Tag Archive for: Password

New Employees Can Be a Cybersecurity Risk. Here Are 5 Simple Practices You Can Teach Them During Onboarding

/in ,

Employee cybersecurity training is becoming an important best practice for organizations, and for good reason. In fact, more than half of small business owners name employee error as the biggest information security risk to their companies.

Many organizations hold annual security training for their employees, which is an important practice that should remain in place. That said, there’s great value in training new employees on cybersecurity during the onboarding process instead of waiting until an annual security training rolls around. While new employees bring skills and experience to the team, they could also bring significant risk if they were never properly educated on cybersecurity practices at previous jobs.

Including security training as part of the initial employee onboarding process makes it clear to new hires that they play a critical role in maintaining the company’s privacy and security, as well as protecting sensitive customer information. It also educates them on key cybersecurity principles, such as how to recognize and avoid common threats, the importance of strong passwords, and the risks of unsecured devices, such as their personal cell phone.

Since cybersecurity is such a broad topic, you might be wondering what to focus on when training your employees. Here are a few of the most important cybersecurity lessons to communicate to new employees as soon as they join the team.

1. Avoid phishing scams.

Phishing scams are a huge cybersecurity threat to companies, playing a role in 91 percent of all data breaches. That’s why it’s essential to teach new employees how to recognize and avoid possible phishing attacks. Be sure to educate them about spear phishing emails, which appear to come from a trustworthy sender but are actually designed to steal sensitive company data. These emails often come from someone high up at the organization, like the CEO.

Teach employees to be vigilant when checking their emails, and to be cautious if an email from a coworker contains lots of typos or asks for sensitive information. If they receive emails that seem suspicious, instruct them to verify the email address to make sure it originated from the actual sender. In addition, educate your new employees to hover their mouse over any links in emails to see where they will take them.

2. Keep up with security patches and software updates.

Another important lesson to teach your employees is to stay on top of security patches and software updates. While it’s easy to click the “update later button” on software update notifications, ignoring them can put devices – and your company – at risk. Security patches and updates are designed to repair vulnerabilities in your device or software and should be installed immediately. Instruct new employees to check their devices for software updates regularly and to install them right away.

3. Avoid unsecured Wi-Fi networks.

Be sure to educate your employees about the dangers of unsecured Wi-Fi networks and how to protect their devices when using public Wi-Fi. This is especially important if you let your employees work remotely or set up permissions so they can access work communications outside of the office. Your employees need to understand that bad actors often linger on unsecured public Wi-Fi networks, hoping to launch a man-in-the-middle attack and steal their sensitive information. If your employees want to connect to public Wi-Fi, make sure they use a virtual private network (VPN) to secure their connection and protect company data.

4. Stick to company-sponsored apps and tools.

During cybersecurity training, stress the importance of sticking to apps and online tools that are company-approved. If employees avoid using employer-mandated tools and opt for their preferred apps instead, they create risk by spreading sensitive company information on systems outside the company’s control. Teach new employees about the dangers of circumventing company-sponsored apps and provide in-depth training on approved tools so employees don’t feel the need to seek out alternatives.

5. Create strong passwords.

Communicating the importance of using strong passwords is an important step to secure sensitive company data. Creating a strong password by using a password generator or a password manager can help secure accounts and prevent cyberattacks. An important point to make with your employees is not only to focus on using strong passwords, but to ensure they are not using the same password on all of their logins.

Employee cybersecurity education is essential for companies of all sizes. In fact, employee cybersecurity training might be even more important for small businesses, which rarely have access to the resources and sophisticated IT teams that large corporations rely on to protect their organizations.

For this reason, small businesses need to take a proactive approach to educating new employees on cybersecurity best practices. By including cybersecurity training during the onboarding process, you can lay the groundwork for your company and employees’ long-term success.

inc

This New Web Standard Could Finally Kill the Password

/in

Passwords are pretty archaic. Unfortunately, despite the best efforts of companies including Google, Apple, Facebook and others, no one has figured out a uniform standard that would make it possible to do away with them entirely. Until, perhaps, now.

