• Search for:
    15Aug, 2024
    Kicking cyber security down the road can come back to bite you

    The consequences of a successful cyber attack can be disastrous. They can lead to untold operational disruption from substantial financial loss to significant reputational damage. Yet despite the clear and present danger, some businesses continue to deprioritize cyber security, with a concerning 15% failing to invest in cyber security measures. Whether this is a calculated decision or a matter of managing risk, it exposes the businesses’ data and processes to attack.

    Large corporations like Microsoft and AT&T, both of which recently experienced cyber breaches, are particularly vulnerable. These very public incidents can feed the perception that small and medium-sized businesses are unlikely to be targeted by cybercriminals. However, this does not ring true when compared to a recent government survey which showed that 45% of medium-sized businesses, and 50% of all companies in the UK, have suffered some breach or cyber attack in the past 12 months.

    For these smaller businesses, implementing simple security procedures is a strong start. Some quick market research can also highlight that engaging with the right managed services provider (MSP) can be a cost-effective way of enhancing security and reducing cyber risk. Despite this, convincing business leaders to invest in cyber defenses can be an uphill battle – even if decisions to delay only amplify the risk. Turning a blind eye could lead to devastating consequences.

    An overshadowed priority

    Despite a shared understanding of cyber threats among security leaders and the C-suite, cyber security often gets overlooked. The root of this lies in a misalignment of priorities. Immediate business concerns like revenue growth, market expansion, and customer acquisition overshadow cyber security, which has historically been viewed as a cost center, rather than a revenue driver.

    This misalignment relegates security measures to a secondary issue, to be addressed only after a breach occurs. Alarmingly, a third of security leaders only prioritize cyber security expertise after an attack has happened.

    This reactive approach to cyber security is fraught with risk. Neglecting proactive cyber security measures can lead to a raft of negative consequences, including financial repercussions. The immediate costs from a breach might include ransom payments, remediation expenses, and legal fees, while long-term impacts can involve lost business, regulatory fines, and increased insurance premiums.

    Staff retention can also take a hit following a cyber attack – over half of employees indicate they would leave companies that have suffered from a breach. They are often driven by insecurity about the company’s future or frustration over inadequate security measures, leading to higher turnover rates.

    The repercussions also extend to business relationships. Larger or partner companies, particularly those with stringent security standards, may be unwilling to engage with businesses that fail to meet their security expectations, limiting opportunities for growth and collaboration. Similarly, the same could be said for potential customers who might shy away from businesses that have suffered a breach, further isolating the business from lucrative partnerships and contracts.

    Securing buy-in

    To ensure cyber security is prioritized, it is vital to convey to the C-suite the very real implications of not mitigating cyber security risks. The most effective way to get this message across is by using business metrics to show the potential financial impact of cyber attacks.

    Presenting case studies of similar organizations that have suffered financial losses from breaches and providing relevant statistics showing the financial and reputational cost can be very powerful to enhance your pitch. It is also key to highlight the benefits that strong cyber security affords a business. This includes building customer confidence, reputational protection, regulatory compliance, and financial security.

    Starting with baseline measures can help secure initial support from the C-suite. Simple steps, such as regular software updates, staff cyber awareness training, and using Endpoint Detection & Response (EDR) tools to quickly identify threats like ransomware can substantially reduce exposure to cyberattacks.

    Even simple changes to a company’s security posture can have long-lasting effects. Many threat actors and hackers are looking for easy targets – companies with exposed vulnerabilities. For example, one of the most common breach points is overlooked or underestimated aspects like poor password security.

    Since the human factor is such a large part of attacks, regular cyber awareness training sessions for all employees help to build a foundational understanding of cyber threats and safe practices. When everyone in the organization is vigilant and informed, the overall security posture is strengthened. For password security in particular, companies can also implement multi-factor authentication tools to ensure employees accessing the network are who they say they are.

    There is a myriad of cyber security tools out there to help secure your systems. Wading through the industry jargon can be tough and is often a daunting task. Tools such as Network Detection and Response (NDR) and Security Incident and Event Management (SIEM) require teams of specialists to constantly monitor and modify settings to maximize efficiency. Achieving this in a small and medium-sized business can be difficult and expensive. This can be overcome by partnering with an MSP who can provide expert advice and technical support to deliver a comprehensive security solution to your organization.

    It is time to implement cyber security measures now

    By deprioritising cyber security, businesses are essentially deferring costs. Every organization accrues a cyber security debt, which can be managed in two ways: it can either be paid upfront through continuous support and rigorous cyber security measures, or it will inevitably be paid later, often at a much higher cost when a breach occurs.

    A proactive approach to cyber security that adopts even simple cyber security solutions can better protect businesses from the risk and cost of a breach and help them build a reputation as a secure and dependable partner.

    Investing in cyber security today is not just about avoiding future costs; it’s about ensuring the long-term success and sustainability of the business.

    Ref: Link

    14Aug, 2024
    Delta vs. CrowdStrike: The duties vendors owe to customers – or do they?

    In a potentially groundbreaking dispute, Delta Air Lines is threatening to sue CrowdStrike, a leading cybersecurity firm, for alleged negligence and breach of contract. This case brings to the forefront critical questions about the duties vendors owe to their customers in an increasingly digital world.

    As cybersecurity threats evolve, the expectations placed on vendors to safeguard sensitive data and maintain robust security measures are higher than ever, but these vendors cannot be responsible for every aspect of their customers’ environments. How can cybersecurity vendors and their customers balance these responsibilities effectively and minimize risk?

    The dispute

    At the end of July, Delta’s CEO indicated that the CrowdStrike-Microsoft event cost the airline $500M because the IT outage stranded thousands of customers and caused them to cancel more than 6,000 flights. This cost includes not only lost revenue but also “the tens of millions of dollars per day in compensation and hotels” for delays stretching over a period of six days.

    Delta states that they have no choice but to seek damages from CrowdStrike for the disruptions due to the high costs incurred by the outage. Delta expected all technology deployed in their ecosystem to be thoroughly tested before release into their mission-critical environment. Unfortunately, CrowdStrike’s testing did not identify the issue.

