AI in Cyberattacks: A Closer Look at Emerging Threats for 2025

Posted on June 5, 2025 by Brent Huston

The complex interplay between technological advancement and cyber threats is reaching unprecedented heights. As artificial intelligence (AI) evolves, it presents both transformative opportunities and significant perils in the realm of cyberattacks. Cybercriminals are leveraging AI to devise more sophisticated and cunning threats, shifting the paradigm of how these dangers are understood and countered.

RedHacker3

AI’s influence on cyberattacks is multifaceted and growing in complexity. AI-powered tools are now utilized to develop advanced malware and ransomware, enhance phishing tactics, and even create convincing deepfakes. These advancements foreshadow a challenging landscape by 2025, as cybercriminals sharpen their techniques to exploit vulnerabilities in ubiquitous technologies—from cloud computing to 5G networks.

In response to the evolving threat landscape, our methods of defense must adapt accordingly. The integration of AI into cybersecurity strategies offers powerful countermeasures, providing innovative ways to detect, deter, and respond decisively to these high-tech threats. This article explores the emerging tactics employed by cybercriminals, the countermeasures under development, and the future prospects of AI in cybersecurity.

The Role of AI in Cyberattacks

As we approach 2025, the landscape of cyber threats is increasingly shaped by advancements in artificial intelligence. AI is revolutionizing the way cyberattacks are conducted, allowing for a level of sophistication and adaptability that traditional methods struggle to compete with. Unlike conventional cyber threats, which often follow predictable patterns, AI-driven attacks are dynamic and capable of learning from their environment to evade detection. These sophisticated threats are not only more difficult to identify but also require real-time responses that traditional security measures are ill-equipped to provide. As AI continues to evolve, its role in cyberattacks becomes more pronounced, highlighting the urgent need for integrating AI-driven defenses to proactively combat these threats.

AI as a Tool for Cybercriminals

AI has significantly lowered the barrier to entry for individuals looking to engage in cybercrime, democratizing access to sophisticated tools. Even those with minimal technical expertise can now launch advanced phishing campaigns or develop malicious code, thanks to AI’s ability to automate complex processes. This technology also allows cybercriminals to launch adaptive attacks that grow more effective over time, challenging traditional cybersecurity defenses. AI plays a critical role in the emergence of Cybercrime-as-a-Service, where even unskilled hackers can rent AI-enhanced tools to execute complex attacks. Additionally, machine learning models enable faster and more efficient password cracking, giving cybercriminals an edge in breaking into secure systems.

AI-Driven Malware and Ransomware

AI-driven malware is reshaping the threat landscape by making attacks more efficient and harder to counter. Ransomware, enhanced by AI, automates the process of identifying data and optimizing encryption, which poses significant challenges for mitigation efforts. Malicious GPTs, or modified AI models, can generate complex malware and create supportive materials like fake emails, enhancing the efficacy of cyberattacks. The rise of AI-driven Cybercrime-as-a-Service in 2025 allows less experienced hackers to wield powerful tools, such as ransomware-as-a-service, to launch effective attacks. Self-learning malware further complicates security efforts, adapting seamlessly to environments and altering its behavior to bypass traditional defenses, while AI-driven malware utilizes automated DDoS campaigns and sophisticated credential-theft techniques to maximize impact.

Enhancing Phishing with AI

Phishing attacks, a longstanding cyber threat, have become more sophisticated with the integration of AI. This technology enables the creation of highly personalized and convincing phishing emails with minimal manual effort, elevating the threat to new heights. AI’s ability to process large datasets allows it to craft messages that are tailored to individual targets, increasing the likelihood of successful infiltration. As these attacks become more advanced, traditional email filters and user detection methods face significant challenges. Preparing for these AI-enhanced threats necessitates a shift towards more proactive and intelligent security systems that can detect and neutralize adaptive phishing attacks in real-time.

The Threat of Deepfakes

Deepfakes represent a growing challenge in the cybersecurity domain, harnessing AI to create realistic impersonations that can deceive users and systems alike. As AI technology advances, these synthetic audio and video productions become increasingly difficult to distinguish from authentic content. Cybercriminals exploit deepfakes for purposes such as misinformation, identity theft, and reputational damage, thereby eroding trust in digital platforms. Organizations must use AI-based detection tools and educate employees on identifying these sophisticated threats to maintain their digital integrity. Furthermore, the rise of AI-powered impersonation techniques complicates identity verification processes, necessitating the development of new strategies to validate authenticity in online interactions.

Emerging Tactics in AI-Driven Attacks

In 2025, AI-driven cyberattacks are poised to escalate significantly in both scale and sophistication, presenting formidable challenges for detection and mitigation. Malicious actors are capitalizing on advanced algorithms to launch attacks that are not only more efficient but also difficult to counteract. Their adaptability enables these attacks to dynamically adjust to the defenses deployed by their targets, thus enhancing their effectiveness. AI systems can analyze vast quantities of data in real-time, allowing them to identify potential threats before they fully materialize. Consequently, the cybersecurity industry is intensifying efforts to integrate AI into security measures to predict and counter these threats proactively, ensuring that security teams are equipped to manage the rapidly evolving threat landscape.