A new credential system proposed by the W3C—the World Wide Web Consortium—could be what we need to kill off the password for good.

Per the w3c, the new Web Authentication specification details an “API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users.” In other words, this would be a universal system that could offer unique encryption keys for each user that could be accessed securely across every site, all in your standard web browser.

But the big upgrade is that, instead of being limited to a regular password, the API would also support the use of fingerprint readers, cameras, and USB keys as a method of logging into your account. In fact, some potential use cases even include using the fingerprint reader on your phone to log into a website that you’re browsing on your laptop or desktop, which may not have its own fingerprint sensor.

While the new standard is currently listed as just a “Candidate Recomendation,” the feature is already in use as an experimental technology in FireFox, with other browsers including Chrome and Edge expected to test the Web Authentication API later this year.

The sad part so far is that, despite input and contribution from companies such as Google, Microsoft, PayPal, Mozilla, Qualcomm and others, it doesn’t seem like Apple is on board to help test or refine the tech. That’s a real shame, because even though wide-scale adoption is still a ways out, it would be nice if there was a secure, non-proprietary login platform that all the big tech companies could agree on.

gizmodo

6 tips to protect your personal information when using public Wi-Fi

/in ,

As the Internet has become a crucial part of everyday life, so too has the need to access it virtually anytime, anywhere.

In fact, according to a recent survey completed by Symantec, over 66 per cent of Canadians consider access to public Wi-Fi when making travel or entertainment arrangements.

Based on these numbers – and the risk of using public networks – it’s important to know how to protect yourself. Here are six tips you can use to protect your personal information on public Wi-Fi networks, before and after you connect.

Before you log on

Keep on top of security updates

As the world learned from the WannaCry ransomware attack, which started by delaying a Windows update and went on to affect hundreds of thousands of computers, staying on top of software updates is the most prudent way to protect yourself against hackers and cybercriminals.

According to Forbes, “there’s no magic bullet to data security,” and diligently running updates for your operating system and web browser is one of the primary ways to protect yourself.

Turn off file-sharing and close shared folders on your laptop

While shared folders can be a great way to work collaboratively with colleagues, and share photos amongst family, make sure to close them and turn off file-sharing before logging onto a public network with your laptop or mobile device.

A blog post from the online security company Zone Alert states that once your computer connects to a public Wi-Fi service, those folders can be viewed by anyone else on the network. A public Wi-Fi field guide from Gizmodo concurs with this suggestion.

To avoid any information falling into the wrong hands, users should adjust their privacy settings to ensure they are different for public and private networks.

Enable 2-factor authentication on any accounts that contain personal information

Two-factor authentication is a good option for anyone desiring a second layer of security on their physical electronic devices, including their mobile device and laptop.

Enabling multiple layers of authentication on email, social networking and bank accounts can also act as an additional line of defence against cyber criminals lurking on public networks, reports The Next Web.

Use a VPN (virtual private network)

One of the most effective ways to protect your information while using public Wi-Fi is to use a Virtual Private Network (VPN). Simply download a VPN app on your phone or mobile device and log into your VPN before connecting to the Internet.

A VPN reroutes your traffic through a private, encrypted network. Kevin Haley, director of product management for security response at Symantec, explains exactly why a VPN is so useful.

“What you’re doing is, within a public network, creating a private network that’s just for you, if you will,” Haley says.

“The other way it’s referred to is a tunnel. It’s really just making sure that your communication is surrounded by protection as you talk between where you are and wherever, the website that you’re going to.”

According to PCMag, some of the best VPN services of 2017 include NordVPN and Private Internet Access for Android, or KeepSolid or NordVPN for iPhone.

After you log on

Avoid signing in to accounts that contain personal information, including social media and online banking

Assuming that you’ve taken precautions beforehand, the next step is to be cautious after logging onto a public network. One of the best ways to play it safe is to avoid logging into any accounts that contain personal information, such as social media, work email and especially, online banking.

Haley pointed out that even though a website itself might be reputable, personal information still isn’t secure as long as the network is insecure.

While email remains relatively low-risk, Stephen Neville, founder of the Centre for Advanced Security at the University of Victoria, noted in an email that any financial transactions should never be completed over a public network.

