Passwords and AI, Weak Spots Lead to Breaches, Aww...Ouch! A Name is Everything, Trojan Security, and Is it Really CERT-UA? It's CISO Intelligence for Friday 24th January 2025
Today's subjects: no, "password" won't do, even big dogs can be breached, don't be fooled by a cuddly-sounding label, won't someone think of the domain name, when security checks get phished, and cyber devils in disguise. Thank goodness it's Friday!
💡
"Gives me everything I need to be informed about a topic" - __UK.Gov__
Table of Contents
1. The Pass-word to Better Security: AI's List of What Not to Use
2. Incident at Conduent: A Cybersecurity Mishap Unfolds
3. PlushDaemon Mischief: When Plush Comes with a Punch
4. How to Fix Your Domain Name Registrar Issues
5. CAPTCHA Chronicles: When Telegram Tests Turn Malicious Traps
6. You've Got Mail — From Fake CERT-UA!
Sign up for CISO Intelligence.
21st century industry insights for the modern CISO
It won't hurt, I promise.
Email sent! Check your inbox to complete your signup.
No spam. Unsubscribe anytime.
The Pass-word to Better Security: AI's List of What Not to Use
_Strong passwords are like good manners—too many people don’t have them._
What You Need to Know
Boards and executive management should be aware that a significant development in cybersecurity has emerged, leveraging AI technology to enhance password security. This innovation utilizes advanced algorithms to identify and exclude weak or common passwords, significantly enhancing security and mitigating password-related vulnerabilities. It is crucial to prioritize the integration of such AI-driven tools to safeguard sensitive information within your organization. The executive management is expected to support the adoption of AI in password management systems to enhance cybersecurity measures effectively.
CISO focus: Identity and Access Management
Sentiment: Positive
Time to Impact: Immediate
*
Cybersecurity Gets Sassy: Put AI to Work by Specifying Password Worst Practices with a Chatbot
In the ongoing battle against cyber threats, a bright new tool has emerged from an unlikely sidekick—AI chatbots. Recent developments have given businesses the ability to reinforce password security using AI-driven smart suggestions, providing immediate and impactful enhancements in protecting sensitive data.
The Golden Opportunity for Security
A significant concern in cybersecurity has been the sheer volume of weak or easily guessed passwords that put organizations at risk. Inspired by this challenge, cybersecurity experts have turned the tables, employing AI chatbots to not just generate secure passwords but to create a list of words you should never use. This counterintuitive approach turns AI tech on its head and promises drastic improvements in organizational security practices.
Why AI-Powered Password Exclusion Works
* AI's Predictive Ability: Leveraging vast datasets, AI systems identify patterns and commonalities in passwords, predicting which are overused and vulnerable.
* Regular Updates: These AI systems are self-learning. This means they continuously update their insights as fresh data is received, accommodating the ever-evolving landscape of digital security threats.
* User-Friendly Integration: Implementation of AI-driven password exclusion is remarkably user-friendly, allowing seamless integration with existing IT architectures. This means less time grappling with complex systems and more time enhancing security protocols.
The Power Players: Who Stands to Gain?
Both large and small enterprises can reap substantial benefits by employing AI-enhanced password practices. For large companies with thousands of users, the burden on IT systems to verify and reset passwords is monumental. By preemptively excluding weak passwords through smart AI suggestions, resources can be reallocated towards strategic security endeavors instead of mundane maintenance tasks.
* Small and Mid-sized Businesses: With typically limited cybersecurity resources, smaller entities can gain robust security coverage using the efficiency of AI.
* IT Administrators: By reducing the numbers of password breaches and resets, administrators can focus on more pressing security innovations.
Challenges: The Wet Blanket to Your Firework Celebration
* Initial Resistance: As with any technological advancement, resistance to change can be the first hurdle. Convincing skeptical IT staff to trust AI for password recommendations needs careful strategy and meticulous execution.
* Integrating Seamlessly: While theoretical integration sounds simple, real-world deployment often faces compatibility challenges across platforms, which demands technical finesse.
Taking the First Step: Quick Wins for You
To get immediately impactful benefits from AI in password security:
1. Conduct Training Workshops: Educate employees and IT staff on how AI can enhance security and streamline password management.
2. Pilot Program: Implement an AI-powered password exclusion list in a segment of the organization to showcase its efficiency before full-scale deployment.
