Data Protection and Backup Solutions

Ransomware attacks have become one of the most prevalent threats and it continues to paralyse businesses, organizations, and individuals by encrypting their data and demanding hefty ransoms for its release. Sharing a ransomware strategy checklist by Rivedix Organization tend to focus a lot on "response and recovery" while ignoring the "strategy & planning". For example, when as an organization you decide to not pay ransom, you would be more diligent building comprehensive security controls and in protecting integrity of backups. Mitigating these ransomware risks goes beyond just deploying security controls. Given the impact of ransomware on business, organizations should focus on key areas such as -      Get your board/mgmt. know the impact of threat & recovery challenges. -      Deploy controls to protect devices and monitor effectiveness of these controls. -      Incident mgmt. plan – Readiness, recovery, communication, lesson learned etc -      Run cyber threat exercises with these scenarios and test effectiveness of your playbook and crisis mgmt. capabilities -      In case ransomware hits in cloud / third party integrated environments, it might require comprehensive approach in recovery with vendor participation. -      Maintaining clean backup of critical data Sharing a high level approach. something that was adapted and worked quite well . The technical controls to protect Endpoints/servers etc would vary with each environment depending on network/system setup. Any suggestions or feedback is most welcome. #Ransomeware #cyberattack #databreach #compliance #auditing CYTAD

🚨New Advisory on RansomHub Ransomware🚨 The FBI, #CISA, MS-ISAC, and HHS have released a new joint advisory about the RansomHub ransomware, formerly known as Cyclops and Knight. This ransomware-as-a-service (RaaS) variant has become increasingly sophisticated, targeting critical infrastructure sectors like water and wastewater, IT, government, healthcare, and more. 🚑🏦🚛 Key Points to Know: 🔹Double Extortion Tactics: RansomHub encrypts data and exfiltrates it, demanding ransom for decryption and preventing data leaks. Victims are given a limited timeframe to comply before their data is published on the RansomHub Tor site. 🔹Growing Threat: Since February 2024, RansomHub has impacted over 200 victims, drawing affiliates from other major ransomware variants like LockBit and ALPHV. The RaaS model allows different threat actors to leverage this ransomware, increasing its reach and sophistication. 🔹Advanced Techniques and Tools: Affiliates gain initial access by utilizing a range of techniques, such as phishing, exploiting known vulnerabilities (like CVE-2023-3519), and password spraying. They also employ tools like Mimikatz for credential dumping and Cobalt Strike for lateral movement. Mitigation Steps: 1️⃣To protect against RansomHub, network defenders should: Install Security Updates: Keep all systems patched against known vulnerabilities. 2️⃣Implement Phishing-Resistant MFA: Use strong, non-SMS-based multi-factor authentication wherever possible. 3️⃣Conduct Regular Training: Ensure users are trained to recognize and report phishing attempts. 📧 4️⃣Network Segmentation and Monitoring: 🔥Segregate networks💥 to limit lateral movement and use network monitoring tools to detect abnormal activities. Stay Ahead of the Threat: This advisory aligns with NIST and CISA #ZeroTrust guidance (NIST 800-207, CISA Zero Trust Maturity Model) to help organizations enhance their cybersecurity posture against such evolving threats. By applying these guidelines, organizations can better prepare for and respond to ransomware attacks, protecting critical infrastructure and sensitive data. (Full disclosure: I was a co-author of both USG documents) 🛡️Read the complete advisory here: https://lnkd.in/er8pzSUx #cybersecurity #ransomware #technology

🔐 Data in Use --Protection Strategies ⚠️ The Challenge When data is being processed in memory (RAM/CPU), it’s usually decrypted, which makes it vulnerable to: 💥 Insider threats 💥 Malware/memory scraping 💥 Cloud provider access ✅ Solutions for Data in Use 1. Homomorphic Encryption (HE) Data stays encrypted even during computation. Supports analytics, AI/ML, and calculations without exposing raw values. 💥 Use case: A hospital can run statistics on encrypted patient data without seeing individual records. Downside: Very slow for large-scale real-time workloads (still improving). 2. Secure Enclaves / Trusted Execution Environments (TEEs) Hardware-based isolation → a secure “enclave” inside the CPU where data is decrypted and processed. Even the system admin or cloud provider cannot see inside. ✨ Examples: 💥 Intel SGX 💥 AMD SEV 💥 AWS Nitro Enclaves → lets you isolate EC2 instances for secure key management, medical data processing, payment transactions, etc. 💥 Use case: A bank can run fraud detection models on sensitive financial data in the cloud without exposing it to AWS staff. 3. Confidential Computing Broader concept: combines TEEs, encrypted memory, and sometimes HE. Ensures that data remains protected throughout its lifecycle (rest, transit, use). ✨ Cloud examples: 💥 AWS Nitro Enclaves 💥 Azure Confidential Computing 💥 Google Confidential VMs 4. Secure Multi-Party Computation (MPC) Multiple parties compute a function jointly without revealing their private inputs. Often used in cryptocurrency custody, federated learning, and zero-knowledge proofs. 💥 Example: Banks collaboratively detect fraud patterns without sharing customer records. #learnwithswetha #encryption #datainuse #learning #dataprotection #privacy

