• Search for:
    24May, 2023
    5 emerging security technologies set to level the battlefield

    The war between data defenders and data thieves has been described as a cat-and-mouse game. As soon as the white hats counter one form of black-hat malicious behavior, another malevolent form rears its ugly head. How can the playing field be tilted in favor of the infosec warriors? Here are five emerging security technologies that may be able to do that.

    1. Hardware authentication

    The inadequacies of usernames and passwords are well known. Clearly, a more secure form of authentication is needed. One method is to bake authentication into a user’s hardware. Intel is moving in that direction with the Authenticate solution in its new, sixth-generation Core vPro processor. It can combine a variety of hardware-enhanced factors at the same time to validate a user’s identity.

    Intel has built on previous efforts to dedicate a portion of the chipset for security functions to make a device part of the authentication process. Good authentication requires three things from users: what they know, such as a password; who they are, such as a username; and what they have, such as a token. In the case of Authenticate, the device becomes the what-you-have.

    “This isn’t new,” said Scott Crawford, research director for information security at 451 Research. “We’ve seen this in other manifestations, such as licensing technologies and tokens.”

    Hardware authentication can be particularly important for the Internet of Things (IoT) where a network wants to ensure that the thing trying to gain access to it is something that should have access to it.

    However, Crawford noted, “The most immediate application for the technology is for authenticating an endpoint in a traditional IT environment — laptops, desktops, and mobile devices using Intel chipsets.”

    2. User-behavior analytics

    Once someone’s username and password are compromised, whoever has them can waltz onto a network and engage in all kinds of malicious behavior. That behavior can trigger a red flag to system defenders if they’re employing user behavior analytics (UBA). The technology uses big data analytics to identify anomalous behavior by a user.

    “There’s a lot of interest in this in the enterprise,” 451’s Crawford said.

    He explained that the technology addresses a blind spot in enterprise security. “Once an attacker gains entry into an enterprise, what happens then?” he asked. “One of the first things they do is compromise credentials. So then the question becomes, Can you differentiate between a legitimate user’s activity and an attacker who has gained entry, compromised a legitimate user’s credentials and is now looking for other targets?”

    Visibility into activity that does not fit the norm of the legitimate user can close a blind spot in the middle of the attack chain. “If you think of the attack chain as initial penetration, lateral movement, and then compromise, theft, and exfiltration of sensitive data, the middle links in that attack chain have not been very visible to enterprise security pros, and that’s why the interest in user behavior analytics today,” Crawford said.

    Comparing a user’s present behavior to past behavior isn’t the only way UBA can identify a malicious actor. “There’s something called ‘peer analysis’,” explained Steven Grossman, vice president for program management at Bay Dynamics, a threat analytics company. “It compares how someone is behaving compared to people with the same manager or same department. That can be an indicator that the person is doing something they shouldn’t be doing or someone else has taken over their account.”

    In addition, UBA can be a valuable tool for training employees in better security practices. “One of the biggest problems in a company is employees not following company policy,” Grossman said. “To be able to identify those people and mitigate that risk by training them properly is critical.”

    3. Data loss prevention

    A key to data loss prevention is technologies such as encryption and tokenization. They can protect data down to field and subfield level, which can benefit an enterprise in a number of ways:

    • Cyber-attackers cannot monetize data in the event of a successful breach.
    • Data can be securely moved and used across the extended enterprise — business processes and analytics can be performed on the data in its protected form, dramatically reducing exposure and risk.
    • The enterprise can be greatly aided in compliance to data privacy and security regulations for protection of payment card information (PCI), personally identifiable information (PII) and protected health information (PHI).

    “There’s been a lot of security spending over the last several years, and yet the number of records breached in 2015 went up considerably over the prior year,” noted 451’s Crawford. “That’s contributing to the surge in interest in encryption.”

    However, as John Pescatore, director of Emerging Security Trends at the SANS Institute, points out, authentication plays an important role in data loss prevention.

    4. Deep learning

    Deep learning encompasses a number of technologies, such as artificial intelligence and machine learning. “Regardless of what it’s called, there a great deal of interest in it for security purposes,” 451’s Crawford said.

    Like user behavior analytics, deep learning focuses on anomalous behavior. “You want to understand where malicious behavior deviates from legitimate or acceptable behavior in terms of security,” Crawford explained.

    Instead of looking at users, the system looks at “entities,” explained Brad Medairy, a senior vice president with Booz Allen. “Exact business analytics and recent developments in machine-learning models mean we are now able to look at the various entities that exist across the enterprise at the micro to the macro levels. For example, a data center, as an entity, can behave a certain way, similar to a user.”

    Use of machine learning can help stamp out the bane of advanced persistent threats, added Kris Lovejoy, president of Acuity Solutions, maker of an advanced malware detection platform. “With its ability to decipher between good and bad software, at line speed, machine-learning technologies will offer a significant boon to security practitioners who seek to decrease time to advanced threat detection and eradication,” she said.

    Crawford said he expects investments in deep learning for security purposes to continue. He added, however, that “the challenge for enterprises is there are a lot of companies coming to market with similar approaches for the same problem. Differentiating distinctions from one vendor to another is going to be a major challenge for enterprises in the coming year and beyond.”

    5. The cloud

    “The cloud is going to have a transformative impact on the security technology industry generally,” Crawford said.

