When the average ransomware payment is over $900k, one might expect a degree of organization among cybercriminals to handle that kind of cash. What might not be expected: an arrangement that resembles your office—complete with HR and an employee-of-the-month award.

A March 2022 report from the cybersecurity services provider Check Point revealed the inner workings of the Conti ransomware group. Leaks showed that Conti—an active crew in the first half of 2022—handled their affairs with familiar corporate features, including a hiring process, salaries, and bonuses.

The office-like approach demonstrates that ransomware has become a professional, team-coordinated enterprise—one that supports malicious hackers with easier-than-ever ways of deploying attacks.

Read more here.—BH

Do you work in IT or have information about your IT department you want to share? Email [email protected].

The vast majority of US defense contractors are failing to meet bare-minimum cybersecurity requirements imposed five years ago, according to a Merrill poll commissioned by managed security provider CyberSheath.

The 2017 Defense Federal Acquisition Regulation Supplement (DFARS) considers a contractor to be in perfect compliance with the federal government’s cybersecurity expectations if they have a score of 110 on a scale called the Supplier Performance Risk System (SPRS). Virtually none of them are even close, the poll of 300 Department of Defense contractors found.

In fact, less than 13% reported an SPRS score of 70 or above. That’s the number the company says is commonly referred to within the industry as “good enough.” The average score was −23 out of a lowest possible rating of −203, presenting “significant opportunity for improvement.”

According to the survey, defense contractors have failed to implement basic standards. A sampling:

• 30% have security information and event management (SIEM)
• 27% have an endpoint detection response solution (EDR)
• 20% have a vulnerability management solution
• 21% have multi-factor authentication (MFA)

It should go without saying that the defense sector is one of the top targets for hacking campaigns.

“The world’s largest supply chain—that is, defense contractors supporting the Department of Defense—is largely noncompliant with their mandatory cybersecurity requirements,” CyberSheath CEO Eric Noonan told IT Brew.

Keep reading here.—TM

Do you work in IT or have information about your IT department you want to share? Email [email protected]. Want to go encrypted? Ask Tom for his Signal.

Today’s top IT reads.

Stat: 78%. That’s the percentage of business leaders who plan to invest in tech for their companies next year. (IBM)

Quote: “They knew my name before I told them...And they told me I was not allowed to be there.”—the mother of a Girl Scout who was escorted from a Rockettes Christmas show after being recognized by facial recognition software as working at a law firm “pursing active litigation” against the owner of Radio City Music Hall, Madison Square Garden Entertainment (NBC New York)

Read: This is what happens when ChatGPT writes your AP English assignment. (the Wall Street Journal)