#CyberCrimeAwareness Archives - Page 2 of 2

Growing threat of E-Skimming Attacks

Posted on 15/08/202009/06/2021 by Tushar

E-skimming has been an online shopping threat for a long time, keeping pace with the growth of e-commerce overall. The current global crisis presents another big opportunity for hackers to launch these strikes as people increasingly shop online. The nefarious cybercrime targets online payment systems to collect or “skim” the payment details of customers’ payment cards at the checkout.

Unlike more traditional cyber attacks, where an entire customer database may be targeted in a single hit-and-run attack, skimming attacks continually intercept customer payment details at the point of purchase, making them harder to detect and often invisible to both customers and retailers.

Several criminal groups have become very adept at this kind of attack over the years, the most prevalent and successful of which is known as Magecart. Magecart is an umbrella term for a set of sophisticated criminal groups using similar malware and techniques — all with the goal of stealing credit card information from online retailers.

The Magecart groups are known to have been active since 2016 and have been behind some of the largest payment system attacks in recent years, including British Airways (2018), Newegg electronics (2018), the Atlanta Hawks Shop fan merchandise store (2019), Forbes magazine subscriptions (2019), as well as ticket-reselling websites for the 2020 Olympic Games and the Union of European Football Associations (UEFA) Euro 2020 soccer tournament (2020). Such attacks earned Magecart a position on Wired magazine’s “Most Dangerous People on the Internet” list in 2018.

How it works

In most skimming attacks the threat actor introduces some additional code to a retailer’s e-commerce application. Recent attacks by the Magecart group have achieved this through the compromise of a trusted external third party whose code is legitimately included in the application, such as an external code repository, a chatbot or an advertising vendor.

So far, researchers have identified more than 40 different code-injection exploits, sometimes as small as 20 characters, which can be difficult to detect unless the application code is examined line-by-line for changes.

Attackers have also incorporated the use of valid SSL certificates tied to the domains that deliver malicious code, making traffic appear legitimate and preventing customers from receiving mixed content warnings when the website attempts to mix trusted, encrypted website content with malicious content that is served unencrypted.

A recent report has also described Magecart attacks where misconfigured access controls on Amazon S3 buckets allowed the attackers to tack their skimmer code onto existing JavaScript application code files.

Defending against card skimming

The best proactive cyber defense an organization can implement to defend against card-skimming attacks all focus on hardening the e-commerce application stack and limiting what code is allowed to run.

Use a free online scanning resource to help spot suspicious connections being opened by scripts injected into the application. Browser developer tools can also be used to analyze contents and spot suspicious connections made during a customer session.
Use the Amazon “Block Public Access” option on any S3 buckets in use by the organization to prevent unauthorized changes to application files.
Define a Content Security Policy (CSP) that defines a list of locations that resources can be loaded from on your site. This should be applied to all sensitive pages, such as payment pages, login pages and other areas where users may enter sensitive information.
Verify any external scripts, such as those from advertising partners, using Subresource Integrity (SRI). This will ensure that any scripts included from external sources are hashed and checked against a known good value to ensure that they are the files that you expect to be loaded and if not, they are blocked from loading by the browser.
Make sure that all assets on sensitive pages use SRI. Using the “require-sri-for” directive in the CSP to enforce SRI on all scripts and style tags will prevent assets being included on these pages that do not have SRI enabled.

The activity seen from Magecart and similar adversaries demonstrates that these are a persistent and resilient threat. The lucrative nature of card-skimming attacks ensures that attacks will continue to evolve in both stealth and capability in response to security precautions. However, for many of the attacks we have seen from these groups to date, had the measures described above been implemented, they would have gone a long way toward preventing some very embarrassing and expensive breaches.

Major Trends that will affect Cyber Security

Posted on 14/08/202009/06/2021 by Tushar

Will this year be as tumultuous as 2020? Let’s hope not. But one thing won’t change: In 2021, as is the case every year, companies will continue to be challenged by new or evolving cyber security threats.

We expect 5 security trends that emerged or accelerated last year to demand even more attention from organizations this year. Here is a look at key threats, potential vulnerabilities and defense strategies in 2021:

Zero Trust becomes more relevant than ever

While the concept of Zero Trust has been around for over a decade, only now is it becoming a viable defense strategy. Today, every endpoint including remote PCs, smartphones, tablets, IoT sensors, containers, virtual systems and cloud resources is susceptible to attacks.

Traditional defenses are meaningless in an environment where the traditional network perimeter is slowly dissipating. It’s not just a matter if these assets will be compromised, but when. The only safe response is to trust nothing on your network and assume the environment is compromised. The premise of Zero Trust management is that to be secure, organizations must verify and authenticate access in a continuous manner.