    He explained that as more organizations use the cloud for what has traditionally been the domain of on-premises IT, more approaches to security that are born in and for the cloud will appear. On-premises techniques will be transitioned to the cloud. Things such as virtualized security hardware, virtualized firewalls, and virtualized intrusion detection and prevention systems. But that will be an intermediate stage.

    “If you think about what an infrastructure-as-a-service provider can do on a very large scale for all of its customers, there may not be the need to pull out all the defenses you need on-prem,” Crawford said. “The infrastructure-as-a-service provider will build that into their platform, which will relieve the need to do that for the individual cloud customer.”

    SANS’ Pescatore added that government agencies and private industry have increased the security of their data centers by using IaaS services such as Amazon and Firehost. “The GSA FedRAMP program is a great example of ‘certified secure-enough’ cloud services that make it easier for the average enterprise to have above-average data center security,” he said.

    These five should help out the infosec warriors get the upperhand. Any we missed? Which technologies do you suggest will move the needle on information security? Weigh in via the comments below.

    Resource : https://techbeacon.com/security/5-emerging-security-technologies-set-level-battlefield

    10Apr, 2023
    Researchers disclose critical sandbox escape bug in vm2 sandbox library

    The development team behind the vm2 JavaScript sandbox library addressed a critical Remote Code Execution vulnerability.

    The developers behind the vm2 JavaScript sandbox module have addressed a critical vulnerability, tracked as CVE-2023-29017 (CVSS score 9.8), that could be exploited to execute arbitrary shellcode.

    vm2 is a sandbox that can run untrusted code in an isolated context on Node.js servers, it has approximately four million weekly downloads and its library is part of 722 packages.

    The flaw was reported by the security researcher Seongil Wi from South Korean security firm KAIST WSP Lab.

    The vulnerability affects all versions, including and prior to 3.9.14, it was addressed with the release of version 3.9.15.

    “vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors.” reads the advisory published by vm2. “A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.”

    Wi also published two proof-of-concept (PoC) exploits for this vulnerability that can be used to escape the sandbox to create an empty file named “flag” on the host.

    In October 2022, VM2 maintainers addressed another critical sandbox escape vulnerability tracked as CVE-2022-36067.

    Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
    Vote for me in the sections:

    • The Teacher – Most Educational Blog
    • The Entertainer – Most Entertaining Blog
    • The Tech Whizz – Best Technical Blog
    • Best Social Media Account to Follow (@securityaffairs)

    Resource : https://securityaffairs.com/144582/hacking/vm2-rce-sandbox-escape.html

    7Feb, 2023
    Rise in cyber threats demand new strategies for data recovery

    We are more connected than ever in this digital era, and those connections are faster and increasingly more immediate. Advanced technologies are accelerating incredible achievements for businesses and consumers.

    While technology offers significant benefits, it has also made it easier for those who seek to gain an advantage by exploiting others. Hidden in the digital web of interconnections are people intent on stealing your content or holding it to a hefty ransom for its return, making the information age a double-edged sword.

    Today’s organizations need digital sentries and multiple lines of defense against cybercrime, which can devastate a business when it hits and impact it for years after the initial attack.

    Ransomware has been steadily growing in prominence and impact since the 2017 WannaCry ransomware outbreak that infiltrated systems around the world. While criminals develop more advanced techniques, the fundamentals of ransomware remain the same. Attackers penetrate a network, find and encrypt data, and demand payment for a decryption key.

    The threat of ransomware is increasing quickly. It’s not a question of “if” but of “when” you will face this challenge. Choosing between ransom payments or suffering data loss is costly and risky.

    The impact of an attack is enormous, and the costs associated with cyberattacks, including lost business, insurance rate hikes, lawsuits, criminal investigations, and bad press, can even put a company out of business – and fast. Here are just a few of the many data breaches that occurred during the past two years and their costly toll:

    • The New York Times reported that T-Mobile Reached a $500 Million Settlement in a Huge 2021 Data Breach: The company, which said the hacking had affected 76.6 million people, agreed to pay $350 million to settle claims and spend $150 million to bolster security.
    • Insiders reported that global insurance provider CNA Financial forked over a reported mind-blowing $40 million post-cyber-attack last year.
    • The Washington Post reported that a ransomware attack on U.S. software provider Kaseya in 2021 targeted the firm’s remote-computer-management tool and endangered up to 2,000 companies globally.

    While there are many strategies for mitigating the risks associated with cyber threats, such as ransomware, each comes with challenges. Backup is a critical means of recovery, yet decades-old legacy enterprise backup solutions were not designed to handle the scale and complexity of today’s data. And this problem continues to grow. Terabytes of data are rapidly becoming petabytes to exabytes of data and beyond. IDC predicts the world’s collective data will reach 175 zettabytes by 2025.

    Backup is Broken

    Traditional backup as we know it is broken, and here’s why:

    • Backups are periodically done in batches – when data recovery is needed, the last available copy could be more than 24 hours old, resulting in permanently lost data and/or recent changes.
    • Backup is outdated – snapshot-based legacy backup soft­ware, developed decades ago, still uses agents to protect and recover virtual machines, resulting in high maintenance costs, time wasted on administration, or even failed recoveries.
    • It’s expensive – aside from costs associated with impacts on production and resources, legacy backup requires multiple licenses, additional agent purchases, and increased IT infrastructure costs.
    • Legacy backup tools are complex – they use distributed systems for data transfer, requiring dedicated hardware, extensive configuration, and a lot of IT time and resources.
    • It’s disruptive – legacy backup jobs often don’t complete in time, disrupt production environments with unplanned downtime, and heavily burden already constrained IT resources.

