A fraudster who tricked and threatened thousands of Spanish-speaking immigrants into paying for educational products has been sentenced to 110 months in prison in the United States.

Peruvian national and call center owner Henrry Adrian Milla Campuzano was part of a conspiracy to defraud victims using false statements and the threat of deportation or legal action in a non-existent “minor crimes court.”

Milla Campuzano, a 37-year-old resident of Lima, owned and operated two call centers in Peru, the Latinos en Accion and Accion Latino. He admitted that from April 2011 until his arrest in July 2019, he and his employees contacted victims via phone and falsely claimed to be lawyers, court officials, federal agents, and minor crimes court representatives.

Victims were erroneously informed that they were required to accept and pay for English-language courses and other educational products that were never delivered.

The conspirators didn’t stop at targeting the victims, but also contacted their family members and friends and fraudulently threatened them with legal consequences if they did not make payments.

Threats used against the victims included court proceedings, negative marks on their credit reports, imprisonment, and immigration consequences.

Milla Campuzano is the sixth individual to plead guilty to involvement in this conspiracy and to receive a lengthy prison term. He and four co-defendants were extradited to the Southern District of Florida in October 2020. 

Jerson Renteria was sentenced to 100 months in prison, and Fernan Huerta, Omar Cuzcano, and Evelyng Milla were each sentenced to serve 90 months in prison.

California resident Angel Armando Adrianzen, who teamed up with the call centers in Peru to run the telemarketing scam, was sentenced in May to serve 121 months in prison followed by fifteen years’ supervised release.

Two additional defendants in the case – Carlos Espinoza Huerta and Josmell Espinoza Huerta – were extradited from Peru to the United States on June 25 and are due to be tried in Florida in February. 

Acting US Attorney Juan Antonio Gonzalez for the Southern District of Florida said: “We will continue to bring American justice to transnational criminals who use fear tactics and intimidation to steal money from immigrants, seniors and others who live in this country.”  

Organizations that spent heavily on digital transformation during the pandemic will need two years’ worth of investment to mitigate the resulting security gaps, according to a new report from Veritas.

To compile its latest report, The Vulnerability Lag, the data security vendor polled over 2000 senior IT decision-makers across EMEA, APAC and the US from organizations with at least $100m in revenue.

It found that security (51%) and cloud (56%) are the top two areas in which capability gaps expose these large enterprises to attack.

Respondents claimed they’d need to spend $2.5m on average and hire 27 full-time IT employees to close these gaps within the next 12 months.

The report predicted that it will take firms, on average, two years to eliminate the current vulnerabilities in digital systems, which represent a significant risk to their organization today.

There’s an urgency to them doing so: Veritas claimed the average responding organization had experienced 2.57 ransomware attacks that led to downtime in the past 12 months, while 14% have been hit five times or more.

Organizations with at least one gap in their technology strategy have, on average, experienced five times more ransomware attacks leading to downtime in the past year versus those with no gaps, it added.

Some two-fifths (39%) of respondents claimed that security measures had not kept pace with new digital transformation initiatives prompted by the pandemic. The report claimed that part of the challenge is understanding exactly what technology has been introduced and what needs to be protected.

Douglas Murray, CEO at Valtix, argued that protecting cloud infrastructure and data is particularly challenging, especially in a world where organizations are investing in technology from multiple platform providers.

“The good news is that it inevitably always comes back to the best practices of defense-in-depth and ensuring that the right security controls and policy are deployed against every cloud workload,” he added.

“There are a variety of technologies that can help reduce ransomware risk in the cloud, including network-based intrusion prevention, anti-virus and the segmentation of workloads. By taking a cloud-first approach to these problems, security leaders can set the stage for the future through a cloud-native, multi-cloud security architecture.”

International information security accreditation and certification body CREST has appointed Rowland Johnson as its new President.

Johnson will take over from Ian Glover, who retired as President of CREST on September 1 after nearly 13 years in the post. This will be for an initial term of one year.

Johnson was previously a member of the CREST GB Executive from 2014–2020 and is credited with playing a major part in the non-profit organization’s development in Singapore and America. Therefore, he is viewed as the ideal candidate to lead the body over the next 12 months. His appointment was unanimously approved by the CREST GB Executive and CREST’s regional Advisory Boards in the USA, Australia and Southeast Asia.