    Do the legal arguments hold?

    Media reports thus far indicate that Delta believes CrowdStrike was negligent, which they argue is shown by the seemingly weak initial CrowdStrike apology. Delta had to manually reset 40,000 servers to resolve the issue and took longer to bounce back to normal operations than its competitors, sparking an investigation by the US Department of Transportation’s Office of Aviation Consumer Protection. That investigation may result in additional costs for Delta on top of the reputational hits the airline has already endured.

    CrowdStrike, on the other hand, argues that Delta’s claims are meritless and emphasizes their own efforts to appropriately assist vendors with recovery from the outage, satisfying the cybersecurity company’s duty of care to its customers and vendors in the event of a systems failure. If CrowdStrike is found to be negligent in its performance of the Delta contract, a court could declare that the damage caps in its contract moot, thus entitling Delta and other similarly impacted CrowdStrike customers to a much larger financial recovery.

    It remains to be seen whether Delta will file a lawsuit, but such a case may be difficult to win, particularly if CrowdStrike can show that it reasonably fulfilled its contractual obligations. In some respects, the negligence argument is analogous to claiming that a sprinkler system provider should ensure a building can never have a fire, highlighting the unrealistic expectations sometimes placed on cybersecurity vendors.

    This event highlights the challenging dynamic for Delta and any other CrowdStrike customer seeking damages, even though the incident made it impossible for them to operate their business effectively. Incidents like these are a harsh reminder that accidents, just like cyberattacks, can have serious impacts, and customers may still be on the hook for losses.

    Responsibility includes accountability and trust

    Regardless of the allegations from Delta, CrowdStrike appears to be holding up to its responsibility as a cybersecurity vendor. For example, this past week the company released a root cause analysis of the incident detailing the lessons learned, including how they are improving their process and identifying steps to enhance resilience.

    Without question, a lot of things went wrong on July 19. This public volleying between CrowdStrike and Delta highlights the challenges for cybersecurity vendors and their customers in digital environments reliant on multiple integrations and interdependencies. To protect cybersecurity vendors and their customers effectively, both parties must hold themselves accountable and act as trustworthy partners in protecting against cyber and business continuity risks.

    4 ways to manage these risks

    Given the ever-present cyber risks and potential for downtime events that pose a serious threat to business continuity, it makes sense for companies to identify alternative ways to manage these risks.

    1. Understand how incidents like these can impact business and operations. It is now critical to fully understand how an outage could impact the business and enable internal teams to focus on impact mitigation strategies in addition to typical incident response.

    2. Know the status quo when negotiating contracts with vendors to the greatest extent possible. At the beginning of a vendor relationship, consider the impact if that vendor fails to the extent that the customer can’t deliver on its own business obligations. If Delta could have foreseen this event and its impact, they could have negotiated higher limitations of liability in the contract (although unlikely to come anywhere close to the $500M mark).

    3. Consider insurability. Based on various insurance industry estimates, it appears that insurance recovery for this event will only be a fraction of the total estimated losses. Additionally, many cyber insurance policies are designed to primarily cover malicious events, which this event was not. That said, coverage is available for losses of this type and companies should be reviewing their policies right now and seeking to amend coverage as desired.

    4. Evaluate whether it makes sense to have redundant or alternative capabilities in place in case of a vendor failure. It may turn out that entirely redundant capabilities are cost prohibitive or impractical, but by not at least considering the question and understanding the tradeoffs, the business is not fulfilling its own duty of care.

    A new shared responsibility model

    Minimizing risk requires vendors and their customers to work together. No cybersecurity vendor has control over the environments in which their solutions are deployed, but they can and must do their best to minimize the risk that their solutions, intended to protect their customers, do not cause massive IT outages.

    Customers, on the other hand, must maintain a modern IT infrastructure, stay up to date on available software patches, and be prepared for diverse risk scenarios. There is not a shared responsibility model defined for these types of relationships yet, but this may be the defining event that prompts one to emerge.

    Ref: Link

    10Oct, 2023
    List of Data Breaches and Cyber Attacks in 2023

    1. DarkBeam

    The three elements of information security are confidentiality, integrity and availability. In other words, data has to be reliable and up to date, and accessible only to those who need it.

    Instances of data being exposed to the Internet – more often than not via configuration errors – clearly breach the confidentiality principle, but are often viewed as somehow less serious than information that’s made its way into criminals’ possession via sophisticated cyber attacks or phishing campaigns, as if human error is less of an issue than criminal hacking.

    This is, of course, an erroneous position to take. Search engines such as Shodan – theoretically, at least – let anyone find anything that’s connected to the Internet, not just websites that are indexed by Google. This, obviously, includes opportunistic criminals as well as civic-minded security researchers who identify exposed services and warn their operators.

    This brings us to DarkBeam. According to Cybernews, the CEO of SecurityDiscovery, Bob Diachenko, discovered on 18 September that the digital risk protection firm DarkBeam had “left an Elasticsearch and Kibana interface unprotected, exposing records with user emails and passwords from previously reported and non-reported data breaches”.

    Diachenko informed DarkBeam, which closed the vulnerability immediately.

    Although most of the 3.8 billion exposed data records come from previous data breaches, ironically having been assembled by DarkBeam in order to alert its customers to security incidents affecting their personal information, the extent of the information held by DarkBeam, as well as the way it was organised, means anyone who managed to access it has the opportunity to create very plausible phishing campaigns.

    It’s not yet known whether anyone did access it but, as Benjamin Franklin said, distrust and caution are the parents of security. So, it’s worth checking your credentials via haveibeenpwned.com and taking the usual precautions, such as changing your password where it’s been reused, implementing multifactor authentication where possible and not clicking on any links unless you’re absolutely sure of their source.