In 2021, the rise of machine learning is paving the way for Zero Trust. Machine learning can be used to help document baseline user behavior and detect anomalies in actions. For example, if you normally log in from London, but today you’ve logged in from Hong Kong, the system recognizes this anomalous behavior, blocks access and triggers an alert to raise an investigation.

Applying Zero Trust will become an integral part of every organization’s business behavior as a way to future-proof the protection of data and assets.

Remote working is your new threat vector

As a result of government-mandated stay-at-home orders, remote working grew faster than anyone could have foreseen in 2020. Approximately 40 percent of the global workforce shifted to working from home or other remote locations. What’s more, the transition happened practically overnight and is expected to settle into a long-term trend.

Traditional security strategies, developed for staff working in the office within the same corporate network, are insufficient. In many cases, home routers and networks are not secure, and family members’ computing devices may be easily compromised.

What’s needed in 2021 is a new way of operating to work securely from remote locations. It will require changes in behavior, such as keeping access to corporate data from a home network to a minimum. Organizations must verify access to data and assets using various authentication methods that require human intervention and leverage new technologies, such as remote browsing or remote terminals, where no actual data is transmitted to the computing device at home.

Such changes, once unthinkable and impractical, will be crucial to securing work-from-home environments.

5G wireless offers new opportunities, enables new threats

After being touted for years as wireless networking’s next big thing, 5G is finally becoming mainstream. Apple introduced its first 5G-capable iPhones in late 2020, and telecom providers worldwide have rolled out 5G services.

5G computing with its high-speed connections and improved network reliability should empower organizations to quickly deploy compute servers, IoT sensors and other devices on the edge in remote hubs.

The features of 5G, however, can pose new threats if not well-managed. If infrastructure is not carefully secured, adversaries can exfiltrate information very quickly and in large amounts from compromised environments, thanks to 5G’s blazing-fast bandwidth.

Another concern is that most endpoint devices are not designed to deal with a high-volume network, which means adversaries could use 5G bandwidth to easily overwhelm network assets through denial-of-service attacks.

Ransomware moves one step ahead

Ransomware dominated headlines in 2020 and security experts have developed new tactics for responding to these threats. For example, by studying ransomware campaigns, security teams can deduce the decryption keys needed to unlock systems without having to pay the ransom.

Cyber criminals are aware of such countermeasures and are already developing ransomware encrypted at the code level. This means cyber security teams will have to wait for the code to run before it can be studied, thus slowing the development of countermeasures.

Attackers are also rewriting ransomware code to infect the firmware of computing devices and ensure perpetual presence in the victim’s environment. Code that is running at the firmware level may not be detected, stopped or removed by antimalware software.

As this malware cannot be simply overwritten, once a device is infected, the hardware must be either replaced or sent back to the factory to reinstall the firmware.

Cyber analytics drives more data-driven decisions

Organizations are starting to understand the importance of using data to improve business decisions. Operational data can give insights about potential growth and cost-savings opportunities, and how to optimize business process.

Security operations, like other parts of business, are harnessing operational data to understand how business events tie to security events. Organizations can use cyber analytics and AI to predict when and where attacks are most likely to occur so they can then focus their investments to achieve the greatest protection.

AI systems must target aspects of operations unrelated to security that can be correlated with past security events. For example, an AI system might determine that most attacks occur 3 days before quarterly financial results are due to be publicly reported. With that information, organizations can proactively bolster security protections prior to the next public disclosure.

In 2021, such pre-emptive knowledge will help organizations plan ahead. However, to succeed they must thoroughly analyze and understand all the data they collect about operations and business behavior.

Thankfully, 2020 is behind us, but new threats await. Protecting enterprises this year will require new cyber defense strategies and tactics, and better threat intelligence.

Digital Security Strategy’s guiding concepts

Posted on 08/08/202009/06/2021 by Tushar

Digital transformation represents the greatest opportunity for the enterprise in the 21^st century. CEOs across the globe have digital innovation on their agenda as they seek to deliver innovative new business models, create new digital customer experiences, and optimize and automate their processes to enhance business performance.

BUT…digital technologies and the rapid pace of change in a digital world also threaten the enterprise through a growing cyberthreat landscape with a widening attack surface that exploits the very same digital technologies being used to transform the business.

To prevent cyberattacks from derailing your digital initiatives, we need to build security into the very fabric of the digital enterprise. Delivering secure digital transformation is about building security into the digital core platform which is the foundation for how we transform the business…put simply, we must become “Secure to the Core” and have a consistent framework for digital security transformation.

Deploying the right Cyber Defense

One of the key imperatives for secure digital transformation is the ability to monitor every aspect of technology (both IT and OT) across the business. In short, we need to Monitor Everything.

The modern enterprise requires a plethora of security tools to secure their infrastructure and endpoints (networks, firewalls, servers, storage, devices, applications, data, etc). These tools generate an enormous volume of data each day, making it almost impossible to identify and respond to true cyberthreats in a timely manner.