Understanding AI Phishing

AI phishing attacks have transformed the cyber threat landscape by leveraging generative AI to create communications that appear exceedingly personalized and realistic. These communications can take the form of emails, SMS messages, phone calls, or social media interactions, often mimicking the style and tone of trusted sources to deceive recipients. Machine learning empowers these attacks by allowing them to evade traditional security measures, making them more challenging to detect. AI-driven phishing schemes can automate the entire process, providing outcomes similar to human-crafted attacks but at a significantly reduced cost. As a result, a notable increase in sophisticated phishing incidents has been observed, impacting numerous organizations globally in recent years.

Transition to Vishing (Voice Phishing)

Emerging as a novel threat, vishing or voice phishing employs AI to enhance the traditional scams, enabling wider and more efficient campaigns with minimal manual input. This method intensifies the effectiveness and sophistication of attacks, as AI-driven vishing can dynamically adjust to the defenses of targets. Unlike traditional, static cyber attacks, AI-enhanced vishing scams modify their tactics on-the-fly by monitoring defenses in real-time, making them harder to identify and mitigate. As this threat continues to evolve, businesses must employ proactive AI-driven defenses that can anticipate and neutralize potential vishing threats before they inflict damage. The incorporation of AI-driven security systems becomes vital in predicting and countering these evolving cyber threats.

Exploiting Zero-Day Vulnerabilities

AI-enabled tools are revolutionizing vulnerability detection by quickly scanning extensive codebases to identify zero-day vulnerabilities, which pose significant risks due to their unpatched nature. These vulnerabilities provide an open door for exploit that threat actors can use, often generating automated exploits to take advantage of these weaknesses rapidly. Concerns are growing that the progression of AI technologies will allow malicious actors to discover zero-day vulnerabilities with the same proficiency as cybersecurity professionals. This development underscores the importance of programs like Microsoft’s Zero Day Quest bug bounty, aiming to resolve high-impact vulnerabilities in cloud and AI environments. The rapid escalation of AI-driven zero-day phishing attacks means that defenders have a narrower window to react, necessitating robust response systems to address cybersecurity challenges effectively.

Targeting Cloud Environments

Cloud environments are becoming increasingly susceptible to AI-driven cyberattacks, which employ machine learning to circumvent standard protections and breach cloud systems. The sophistication of AI-powered impersonation necessitates enhanced identity verification to safeguard digital identities. Organizations must therefore integrate AI-driven defenses capable of identifying and neutralizing malicious activities in real-time. AI-assisted detection and threat hunting are instrumental in recognizing AI-generated threats targeting these environments, such as synthetic phishing and deepfake threats. With cloud infrastructures being integral to modern operations, adopting proactive AI-aware cybersecurity frameworks becomes essential to anticipate and thwart potential AI-driven intrusions before they cause irreparable harm.

Threats in 5G Networks

The expansion of IoT devices within 5G networks significantly enlarges the attack surface, presenting numerous unsecured entry points for cyber threats. Unauthorized AI usage could exploit these new attack vectors, compromising vital data security. In this context, AI-powered systems will play a crucial role in 2025 by utilizing predictive analytics to identify and preempt potential threats in real-time within 5G infrastructures. Agentic AI technologies offer tremendous potential for improving threat detection and neutralization, securing 5G networks against increasingly sophisticated cyber threats. As the threat landscape continues to evolve, targeting these networks could result in a global cost burden potentially reaching $13.82 trillion by 2032, necessitating vigilant and innovative cybersecurity measures.

Countermeasuring AI Threats with AI

As the cyber threat landscape evolves, organizations need a robust defense mechanism to safeguard against increasingly sophisticated AI-driven threats. With malicious actors utilizing artificial intelligence to launch more complex and targeted cyberattacks, traditional security measures are becoming less effective. To counter these AI-driven threats, organizations must leverage AI-enabled tools to automate security-related tasks, including monitoring, analysis, and patching. The use of such advanced technologies is paramount in identifying and remediating AI-generated threats. The weaponization of AI models, evident in dark web creations like FraudGPT and WormGPT, underscores the necessity for AI-aware cybersecurity frameworks. These frameworks, combined with AI-native solutions, are crucial for dissecting vast datasets and enhancing threat detection capabilities. By adopting AI-assisted detection and threat-hunting tools, businesses can better handle synthesized phishing content, deepfakes, and other AI-generated risks. The integration of AI-powered identity verification tools also plays a vital role in maintaining trust in digital identities amidst AI-driven impersonation threats.

AI in Cyber Defense

AI is revolutionizing the cybersecurity industry by enabling real-time threat detection and automated responses to evolving threats. By analyzing large volumes of data, AI-powered systems can identify anomalies and potential threats, providing a significant advantage over traditional methods. Malicious actors may exploit vulnerabilities in existing threat detection frameworks by using AI agents, but the same AI technologies can also strengthen defense systems. Agentic AI enhances cybersecurity operations by automating threat detection and response processes while retaining necessary human oversight. Moreover, implementing advanced identity verification that includes multi-layered checks is crucial to counter AI-powered impersonation, ensuring the authenticity of digital communications.

Biometric Encryption Innovations

Biometric encryption is emerging as a formidable asset in enhancing user authentication, particularly as cyber threats become more sophisticated. This technology leverages unique physical characteristics—such as fingerprints, facial recognition, and iris scans—to provide an alternative to traditional password-based authentication. By reducing reliance on static passwords, biometric encryption not only strengthens user authentication protocols but also mitigates the risk of identity theft and impersonation. As a result, businesses are increasingly integrating biometric encryption into their cybersecurity frameworks to safeguard against the dynamic landscape of cyber threats, minimizing potential vulnerabilities and ensuring more secure interactions.