    2. MOVEit

    As with last month (see below), the MOVEit breach continues to claim victims, among which the most significant – at least in terms of the number of individual victims – was Better Outcomes Registry & Network, which discovered that “personal health information of approximately 3.4 million people – mostly those seeking pregnancy care and newborns who were born in Ontario between January 2010 and May 2023” had been compromised.

    Other recently identified MOVEit victims include:

    The scale of the MOVEit breach remains unquantified, but some estimates now put the number of affected organisations at over 2,000 and the number of individual victims at over 60 million.

    It’s likely that we’ll continue to see breach disclosures related to MOVEit Transfer in the weeks and months to come.

    3. Undisclosed restaurant database

    The personal information of 2.2 million Pakistani citizens, including their contact numbers and credit card details, has been offered for sale online on the dark web for 2 Bitcoin. The data was apparently compromised when criminal hackers accessed a database used by more than 250 restaurants.

    Indolj – a popular food ordering app – has taken the step of denying any involvement, saying in a press release reported by Pro Pakistani: “We have conducted a detailed audit of the sample data and determined that the data records do not match the current transactional records of customers on the Indolj platform. Furthermore, Indolj does not store any credit card or payment-related information and therefore it is impossible for any customer payment data to be breached from our platform.”

    According to Geo News, the criminals provided a sample of the stolen data as part of their online listing, while naming “dozens of food outlets”.

    However, having analysed the available data, the security company CTM360 confirms Indolj’s analysis. In a comment published by Pakstani Pro, the company claims that the data in fact comes from a 2022 leak, and says it will continue to monitor the post “and will notify impacted organizations urgently if any credible data is released”.

    Resource : https://www.itgovernance.co.uk/blog/list-of-data-breaches-and-cyber-attacks-in-2023#:~:text=See%20the%20full%20list%20of%20data%20breaches%20for%20September%202023&text=September%20saw%20the%20biggest%20data,misconfigured%20Elasticsearch%20and%20Kibana%20interface.

    14Jul, 2023
    Red Team vs Blue Team: What’s the Difference?

    Red team cyber security assessments are a crucial way of giving organisations a practical understanding of their defence capabilities.

    In these exercises, the red team faces off against their counterparts, the blue team, in a battle to control a particular asset. That could be sensitive data, financial records, communication channels or the organisation’s infrastructure itself.

    Assessments can be adapted to suit particular requirements. However, the objective is always to learn how a cyber criminal might target your organisation in real life, and the steps that your security personnel would take to prevent attacks.

    But who exactly are the red and blue teams, and how can you conduct an assessment?

    What is a red team?

    Red teams are cyber security professionals who are experts in in the ways criminal hackers break through defences and steal sensitive data.

    Although these skills are often associated with criminal activity, they are also essential in cyber security. After all, you need to know how malicious hackers operate in order to anticipate their methods and block their attacks.

    Nonetheless, the read team acts as the adversaries in this assessment, and they will use their knowhow to try and capture sensitive information. Fortunately, there is no risk of a real-life data breach, as the ‘attackers’ are trusted personnel who agree not to abuse any data that they capture.

    This is a common practice in cyber security, with organisations often hiring ethical hackers or penetration testers to probe their systems in the same way that a criminal would.

    How a red team works

    The red team uses any number of techniques to look for and exploit weaknesses. This could mean finding technical vulnerabilities and flaws in the organisation’s processes, or duping employees with phishing attacks and other social engineering techniques.

    Typically, there are no limits on the actions that the red team can take. Anything that a cyber criminal might do is considered fair game.

    However, there might be times when an organisation asks the attackers not to perform certain actions. This could be, for instance, because it might disrupt regular business activities or because the organisation wants to focus on specific defence mechanisms.

    Red teaming usually begins with a detailed planning stage, in which the adversaries gain as much background information about the target as possible.

    They will start with the basics, such as the operating systems that the target uses, and the make and model of the networking equipment (such as computers, servers, firewalls and routers).

    In some cases, the red team might also look at physical controls, such as doors, locks, CCTV cameras and security, although most attacks are conducted entirely through digital means.

    With this information, the team will then look for vulnerabilities in those systems and create a map that outlines various paths to their destination. The techniques they use will vary greatly, but at some point, the attackers will usually attempt to steal user credentials.

    This gives them clear access to the organisation’s internal systems, where they can view anything that the employee whose account they’ve compromised can see. The attacker might also imitate that employee in an email or instant message in an attempt to grab more sensitive data.

    It’s therefore no surprise that red teams, like cyber criminals, target usernames and passwords ruthlessly, with an assortment of tactics ranging from brute-force attacks to phishing scams.

    What is a blue team?

    While the red team is on the attack in these exercises, the blue team is playing defence. The group is also comprised of cyber security professionals, and their goal is to identify the adversaries’ attempts to compromise the organisation and to protect its critical assets.

    The blue team’s tactics are guided by the organisation’s business objectives and security strategy. As such, they will have the same tools and knowledge that would be available in the event of a real-life attack.

    How a blue team works

    The blue team’s work begins long before the adversaries begin their attack. Their first job is to review the organisation’s security practices with a gap analysis and risk assessment in order to identify security weaknesses.

    With that information, they implement controls to close gaps and bolster the organisation’s systems. This might include, for instance, introducing stricter password policies, patching software or reminding employees about the threat of phishing.

    Networking monitoring tools are often also deployed, giving the blue team real-time information about people accessing the organisation’s systems. This is crucial to identify unusual or suspicious activity that would help them spot the red team’s efforts.

    It’s only after these threat prevention and detection tools are put in place that the blue team are ready to fend off the red team’s attacks.

    Although many organisations prioritise threat prevention as a security measure, it’s equally important to consider your ability to respond to attacks in progress. Organisations rarely get a chance to practice this, and it’s why red team vs blue team assessments are so helpful.

    How do the red team and blue team work together?

    Although the red and blue teams are on opposite sides during the assessment, they are both working to improve the organisation’s security posture.

    As such, they must work together to ensure that both sides are operating with the latest information. For instance, the blue team should stay up to date on emerging threat prevention technologies and share their findings with the red team.

