‘Petya’ ransomware attack: what is it and how can it be stopped?

/in ,

Many organizations in Europe and the US have been crippled by a ransomware attack known as “Petya”. The malicious software has spread through large firms including the advertiser WPP, food company Mondelez, legal firm DLA Piper and Danish shipping and transport firm Maersk, leading to PCs and data being locked up and held for ransom.

It’s the second major global ransomware attack in the past two months. In early May, Britain’s National Health Service (NHS) was among the organizations infected by WannaCry, which used a vulnerability first revealed to the public as part of a leaked stash of NSA-related documents released online in April by a hacker group calling itself the Shadow Brokers.

The WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the NHS, Spanish phone company Telefónica and German state railways among those hardest hit.

Like WannaCry, “Petya” spreads rapidly through networks that use Microsoft Windows, but what is it, why is it happening and how can it be stopped?

What is ransomware?

Ransomware is a type of malware that blocks access to a computer or its data and demands money to release it.

How does it work?

When a computer is infected, the ransomware encrypts important documents and files and then demands a ransom, typically in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files.

How does the “Petya” ransomware work?

The ransomware takes over computers and demands $300, paid in Bitcoin. The malicious software spreads rapidly across an organization once a computer is infected using the EternalBlue vulnerability in Microsoft Windows (Microsoft has released a patch, but not everyone will have installed it) or through two Windows administrative tools. The malware tries one option and if it doesn’t work, it tries the next one. “It has a better mechanism for spreading itself than WannaCry,” said Ryan Kalember, of cybersecurity company Proofpoint.

Is there any protection?

Most major antivirus companies now claim that their software has updated to actively detect and protect against “Petya” infections: Symantec products using definitions version 20170627.009 should, for instance, and Kaspersky also says its security software is now capable of spotting the malware. Additionally, keeping Windows up to date – at the very least through installing March’s critical patch defending against the EternalBlue vulnerability – stops one major avenue of infection, and will also protect against future attacks with different payloads.

For this particular malware outbreak, another line of defence has been discovered: “Petya” checks for a read-only file, C:\Windows\perfc.dat, and if it finds it, it won’t run the encryption side of the software. But this “vaccine”doesn’t actually prevent infection, and the malware will still use its foothold on your PC to try to spread to others on the same network.

Why is it called “Petya”?

Strictly speaking, it is not. The malware appears to share a significant amount of code with an older piece of ransomware that really was called Petya, but in the hours after the outbreak started, security researchers noticed that “the superficial resemblance is only skin deep”. Researchers at Russia’s Kaspersky Lab redubbed the malware NotPetya, and increasingly tongue-in-cheek variants of that name – Petna, Pneytna, and so on – began to spread as a result. On top of that, other researchers who independently spotted the malware gave it other names: Romanian’s Bitdefender called it Goldeneye, for instance.

Where did it start?

The attack appears to have been seeded through a software update mechanism built into an accounting program that companies working with the Ukrainian government need to use, according to the Ukrainian cyber police. This explains why so many Ukrainian organizations were affected, including government, banks, state power utilities and Kiev’s airport and metro system. The radiation monitoring system at Chernobyl was also taken offline, forcing employees to use hand-held counters to measure levels at the former nuclear plant’s exclusion zone. A second wave of infections was spawned by a phishing campaign featuring malware-laden attachments.

How far has it spread?

The “Petya” ransomware has caused serious disruption at large firms in Europe and the US, including the advertising firm WPP, French construction materials company Saint-Gobain and Russian steel and oil firms Evraz and Rosneft. The food company Mondelez, legal firm DLA Piper, Danish shipping and transport firm AP Moller-Maersk and Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh, also said their systems had been hit by the malware.

Crucially, unlike WannaCry, this version of ‘Petya’ tries to spread internally within networks, but not seed itself externally. That may have limited the ultimate spread of the malware, which seems to have seen a decrease in the rate of new infections overnight.

So is this just another opportunistic cybercriminal?

It initially looked like the outbreak was just another cybercriminal taking advantage of cyberweapons leaked online. However, security experts say that the payment mechanism of the attack seems too amateurish to have been carried out by serious criminals. Firstly, the ransom note includes the same Bitcoin payment address for every victim – most ransomware creates a custom address for every victim. Secondly, the malware asks victims to communicate with the attackers via a single email address which has been suspended by the email provider after they discovered what it was being used for. This means that even if someone pays the ransom, they have no way to communicate with the attacker to request the decryption key to unlock their files.