3. Feedback Loop: Establish a continual feedback loop to iteratively refine AI recommendations, ensuring they meet organizational security standards effectively.
*
Vendor Diligence Questions
1. How does the AI exclude list integrate with our current password management systems?
2. What is the frequency of updates and how adaptable is the solution to emerging cybersecurity threats?
3. What evidence or case studies can you provide to demonstrate the efficacy of AI-driven password exclusion?
Action Plan
Evaluate current password protocols and identify gaps where AI can provide immediate improvements.
Engage a vendor experienced in AI-driven solutions to conduct a demo of how AI can enhance password security.
Develop a timeline for pilot testing, followed by a phased roll-out across departments.
Monitor performance metrics closely and adjust strategies based on data-driven insights.
*
Source: Use this AI chatbot prompt to create a password-exclusion list
<https://www.bleepingcomputer.com/news/security/use-this-ai-chatbot-prompt-to-create-a-password-exclusion-list/>
*
Incident at Conduent: A Cybersecurity Mishap Unfolds
_"When services halt, the plot thickens"_
What You Need to Know
A recent cybersecurity incident at Conduent led to significant service outages, affecting its vast array of clients. Immediate actions are required to manage potential data breaches and service disruptions. The CISO and the IT team must finalize contingency plans while the executive group should prioritize communication strategies and vendor due diligence assessments. The incident underscores the necessity of revisiting security protocols and strengthening cybersecurity frameworks.
CISO focus: Incident Response and Management
Sentiment: Negative
Time to Impact: Immediate
*
Conduent, a global leader in business process services, has recently confirmed that a major cybersecurity incident led to widespread operational outages. This incident has brought to light the urgent necessity for robust cybersecurity measures and incident response strategies in contemporary corporate environments. The acknowledgment follows after a period of speculation and customer frustration, as Conduent remained mum about what had caused their critical service downtime.
The Incident: A Quick Recap
Nature of the Incident : Conduent faced a cybersecurity breach that resulted in substantial challenges impacting its operational efficiency. The company has only recently confirmed the breach after the resultant outages disrupted numerous clients' activities.
Timing and Discovery : The breach was reportedly detected quickly, owing to Conduent's continuous cybersecurity monitoring. Yet, the damage control and service restoration processes prolonged the outages.
Scope : While details remain sparse, it's believed the incident affected multiple services across various sectors Conduent operates in, from healthcare and transportation to finance and public sector services.
Immediate Impact and Customer Reaction
The immediate impact was stark, with client operations severely disrupted, reflecting negatively on Conduent's reliability reputation. Customers reported issues ranging from delayed services to complete operational halts. This event reinvigorated discussions around cybersecurity's crucial role in business continuity planning.
Digging into the Why
Vulnerability Identification : While exact details have not been divulged, the breach likely exploited vulnerabilities within Conduent’s systems. It highlights a critical need to constantly update and patch software to prevent such incidents.
Potential Data Compromise : There's a looming threat of sensitive data exposure, which could lead to regulatory fines and loss of client trust, extending the incident’s impact beyond immediate outages.
Reflecting on Cybersecurity Protocols
This incident acts as a reminder of the importance of robust cybersecurity frameworks. For Conduent, this might mean re-evaluating current security measures and ensuring that all systems can withstand similar cyber threats in the future. The need for continual cyber health checks is evident.
Cautionary Tales and Preemptive Measures
One vital lesson from Conduent’s mishap is the importance of preemptive cybersecurity measures:
Preparedness is Key : Companies must focus on building proactive security infrastructures and invest in continuous employee training and system testing.
Incident Response Planning : Having a detailed incident response plan is crucial for quick mitigation to limit downtime and data loss.
Communication and Transparency : Keeping stakeholders informed during crises can help maintain trust and manage expectations.
Looking Forward: A Silver Lining?
While the incident painted a gloomy picture for Conduent in the short term, it offers an opportunity for comprehensive reevaluation and improvement of cybersecurity measures. Implementing lessons learned could position Conduent, and others who take note, to emerge with fortified defenses against cyber threats.
*
Vendor Diligence Questions
1. How does the vendor ensure continuous monitoring and real-time threat detection across their network?
2. Can the vendor provide detailed documentation of their data encryption and backup protocols?
3. What is the vendor’s incident response strategy, and how do they ensure rapid recovery from service interruptions?
Action Plan
Action Steps for IT and Security Teams:
1. Conduct a Full System Audit : Evaluate systems for potential vulnerabilities that could have been exploited in this breach.