    And it’s slow – legacy backup copying processes place an enormous load on your production environment, causing network lag and downtime.

    A New Backup Paradigm to Recover Data Instantaneously

    What’s needed is continuous data availability. This approach would provide a strong first line of defense against cyber threats, enabling organizations to recover compromised data easily and almost instantly. And yet, continuous data availability has been out of reach given the weaknesses of traditional backup. Business leaders have been forced to accept levels of data loss, measured by recovery point objectives (RPO), and downtime, measured by recovery time objectives (RTO).

    Traditionally, backup occurs outside the operating system data path. As data volumes increase exponentially – both in the number of files and the amount of data generated – backup systems that scan file systems are no longer feasible, particularly as we enter the realms of billions of files and petabytes or more data.

    A new approach would make the file system and backup one and the same. As a result, every change in the file system would be recorded as it happens, end users could recover lost data without the assistance of IT, and finding files would be easy, regardless of when they may have existed, and across the entire time continuum. Such an approach would redefine enterprise storage by converging storage and data resilience into one system. Every change that occurs in the data path would be captured. This approach would not require decryption keys, users could just unwind ransomware events with a single operation.

    Current backup and recovery solutions are not where the world needs them to be, but that doesn’t mean we should settle for less. In 2023, there will be an increased focus on the “first line of defense,” where cyberattacks are stopped altogether or can be swiftly unwound without recourse to backups. Instead of taking hours, days, and sometimes weeks or more, recovery would take place almost immediately.

    Backup that sits within the operating system data path could enable continuous data access. This method could provide unprecedented data protection, making it possible to approach the ideal of zero RTO, giving users control of searching and recovering data immediately without IT assistance, and an RPO of zero, eliminating the significant cost and impact of data loss and interrupted data access.

    Anything more is a compromise that exposes organizations to increased risk of data and financial loss. Companies should push vendors to achieve zero RPO and zero RTO and seek out solutions that achieve those objectives.

    Resource : https://www.securityinfowatch.com/cybersecurity/information-security/breach-detection/article/21294365/rise-in-cyber-threats-demand-new-strategies-for-data-recovery

    20Dec, 2022
    Mobile App Users at Risk as API Keys of Email Marketing Services Exposed

    Analysis of 600 apps on the Google Play store by CloudSEK’s BeVigil security search engine found that 50% were leaking application programming interface (API) keys of three popular transactional and marketing email service providers.

    The providers included Mailgun, MailChimp and SendGrid. CloudSEK has notified all involved entities and affected apps about the hardcoded API keys.

    The leaked API keys allow threat actors to perform a variety of unauthorized actions such as sending emails, deleting API keys, and modifying two-factor authentication (2FA).

    An API is a piece of software that allows applications to communicate with each other without any human intervention. An API key is a special identification used by users, developers or calling programs to authenticate themselves to an API.

    CloudSEK said that an overall examination of all three providers’ data revealed that the USA was the country with the highest number of downloads followed by the UK, Spain, Russia and India, leaving over 54 million mobile app users vulnerable.

    In a breakdown of the research, CloudSEK noted how attackers could potentially exploit leaked API keys and said that it is advisable to keep API keys private.

    MailGun provides email API services, enabling brands to send, validate and receive emails through their domain at scale. The research noted that in this case, an API key leak could allow threat actors to send and read emails, get Simple Mail Transfer Protocol (SMTP) credentials, IP addresses and statistics, as well as retrieve mailing lists of customers in order to launch phishing campaigns.

    CloudSEK said that 35% of the analyzed packages contained a valid Mailgun key embedded in their android code and 132 domains were configured with the valid keys.

    MailChimp is a transactional email service first introduced in 2001 and later launched as a paid service with an additional freemium option in 2009. An API key leak in this case would allow threat actors to read conversations, fetch customer information, expose email lists of multiple campaigns containing PII, start fake email campaigns and manipulate promotional codes. The research also noted that threat actors could authorize third party applications connected to a MailChimp account.

    The report highlighted that of a total of 319 identified API keys, 28% were found to be valid and of those, 12 keys allowed read email access.

    Finally, SendGrid is a communication platform intended for transactional and marketing emails. It provides cloud-based services to assist businesses with shipping notifications, friend requests, sign-up confirmations, email newsletters, etc.

    An API lead would allow a threat actor to send emails, create API keys and control IP addresses used to access accounts, according to CloudSEK.

    The research found that of 319 API keys, 128 were found to be valid and of those, 121 could allow threat actors to send emails using SendGrid, 65 could allow threat actors to delete API keys and 42 could allow the modification of 2FA.

    Following the findings, CloudSEK said: “In modern software architecture, APIs integrate new application components into existing architecture. So its security has become imperative. Software developers must avoid embedding API keys into their applications and should follow secure coding and deployment practices like standardize review procedures, rotate keys, hide keys and use vault.”

    Resource : https://www.infosecurity-magazine.com/news/api-keys-email-marketing-services/?&web_view=true

    12Nov, 2022
    Securing Your Move to the Hybrid Cloud

    Infosec expert Rani Osnat lays out security challenges and offers hope for organizations migrating their IT stack to the private and public cloud environments.

    Infosec Insider contributor Rani Osnat is SVP Strategy at Aqua Security

    The combination of private and public cloud infrastructure, which most organizations are already using, poses unique security challenges. There are many reasons why organizations adopt the public cloud — from enabling rapid growth without the burden of capacity planning to leveraging flexibility and agility in delivering customer-centric services. However, this use can leave companies open to threats.

    Since regulatory requirements or other preferences dictate that certain applications remain on private (on-prem) infrastructure, many organizations choose to maintain a mix of private and public infrastructure. Additionally, organizations typically use multiple cloud providers simultaneously or preserve the option to move between providers. However, this hybrid approach presents unique and diverse security challenges. Different cloud providers and private cloud platforms may offer similar capabilities but different ways of implementing security controls, along with disparate management tools.

    The question then becomes: How can an organization maintain consistent governance, policy enforcement and controls across different clouds? And how can it ensure that it maintains its security posture when moving between them? Fortunately, there are steps professionals can take to ensure that applications are continuously secure, starting from the early stages of development and extending throughout the lifecycle.

    Old Security Tools No Longer Effective in the Cloud

    Security tools not born in the cloud are ill-equipped to protect applications running in the cloud for many reasons. First, they are incapable of coping with the considerably accelerated development cycles of cloud native applications, compared with traditional waterfall methods. Instead of releasing versions every few months, organizations that employ cloud native CI/CD are continuously integrating and deploying applications and updates, sometimes multiple times per day. This mandates an automated approach to ensuring security — one that’s embedded into the early stages of development so that it doesn’t become the bottleneck slowing development and operations.

    Additionally, in the dynamic and diversified cloud environment, security solutions can no longer expect or rely on permanent infrastructure and location. If, in the past, we knew that a certain server ran a certain application (e.g., a Microsoft Exchange server or database), we cannot assume that the same scenario applies today. Modern cloud application solutions are tied to the application itself, not to its IP address or a specific server location. Automated orchestration of workloads means that a database might be running on one container now and on a different one, with a different IP address, 10 minutes later. Or, perhaps, tomorrow, the whole cluster will move to a different cloud provider entirely. This is why organizations need to use more modern, cloud-specific solutions rather than older ones not meant for the cloud.

    Cloud Providers’ Own Security Tools: A Limited Answer

    The major cloud providers all use what’s called “the shared responsibility model,” which, at a very simplistic level, distinguishes between security “of the cloud” (the provider’s responsibility) and security “in the cloud” (the customer’s responsibility). “Shared responsibility” does not translate into shared accountability. When it comes to the physical security of public cloud data centers, organizations need not worry; the cloud providers operate such security at the highest standards, similar to those employed by major banks and government agencies. But for everything else, the responsibility lies squarely with the customer organizations — in fact, Gartner predicts that through 2025, 99% of cloud security failures will occur on the customer’s side.

    The tools offered by the cloud security providers (CSP) usually provide partial coverage for customer needs and increase the dependency of the customers on the cloud provider, but are not equally effective in protecting the multi-cloud environment, especially private clouds.

    The New Stack is Great for Security

    The good news is that the technologies that are used to run the new stack, such as containers and Kubernetes, enable better security than was ever possible before, and with more granular visibility and automation. They also make it easier to transfer security across private and public cloud environments, provided that the security controls are applied correctly.

    Since containers are made to be portable and Kubernetes was made to be intraoperative with any cloud environment, if you attach security tooling that was specifically designed to protect your containers, you can run them anywhere uniformly, regardless of where your applications are.

    Due to the complexity of cloud environments and the many moving parts involved, planning the tech stack requires a holistic approach to defend applications across their entire lifecycle — from development to production. Such an approach should be able to handle multiple security gaps across both infrastructure components and application code, whether managing vulnerabilities, misconfigurations, malware or behavioral anomalies.

    The Born-in-the-Cloud Approach

    Companies now are not only born in the cloud but specifically set out to secure the new cloud native stack, from containers to VMs and serverless. Cloud Native Application Protection Platform (CNAPP) — a new category named by Gartner — protects enterprise applications against attacks, which are increasing as the adoption of cloud grows.

    While the future of cloud security is bright, the present is uncertain. This is due to the increase in the volume and sophistication of attacks that specifically target cloud infrastructure and supply chains. A vulnerable or badly configured Kubernetes node will be targeted within as little as 20 minutes. These sophisticated attacks might result in a variety of malicious outcomes, from cryptocurrency mining to credentials theft, and from rootkit installation to network traversal.

    The lag between the race to move more workloads to the cloud and the ability to secure those workloads stems from knowledge and skills deficits, but there are platforms to bridge those gaps. More importantly, companies can achieve an unprecedented level of security as a result of the high level of policy-driven automation, the reduction in attack surface, and the ability to detect the smallest drift or behavioral anomalies of application components. Security methods that are an integral part of developing, deploying and running cloud applications are the way forward.

    Resource : https://threatpost.com/secure-move-cloud/180335/

    15Oct, 2022
    Policy-as-code approach counters ‘cloud native’ security risks

    So-called ‘cloud native’ IT architectures are creating new threats for organizations, just as they look to update their technology infrastructure, security researchers have warned.

    Over half of developers and security professionals expect the risks to their organizations to increase over the next year, according to research from developer security tools vendor Snyk. The drivers include cloud-native threats and, especially, control plane compromises.

    Other potential problems include misconfigured cloud resources, as well as compromised credentials.

    Speaking at the recent International Cyber Expo in London, Ashish Rajan, principal cloud security advocate at Snyk, explained that security breaches are no longer only about data. Increasingly, criminal groups are also looking to steal or expose credentials, including cloud infrastructure credentials.

    Rajan cited the recent breach at ride-hailing company Uber, which used social engineering as part of an attack that ultimately succeeded in gaining access to the company’s credentials for Amazon Web Services and Google Workspace.

    “It’s not just a breach, a release of records, they also shared the AWS and Google Cloud credentials on the internet as well,” he said. “We are actually talking about data breaches creeping into our cloud environment or even broader production environments as well.”

    Credentials targeted

    Attackers are searching for credentials for cloud services by searching for ‘open S3 buckets’, blob storage or other open storage sites, as well as GitHub repositories, SSH [Secure Shell] and SSL vulnerabilities, and even posts by developers on sites such as Stack Overflow. “People are finding easier targets,” Rajan said.

    This is forcing developers to pay more attention to both application security and cloud security, the speaker argued. Although organizations and their developers increasingly understand the need for application security, cloud security is too often treated separately rather than as part of the same problem, he asserted.

    “In my previous company, we had a product security team and we had cloud people. But they weren’t on the same team. It didn’t make sense. We were still protecting this one application,” said Rajan.

    Cloudy with a chance of breaches

    And the situation is made more difficult still by the ‘shared responsibility’ model of cloud security. Too often, contended Rajan, developers and their managers rely on the cloud provider’s security measures, rather than ensuring that their infrastructure and code is secure.

    According to Snyk’s 2022 State of Cloud Security Report, 80% of organizations experienced a “serious cloud sec incident” during the past year. Of those, 33% suffered a cloud data breach, and 26% a cloud data leak. A further 27% detected an intrusion into their environment.

    Catch up on the latest DevSecOps-related news and analysis

    The research also found that companies that use the cloud to host applications that had migrated from a data center were the most likely to report serious cloud security incidents: 89% did so during the past year.

    That was higher than the total for organizations using the cloud to build and run in-house applications (73%) or those hosting third-party applications (78%).

    Infrastructure as code

    To counter this, Rajan suggests that developers should follow five fundamentals of cloud security. These are knowing the operating environment, focusing on prevention and secure design, empowering developers, using policy as code to align with security requirements and automate compliance, and ensuring security teams are “measuring what matters”.

    To adhere to these fundamentals, organizations should be looking to ’shift left’ and build in security checks earlier in a project’s timeline. Firms should map out a cloud secure development lifecycle, using infrastructure as code (IaC) tools and CI/CD pipelines. And organizations can take this a step further by defining security policies within IaC.

    This, Rajan said, removes, or at least reduces, one of the most common causes of cloud security failures: human error.

    “What’s the policy look like? Can I define the policy as IaC? That’s where a lot of people have found that you can reduce credentials being leaked or over-privilege, or misconfiguration of resources, as well as having identity not in control,” he said. Policy as code allows organizations to apply their security rules, whether they use a single cloud platform, or two or even three, added Rajan.

    Resource : https://portswigger.net/daily-swig/policy-as-code-approach-counters-cloud-native-security-risks

    6Oct, 2022
    Want More Secure Software? Start Recognizing Security-Skilled Developers

    Professional developers want to do the right thing, but in terms of security, they are rarely set up for success. Organizations must support their upskilling with precision training and incentives if they want secure software from the ground up.

    The cyber threat landscape grows more complex by the day, with our data widely considered highly desirable “digital gold”. Attackers are constantly scanning networks for vulnerable applications, programs, cloud instances, and the latest flavor of the month is APIs, with Gartner correctly predicting that they would become the most common attack vector in 2022, and that is in no small part thanks to their often lax security controls.

    Threat actors are so persistent that new apps can sometimes be compromised and exploited within hours of deployment. The Verizon 2022 Data Breach Investigations Report reveals that errors and misconfigurations were the cause of 13% of breaches, with the human element responsible overall for 82% of the 23,000 analyzed incidents.

    It’s becoming very clear that the only way to truly fortify the software being created is to ensure that it’s built on secure code. In other words, the best way to stop the threat actor invasion is to deny them a foothold into your software in the first place. Cybercriminals are at a distinct advantage against organizations scrambling to defend their often vast attack surface, and any windows of opportunity that can be shut for good significantly reduce risk.

    We make it hard for security stars to shine

    The current status quo for developers at many organizations is such that their primary role is to build awesome features and deploy software at speed. The faster that developers can code and deploy, the more valuable they tend to be seen in terms of their performance reviews.

    Security can be an afterthought, if considered at all, and is conspicuously absent as a measure of developer success. The 2022 State of Developer-Driven Security Survey in conjunction with Evans Data supports this outlook, with 86% of surveyed developers revealing that they do not view application security as a top priority. Instead, much of that is left to the application security (AppSec) teams to figure out. AppSec teams tend to be a source of frustration to most developers, because they would often send completed applications back into development to apply security patches, or to rewrite code to remediate vulnerabilities. And every hour that a developer spent working on an app that was already “finished” was an hour they were not creating new apps and features, thus decreasing their performance (and their value, in the eyes of a particularly punitive company).

