Tag Archive for: cyberSecurity

New Employees Can Be a Cybersecurity Risk. Here Are 5 Simple Practices You Can Teach Them During Onboarding

/in ,

Employee cybersecurity training is becoming an important best practice for organizations, and for good reason. In fact, more than half of small business owners name employee error as the biggest information security risk to their companies.

Many organizations hold annual security training for their employees, which is an important practice that should remain in place. That said, there’s great value in training new employees on cybersecurity during the onboarding process instead of waiting until an annual security training rolls around. While new employees bring skills and experience to the team, they could also bring significant risk if they were never properly educated on cybersecurity practices at previous jobs.

Including security training as part of the initial employee onboarding process makes it clear to new hires that they play a critical role in maintaining the company’s privacy and security, as well as protecting sensitive customer information. It also educates them on key cybersecurity principles, such as how to recognize and avoid common threats, the importance of strong passwords, and the risks of unsecured devices, such as their personal cell phone.

Since cybersecurity is such a broad topic, you might be wondering what to focus on when training your employees. Here are a few of the most important cybersecurity lessons to communicate to new employees as soon as they join the team.

1. Avoid phishing scams.

Phishing scams are a huge cybersecurity threat to companies, playing a role in 91 percent of all data breaches. That’s why it’s essential to teach new employees how to recognize and avoid possible phishing attacks. Be sure to educate them about spear phishing emails, which appear to come from a trustworthy sender but are actually designed to steal sensitive company data. These emails often come from someone high up at the organization, like the CEO.

Teach employees to be vigilant when checking their emails, and to be cautious if an email from a coworker contains lots of typos or asks for sensitive information. If they receive emails that seem suspicious, instruct them to verify the email address to make sure it originated from the actual sender. In addition, educate your new employees to hover their mouse over any links in emails to see where they will take them.

2. Keep up with security patches and software updates.

Another important lesson to teach your employees is to stay on top of security patches and software updates. While it’s easy to click the “update later button” on software update notifications, ignoring them can put devices – and your company – at risk. Security patches and updates are designed to repair vulnerabilities in your device or software and should be installed immediately. Instruct new employees to check their devices for software updates regularly and to install them right away.

3. Avoid unsecured Wi-Fi networks.

Be sure to educate your employees about the dangers of unsecured Wi-Fi networks and how to protect their devices when using public Wi-Fi. This is especially important if you let your employees work remotely or set up permissions so they can access work communications outside of the office. Your employees need to understand that bad actors often linger on unsecured public Wi-Fi networks, hoping to launch a man-in-the-middle attack and steal their sensitive information. If your employees want to connect to public Wi-Fi, make sure they use a virtual private network (VPN) to secure their connection and protect company data.

4. Stick to company-sponsored apps and tools.

During cybersecurity training, stress the importance of sticking to apps and online tools that are company-approved. If employees avoid using employer-mandated tools and opt for their preferred apps instead, they create risk by spreading sensitive company information on systems outside the company’s control. Teach new employees about the dangers of circumventing company-sponsored apps and provide in-depth training on approved tools so employees don’t feel the need to seek out alternatives.

5. Create strong passwords.

Communicating the importance of using strong passwords is an important step to secure sensitive company data. Creating a strong password by using a password generator or a password manager can help secure accounts and prevent cyberattacks. An important point to make with your employees is not only to focus on using strong passwords, but to ensure they are not using the same password on all of their logins.

Employee cybersecurity education is essential for companies of all sizes. In fact, employee cybersecurity training might be even more important for small businesses, which rarely have access to the resources and sophisticated IT teams that large corporations rely on to protect their organizations.

For this reason, small businesses need to take a proactive approach to educating new employees on cybersecurity best practices. By including cybersecurity training during the onboarding process, you can lay the groundwork for your company and employees’ long-term success.

inc

Potential global cyber attack could cause $85 billion-$193 billion worth of damage: report

/in

A co-ordinated global cyber attack, spread through malicious email, could cause economic damages anywhere between $85 billion (₦30,794,650,000,000) and $193 billion (₦69,921,970,000,000), a hypothetical scenario developed as a stress test for risk management showed.

Insurance claims after such an attack would range from business interruption and cyber extortion to incident response costs, the report jointly produced by insurance market Lloyd’s of London and Aon said on Tuesday.