Intelligent Security Operations can detect threats quickly, respond to attacks rapidly, and defend the enterprise from security breaches by applying intelligence and automation to handle the enormous volume of incidents we see across the globe.

To ensure a secure core, Anteelo’s approach is to provide next-generation digital services with a high degree of automation through a Security Platform that applies lean process, deep analytics and intelligent automation to the security information and event management (SIEM) process.

We often describe the underlying technologies within this platform as SOAR (security, orchestration, automation and response).

IDC, meanwhile, describes these cybersecurity technologies as AIRO (Analytics, Incident, Response, and Orchestration). The AIRO technologies trace what is required in the Security Operations Center (SOC) to protect the enterprise network through to threat detection and formal remediation.

Whether your approach is “SOAR” or “AIRO,” either way we must apply automation and orchestration to cyber defences in order to keep up with the sheer volume of data and incidents generated across a wide array of infrastructure and endpoints.

In addition to monitoring everything with SOAR (or AIRO), we also believe in two more critical imperatives that are needed to secure the enterprise: Verify Everything and Encrypt Everything.

Verify Everything is about adopting a zero-trust approach to digital identity and access management. Enterprises engaged in digital transformation need a new approach if they are going to thrive in the digital world. The principle for security is no longer about the “where” it’s about the “who.” Success requires a comprehensive focus on digital identity management. Identity and access management can effectively establish a logical perimeter that enables digital transformation. The right identity and access management solutions prevent unauthorized access to enterprise information using multiple authentication methods with user access management and provisioning.

Privacy by Design

Encrypt Everything is about minimizing the risk of unauthorized or unlawful processing of business-critical data and avoiding accidental loss and destruction or damage to data. All sensitive data requires encryption and/or tokenization using trust services (PKI, certificate and key management), encryption solutions, and rights management. The right data protection and privacy solutions encrypt sensitive data and prevents data loss from malicious cyberattacks.

So, to enable your digital transformation journey, remember these three key security principles: Monitor Everything (with cyber defense solutions), Verify Everything (with digital identity solutions) and Encrypt Everything (with data protection solutions).

Where should new security tools be deployed initially for maximum impact?

Posted on 12/07/202009/06/2021 by Tushar

You have your eye on a new piece of security technology or service and you want to evaluate it before deciding whether to commit to the effort of a full deployment. Alternatively, you may already be committed to full-scale deployment but wondering where to start. So where should you deploy it first to test it most effectively and have the greatest impact?

Human nature, caution and conventional wisdom dictate that you should put it in a lab environment or in a low-importance section of your network. That is sensible, isn’t it? The change board will give you less hassle and if there is a problem, you are going to get less flack, aren’t you?

But will that approach give you most information and practical experience about the new system’s deployment difficulties, effectiveness in your environment and what it will detect? Will it give you the maximum protection as soon as possible?

Any tool that gives you fresh insight on the behavior of your systems tends to find something interesting. Those of us who have deployed such things have the stories to go with them – from mundane discoveries such as finding that all servers in one network had the wrong DNS settings and were thus being slowed down, to critical detections of previously unobserved persistent attackers.

However, there is an argument to be made for deploying this new tool on your production systems, close to your crown jewels. These are the things you really want to protect and the environment in which it really needs to work. Yes, this approach is higher risk, but it is also higher benefit. Will a deployment on a low throughput, obscure bit of network really tell you much? On the other hand, couldn’t one real detection on your primary systems during the evaluation period convince you and your management of the system’s value?

Granted, this may not be a sensible suggestion for inline systems that process all traffic, but with the right technology it can work. Many security technologies monitor traffic and provide alerts rather than enforce actions — or at least they have a mode in which they can act in this way. A new security solution deployed on a span port or network tap may actually pose more risk to production traffic in terms of confidentiality than in disruption or performance. It is also easy to turn off or detach such solutions by removing the span connection. Other security tools rely on collecting logs from your existing devices. Building an architecture that allows forking and diverting the streams of log events can support easy introduction of such types of new security tooling.

As an example, consider the evaluation of a new security monitoring tool, perhaps one with user and entity behaviour analytics (UEBA). Will you get much information from deploying it on a test/staging environment that will typically have a small number of users and occasional traffic? Or would you get a better sense of its value from connecting it to your production active directory, primary applications and remote access system? Wouldn’t that give you a better idea of how easily it can be connected, how well it copes with actual production loads and whether it can really differentiate between normal and suspicious behaviour?

Designing taps such as those mentioned above into your network and log architectures future-proofs your environment, making it easier to evaluate other products down the road and deploy them into final production. It can also help in emergencies, as incident response teams wishing to deploy their tooling will be looking for very similar facilities overseeing your most critical systems.