Advances in Machine Learning for Cybersecurity

Machine learning, a subset of AI, is instrumental in transforming cybersecurity strategies, enabling rapid threat detection and predictive analytics. Advanced machine learning algorithms simulate attack scenarios to improve incident response strategies, providing cybersecurity professionals with enhanced tools to face AI-driven threats. While AI holds the potential to exploit vulnerabilities in threat detection models, it also enhances the efficacy of security teams by automating operations and reducing the attack surface. Investments in AI-enhanced cybersecurity solutions reflect a strong demand for robust, machine-learning-driven techniques, empowering organizations to detect threats efficiently and respond effectively in real time.

Identity and Access Management (IAM) Improvements

The integration of AI-powered security tools into Identity and Access Management (IAM) systems significantly bolsters authentication risk visibility and threat identification. These systems, critical in a digitized security landscape, enhance the foundation of cyber resilience by tackling authentication and access control issues. Modern IAM approaches include multilayered identity checks to combat AI-driven impersonations across text, voice, and video—recognizing traditional digital identity trust as increasingly unreliable. Role-based access controls and dynamic policy enforcement are pivotal in ensuring users only have essential access, preserving the integrity and security of sensitive systems. As AI-driven threats continue to advance, embracing AI capabilities within IAM systems remains vital to maintaining cybersecurity.

Implementing Zero-Trust Architectures

Zero-Trust Architecture represents a paradigm shift in cybersecurity by emphasizing least-privilege access and continuous verification. This model operates on the principle of never trusting, always verifying, where users and devices’ identities and integrity are continually assessed before access is granted. Such a dynamic approach ensures real-time security policy adaptation based on emerging threats and user behaviors. Transitioning to Zero-Trust minimizes the impact of breaches by compartmentalizing network resources, ensuring that access is granted only as necessary. This proactive strategy stresses the importance of continuous monitoring and data-driven analytics, effectively moving the focus from reactive measures to a more preemptive security posture, in anticipation of future AI-driven threats.

Preparing for AI-Enabled Cyber Threats

As we near 2025, the landscape of cyber threats is becoming increasingly complex, driven by advances in artificial intelligence. AI-enabled threats have the sophisticated ability to identify system vulnerabilities, deploy widespread campaigns, and establish undetected backdoors within infrastructures, posing a significant risk to data integrity and security. Cybersecurity professionals are finding these AI-driven threats challenging, as threat actors can exploit weaknesses in AI models, leading to novel forms of cybercrime. The critical need for real-time AI-driven defenses becomes apparent as businesses strive to recognize and neutralize malicious activities as they occur. Organizations must prioritize preparing for AI-powered cyberattacks to maintain resilience against these evolving threats. Traditional security measures are becoming outdated in the face of AI-powered cyberattacks, thus compelling security teams to adopt advanced technologies that focus on early threat detection and response.

Developing AI Resilience Strategies

The development of AI resilience strategies is essential as organizations prepare to counter AI-driven cyber threats. Robust data management practices, including data validation and sanitization, play a crucial role in maintaining data integrity and security. By leveraging AI’s power to monitor networks continuously, security teams gain enhanced visibility, allowing for the early detection of potential cyber threats. Preparing AI models by exposing them to various attack scenarios during training significantly increases their resilience against real-world adversarial threats. In this evolving threat landscape, integrating AI into cybersecurity strategies provides a notable advantage, enabling preemptive counteraction against emerging risks. AI-enabled agentic cybersecurity holds the promise of automating threat detection and response, thus reducing response time and alleviating the workload on security analysts.

Importance of Cross-Sector Collaborations

Cross-sector collaborations have become vital in adapting to the rapidly evolving AI-driven cyber threat landscape. Public-private partnerships and regional interventions provide a foundation for effective intelligence sharing and identifying new threats. These collaborations between tech companies, cybersecurity vendors, universities, and government agencies enhance cyber resilience and develop best practices. The collective efforts extend beyond individual organizational capabilities, leveraging a diverse expertise pool to tackle systemic cybersecurity challenges strategically. By fostering strong public-private cooperation, sectors can combat cybercrime through unified action, demonstrating the importance of cybersecurity as a strategic priority. Initiatives like the Centres’ collaboration with over 50 partners exemplify the power of alliances in combating AI-driven threats and fortifying cyber defenses.

Upgrading Security Infrastructures

The evolution of AI-driven threats necessitates a comprehensive upgrade of security infrastructures. Organizations must align their IT, security, procurement, and compliance teams to ensure effective modernization of their security measures. Strengthening identity security is paramount and involves deploying centralized Identity and Access Management (IAM), adaptive multi-factor authentication (MFA), and real-time behavioral monitoring. Implementing AI-powered solutions is essential for automating critical security tasks, such as monitoring, analysis, patching, prevention, and remediation. AI-native cybersecurity systems excel in leveraging vast datasets to identify patterns and automate responses, enhancing an organization’s defensive capabilities. As communication modes become more complex, multi-layered identity checks must account for AI-powered impersonation to ensure that verification processes remain secure and robust.