Total claims paid by the insurance sector in this scenario is estimated to be between $10 billion and $27 billion, based on policy limits ranging from $500,000 to $200 million.

The stark difference between insured and economic loss estimates highlights the extent of underinsurance, in case of such an attack, the stress test showed. An attack could affect several sectors globally, with the largest losses in retail, healthcare, manufacturing and banking fields.

Regional economies that are more service dominated, especially the United States and Europe, would suffer more and are vulnerable to higher direct losses, the report said.

Cyber attacks have been in focus after a virus spread from https://www.reuters.com/article/us-cyber-attack/new-computer-virus-spreads-from-ukraine-to-disrupt-world-business-idUSKBN19I1TD Ukraine to wreak havoc around the globe in 2017, crippling thousands of computers, disrupting ports from Mumbai to Los Angeles and even halting production at a chocolate factory in Australia.

Governments are increasingly warning against the risks private businesses face from such attacks, both those carried out by foreign governments and financially motivated criminals.

For example, Britain’s National Cyber Security Centre announced on Friday it was investigating a large-scale Domain Name System (DNS) hijacking campaign that hit governments and commercial organizations across the world.

In another recent incident, French engineering consultancy Altran Technologies was the target of a cyber attack that hit its operations in some European countries.

On a larger scale, personal data and documents from hundreds of German politicians and public figures, including Chancellor Angela Merkel, were published online in what appears to be one of Germany’s most far-reaching data breaches.

The report was also co-produced by MSIG, SCOR TransRe and Cyber Risk Management (CyRiM).

Reuters

School dropout makes it to Forbes’ U-30 list

/in

Chandigarh, April 3 (IANS) A school dropout from Chandigarh who is now a cyber security expert has made it to the Forbes “30 under 30” Asia 2018 list.

Trishneet Arora, 25, made his way to the prestigious list which is packed with innovators and disruptors who are reshaping their industries and changing Asia for the better, a spokesperson for the young entrepreneur said here on Tuesday.

Arora is cyber security expert, an author and the founder and CEO of TAC Security — a Cyber-Security company based in Mohali, adjoining Chandigarh.

TAC Security performs vulnerability assessment and penetration testing for corporates, identifying weaknesses in their cyber security.

“In 2017, Arora was listed among the 50 Most Influential Young Indians by GQ Magazine. He has received funding from investor Vijay Kedia and support from former vice president of IBM, William May,” the spokesperson said.

His name now figures in the Enterprise Technology category of the Forbes “30 under 30” Asia 2018 list.

Besides young international personalities from across the world, international badminton player P.V Sindhu from India is part of the Forbes Asia “30 under 30” list under a different category.

TAC Security helps corporates recognise their weaknesses before fraudulent hackers can use them adversely. It helps to protect networks and information assets from malicious activity such as cyber-attacks. TAC is also responsible for security assessment for 50+ UPI based applications.

20% of Risky Emails Bypass Email Security

/in

Far too many risky emails are infiltrating email security solutions, according to a report released Tuesday by Mimecast.

The email and data security company released its second quarterly report on the effectiveness of email security systems, the Mimecast Email Security Risk Assessment (ESRA), based on a study of more than 44,000 users. The results are bleak, depicting how risky and potentially malicious emails continue to infiltrate security solutions.

As much as 9 out of 40 million emails analyzed by Mimecast, all of which passed through an email security vendor or cloud email service, were determined to have the potential for risk. The majority of these emails were spam, but a smaller amount of more dangerous emails also bypassed security, and it only takes one to cause irreversible harm.

More than 8,300 emails examined by Mimecast contained dangerous file attachments, while 1,669 contained known malware and 8,605 were impersonation attacks.

Impersonation attacks, or social engineering scams, are when a cybercriminal attempts to impersonate a trusted individual, like a company CEO, to obtain confidential information from duped employees. These types of scams have risen 400% since the release of Mimecast’s February ESRA report.

Phishing is now the primary entry method for cybercriminals seeking to access organizations according to a recent report from Symantec.

It’s also a preferred method of the Russian military according to a leaked NSA document published Monday by The Intercept. The report describes how the Russian military used email phishing to target United States agencies and services in the lead-up to the 2016 Presidential election.