“If you use encrypted transmissions, wireless access points offer reasonable security for low-risk activities, e.g. email, and security, that is more or less on par with a wired connection. But the security is insufficient for any higher-risk things like e-banking,” Neville wrote.

Make sure the URL is encrypted

It’s also helpful for users to know how to identify whether a website has taken steps to protect their information. Users can do this by checking the beginning of a URL to see whether it begins with HTTP or HTTPS.

Haley explained that website URLs containing HTTPS use an SSL encryption to protect visitors to their site. Sites that use HTTPS will also show a small padlock next to the search bar.

“Users just need to look for the little lock that’s in the browser bar, and that tells you that your traffic is being encrypted,” said Haley.

globalnews

This cheap password-stealing malware just added to your security headaches

/in ,

A new form of credential-stealing malware — complete with slick marketing and support from its authors — is available for as little as $7, providing wannabes with a worryingly easy entry point into the world of cybercrime.

First appearing a month ago, Ovidiy Stealer is regularly updated by its Russian-speaking authors and the malware has hit targets around the world including the UK, the Netherlands, India, and Russia.

Despite its low price of 450-750 Rubles ($7-13), the malware comes with code designed to avoid analysis and detection.

Uncovered by researchers at Proofpoint, the malware is spread via a number of methods, including malicious email attachments, file-hosting websites, and even within software packages.

It comes with functionality to target multiple applications, but buyers are able to purchase a version of the malware which only focuses on a single browser if they so wish.

If the malware is able to find passwords in its targeted applications, it will send them to the gang using it, putting the victim and their organisation at risk of compromise, especially if the same password is used across multiple accounts.

Ovidiy Stealer is openly sold on a domain which boasts support and features — including the ability to view statistics and logs of infected machines — to potential customers. Payment for the malware is taken by RoboKassa, the Russian equivalent of PayPal.

In order to help drive sales in the competitive criminal world of malware, the developers include statistics and detail plans for future releases of Ovidiy Stealer.

ovidiy-stealer-reviews.png
Reviews help Ovidiy Stealer look appealing to potential buyers.Image: Proofpoint

While Ovidiy Stealer isn’t advanced, the marketing and advertising around it, combined with a low price, could make it very attractive to wannabe cybercriminals who might not otherwise have the expertise to get involved.

“Ovidiy Stealer highlights the manner in the cybercrime marketplace drives innovation and new entrants and challenges organizations that must keep pace with the latest threats to their users, their data, and their systems,” said Proofpoint researchers.

While many cybercriminal operations are run by highly sophisticated gangs which do not sell their products to outsiders, there’s a growing market for ‘cybercrime-as-a-service’ schemes which provide low-level criminals with all the tools they need to get started, in return for a cut of the profits.

ZDNet

Password manager OneLogin hacked, exposing sensitive customer data

/in

Password manager and single sign-on provider OneLogin has been hacked.

In a brief blog post, the company’s chief security officer Alvaro Hoyos said that it was aware of “unauthorized access to OneLogin data in our US data region,” and that it had reached out to customers.

Hoyos said that the company had blocked the unauthorized access after the breach and is working with law enforcement.

The blog post initially lacked detailed information about the incident, although the post had omitted that hackers had stolen sensitive customer data — a point that the company had instead only mentioned in an email sent to customers, seen by ZDNet.

“OneLogin believes that all customers served by our US data center are affected and customer data was potentially compromised,” the email read.

Later in the day, the company said in an update: “Our review has shown that a threat actor obtained access to a set of [Amazon Web Services, or AWS] keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US.”

The company confirmed that the attack appears to have started at 2am (PT), but staff were alerted of unusual database activity some seven hours later, who “within minutes, shut down the affected instance as well as the AWS keys that were used to create it”.

“The threat actor was able to access database tables that contain information about users, apps, and various types of keys,” the company said.

The company added that although it encrypts “certain sensitive data at rest,” it could not rule out the possibility that the hacker “also obtained the ability to decrypt data”.