Johnson is also renowned for his role as a founding director at cybersecurity firm Nettitude, where he oversaw its acquisition by Lloyd’s Register in 2018.

A CREST senior management team comprising Elaine Luck, operations manager, Samantha Alexander, principal accreditor and Richard Beddow, CREST’s financial controller, will now support Johnson during the transition period. In addition, former President Glover will continue supporting CREST projects internationally until December 1.

Commenting on his appointment, Johnson said: “I feel hugely privileged by the support from CREST’s elected members and regional chairs for my appointment to this prestigious role. I will be working closely with Ian and the whole of the CREST team to ensure that the transition is as seamless as possible for CREST members and for everyone we work with across the industry, governments, regulators and academia.

“It is important that members are always right at the heart of everything CREST does and we will be focusing on providing greater support and encouraging closer collaboration, helping us to take things forward so that we are able to build on Ian’s legacy. He leaves CREST in a very strong position.”

Glover stated: “Having worked closely with Rowland for six years while he was a member of the CREST GB Executive, I am delighted that he is taking up the President’s role.

“During my time with CREST I hope I have helped organizations to mature and grow and encouraged individuals to enter and thrive in an increasingly professional industry, and I am confident it will also be Rowland’s mission to carry on this work.”

Last week, Infosecurity reported on the conclusion of CREST’s year-long investigation into NCC Group’s exam leak scandal.

Cybersecurity professionals need to shoot for the stars and overcome self-confidence issues to progress in their careers. That was the message of an illuminating keynote address by Alyssa Miller, business information security officer, SMP Global, while giving the keynote address at the Infosecurity Magazine Autumn Online Summit – North America 2021.

Miller began by describing her own career to date, and how she reached the heights of business information security officer at SMP Global, where she leads the cybersecurity strategy for a $4bn a year division.

Her career in information security began at 19 as a programmer at a fintech firm, while she was still studying computer science at university. She stayed at the firm for almost nine years, holding a range of high-profile positions.

At 28, Miller was approached to become a penetration tester; while she was concerned she had no prior knowledge of penetration testing, she was assured she would be able to figure it out. This leap worked, as by the age of 31 Miller was leading a team alongside the entire testing and vulnerability management program for a 35,000 employee company. Despite these achievements, Miller continued to consider her progression as mainly luck. “I never really considered how impressive some of that was,” she explained.

Four years later, at the age of 35, Miller entered the world of consultancy in an application security practice. As the least profitable practice at the consultancy, she was tasked with building a team from the ground up and alongside colleagues, made that team the most profitable in the entire practice, achieving revenue growth of 400%. However, “I never really gave myself a lot of credit for that,” she reflected. 

Following a merger, Miller became head of a program services practice of a new consulting services firm at the age of 37, where she worked with high-ranking security leaders like CIOs and CISOs in major global organizations. Again, Miller largely put this down to “serendipity.”  

Then, a setback occurred at the age of 41 while working for a security consulting organization as part of a larger security practice at a reseller. She was passed over for promotion to director despite being the pick of the previous director. “It really harmed my self-confidence. I felt like I’d shot too high, maybe I wasn’t ready for that high level of a role,” she outlined.

This led her to re-evaluating her goal of progressing in high-level security positions, and she moved into a ‘contributor’ role, focusing on public speaking and advocacy work.

Her perspective changed when she was approached by one of the three big social media companies, who asked if she’d like to be considered for an executive position. While nobody was ultimately hired for that role, just being considered “forced me to go back and look at everything I’d done and ask ‘why did they choose me?’” This made her analyze the extent of her achievements “and it really built up my self-confidence.”

This new found confidence took Miller to her current high-profile position, as BISO for SMP Global. “This is a chance now to do all those things I’ve been working towards all my life — what an exciting position to be in,” she said, adding: “I’d never have gotten here if I’d been afraid to take that leap, if I’d let that damage to my self-confidence hold me back.”

Miller believes that getting over self-confidence issues is therefore key to progressing security careers, especially for women, who she believes continue to experience numerous disadvantages in the workplace. This includes being expected to give up their careers for their families.

With this in mind, Miller gave the following advice to those keen to develop in their careers:

• Overcome “imposter syndrome” — the fear of being ‘found out’ in a role is “universally experienced,” particularly in tech. Therefore, it is worth remembering that there is a wide domain of cybersecurity knowledge that is around, meaning each person brings their own unique diverse perspective to the table. “Nobody knows it all,” Miller pointed out.
• Look at job descriptions differently — Miller said that in cyber, many job descriptions “stink,” setting out experiences, requirements and responsibilities that are simply unrealistic. She gave one example of a job description that required 10 years of experience of Kubernetes, even though it has only existed for six. However, she advised potential candidates to not be put off “as no-one can check off all those boxes,” and instead look at the high level job description and ask themselves “is this something you can do or something you can learn to do?”
• Know your worth — Potential employers should never ask you what your current salary is, and if they do, you should turn the question round and tell them what you expect to be paid or even what they expect to pay someone to do that job, Miller advised. She added that you can look on sites like LinkedIn and Glassdoor to give yourself a better idea of what kind of salary you should be earning for the position you are applying for. This way, you can ensure you will be paid what you are worth to that organization.
• Get a mentor — Miller also advised people to get a mentor to help guide them on their career journey. Rather than focusing on learning job skills, the mentor “should be sharing their journey, and be that person to help [with] situations you’re experiencing that you need help understanding or navigating.” This relationship is best forged “organically” via people met at work or at conferences.
• See denials differently — People need to ensure they do not lose confidence if they are not offered a job after attending an interview, said Miller. The decision is never a personal one, and it might just be that “there was something about that role that wasn’t right for you.” She added that it is always worth asking for feedback from the hiring manager about what they could have done differently with their resume or during the interview. “You can use these denials as an opportunity to grow and learn, to understand how a certain position might not be the right fit for you.”
• Negotiate the job offer — It is also important to understand that any job offer you do receive is negotiable, and don’t be afraid the company will rescind the offer if you do try and negotiate the terms of the deal. This is something that recruiters expect, noted Miller. This negotiation doesn’t just have to revolve around salary either, and can include aspects like bonuses and annual leave. “Always be willing ask, don’t be afraid,” she said.

Miller concluded by saying: “Shoot for those heights – just because you shoot high doesn’t mean that you have a chance of falling.”

Business executives in the United States favor retaliatory action over diplomacy when it comes to preventing cyber-attacks. 

A day after American president Joe Biden announced his intention to replace “relentless war” with “relentless diplomacy,” new research by Arctic Wolf shows that just 15% of US executives believe that diplomacy effectively stops future cyber-attacks. 

More than twice as many US executives – 31% – believe that retaliatory cyber-attacks against foreign nations would be effective in putting a halt to digital assaults.  

When asked which countries posed the most serious threat to their business, 41% of IT decision makers pointed the finger at China while another 41% named Russia. 

The research is based on a survey of more than 1,400 senior IT decision makers and business executives in Canada, the UK, and the US that took place in August. 

“Survey respondents revealed that despite recent interventions into cybersecurity issues, they lack faith in the government’s ability to protect them from cyber-threats, with 60% of organizations believing that spending on new security tools and services is the most effective way of stopping attacks,” stated Arctic Wolf’s Ian McShane.

This lack of confidence extended to the respondents’ own ability to secure hybrid work environments, with 60% of executives stating that their individual employees wouldn’t be able to identify a cyber-attack targeting their business in any working location. 

Another key finding of the report was that most C-suite executives in Canada, the UK, and the US said that they would pay a ransom to their cyber-attackers.

The survey found that only 22% of C-suite executives, when asked if they would pay a ransom if their organization were hit by a ransomware attack, answered “never.” When the same question was posed to middle managers, more than half (56%) gave “never” as their response. 

Nearly a third of the organizations surveyed (32%) reported suffering a data breach that exceeded six figures in the past year, with most business owners (61%) admitting that they had personally concealed a breach. 

Asked if their organization had deliberately covered up a cyber-attack to prevent the reputation of their organization’s being blemished, one in five respondents admitted that it had.

A new partnership aimed at amplifying the security of operational technology (OT) networks was announced today by cybersecurity company SCADAfence.

Under the new pact, SCADAfence will join forces with American manufacturer of electronics testing and measurement equipment and software, Keysight Technologies, to enhance the cybersecurity of complex OT networks and boost their network visibility.

Through continuous monitoring and proactive mitigation, the new partnership aims to increase the control that organizations have over their industrial environments. The union brings together SCADAfence’s non-intrusive platform for deep packet inspection (DPI) and Keysight’s network test access point (TAP) and network packet broker (NPB) solutions.

“Protecting and securing OT environments from security threats and anomalies has become a top priority for the industrial sector, and we provide deep packet-level visibility with accurate real-time analytics,” said Elad Ben-Meir, chief executive officer of SCADAfence. 

“We’re excited to partner with Keysight Technologies to help industrial organizations leverage both solutions for better visibility and more advanced packet information within OT environments.”

Companies already using SCADAfence’s services include Vestel, Mitsui Fudosan, Taro Pharmaceuticals, and numerous other Fortune 500 companies in the United States.

In a statement released September 22, the companies said that deploying their solution together will increase real-time visibility into OT environments and provide detailed asset visibility and continuous threat detection for manufacturing sites, water and wastewater environments, oil and gas facilities, automotive, and other industrial infrastructures.

The partnership will give Keysight the ability to collect data across all OT environments that can be used to generate actionable insights. 

“Critical infrastructures are being targeted more than ever and are facing more security threats in the OT and IoT networks. The mitigation process can take from weeks to possibly months to patch vulnerabilities within the more complex environments,” said Taran Singh, vice president, enterprise solutions, Keysight. 

“Our joint-partnership with SCADAfence will allow our customers and other industrial organizations to speed up that process from weeks to a few days.”

News of the partnership comes six months after SCADAfence announced that it had secured $12m in funding aimed at accelerating growth. 

The US Treasury has added a Russian cryptocurrency exchange to its sanctions list after claiming the firm helped facilitate ransomware payments for countless groups.

SUEX is incorporated in the Czech Republic but reportedly operates out of Russia. The Treasury estimated that 40% of its transaction history is associated with “illicit actors.”

According to separate analysis, the “over the counter” (OTC) broker has received over $160m in Bitcoin alone from illegal and high-risk sources, including Ryuk, Conti and Maze ransomware groups; dark web sites like Hydra Market; and cryptocurrency scammers.

“As a result of today’s designation, all property and interests in property of the designated target that are subject to US jurisdiction are blocked, and US persons are generally prohibited from engaging in transactions with them,” the Treasury explained.

“Additionally, any entities 50% or more owned by one or more designated persons are also blocked. In addition, financial institutions and other persons that engage in certain transactions or activities with the sanctioned entities and individuals may expose themselves to sanctions or be subject to an enforcement action.”

The US government action was widely trailed over the weekend, and includes a separate update from the Treasury’s Office of Foreign Assets Control (OFAC) designed to remind ransomware victims of the risks involved in paying cyber-criminals.

Specifically, payment of certain groups on sanctions lists, like Evil Corp, may result in penalties levied by the government on the victim organization.

“OFAC has updated the advisory to emphasize the importance of improving cybersecurity practices and reporting to, and cooperating with, appropriate US government agencies in the event of a ransomware attack,” the Treasury said.

“Such reporting, as the advisory notes, is essential for US government agencies, including law enforcement, to understand and counter ransomware attacks and malicious cyber actors.”

The FBI recorded victim ransomware losses of just $29m last year. However, the Treasury estimated that organizations paid out $400m in ransom payments alone last year, more than four times the 2019 figure.

Adam Flatley, director of threat intelligence at [redacted], welcomed the sanctions but said that government efforts need to go further.

“It will be critical that actions like these continue to be pursued as part of a larger, coordinated, intelligence-driven campaign that uses all aspects of national and international power,” he added.

“Financial and law enforcement actions are important components to this campaign, but this problem can’t be solved without bringing in capabilities that have not been traditionally used against criminal organizations.”

Sam Curry, chief security officer at Cybereason, had similar concerns: “The announcement from the White House is a good first step but, if this is the only exchange sanctioned, then there will be little effect, and the ransomware economy will continue to grow. There are many more exchanges, so now it’s all about adaptability and evolution. 

“The Department of Justice estimated that 40 percent of the digital transactions facilitated by SUEX were for illicit activity. With yesterday’s news, the ransomware cartels take a one-time loss, re-gear and use new exchanges. So the first move of the chess match has been made. What comes next in this digital frontier skirmishing? Let’s see!”