Hackers attempted to spear-phish a private company in the United States to access information on voting-related technology, as well as targeting government agencies to impede requests for absentee ballots.

MEDIA POST

Cyber attacks: how your devices can be used

/in

The massive global cyber attack that wreaked havoc in computer systems earlier this month caused plenty of visible disruption, not least in Britain’s National Health Service.

But in the brave new inter-connected world heralded by the internet of things (IoT), so-called “ransomware” attacks could have as their source something quite mundane and yet present in ever more modern households.

In a not so far-off future, the source of a software glitch with serious consequences for the simple consumer could be anything from a connected coffee machine or refrigerator to a techie toy or an outsmart-you television.

Web-connected gadgets are becoming all the rage with tech-aware professionals.

But the mere idea that it only needs a hacker to give the software a malevolent tweak to send them on the blink with disastrous consequences may yet threaten the development of such goods’ popular take-up.

“Regarding last weekend’s attack there is no risk for connected objects. That in particular hit systems running Windows …and today there are no mass market gadgets with Windows loaded in order to function,” says Gerome Billois, a consultant with Wavestone.

“In contrast, there have already been massive attacks on connected objects,” Billois told AFP.

The Mirai malware strain made from hacked IoT devices including badly secured routers and internet connected cameras recently infected hundreds of thousands of poorly secured connected objects.

The idea was not to stop them from working but to transform them into zombies or botnets with a view to using them as relay stations for future cyber attacks.

Last week at a timely cyber security conference in The Netherlands, American wunderkind Reuben Paul, just 11, stunned an audience of security experts by hacking into a teddy bear via bluetooth to show how interconnected smart toys “can be weaponised”.

His prowess showed just how easy it is for tech savvy individuals to use everyday objects to harvest data or use them as spy holes for covert surveillance.

According to documents released in March by Wikileaks, US intelligence can hack smartphones, computers and smart, web-connected TVs, to pilot them and eavesdrop.

“All the other connected objects can be pirated, that has been shown, be it a coffee machine, a refrigerator, a thermostat, electronic entry systems, the lighting system…,” warns Loic Guezo, a cyber security analyst for southern Europe with Japanese security software company Trend Micro.

Mikko Hypponen, head of research at Finnish security specialists F-Secure, has for his part come up with his eponymous Hypponen’s Law.

This states that “once a device is described as ‘intelligent’, you can consider it as vulnerable.”

Neglected security

The future might well spell connected cars – but they too are subject to potential remote hacking, the consequences of which barely need stating.

When hackers lurking with their laptops have finished conjuring what havoc they might wreak on distant roads there are plenty of other things to which they could turn their attention.

These include vases which tell you when they need fresh water, insulin pumps – or how about sex toys?

So, the worried tech consumer may be asking him or herself – can a cyber hacker deprive me of my morning slug of caffeine?

Or maybe keep my thermostat blocked at 10 Celsius – a chilling thought – or even take over my GPS if I don’t hand over a ransom?

Theoretically, yes, specialists tell AFP.

“The logic of a cybercriminal is to make money,” says Wavestone’s Billois. Such an individual will not feel the need to make do with small-scale attacks.

Connected TVs, having rapidly become widespread, are an ideal portal for making ransom demands.

“Tomorrow, one can imagine devices which attack your connected house, bringing it under control, and then you get sent a message by another channel,” muses Guezo.

All that would required would be to perfect the sort of virus one can find on offer within the murky confines of the “darknet”, off the beaten track for day to day netizens.

Cyber security specialists are very much aware of the need to keep working on solutions offering protection as more and more homes go “smart” and “connected” with various boxes as add-ons to their usual routers.

The specialists’ plan is to work with the makers of connected goods in order to incorporate a security interface right from the start, thereby offering what the profession calls “security by design”.

Some experts feel that, in the rush to bring fascinating and cutting edge technologies into the home, the need for commensurate security has been rather left behind.

“It is extremely difficult to calculate the solidity of a connected object in terms of cybersecurity,” Billois regrets.

“As a consumer it is today impossible to know if you are buying a secure connected object or not,” he adds.

“There’s no label such as a made in Europe kind of tag guaranteeing an object won’t catch fire, or won’t pose a risk to children.”

