Finally, in the enterprise security news, Not much funding this week, but Netskope raises $400M, and Hack the Box raises $55M! Also, what went wrong with IronNet? The Open Source Index highlights popular security projects, Windows 7 and Windows 8.1 have been put out to pasture, Predictions about personal cybersecurity, Cloud security trends, The ongoing impact of ChatGPT on the security industry, Password hygiene revealed to be terrible in the US Government, All that and more, on this episode of Enterprise Security Weekly.
We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
Adrian Sanabria
- FUNDING: Netskope Receives $401M In New Funding
There's not much funding today, but the funding we have is large and pointed at only a few companies. A few years ago, Netskope said it was doing fine, wasn't in a hurry to IPO, and didn't really need their Series G, but took the cash to 'top up the warchest'.
Four rounds of funding later, and I've got to wonder if that IPO is ever coming, if Netskope is comfortable as a private company, or if a PE sale is coming soon.
- FUNDING: Hack The Box Secures $55 Million in Series B Funding Led by Carlyle
A sizable series B from a security training firm is NOT something I was expecting in 2023. The best estimate of SANS Institute revenue is around $56M. If that's accurate, there's a sizable pie for HackTheBox to take a bite out of here.
The market seems rather saturated to me, but with 1.7m users, HackTheBox does seem to be doing rather well. It's typically one of the first names I hear dropped when someone new to the industry asks for self-guided training recommendations.
- (DE)FUNDING: IronNet cybersecurity faces delisting threat, potential insolvency – Baltimore Business Journal
- NEW PRODUCTS: Snyk announces general availability of its cloud platform
- NEW TOOLS: Open Source Security Index
A fantastic collection and analysis of the most popular open source security tools! 100% better than trying to manually search Github for the best free SAST tool.
- DISCONTINUED: End of Support for Previous Versions of Windows
- ESSAYS: 10 Reasons for VCs to Invest in a Network of Security Leaders
Looking forward to Tyler Shields' thoughts on this one!
- TRENDS: This Week in Startups – Em Herrera predicts Personal Cybersecurity will be big in 2023
There is actually some discussion about personal cybersecurity before the point I link to in this YouTube video, so you might want to listen to the whole segment (which starts at 50:29). Herrera mentions that she actually divides personal cybersecurity (a term I like more than consumer cybersecurity) into 6 categories, and I'd love to know what those are!
- TRENDS: Hackers went after personally identifiable information the most, study says
Reading the headlines, you'd be forgiven for thinking that the vast majority of data breaches were ransomware and extortion-driven. Reading this story, you might be surprised to hear that ransomware is only the 4th most common cause of a breach, at 10.4%. I sought out the source study, which made things a bit more clear. Ransomware was the 4th most common root cause of a data breach.
The way I'm reading this is that an extortion case where the root cause is phishing, but employs ransomware at a later stage of the campaign, would be counted as "social engineering", not "ransomware" as the root cause.
Though some of this is a bit foggy to me, the report has some good insights, like a good breakdown of the key mistakes and oversights companies can correct to prevent data breaches.
Note that the scope of this report was "100 of the largest and well-known data breaches to date". It's unclear if all these events happened in the past 5 years, or go back 20 years or more, which I would think would dull the value of the report. There's no methodology listed for the report.
- TRENDS (CloudSec): Lessons on cloud security from the ‘Twitter Whistleblower’
- TRENDS (CloudSec): Are threat actors gaining cloud skills faster than enterprises?
- TRENDS (AI EDITION): AI for Cybersecurity Market Giants Spending Is Going To Boom
- TRENDS (AI EDITION): ChatGPT is enabling script kiddies to write functional malware
- TRENDS: US Farmers win right to repair John Deere equipment
- TRENDS: How a single developer dropped AWS costs by 90%, then disappeared.
They call it freejacking - automating opening massive new accounts on services that have free trials and then abusing the free trials for profit.
Mining crypto is usually the endgame with freejacking, but in this story, someone uses it to con a company into thinking they've somehow saved them 90% on their cloud bills, when they've actually temporarily saved them money by funneling workloads to accounts with temporary free trials!
- TRENDS: 2023 threat predictions: Beware ‘economic uncertainty’ for the cybersecurity community
I'd normally pass a story like this up, but with quotes from 49 industry executives, I found this worth a skim. There are some interesting takes in there, but yes, there are also some that read like a ChatGPT prompt titled, "boilerplate 2023 prediction for the cybersecurity market written by an exec worried about offending anyone"
- HACKS: Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More
An absolutely breathtaking collection of automotive vulnerabilities. It seems like this small group of research likely had access to tens of millions of vehicles spread across 16 brands over the last 5 years!
That sounds like it might result in a 300 page PDF, but this blog post is surprisingly concise for the amount of pwnage that has occurred here.
- HACKS: Taking over a Dead IoT Company
- REPORTS: P@s$w0rds at the U.S. Department of the Interior
Figure 5, Page 18
Boy, if you're not convinced we need to ditch passwords a few pages into this report, you certainly will by the time you get to Figure 5 on Page 18.
- DISCONTINUED: Palo Alto pulls out of the consumer market; kills the Okyo Garde
We reported on the surprising news that Palo Alto broke into the consumer market with their Okyo Garde home network appliance back in Q3 2021. Less surprisingly, they ended sales a year later and ended service on December 31st, 2022.
Folks that weren't aware of the service ending got a very abrupt surprise as the device failed closed.
I doubt anyone got refunds for their devices. Normally, I wouldn't even consider that question, except that I just received a refund for everything I had ever bought that was attached to Google's Stadia cloud gaming platform, even though all my purchases were over 3 years ago!
- SQUIRREL: All the FTX Films and TV Series in Production Right Now – Decrypt