    However, the modern threat environment has forced everyone, from companies to government departments, to rethink the importance and prioritization of security, and they would be well-placed to consider how the development cohort fits into a defensive approach. According to the recent 2022 Cost of a Data Breach Report from IBM and the Ponemon Institute, the average cybersecurity breach now costs about $4.24 million per incident, although that is hardly the upper limit. The companies of today want the security offered by DevSecOps, but, sadly, have been slow to reward developers who answer that call.

    Simply telling the development teams to consider security won’t work, especially if they are still being incentivized based on speed alone. In fact, within such a system, developers who take the time to learn about security and secure their code could actually be losing out on better performance reviews and lucrative bonuses that their less-security-aware colleagues continue to earn. It’s almost like companies are unwittingly rigging the system for their own security shortcomings, and it comes back to their perception of the development team. If they’re not seeing them as the security frontlines, then it’s very unlikely a viable plan to utilize their workforce will come to fruition.

    And this doesn’t even account for the lack of training. Some very skilled developers have decades of experience coding, but very little when it comes to security… after all, it was never required of them, nor a measure of success or quality work. Unless a company provides a good training program, it can hardly expect its developers to suddenly gain new skills and put them into action in a meaningful way that actively reduces vulnerabilities.

    (Want to compete against other elite developers from around the world, or nominate your own dev team of security superstars? Join Secure Code Warrior‘s 2022 Devlympics, our biggest and best global secure coding tournament, and you could win big!)

    Rewarding developers for good security practices

    The good news is that the overwhelming majority of developers do their job because they find it both challenging and rewarding, and because they enjoy the respect that their position entails. Lifelong software engineer Michael Shpilt recently wrote about all of the things that motivate him and his colleagues in their development work. Yes, he lists monetary compensation among those incentives, but it’s surprisingly far down the list. Instead, he prioritizes the thrill of creating something new, skills development, and the satisfaction of knowing that his work is going to be directly used to help others. He also talks about wanting to feel valued within his company and community. In short, developers are no different to a lot of good people who take pride in their work.

    Developers like Shpilt don’t want threat actors compromising their code and using it to harm their company, or the very users they are trying to help. But, they can’t suddenly shift their priorities to security without support.

    To help development teams improve their cybersecurity prowess, they must first be taught the necessary skills. Utilizing a tiered approach to learning – as well as tools that are purpose-built to integrate seamlessly into their actual workflow – can make this process much less painful while helping to build upon existing knowledge in the right context.

    With a commitment to upskilling in place, the old methods of evaluating developers based solely on speed need to be eliminated. Instead, developers should be rewarded based on their ability to create good, secure coding patterns, with the best candidates becoming security champions that help the rest of the team improve their skills. And those champions need to be rewarded with both company prestige and monetary compensation. It’s also important to remember that developers don’t typically have a positive experience with security, and uplifting them with positive, fun learning and incentives that speak to their interests will go a long way to ensuring both knowledge retention and a desire to keep building skills.

    Resource : https://thehackernews.com/2022/10/want-more-secure-software-start.html

    29Sep, 2022
    Information Security Javatpoint

    What is the Information Security Javatpoint?

    Javatpoint is a Java-based web application that enables users. Also, it is to access Java tutorials, API documentation, code samples, code golf, and programming contests.

    Javatpoint can be accessed by typing http://javatpoint.com in your browser or through the Java SE Downloads page. If you are using Linux or Mac OS X you will have to download the Java Runtime Environment at first. 

    Javatpoint provides you with the best-in-class features and experience. This website provides detailed information about Java technology. You can also access tutorials, API documentation, code samples, code golf, and programming contests here. 

    Javatpoint is the official website of Oracle Corporation. Also, Javatpoint provides tutorials that help you to learn about Java technology. You can also access API documentation, code samples, code golf, and programming contests here. 

    The Javatpoint site is accessible from any computer via the Internet. However, if you are behind a corporate firewall or proxy server, you may need to enter a special URL to access Javatpoint. 

    Goals and Visions

    Javatpoint is the official website of Oracle Corporation. Also, Javatpoint provides tutorials that help you to learn about Java technology. You can also access API documentation, code samples, code golf, and programming contests here. 

    Javatpoint provides you with the best-in-class features and experience. This website provides detailed information about Java technology. 

    You can also access tutorials, API documentation, code samples, code golf, and programming contests here. Also, the Javatpoint site is accessible from any computer via the Internet. 

    However, if you are behind a corporate firewall or proxy server, you may need to enter a special URL to access Javatpoint. 

    Features and Benefits

    Javatpoint is maintained by a team of Java experts. Also, this website contains detailed information about Java technology. 

    You can also access tutorials, API documentation, code samples, code golf, and programming contests here. Also, the Javatpoint site is accessible from any computer via the Internet. 

    However, if you are behind a corporate firewall or proxy server, you may need to enter a special URL to access Javatpoint. 

    Javatpoint provides you with the best-in-class features and experience. This website provides detailed information about Java technology. You can also access tutorials, API documentation, code samples, code golf, and programming contests here.

    Information Security Javatpoint: Challenges

    If you want to use Javatpoint, you need to open your browser, type the URL in your address bar, and press enter. Also, if you want to use Javatpoint, then you need to open your browser and type http://javatpoint.com in your address bar.

    However, in some situations, you need to enter a special URL to access Javatpoint. You will get this special URL when you try to access Javatpoint from behind a corporate firewall or proxy server. 

    Accessing Javatpoint via Corporate Firewall or Proxy Server

    There are many corporate firewalls or proxy servers that can cause problems when you try to access Javatpoint from the Internet. 

    If your company has a firewall or proxy server, you need to enter a special URL to access Javatpoint from the Internet. Otherwise, you will get a blocked page. 

    Conclusion

    Javatpoint is a Java-based web application that enables users. Also, it is to access Java tutorials, API documentation, code samples, code golf, and programming contests.

    Javatpoint can be accessed by typing http://javatpoint.com in your browser or through the Java SE Downloads page. If you are using Linux or Mac OS X you will have to download the Java Runtime Environment at first. 

    Resource : https://www.information-security-today.com/information-security-javatpoint/

    26Sep, 2022
    Benefits of Information Security

    Information security is more critical now than ever before. With the recent controversies surrounding data leaks that have taken place across the globe, there has never been a more pressing time for businesses to take steps to protect their data. In this article, we’ll explore some benefits of information security and some information about what’s happening in cybersecurity.

    Why you Need to be Concerned With Information Security

    Information security is the process of protecting electronic information from unauthorized access, use, or disclosure. Organizations must be concerned with various threats that could potentially impact their data and systems to maintain an effective information security program.

    Some of the most common threats to electronic information include:

    • Insiders who have access to sensitive data but may not have the proper permissions
    • Hackers who attempt to breach systems and steal sensitive data
    • Spammers who use unsolicited messages to spread malware or viruses
    • Extortionists who threaten companies with exposure of confidential information to extract payments

    The benefits of having an effective information security program are numerous. Some of the most significant include:

    • Reduced risk of data theft and loss
    • Enhanced protection against malware and viruses
    • Reduced reliance on third-party vendors and systems
    • Improved efficiency and productivity due to reduced vulnerability to cyber attacks

    The History of Information Security

    Information security has been around for centuries, with the first computer networks dating back to the 1950s. Information security is essential because it protects data and information confidentiality, integrity, and availability. Information security is also necessary to maintain an efficient business operation.

    There are many benefits of maintaining an effective information security program:

    1. It can protect your company’s assets from theft or damage.
    2. An effective information security program can help protect your company’s customers’ data from unauthorized access.
    3. A well-functioning information security program can help ensure that your employees are productive and safe while working with confidential data.
    4. An effective information security program can keep your company out of legal trouble.
    5. A well-functioned information security program can promote trust and faith in your company among customers and other businesses.

    The Five Risks

    Facing the risks of cybercrime is a daily reality for many businesses. Here are five key risks to consider when it comes to information security: 

    1. Data loss. Cybercriminals can steal or corrupt your data, seriously harming your business. Protect your data by using robust security measures and keeping up with regular updates.
    2. Business disruption. A cyberattack can cause significant damage to your business, including lost revenue and customer trust. Make sure you have robust security measures to prevent such an event from happening and quickly respond to any disruptions that occur.
    3. Legal liability. You could be held liable if someone suffers damages due to a cyberattack. Ensure your business is fully protected from legal liability by implementing sound information security practices.
    4. Risks to personnel. A cyberattack can also put your employees at risk, including those who handle sensitive data or operate systems on behalf of the business. Please ensure you have robust security measures in place to protect them from attack and that they are up-to-date on the latest safety precautions.
    5. Reputation damage. A cyberattack can tarnish your reputation, mainly if it targets your brand. A public cyberattack can substantially impact your brand and the importance of your company, products, or services.

    Benefits of Information Security

    Information security can help protect your organization’s data, technology, and assets from unauthorized access or theft. Here are some of the benefits of implementing good information security practices:

    1. Protects data: Data security protects confidential information such as customer records, business secrets, and trade secrets. It can also protect data needed to run your business, such as financial information and employee data.
    2. Protects technology: Good information security practices protect your organization’s computer systems and networks from unauthorized access, use, or disclosure. In addition, they can help prevent cyberattacks in which malicious actors attempt to damage or destroy systems or steal sensitive information.
    3. Protects assets: Security measures can help protect physical assets such as buildings and equipment from being damaged or destroyed by theft or vandalism. They can also help reduce the risk of fraud and other crimes by protecting valuable intellectual property (IP) and trade secrets.
    4. Reduces costs: Implementing good information security practices can often reduce the costs associated with incidents that result in data loss, system downtime, or fraud losses. In addition, it can help avoid costly lawsuits arising from incidents that do not involve data loss but do involve reputation damage and other costs.
    5. Enables compliance: Security can help organizations meet legal, regulatory, and contractual obligations. This is generally true of information security programs in any industry. Still, it is vital for financial institutions—such as banks, credit unions, and brokerages—that have a legal obligation to protect customer data and adhere to privacy laws.
    6. Improves efficiency: Information security improves operational efficiency by reducing the time spent responding to incidents, onboarding new employees, or accommodating system downtime by minimizing disruption.
    7. Increases employee productivity: Good information security practices enable organizations to work more efficiently and effectively by reducing wasted time and effort from system disruptions or malicious attacks.