Who is behind the attack?

It is not clear, but it seems likely it is someone who wants the malware to masquerade as ransomware, while actually just being destructive, particularly to the Ukrainian government. Security researcher Nicholas Weaver told cybersecurity blog Krebs on Security that ‘Petya’ was a “deliberate, malicious, destructive attack or perhaps a test disguised as ransomware”. Pseudonymous security researcher Grugq noted that the real Petya “was a criminal enterprise for making money,” but that the new version “is definitely not designed to make money.

“This is designed to spread fast and cause damage, with a plausibly deniable cover of ‘ransomware,’” he added, pointing out that, among other tells, the payment mechanism in the malware was inept to the point of uselessness: a single hardcoded payment address, meaning the money can be traced; the requirement to email proof of payment to a webmail provider, meaning that the email address can be – and was – disabled; and the requirement to send an infected machine’s 60-character, case sensitive “personal identification key” from a computer which can’t even copy-and-paste, all combine to mean that “this payment pipeline was possibly the worst of all options (sort of ‘send a personal cheque to: Petya Payments, PO Box … ’)”.

Ukraine has blamed Russia for previous cyber-attacks, including one on its power grid at the end of 2015 that left part of western Ukraine temporarily without electricity. Russia has denied carrying out cyber-attacks on Ukraine.

What should you do if you are affected by the ransomware?

The ransomware infects computers and then waits for about an hour before rebooting the machine. While the machine is rebooting, you can switch the computer off to prevent the files from being encrypted and try and rescue the files from the machine, as flagged by @HackerFantastic on Twitter.

If the system reboots with the ransom note, don’t pay the ransom – the “customer service” email address has been shut down so there’s no way to get the decryption key to unlock your files anyway. Disconnect your PC from the internet, reformat the hard drive and reinstall your files from a backup. Back up your files regularly and keep your anti-virus software up to date.

The Guardian logo

Microsoft hit with anti-trust complaint from Russian cybersecurity firm over Windows Defender

/in

Russian cybersecurity company Kaspersky Lab said it has filed complaints with regulators in Germany as well as the European Union as a whole against Microsoft, alleging the Redmond, Wash. technology giant unfairly favors its security software over other solutions.

In a blog post with a very Yoda-like title — Antitrust: Pursue It in Europe We Must — Eugene Kaspersky writes that the company is moving forward with complaints to the European Commission and the German Federal Cartel Office because it wants users to have more choices in security software. Kaspersky also filed a complaint with Russia’s Federal Antimonopoly Service late last year on the same issue.

“We see clearly — and are ready to prove — that Microsoft uses its dominant position in the computer operating system (OS) market to fiercely promote its own — inferior — security software (Windows Defender) at the expense of users’ previously self-chosen security solution,” Kaspersky writes. “Such promotion is conducted using questionable methods, and we want to bring these methods to the attention of the anti-competition authorities.”

Microsoft issued the following statement in response to Kaspersky’s claim:

Microsoft’s primary objective is to keep customers protected and we are confident that the security features of Windows 10 comply with competition laws. We’re always interested in feedback from other companies and we engage deeply with antimalware vendors and have taken a number of steps to address their feedback. We reached out directly to Kaspersky a number of months ago offering to meet directly at an executive level to better understand their concerns, but that meeting has not yet taken place.

A European Commission representative confirmed that the complaint has been received.

Windows Defender is built into Windows 10, which Microsoft said last month is on more than 500 million devices, and Kaspersky claims it is impossible to completely disable or uninstall. The cybersecurity company further claims that Microsoft actively encourages people to get rid of independent security systems, and that the upgrade to Windows 10 in some cases invalidated security programs already on a device by uninstalling drivers.

Kaspersky concludes the blog post with the outcome it would like to see from its complaints.

We want Microsoft to stop misleading and misinforming our — and not only our — users. We want to see all security solutions being able to work on the Windows platform on a level playing field. And we want to see users being able to decide for themselves what they want and consider important to them.

Besides, we want fair and healthy competition, which has always given excellent results everywhere – no matter in which industry or market. And btw, we invite all our competitors/colleagues to join us: as we’ve already shown, turning to antitrust bodies does bring positive change.

And remember: the only folks who gain unequivocally if there is a monopoly in the security products market are cybercriminals. They’d love nothing more than to be able to concentrate on trying to out-smart the single security solution of a monopolist.