So next time you have a new security system to test, think about ignoring conventional wisdom and throwing (some) caution to the wind. Sometimes the radical step is the right one. Deploying security tools on your crown jewels first may be the optimal approach.

Crucial ways by which Continuous Delivery improves your Security posture

Posted on 10/07/202009/06/2021 by Tushar

Continuous delivery yields a host of IT and operational benefits, including proven competitive advantages like faster deployment times, responses to customer feedback, and bug fixes. But one aspect that tends not to make it on the marquee list of benefits — and should probably be headlining it — is security.

It’s really quite simple — with continuous delivery, cruical security enhancementst, updates and fixes to applications can be pushed live in a quick and timely manner to get the enhanced security into deployment. What could be better than that?

Traditional slow and batch-oriented waterfall approach

Typically, in the traditional ITSM approach, when a security incident happens, it is captured and consolidated with other requirements to be addressed in the next application release. Sometimes an urgent patch release can be delivered sooner, in a few weeks – if it can rapidly progress through the cycle of fix, regression testing, release preparation, release testing and maintenance. But if the fix requires a major release, it could be many months until it can be made available, and in most cases, the only thing you can do in the meantime is document the incidents.

That’s too slow.

A better, faster way — continuous delivery and DevSecOps

A modern service management approach combining continuous delivery and DevSecOps supports the core tenets of information security: data confidentiality, integrity, and availability. A dedicated team provides continuous delivery by making small or incremental changes every day or multiple times a day. DevSecOps secures the continuous integration and delivery pipeline, as well as the content that’s coming through that pipeline.

You gain three key advantages:

Speed. Continuous delivery and DevSecOps dramatically improve security because they allow malicious attacks and bugs to be addressed as soon as they’re identified, not just added to some logbook. And in many cases, the window for action falls from between six and eight weeks down to minutes. Thus, far fewer incidents become problems that impact IT and business operations.

Consistency. IT teams working under traditional ITSM often worry that the continuous delivery and DevSecOps approach will create more opportunity for mistakes and bugs because more changes are happening more often. In practice, the exact opposite is true.

Flexibility. A DevSecOps approach simplifies the introduction of blue/green canary releases — implementing a new release while continuing to operate the prior release — into your delivery capacity. This allows you to redirect modest amounts of traffic to your new release, facilitating the identification of potential issues without drastically impacting many users. It also lets you rapidly shift all traffic back to the current release should a problem be identified.

The modern approach offers a variety of powerful tactics for quickly countering attacks. For example, workloads can be designed to move between cloud providers using Pivotal Cloud Foundry, containers or other homogenizing technology that offers the flexibility to move systems from one cloud provider to another. If there is a big denial of service attack in one provider, you could redeploy to another provider or back to a private data center with the click of a button. If an attack is focused on a particular IP, you recreate the environment at a new IP and block the other one completely. Structuring applications in this kind of push-button deployment mode creates opportunities for all sorts of similar scenarios.

How to move forward

Realizing the security benefits that come from implementing continuous integration and DevSecOps may require a deep, cultural change in the way your company builds and delivers software. Increasingly, security will become a secondary competency of developers, with risk ownership devolving from the central security team to application owners. In this new mode of operating, we need to make sure the right guard rails are in place and that the central security team provides necessary mentorship and support.

It’s a challenge, no question. But worth the rewards.

Successfully navigating some of these changes is explored in a recent post called “How to jump start your enterprise digital transformation.” A seven-page paper, DevSecOps: Why security is essential, is another good resource.

Self-Sovereign Identification raises the value of Data shared in an Ecosystem

Posted on 09/07/202009/06/2021 by Tushar

As organizations focus on data-driven business models to remain competitive, they will increasingly seek to collaborate with partners and exchange data. Data shared in an ecosystem is more valuable than data locked in a silo because it leads to new innovations and customer experiences. This trend is playing out in many industries including transportation, logistics, energy, manufacturing, healthcare, telecommunications and financial services. The effort of maintaining countless data repositories has made data acquisition very expensive, causing a drag on the overall competitiveness of an industry, not to mention the additional burden of adherence to the General Data Protection Regulation and personally identifiable information standards with respect to handling personal data. In the case of autonomous cars, for example, there is so much data to be had — and so much needed — that pooling it makes sense to get a sufficient amount for R&D in as timely and cost-effective a manner as possible. This moves the entire industry forward. Through a combination of internet of things, artificial intelligence, and distributed ledger technology (DLT) we will see auto manufacturers, fleet operators, OEMs and end users willing to share and exchange data as digitized assets through data marketplaces, enabling the players to benefit from new offerings based on the transparency and monetization of shared data.

