Cyber Skills Gap: Experience vs. Education and Key Industry News

LockBit Gang Hacked and Data Leaked

• 🔓 The LockBit ransomware gang has been hacked, resulting in a significant leak of its internal data, including victim negotiation logs and Bitcoin addresses.
• 💥 This breach exposes the operational details of their ransomware-as-a-service model and follows previous law enforcement actions against the group.

New Malware and Exploits Identified

• 🦠 Google researchers identified a new infostealer called Lost Keys, used by the Russian state-backed group Cold River, which steals files and system data via fake capture sites.
• 🤖 Scammers are distributing a new malware called Nlafile Stealer through fake AI tools advertised on Facebook, targeting users with credential and crypto wallet theft.
• 🚨 SonicWall is urging customers to patch three critical vulnerabilities in its SMA 100 series devices, with one already being actively exploited, allowing remote code execution.
• 🍎 Apple has patched a critical remote code execution flaw in macOS related to malicious ICC profiles, and Cisco has addressed 35 vulnerabilities across multiple products, including critical flaws in wireless LAN controllers and identity services engines.
• 🕵️ Iranian state-linked hackers cloned a German modeling agency's website to spy on Iranian dissidents, collecting detailed visitor data through obfuscated JavaScript.
• 🛡️ Researchers discovered a technique called 'bring your own installer' that can bypass SentinelOne's EDR protection by exploiting the agent's upgrade process.

PowerSchool Faces Renewed Extortion and CrowdStrike's AI Focus

• 🏫 Despite paying a ransom, the education tech firm PowerSchool is facing renewed extortion as the hacker targets individual school districts with previously stolen data.
• 🤖 CrowdStrike is laying off 5% of its workforce, citing increased efficiency through AI, though its regulatory filings acknowledge potential AI risks.

The Cyber Skills Gap: Experience Over Education

• 🧠 Caleb Barlow, CEO of Cyberbit, argues that the perceived cyber skills gap is more accurately an experience gap, where recruiters prioritize hands-on experience with commercial tools over academic qualifications.
• 💻 Graduates often struggle to find entry-level jobs because they lack experience with industry-standard platforms like Splunk, Curadar, or Google Chronicle, which are used to filter resumes.
• 🎓 Barlow emphasizes the need for educational institutions and vendors to provide students with access to and training on these commercial tools, similar to how RIT provided him with co-op experience.
• 🏢 Companies are encouraged to invest in upskilling existing employees rather than solely relying on external hires, which can reduce recruitment costs, improve retention, and build a more skilled workforce.
• 🎯 Effective training requires hands-on, repetitive practice with realistic adversaries, akin to sports training, to develop crucial pattern recognition and reflexive responses.

Honoring Joseph Nye's Legacy

• 🕊️ The episode concludes by honoring the legacy of Joseph Nye, a key figure in international relations and cybersecurity, known for coining the term 'soft power' and championing norms for cyberspace stability.