RedAlpha update. Evil PLC proof-of-concept . Cl0p hits English water utility. "SEABORGIUM" Russian cyberespionage activity.

Summary

By the CyberWire staff

At a glance.

An update on RedAlpha.
Evil PLC proof-of-concept shows how programmable logic controllers could be "weaponized."
Cl0p gang hits English water utility.
Microsoft identifies and disrupts Russian cyberespionage activity.

An update on RedAlpha.

Recorded Future this morning outlined recent activity by the Chinese government threat actor RedAlpha, an operation the company's researchers have been tracking since June of 2018. RedAlpha has recently been observed conducting large-scale credential theft. Its targets continue to be "humanitarian, think tank, and government organizations globally."

"Over the past 3 years, we have observed RedAlpha registering and weaponizing hundreds of domains spoofing organizations such as the International Federation for Human Rights (FIDH), Amnesty International, the Mercator Institute for China Studies (MERICS), Radio Free Asia (RFA), the American Institute in Taiwan (AIT), and other global government, think tank, and humanitarian organizations that fall within the strategic interests of the Chinese government," Recorded Future writes. RedAlpha, which researchers believe is run for Chinese intelligence and security services by contractor personnel, has shown an interest in domestic ethnic and religious minorities, especially Tibetan and Uyghur populations. Internationally, the group has been particularly but not exclusively interested in Taiwan. "Historically, the group has also engaged in direct targeting of ethnic and religious minorities, including individuals and organizations within Tibetan and Uyghur communities. As highlighted within this report, in recent years RedAlpha has also displayed a particular interest in spoofing political, government, and think tank organizations in Taiwan, likely in an effort to gather political intelligence."

RedAlpha's techniques involve a great deal of credential harvesting. "Our research uncovered the suspected China statesponsored group RedAlpha conducting credential-harvesting activity targeting individuals and organizations globally, with a particular focus on civil society and government sectors, Recorded Future says. "The group has used a consistent set of TTPs to register and manage large clusters of operational phishing infrastructure, using a mixture of pages impersonating popular email provider logins and custom webmail login pages to mimic specific providers and organizations." It's objectives are consonant with those common in Chinese intelligence and security operations. "Since 2015, the group has engaged in consistent targeting of individual citizens and groups associated with minority communities, many of which are subject to reported human rights abuses within China. More generally, Chinese statesponsored groups continue to aggressively target dissident and minority groups and individuals, both domestically through state surveillance and internationally through cyber-enabled intrusion activity. This targeting of sensitive and vulnerable communities, many of which have security budget and resources constraints, is particularly concerning."

Free Guide | 5 Critical Controls for World-Class OT Cybersecurity

As operational technology (OT) cybersecurity becomes a top priority from boardrooms to the manufacturing floor, CISOs and their teams must implement proven strategies to protect the business. Download this free guide and discover the components to align your leadership and implement a successful operational technology (OT) security posture. Download now →.

Evil PLC proof-of-concept shows how programmable logic controllers could be "weaponized."

Claroty's Team82 research group has developed "a novel attack that weaponizes programmable logic controllers (PLCs) in order to exploit engineering workstations and further invade OT and enterprise networks." It's a proof-of-concept that demonstrates what Claroty considers a hitherto unexplored vulnerability in PLCs.

"This technique weaponizes the PLC with data that isn't necessarily part of a normal static/offline project file," Claroty says, "and enables code execution upon an engineering connection/upload procedure. Through this attack vector, the goal is not the PLC, such as it was, for example, with the notorious Stuxnet malware that stealthily changed PLC logic to cause physical damage. Instead, we want to use the PLC as a pivot point to attack the engineers who program and diagnose it and gain deeper access to the OT network." The researchers emphasize that "all the vulnerabilities we found were on the engineering workstation software side and not in the PLC firmware. In most cases, the vulnerabilities exist because the software fully trusted data coming from the PLC without performing extensive security checks."

Become a sponsor for this year’s Women in Cybersecurity Reception!

The Women in Cybersecurity Reception is an annual networking event that highlights and celebrates the value and successes of women in the cybersecurity industry. This event brings together a group of women with diverse backgrounds to strengthen relationships, and build new ones. Contact us if your company is interested in sponsoring an event made for women that are passionate about cybersecurity. Learn More.

Cl0p gang hits English water utility.

The Cl0p group, after a failed extortion attempt, published data stolen from South Staffordshire Water, a utility that supplies water to Staffordshire and the West Midlands. Computing reports that the gang published data that included "passport scans, screenshots of user interfaces and spreadsheets" to a dark web dump site. Cl0p apparently believed it had hit Thames Water, a different utility, which may offer a partial explanation of why the ransom attempt failed. The systems have continued to deliver water safely and reliably throughout the incident.

Microsoft identifies and disrupts Russian cyberespionage activity.

Microsoft yesterday outlined recent activity of the Russian government threat actor Redmond calls "SEABORGIUM." The company's report begins, "The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM, an actor Microsoft has tracked since 2017. SEABORGIUM is a threat actor that originates from Russia, with objectives and victimology that align closely with Russian state interests. Its campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft."

As is typically the case, different researchers track this (and possibly other, related activities) by different names. "SEABORGIUM overlaps with the threat groups tracked as Callisto Group (F-Secure), TA446 (Proofpoint) and COLDRIVER (Google). Security Service of Ukraine (SSU) has associated Callisto with Gamaredon Group (tracked by Microsoft as ACTINIUM); however, MSTIC has not observed technical intrusion links to support the association."

The group's targets have been found for the most part in the US, the UK, and other NATO allies who support Ukraine during the present war. “SEABORGIUM primarily targets NATO countries, particularly the US and the UK, with occasional targeting of other countries in the Baltics, the Nordics, and Eastern Europe," the report says. “Such targeting has included the government sector of Ukraine in the months leading up to the invasion by Russia, and organizations involved in supporting roles for the war in Ukraine.”

The group gains access through social engineering, phishing campaigns that have targeted both organizations and specific individuals. There's some appearance of linkage to conventional criminal activity, but this seems likely to represent either opportunistic collaboration with gangs or deliberate misdirection. The motives appear to be espionage and influence. "SEABORGIUM intrusions have also been linked to hack-and-leak campaigns, where stolen and leaked data is used to shape narratives in targeted countries. While we cannot rule out that supporting elements of the group may have current or prior affiliations with criminal or other nonstate ecosystems, MSTIC assesses that information collected during SEABORGIUM intrusions likely supports traditional espionage objectives and information operations as opposed to financial motivations."

SEABORGIUM's contribution to disinformation and information operations is interesting. "In late May 2022, Reuters along with Google TAG disclosed details about an information operation, specifically using hack and leak, that they attributed to COLDRIVER/SEABORGIUM. Microsoft independently linked SEABORGIUM to the campaign through technical indicators and agrees with the assessment by TAG on the actor responsible for the operation. In the said operation, the actors leaked emails/documents from 2018 to 2022, allegedly stolen from consumer Protonmail accounts belonging to high-level proponents of Brexit, to build a narrative that the participants were planning a coup. The narrative was amplified using social media and through specific politically themed media sources that garnered quite a bit of reach."

Microsoft's report includes a caution against spreading the narratives that it links to the threat group. "While we have only observed two cases of direct involvement, MSTIC is not able to rule out that SEABORGIUM’s intrusion operations have yielded data used through other information outlets. As with any information operation, Microsoft urges caution in distributing or amplifying direct narratives, and urges readers to be critical that the malicious actors could have intentionally inserted misinformation or disinformation to assist their narrative. With this in mind, Microsoft will not be releasing the specific domain or content to avoid amplification."

What has Microsoft done to disrupt SEABORGIUM? "As an outcome of these service abuse investigations, MSTIC partnered with abuse teams in Microsoft to disable accounts used by the actor for reconnaissance, phishing, and email collection. Microsoft Defender SmartScreen has also implemented detections against the phishing domains represented in SEABORGIUM’s activities."

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Notes.

Today's issue includes events affecting Argentina, Belarus, China, NATO/OTAN, Russia, Taiwan, Ukraine, the United Kingdom, and the United States.

RedAlpha updae. Evil PLC proof-of-concept . Cl0p gang hits English water utility. "SEABORGIUM" Russian cyberespionage activity.

Ukraine at D+173: OSINT for targeting; espionage and influence ops. (CyberWire) Ukrainian strikes are reported in Russian rear areas. Retaliatory Russian missile fire hits towns near the Belarusian border. Microsoft identifies and disrupts a Russian cyberespionage and influence operation.

Russia-Ukraine war: List of key events, day 174 (Al Jazeera) As the Russia-Ukraine war enters its 174th day, we take a look at the main developments.

Russia-Ukraine war: explosions reported in Crimea; Putin accuses US of trying to ‘drag out’ conflict in Ukraine – live (the Guardian) Blasts reported in Simferopol and Mayskoye; Russian president claims west was trying to build ‘Nato-like system’ in Asia-Pacific

Ukraine war: 'Multiple explosions' rock Russian military facilities in Crimea (The Telegraph) An ammunition depot exploded in northern Crimea, according to the administration in the village of Mayskoye.

Blasts rock Russian base in Crimea, Ukraine exults (Reuters) Explosions rocked an ammunition depot and disrupted trains in Russian-annexed Crimea on Tuesday, the latest such incident in a region Moscow uses as a supply line for its war in Ukraine.

Ukraine claims it has struck base used by Wagner Group paramilitaries (the Guardian) Kyiv says facility used by Russian group destroyed in ‘precision strike’, with bridge near Melitopol also hit

Stunning security blunder allows Ukraine to destroy Wagner Group mercenaries base (The Telegraph) Up to 100 fighters reportedly killed in strike, after photos posted by Russian state TV reporter appeared to give away location

42 countries and EU urge Russia to remove military from Ukrainian nuclear plant (Axios) Recent shelling damaged a power line and forced one of the plant's three reactors to be disconnected.

Russia building prison 'cages' to parade captured Ukrainian soldiers in Mariupol show trial (The Telegraph) The trial of the 'Azovstal' defenders could happen as soon as August 24 to give Moscow an appearance of a victory after months of failures

Six Weeks of ‘Hell’: Inside Russia’s Brutal Ukraine Detentions (New York Times) Thousands of Ukrainian civilians have suffered beatings and sometimes electrical shocks, while the U.N. says hundreds have disappeared into Russian jails.

Putin offers to share Russia’s advanced weapons with allies around the world (The Telegraph) Russian leader’s remarks are at odds with his army’s performance in Ukraine which is suffering from major shortages and production issues

Russia fails to pay military reservists, civilian laborers brought into Ukraine (UPI) Russia is reportedly failing to pay military reservists and volunteer units fighting in Ukraine as well as Russian laborers brought into occupied regions.

Disrupting SEABORGIUM’s ongoing phishing operations (Microsoft Security) The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM, an actor Microsoft has tracked since 2017.

Microsoft disrupts Russian-linked hackers targeting NATO countries (Breaking Defense) The company said information collected during SEABORGIUM intrusions likely supports traditional espionage objectives and information operations as opposed to financial motivations.

Microsoft Announces Disruption of Russian Espionage APT (SecurityWeek) Microsoft disrupts Russian APT actor, cutting off access to accounts used for pre-attack reconnaissance, phishing, and email harvesting.

Microsoft disrupts Russia-linked hacking group targeting defense and intelligence orgs (The Record by Recorded Future) Microsoft on Monday published new details about a suspected Russian hacking group.

Microsoft shuts down accounts linked to Russian spies (Register) Seaborgium targeted dozens of orgs this year alone

Russian hackers target Ukraine with default Word template hijacker (BleepingComputer) Threat analysts monitoring cyberattacks on Ukraine report that the operations of the notorious Russian state-backed hacking group 'Gamaredon' continue to heavily target the war-torn country.

Head of Ukraine’s Cybersecurity Says Russia Has Committed ‘Cyber War Crimes’ (Vice) Victor Zhora, head of Ukraine’s defensive cybersecurity agency, visited one of the biggest hacking conferences in the world this week.

Opinion | What Amnesty got wrong in Ukraine and why I had to resign (Washington Post) Far from protecting civilians, Amnesty's latest Ukraine report further endangered them by giving Russia a justification to continue its indiscriminate attacks.

Road to war: U.S. struggled to convince allies, and Zelensky, of risk of invasion (Washington Post) On a sunny October morning, the nation’s top intelligence, military and diplomatic leaders filed into the Oval Office for an urgent meeting with President Biden

Attacks, Threats, and Vulnerabilities

RedAlpha Conducts Multi-Year Credential Theft Campaign Targeting Global Humanitarian, Think Tank, and Government Organizations (Recorded Future) China’s RedAlpha threat group dumps older infrastructure and expands cyber-espionage operations to target humanitarian, think tank, and government organizations

Hackers linked to China have been targeting human rights groups for years (MIT Technology Review) In a new report shared exclusively with MIT Technology Review, researchers expose a cyber-espionage campaign on “a tight budget” that proves simple can still be effective.

Yanluowang Ransomware: NCC-CSIRT urges stronger security measures (Blueprint) The Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has urged organisations to adopt stronger cybersecurity measures like ensuring their employees use strong, unique passwords for every account and enabling multi-factor authentication (2FA) wherever it is supported to prevent ransomware attacks. It also advised organisations to ensure regular systems backup.

Argentina's Judiciary of Córdoba hit by PLAY ransomware attack (BleepingComputer) Argentina's Judiciary of Córdoba has shut down its IT systems after suffering a ransomware attack, reportedly at the hands of the new 'Play' ransomware operation.

Hackers attack UK water supplier but extort wrong victim (BleepingComputer) South Staffordshire Water, a company supplying 330 million liters of drinking water to 1.6 consumers daily, has issued a statement confirming IT disruption from a cyberattack.

South Staffordshire Water victim of cyber attack, customers not at risk (Computing) Gang claims to have a policy against harming critical infrastructure

South Staffordshire Water says it was target of cyber attack as criminals bungle extortion attempt (Sky News) The parent company for Cambridge Water and South Staffs Water stresses it is still supplying safe water for customers.

Evil PLC Attack: Using a Controller as Predator Rather than Prey (Claroty) Team82 has developed a novel attack that weaponizes programmable logic controllers (PLCs) in order to exploit engineering workstations and further invade OT and enterprise networks. We’re calling this the Evil PLC Attack.

Secure Boot Bypass Flaws Affect Bootloaders of Many Devices Made in Past Decade (SecurityWeek) Eurosoft, New Horizon Datasys, and CryptoPro Secure Disk bootloaders, which are present on many devices made in the past 10 years, are affected by Secure Boot bypass vulnerabilities.

A New Jailbreak for John Deere Tractors Rides the Right-to-Repair Wave (Wired) A hacker has formulated an exploit that provides root access to two popular models of the company’s farm equipment.

Updated threat actor to attack cryptocurrency and foreign exchange companies (ITP.net) DeathStalker is an infamous hack-for-hire APT actor that Kaspersky monitors since 2018, and which mainly targets law firms and organizations in the financial sector.

Increased data access opens wide medical device security vulnerabilities (FutureIoT) Cybersecurity spending in medical device sector will reach $1.2 billion by 2025 driven by escalating health data breaches, says GlobalData

Ski-Doo maker BRP resumes operations following cyber attack; shares fluctuate (MarketWatch) BRP has not revealed specific details of the cyber assault, but a cybersecurity expert thinks it could be a ransomware attack.

Twilio attacker 'explicitly' looked for 3 Signal numbers (Register) Bad guy also got SMS verification codes, and re-registered one of the numbers they searched for

1,900 Signal users exposed following Twilio breach - Help Net Security (Help Net Security) The attacker who pulled off the Twilio breach may have accessed phone numbers and SMS registration codes for 1,900 Signal users.

Twilio Incident: What Signal Users Need to Know (Signal) Recently Twilio, the company that provides Signal with phone number verification services, suffered a phishing attack. Here's what our users need to know:

Thomas More University hacked in multiple ways after cyber attack on Facebook account (WLWT) A local university was hit with a cyberattack that has left it with embarrassing and inappropriate pictures on their social media account that they can’t take down.

Trends

Egnyte AEC Data Insights Report Shows Rapid Increase in Data Storage and Signals Potential Challenges (Egnyte) Egnyte, the most secure platform for content collaboration and governance, today released its AEC Data Insights Report. The study is based on an analysis of data trends among more than 3,000 customers in the Architecture, Engineering, and Construction (AEC) industry, which has experienced exploding growth in data volume and usage. On average, Egnyte’s AEC customers increased storage by 31.2 percent compound annual growth rate (CAGR) from 2017 to 2021.

The Digital Trust Index - Callsign (Callsign) Conducted by Cebr, this Callsign-commissioned report quantifies the true value of digital trust, and the relationship between trust in the digital and physical realms.

Hybrid working: How cyber secure are accountancy firms? (Accountancy Age) The pandemic has severely compromised cybersecurity around the world, and this is a problem that businesses of all sizes now face

Marketplace

Coalition Completes Acquisition of Insurance Carrier With Licenses In All 50 States (PR Newswire) Coalition, the world's first Active Insurance provider designed to prevent digital risk before it strikes, announced today that it has received...

Coalition to Now Offer Cyber Policies With Acquisition of Admitted Carrier (Insurance Journal) Coalition said it received regulatory approval and completed the acquisition of Digital Affect Insurance Company from Munich Re Digital Partners US

BackBox Reinforces Focus on Network Security Automation with Launch of Managed Service Provider Program and Key Executive Hires (BackBox Software) BackBox announced two key executive hires and the launch of a formal Managed Service Provider (MSP) and Managed Security Services Provider (MSSP) Program.

Contrast Security Makes Its Debut on the Inc. 5000 List of America’s Fastest Growing Companies (Contrast Security) Leading code and application security provider achieves three-year revenue growth of 157%, doubles global headcount, expands executive leadership team and rolls out new product offerings.

Cybersecurity firm Darktrace confirms talks with private equity firm Thoma Bravo (CRN Australia) Confirms it was in early stages of discussions.

Thoma Bravo is holding talks to acquire cybersecurity firm Darktrace (SiliconANGLE) Thoma Bravo is holding talks to acquire cybersecurity firm Darktrace - SiliconANGLE

Torch.AI wins Pentagon ‘insider threat’ cybersecurity contract (C4ISRNet) The Pentagon will use the software as part of its System for Insider Threat Hindrance, or “SITH,” in another apparent military reference to Star Wars.

Tanium Expands Collaboration with Microsoft as It Joins the Microsoft Intelligent Security Association (MISA) (Tanium)  Tanium joins the Microsoft Intelligent Security Association (MISA), an ecosystem of independent software vendors and managed security service providers (MSSPs) that have integrated their solutions with Microsoft security technology to help customers better defend themselves against increasingly sophisticated cyber threats.

Forescout names Nextgen as sole ANZ distie (CRN Australia) Replacing Westcon-Comstor.

Google Boosts Bug Bounty Rewards for Linux Kernel Vulnerabilities (SecurityWeek) Google is offering up to $130,000 rewards for vulnerabilities in the latest Linux kernel that bypass certain mitigations.

BitSight Appoints Catherine Harrell as Chief Marketing Officer (PR Newswire) BitSight, the Standard in Security Ratings, today announced it has appointed Catherine Harrell as Chief Marketing Officer (CMO). Catherine...

Products, Services, and Solutions

Celebrus Releases World’s First No-Party Data Technology (PRWeb) Today, Celebrus releases the world’s first no-party data technology. Celebrus CX Vault will allow customers to keep their informa

Trend Micro : Fast-Tracks Industrial IoT Security with Schneider Electric Partnership | MarketScreener (SURPERFORMANCE) DALLAS, August 15, 2022 - Trend Micro Incorporated , a global cybersecurity leader, today announced another landmark in its continued drive to secure Industry 4.0 and industrial IoT projects... | August 16, 2022

Teneo Boosts its Security Portfolio with Akamai Guardicore Segmentation (Fast Mode) Teneo, the IT services company, has announced that it is strengthening its security portfolio with Akamai Guardicore Segmentation

Huntress Launches New Managed Endpoint Detection & Response Capabilities, Strengthening its Position as the Leading Security Platform for the 99% (GlobeNewswire News Room) The company’s new Process Insights feature—backed by its global 24/7 threat hunting team—enables teams to identify, isolate and remediate active...

Veracode Unveils Velocity Partner Program™ (Veracode) Veracode, a leading global provider of application security testing solutions, today announced the launch of the Veracode Velocity Partner Program. The objective of the program is to enable partners to grow their security practice quickly and profitably around Veracode’s cloud-native Continuous Software Security Platform, offering opportunities to accelerate deal closure, expand market share, and grow revenue.

Cerby Announces Successful Completion of SOC 2 Type II Security Audit (Business Wire) Cerby completed a System and Organization Controls 2 Type II audit, demonstrating its priority for security controls and customer data protection.

Technologies, Techniques, and Standards

New Report Reveals Fraud Management Is Vital to the Business Strategy of Most Organizations (GlobeNewswire News Room) Companies are most concerned about account takeover, phishing, new account fraud and fake users, according to study sponsored by Telesign...

A tale of two breaches: Comparing Twilio and Slack’s responses (Avast) We recently learned about major security breaches at Twilio and Slack. The manner in which these two organizations responded is instructive.

Academia

CMU Hacking Team Wins Super Bowl of Hacking for 6th Time (Carnegie Mellon University) A Carnegie Mellon University team won DEF CON's Capture the Flag competition, the "Super Bowl of hacking," for the sixth time.

Legislation, Policy, and Regulation

Editorial | Israel Tightly Oversees the Weapons It Exports. It Should Do the Same for Spyware (Haaretz) The head of Greece’s National Intelligence Service resigned last week following yet another political scandal involving Israeli surveillance software.

Inglis: People, companies need to replicate collective cyber defense seen in Ukraine (The Record by Recorded Future) U.S. Cyber Director Chris Inglis said the cyberdefense tactics used in Ukraine by residents, government agencies and companies is something the U.S. needs to replicate going forward.

Cyberspace Solarium Co-Chairs Call For HHS Briefing on Healthcare Cybersecurity (Health IT Security) In a letter to HHS Secretary Becerra, Senator Angus King and Representative Mike Gallagher urged HHS to disclose the current status of healthcare cybersecurity efforts.

Surprise, kill, vanish: ‘Jedburghs’ led way for US cyber, special ops (Defense News) WWII's "Jedburghs" show how an unconventional take on cross-functional partnerships can operate effectively in politically sensitive environment.

Litigation, Investigation, and Law Enforcement

Spyware Scandals Are Ripping Through Europe (Wired) The latest crisis that rocked the Greek government shows the bloc’s surveillance problem goes beyond the notorious NSO Group.

NSO Group Finally Figures Out How Many European Countries It Does Business With (Techdirt) European lawmakers wanted answers after months of investigations and reporting made it clear exploit developer NSO Group was involved with some seriously shady customers. Facing lawsuits, sanctions…

Pompeo sued for CIA surveillance of Assange that swept up Americans' data. (Newsweek) Lawsuit: CIA spying on Wikileaks founder included illegal taping of conversations with US lawyers, journalists and doctors, and copying data from their phones.

Cisco Gets Email Security Patent Tossed Amid Infringement Suit (Bloomberg Law) Cisco Systems Inc. succeeded Friday in getting most of a competitor’s patent for email security systems thrown out at an administrative tribunal, invalidating one of two patents asserted against it in a federal district court infringement case.

Capital One Data Breach Settlement: Who Is Eligible for a Payment and How Much Could They Get? (CNET) Customers can collect up to $25,000, according to a preliminary settlement.

https://topclassactions.com/lawsuit-settlements/privacy/data-breach/florida-orthopaedic-institute-data-breach-4m-class-action-settlement/ ()

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Aug 15 - 19, 2022) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps.

Insider Threat Program Development - Management Training Course (Sterling, Virginia, USA, Aug 22 - 23, 2022) This affordable, comprehensive and extremely resourceful 2 day training course will ensure the Insider Threat Program (ITP) Manager, Facilities Security Officer, Insider Threat Analyst, and others who support the ITP (CSO, CIO, CISO, IT, Network Security, Human Resources, Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing or enhancing an ITP / Working Group. Our student satisfaction levels are in the exceptional range. Over 875+ individuals have attended this training course and received ITP Manager Certificates. The class has 2 additional instructors who are the former ITP Managers for CIA and NSA.

Insider Threat Program Development - Management (Virtual, Aug 22 - 23, 2022) This affordable, comprehensive and extremely resourceful 1 day WEB BASED training course will ensure the Insider Threat Program (ITP) Manager, Senior Official, Facilities Security Officer, Insider Threat Analyst, and others who support the ITP (CSO, CIO, CISO, IT, Network Security, Human Resources, Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing or enhancing an ITP / Working Group. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates. CLASS DATES: August 22 & 23 (Training Taught In 2 / 4 Hour Sessions On Different Dates).

SANS 2022 Cloud Security Exchange (Virtual, Aug 25, 2022) SANS Institute, the global leader in cybersecurity training and certifications, today announced it would be hosting its first SANS 2022 Cloud Security Exchange live online event, which will take place on August 25, 2022 at 11:00am EDT. The Cloud Security Exchange brings technical security leaders from Google Cloud Platform (GCP) and Microsoft Azure together in one forum to share their perspectives on building cloud security programs and best practices on crucial security pillars. As more organizations embrace digital transformation, security operations and architecture teams are facing new challenges.

13th Annual Billington Cybersecurity Summit (Washington, DC, USA, Sep 7 - 9, 2022) The world's leading government summit on cybersecurity will continue its unique educational mission of convening the who's who in cybersecurity: the senior leadership from the U.S. government, our allied partners, and their industry and academic partners. Given the fast moving strategic direction that the Biden Administration has generated over the past year, this event will take a holistic view of the cybersecurity business with a hearty dose of topics covering Zero Trust, proactive cyber defense measures, partnership building, offensive cyber, and a continued look at what the future will bring to the cybersecurity mission. Once again, Billington will play host to the Federal Government's most senior cyber and IT managers and experts, some of the most innovative cybersecurity providers in the business, and a broad range of expertise from across the public and private sectors. Like the past Billington events, we expect groundbreaking news and a content rich discussion focused on lessons learned, best practices, and things to consider as you build and enhance your own cybersecurity programs.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.