The Role of Continuous Monitoring and Response

Continuous monitoring and response are core components of modern cybersecurity strategies, particularly in the face of sophisticated AI-powered cyberattacks. AI-driven security systems significantly enhance this process by analyzing behavioral patterns to detect anomalies in real time. Automated incident response systems, using AI, can contain breaches much quicker than traditional human-led responses, allowing for more efficient mitigation of threats. The AI algorithms in these systems are designed to learn and evolve, adapting their strategies to effectively bypass static security defenses. As the complexity of attack vectors increases, the need for continuous monitoring becomes critical in adapting quickly to new threats. Advanced AI tools automate vulnerability scanning and exploitation, identifying zero-day and n-day vulnerabilities rapidly, thereby bolstering an organization’s ability to preempt and respond to cyber risks proactively.

The Future of AI in Cybersecurity

Artificial Intelligence (AI) is revolutionizing the field of cybersecurity, playing a pivotal role in enabling real-time threat detection, providing predictive analytics, and automating responses to the ever-evolving landscape of cyber threats. By 2025, the sophistication and scale of AI-driven cyberattacks are anticipated to significantly escalate, pressing organizations to deploy robust, AI-powered defense systems. The global market for AI in cybersecurity is on a path of remarkable growth, expanding from $15 billion in 2021 to a projected $135 billion by 2030. AI technologies are transforming the cybersecurity industry by allowing businesses to pinpoint vulnerabilities far more efficiently than traditional security measures. In this battleground of cybersecurity, AI is not only a tool for defenders but also a weapon for attackers, as both sides leverage AI to enhance their strategies and respond to emerging threats.

Predictions for 2025 and Beyond

The integration of AI into cybersecurity is predicted to greatly enhance threat detection and mitigation abilities by processing extensive data in real-time, enabling swift responses to potential threats. The financial burden of global cybercrime is expected to rise drastically, from an estimated $8.15 trillion in 2023 to $11.45 trillion by 2026, potentially reaching $13.82 trillion by 2027. The increasing impact of AI-powered cyber threats is acknowledged by 78% of Chief Information Security Officers, who report its significant influence on their organizations. To counteract these threats, it’s critical for organizations to cultivate a security-first culture by 2025, incorporating AI-specific cybersecurity training and incident response drills. The accelerating sophistication of AI-driven cyberattacks is reshaping the cybersecurity landscape, creating an imperative for proactive, AI-driven defense strategies. This evolution demands that cybersecurity professionals remain vigilant and adaptive to stay ahead of malicious actors who are constantly innovating their attack methods.

Ethical Implications and Challenges

As AI becomes broadly available, it presents both exciting opportunities and significant risks within the cybersecurity domain. The potential for AI-driven methods to be manipulated by threat actors introduces new vulnerabilities that must be meticulously managed. Balancing the implementation of AI-driven security measures with the ethical necessity for human oversight is crucial in preventing the unauthorized exploitation of AI capabilities. As these technologies advance, ethical challenges emerge, particularly in the context of detecting zero-day vulnerabilities, which can be used exploitatively by both defenders and attackers. Effective mitigation of AI-driven cyberattacks requires an equilibrium between technological innovation and ethical policy development, ensuring that AI is not misused in cybersecurity operations. The expanding application of AI in this field underscores the ethical obligation to pursue continuous monitoring and secure system development, acknowledging that AI’s powerful capabilities can serve both defensive purposes and malicious ends.

More Info and Help from MicroSolved

For organizations looking to fortify their defenses against AI-driven cyber threats, MicroSolved offers expert assistance in AI threat modeling and integrating AI into information security and risk management processes. With the growing complexity of cyber threats, especially those leveraging artificial intelligence, traditional security measures often prove inadequate.

MicroSolved’s team can help your business stay ahead of the threat landscape by providing comprehensive solutions tailored to your needs. Whether you’re dealing with ransomware attacks, phishing emails, or AI-driven attacks on critical infrastructures, they are equipped to handle the modern challenges faced by security teams.

Key Services Offered by MicroSolved:

AI Threat Modeling
Integration of AI in Cybersecurity Practices
Comprehensive Risk Management

For expert guidance or to initiate a consultation, contact MicroSolved at:

Email: info@microsolved.com
Phone: +1.614.351.1237

By partnering with MicroSolved, you can enhance your organization’s ability to detect and respond to AI-powered cyberattacks in real time, ultimately protecting your digital assets and ensuring cybersecurity resilience in 2025 and beyond.

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

What to Expect During a Tabletop Exercise with MicroSolved, Inc.

Posted on December 16, 2024 by Brent Huston

When it comes to organizational resilience, preparedness is everything. At MicroSolved, Inc., we specialize in helping organizations refine their incident response capabilities through tailored tabletop exercises. These sessions are designed not just to test your response to potential threats but to actively improve your readiness, team cohesion, and ability to adapt to evolving risks. In this blog, we’ll walk through what you can expect during one of our tabletop engagements and why they’re a critical component of any security strategy.

Tabletop3

Purpose of a Tabletop Exercise

Tabletop exercises are immersive, scenario-driven simulations designed to prepare organizations for real-world incidents such as cyberattacks, data breaches, or disasters. Conducted in a safe, non-disruptive environment, these sessions serve multiple purposes:

Gap Identification: Uncover weaknesses in policies, procedures, and team readiness that could hinder your response during an actual incident.
Real-World Preparation: Test your team’s ability to make decisions under pressure in a controlled, simulated crisis.
Collaboration and Alignment: Strengthen coordination between departments, clarify roles and responsibilities, and align processes with industry best practices.