Shifting from cars to mobility services

In the automotive industry, the market is shifting from selling cars to providing mobility services. A DLT-based system, combined with self-sovereign identity, makes it straightforward to build a mobility ecosystem where it’d be easy to enable new ways to engage with customers and partners, leveraging trusted and safe data exchange. For example, make it simple for customers to get the best deal on car financing (no need to re-enter their personal details to get approval at each dealership). Make customer interactions seamless by having customer history (i.e., loyalty data) immediately available with the customer’s explicit consent, without the need to store this data at each dealership or at a car manufacturer.

A trusted and verifiable data-enabled mobility ecosystem helps companies offer new services, such as car-sharing or car-exchanging that can involve dealers, for example, as drop-off and pick-up locations. This includes making the process of verifying auto insurance and driver qualifications seamless.

If I’m on vacation and don’t need my car, I can share it, or if I drive a compact car and need an SUV for a few days, I can connect with the ecosystem and benefit from this shared economy. In addition, the revenue I collect from the shared vehicle could be applied to a down payment on a new car.

Dealers benefit too. They can offer inspecting and cleaning services for the shared cars, and they get potential new customers at their location. Car makers benefit because they can grow their brand’s value and get insights into car usage.

Controlling identity, unblocking consent

Empowering an individual or an asset to control one’s own identity is a precursor to companies’ reaping the benefits of pooled data. Through self-sovereign identity, an individual will be able to consent, authenticate or verify themselves without having to present their documents. Users can access third-party-owned products and services while keeping their anonymity.

Many organizations and consortiums are contributing towards the establishment of open source decentralized identity to achieve interoperability among all participants, set protocols, and develop technologies and code in areas including decentralized identifiers (DID) and verification, storage and compute, authentication, claims and verifiable credentials. The focus of these efforts has been to decouple the trust between the identity provider and the relying party to create a more flexible and dynamic trust model such that the ecosystem benefits from increased market competition and customer choice.

In 2020, we expect to witness deployment of self-sovereign identity to unblock consent, which will help organizations leverage inaccessible data sets without breaching privacy regulations. This will facilitate decentralized data marketplaces that provide a level playing field for all market players by enabling any of them to monetize data. It allows for improved and customized offerings, thus setting higher standards and increasing the overall value of the ecosystem.

The Biggest Cybersecurity Threats for 2020

Posted on 10/06/202015/06/2021 by Tushar

Cybersecurity has continued to be a major issue throughout 2019 and as organisations begin to rely even more on IT, it remains a serious concern. While most companies are by now aware of how important cybersecurity is, many have yet to implement the necessary measures needed to adequately protect them. In this post, we’ll look at what security threats 2020 is likely to put in their way.

1. Lack of cybersecurity education

Perhaps the biggest cyber threat to any business is the lack of knowledge and understanding within a company about cybersecurity. Today, the digital revolution is affecting the working practices of employees throughout companies big and small. With more and more employees using connected technologies as part of their everyday jobs, it is more important than ever to ensure all staff are aware of what cybersecurity risks they face and how they can work in a way that will enhance security.

In 2020, expect to see more organisations putting cybersecurity strategies into place that include ongoing training for staff on the latest technologies and threats and, importantly, letting them know how to work responsibly and respond to incidents.

2. The threat of data breaches

The enormous value of personal data to the criminal underworld means that data is a principal target for hackers. As a result, the threat of a data breach will continue to be one of the biggest issues that businesses will face in the coming years. This means companies will need to ensure personal data is secure end to end, from the moment it is sent to them to its safe disposal. The use of SSL certificates, encrypted data storage, logical access, password management and the rapid patching and updating of web applications is vital in this area.

For those who succumb to a data breach, tough fines, reputational damage and even lawsuits await.

3. Skills shortages

The complex nature of cybersecurity means that increasing numbers of organisations are employing the services of highly-skilled, security experts. Unfortunately, as these professionals are in short supply, there is a considerable skills gap in many companies just at the time when the need is the greatest.

In response, many companies are now implementing the use of intelligent, automated security tools that use advanced technologies to scan and block attempted intrusions, infections or other forms of attack like DDoS. These services can often be delivered by your service provider.

4. Leaky clouds

The majority of enterprises use the cloud for at least part of their IT solution and it is increasingly becoming popular as the place to store data and run operational processes. However, its popularity has not been kept a secret from cybercriminals and the number of cloud-based threats has continued to rise.

In 2020, companies will need to maintain the security of critical data and make sure they have real-time threat intelligence in place, to minimise the risk of data breaches or critical operations being taken offline.

5. Mobile device risk

For many employees, the smartphone is now an essential work tool used not only to access the company system but to store important data. This puts organisations at risk from poorly secured connections, mobile malware and device theft. It is critical, therefore, that all mobile devices that can be used to access the organisation’s systems are secured. One solution is to ensure access is carried out via a secure web app.