    Likewise, the red team must keep an eye out for new hacking techniques, and explain to the blue team how they work.

    This type of communication is crucial between assessments, but depending on the objective of the test, the red team won’t necessarily inform the blue team about a planned attack.

    A surprise offensive is useful if the organisation wants to see how their security team responds to a crisis in a real-world scenario.

    Even in this scenario, however, someone in a management position should be aware of the test. Typically, this will be the top-level employee in the IT or cyber security team, who may also act as the manager of the blue team.

    This ensures that the senior personnel are aware that the activity is a drill while those responsible for incident response are not influenced by the knowledge that it’s only a practice.

    When the test is complete, both teams gather and share their findings. If the red team was successful, they will explain how they bypassed security systems and provide tips to combat future attacks.

    But if the blue team successfully repelled the attack, they would describe the steps they took to identify and thwart them.

    Both teams should then work together to plan, develop and implement stronger security controls where necessary.

    The purple team

    Although the activities of the red and blue team are designed to work in harmony, the reality is usually more complicated. The two sides will naturally be competitive, and they might be reluctant to share tips that helps their opponents.

    This is where the concept of a purple team comes in. As the name suggests, this team brings the red and blue team together to work in unison.

    Individual employees might take it in turns to play attack and defence, while everyone is encouraged to share ideas that help either side.

    Navigating the practicalities of a purple team can be tricky. For instance, it will be harder to spring a surprise attack on the blue team and therefore simulate a real-world attack.

    Likewise, the red team is often a more appealing option, as cyber security personnel break away from their day-to-day tasks and show off their hacking expertise. Persuading people to switch sides can therefore be tricky, and it will require strong leadership to keep everybody happy.

    However, when it’s done right, the purple team can prove an invaluable cyber security resource.

    Developing an effective assessment team

    Red and blue team assessments are among the most in-depth ways to manage cyber security.

    They are highly organised, and they put every part of your organisation to the test. You’ll gain a real-world understanding of the ways a cyber criminal might target your organisation and get a close-up view of the ways in which your defences hold up to attacks.

    Unfortunately, for many organisations, red and blue team assessments are impractical if not impossible. They either don’t have enough internal expertise to form opposing teams, or they don’t have the resources to conduct tests and monitor the results.

    But that doesn’t mean you can’t benefit from these sorts of assessment. With IT Governance’s  Red Team Assessment service, our team of experts will play the adversarial role and probe your organisation to see how you would handle an attack.

    Our team of ethical hackers will test your organisation and provide expert guidance on how to improve your organisation’s security posture.

    The scope of each engagement is tailored to your organisation’s requirements and goals, but in every assessment, we can:

    Attack scenarios can be crafted to emulate specific types of threat actor. We use traditional and non-traditional techniques to test your resilience to intrusion, fraud, data extraction, internal threats, corporate espionage and physical attacks.

    Resource : https://www.itgovernance.co.uk/blog/red-team-vs-blue-team-whats-the-difference

    29Jun, 2023
    Top 6 cybersecurity trends to keep an eye on in 2023

    In a world where everything is just a click away, cybersecurity trends are a matter of concern. With data breaches, hacking, and malware attacks becoming more sophisticated, it’s crucial to stay ahead of the curve and remain vigilant in the fight against cybercrime. 

    For the unversed, cybersecurity is the practice of protecting computer systems, networks, and data from theft, damage, or unauthorized access. In today’s digital age, cybersecurity is more important than ever, as businesses and individuals rely heavily on technology to store and exchange sensitive information. 

    Key components of cybersecurity 

    There are several key components to cybersecurity. The first is prevention. This involves implementing security measures such as firewalls, antivirus software, and access controls to prevent unauthorized access to systems and data. It also involves regularly updating software and systems to patch vulnerabilities that could be exploited by cybercriminals. 

    Another key component of cybersecurity is detection. This involves monitoring systems and networks for suspicious activity, such as unauthorized access attempts or unusual network traffic. Early detection of potential threats can help organizations mitigate the damage and prevent data loss. 

    If a breach does occur, it is important to have a response plan in place. This involves having procedures for investigating and containing the breach and notifying affected individuals and authorities as needed. It is also important to have a plan for restoring systems and data after a breach, which may involve restoring backups or rebuilding systems from scratch. 

    Cybersecurity trends to watch out for in 2023 

    Since cybersecurity is a constantly evolving field, new threats emerge every year. As we look ahead to 2023, there are several cybersecurity trends that organizations and individuals need to watch out for. 

    1. Ransomware attacks 

    Ransomware is a type of malware that infects a computer system and encrypts its files, making them inaccessible to the user. The attacker then demands a ransom payment in exchange for the decryption key. 

    One reason for the rise of ransomware attacks is that they are incredibly profitable for cybercriminals. The cost of paying the ransom is often much lower than the cost of restoring the system from backups or dealing with the fallout from a data breach. The consequences of a successful ransomware attack can be severe. In addition to the financial costs of paying the ransom and restoring the system, organizations may suffer reputational damage and loss of business. In some cases, sensitive data may be stolen and used for malicious purposes. 

    To protect against the threat of ransomware attacks, organizations need to take proactive steps to improve their cybersecurity defenses. This includes having strong backup and recovery systems in place, regularly updating software and security patches, and educating employees about cybersecurity best practices.  

    2. Healthcare sector at risk

    The healthcare industry is expected to face more cyber attacks in 2023. This industry has already seen a significant increase in cyber attacks in recent years, with a 44% increase resulting in the compromise of 40 million American patient records in 2021. This affected over 22.6 million patients, which is equal to the population of New York.

    A research survey shows that approximately 60% of all ransomware attacks target patient data, while the remaining attacks focus on disrupting operations or taking over systems.

    Phishing scams were the most common type of cyber attack on healthcare organizations in 2020, affecting 81% of companies. With the onset of the COVID-19 pandemic, phishing incidents increased by 220%.