GeekWire

3 Things Developers Need to Know about Cross-Marketing

/in ,

With a limited budget, small businesses should consider partnership with other companies or independent developers who offer related products and try cross-marketing. It consists in combining efforts of two or more companies for achieving the common goal.

Nowadays hundreds of apps a day are being created making the intensely competitive IT industry one of the biggest spenders when it comes to marketing. However, there are many companies that do not have massive budgets for product promotion and, therefore, need to use affordable methods to attract potential customers.

With a limited budget, such small businesses should consider partnership with other companies or independent developers who offer related products and try cross-marketing. It consists in combining efforts of two or more companies for achieving the common goal – improving the sales performance by merging customer bases. Basically, your products get promoted and promote other software.

What are the advantages of cross-marketing?

Cross-marketing is a cost-effective method for breaking through the white noise of advertising and motivating customers to purchase products that they initially have not been after. Moreover, it provides you with a possibility to:

  • Establish your business credibility. By placing your product’s name next to the better-known brand, you develop a positive association in customers’ minds, and gain more trust from them, so they do not treat you like another dark horse. Obviously, it works only if you collaborate with a reputable company.
  • Increase the coverage of the target audience. With a customer base of your partner, you are able to reach more people who are potentially interested in your product. Your product will be shown to
  • Broad your company’s visibility. People tend to opt for products they have already heard about; therefore, you need to get exposure, and cross-marketing lets you do this without spending much.

Rules for choosing the right partner for cross-marketing

To make your cooperation with another company or developer effective and mutually beneficial, you have to consider several things.

The first one is about learning whether a potential partner(s) is your indirect competitor. Your products have to complement each other, but not to offer the same features, even if there are a few of them. Customers may need exactly what you have in common, and the comparison may not be in your favor.

You have probably identified your and your potential partner’s target audiences already. Do they coincide? If no, you will probably fire blanks trying to get exposure among customers who are not interested in your product. For example, if you sell an app for Mac optimization like this one, you should try to reach developers oriented on users who pay much attention to their computers’ maintenance, but want to do it quickly and easy, and whose work is connected with processing of large amounts of information. It could be professional photographers, for example, who use photo editors. It is unlikely for you to benefit from partnering with companies that create apps for kids or low-code development platforms.

One more thing to take into account is how much your partner’s target audience is used to spend on software – you have to be in the same price segment.

You also have to make sure your potential partner would not harm your reputation. Small companies often try to get their name in as many places as possible in the pursuit of money; however, it is not a viable option for businesses that aim to sell quality products. For instance, a free software segment is known for advertising and forced downloads of harmful and unnecessary apps said to be designed for “improving user experience”. In fact, loyal customers are often scared off by such “bonuses” and may stop using your product. Therefore, you should guard against accepting potentially harmful offers and reconsider a monetization model if needed. Devote enough time for studying the company’s history and its products’ reviews before initiating a cooperation.

How to make cross-promotion effective

Before you start working with your partner(s), you should determine:

  • Who will be the main contact from each business?
  • How the billing will be handled?
  • How long your promotion campaigns will last?
  • How the profits will be shared?
  • Who will be in charge of implementing new approaches while cross-promoting products?

This way you can avoid disagreements with your partner(s), which usually significantly reduce the efficacy of collaboration.

It is also worth remembering that barter projects need to be constantly monitored to make sure that both parties are satisfied. Collect statistics of traffic and sales and conduct analysis on a regular basis. It is probable that you will need to change your tactics in order to get better results.

Obviously, there are other ways to promote your product without investing much and you should not rely on cross-marketing only. However, this method like no other can help you to make a big step forward in a very short time.

Social Media, Brute Force Attacks, Passwords, Fake WAPs & Protecting Yourself

/in , ,

The video above shows a hack of Gmail, but your social media accounts can be just as vulnerable if you choose a common password like:

  • Password
  • 12345
  • QWERTY
  • iloveyou

Social media accounts are online assets, which no matter how big you build them, can still be a liability. This liability comes from how they can be exploited by hackers, especially when you do not take the proper steps to protect them.

You need to put as much effort into protecting your online assets as you do building them. You don’t need an entire IT team to do this, keep reading to learn the basics of what you need to do.

Defeat brute force hacks with better passwords

One of the most brainless hacks out there is known as a brute force hack. I hacker simply sets up a tool to target a specific account and the tool guesses passwords until it is right. You may know these tools as password recovery tools. They have be altered by hackers for nefarious purposes.

You have to defend against brute force hacks with better passwords that are complicated and use a mix of characters.

Fake WAPs: Use a variety of passwords

Let’s say that you took my advice above when you created a password that is “35IrulePLANETearthb1tches!” Good job, but now you have to come up with the new password for each of your social media accounts. This is important because of something known as the fake WAP. This is when a hacker will set up a free Wi-Fi network in a public location. They will then use the network to steal things like passwords.

Your first line of defense should be a good password manager. You can create a very strong password to get into the password manager, and then it could manage a wide variety of strong passwords for you. Good examples include:

Each one is going to help you protect your accounts by using a wide variety of passwords to defend against the fake WAP hack. Even if they do get one password to one of your social media accounts they won’t necessarily get access to all of your other accounts.

Secondary defense against fake WAP

Last failsafe to protect yourself against a fake WAP involves encryption. The problem with the fake WAP is the hacker will set up a hot spot that has no encryption on it. This means that they can see the following in plain text:

  • Confidential information that you send over your social media through private messages.
  • Any customer contact details that you sent back and forth.
  • Brand strategies discussed between related accounts.
  • Any credit card numbers that customers send through there.

The way that you are going to encrypt every single thing that you send over a hotspot, including your social media, is with a VPN with strong encryption. These tools are perfect for this job as they encrypt everything that is transferred to and from your device. All you have to do is connect to the VPN server and that takes care of your encryption, and your social media data.

Do your best against insider threats

Insider threats, especially recently fired employees that still have your social media, are very real. There have been a number of times when staff and being fired but they’re access to the social media has not been removed. The most embarrassing has probably been HMV.

 Here are ways that you can defend against this insider threat:

  • Make a record of all accounts that employees have access to.
  • Have plans in place to remove people from all accounts before they’re fired. Make sure a specific person is assigned to this.
  • If you have multiple accounts that multiple employees are given access to, it may be smart to consolidate these in one social media dashboard. You can use things like HootSuite, SocialFlow, or BufferApp.

The last point will make things easier ‘s that you only have one account to remove access from. Imagine having to remove access to twitter, Facebook, WordPress, Google, LinkedIn, etc.… Consolidate the accounts in one spot to minimize an insider threat caused by oversight on what accounts they have access to.

Social media and online security

Social media is a fantastic way to connect with your customers. It can be a very valuable asset to your company. The value that you get from that can be exploited by hackers for monetary reasons, or simply to troll you. Both of these will wind up costing you money. Invest in these tactics, make sure that your employees follow through on them, and you will save yourself a lot of money and heartache.

Samsung releases SoundAssistant app for improved audio experience on Galaxy phones

/in ,


Samsung has launched a new app to allow Samsung Galaxy owners to customize a wealth of audio settings on their devices.

Known as SoundAssistant, the app offers “150 steps” of volume adjustment, a floating EQ, mono and stereo balancing, as well as the chance to set individual volumes for different apps.

What’s more, SoundAssistant can alter the hardware volume keys so that they default to media volume control rather than call volume. Typically, these keys will automatically switch to control whatever sound is playing at the time, but this can be a little finicky and doesn’t always adjust the desired setting. As a person who usually has their phone on silent, though, having it default to media volume would be far more useful than call volume.

If you own a Galaxy S8 or S8 Plus, SoundAssistant can even allow you to set different outputs for different apps, like using a Bluetooth speaker for Spotify and the phone’s speaker for Clash of Clans.

On paper, the app looks like it could be a useful tool and I expect that many Android users would appreciate the features it offers: here’s hoping Samsung opens it up to non-Galaxy devices sometime (and non-Android 7.0 Nougat devices, as that’s another current restriction).

You can download SoundAssistant via the link below and let us know in the comments what your favorite Android audio customization tool is.

DOWNLOAD SAMSUNG SOUNDASSISTANT

Android Authority

Critical flaw in Twitter’s code could let hackers take over your account

/in ,

A security researcher discovered a critical vulnerability in the advertising code of Twitter, the most popular micro-blogging website in the world, which if exploited could let hackers publish updates from any other account without needing access to the victim’s profile.

The white-hat hacker, writing in a blog post this week (22 May), claimed to have uncovered the issue while exploring Twitter’s code for bugs. He said the flaw could give cybercriminals the ability to “publish entries in Twitter-network by any user of this service.”