2. Review & Revamp Incident Response Protocols: Update and test incident response plans to ensure rapid and efficient future responses.
3. Enhance Client Communication Strategies : Develop a clear communication plan to keep clients informed during service disruptions.
*
Source: Conduent confirms cybersecurity incident behind recent outage
Additional References:
"The Essential Cybersecurity Handbook for Line of Business Leaders," by Oftwear Cyber Institute
"Cybersecurity and Cyberwar: What Everyone Needs to Know," by P.W. Singer and Allan Friedman
*
PlushDaemon Mischief: When Plush Comes with a Punch
_Don't let the cute name fool you, PlushDaemon's got claws._
What You Need to Know
The elusive Advanced Persistent Threat (APT) known as PlushDaemon has struck again, targeting yet another unsuspecting victim—in this case, a popular South Korean VPN provider. This cyber-incursion exemplifies the sophistication and tenacity of cybercriminal groups willing to exploit supply chain vulnerabilities. The key takeaway: fortify supply chain defenses and assess existing VPN partnerships immediately for exposure risks.
CISO Focus: Supply Chain Security, APT Defense Strategies
Sentiment: Strong Negative
Time to Impact: Immediate
*
In the menacing ballet of cyber threats, few acts stagger the cybersecurity stage quite like a well-coordinated APT attack. PlushDaemon, an APT with a deceptive name and an even more deceptive scheme, has once again danced its way into the spotlight. Its latest choreography involved compromising a South Korean VPN provider, highlighting profound vulnerabilities within supply chains and amplifying the urgency for fortified cyber defenses.
Mirror, Mirror on the Protocol Wall
1. What Happened?
A sophisticated attack led by the PlushDaemon APT group targeted a prominent South Korean VPN provider.
This incident serves as a jarring reminder of the vulnerabilities ingrained within complex supply chains.
2. Why is it Significant?
VPN providers play a crucial role in encrypting data and guarding online privacy. A compromised VPN not only endangers direct clients but also potentially exposes countless downstream users.
The attack method exemplifies an insidious trend where cybercriminals pivot from targeting primary entities to impacting the interconnected network of suppliers.
3. Anatomy of the Attack
PlushDaemon employed a highly tailored phishing campaign to gain initial access.
It executed lateral movements within the network, capitalizing on unpatched systems and weak credentials, eventually compromising core functionalities of the VPN service.
No Supply Chain Left Behind
The adage "you're only as strong as your weakest link" is particularly true in the realm of network defense. PlushDaemon's incursion underscores the severity and real-world impact of supply chain vulnerabilities.
Case Study Similarities : Comparisons are being drawn to the SolarWinds debacle, where supply chain vulnerabilities facilitated unprecedented infiltration and data exfiltration.
Ecosystem Ripple Effects : Suppliers who remain unshielded inevitably pass risk down to associates and customers. End-to-end evaluation and hardening of suppliers are paramount.
Desperate Times Call for Ensured Measures
Adapting to such threats concludes with robust strategies, including:
Zero Trust Principles : Adopting a Zero Trust framework correlates with minimizing lateral movement and bolstering defenses.
Continuous Monitoring : Leverage AI-driven tools to maintain vigilant surveillance over network traffic, alerting to any abnormal activities.
Third-party Risk Assessments : Regular audits and risk evaluations of third-party suppliers mitigate exposure factors.
PlushDaemon may have hatched under your radar, but with precise countermeasures, its next appearance can be thwarted. Defend not only your castle but the bridges leading to it.
*
Vendor Diligence
1. How do they secure data in transit and at rest?
2. What is their incident response protocol in case of a breach?
3. Do they proactively disclose and patch vulnerabilities?
Action Plan
Conduct immediate audits on all existing VPN solutions for potential exposure.
Initiate a comprehensive review of all third-party supplier cybersecurity measures.
Accelerate patch management timelines for any potential vulnerabilities.
Host training sessions for employees to recognize phishing attempts effectively.
Update and enforce robust multi-factor authentication protocols on all sensitive access points.
*
Sources
"PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack." The Hacker News, January 2025.
"The Vulnerable Supply Chain in Cyberattacks: Lessons from SolarWinds." Wired.