    3. Artificial intelligence (AI) in cyberattacks  

    With Chat GPT storming the internet, cybercriminals are well versed with current trends and are using Artificial intelligence to launch more sophisticated attacks. AI-powered attacks can quickly adapt to changing environments, making them harder to detect and defend against. 

    AI-powered attacks can take different forms, such as phishing emails, malware, or social engineering scams. For example, AI can be used to create highly convincing phishing emails that appear to be from trusted sources, making it easier for attackers to trick users into clicking on malicious links or downloading malware. 

    To protect against AI-powered cyberattacks, organizations need to stay vigilant and adopt advanced cybersecurity tools and techniques that can detect and respond to these threats in real time. This includes using AI-based cybersecurity solutions that can identify and block attacks before they cause damage. Organizations should also implement security awareness training programs to educate employees on how to recognize and report suspicious activity. 

    4. IoT vulnerabilities

    Next up on the cybersecurity trends list, we have IoT vulnerabilities. The security of IoT devices is a concern, and manufacturers are aware of this issue. However, they may not be fully knowledgeable about all the possible vulnerabilities that exist. If any security breaches are discovered, the consequences could be severe.

    As per information from Oracle, the number of connected IoT devices has already exceeded 7 billion and is projected to increase to 22 billion by 2025. This growth presents a large opportunity for cybercriminals to carry out attacks.

    5. Users as an attack surface

    In 2023, one of the cybersecurity trends is expected to be the increased focus on users as an attack surface. Cyber attackers will continue to target an organization’s user base by using tactics like phishing, social engineering, and other methods to gain unauthorized access.

    This trend is driven by the fact that user error remains one of the biggest cybersecurity risks for organizations, as attackers exploit the human element to gain entry to networks and systems. As a result, organizations will need to prioritize user education and awareness training to mitigate the risks posed by user-targeted attacks.

    6. Quantum cryptography

    As quantum computing becomes more widespread, traditional cryptographic methods used for encryption are becoming increasingly vulnerable. Quantum cryptography provides an alternative approach to encryption that is highly secure and resistant to attacks by quantum computers. Quantum cryptography uses quantum mechanics to generate encryption keys, which are then used to secure communications. This method provides an exceptionally high level of security and privacy.

    Navigating cybersecurity challenges: Lessons learned and outlook 

    Overall, cybersecurity is a critical component of modern business and personal life. It requires ongoing vigilance and attention, as cybercriminals continue to develop new tactics and strategies to exploit vulnerabilities. By staying informed and taking proactive measures to protect systems and data, individuals and organizations can help ensure their safety and security in the digital age. 

    In conclusion, 2023 is expected to bring new and evolving cybersecurity trends and threats. It is important for organizations to stay vigilant, stay up to date with the latest cybersecurity tools and techniques, and ensure that their employees are trained to recognize and respond to potential threats. By taking proactive measures to protect their systems and data, organizations can reduce the risk of cyberattacks and keep their businesses running smoothly. 

    Resource : https://datasciencedojo.com/blog/top-cybersecurity-trends-2023/

    6Apr, 2023
    5 Most Advanced Cyber Security Technology to Aid Your Business

    Running a business using the most advanced technology and terrified about the increasing incidents of cybercrimes. As most of the business practices are getting digitized, it has created a sea change in the entire scenario. But, this approach runs the risk of exposing confidential information of your clients. The advancement of technology has become convenient for hackers to crack into the system, using the latest techniques, and create new incidences of cybercrimes. Maintaining valid cyber insurance can save a lot of your obligations following the crime.

    The Necessity for Adopting the Latest Cyber Security Technologies

    The worldwide pandemic outbreak has compelled us to resort to digital modes for the last two years. This has severely impacted our lives and the instances of cyberattacks have also become much more intense. Cyberattacks have always existed, but their current nature has turned much more grave and powerful.

    1. Changed targets of attacks:

    The targets of cyber crimes have changed over the years and have become much more sinister than only extraction of confidential information, quick money or vengeance. It has been elevated to the state of cyber warfare. Presently, all the nuclear power plants, utility services, airports, and healthcare facilities are connected to a specialized network. This is increasing with every passing day, thereby, creating more probable targets.

    2. Advanced cyber threats:

    Cybercriminals are getting more advanced and grave with time. Each hacker possesses a top-grade technical prowess and is a computer science professional of the highest grade. As technologies are getting advanced to block cyber threats, so are the nature of attacks.

    3. Critical aftermath:

    All the critical infrastructure is connected to a single frame network, possessing a worldwide expanse. All the important businesses store their confidential data digitally and are largely dependent on the system. Under such circumstances, even the smallest security breach can jeopardize their position.

    4. A critical shift in the cyber attacking nature:

    If any of the public utility infrastructures gets hacked it will lead to extreme public inconvenience, heavy regulatory penalties, loss of revenue, severe reputational damage and tremendous cost of restoration and upgrading the cyber security system measures.

    Top 5 Latest Cyber Security Measures

    Under the current circumstances, cyber warfare carries the biggest threat to advancing technologies. We have experienced malware and ransomware attacks on business enterprises on a much smaller grade. We have to remember that there is not a single protective measure that can be considered 100% foolproof. We have to keep ourselves upgraded with the advancing technologies to keep pace with time. Some of the most advanced cyber security technologies of the time include the following:

    1. Deep learning and artificial intelligence:

    Artificial intelligence is the current market trend. Have you ever wondered how can it affect and improve cyber security? Of course, the method of such an application is quite similar to the working strategy of the two-factor authentication system. It works on the user’s identity confirmation on the basis of multiple parameters. Such parameters are designed on the basis of their knowledge and possession. Adding to such layers of authentication and information, AI enters the scene.

    Deep learning is used for analyzing the data like real-time communications, logs, and transactions, detecting unwarranted activities and threats.

    2. Behavioural analytics:

    This is the biggest target for social media and several online advertisements for the correct set of target audiences. Cyber security technology is increasingly exploring behaviour analytics for even further development of the systems. The system identifies the patterns in a particular system and/or network activities for detecting real-time and plausible cyber threats. Although behavioural analytics is generally used for networks, its system application and application on user devices are considered as surging.