The vulnerability was initially found on 26 February 2017 and fixed two days later.

The hacker, known as kedrisch, reported the flaw via Twitter’s bug bounty service – a programme managed by the organisation HackerOne which lets researchers disclose bugs in exchange for rewards.

In this instance, kedrisch was handed a bounty of $7,560 (₦2,872,800) for his efforts.

The issue he found was in Twitter’s advertising code. Essentially, the researcher said flaws existed in how the service’s media library uploaded files such as videos, images and gifs to the platform.

Rules surrounding the responsible disclosure programme mean the flaw is only coming to light now.

In a statement, Twitter said: “The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user.

“By sharing media with a victim user and then modifying the post request with the victim’s account ID the media in question would be posted from the victim’s account. This bug was patched […] and no evidence was found of the flaw being exploited by anyone other than the reporter.”

Charlie Miller, a security expert well-known for being part of the collective which remotely hacked a 2014 Jeep Cherokee, tweeted: “As former appsec [Application Security] tech lead for Twitter, I’ll just say I’m not shocked this was in code from the ads team.” He did not elaborate further.

 Last December, kedrisch was awarded $1,120 (₦425,600) for finding a less critical flaw which could let a hacker change comments on Twitter’s official forums. This was publicly disclosed on 12 May 2017.
Most recently, Twitter issued a warning to users of its Vine service that a bug potentially exposed users’ email addresses and phone numbers to unnamed third parties. In an email sent to all impacted Vine users, it said the bug affected the Vine Archive for “less than 24 hours”.
Vine was bought by Twitter back in 2012 however the company decided to shut down the popular short video publishing application earlier this year amid a period of heavy job cuts.

“We want to emphasise that this information can’t directly be used to access your account, and we have no information indicating that it has been misused,” Twitter’s email to Vine users stressed. “We take these incidents very seriously, and we’re sorry this occurred,” it added.

IBTimes

Why Companies Shouldn’t Try to Hack Their Hackers

/in

During a recent cybersecurity competition, teams of students conducting a mock exercise unintentionally caused the U.S. to start a (fake) war. The students were given a variety of options, including diplomatic ones, for responding to a cyberattack by China. The majority of them took an aggressive approach, known as “hack back,” with disastrous consequences. The mock exercise shows how tempting it is to launch a counterstrike in response to a cyberattack — and the potential for significant unintended consequences.

As the CEO of a publicly traded security company, I would like to urge businesses and individuals to beware those very same dangers. In the United States, the Computer Fraud and Abuse Act (CFAA) prohibits private parties from accessing or damaging computer systems, even if they’re being used to attack you or your business.

But legislation in Congress would change that, giving private-sector businesses and individuals the right to strike back and hack their hackers. The idea behind the proposal is to empower people “to defend themselves online, just as they have the legal authority to do during a physical assault.” I believe the measure would do more harm than good. Here’s why.

Holes in the Self-defense Defense

It may sound reasonable that the same principle that allows homeowners to defend themselves against intruders, even if it involves causing harm to the attackers, should hold true for cyberattacks. But the reality is, unfortunately, that it would be akin to lobbing grenades from your front yard, hoping to get lucky and hit an attacker you haven’t seen as they flee the scene of the crime. Even if you do manage to hurt your attacker, you’ll likely hurt other people, too. In hack back, it’s almost impossible to ensure that an action targeted at a specific actor or group of actors will affect only the intended targets. After all, the internet is designed specifically for the purpose of systems interacting and communicating. Technology and users are increasingly interconnected.

It’s Difficult to Identify Your Attacker

Another significant challenge is that cyberattacks, which are sometimes discovered years after a security breach, are difficult to attribute to the correct actor. Hackers are constantly evolving their techniques to stay one step ahead of defenders and law enforcement. Sometimes they use deception techniques to plant indicators that point to some other perpetrator, either to throw off suspicion or to incriminate another party.

This is even more problematic when you consider that devices operating as unwilling parts of a botnet may be used to carry out an attack. These infected devices — and their owners — are as much victims of the attacker as the primary target, yet any attempt to hack back could cause them harm. Even governments, which possess the large-scale, sophisticated intelligence-gathering programs needed to accurately attribute cyberattacks, can take a long time to do so. Private-sector organizations typically do not have these resources.