Fin24Tech

Why Companies Shouldn’t Try to Hack Their Hackers

/in

During a recent cybersecurity competition, teams of students conducting a mock exercise unintentionally caused the U.S. to start a (fake) war. The students were given a variety of options, including diplomatic ones, for responding to a cyberattack by China. The majority of them took an aggressive approach, known as “hack back,” with disastrous consequences. The mock exercise shows how tempting it is to launch a counterstrike in response to a cyberattack — and the potential for significant unintended consequences.

As the CEO of a publicly traded security company, I would like to urge businesses and individuals to beware those very same dangers. In the United States, the Computer Fraud and Abuse Act (CFAA) prohibits private parties from accessing or damaging computer systems, even if they’re being used to attack you or your business.

But legislation in Congress would change that, giving private-sector businesses and individuals the right to strike back and hack their hackers. The idea behind the proposal is to empower people “to defend themselves online, just as they have the legal authority to do during a physical assault.” I believe the measure would do more harm than good. Here’s why.

Holes in the Self-defense Defense

It may sound reasonable that the same principle that allows homeowners to defend themselves against intruders, even if it involves causing harm to the attackers, should hold true for cyberattacks. But the reality is, unfortunately, that it would be akin to lobbing grenades from your front yard, hoping to get lucky and hit an attacker you haven’t seen as they flee the scene of the crime. Even if you do manage to hurt your attacker, you’ll likely hurt other people, too. In hack back, it’s almost impossible to ensure that an action targeted at a specific actor or group of actors will affect only the intended targets. After all, the internet is designed specifically for the purpose of systems interacting and communicating. Technology and users are increasingly interconnected.

It’s Difficult to Identify Your Attacker

Another significant challenge is that cyberattacks, which are sometimes discovered years after a security breach, are difficult to attribute to the correct actor. Hackers are constantly evolving their techniques to stay one step ahead of defenders and law enforcement. Sometimes they use deception techniques to plant indicators that point to some other perpetrator, either to throw off suspicion or to incriminate another party.

This is even more problematic when you consider that devices operating as unwilling parts of a botnet may be used to carry out an attack. These infected devices — and their owners — are as much victims of the attacker as the primary target, yet any attempt to hack back could cause them harm. Even governments, which possess the large-scale, sophisticated intelligence-gathering programs needed to accurately attribute cyberattacks, can take a long time to do so. Private-sector organizations typically do not have these resources.

Running Afoul of the Law of Proportionality

In the wake of a cyberattack, even if the attacker has been identified, it is difficult to judge motivation accurately and to determine an appropriate response. Remember the students competing in the mock cybersecurity exercise, the ones who ended up at war? They thought their response was proportional, but the situation quickly got out of hand.

Sometimes the need for information is used as an argument for hacking back. The argument is that it can help with intelligence gathering. However, intelligence gathering is not the same as mounting a digital counterstrike. There are a number of intelligence-gathering measures that U.S. organizations can take that do not run afoul of the CFAA. For example, organizations can deploy honeypots in their own networks to capture information on the attacker and their methods.

Essentially, hack back legislation would put the ability to launch cyberattacks, decide proportional responses, and infiltrate systems into the hands of companies and individuals. If hack back is legalized and private-sector companies have it in their arsenals, I fear it could become the de facto response — rather than considering the broad range of options that do not involve hacking back.

New Pressure on Company Resources

Clearly, hacking back effectively would require specialized skills and costly investments. Were it legalized with an authorization framework that is insufficiently stringent, I fear that many organizations may try to participate without the necessary tools and expertise to carry it out. That is likely to be ineffective, damaging, or both.

Other companies cannot afford a great deal of in-house security expertise and technologies to protect themselves today. Hack back capability is a nonstarter for them. That will make them even more vulnerable if hack back is legalized. Profit-motivated attackers may try to avoid companies that threaten to strike back. Instead, they’ll target the unfortunate organizations below this security poverty line.

Legal Landmines in a Lawless “Land”

While the internet is a borderless space accessed from every country in the world, each of those countries has its own legal system and expects its citizens to abide by it. It would be very risky for companies and individuals who hack back to avoid running afoul of the laws of another country and international law.

When national governments do this, it tends to occur within existing international legal frameworks and under some regulatory oversight. It must meet a stringent burden of proof for attribution. There are parameters determining the types of targets that can be pursued and which actions can be taken. Any hack back authorization would need considerable government oversight to avoid abuse by the private sector and minimize collateral damage.