"The Importance of a Comprehensive Cybersecurity Framework." Cyber Insights Magazine.
*
How to Fix Your Domain Name Registrar Issues
_"Struggling with domain headaches? It’s time to cut the knot, not the cord."_
What You Need to Know
In the dynamic digital landscape, domain security is critical. Organizations relying heavily on their digital presence must ensure their domain registrations are robustly managed to prevent misconfiguration or hijacking. Executive management is expected to endorse strategic investments in robust domain management practices and maintain continuous oversight on domain security infrastructure.
CISO focus: Domain Security
Sentiment: Strong Positive
Time to Impact: Immediate
*
Subscribers receive exclusive insights into the complexities of domain name registration and security, unraveling the best practices to shield their organization's digital operations. Delve into strategies to combat domain mismanagement with expert advice, ensuring your brand remains unfaltering in the online space.
*
Article
In the realm of digital identity, the domain name stands as a cornerstone, serving as the face of your organization online. Constantly in the crosshairs of potential cyber malfeasance, domains require a vigilant strategy to mitigate risks associated with misconfigurations, technical glitches, and malicious attacks.
The Stakes of Domain Neglect
Brand Damage: A compromised domain can result in brand degradation, financial losses, and consumer distrust.
Loss of Control: Without stringent protections, businesses could lose administrative control, succumbing to hijacking and unauthorized domain transfers.
Operational Disruption: Downtime impacting both internal and customer-facing applications can have a deep operational impact.
Establishing a Bulletproof Domain Strategy
1. Choose a Reputable Registrar
Secure your domain with established registrars known for robust security practices.
Ensure the registrar offers support for DNSSEC (Domain Name System Security Extensions).
2. Implement Multi-Factor Authentication (MFA)
Employ MFA to add an extra layer of security beyond just passwords.
Protect all user accounts and access points within the domain management platform.
3. Regular Audits and Monitoring
Conduct frequent audits to track changes or irregular activities in your domain settings.
Adopt monitoring solutions to alert on unauthorized domain modifications or DNS record changes.
Best Practices in Domain Management
Registrar Lock : Enable locked status where your domain cannot be transferred without explicit authorization.
Public WHOIS Privacy : Protect administrative contact information from being publicly accessible to reduce the risk of phishing.
Scheduled Renewals : Automate renewals or adopt extended registration periods to prevent inadvertent lapses.
Why It's Crucial to Act Now
The immediacy of domain threats requires organizations to fine-tune their domain management tactics swiftly. Lack of action could lead to severe long-term repercussions, damaging reputation and authority. As cyber threats become increasingly sophisticated, proactive domain security measures should be a non-negotiable priority.
_Note to Cynics: So, what are you waiting for? A domain Greek tragedy? Secure that online identity before it’s curtains!_
*
Vendor Diligence Questions
1. Does the domain registrar support comprehensive security features, including DNSSEC and MFA?
2. What measures does the registrar have in place to prevent unauthorized domain transfer or hijacking?
3. How does the registrar ensure data privacy and protection concerning WHOIS information?
Action Plan
Immediate Steps for Teams Reporting to the CISO:
1. Assessment of Current Domains:
Conduct an immediate review of current domain registrars and configurations.
Identify potential vulnerabilities or existing lax security measures.
2. Implementation of Security Enhancements:
Liaise with IT to integrate MFA across all domain access points.
Coordinate with legal and compliance teams to ensure all domains adhere to industry regulations and best practices.
3. Establish Ongoing Monitoring and Training:
Implement continuous monitoring solutions to detect and alert on suspicious activities.
Schedule regular training sessions for teams on emerging domain threats and response protocols.
*
Source: How to Fix Your Domain Name Registrar Issues | UpGuard
*
CAPTCHA Chronicles: When Telegram Tests Turn Malicious Traps
_CAPTCHA: Come And Phish This Cleverly Hosted Attack_
What You Need to Know
A recent security incident has emerged involving Telegram, where CAPTCHA tests are being exploited to deploy malicious PowerShell scripts. This attack poses a significant cybersecurity threat by leveraging what is traditionally seen as a security check. Management should prioritize reviewing current security protocols and ensuring user awareness training that highlights this emerging threat.