    3. Embedded hardware authentication:

    A password and PIN are no longer considered to be enough hardware protection. Embedded authenticators are developing advanced technologies for the verification of the identity of the concerned user. The sixth-generation vPro chips deserve a special mention in this context for its groundbreaking entry. Here, the authentication chips remain embedded within the hardware itself, ideally revolutionizing the “authentication security”. It successfully employs several levels and authentication techniques working in sync with each other.

    4. Blockchain cybersecurity:

    This is one of the most advanced in the genre and is gaining rapid popularity. His system works based on the successful identification of two transacting parties. Similarly, blockchain systems also function based on the system’s peer-to-peer network fundamentals. Each member in the blockchain system holds the responsibility for verification of the authenticity of the newly added data. Moreover, it forms a nearly impenetrable network for hackers to break into and offers almost foolproof security and protection. Artificial intelligence is capable of establishing a strong verification system for keeping potential cyber threats away.

    5. Zero-trust model:

    As the name goes, this essential cyber security model is framed based on considering an already compromised network. With the belief that any particular network cannot be trusted, one must enhance both “external” and “internal” securities. The game here lies that both the external and internal networks are prone to compromise and need similar levels of protection. It includes the proper identification of critical business data, mapping of the data flow, physical and logical segmentation, policy controlling and enforcement using constant monitoring and automation.

    Resource : https://www.hdfcergo.com/blogs/cyber-insurance/5-most-advanced-cyber-security-technology-to-aid-your-business

    25Feb, 2023
    Top SaaS cyber security threats in 2023

    This year will bring new challenges and new opportunities in relation to SaaS security. As we move into the year, it’s becoming increasingly clear that SaaS organizations will need to take great care in implementing the processes, policies, tools and best practices that will prevent next-generation threats from disrupting the flow of business. In this article, we’ll discuss prominent issues related to SaaS security, explaining what they are and how to more effectively protect your business data.

    1. Web application weaknesses. Web applications are at the center of the SaaS business model, and play a profound role in determining how an enterprise operates. Web applications commonly store customer data and other valuable business information.

    Because SaaS applications are commonly multi-tenanted, applications need to be secure from the kinds of attacks where one customer attempts to break into the systems of another customer. Such attacks tend to rely on logic flaws, injection flaws or access control weaknesses.

    Design and build secure web applications by using an automated vulnerability scanner in combination with routine pentesting. This can assist you in catching vulnerabilities as they’re introduced through the development cycle.

    2. Misconfiguration mistakes. Glitches, gaps and errors can accidentally expose your cloud environment to risk. Engineers are typically tasked with ensuring that every setting, user role and permission complies with industry and company policy. However, misconfigurations can occur – and they’re also extremely difficult to detect and to manually remediate.

    Mitigate risk by ensuring that you monitor external networks and pentest cloud infrastructure. This will help reveal issues related to misconfigured S3 buckets, permissive firewalls within VPCs, and overly permissive cloud accounts.

    A vulnerability scanner can help reduce and monitor your attack surface by ensuring that only the services that need exposure to the internet are accessible.

    3. Vulnerable software and patching. Although it may sound obvious, vulnerable software and patching are major issues that companies continue to contend with. If you’re self-hosting an application, ensure that the operating system and library security patches are applied shortly after they are rolled out. Vulnerability fixes and patching are continuous processes, as security vulnerabilities in operating systems and libraries are constantly being identified and solved for.

    Use DevOps best practices and ephemeral infrastructure to make sure that your systems are always up-to-date with each patch release. In addition, be sure to monitor for new weaknesses that could be uncovered between patch releases.

    One alternative to self-hosting is free (and paid) Serverless and Platform-as-a-Service (PaaS) offerings that operate your application in a container. This takes care of operation system patching. However, the onus is on you to ensure that the libraries used by your service are kept up-to-date with security patches.

    4. Weak internal security policies and practices. SaaS companies are often small, strategic and well-positioned for growth. Consequently, in the spirit of moving fast and breaking things, the security posture can prove poor. SaaS businesses are particularly vulnerable to cyber attacks.

    Simple measures like two-factor authentication and cyber security awareness training for employees can significantly increase security.

    Organizations should take care to enable two-factor or multi-factor authentication (2FA/MFA) wherever possible. Further, ensure that your teams understand how to recognize and avoid phishing emails.

    Resource : https://www.cybertalk.org/top-saas-cyber-security-threats-in-2023/

    7Feb, 2023
    Rise in cyber threats demand new strategies for data recovery

    We are more connected than ever in this digital era, and those connections are faster and increasingly more immediate. Advanced technologies are accelerating incredible achievements for businesses and consumers.

    While technology offers significant benefits, it has also made it easier for those who seek to gain an advantage by exploiting others. Hidden in the digital web of interconnections are people intent on stealing your content or holding it to a hefty ransom for its return, making the information age a double-edged sword.

    Today’s organizations need digital sentries and multiple lines of defense against cybercrime, which can devastate a business when it hits and impact it for years after the initial attack.

    Ransomware has been steadily growing in prominence and impact since the 2017 WannaCry ransomware outbreak that infiltrated systems around the world. While criminals develop more advanced techniques, the fundamentals of ransomware remain the same. Attackers penetrate a network, find and encrypt data, and demand payment for a decryption key.

    The threat of ransomware is increasing quickly. It’s not a question of “if” but of “when” you will face this challenge. Choosing between ransom payments or suffering data loss is costly and risky.

    The impact of an attack is enormous, and the costs associated with cyberattacks, including lost business, insurance rate hikes, lawsuits, criminal investigations, and bad press, can even put a company out of business – and fast. Here are just a few of the many data breaches that occurred during the past two years and their costly toll:

    • The New York Times reported that T-Mobile Reached a $500 Million Settlement in a Huge 2021 Data Breach: The company, which said the hacking had affected 76.6 million people, agreed to pay $350 million to settle claims and spend $150 million to bolster security.
    • Insiders reported that global insurance provider CNA Financial forked over a reported mind-blowing $40 million post-cyber-attack last year.
    • The Washington Post reported that a ransomware attack on U.S. software provider Kaseya in 2021 targeted the firm’s remote-computer-management tool and endangered up to 2,000 companies globally.

