A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. I had almost forgotten (was I the only one?) that the aged IE web browser approaches it’s doom… Long may it rot.

Electronic mail (or email) is an integral part of how businesses function and has been a fundamental communication tool across all industries. Email communication has been used to interact instantly with employees and customers, as well as to share important information to the wider public. Emails are also effective as they can be used to connect two or more people by allowing businesses to send messages en masse to a targeted list of contacts quickly and efficiently.

CIS Control 14 concerns implementing and operating a program that improves the cybersecurity awareness and skills of employees. (Prior to CIS Critical Security Controls Version 8, this area was covered by CIS Control 17.) This control is important because a lack of security awareness among people inside your network can quickly lead to devastating data breaches, downtime, identity theft and other security issues.

The newly revised and renumbered Center for Internet Security (CIS) Control 11 highlights the need for backups, ensuring smooth and timely recovery of data in case of security breach or misconfiguration. In the current CIS Critical Security Controls (CSC) version 8 of CIS benchmarks, the data recovery control has been pushed ahead to 11. It was previously CIS Control 10 in version 7. CIS Control 11 is a vital player among the 18 cis controls CIS has formulated.

By now, pretty much anyone who uses email is familiar with the term “phishing,” and is aware of the prevalence of phishing scams. However, the term “spear phishing”—and what it means exactly—might be a bit more elusive. Essentially, spear phishing is a more targeted and socially engineered version of a spray-and-pray, bait-and-hook, phishing email.

Cyber insurance premiums are growing exponentially. It’s a dilemma that puts new financial pressures on organizations that are eager to protect their digital assets, but wary of increased spending. ‍Part I of this cyber insurance blog series explored six reasons why cyber insurance costs are increasing so rapidly.

On March 22, the hacking group Lapsus$ published a Twitter post with a number of screenshots taken from a computer showing “superuser/admin” access to various systems at authentication firm Okta that took place in January this year. Okta is a platform in the #1 platform in Identity-as-a-Service (IDaaS) category, which means that it manages access to internal and external systems with one login.

This blog is a continuation of our series on working with chatbots leveraging Microsoft Teams. In Part 1 of this series, we examined how to set up a chatbot within Microsoft Teams. In Part 2, we explored how to send rich notifications using Cards and use the Microsoft Graph API and the chatbot to proactively find and contact users within Microsoft Teams.