Threat Source newsletter (July 28, 2022) — What constitutes an "entry-level" job in cybersecurity?

2022-07-2818:00:00

Jon Munshaw ([email protected])

blog.talosintelligence.com

JSON

_By Jon Munshaw. _

Welcome to this week’s edition of the Threat Source newsletter.

Between the White House’s recent meeting, countless conference talks and report after report warning of cybersecurity burnout, there’s been a ton of talk recently around the cybersecurity skills gap and hiring.

Everyone wants to know the magic ticket to figure out how to increase hiring at their cybersecurity practice without hiring somehow with under-developed skills that could leave clients open to attack. This is not a problem exclusive to cybersecurity, but I do find it interesting that there’s been so much talk about the problems the cybersecurity workforce faces and not much about actual solutions.

I think a good place to start would change the meaning of what an “entry-level” position truly is in security. I came into this field with zero security experience from the domain of journalism. My family considered me to be “a computer guy” just because I was good at searching the internet for public information as a journalist. Granted, I’m no security expert four years into this, but between internal mentorships and educational support outside of the company, I can at least write a basic ClamAV signature and could talk to a CEO about the difference between ransomware and business email compromise. Imagine what someone who at least knew what Kali Linux was before their first day could do with that same amount of time.

I decided to go on LinkedIn and search for “entry-level” cybersecurity roles by literally clicking a box in the search function. Granted, this could be the LinkedIn algorithm serving me jobs that would be best suited for me based on my level of experience, but I found countless “entry-level” openings that I would not be qualified for based on the qualifications listed in the posting. Even if someone were to apply and still get an interview, who’s to say someone with less experience wouldn’t be deterred from applying in the first place by feeling they were under-qualified?

One listing (I’m not naming any names) was for an “entry-level” cybersecurity analyst at a mid-size firm. The top requirement was that the candidate has “three-plus years of experience analyzing general cybersecurity-related technical problems" and a bachelor’s degree in “cybersecurity or a related field” and it would be “nice if you have” a master’s degree and several different certifications.

Another analyst role didn’t ask for a specific number of years’ worth of experience, but it did say the ideal candidate needs:

Strong experience administering endpoint protection.
Strong experience managing email security products.
Familiarity with incident response procedures, identity management and multi-factor authentication.

I’d be willing to bet there are folks who have years of experience at Talos who don’t have “strong experience” with all of those fields listed above. And I’ve met team members who didn’t go to college for security — they may have started out in the military or a totally different field before pivoting to security.

I’m not saying we should let just anyone manage a SOC team for a Fortune 500 company. But if we’re going to build up the next generation of defenders, we do need to widen the scope of what it means to be at the entry-level of cybersecurity. I would encourage hiring managers to take chances on people who don’t have a “traditional” security background and be willing to invest time and money into training employees who are keen and willing but may not have the exact certifications, which can always come later.

If every “entry-level” job requires years of experience, how is anyone ever actually supposed to get their first job in security? And don’t say “pay your dues at unpaid internships.”

The one big thing

Since the Russian invasion of Ukraine began, Ukrainians have been under a nearly constant barrage of cyber attacks. Working jointly with Ukrainian organizations, Cisco Talos has discovered a fairly uncommon piece of malware targeting Ukraine — the GoMet backdoor — this time aimed at a large software development company whose software is used in various state organizations within Ukraine. As this firm is involved in software development, we cannot ignore the possibility that the perpetrating threat actor’s intent was to gain access to source a supply chain-style attack, though at this time we do not have any evidence that they were successful.

> ### Why do I care?
>
> I shouldn’t have to tell you why you should care about Ukraine. But if anything, this attack shows that even though public discussion around the war and follow-on cyber attacks has waned, the threat isn’t going anywhere.
>
> ### So now what?
>
> In this instance, we saw a software company targeted with a backdoor designed for additional persistent access. This access could be leveraged in a variety of ways, including deeper access or launching additional attacks, including the potential for software supply chain compromise. It’s a reminder that although the cyber activities haven’t necessarily risen to the level many have expected, Ukraine is still facing a well-funded, determined adversary that can inflict damage in a variety of ways — this is just the latest example of those attempts. As always, Talos continually updates our coverage around the threats Ukraine faces and appropriate Cisco Secure protections.

>
>

Other news of note

Spyware continues to be a top threat for government officials, politicians and activists. The European Union recently found the NSO Group’s Pegasus spyware installed on several employees’ mobile devices. Apple initially alerted the EU that the devices had indicators of compromise related to the spyware. This led the European Commission to reach out to Israel, asking the country to "prevent the misuse of their products in the EU.” Meanwhile, the Canadian Parliament is investigating if the national police force uses Pegasus as part of its surveillance operations. Previously, the RCMP said it only used Pegasus in severe cases, deploying it 10 times between 2018 and 2020. (Reuters, Politico)

An attacker claims to have stolen data from more than 5.4 million Twitter users and is selling it on the dark web for $30,000. The seller using the username “devil” claims the data includes “Celebrities, to Companies, randoms, OGs, etc.” Twitter said it launched an investigation to verify the authenticity of the data and notify any users whose accounts may have been affected. The attacker exploited a vulnerability that was reported to Twitter several months ago through its bug bounty program and has since been fixed. Breached Forums, where the data is listed for sale, is the same site where an attacker leaked 23 TB of data from 1 billion Chinese citizens earlier this year. (Fortune, The Register)

A new malware tool broker known as “Knotweed” has been outed as the source of several spyware attacks and zero-day exploits against Microsoft and Adobe products. Microsoft stated in a new report that it believes the group is “linked to the development and attempted sale of a malware toolset called Subzero, which enables customers to hack into their targets’ computers, phones, network infrastructure and internet-connected devices.” Some of the exploits the group sold were recently used in cyber attacks against Austria, Panama and the U.K. (Microsoft, Dark Reading)

Can’t get enough Talos?

Upcoming events where you can find Talos

BlackHat**U.S. **(Aug. 6 - 11, 2022)
Las Vegas, Nevada

DEF CON U.S.(Aug. 11 - 14, 2022)
Las Vegas, Nevada

Security Insights 101 Knowledge Series (Aug. 25, 2022)

Virtual

Most prevalent malware files from Talos telemetry over the past week

SHA 256:9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507

**MD5:**2915b3f8b703eb744fc54c81f4a9c67f

**Typical Filename:**VID001.exe ** **

Claimed Product: N/A** **

**Detection Name:**Win.Worm.Coinminer::1201

SHA 256:e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934** ****MD5:**93fefc3e88ffb78abb36365fa5cf857c ** ****Typical Filename:**Wextract
**Claimed Product:**Internet Explorer
**Detection Name:**PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg

SHA 256:e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c ** **

MD5: a087b2e6ec57b08c0d0750c60f96a74c

**Typical Filename:**AAct.exe ** **

Claimed Product: N/A** **

**Detection Name:PUA.Win.Tool.Kmsauto::1201 **

SHA 256:a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91** **

**MD5:7bdbd180c081fa63ca94f9c22c457376 **

**Typical Filename:**c0dwjdi6a.dll

**Claimed Product:N/A **

**Detection Name:**Trojan.GenericKD.33515991

SHA 256:125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645 ** **

**MD5:**2c8ea737a232fd03ab80db672d50a17a