CISO focus: Phishing and Malicious Script Attack
Sentiment: Strong Negative
Time to Impact: Immediate
*
In the digital age, captchas serve as gatekeepers, defending against bots but now, ironically, they have been turned into Trojan horses. According to a report by Bleeping Computer, cybercriminals have ingeniously manipulated Telegram's verification processes, embedding malicious PowerShell scripts in these seemingly innocuous tests. This sinister innovation signifies not just a cunning technological maneuver but an alarming evolution in phishing tactics, compelling both cybersecurity experts and everyday users to bolster their defenses against such duplicitous devising.
The CAPTCHAs’ Deceptive Front
The malicious campaign exploits the familiarity and trust gained through CAPTCHA tests, using Telegram as a platform for its distribution. Known for validating human interaction, these tests are cleverly masked traps, seamlessly integrating into routine processes that many users execute without a second thought. By capitalizing on the comfort zone of user interactions, cybercriminals create a perfect storm of deception — a Trojan horse cloaked under a banner of safety and routine.
How the Attack Functions
Step 1: Users are presented with a seemingly typical CAPTCHA challenge upon accessing a resource or service through Telegram.
Step 2: Hidden within this operational sequence is a malicious payload — a PowerShell script crafted to execute criminal objectives once users engage with it.
Step 3: The script runs undetected, granting attackers access to the victim's machine and potentially their network, depending on security posture.
These steps illustrate the simplicity yet potency of the attack, highlighting the critical components that make it a dangerous innovation in phishing.
Implications for Organizations
The threat extends beyond individual users to organizations, especially those relying on Telegram as a communication channel. With compromised CAPTCHAs acting as entry points, businesses risk unauthorized data access, system control, or network infiltration. Organizations must therefore reassess their security agreements with external communication platforms, and reinforce endpoint security measures to combat this threat vector.
Operational Adjustments Required
Strict scrutiny of CAPTCHA implementations and third-party integrations.
Engagement in continuous user education initiatives surrounding phishing and script-based threats.
Deployment of robust security measures such as enhanced PowerShell script monitoring and prompt deactivation of risky communication practices.
Such adjustments can secure organizational networks against unauthorized intrusions while educating employees about potential threats hidden in everyday digital interactions.
Anti-Phishing Inoculation: Beefing Up Cybersecurity
To stall the proliferation of this tool of deception, cybersecurity defenses must transcend standard countermeasures and delve into comprehensive, proactive strategies. Real-time threat detection systems play a critical role here, monitoring and flagging suspicious activities involving PowerShell executions.
Moreover, the surge in this type of attack harks back to a pressing priority: fostering a well-informed user base. The notion of continuous cybersecurity education cannot be overstated, especially in the face of evolving threats that employ familiar aspects of digital interactions like CAPTCHAs.
Prioritizing Cyber Hygiene
Ensuring security in a digitized world requires a two-pronged approach: technology and education. Routine cybersecurity drills, frequent updates of security protocols, and regular checks on user compliance are essential.
User Training: Tailored programs should educate staff about this specific phishing tactic, fostering a culture of vigilance and informed response.
Technical Reinforcements: Deploy next-gen firewalls, enhanced email security systems, and regular security audits to ensure all aspects of company tech infrastructure are secure.
In Closing: CAPTCHA-ed by Surprise!
The exploitation of Telegram's CAPTCHAs underscores the relentless malice within the cyber realm, a stark reminder that even the most trusted digital processes can harbor threats. As technology advances, organizations and individuals alike must remain vigilant, adaptable, and proactive in safeguarding against these evolving threats.
*
Vendor Diligence Questions
1. How does your service or product ensure the authenticity and security of CAPTCHA implementations?
2. What measures are in place to detect and block malicious PowerShell scripts within your infrastructure?
3. Can your organization provide detailed incident responses and support in the event of a script-based phishing attack detected through your systems?
Action Plan
Audit and verify all CAPTCHA processes integrated within organizational systems.
Boost PowerShell monitoring capabilities, ensuring that no unapproved scripts run unchecked.
Initiate company-wide alertness and educational campaigns about emerging phishing methods like CAPTCHA exploits.
Maintain resilient incident response teams ready to act swiftly against detected threats, minimizing potential impact and facilitating recovery.
*
Source: Telegram CAPTCHA Tricks You Into Running Malicious PowerShell Scripts
*
You've Got Mail — From Fake CERT-UA!