    Cyber Security Career

    There are many reasons to pursue a career in information security, and cyber security is undoubtedly one of the most exciting and profitable options.

    Cybersecurity professionals work in various capacities, from developing and implementing effective computer systems security measures to providing customer support for online security concerns. The field is increasing, and there are many opportunities for career growth.

    The benefits of pursuing a career in information security include:

    • Competitive salary. Cybersecurity careers offer high salaries, especially if you have experience in a specialized area. The median annual wage for cyber security professionals was $86,030 in 2016, according to the Bureau of Labor Statistics (BLS).
    • Variety of career opportunities. Cybersecurity jobs range from development and management positions in government and industry to technical support roles. You can find the perfect position for your skills and interests by researching specific cybersecurity fields.
    • Good working conditions. Many cybersecurity jobs are highly technological, so you’ll enjoy excellent working conditions. Job stability is also high due to the need for specialized skill sets and the relatively small number of job vacancies.
    • Ability to work remotely. Many cyber security jobs allow you to work remotely, which can help you accommodate your family’s needs.
    • Career opportunities. Your career can take many paths, as cyber security has various areas to explore and grow. Whether you want to work in a governmental office or an industry leader, this field is growing and offers plenty of opportunities for advancement. The next time you look at an IT job advertisement, remember that cybersecurity jobs are nearly as good!

    Conclusion

    Information security is a topic that can be overwhelming for many people. However, there are some benefits to learning about and practicing good information security habits. By understanding the risks and taking steps to protect yourself, you can help ensure that your business remains safe and protected from potential damage. Thanks for reading!

    Resource : https://www.linkedin.com/pulse/benefits-information-security-reverse-lookup-services/

    26Sep, 2022
    ONLINE SAFETY CYBER SECURITY INTERNET PRIVACY

    What is Cyber-Security?

    Cyber-Security refers to the act of protecting and ensuring the safety of computer systems and electronic devices from targeted cyber-attacks, opportunist malware (- viruses, trojans and bugs) or accidental introduction of malware by users. The global scale of cyber-threats continues to rise rapidly. In the modern day and age, access to volumes of data has gained currency, and hence every year, numerous attempts are made to breach data, and/or sensitive, confidential or classified records to expose information for political or economic gains. Effective cyber-security practices as a countermeasure, thus have become important.  There are three types of cyber-threats –

    • Cyber-Crime: wherein single actors or group of actors target systems for financial gains or to cause disruption
    • Cyber-Attack: involves gathering information for political or economic means
    • Cyber-Terrorism: aims to undermine electronic systems with an intent to instill fear or to cause panic

    End-user Protection is an important aspect of cyber security. It is imperative to ensure that users are educated to protect their systems and themselves from cyber-threats. It is found that introduction to malware is (accidentally) often caused by users themselves. It is thus crucial that users are able to detect such malware, update their systems timely, and refrain from using unsecure networks.

    Cyber security issues in India

    India is home to a population which is rooted in diverse socio-economic backgrounds. As per the living standards of people, a wide range of devices are in use – from high-end secured electronic devices to low-cost mobile phones. This makes it difficult for authorities to set uniform legal and technical standards for regulating data-protection. Additionally, digital literacy and awareness among the population is also very low.

    Risks of harm and threats for Children in a Digital age

    Children and young people, globally, in an increasingly digitally connected world, are among the most active users of Internet and web-based services. It is estimated that 1 in 3 children worldwide use the internet, or, one can say that 1 in 3 internet users is a child under 18 years of age. Children tend to surf the web to access educational information and content for entertainment, to develop their digital skills to acquire new opportunities, or to maintain their online/digital identities and social relationships. However, increased access to information at various web-platforms also lead to increased exposure to materials which are neither age-appropriate nor suitable for children for viewing, and/or risks/threats that children face online. Owing to their young age and evolving development capabilities, children and young people are vulnerable to abuse and exploitation at the hands of cyber-predators and perpetrators.

     The COVID-19 pandemic, lockdowns and restrictions on mobility made digitization the need of the hour. Closure of schools and a shift from attending classes in person to technology-based remote learning through virtual/digital education platforms not only dehumanized learning environments and distorted social interactions for children, but also isolated them in navigating the digital space. This new development increased children’s exposure to internet, virtual/digital media, exponentially and brought forth additional stressors related to their safety and protection online, consequently impacting their mental health and well-being. In this changed paradigm, novel child protection concerns have emerged – such as – digital addiction, cyber-bullying, access to/exploitation for pornographic material, prevalence of Child Sexual Abuse Material online (CSAM) etc. Additionally, social media platforms, chat rooms, computer games etc. open a “Pandora’s-box” for children’s safety and security. Often, parents and guardians lack digital-literacy and in most cases are unaware of the ill-effects of such exposure on mental and emotional well-being of children.

    Resource : https://www.childlineindia.org/a/issues/online-safety?gclid=CjwKCAjw-L-ZBhB4EiwA76YzOT89IKxRC2LQJl1NKX3V5J5JIJ-4k1Ic9NXcn0k8IbBWR6l_h87Y9BoCGk4QAvD_BwE