6. IoT vulnerability

Mobiles aren’t the only remote devices that are vulnerable to attack; perhaps even more at risk are the IoT devices which have proliferated in use over the last few years and on which many organisations increasingly rely. They present a plethora of potential vulnerabilities that organisations need to protect themselves from, such as insecure wi-fi connections, hard-coded credentials, unverified firmware and unencrypted data. In addition, a compromised router or network attached storage server gives an attacker access to data and can serve as a platform to launch more attacks. In 2020, organisations which use the IoT will need to look carefully at how to ensure these vulnerabilities are protected against.

7. Rogue states

It is not just cybercriminals that are out to steal data and cause chaos, unfortunately, some governments are at it too – and these rogue states will have more advanced technologies, IT expertise and financial backing than the average hacker.

While cybercriminals are usually financially motivated, state-sponsored attacks can have a number of purposes, such as causing major security breaches to undermine companies, taking critical services offline using a DDoS attack, industrial or political espionage, spreading fake news to influence elections and even taking those who oppose them offline.

State-sponsored cybercrime is the new cold war and while major companies, public utilities, defence and political organisations are particularly at risk, all organisations need to be aware of their risk of attack and how to protect themselves.

8. Intelligent malware

The war between cybercriminals and cybersecurity teams isn’t being carried out simply by the human brain anymore. Both camps are now using artificial intelligence (AI) and machine learning as tools in their armoury. Unfortunately, this means that cybercriminals are now able to create extremely sophisticated malware and methods of attack and at a pace that cybersecurity companies are finding challenging to deal with. It may only be a matter of time before one of these stealthy attacks strikes with devastating effect.

Conclusion

In 2020, cybersecurity will continue to challenge organisations big and small. We’ll see persistent risks like data breaches remaining high on everyone’s agenda, while the development of new technologies brings new threats, such as intelligent malware and IoT vulnerabilities. As companies expand their use of IT, we’ll also see a need to protect the cloud and mobile devices while ensuring that there are highly skilled IT experts driving security strategies and educating everyone else how to stay secure.

Better using AIRO in security operations-For Analysts

Posted on 08/03/202015/06/2021 by Tushar

The traditional security operations model is rapidly succumbing to the challenges and dynamics inherent in today’s cybersecurity market. Over the last few years, organizations have deployed a myriad of security technologies to combat specific threats, and as a result have inherited a collection of point product solutions with very little interoperability. This has made it difficult for operation teams to leverage these technologies as a common fabric for threat identification, correlation, detection and remediation activities.

This has also increased the amount of time it takes to detect and remediate a security breach. On average, it takes organizations nearly 6 months to detect a breach and another 2 months to remediate it. While organizations continue to operate in a reactive mode to security threats, the goal is to move to a model that is much more proactive and predictive in nature.

Compromising this goal is the lack of skilled security expertise needed to perform identification, detection and remediation activities. The talent shortage is most pronounced for Level 1 analysts in the security operations center (SOC), the “first responders” that must sift through volumes of data and determine which alerts require immediate action.

Attackers are using sophisticated approaches to exploit vulnerabilities, and the volume and velocity of known and unknown attacks continue to rise. Organizations still demand “eyes on glass” to detect and respond to security threats, but the volume of attacks originating from multiple threat vectors, and the skills challenge they face has created a scale issue where level 1 SOC analysts are overwhelmed with the amount of data that must be analyzed. In some cases, SOC analysts are dealing with petabytes of data. In addition to the scale problem, the incoming data lacks context, which makes the task of prioritizing suspicious behavior for further investigation another challenge for SOC analysts.

The Business Benefits of AIRO

To effectively address these challenges, organizations must adopt a new approach for SOC operations that addresses the need to handle the volume of data and alerts more effectively. A move toward an intelligent SOC that utilizes AI, Automation, Incident Response and Orchestration (AIRO) to increase productivity and efficiency of SOC analysts and accelerate the time to detect and contain a security breach is directionally where the market is headed. AIRO consists of the following components:

Analytics: Driving contextual insight into threat dynamics
Intelligence: Collecting and indexing sources of information
Response: Initiating the proper response based on the nature of the security threat
Orchestration: Coordinating multiple toolsets to mitigate a threat and harden the network

Using AIRO tools, organizations can better leverage existing investments in security technologies by utilizing APIs to interconnect various platforms and correlate data from firewalls, IDS sensors, endpoint devices, and external threat intelligence feeds. AIRO tools complement an existing security information and event management (SIEM) tool by acting as middleware to integrate with existing tools and provide greater visibility into indicators of compromise. This becomes increasingly important as corporate data moves from endpoint devices to on-premise infrastructure and multi-cloud environments.

AIRO tools ingest alerts from the SIEM and automate the responses to repetitive alerts, freeing up security analysts for the more challenging alerts that require human intervention. The tool should also provide valuable contextual information — such as asset information and threat enrichment data — to effectively improve the security analyst’s decision-making ability by prioritizing threats that represent the most risk to the organization.