By the end of the exercise, participants gain greater confidence in their ability to navigate crises while leadership obtains actionable insights to strengthen their organizational defenses.

Pre-Engagement Preparation

A successful tabletop exercise begins long before the scenario unfolds. At MicroSolved, we follow a detailed pre-engagement process to ensure the exercise is meaningful and effective:

Scoping: Every organization faces unique risks. That’s why we work closely with our clients to define the scope of the exercise and identify realistic scenarios tailored to their industry, threat landscape, and goals.
Document Review: Our experts analyze existing policies, procedures, and technical systems to ensure the exercise reflects your organization’s current capabilities and areas for growth.
Scenario Design: We take a collaborative approach to crafting scenarios. With client input, we develop challenges that are practical, relevant, and aligned with real-world threats. Our goal is to create an experience that is engaging and impactful for participants while addressing critical areas of concern.

This meticulous preparation ensures that your tabletop exercise delivers maximum value.

During the Exercise

When it’s time to step into the exercise, our team facilitates an interactive, thought-provoking simulation designed to engage and challenge your organization. Here’s what you can expect during the session:

Moderated Simulation: One of our experienced facilitators will guide participants through the scenario, posing dynamic challenges and ensuring the exercise stays focused and productive.
Role Assignments: Key personnel take on roles relevant to the exercise, such as members of the incident response, legal, communications, or executive teams. This approach reinforces accountability and helps participants better understand their responsibilities in a real crisis.
Injects: To keep participants on their toes, we introduce “injects” — unexpected developments such as new threat intelligence or complications. These injects test your team’s ability to adapt and make decisions as the situation evolves.

Our facilitation style encourages active participation, collaboration, and critical thinking, making the exercise both realistic and engaging.

Post-Exercise Debrief

The learning doesn’t stop when the scenario ends. In fact, the post-exercise debrief is where much of the value is realized. After the simulation, we guide participants through a structured review process that includes:

Immediate Feedback: Moderators and observers provide initial insights into the team’s performance, highlighting strengths and areas for improvement.
Gap Analysis: We identify specific gaps in your processes, tools, or training that may hinder your incident response capabilities.
Deliverables: MicroSolved provides a comprehensive report summarizing observations, findings, and actionable recommendations. This deliverable serves as a roadmap for improving your organization’s readiness and resilience.

Benefits to Your Organization

Tabletop exercises are more than just training sessions — they are investments in your organization’s security posture and resilience. By working with MicroSolved, your organization can expect the following benefits:

Improved Incident Response: Develop confidence and competence in responding to a variety of incidents, from cyberattacks to natural disasters.
Clarity of Roles and Responsibilities: Ensure that every team member understands their role during a crisis, reducing confusion and delays.
Alignment with Best Practices: Strengthen alignment with industry standards, regulatory requirements, and proven best practices.
Enhanced Resilience: Build your organization’s capacity to adapt, respond, and recover from incidents with minimal disruption.

Why Choose MicroSolved?

At MicroSolved, we bring decades of experience and a deep understanding of the evolving threat landscape to every engagement. Our proprietary tools and methodologies ensure that each tabletop exercise is tailored to your organization’s unique needs, providing insights and recommendations that are both actionable and practical. We pride ourselves on our collaborative approach, ensuring that your team feels supported and empowered throughout the process.

Ready to Get Started?

A well-executed tabletop exercise can make the difference between a chaotic crisis response and a confident, coordinated recovery. If you’re ready to strengthen your organization’s readiness and resilience, contact MicroSolved today to schedule a tabletop engagement.

Learn More About MicroSolved’s Approach

Let’s build resilience, one scenario at a time.

* AI tools were used as a research assistant for this content.

Some Thoughts on Security Policy Violation and Terminations

Posted on September 26, 2023 by Brent Huston

There was recently a discussion on one of my forums that I visited about whether or not employees should be terminated if they violate information security policies.

The discussion was heated by some parties, and the threads grew long and multi-layered.

I asked Frase.io to summarize that discussion and pull together a relevant set of ideas stemming from it. Here is what the AI tool created:

– Following information security policies is crucial for the protection of sensitive data and the overall cybersecurity of a company. Therefore, it is important to discuss whether employees should face consequences for not adhering to these policies.
– When employees fail to follow information security policies, it can put the entire organization at risk. The consequences of a data breach can be severe, including financial loss, damage to reputation, and legal implications. Therefore, some argue that firing employees who do not comply with these policies is necessary to maintain a secure work environment.
– On the other hand, it is essential to consider the context and severity of the violation before deciding on termination. Employees may unintentionally make mistakes or be unaware of the policies, in which case education and training may be more appropriate than immediate termination.
– Implementing a fair and consistent approach to enforcing information security policies is crucial. This includes clear communication of expectations, regular training programs, and providing employees with the necessary tools and resources to comply with policies.
– Ultimately, the decision to fire an employee for not following information security policies should be based on a thorough assessment of the situation. It is important to balance the need for security with fairness and understanding, considering the employee’s intentions, previous behavior, and potential for improvement.

After all of the rhetoric and the flames, this seems to be a rational approach to me. I think that stripped of the emotions of the participating infosec practitioners; there is logic here that is useful.