But a spokesperson did not say what kind of data is and isn’t encrypted. We have asked for clarity, and will update when we hear back.

Some had questioned earlier in the day how the hackers had access to customer data that could ultimately be decrypted.

“Am I the only 1 to find it disturbing OneLogin had a decryption method for customer data accessible enough to be grabbed via breach?” said one user on Twitter.

The company has advised customers to change their passwords, generate new API keys for their services, and create new OAuth tokens — used for logging into accounts — as well as to create new security certificates. The company said that information stored in its Secure Notes feature, used by IT administrators to store sensitive network passwords, can be decrypted.

The company also hasn’t said how many customers were affected.

According to its website, dozens of major multinationals, including ARM, Dun & Bradstreet, The Carlyle Group, Conde Nast, and Dropbox (which a spokesperson disputed in an email), are customers.

OneLogin allows corporate users to access multiple web applications, sites, and services with just one password. It’s thought that the company has millions of users serving more than 2,000 companies in dozens of countries, according to CrunchBase.

The single sign-on provider integrates hundreds of different third-party apps and services, such as Amazon Web Services, Microsoft’s Office 365, LinkedIn, Slack, Twitter, and Google services.

It’s the second such breach in as many years. Last August, the company warned users that its Secure Notes service had been accessed by an “unauthorized user,” but it denied that any customer data had been compromised.

ZDNet

Social Media, Brute Force Attacks, Passwords, Fake WAPs & Protecting Yourself

/in , ,

The video above shows a hack of Gmail, but your social media accounts can be just as vulnerable if you choose a common password like:

  • Password
  • 12345
  • QWERTY
  • iloveyou

Social media accounts are online assets, which no matter how big you build them, can still be a liability. This liability comes from how they can be exploited by hackers, especially when you do not take the proper steps to protect them.

You need to put as much effort into protecting your online assets as you do building them. You don’t need an entire IT team to do this, keep reading to learn the basics of what you need to do.

Defeat brute force hacks with better passwords

One of the most brainless hacks out there is known as a brute force hack. I hacker simply sets up a tool to target a specific account and the tool guesses passwords until it is right. You may know these tools as password recovery tools. They have be altered by hackers for nefarious purposes.

You have to defend against brute force hacks with better passwords that are complicated and use a mix of characters.

Fake WAPs: Use a variety of passwords

Let’s say that you took my advice above when you created a password that is “35IrulePLANETearthb1tches!” Good job, but now you have to come up with the new password for each of your social media accounts. This is important because of something known as the fake WAP. This is when a hacker will set up a free Wi-Fi network in a public location. They will then use the network to steal things like passwords.

Your first line of defense should be a good password manager. You can create a very strong password to get into the password manager, and then it could manage a wide variety of strong passwords for you. Good examples include:

Each one is going to help you protect your accounts by using a wide variety of passwords to defend against the fake WAP hack. Even if they do get one password to one of your social media accounts they won’t necessarily get access to all of your other accounts.

Secondary defense against fake WAP

Last failsafe to protect yourself against a fake WAP involves encryption. The problem with the fake WAP is the hacker will set up a hot spot that has no encryption on it. This means that they can see the following in plain text:

  • Confidential information that you send over your social media through private messages.
  • Any customer contact details that you sent back and forth.
  • Brand strategies discussed between related accounts.
  • Any credit card numbers that customers send through there.

The way that you are going to encrypt every single thing that you send over a hotspot, including your social media, is with a VPN with strong encryption. These tools are perfect for this job as they encrypt everything that is transferred to and from your device. All you have to do is connect to the VPN server and that takes care of your encryption, and your social media data.

Do your best against insider threats

Insider threats, especially recently fired employees that still have your social media, are very real. There have been a number of times when staff and being fired but they’re access to the social media has not been removed. The most embarrassing has probably been HMV.

 Here are ways that you can defend against this insider threat:

  • Make a record of all accounts that employees have access to.
  • Have plans in place to remove people from all accounts before they’re fired. Make sure a specific person is assigned to this.
  • If you have multiple accounts that multiple employees are given access to, it may be smart to consolidate these in one social media dashboard. You can use things like HootSuite, SocialFlow, or BufferApp.