    While there are many strategies for mitigating the risks associated with cyber threats, such as ransomware, each comes with challenges. Backup is a critical means of recovery, yet decades-old legacy enterprise backup solutions were not designed to handle the scale and complexity of today’s data. And this problem continues to grow. Terabytes of data are rapidly becoming petabytes to exabytes of data and beyond. IDC predicts the world’s collective data will reach 175 zettabytes by 2025.

    Backup is Broken

    Traditional backup as we know it is broken, and here’s why:

    • Backups are periodically done in batches – when data recovery is needed, the last available copy could be more than 24 hours old, resulting in permanently lost data and/or recent changes.
    • Backup is outdated – snapshot-based legacy backup soft­ware, developed decades ago, still uses agents to protect and recover virtual machines, resulting in high maintenance costs, time wasted on administration, or even failed recoveries.
    • It’s expensive – aside from costs associated with impacts on production and resources, legacy backup requires multiple licenses, additional agent purchases, and increased IT infrastructure costs.
    • Legacy backup tools are complex – they use distributed systems for data transfer, requiring dedicated hardware, extensive configuration, and a lot of IT time and resources.
    • It’s disruptive – legacy backup jobs often don’t complete in time, disrupt production environments with unplanned downtime, and heavily burden already constrained IT resources.

    And it’s slow – legacy backup copying processes place an enormous load on your production environment, causing network lag and downtime.

    A New Backup Paradigm to Recover Data Instantaneously

    What’s needed is continuous data availability. This approach would provide a strong first line of defense against cyber threats, enabling organizations to recover compromised data easily and almost instantly. And yet, continuous data availability has been out of reach given the weaknesses of traditional backup. Business leaders have been forced to accept levels of data loss, measured by recovery point objectives (RPO), and downtime, measured by recovery time objectives (RTO).

    Traditionally, backup occurs outside the operating system data path. As data volumes increase exponentially – both in the number of files and the amount of data generated – backup systems that scan file systems are no longer feasible, particularly as we enter the realms of billions of files and petabytes or more data.

    A new approach would make the file system and backup one and the same. As a result, every change in the file system would be recorded as it happens, end users could recover lost data without the assistance of IT, and finding files would be easy, regardless of when they may have existed, and across the entire time continuum. Such an approach would redefine enterprise storage by converging storage and data resilience into one system. Every change that occurs in the data path would be captured. This approach would not require decryption keys, users could just unwind ransomware events with a single operation.

    Current backup and recovery solutions are not where the world needs them to be, but that doesn’t mean we should settle for less. In 2023, there will be an increased focus on the “first line of defense,” where cyberattacks are stopped altogether or can be swiftly unwound without recourse to backups. Instead of taking hours, days, and sometimes weeks or more, recovery would take place almost immediately.

    Backup that sits within the operating system data path could enable continuous data access. This method could provide unprecedented data protection, making it possible to approach the ideal of zero RTO, giving users control of searching and recovering data immediately without IT assistance, and an RPO of zero, eliminating the significant cost and impact of data loss and interrupted data access.

    Anything more is a compromise that exposes organizations to increased risk of data and financial loss. Companies should push vendors to achieve zero RPO and zero RTO and seek out solutions that achieve those objectives.

    Resource : https://www.securityinfowatch.com/cybersecurity/information-security/breach-detection/article/21294365/rise-in-cyber-threats-demand-new-strategies-for-data-recovery

    23Nov, 2022
    Cyber Resilience: The New Strategy to Cope With Increased Threats

    As part of last month’s Cybersecurity Awareness Month, I was traveling around the globe to provide organizations actionable tips on how to strengthen their cybersecurity posture and allow for accelerated recovery from cyberattacks. Through my conversations with hundreds of analysts, system integrators, and security professionals one thing became apparent – many of them understand that it’s no longer a matter of ‘if’ but ‘when’ an organization will suffer a data breach. This means that instead of primarily focusing efforts on keeping threat actors out of the network, it’s equally important to develop a strategy to reduce the impact. In turn, many organizations have started adopting a new strategy to cope with today’s increased cyber threats, which is called ‘cyber resilience’.

    But what exactly is cyber resilience and how does it compare to traditional cybersecurity practices?   

    According to MITRE, cyber resilience (or cyber resiliency) “is the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on cyber resources.” The need for cyber resilience arises from the growing realization that traditional security measures are no longer enough to protect systems, data, and the network from compromise. The objective of cyber resilience is to ensure that an adverse cyber event (intentional or unintentional, i.e., due to failed software updates) does not negatively impact the confidentiality, integrity, and availability of an organization’s business operation. 

    Cybersecurity vs. Cyber Resilience

    Cybersecurity applies technology, processes, and measures that are designed to protect systems (e.g., servers, endpoints), networks, and data from cyberattacks. In contrast, cyber resilience focuses on detective and reactive controls in an organization’s IT environment to assess gaps and drive enhancements to the overall security posture. Most cyber resilience initiatives leverage or enhance a variety of cybersecurity measures. Both are most effective when applied in concert. 

    More and more cyber risk and security management frameworks are adopting the concept of cyber resilience (e.g., the Department of Homeland Security’s Cyber Resilience Review (CRR) or the National Institute of Standards and Technology (NIST) Special Publication 800-160 Volume 2). Furthermore, leading analyst firms like Gartner are advising clients to shift their cybersecurity priorities from defensive strategies to the management of disruption through resilience to make a real difference to the impact of cybersecurity incidents.

    Benefits of Cyber Resilience

    A cyber resilience strategy is vital for business continuity and can provide a range of benefits prior, during, and after a cyberattack, such as:

    • Enhanced Security Posture: Cyber resilience not only helps with responding to and surviving an attack. It can also help an organization develop strategies to improve IT governance, improve security across critical assets, expand data protection efforts, and minimize human error.