_When your guardian angel turns out to be a cyber-impersonator, it's high time you checked under the hood!_
What You Need to Know
The Ukrainian government's Computer Emergency Response Team (CERT-UA) warns of attempted cyberattacks using AnyDesk software by alleged impersonators. These actors aim to connect under the guise of a security audit, leveraging the well-respected CERT-UA name and logo. It's imperative for organizations potentially targeted to verify the authenticity of such requests through established communication channels and avoid unauthorized remote access.
CISO focus: Threat Intelligence, Cyber Threats, Incident Response
Sentiment: Strong negative
Time to Impact: Immediate
*
Impersonation Alert: Fake CERT-UA Targeting Enterprises via AnyDesk
In a recent distressing development, multiple enterprises have come under attack by crafty cybercriminals posing as the Ukrainian Cyber Emergency Response Team (CERT-UA). These sophisticated impostors are exploiting the trust and credibility associated with CERT-UA to deceive targets into granting remote access through AnyDesk software. By masquerading their operations as a "security audit," they manage to exploit organizational vulnerabilities rooted less in software firewalls and more in human trust.
Key Details of the Scam
* Modus Operandi : The culprits aim to dupe victims by contacting them with legitimate-sounding requests for a security audit, complete with the CERT-UA logo and identifiers, urging them to grant access via remote desktop software AnyDesk.
* Red Flags : These entities use the AnyDesk identifier "1518341498," although it's essential to note this identifier can change. The use of an unexpected identifier or PARTNER ID should immediately raise suspicion.
CERT-UA's Legitimate Use of AnyDesk
CERT-UA occasionally uses AnyDesk for legitimately assisting cyber protected facilities. However, these legitimate requests are preceded by official communications through well-established channels. This underscores the importance of organizations having clear protocols for verifying such communications before ceding remote access.
Immediate Actions and Preventive Measures
1. Verification Protocols : Before granting any unprecedented access, verify through direct, previously established communication methods to confirm authenticity.
2. Awareness Campaigns : Companies should engage in routine awareness training, emphasizing the risks of social engineering tactics, especially focusing on impersonation threats.
3. Strict Access Controls : Limit remote access privileges within your organization and ensure robust authentication measures for all users, especially those accessing through remote desktop software.
Broader Implications for Cybersecurity
The incident highlights a growing trend in cyber operations where identity masquerading plays a pivotal role. Beyond conventional hacking, trust manipulation is an emerging vector that capitalizes on our increasing interconnectedness. Organizations must evolve their security paradigms to address these sophisticated human-centric vulnerabilities.
Lessons Learned
* Trust, But Verify : In an era where every entity is susceptible to impersonation, the guiding principle should be verification before trust.
* Communication Channels : Ensure regular communication with trusted advisory teams or governmental bodies. Know their contact points and always confirm independently.
* Educate & Evolve: Cybersecurity breaches are not static; thus, neither should be the defenses. Regular education sessions and adaptive security protocols are vital.
Future Steps and Cybersecurity Strategy
Moving forward, incorporating AI-driven verification tools and leveraging machine learning could bolster an organization's capability to detect imposter communications. Additionally, industry dialogues and strong public-private partnerships can ensure updated, effective defense mechanisms are shared widely and promptly.
Whodunit?
A cheeky nod to mystery novels is apt here, as the real culprits remain enshrouded by the anonymity of the web. Keeping them at bay involves more than technology — it’s about nurturing a culture of skepticism where "too good to be true" is a red flag, prompting investigation.
*
Vendor Diligence Questions
1. How does your remote access management software alert users to potential impersonation threats?
2. What measures are in place to authenticate communication from entities leveraging your software for remote access?
3. Could you provide a documented process for verifying the legitimacy of remote connection requests?
Action Plan
Immediate Communication : Inform all staff and stakeholders about the impersonation threat and relay guidelines to verify requests.
Access Review : Audit current remote access permissions and ensure compliance with the latest security standards.
Phishing Test : Conduct a surprise phishing simulation to assess and improve employee response to potential threats.
*
Source:
Follow the full story at CERT-UA Announcement
*
_CISO Intelligence is lovingly curated from open source intelligence newsfeeds and is aimed at helping cybersecurity professionals be better, no matter what their stage in their career._
_We’re a small startup, and your subscription and recommendation to others is really important to us._
*Thank you so much for your support!(