What do you think about termination for security policy violations? What have you seen that works, and what doesn’t in your experience? Drop me a line on Twitter (@lbhuston) or Mastodon (@lbhuston@mastodon.social) and let me know your opinion.

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

3 Daily Habits for Information Security Practitioners to Stay Updated

Posted on September 12, 2023 by Brent Huston

Stay Informed with Industry News:
- Why? The cybersecurity landscape is ever-evolving. New threats, vulnerabilities, and attack vectors emerge daily.
- How?
Engage in Continuous Learning:
- Why? Technologies and tools in the cybersecurity domain are constantly advancing. To remain effective, professionals must keep up with the latest techniques and methodologies.
- How?
Network with Peers:
- Why? Networking helps share knowledge, learn about real-world challenges, and understand best practices from experienced professionals.
- How?

Remember, the field of information security is vast and dynamic. By integrating these habits into your daily routine, you’ll be better equipped to stay ahead of the curve and safeguard your organization’s digital assets.

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

Brent’s Interview About His Most Recent Book

Posted on September 5, 2023 by Brent Huston

Introduction

In today’s digital age, the importance of cyber-security cannot be overstated. With threats evolving at an unprecedented rate, organizations need to be proactive in their approach to safeguarding their assets. “We Need To Talk: 52 Weeks To Better Cyber-Security” by L. Brent Huston offers a comprehensive guide to navigating the complex world of cyber-security. We sat down with the author to delve deeper into the inspiration, content, and significance of this book.

Interview

Q1: What inspired you to write “We Need To Talk: 52 Weeks To Better Cyber-Security”?

A1: As a virtual CISO and 30+ year security practitioner, I know how important it is to keep the security team engaged with one another, encourage open discussions, and do continual learning. I wrote the book to give security teams a good basis for these discussions every week for a year. Covering the basics and letting the team discuss sticking points and areas for improvement has led my clients to identify some interesting trends and rapidly mature their security programs. I think, literally, “We Need To Talk”. We need it as practitioners, individuals, teams, and organizations. This is a stressful, detail-oriented, rapid-change business, and talking helps nearly everyone involved.

Q2: Why did you feel it was essential to provide such a comprehensive view of cyber-security?

A2: So much of what we do is complex and touches multiple areas of our organization that we must bring the basics to each. I picked the topics for discussion in the book to address the high-level, technical, and procedural controls that almost every organization needs. I threw in some of the more tenacious topics I’ve encountered in my career and a few curve balls that have bitten us over the years. Information security and risk management are broad-spectrum careers, and we need a broad spectrum of topics to help security teams be successful.

Q3: Can you elaborate on how the structure of the book facilitates this year-long journey?

A3: This is a great question. The book idealizes a weekly security team meeting where the team discusses one of the topics and why it is relevant and then works through a series of questions to help them hone and refine their security program. The book includes a topic for each week, appropriate background information about that topic, and a set of questions for discussion by the team. As I piloted the book with my clients, it became clear that these were ultra-powerful discussions and led to some amazing insights. I knew then that I had to write and put the book out there to benefit security teams and practitioners.

Q4: How did leveraging AI tools shape the content and structure of the book?

A4: I used several AI tools to help generate the content of the book. It was written programmatically, in that I wrote some programming to leverage an AI backend to generate the questions and background information for each topic. I then adjusted the code and moderated the output until I got the book I wanted. It took a while, but it was fantastic when completed. I wanted to experiment with writing with AI tools, and since I knew the book I wanted to create had a specific format and content, it seemed like a good experiment. Ultimately, I learned much about working with AI and using Grammarly for editing and self-publishing. I have been absolutely thrilled with the response to the book and how the experiment turned out. In fact, it gave birth to another project that I am just beginning and will pave the way for some exciting new breakthroughs in how to work with AI tools in the coming years.

Q5: What is the one core message or lesson from your book that you’d like security teams to take away?

A5: The one takeaway I would have them consider is that discussion among the security team can really help a lot of the team members and the organization at large. We need to talk more about the work we do, both inside our teams and to the other teams we work with across the enterprise. The more we discuss, the more likely we can support each other and find the best solutions to our common problems and issues. Implementing the strategies, tactics, and insights we discover along the way might just be the change we need to make information security more effective, easier to manage, and even more fun!

Summary

L. Brent Huston’s “We Need To Talk: 52 Weeks To Better Cyber-Security” is more than just a book; it’s a roadmap for security teams to navigate the intricate maze of cyber-security. Through structured discussions, the book aims to foster collaboration, understanding, and growth among security professionals. With the unique blend of AI-generated content and Huston’s vast experience, this book promises to be an invaluable resource for those in the field.

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

FAQ for the End of SMS Authentication

Posted on January 4, 2023 by Brent Huston

Q: What is the end of SMS authentication?

A: SMS authentication verifies user identity by sending a one-time code via text message to a user’s mobile phone number. With the rise of potential security risks, many financial websites, applications, and phone apps are phasing out SMS-based authentication and transitioning to authenticator apps that reside on user devices and smartphones.

Q: What are some of the potential security risks associated with SMS authentication?

A: Attackers have a variety of means of intercepting SMS text messages, thus defeating this type of authentication. This increases the risk of interception and misuse of the codes in question and decreases the security of the user’s account with the financial institution.

Q: What is an authenticator app?