    • Reduced Financial Loss: According to the IBM Cost of a Data Breach Report 2022, the average cost of a data breach is now $4.35 million globally. In addition to financial costs, the reputational impact of data breaches is increasing due to the introduction of general data protection laws and stringent data breach notification requirements. Cyber resilience can help minimize recovery costs by accelerating time-to-remediation.

    • Improved Compliance Posture: Many industry standards, government regulations, and data privacy laws nowadays propagate cyber resilience. 

    • Enhanced IT Productivity: One of the understated benefits of cyber resilience is its ability to improve the daily IT operations, including threat response and ensuring day-to-day operations run smoothly.

    • Heightened Customer Trust: Implementing a cyber resilience strategy helps improve trust as it enhances the chances of responding to and surviving a cyberattack, minimizing the negative impact on an organization’s customer relationships. 

    • Increased Competitive Edge: Cyber resilience provides organizations a competitive advantage over companies without it. 

    Both the range of cyber resources within an organization (e.g., networks, data, workloads, devices, and people) and the threats to which they are susceptible will determine what steps are needed to achieve cyber resilience. As a result, cyber resilience measures should be implemented based on an assessment of the tactics, techniques, and procedures (so-called TTPs) that hackers are commonly applying when exploiting their victims. 

    For instance, endpoints are often used as an access point for hackers and cybercriminals to launch attacks that could infect an organization’s entire network or function as a beachhead to laterally move within the network. In fact, a Ponemon Institute survey revealed that 68 percent of organizations suffered a successful endpoint attack within the last 12 months. 

    Despite widespread attempts to secure endpoints, this finding suggests that security has been rapidly eroding in today’s work-from-anywhere environment and therefore requires Endpoint Resilience, which is just one flavor of cyber resilience. Endpoint Resilience enables organizations to always know where their endpoints are, apply deep security control, and take defensive actions on those devices, which includes repairing protective security applications if they’re disabled, altered, or otherwise compromised.

    Conclusion

    When implemented properly, cyber resilience can be considered a preventive measure to counteract human error, malicious actions, and decayed, insecure software. The goal of cyber resilience is to aggressively protect the entire enterprise, covering all available cyber resources.

    Resource : https://www.securityweek.com/cyber-resilience-new-strategy-cope-increased-threats

    19Nov, 2022
    What is WarXing in Cyber Security? What are the Benefits?

    You might have heard about WarXing; here you will get detailed information about that. WarXing is always searching for Wi-Fi networks because in this hyper-connected world users need to need a stable internet connection. We also need an internet connection to our mobile, tablets, computers to fulfill their functions.

    We also need to keep in touch with our friends and that also possible through the internet. Our family, co-workers everyone is connected online, and we even receive our education online.

    Here you will get some variations of WarXing:

    1. Warchalking: The name itself a practice which is the reference of a common method of warXing.
    2. Community: Here they breadth regarding Wi-Fi arrangement and the sidewalk with a piece of chalk.
    3. Warcycling: Users can search Wi-Fi networks by doing the cycling.
    4. War dialing: In this practise, include phone numbers so that the user can find the modems.
    5. Wardriving: In this process, you can seek Wi-Fi networks in the car.
    6. Warflying: In this, by using an aircraft or drone, the PDA user needs to complete his work.

    Why do People need to warXing?

    People need this warXing for various reasons. For example, a user can opt for warXing to piggyback. In this, it looks very innocent and non-threatening.

    You also need to consider the possibility so that the individual can be overburden to your network, and it can be heavily downloading the activity where internet connection becomes illegal. In the future, you might be getting yourself in an unwanted situation and explain who is responsible for this illegal activity.

    There is another motivation for warXing, which can be infiltrating your system. You can steal the information where you can lock out yourself in your network. However, wardrivers drive around the neighborhood so that they can find the open Wi-Fi network and they can effortlessly hack everything.

    If any organization uses unknown Wi-Fi then, that organization is under threat. Wardrivers target the consumer so that they can crack through WER’s encryption easily.

    If you want to keep safe to your organisation and enhance the cybersecurity posture then you need to keep a look of SIEM and SOAR applications.

    What all threats can come if you do not use WarXing in Cyber Security?

    1. Adware: This is one of the forms of computer virus which fills the computer with more advertisement. It is very common for cyber-attack. Adware allows viruses to enter inside the computer if you accidentally click on them.
    2. Ransomware: This is one type of malicious software which mainly designed to access until some limit. If you want you can opt for the paid version.
    3. Spyware: This is one type of WarXing cyber infection that is mainly designed to spy on your computer action and relay on that information you can get the cyber-criminal.

    The best WarXing in Cyber Security can easily prevent this type of virus and ensure that your data stays private and confidential inside the workplace.

    Benefits of WarXing in Cyber Security:

    There are several benefits which are discussing below:

    1. Protection for your business: WarXing provides digital protection to your business, and will make sure that your employees are not at risk. They must be saved from potential threats like Ransomware and Adware.
    2. Increase productivity: Please note that viruses slow down the computers while crawling that time you need to do the work practically. Powerful WarXing eliminates all negativity and maximizes your business potential.
    3. Inspires customer confidence: If you prove your business is protected against all types of viruses, you can gain the trust of your customer and your data will not compromise.
    4. Protection for your customers: You need to ensure your business is secure from WarXing, and it will help your customer to do the subscription for WarXing.
    5. Stops your website from going down: When you have your own website you must be potentially cyber breach which can be disastrous. When you are in the system and it becomes infected that time, your website can be forced to close where you will lose money and there are chances that you will lose the transaction.   

    Final thoughts

    However, your business must be secure physically and virtually. It is perfect to have control over your business and employees. As an owner, you also need to get connected with them via WI-FI connection. You can also do the broadcasting to the world that your business is ‘open for business’. WarXing is very good and convenient as well as suited for all types of business.

    Resource : https://cybersecuritynews.com/warxing/