In today’s complex environment AIRO tools can make security analysts’ work more efficient, less burdensome and more accurate by leveraging automation, analytics and orchestration. By ensuring proper integration and interoperability with existing security technologies and centralizing visibility on a security platform, security operations teams can gain greater insight and move from a reactive security posture to a more predictive and preventative approach.

Cybersecurity for Remote Work: 10 Ways to Boost It

Posted on 01/03/201921/06/2021 by Tushar

Many companies use cloud-based platforms that enable their employees to work remotely, whether from home or out in the field. While this brings benefits to both the company and its employees, it does create challenges which need to be addressed for the company’s systems and data to remain secure. Here, we’ll look at the best practices to ensure cybersecurity for your remote employees.

1. Vet your employees

If you are going to keep your data and systems secure, you need to know that the people who have access to it are trustworthy. Vetting employees can highlight anyone with a background that makes you think twice about giving them access. This doesn’t merely relate to someone’s criminal history; it also means looking at employees who have a record of flouting the company’s IT policy.

2. Train your employees

All employees can pose a security risk if they do not understand how to keep your system and data safe. While most companies undertake cybersecurity training for their staff, there are differences between using an in-house system which is not connected to the internet and a remote system which is. If you have recently begun to implement remote work, you will need to update your training to cover the new procedures and best practices that your employees need to follow.

3. Store remote user data securely

If a hacker gets hold of information about your employees, such as their usernames, passwords and privileges, it makes it very easy for them to undertake even wider and more damaging hacks. For this reason, the data you keep on these employees should be stored very securely.

4. Provide your own devices

While many companies operate a Bring Your Own Device (BYOD) policy, this gives you far less control over security. As the device your staff access your system with is also for personal use, you are unable to manage how that device is used or even who it is used by. If your employee lends their laptop to their child who unwittingly clicks on a malicious link, your data may be put at immediate risk.

Although it is more expensive, providing your own devices means you can set up firewalls and security settings in-house, install antivirus and internet security, and ensure that the employees are obliged to follow security protocols when using the devices.

5. Know where devices are

One of the biggest issues with remote work is that lots of devices get lost. Even the UK government lost over 2000 devices in the year up to June 2019, nearly 800 of which belonged to the Ministry of Defence. For this reason, devices must be fitted with a location finder, be securely locked and, where possible, be set up for remote deletion.

6. Secure internet connections

Where your employee connects to the internet can also be an issue. Public wi-fi hotspots, for example, can be easy to hack into and this makes it possible for data transmitted across them to be stolen. Although you may insist employees do not connect from an insecure connection, you can further increase security by preventing company data being accessible when the device is not logged into a secure network.

7. Encrypt data and emails

Encryption prevents data from being stolen when it’s in transit or at rest, so even if a hacker gets to the data, they will not be able to access it. Using VPNs, SSL and TLS are important ways to protect your data, as are Personal Signing Certificates that encrypt emails and their attachments.

8. Two-factor and multi-factor authentication

No matter how unique and strong username and passwords are, on their own, they are not robust enough to guarantee that whoever is logging in to your system is who they say they are. Adding further levels of security, such as a passcode sent to a user’s mobile phone or a biometric fingerprint scan, offer a far greater degree of authentication that can prevent hackers from getting access.

9. Control access privileges

Limiting what employees can access on your system also limits what a cybercriminal can access if they hack into an employee’s account. By setting privileges so that employees only have access to the information they need to carry out their remote work, you minimise the risk of data being stolen or the system being taken down.

10. Use a secure cloud provider

Your cloud provider can provide significant help in keeping your system and data safe. At Anteelo, our team can develop and implement a security policy that meets both your internal and regulatory requirements. We use next-gen FortiGate firewalls with built-in intrusion prevention systems and in-flow virus protection, while also offering extensive VPN features, server and network monitoring, personal signing and SSL certificates, application firewall configuration, DDoS protection, email security, industry-leading remote, encrypted backups and more.

Conclusion

Remote work provides companies with opportunities to save money, improve collaboration, offer flexible working conditions and cope with crises like Coronavirus. However, it is critical that systems and data remain secure. Hopefully, the ten points raised here will show you ways that such security can be put in place.

In 2019, new cyber security threats are predicted to emerge.

Posted on 23/01/201919/06/2021 by Tushar

Cyber security remains a major issue for all organisations and 2019 will continue to prove challenging. Expect to see more large-scale data breaches, new forms of malware and the continuing plague of ransomware attacks. In addition, we need to prepare for threats to Internet of Things devices and attacks on infrastructure, such as banking and payment systems and public transport. Perhaps more worrying than these are the unknown, emerging threats that are on the horizon. Here weâ€™ll look at four you should be wary of.