A: An authenticator app is an application that resides in encrypted storage on the user’s device and, when prompted, provides a one-time password (“OTP”) just like the code sent in the text message. The difference is, through a variety of cryptographic techniques, once the application is set up and the settings configured, it doesn’t need to communicate with the financial platform and thus is significantly more difficult for attackers to compromise.

Q: What are the steps for organizations to switch from SMS authentication to authenticator apps?

A: Here is a quick overview of what is needed:

1. Research and decide on an authenticator app that meets your organization’s needs. Most of the time, users can select their own apps, and the firm selects the libraries needed to support them. Open source and commercial solutions abound in this space now.

2. Update user accounts in each application and authentication point with the new authentication protocol and provide instructions for downloading and setting up the authenticator app.

3. Educate users on using the authenticator app, including generating one-time passwords (OTPs), scanning QR codes, etc.

4. Monitor user feedback and usage data over time to ensure a successful switch from SMS authentication to an authenticator app.

PS – Need a process for cataloging all of your authentication points? Here you go.

IT/OT Convergence and Cyber-Security

Posted on July 28, 2021 by Brent Huston

Today, I spoke at ComSpark as a part of a panel with Chris Nichols from LucidiaIT and David Cartmel from SMC.

We talked extensively about convergence and the emerging threats stemming from the intertwined IT/OT world.

If you missed it, check the ComSpark event page here. I believe they are making some of the content available via recording, though a signup might be required.

Our virtual booth also had this excellent video around the topic. Check it out here.

Thanks and hit me up on Twitter (@lbhuston) and let me know your thoughts.

Tips For Recognizing a Phishing Email

Posted on July 28, 2021 by Brent Huston

Below are some common tips for helping to identify phishing emails at work or at home. The same rules apply.

Most Phishing Emails Originate at Common Domains

The first way to recognize a phishing email is that most originate from a public email domain.

There are few legitimate organizations that will send emails from an address that ends in @gmail.com, not even Google does this.

To check an organization’s name, type it into a search engine.Most of the time, organizations have their own email and company accounts and don’t need to use an @gmail.com address.

Check the Spelling of the Domain, Carefully!

There is another clue hidden in domain names that shows a strong indication of the scam.

Anyone can purchase a domain name from a website. There are many ways to create addresses that are easily confused with the official domain of a brand or company. The most common ways include slight mis-spellings of the domain name, or by changing one character to a number or letter that resembles the original. Be extra vigilant for these types of spoofing attempts.

Grammer and Spelling Counts

It’s often possible to tell if an email is a scam if it has poor spelling and grammar. Odd terminology or phrasing is also a clue. For example, your bank is unlikely to misspell the word checking or account, and they would not usually call an ATM machine a “cash machine”. These clues can be subtle, but often indicate that an email is not what it claims to be.

Beware of Potentially Malicious Links and Attachments

Sometimes, the wording in an email might be right, but the links send you to somewhere unexpected on the web. You can check this out in most clients and browsers by simply hovering the mouse cursor over the link without clicking on it. That’s an easy way to know where the link is taking you, and note that it might be somewhere other than what the links says it is.

You should always beware of attachments in emails. Everyone knows that malicious code and ransomware can be hiding in documents, spreadsheets and such, but they can also appear to be image files, presentations, PDFs and most types of documents. If you aren’t expecting the attachment, delete it!

Too Good To Be True

Lastly, if the offer is too good to be true, it probably is. Few people have won the lottery and been notified by email. Even less have been chosen for random gifts or to receive inheritance from Kings and Queens. Don’t be gullible, and remember, scammers are out there, and they want to trick you.

What to Do When You Spot a Phish

The first thing is to delete the email and attachments. If it is a work email, you should also notify the security team that you received it. They can investigate, as needed. In some firms, they may want you to forward it to a specific email address for the security team, but most security teams can recover the email information even if you delete it. Follow their instructions.

At home, just delete the email and tell your family and friends about it. The more folks are aware of what’s going around, the less likely there are to fall into the trap.

More Information

We’d love to discuss phishing attacks, emerging threats or common security controls for organizations. Reach out to info@microsolved.com or give us a call at 614-351-1237 for help.

Thanks for your attention, and until next time, stay safe out there.

Preparing for the End of SMS Authentication

Posted on November 16, 2020 by Brent Huston

Over the last several years, wealth management/asset management firms have been integrating their systems with banking, trading and other financial platforms. One of the largest challenges wealth management firms face, from a technology standpoint, is managing multi-factor authentication when connecting to the accounts of their clients. In the coming year to eighteen months, this is likely to get even more challenging as SMS-based authentication is phased out.

Today, many financial web sites, applications and phone apps require the use of SMS one-time security verification codes to be sent via text to the user. This usually happens once the user has entered their login and password to the system, after which it triggers the credential to be sent to their mobile phone number on record. The user then inputs this code into a form on the system and it is verified, and if correct, allows the user to proceed to access the application. This is called two factor authentication/multi-factor authentication (“MFA”) and is one of the most common mechanisms for performing this type of user authorization.

The problem with this mechanism for regulating sign ins to applications is that the method of sending the code is insecure. Attackers have a variety of means of intercepting SMS text messages and thus defeating this type of authentication. Just do some quick Google searches and you’ll find plenty of examples of this attack being successful. You’ll also find regulatory guidance about ending SMS authentication from a variety of sources like NIST and various financial regulators around the world.