How Ransomware Almost Stole My Spotlight A few years ago, while on a routine business trip to Kuala Lumpur, I was giving a company presentation when I realised that my greatest risk was not forgetting my words but rather my digital security. Seated at a cramped desk in my hotel room, I rehearsed my presentation with my laptop connected to the hotel's public Wi-Fi, navigating each slide as though I had delivered it a thousand times. All my meticulous work resided solely on the notebook's hard drive. I was ignorant of the hidden dangers of that unsecured network. While setting up at the regional conference, a fellow speaker's laptop fell victim to a ransomware attack. Within minutes, their slides were sealed behind an encrypted vault. I watched the organisers frantically attempt to salvage the session, my heart pounding as I imagined the same disaster befalling me. Determined never to experience such anxiety again, I developed a speaker-specific cybersecurity routine based on simple daily habits. Pre-trip organisation Before every journey, I tidy and organise my laptop by backing up crucial data to a secure cloud vault and external storage, retaining only essential files, and removing any unused applications that have not been used for more than three months. Secure connections Whenever I use airport or hotel Wi-Fi, I first connect to a VPN so that every keystroke, file transfer and message remains encrypted. Strict wireless management I disable Bluetooth when I'm not using it and disable Wi-Fi auto-connect to prevent unauthorised networks or headsets from connecting. Multiple backups I keep copies of my slides in protected cloud storage as well as on a trusted thumb drive so that I never rely on a single source. Post-trip sanitisation After each trip, I forget all saved Wi-Fi networks, clear cached credentials, and either archive or delete files I no longer need while backing up the rest to both the cloud and an external hard drive. I know this sounds like a lot of work, but each habit is now as natural as my morning cup of tea. It may add minutes to my prep, but it saves me hours of panic and ensures no malware or ransomware ever steals the spotlight from my presentations. Over to you Which cyber-hygiene habit do you rely on most when presenting or travelling? Share your tip below and help us create a collective checklist so that every speaker can step into the spotlight with confidence. #alvinsratwork ✦ #ExecutiveDirector ✦ #cybersecurity ✦ #cyberhygiene ✦ #Cyberawareness ✦ #BusinessTechnologist ✦ #Cyberculture 

The tension between maximizing data utility and upholding stringent privacy is a defining challenge. How can we leverage sensitive information for analytics, AI training, or collaborative research without ever exposing the raw data itself? Homomorphic Encryption (HE)—a cryptographic approach that promises to solve this dilemma. Imagine performing computations directly on encrypted data, without any need for decryption. It's like giving someone a locked box, letting them process its contents, and getting a new locked box back, all without them ever seeing what's inside. Where could this technology revolutionize data privacy? ✅ Cloud Computing: Securely outsourcing powerful analytics or privacy-preserving AI/ML model training to untrusted cloud environments, maintaining data confidentiality end-to-end. ✅ Healthcare & Genomics: Facilitating collaborative medical research across institutions on encrypted patient records or genomic data, accelerating breakthroughs without compromising individual privacy. ✅ Financial Services: Enabling fraud detection, risk assessments, or credit scoring by analyzing encrypted financial transactions, ensuring regulatory compliance and protecting sensitive customer portfolios. ✅ Government & Defense: Enabling secure intelligence sharing and processing of classified data in multi-party or untrusted environments. However, the challenges are: 🔴 Performance Overhead: Current HE schemes are computationally intensive. Operations on encrypted data are significantly slower and resource-heavy compared to plaintext operations, making real-time applications a hurdle. 🔴 Complexity: Implementing and securely managing HE systems requires deep cryptographic expertise, posing a barrier for many organizations. The learning curve for developers is steep. 🔴 Data Expansion: Encrypted data often becomes significantly larger than its original plaintext, leading to increased storage and bandwidth requirements. 🔴 Limited Operations (Historically): While strides have been made, not all complex operations are equally efficient or even possible with current HE schemes. It's a highly specialized toolkit. 🔴 Bootstrapping: A key technique required to "refresh" noisy ciphertexts to allow for more complex computations, but it's one of the most computationally expensive steps. Despite these hurdles, the progress in libraries like SEAL, HElib, and TFHE is truly remarkable. It promises a future where data utility and privacy can coexist. What are your thoughts on Homomorphic Encryption's potential impact on cybersecurity and data privacy? #DataSecurity #Encryption #HomomorphicEncryption #SecureData #DataPrivacy #CyberSecurity #SecureProcessing #CloudComputing #TechInnovation #DataProtection