The last point will make things easier ‘s that you only have one account to remove access from. Imagine having to remove access to twitter, Facebook, WordPress, Google, LinkedIn, etc.… Consolidate the accounts in one spot to minimize an insider threat caused by oversight on what accounts they have access to.

Social media and online security

Social media is a fantastic way to connect with your customers. It can be a very valuable asset to your company. The value that you get from that can be exploited by hackers for monetary reasons, or simply to troll you. Both of these will wind up costing you money. Invest in these tactics, make sure that your employees follow through on them, and you will save yourself a lot of money and heartache.

Zomato Hacked, Records Of 17 Million Users Stolen, Company Assures Card Details Safe

/in

In a major cyber attack on food ordering app Zomato,  1.7 crore user records were stolen from the company’s database. The stolen database includes user email addresses and hashed passwords.

 What Zomato says

The company in its blog post on Thursday gave the following assurances:

  • The stolen information can’t be misused since the company has reset the passwords for all affected user
  • The stolen password cannot be converted/decrypted back to plain text
  • It also assured that no payment information or credit card data has been stolen/leaked.
  • It has recommended users to change passwords in case they’re using the same for other accounts as well.

Here is what Zomato wrote:

The hashed password cannot be converted/decrypted back to plain text – so the sanctity of your password is intact in case you use the same password for other services. But if you are paranoid about security like us, we encourage you to change your password for any other services where you are using the same password.

Important note – payment related information on Zomato is stored separately from this (stolen) data in a highly secure PCI Data Security Standard (DSS) compliant vault. No payment information or credit card data has been stolen/leaked.

As a precaution, we have reset the passwords for all affected users and logged them out of the app and website. Our team is actively scanning all possible breach vectors and closing any gaps in our environment. So far, it looks like an internal (human) security breach – some employee’s development account got compromised.

How can this stolen information be misused?

Since we have reset the passwords for all affected users and logged them out of the app and website, your zomato account is secure. Your credit card information on Zomato is fully secure, so there’s nothing to worry about there.

This is not the first instance where Zomato had to face a cyber attack as in 2015, ethical hacker Anand Prakash hacked 6.2 crore accounts of Zomato in order to expose the company’s flaw. Prakash later informed Zomato after which its technical team fixed the bug in an hour’s time, reports vcc circle.

ScoopWhoop

MasterCard adds fingerprint sensors to payment cards

/in , ,

Our fingerprints are quickly replacing PINs and passwords as our primary means of unlocking our phones, doors and safes. They’re convenient, unique, and ultimately more secure than easily guessed or forged passwords and signatures. So it makes sense that fingerprint sensors are coming to protect our credit and debit cards. MasterCard is testing out new fingerprint sensor-enabled payment cards that, combined with the onboard chips, offer a new, convenient way to authorize your in-person transactions. Instead of signing a paper receipt or entering your PIN while struggling to cover up the number pad, you simply place your thumb on your card to prove your identity.

Read more

Hackers can steal your password by looking at how you tilt your phone

/in

According to a team of cybersecurity experts at Newcastle University, the way you tilt your phone could be used by hackers to break into your device.

When it comes to security and the protection of privacy, people often worry about connecting to public Wi-Fi networks, tricking face recognition technology, or bypassing fingerprint sensors. What usually gets left out of the discussion is the multitude of basic motion and orientation sensors that can be found inside most smartphones and tablets today. Well, according to cyber-experts at Newcastle University, we should be paying more attention to these sensors that we take for granted every day.

According to the paper published by the team, they were able to crack four-digit pins with 70 percent accuracy on the first guess and 100 percent accuracy by the fifth guess.

Read more

Researchers found it is scarily easy to crack Android users’ lock screen patterns

/in

If you use a lock screen pattern to protect your Android phone, it’s a lot less secure than you might think.

That’s the message from researchers at the University of Lancaster, who have put out a paper explaining how they were able to reconstruct people’s lock screen patterns with a high degree of accuracy by using discretely captured footage. (You can check out the full study below.) Read more