The likely successor to SMS text message authentication is the authenticator app on user mobile devices and smartphones. These authenticator apps reside in encrypted storage on the user’s phone and when prompted, provide a one-time password (“OTP”) just like the code sent in the text message. The difference is, through a variety of cryptographic techniques, once the application is setup and the settings configured, it doesn’t need to communicate with the financial platform, and thus is significantly more difficult for attackers to compromise. Indeed, they must actually have the user’s device, or at the very least, access to the data that resides on it. This greatly reduces the risk of interception and mis-use of the codes in question, and increases the security of the user’s account with the financial institution.

This presents a significant problem, and opportunity, for wealth management firms. Transitioning their business processes from integrating with SMS-based authentication to authenticator apps can be a challenge on the technical level. Updates to the user interaction processes, for those firms that handle it manually, usually by calling the user and asking for the code, are also going to be needed. It is especially important, for these manual interactions, that some passphrase or the like is used, as banks, trading platforms and other financial institutions will be training their users to NEVER provide an authenticator app secret to anyone over the phone. Attackers leveraging social engineering are going to be the most prevalent form of danger to this authentication model, so wealth management firms must create controls to help assure their clients that they are who they say they are and train them to resist attackers pretending to be the wealth management firm.

Technical and manual implementations of this form of authentication will prove to be an ongoing challenge for wealth management firms. We are already working with a variety of our clients, helping them update their processes, policies and controls for these changes. If your organization has been traditionally using SMS message authentication with your own clients, there is even more impetus to get moving on changes to your own processes.

Let us know if we can be of service. You can reach out and have a no stress, no hassle discussion with our team by completing this web form. You can also give us a call anytime at 614-351-1237. We’d love to help!

3 Steps To Increase Cyber Security At Your Dealership

Posted on October 12, 2020 by Brent Huston

Car dealerships and automotive groups are juicy targets for cybercriminals with their wealth of identity and financial information. Cyber security in many dealerships is lax, and many don’t even have full time IT teams, with even fewer having cybersecurity risk management skills in house. While this is changing, for the better, as dealerships become more data-centric and more automated, many are moving to become more proactive against cybersecurity threats.

In addition to organized criminals seeking to capture and sell personal information, global threats stemming from phishing, malware, ransomware and social engineering also plague dealerships. Phishing and ransomware are among the leading causes of financial losses tied to cybersecurity in the dealership space. Even as the federal regulators refine their focus on dealerships as financial institutions, more and more attackers have shifted some of their attention in the automotive sales direction.

Additionally, a short walk through social media doesn’t require much effort to identify dealerships as a common target for consumer anger, frustration and threats. Some of the anger shown toward car dealerships has proven to turn into physical security concerns, while it is almost assured that some of the industry’s network breaches and data breaches can also be tied back to this form of “hacktivism”. In fact, spend some time on Twitter or chat rooms, and you can find conversations and a variety of information of hacking dealership wireless networks and WiFi cameras. These types of cybersecurity incidents are proving to be more and more popular.

With all of this cybersecurity attention to dealerships, are there any quick wins to be had? We asked our MSI team and the folks we work with at the SecureDrive Alliance that very question. Here’s the best 3 tips they could put forth:

1) Perform a yearly cybersecurity risk assessment – this should be a comprehensive view of your network architecture, security posture, defenses, detection tools, incident response plans and disaster recovery/business continuity plan capabilities. It should include a complete inventory of all PII and threats that your dealership faces. Usually this is combined with penetration testing and vulnerability assessment of your information systems to measure network security and computer security, as well as address issues with applications and social engineering.

2) Ensure that all customer wireless networks and physical security systems are logically and physically segmented from operations networks – all networks should be hardened in accordance with information security best practices and separated from the networks used for normal operations, especially finance and other PII related processes. Network traffic from the customer wireless networks should only be allowed to traverse the firewall to the Internet, and may even have its own Internet connection such as a cable modem or the like. Cameras and physical security systems should be hardened against attacks and all common credentials and default passwords should be changed. Software updates for all systems should be applied on a regular basis.

3) Train your staff to recognize phishing, eliminate password re-use among systems and applications and reportcybersecurity attacks to the proper team members – your staff is your single best means of detecting cyber threats. The more you train them to identify and resist dangerous behaviors, the stronger your cybersecurity maturity will be. Training staff members to recognize, handle, report and resist cyber risks is one of the strongest value propositions in information security today. The more your team members know about your dealership’s security protocols, service providers and threats, the more effective they can be at protecting the company and themselves. Buidling a training resource center, and setting up a single point of contact for reporting issues, along with sending out email blasts about the latest threats are all great ways to keep your team on top of the issues.

There you have it, three quick and easy wins to help your dealership do the due diligence of keeping things cyber secure. These three basic steps will go a long way to protecting the business, meeting the requirements of your regulatory authority and reduce the chances of substantial harm from cyber attacks. As always, remaining vigilant and attentive can turn the tide.

If you need any assistance with cybersecurity, risk management, penetration testing or training, MicroSolved and the SecureDrive Alliance are here to help. No matter if you’re a small business or a large auto group, our risk management and information security processes based on the cybersecurity framework from the National Institute of Standards and Technology (NIST) will get you on the road to effective data security. Simply contact MSI via this web form, or the SecureDrive Alliance via our site, and we will be happy to have a no cost, no hassle discussion to see how we can assist you.