In an era where data sharing is essential and concerning, six fundamental techniques are emerging to protect privacy while enabling valuable insights. Fully Homomorphic Encryption involves encrypting data before being shared, allowing analysis without decoding the original information, thus safeguarding sensitive details. Differential Privacy adds noise variables to a dataset, making decoding the initial inputs impossible, maintaining privacy while allowing generalized analysis. Functional Encryption provides selected users a key to view specific parts of the encrypted text, offering relevant insights while withholding other details. Federated Analysis allows parties to share only the insights from their analysis, not the data itself, promoting collaboration without direct exposure. Zero-Knowledge Proofs enable users to prove their knowledge of a value without revealing it, supporting secure verification without unnecessary exposure. Secure Multi-Party Computation distributes data analysis across multiple parties, so no single entity can see the complete set of inputs, ensuring a collaborative yet compartmentalized approach. Together, these techniques pave the way for a more responsible and secure data management and analytics future. #privacy #dataprotection

The 2025 Verizon Business Data Breach Investigations Report (DBIR) is here, and it delivers critical insights into the shifting cybersecurity landscape. For Enterprise and Public Sector business decision-makers, understanding these trends is crucial for protecting your organizations and the communities we serve. Here are some key findings from the report that rose to the top for me: - Exploitation of Vulnerabilities Surges: A 34% increase in vulnerability exploitation, with a focus on zero-day exploits targeting perimeter devices and VPNs, demands heightened vigilance and proactive patching strategies. - Ransomware Remains a Persistent Threat: Ransomware attacks have risen by 37%, now present in 44% of breaches. Enterprise and Public Sector entities must bolster their defenses and incident response capabilities. - Third-Party Risks Double: Breaches involving third parties have doubled, highlighting the critical importance of supply chain security and robust vendor management programs. - Espionage-Motivated Attacks Rise: We're seeing an alarming rise in espionage-motivated attacks in sectors like Manufacturing and Healthcare, as well as persistent threats in Education, Finance, and Retail. Public Sector entities are also at risk. - Credential Abuse Continues: Credential abuse remains a leading attack vector, emphasizing the need for strong authentication, multi-factor authentication, and continuous monitoring. For Enterprise and Public Sector organizations, these findings underscore the need for a multi-layered defense strategy, including: - Robust Vulnerability Management: Implement timely patching and vulnerability scanning. - Enhanced Security Awareness Training: Address the human element and reduce susceptibility to social engineering. - Strengthened Third-Party Risk Management: Thoroughly vet and monitor vendors and partners. - Advanced Threat Detection and Response: Invest in technologies and processes to detect and respond to threats quickly. The 2025 DBIR provides actionable insights to help us navigate these challenges. To dive deeper into the findings and learn how to enhance your organization's security posture, visit: https://lnkd.in/eXdHUYVM #Cybersecurity #DataBreach #EnterpriseSecurity #PublicSector #DBIR #Ransomware #ThreatIntelligence #VerizonBusiness #PublicSectorSecurity Verizon Jonathan Nikols | Daniel Lawson | Robert Le Busque | Sanjiv Gossain | Maggie Hallbach | Don Mercier | Chris Novak | Alistair Neil | Ashish Khanna | Alex Pinto | David Hylender | Suzanne Widup | Philippe Langlois | Nasrin Rezai | Iris Meijer

By applying these strategic principles from "The Art of War" to cybersecurity, organizations can enhance defensive strategies and stay one step ahead of cyber adversaries. 1. Know your enemy and know yourself - Understand your own systems and vulnerabilities, and know the threat actors targeting you. Regularly assess your security posture and keep up-to-date on threat intelligence. 2. Appear weak when you are strong, and strong when you are weak: - Use deception techniques like honeypots and decoy systems to mislead attackers about the true nature and strength of your defenses. 3. Attack where the enemy is unprepared: - Identify and exploit weak points in potential attackers’ methodologies and tools. Ensure you have comprehensive defenses, including monitoring for uncommon attack vectors. 4. Make use of spies: - Leverage threat intelligence and cybersecurity experts to gather information on cyber threats and adversaries. Use this intelligence to stay ahead of potential attacks. 5. Use terrain to your advantage: - Configure your network architecture to favor defense. Implement network segmentation, firewalls, and secure configurations to create a landscape that is challenging for attackers to navigate. 6. Be flexible: - Cyber threats are constantly evolving. Ensure your security policies and defenses can adapt quickly to new types of attacks and emerging vulnerabilities. 7. Concentrate your forces: - Focus your resources on protecting critical assets and data. Prioritize the most important systems for the strongest defenses and monitoring. 8. Strike at the enemy's heart: - Identify the core motivations and techniques of your adversaries. Disrupt their operations by targeting their infrastructure, such as command and control servers, or disrupting their financial incentives. 9. Use deception: - Implement security measures like deceptive traps and misinformation to confuse and delay attackers. Use threat hunting to proactively detect and respond to threats. 10. Know when to retreat: - In cybersecurity, retreating means recognizing when a system is compromised and isolating it to prevent further damage. Have incident response plans in place to quickly contain breaches and restore systems securely. Salient Lessons from the Art of War.