According to a recent survey, roughly half of IT and cybersecurity professionals are unfamiliar with a popular golden rule for security in the clouds…or at least the name of it.

An August Dark Reading report found that only 49% of respondents surveyed were familiar with the “shared responsibility model,” a cloud security framework that outlines the responsibilities of a cloud service provider and its customers. Cloud service providers such as Microsoft Azure, Google Cloud, and Amazon Web Services each have their own version of the accountability model, which allows them to clearly communicate what security responsibilities they are responsible for versus what areas are in the control of a customer.

The survey, which was commissioned by cybersecurity company OPSWAT in partnership with F5, queried 131 IT and cybersecurity professionals from companies of all sizes earlier this year.

On the tip of your tongue. Adam Rocker, director at OPSWAT, told IT Brew that the survey’s findings were a bit surprising, but gave the respondents the benefit of the doubt in their understanding of the model, which he claims was popularized primarily by AWS.

“They may not be familiar with the term, but I think they’re familiar with the concept,” he said.

Read the rest here.—BM

Yep. Pretty much everyone is saying it, actually. AI think pieces, strategies, and insights are almost everywhere. So where can we cut through the noise and get to the relevant stuff?

At Amazon Web Services’ (AWS) upcoming event centering on AI. Join Forrester and top software providers to learn how AI is transforming operations. Discover implementation strategies, ROI analysis, and performance-boosting tools for the C-suite.

Learn from industry leaders on how to implement AI strategically, measure its impact, and position your business for long-term success.

All you’ve gotta do is register here.

Software recovery company Veeam has a series of vulnerabilities that could open the door to exploits, prominent cybersecurity firms revealed in September.

According to a Rapid7 post on September 9, Veeam has a number of Common Vulnerabilities and Exposures—CVEs—that could be exploited by bad actors. In a blog post, Rapid7 detailed the concerns while making clear that, thus far, there is no evidence of bad actors taking advantage of the vulnerabilities.

“It is possible that one or more of these vulnerabilities may be used to facilitate extortion attacks,” the firm wrote. “More than 20% of Rapid7 incident response cases in 2024 so far have involved Veeam being accessed or exploited in some manner, typically once an adversary has already established a foothold in the target environment.”

Target identified. Rapid7’s report singled out CVE-2024-40711, an unauthenticated remote code execution vulnerability that targets Veeam’s proprietary backup and replication system. The vulnerability was initially detected by Florian Hauser of CODE WHITE, and listed by Veeam as “critical.”

Read more here.—EH

Insurance firms, technology companies, and governments, assemble! It’s time for an “Avengers: Endgame”-style battle against the world’s cyber threats.

Minus the MCU reference, that’s more or less the message that insurance carrier Zurich and insurance broker Marsh McLennan convey in a new white paper.

“Cyber threats are outpacing the ability of traditional insurance and risk management approaches to fully mitigate them,” according to the paper’s foreword, signed by Marsh McLennan president and CEO John Doyle and Zurich Group CEO Mario Greco. “The resulting cyber risk protection gap is a societal challenge that urgently needs collective action from both the insurance industry and the public sector.”

Read the full story on CFO Brew.—AZ

Is that a threat? Your data is likely susceptible to more than a few threats. It’s…not exactly pleasant knowledge. What is? Learning how to meet these threats head-on at Rubrik’s virtual Data Security Summit. It’ll cover threat trends, modern security strategies, and how to protect and recover as a whole. Save your seat.