For example, what if a company hacks back and accidentally hurts another company or individual? The company could incur expensive legal proceedings, reputational damage, and loss of trust. Making organizations exempt from this kind of legal action around unintended consequences is problematic. How could we spot and stop accidental or intentional abuses of the system? Giving the private sector hack back capability would require a complex legal framework and oversight system. Who would run it? How would it be funded? This seems impractical and costly.

It’s hard to blame companies for feeling helpless in the wake of cyberattacks that have shut factories, paralyzed hospitals, and publicized proprietary corporate data. From phishing scams to ransomware to vulnerabilities in medical devices, connected electronics, and even the entire power grid, no one likes to feel that they are constantly on the losing end of a shadowy war against clandestine cyberattackers, with no hope in sight. That feeling of helplessness is behind a growing call for companies to be able to hack back.

Yet the potential costs of a misstep and the unintended consequences should deter business leaders from undertaking such an effort. We must instead work together to find solutions to our complex cybersecurity problems that are better than legitimizing vigilantism, particularly given its significant risks and dubious benefits. It’s one thing for students to unintentionally trigger a disaster in the safe confines of a competitive mock scenario. It’s another thing entirely to be a business leader that does so in the real world.

Harvard Business Review

3 Cybersecurity Practices That Small Businesses Need to Consider Now

/in , ,

All businesses, regardless of size, are susceptible to a cyberattack. Anyone associated with a company, from executive to customer, can be a potential target. The hacking threat is particularly dangerous to small businesses who may not have the resources to protect against an attack let alone ransomware.

Norman Guadagno, a senior marketing officer at Carbonite, has said that “almost one in five small business owners say their company has had a loss of data in the past year,” with each data hack costing anything ranging $100,000 to $400,000 [about ₦37,500,000 to ₦150,000,000]. It, therefore, pays to understand cybersecurity to better protect you and your business.

Ransomeware Risks
Ransomware attacks can be especially devastating for small business owners. When hackers seize your data, encrypt it, and demand money in exchange for the key to unlock that data, you are truly at the mercy of the criminals.

Given that smaller businesses are likely to have weaker protection than larger ones, it is important that adequate steps are taken to properly secure your information. Ensure that software and hardware is up to date and change passwords often.

Cloud-Based Security
Using some sort of central data vault is a popular solution for business security. There are a great many companies which provide this service, from the large Nokia Networks to smaller bespoke groups.

The advantage of this approach is that you will have access to the cyber expertise of the vault company while also possessing a significant degree of control over the cloud system you will be using. The disadvantage is that adopting this approach does not make your company immune to hackers since there are points of attack either at the vault company or at your own. But you are at least in expert hands.

Biometric Security
Smartphones are already using thumbprints for user identification purposes, but 2017 promises to deliver even more advancements along these lines. Biometric systems will be able to analyze and evaluate every part of your company’s security features. Touch pads will have sensors able to identify a user from their computer habits like typing speed and even online browsing taste.

The Internet of Things (IoT) is such that security measures are under increasing scrutiny as multiple devices, over ever-expanding distances, can be linked together. This facilitates speedier data sharing and storage as the hardware (and the businesses using the hardware) becomes more familiar to users. But it also means that device-level security must be effective if it is to minimize the risk of an effective cyber attack – multiple-factor authentication is needed.

Increased Automation Assists Security Staff
Biometrics, the cloud, and the increasing prevalence of the IoT are signposting an expanding role for automation in cybersecurity. When the smart systems already mentioned combined with the human element of a security process, a strong deterrent against criminals can be created. Automated technology constantly reviews your protection arrangements, looking for possible gaps and plugging them. The use of these systems complements the work of your staff and safeguards your business against all but the most determined attackers.

Cybersecurity is evolving as it tries to keep pace with increasingly sophisticated hack attacks. This is why it is important to secure your business effectively by taking expert advice. The cost to businesses of cyberattacks is already monumental, and it is growing. Consumers are also becoming more aware of the dangers of computer crime and they will often take their custom to those businesses which take data security seriously. Being small is no excuse for businesses – they must pay heed to industry advice and ensure that they are properly protected against cybercrime in 2017.

Tech.co