AI versus AI attacks

Artificial intelligence is being increasingly used by all manner of businesses and in a wide range of ways. Crucially, it is a key tool for cyber security firms which use AI models to find better ways to defend our systems.

Unfortunately, AI is also available to cybercriminals who now use it to counteract the work done by security companies. This is carried out using a generative adversarial network (GAN) which creates a situation where two neural networks compete against each other to discover the AI algorithms each is using. If the cybercriminals discover the algorithms being used by cyber security companies, it gives them a much better understanding of how to evade being detected.

Indeed, these increasingly sophisticated hackers can use AI and machine learning to infiltrate the data sets used by security companies, for example, injecting malicious code and modifying labels, so that threats can be re-identified as safe.

Fake media exploitation

Most people are now aware of the problem of phishing emails where criminals send fake messages to employees in the hope of conning them into giving away important data, access details or, in some cases, getting them to transfer money to the criminalsâ€™ accounts.

While many of us have learnt to spot the tell-tale signs of most fake emails, advances in artificial intelligence have now produced an entirely new and potentially much more difficult to spot threat – fake video and audio messages. Simply by analysing online images, video and voice recordings, AI-enhanced software is now able to create highly realistic video and audio that can fool even the most cautious of viewers. In the video below, youâ€™ll see how this is done.

As you can see from the video, even the creator of this technology has concerns about how it can be used for malign reasons. Cybercriminals with access to it can deliberately spread misinformation that can have a devastating impact, for example, making statements purporting to be from a leading CEO that affects stock market volatility. Criminals can also use the technology to send fake video and audio messages to employees and customers that con them far more easily than a phishing email.

For now, this technology is difficult to use and expensive to own. However, it wonâ€™t take long before itâ€™s available for use on the average laptop or even as a phone app. Luckily, as the video shows, there are efforts in place to develop technology that can detect these fake videos. For the time being, it is important to remain vigilant.

A quantum leap in encryption cracking

Understanding the bizarre world of quantum physics is a challenge even for the most gifted of scientists. However, we are now at a stage where quantum computers are being developed that have the processing power far beyond that which we have ever been able to produce before.

With such potent technology, experts believe that cybercriminals with access to quantum computers would be able to crack the encryption we currently use to protect data. While it is possible to create even more secure encryption to combat this in the future, the problem lies with technology that is already in use. Products like TVs, vehicles and phones, together with many IoT devices, which are going to be around for quite a few years and which have todayâ€™s levels of encryption built in, may become far easier to hack in the future.

Smart contract hacks

Blockchain technology is increasingly used in business because it offers both transparency and the security brought by encryption. One way in which it is used is for smart contracts, where apps housed on blockchain automate processes when the right conditions are met, for example, carrying out financial transactions or delivering intellectual property.

While blockchain has a potentially very useful role to play, this relatively new technology still has issues. One of the concerns is that the inbuilt transparency of blockchain makes it difficult to keep smart contract data private. This vulnerability has already been exploited by cybercriminals who have used it to get their hands on large amounts of cryptocurrencies.

Conclusion

As you can see, in 2019, the new cyber security threats are far more sophisticated than ever before, using technologies such as artificial intelligence, machine learning and quantum computers to launch their attacks. They are also finding new things to attack, such as the media, blockchain and even other AI models. With this in mind, 2019 is certainly a year to keep security threats as a priority in your organisation.

How it works

Defending against card skimming

Zero Trust becomes more relevant than ever

Remote working is your new threat vector

5G wireless offers new opportunities, enables new threats

Ransomware moves one step ahead

Cyber analytics drives more data-driven decisions

Deploying the right Cyber Defense

Privacy by Design

Traditional slow and batch-oriented waterfall approach

A better, faster way — continuous delivery and DevSecOps

How to move forward

Shifting from cars to mobility services

Controlling identity, unblocking consent

1. Lack of cybersecurity education

2. The threat of data breaches

3. Skills shortages

4. Leaky clouds

5. Mobile device risk

6. IoT vulnerability

7. Rogue states

8. Intelligent malware

Conclusion

The Business Benefits of AIRO

1. Vet your employees

2. Train your employees

3. Store remote user data securely

4. Provide your own devices

5. Know where devices are

6. Secure internet connections

7. Encrypt data and emails

8. Two-factor and multi-factor authentication

9. Control access privileges

10. Use a secure cloud provider

Conclusion

AI versus AI attacks

Fake media exploitation

A quantum leap in encryption cracking

Smart contract hacks

Conclusion

Delivering excellence, collaborating across time zones.

Take a look at our global hideouts.​

Contact

India (HQ)

Atlanta, USA

London, UK

Dubai, UAE

Melbourne, Australia

Surabaya, Indonesia

India (HQ)

Atlanta

London

Dubai

Australia

Indonesia

Take a look at our global hideouts.