.

https://www.microsoft.com/en-us/windows/end-of-support

Looking forward to Tyler Shields' thoughts on this one!

There is actually some discussion about personal cybersecurity before the point I link to in this YouTube video, so you might want to listen to the whole segment (which starts at 50:29). Herrera mentions that she actually divides personal cybersecurity (a term I like more than consumer cybersecurity) into 6 categories, and I'd love to know what those are!

Reading the headlines, you'd be forgiven for thinking that the vast majority of data breaches were ransomware and extortion-driven. Reading this story, you might be surprised to hear that ransomware is only the 4th most common cause of a breach, at 10.4%. I sought out the source study, which made things a bit more clear. Ransomware was the 4th most common root cause of a data breach.

The way I'm reading this is that an extortion case where the root cause is phishing, but employs ransomware at a later stage of the campaign, would be counted as "social engineering", not "ransomware" as the root cause.

Though some of this is a bit foggy to me, the report has some good insights, like a good breakdown of the key mistakes and oversights companies can correct to prevent data breaches.

Note that the scope of this report was "100 of the largest and well-known data breaches to date". It's unclear if all these events happened in the past 5 years, or go back 20 years or more, which I would think would dull the value of the report. There's no methodology listed for the report.

https://www.scmagazine.com/perspective/cloud-security/lessons-on-cloud-security-from-the-twitter-whistleblower

https://www.scmagazine.com/news/cloud-security/are-threat-actors-gaining-cloud-skills-faster-than-enterprises

https://www.bbc.com/news/business-64206913

They call it freejacking - automating opening massive new accounts on services that have free trials and then abusing the free trials for profit.

Mining crypto is usually the endgame with freejacking, but in this story, someone uses it to con a company into thinking they've somehow saved them 90% on their cloud bills, when they've actually temporarily saved them money by funneling workloads to accounts with temporary free trials!

I'd normally pass a story like this up, but with quotes from 49 industry executives, I found this worth a skim. There are some interesting takes in there, but yes, there are also some that read like a ChatGPT prompt titled, "boilerplate 2023 prediction for the cybersecurity market written by an exec worried about offending anyone"

An absolutely breathtaking collection of automotive vulnerabilities. It seems like this small group of research likely had access to tens of millions of vehicles spread across 16 brands over the last 5 years!

That sounds like it might result in a 300 page PDF, but this blog post is surprisingly concise for the amount of pwnage that has occurred here.

Figure 5, Page 18

Boy, if you're not convinced we need to ditch passwords a few pages into this report, you certainly will by the time you get to Figure 5 on Page 18.

We reported on the surprising news that Palo Alto broke into the consumer market with their Okyo Garde home network appliance back in Q3 2021. Less surprisingly, they ended sales a year later and ended service on December 31st, 2022.

Folks that weren't aware of the service ending got a very abrupt surprise as the device failed closed.

I doubt anyone got refunds for their devices. Normally, I wouldn't even consider that question, except that I just received a refund for everything I had ever bought that was attached to Google's Stadia cloud gaming platform, even though all my purchases were over 3 years ago!