Tag Archives: Cyber Risk

Immediate Vault Immediate Access

Five Strategies to Protect Against Ransomware and Other Cyberattacks

Posted on by

As organizations continue to adapt to remote or hybrid work models, it has never been more vital to have a robust cybersecurity program to better protect against ransomware attacks and other cyberattacks against company systems and personnel. Ransomware attacks have proven a particular risk in recent years, with attacks like the Colonial Pipeline and myriad attacks on health care organizations demonstrating the serious impact of cyberattacks beyond financial risks, affecting everyday life and business operations.

Ransomware and other cyberattacks are always evolving. Attackers are constantly finding new ways to infiltrate environments while trying to stay undetected. Cyberattacks can target many different points in an organization’s ecosystem, including firewall configuration, patch management, network segmentation and defensive technology. The following five strategies can help companies mitigate cyberrisk and respond to threats quickly and efficiently:

1. Strengthen Asset Inventory
You cannot protect what you do not know exists or cannot see. Having an efficient asset management program can significantly increase visibility and rapidly provide detailed information about systems in the event of a cyberattack. Organizations should document system or device types, operating systems and software used. To be more granular and aggressive, consider documenting what ports and service systems use for business functions and use that as a baseline for future firewall rules and network exceptions.

buy naprosyn online www.biop.cz/slimbox/css/gif/naprosyn.html no prescription pharmacy

Having a strong program is key for every organization, but is even more important in remote work environments.

2. Conduct Security Awareness Training
A comprehensive and effective security awareness program for employees benefits the organization at large. An efficient security awareness program extends visibility and cyber threat detection beyond defensive technologies applied in the environment by empowering people to be a critical line of defense. A robust security awareness training program allows employees to assist with the detection of network anomalies, suspicious emails and other potential threats.

3. Assess Antivirus and Endpoint Detection and Response Programs
Traditionally, antivirus programs have helped detect malicious activity. However, the problem with the traditional antivirus approach in modern day cybersecurity is that attackers regularly update their code to obfuscate and bypass signature-based antivirus products. By employing an endpoint detection and response (EDR) product, organizations create an efficient response to detecting malicious programs and activities based on network anomalies rather than signatures alone. If purchasing and implementing an EDR solution is not viable, consider additional layers of defense around the antivirus software. Ultimately, the goal is to increase visibility and the ability to alert upon suspicious activity.

4. Monitor and Detect New Processes
In addition to having inventory on assets, an organization should document legitimate system processes and software. Upon gaining access to an environment, ransomware downloads and executes its installer to infect the victim. Ensuring visibility into your environment can help IT and information security teams to detect programs or processes with behaviors that deviate from the norm. In turn, this allows operations and incident response teams to respond quickly in the event of those anomalies.
One example is Microsoft Windows’ AppLocker, which generates messages and alerts about anomalies such as when an attacker attempts to install an executable outside of the known baselined created. By creating baseline rules, AppLocker will create an 8003 warning message that can be collected and parsed using a security incident and event management (SIEM) product or log aggregator and monitored by the IT or information security team.

5. Network Anomaly Detection
Ransomware moves laterally across the network while infecting systems. This can be done quickly while raising flags or network anomalies such as authenticating to several systems within minutes. It is uncommon for systems or domain administrators to connect to multiple systems rapidly and on a large scale on internal networks. To differentiate between legitimate and potentially malicious activity, network administrators must first document legitimate network connections and known behaviors. This supports anomaly detection by establishing outbound and inbound connectivity from the organization’s servers.

buy symbicort inhaler online www.biop.cz/slimbox/css/gif/symbicort-inhaler.html no prescription pharmacy

Once the legitimate network connection is documented and a baseline is created, you can leverage defensive technologies and monitoring programs to alert when deviations occur. Then, create alerts in firewalls and SIEM solutions to quickly detect and respond to network anomalies.

As cybercriminals become more advanced, cybersecurity programs must also evolve to identify and prevent malicious behavior. By implementing the best practices and strategies mentioned above, organizations can dramatically reduce their exposure to ransomware and other cyberattacks.

How to Conduct Better Third-Party Risk Assessments

Posted on by

Today’s enterprises operate in a complex digital ecosystem that connects customers, vendors and partners and through which data is shared and transactions are processed. Because much of this is done through outsourcing of systems and services to third parties, many enterprises have dramatically increased the scale and complexity of their risk surface.

While companies are reliant on third and fourth parties to do business and often benefit from using such external services, these relationships also pose a risk to the enterprise’s sensitive data. Enterprises rely on these third parties to fulfill essential services and often expect them to secure the enterprise’s data in the process. Unfortunately, this does not always happen. 

According to a survey by RiskRecon, a Mastercard company, and the Cyentia Institute, third-party risk practitioners said that 31% of their vendors could cause a critical impact to their organization if breached, while 25% claimed that half of their entire network could trigger severe impacts.

