Gemma Lofthouse’s Post

Screening and vetting candidates during the HR recruiting process is crucial for protecting companies from potential threats such as hacking, espionage, and other malicious activities. This process involves thorough background checks, verification of credentials, and assessment of a candidate's suitability for the role and organizational culture. Effective screening helps identify red flags, such as false credentials or criminal history, which could pose significant risks to the company's security and reputation. By ensuring that only qualified and trustworthy individuals are hired, companies can mitigate the risk of internal fraud, data breaches, and other security threats, thereby safeguarding their assets and maintaining a secure and productive work environment. Additionally, a robust screening process enhances overall team performance and morale by ensuring that new hires are competent and aligned with the company's values and goals. https://lnkd.in/ehg6EBqT #knowbe4 #vetting #hiring #cybersecurity #spy

This takes 'insider threat' to a whole different level. Can you imagine accidentally hiring a hacker and sending them a laptop with credentials to access your systems! 💻 I do feel for the HR team caught up in this but it really emphasises how important security processes and awareness are in every team, and in every role - not just in IT and security teams. For HR teams, they should be looking at the policy and processes for hiring staff, including background checks, verified identity, and provide regular training and awareness for HR staff. It also underscores the need for role-based access controls, restricted admin privileges, and of course, 24/7 monitoring for suspicious activity. At Cyber GC we provide role-based training for non-technical teams (like HR, legal, admin etc) so they can identify the aspects of their roles that have a cybersecurity responsibility, and change the way they work so that they, and their organisations, are more secure. Thanks for the article David Hollingworth - a great read on Cyber Daily as usual! #securityiseveryonesjob #cybersecurity #hacker

Anyone else in the Aussie recruitment game feeling like they're constantly dodging cyber threats? New data breaches seem to be popping up daily (looking at you Medibank ), and the NDB scheme keeps us on our toes (who wants a hefty fine, amirite?). Here's the real struggle: keeping candidate and client data safe while juggling a million other things. Been there, done that: 1. Ever clicked on a suspicious email link because you were swamped with applications? 2. Totally forgotten to update your password for the 100th time (it's a struggle, okay!) 3. Worried about a third-party vendor you use having dodgy security? We're all in this together! Let's share some tips in the comments: What data security tools are your recruitment besties using? ️ How do you keep your team on top of phishing scams and password hygiene? Any advice for managing cybersecurity risks with third-party vendors? Let's build a secure recruitment community where talent can connect with confidence! #cybersecuritystruggles #aussierecruiters #databreachblues #arcon

#cybersecurity alert: #Hiring IT software personnel remotely? Check out this article for crucial tips to avoid hiring a #hacker. The attacker in this incident used elaborate tactics - from a stolen identity including leftover credentials from previous browser sessions, to #AI-generated profile pictures during interview video calls. Tricky schemes like using VPNs to mimic same working hours, and 'IT mule laptop farm" to fake an address, were employed. #remoteworking #employment #leadership https://lnkd.in/gF6BnsWX

Cybersecurity careers & salaries: From ethical hacker to architect Cybersecurity professionals protect an organization’s data from theft and unauthorized access. Here are eight different jobs in the field and what they can pay. https://lnkd.in/erGbDKBE

Job Board Breach: Hackers Swipe Millions of Resumes & Personal Data!" Since early 2023, a new cyber threat, ResumeLooters, has been compromising job search platforms in the Asia-Pacific region, aiming to pilfer sensitive data. Group-IB reports that this hacking group targeted employment agencies and retail companies, breaching around 65 websites from November to December 2023 and stealing over 2 million user records, including detailed personal and employment information. The attackers utilized SQL injection techniques to extract databases full of personal data, which they later sold on Telegram channels. Additionally, the group exploited cross-site scripting (XSS) vulnerabilities on legitimate job sites to launch phishing attacks. With a focus on financial gains, ResumeLooters has demonstrated the persistent risk and impact of SQL attacks and the continuous threat to digital security posed by such cyber criminals. Their activities underscore the critical need for robust security and database management practices to defend against sophisticated hacking strategies. #cybersecurity #infosec #databreach #cybercrime #clouddfn

The risks of hiring in the age of AI and Cyber Threats: KnowBe4, a US-based security awareness training company, recently revealed that a North Korean hacker had successfully infiltrated their hiring process, posing as a legitimate software engineer. This individual, armed with a stolen identity and an AI-generated image, managed to bypass multiple layers of scrutiny, including background checks, reference checks, and four rounds of interviews, before being offered the position. The hacker’s ploy was meticulously planned. By constructing a convincing persona, they seamlessly integrated into KnowBe4’s hiring pipeline, even receiving company equipment. It wasn’t until the hacker began to load malware onto the device that the company’s security operations team detected something was wrong. A routine security audit revealed suspicious activity, leading to an investigation that unmasked the hacker’s true identity. Swift action was taken—access was immediately revoked, and the breach was reported to authorities. Although the infiltration attempt was unsuccessful, the incident served as a critical wake-up call for KnowBe4, prompting an internal review and emphasizing the need for more robust vetting processes. This event is far from an isolated case. The lessons from KnowBe4’s close call are clear: vigilance, advanced verification, and a holistic approach to security are vital. In a world where even the most innocuous job applicant might be a potential threat, businesses must be prepared to safeguard their operations from the inside out. Our Blog - Common Cyber Security Risks Faced by Small Businesses and How to Mitigate Them - addresses some of the most common issues posed by 'Insider Threats' in more detail, in Section 6: https://lnkd.in/e2yR4CCK #cybersecurity #hacker #AI #AIthreats #remoterecruitment #insiderthreats

Most people know about phishing, but here's a new twist in cyber threats: Ever thought your new hire might not be who they claim? KnowBe4 (a major security awareness vendor and one of the last places you'd think this would pass), revealed that a North Korean agent posed as a legitimate IT worker, using AI-generated photos and passing video interviews to nearly breach their system. Fortunately they caught the insider threat just in time but this just goes to show that even companies where security is not only top priority but their actull buisness model are at risk. We often tend to forget about State-Sponsored threats but as we can see it's a real thing and the recruting process at companies is one of the most overlooked parts in terms of security. KnowBe4 have included the following takeaways on how to avoid this: TIPS TO PREVENT THIS  - Scan your remote devices, to make sure no one remotes into those. - Better vetting, making sure that they are physically where they are supposed to be. - Better resume scanning for career inconsistencies. - Get these people on video camera and ask them about the work they are doing. - The laptop's shipping address different from where they are supposed to live/work is a red flag. WHAT TO LOOK OUT FOR: - Use of VOIP numbers and lack of digital footprint for provided contact - information - Discrepancies in address and date of birth across different sources - Conflicting personal information (marital status, "family emergencies" explaining unavailability) - Sophisticated use of VPNs or VMs for accessing company systems - Attempt to execute malware and subsequent cover-up efforts I reccomend reading the whole post on their website: https://lnkd.in/ddr5Enas

#hiring *Network Based Systems Analyst II with Security Clearance*, Arlington, *United States*, fulltime #opentowork #jobs #jobseekers #careers #Arlingtonjobs #Virginiajobs #ITCommunications *To Apply -->*: https://lnkd.in/dbzf5Zdu Our Arlington VA based client is looking for Network Based Systems Analyst II. If you are qualified for this position, please email your updated resume in word format to Provides remote and onsite advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation and resolution using host-based, network-based and cloud-based cybersecurity analysis capabilities. Team personnel provide front line response for digital forensics/incident response (DFIR) and proactively hunting for malicious cyber activity. We are seeking Cyber Network Defense Analysts (CNDA) to support this critical customer mission. The CDNA uses information collected from a variety of sources to monitor network activity and analyze it for evidence of suspicious behavior. Monitoring and analysis are performed to identify and report events that occur, or might occur, within the network, in order to protect information, information systems, and networks from threats. Responsibilities:- Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources- Coordinate with enterprise-wide cyber defense staff to validate network alerts- Document and escalate incidents (including event's history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment- Perform cyber defense trend analysis and reporting- Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack- Provide daily summary reports of network events and activity relevant to cyber defense practices- Receive and analyze network alerts from various sources within the enterprise and determine possible causes of alerts- Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities- Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity- Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information- Identify and analyze anomalies in network traffic using metadata- Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools- Identify applications and operating systems of a network device based on network traffic - Reconstruct a malicious attack or activity based off network traffic- Identify network mapping and operating system (OS) fingerprinting activiti

What a crazy blog post by the folks at KnowBe4 They hired an IT guy who turned out to be a North Korean agent! I don't want to spoil it for you - the link is below. I have shared this with my clients' #HR departments. Please also share with your HR folks and see where there may be gaps in your #recruitment process. This is important in any organization, but especially if you are #critical #infrastructure #Cybersecurity