Running Afoul of the Law of Proportionality

In the wake of a cyberattack, even if the attacker has been identified, it is difficult to judge motivation accurately and to determine an appropriate response. Remember the students competing in the mock cybersecurity exercise, the ones who ended up at war? They thought their response was proportional, but the situation quickly got out of hand.

Sometimes the need for information is used as an argument for hacking back. The argument is that it can help with intelligence gathering. However, intelligence gathering is not the same as mounting a digital counterstrike. There are a number of intelligence-gathering measures that U.S. organizations can take that do not run afoul of the CFAA. For example, organizations can deploy honeypots in their own networks to capture information on the attacker and their methods.

Essentially, hack back legislation would put the ability to launch cyberattacks, decide proportional responses, and infiltrate systems into the hands of companies and individuals. If hack back is legalized and private-sector companies have it in their arsenals, I fear it could become the de facto response — rather than considering the broad range of options that do not involve hacking back.

New Pressure on Company Resources

Clearly, hacking back effectively would require specialized skills and costly investments. Were it legalized with an authorization framework that is insufficiently stringent, I fear that many organizations may try to participate without the necessary tools and expertise to carry it out. That is likely to be ineffective, damaging, or both.

Other companies cannot afford a great deal of in-house security expertise and technologies to protect themselves today. Hack back capability is a nonstarter for them. That will make them even more vulnerable if hack back is legalized. Profit-motivated attackers may try to avoid companies that threaten to strike back. Instead, they’ll target the unfortunate organizations below this security poverty line.

Legal Landmines in a Lawless “Land”

While the internet is a borderless space accessed from every country in the world, each of those countries has its own legal system and expects its citizens to abide by it. It would be very risky for companies and individuals who hack back to avoid running afoul of the laws of another country and international law.

When national governments do this, it tends to occur within existing international legal frameworks and under some regulatory oversight. It must meet a stringent burden of proof for attribution. There are parameters determining the types of targets that can be pursued and which actions can be taken. Any hack back authorization would need considerable government oversight to avoid abuse by the private sector and minimize collateral damage.

For example, what if a company hacks back and accidentally hurts another company or individual? The company could incur expensive legal proceedings, reputational damage, and loss of trust. Making organizations exempt from this kind of legal action around unintended consequences is problematic. How could we spot and stop accidental or intentional abuses of the system? Giving the private sector hack back capability would require a complex legal framework and oversight system. Who would run it? How would it be funded? This seems impractical and costly.

It’s hard to blame companies for feeling helpless in the wake of cyberattacks that have shut factories, paralyzed hospitals, and publicized proprietary corporate data. From phishing scams to ransomware to vulnerabilities in medical devices, connected electronics, and even the entire power grid, no one likes to feel that they are constantly on the losing end of a shadowy war against clandestine cyberattackers, with no hope in sight. That feeling of helplessness is behind a growing call for companies to be able to hack back.

Yet the potential costs of a misstep and the unintended consequences should deter business leaders from undertaking such an effort. We must instead work together to find solutions to our complex cybersecurity problems that are better than legitimizing vigilantism, particularly given its significant risks and dubious benefits. It’s one thing for students to unintentionally trigger a disaster in the safe confines of a competitive mock scenario. It’s another thing entirely to be a business leader that does so in the real world.

Harvard Business Review

Amazon launches new training and certification portal to lure talent to AWS

/in

As cloud services continue to pick up steam, Amazon wants to make sure there is no shortage of talent to maintain your cloud computing operations and take care of your AWS needs.

Yesterday, the e-commerce giant announced it is launching its own dedicated training and certification portal to offer aspiring ASW solution architects the opportunity to independently manage and monitor their progress in one convenient place.

“Previously, you had to rely on multiple websites to find and manage training and certification offerings,” Amazon said in a blog post.

“Now you have a central place where you can find and enroll in AWS Training, register for AWS Certification exams, track your learning progress, and access benefits based on the AWS Certifications you have achieved.”

Amazon hopes the move will make it easier for technical professionals to build up their AWS skills and advance towards earning an actual certification to back up their competence in the area.

To access the portal, you can create a new account or simply log in with your existing Amazon account. Owners of AWS Training accounts will have the option to migrate their existing training history to the new platform.

While the new training portal will certainly make it easier for ambitious AWS rookies to catch up with the latest and greatest trends and practices in managing cloud infrastructures, it is worth noting employers tend to bet on candidates that can back up their certifications with practical experience.

So make sure you have some actual working experience to compliment your glowing AWS training certifications if you really want to impress potential talent hunters.

Check out more details about the AWS Training and Certification portal here.

TnW

3 Cybersecurity Practices That Small Businesses Need to Consider Now

/in , ,

All businesses, regardless of size, are susceptible to a cyberattack. Anyone associated with a company, from executive to customer, can be a potential target. The hacking threat is particularly dangerous to small businesses who may not have the resources to protect against an attack let alone ransomware.

Norman Guadagno, a senior marketing officer at Carbonite, has said that “almost one in five small business owners say their company has had a loss of data in the past year,” with each data hack costing anything ranging $100,000 to $400,000 [about ₦37,500,000 to ₦150,000,000]. It, therefore, pays to understand cybersecurity to better protect you and your business.

Ransomeware Risks
Ransomware attacks can be especially devastating for small business owners. When hackers seize your data, encrypt it, and demand money in exchange for the key to unlock that data, you are truly at the mercy of the criminals.

Given that smaller businesses are likely to have weaker protection than larger ones, it is important that adequate steps are taken to properly secure your information. Ensure that software and hardware is up to date and change passwords often.

Cloud-Based Security
Using some sort of central data vault is a popular solution for business security. There are a great many companies which provide this service, from the large Nokia Networks to smaller bespoke groups.

The advantage of this approach is that you will have access to the cyber expertise of the vault company while also possessing a significant degree of control over the cloud system you will be using. The disadvantage is that adopting this approach does not make your company immune to hackers since there are points of attack either at the vault company or at your own. But you are at least in expert hands.

Biometric Security
Smartphones are already using thumbprints for user identification purposes, but 2017 promises to deliver even more advancements along these lines. Biometric systems will be able to analyze and evaluate every part of your company’s security features. Touch pads will have sensors able to identify a user from their computer habits like typing speed and even online browsing taste.

The Internet of Things (IoT) is such that security measures are under increasing scrutiny as multiple devices, over ever-expanding distances, can be linked together. This facilitates speedier data sharing and storage as the hardware (and the businesses using the hardware) becomes more familiar to users. But it also means that device-level security must be effective if it is to minimize the risk of an effective cyber attack – multiple-factor authentication is needed.

Increased Automation Assists Security Staff
Biometrics, the cloud, and the increasing prevalence of the IoT are signposting an expanding role for automation in cybersecurity. When the smart systems already mentioned combined with the human element of a security process, a strong deterrent against criminals can be created. Automated technology constantly reviews your protection arrangements, looking for possible gaps and plugging them. The use of these systems complements the work of your staff and safeguards your business against all but the most determined attackers.

Cybersecurity is evolving as it tries to keep pace with increasingly sophisticated hack attacks. This is why it is important to secure your business effectively by taking expert advice. The cost to businesses of cyberattacks is already monumental, and it is growing. Consumers are also becoming more aware of the dangers of computer crime and they will often take their custom to those businesses which take data security seriously. Being small is no excuse for businesses – they must pay heed to industry advice and ensure that they are properly protected against cybercrime in 2017.

Tech.co

Twitter co-founder: ‘Yeah, I’m sorry’ if Twitter helped Trump get elected

/in ,

Twitter co-founder Evan Williams wants you to know he’s super sorry for any role the social media platform played in the election of President Donald Trump.

The sort-of apology was made in an interview with The New York Times published on Saturday. Williams’ remorse for possibly helping to create a political monster comes after Trump’s claims that Twitter was key in helping him clinch the election.

“I think that maybe I wouldn’t be here if it wasn’t for Twitter, because I get such a fake press, such a dishonest press,” Trump told Fox News in March.

The Times reports that Williams has only recently heard Trump’s claim for the first time, reflecting on it for a while before speaking out.

“It’s a very bad thing, Twitter’s role in that,” Williams told the Times. “If it’s true that he wouldn’t be president if it weren’t for Twitter, then yeah, I’m sorry.”

Trump’s use of Twitter has long been the source of criticism, especially now as he holds the highest office in the country. The Wall Street Journal reported earlier this week that Trump’s aides recently held a social media intervention with the president due to concerns his tweets could have political and legal ramifications.

The White House did not respond to a request for comment on Williams’ remarks, according to the Times

WATCH: Trump’s outrageous insults throughout his campaign