Recent catastrophic cybersecurity incidents like the SolarWinds case demonstrate that cyberrisk can come from supply chain layers beyond the company’s immediate third parties. These multi-party cyber breaches create a ripple effect and threaten to have a far greater impact than those affecting single companies.

Business leaders, third-party risk practitioners, and cybersecurity professionals are well aware of the potential impacts of third-party risk, yet many struggle to keep up. In fact, research shows that only 14% of third-party risk professionals are confident that vendors are capable of meeting third-party security requirements. Managing vendor risk can seem like an impossible problem, but the key is having greater visibility into your digital supply chain and monitoring the external parties that pose the greatest risks to your firm.

Traditional Risk Assessments vs. Continuous Third-Party Monitoring

Traditional risk assessment processes cannot fully address today’s dynamic cyberrisk landscape, as they can be difficult to validate, take a long time for both the vendor and the organization to process, and are pinned to a single point in time. Without a valid, current assessment, security teams are forced to prioritize vulnerabilities blindly, which ultimately compromises risk mitigation, and limits their value as an accurate barometer of third-party risk.

It can be easy and tempting to complete a third-party risk assessment in one month and then forget about it for another year, but third-party risk management is not a once-a-year project—it requires an ongoing program with ongoing monitoring. This may appear to be overwhelming, confusing and time-consuming. While there will always be more vendors to find, a well-structured and continuous third-party monitoring program can help your security team to prioritize.

It is also important to take action on the vulnerabilities these critical vendors produce and gain visibility into how to remediate these issues. Continuous third-party monitoring can not only help you identify and remediate risk, but can also serve as a helpful tool in communicating your organization’s security hygiene to board members or executive leadership.

Below are practical steps that cybersecurity teams and risk professionals can take to better manage their organization’s third-party cyberrisk:

  1. Ask the right questions: Build and collect security questionnaires that ask important questions about how a vendor is handling the company’s data. To better manage risk, security teams need insight into the technologies that are being used internally and externally by third parties, fourth parties, and beyond.
  2. Assign a risk rating: Based on the answers to the questionnaires, assign the vendor a risk rating. By having a clear understanding of a vendor’s security posture, the security team can then rank vulnerabilities in order of priority, so they know which issues to tackle first.
  3. Take action: Create custom-fitted risk action plans so you can immediately start engaging with your vendors on remediation. If a vendor’s cyber risk degrades or an element falls out of policy, you will be notified instantly. By having accurate visibility into supply chain risk, security teams can then use that information to make decisions about whom to share data with moving forward.

By utilizing these best practices, organizations can better manage their third-party risk, further reduce overall risk, increase cyber visibility, and improve the quality of vendor and supplier networks.

Successfully Navigating Identity Management Strategies

Posted on by

For many CISOs, overseeing identity management represents a significant challenge and a substantial component of their broader security ecosystem. In a nod to its importance, the National Cyber Security Alliance even recently kicked off the first ever Identity Management Day. It is also central to a number of critical issues that urgently need a CISO’s attention, namely data access governance, data loss prevention and cloud application security.

When navigating the vital issue of identity, the top considerations include:

Data Access Governance

Data security spans two areas of organizational risk: unauthorized data use and privacy issues associated with authorized data processes. When evaluating an identity management strategy, it is imperative to start at a high level, which includes data access governance to limit access and meaningfully reduce the risk of loss or theft.

An effective end-to-end approach provides visibility and controls to identify risk and protect sensitive information across cloud and on-premise networks while also keeping digital communications compliant. This approach involves establishing a data governance program, which includes data inventory, data mapping, needs-based permissions and, ultimately, data retention and erasure. Critical components in overall data access considerations include understanding what data is being collected, where and how it is stored, who is accessing that data, protection mechanisms in transit and at rest, and how long the data is being retained.

Proper data access governance is essential to ensuring successful digital transformation as remote/hybrid work continues, both email and cloud apps remain core communication channels, and social media continues to drive business.

Data Loss Prevention

Protecting information both at rest and in motion are important elements of another identity management issue: data loss prevention (DLP). Data is lost due to negligent, compromised, or malicious users and it is important to approach DLP in manageable terms. For example, full data classification and discovery is idealistic for many. Complete reliance on both fronts is hard, if not impossible.

Traditional data loss prevention approaches, such as full data discovery, have arduous requirements and usually involve mandatory outsourcing for development and monitoring. In fact, many CISOs only want to tackle the DLP challenge once in their career.

Fortunately, modern strategies are available to manage DLP efforts that focus on protecting the most sensitive information in terms of content type, context, and user behavior. These include systems that issue accurate alerts, reduce investigation time, and focus security teams on risky user behavior rather than solely on classification violations.

online pharmacy female cialis with best prices today in the USA

An approach that places an emphasis on user behavior, in addition to classification, is pivotal to identifying compromised accounts and phished users. Data does not lose itself, but proper DLP can stop bad actors and insider risks from siphoning critical assets.

Cloud Application Security

In a Cloud Security Alliance study of 200 IT professionals, 83% indicated that cloud security is a top area for improvement. This is not surprising in our current climate as CISOs are constantly struggling to ensure they have visibility and control over how users access and share sensitive data in the cloud. It only takes one compromised account to expose an organization to significant risk.

For example, according to a 2020 Proofpoint analysis of over 20 million cloud account users and thousands of cloud tenants across North America and Europe, attackers are increasingly abusing legitimate OAuth authorization apps to exfiltrate data and maintain persistence on specific cloud resources after compromising an account.

Over the last year, threat actors targeted 95% of organizations with cloud account compromise attempts, and more than half of organizations were successfully compromised at least once. Discovering cloud apps and reducing shadow-based IT—including third-party OAuth authorization apps—helps limit accessing and sharing data to only authorized users.

Every cloud app security broker (CASB) strategy needs to address how individuals handle data and the threats targeting them. It is imperative that threat visibility and adaptive controls extend to the most attacked people and operate effectively in the cloud.

online pharmacy avodart with best prices today in the USA

This includes deployment of multifactor authentication solutions, the ability to detect suspicious login attempts, and user education.
online pharmacy amoxicillin with best prices today in the USA

Also, deployed cloud DLP policies need to align with those for email and on-premises file repositories. Finally, DLP incident management should be centralized and span across cloud apps.

The issue of identity management will continue to play a central role in security strategies for years to come. Focusing on data access governance, modern DLP and effective cloud app security can help significantly reduce an organization’s risk.

Inside a Business Email Compromise Operation

Posted on by

A new report from cybersecurity company Agari’s Cyber Intelligence Division outlines the operations of a business email compromise (BEC) gang in West Africa, showing that criminals who engage in BEC online theft can have a diverse portfolio of online criminal activity that they use to build their capabilities, and use sophisticated methods to scam their victims, including businesses and government agencies.

BEC is a cyberfraud tactic in which a scammer will contact a target using phishing emails imitating a fellow employee of the target (often someone in the finance department or management) usually seeking to convince the victim to conduct a business transaction, most likely a money transfer to an account run by the scammer. The scammers may also try to trick their victims into clicking a link in an email or visiting a scam website, which could provide the scammers with the victim’s online credentials or download malware onto the victim’s computer and gain access to their company’s network.

As Risk Management previously reported, Beazley Breach Response Services found that BEC-related attacks cost victims an average of $70,960, but the FBI’s Internet Crime Complaint Center has estimated that the total “revenues” of BEC attacks doubled in 2018 to $1.3 billion. BEC attacks are also extremely common—approximately two-thirds of IT executives are reportedly dealing with them.

Agari’s report, titled “Scattered Canary: The Evolution of a West African Cybercriminal Startup,” shows that cybercriminal gangs diversify their criminal schemes, using their established infrastructure from one type of scam to facilitate others. Agari researchers named the group Scattered Canary and compared it to a tech startup because of its recruitment and expansion strategy. Scattered Canary has pursued a variety of different criminal social engineering efforts, including:

  • Romance scams: Creating a fake online romantic relationship with a victim and requesting gifts, access to their bank or retirement accounts, or services related to other scams.
  • Check fraud: A scammer offers to purchase an item for more than its advertised price with a check (which is fraudulent), then requests that the seller send the extra amount to a third party (a fictional shipping company, for example).
    buy cellcept online blockdrugstores.com/wp-content/uploads/2023/10/jpg/cellcept.html no prescription pharmacy

  • Credential harvesting: Tricking victims into providing their online credentials, including log-in information for online financial services.

Agari says that Scattered Canary built up a network of members and the skills to easily transfer from one scheme to another.

buy zetia online blockdrugstores.com/wp-content/uploads/2023/10/jpg/zetia.html no prescription pharmacy

The group has used multiple BEC tactics over time, transitioning from tricking employees into carrying out wire transfers from their companies’ bank accounts to convincing victims to buy gift cards that scammers would then cash out via cryptocurrency exchanges.

buy levofloxacin online blockdrugstores.com/wp-content/uploads/2023/10/jpg/levofloxacin.html no prescription pharmacy

More recently, the group has targeted human resource departments to change the direct deposit information for a company’s executive, then cashed out the deposits using prepaid debit cards.

Businesses should train their staff at all levels on how to spot BEC and other types of online scams. If employees can recognize phishing emails and websites, and know not to click links or provide information in response to either, this can protect companies from fraud and significant financial loss. In addition to training staff, the FBI suggests always verifying requests to send money, even if the email requesting the transfer is urgent, by speaking directly to the person who seems to be requesting the money on the phone (using the previously known number, not the one provided in the email) or in person. The FBI also suggests setting up filters that flag email addresses that are similar to the company’s email, and creating an email rule that notes emails coming from outside the company, among other technical steps.

For more from Risk Management about controlling the risks of BEC and other social engineering fraud, check out: