Tag Archives: Data Breach

Immediate Vault Immediate Access

Insider Fraud: How to Identify and Prevent Internal Threats

Posted on by

Organizations of all sizes, across all industries have become data breach victims as cyber crooks become more sophisticated in identifying vulnerable targets.

buy cenforce online www.handrehab.us/images/patterns/jpg/cenforce.html no prescription pharmacy

Attackers can compromise an organization within scant minutes in 60% of breaches, reports the latest Verizon Data Breach Investigations Report. Still, insiders persist as one of the biggest fraud perpetrators, costing organizations globally about $3.7 trillion annually in 2014, estimates the Association of Certified Fraud Examiners. The puzzling question is this: With the advances in technology, why aren’t organizations preventing these incidents and why aren’t the offenders being nabbed earlier?

The answer to the insider fraud dilemma lies in a lag in robust risk-management technologies that help organizations identify and prevent insider fraud, especially in such industries as banking. With this type of breach, tracking behavior becomes a key component of managing risks and threats proactively. While basic data tracking isn’t new, what is fresh is grasping the internal behavior of employees in a real time, comprehensive view across multiple platforms and applications.

Unfortunately, disparate legacy systems that don’t share information easily create larger problems by limiting an organization’s ability to monitor across all systems. And siloed information makes it impossible to find “normal” employee behavior that should serve as a benchmark for day-to-day activity.

For example, banks must be on the lookout continually for employees who exhibit illegal behavior when, say, handling a dormant bank account, who are manipulating customer information or who collude with colleagues.

buy finasteride online www.handrehab.us/images/patterns/jpg/finasteride.html no prescription pharmacy

By benchmarking regular employee activity and leveraging link analysis to spot relationships across accounts or employees, banks also can monitor for and spot instances of employee negligence that can offer cyber crooks easy access to customer data.

Sophisticated surveillance technology exists that lets organizations monitor and detect suspicious behavior in real time, then analyze and develop an evidence trail. Organizations can use the following activities to help identify and prevent an internal threat before it escalates and triggers substantial monetary and brand damage.

  • Monitor all user activity: It is critical to establish what is normal and what is abnormal. Each organization has different user personas with unique activities considered “normal.” By defining organizational benchmarks for normal versus abnormal activity, risk managers can identify inconsistencies in employee behavioral patterns.
    buy abilify online www.handrehab.us/images/patterns/jpg/abilify.html no prescription pharmacy

    Visibility into user activity across applications and networks enables them to highlight incidents that warrant deeper analysis and determine threats.

  • Track behavior in real time: Rather than analyze data retroactively, organizations should adopt a solution which can alert from the moment data is captured from the corporate applications and networks. Long-lead systems or those heavily reliant on log-file data don’t allow for real-time tracking and often result in discovering a breach after the fact.

Enable searchability: Organizations can deploy a user-friendly monitoring system with Google-like searchability features with highly specific behavioral criteria. Moving beyond clunky legacy systems to technology that is intuitive eliminates user error and enables more advanced rule-based monitoring.

  • Record screen activity: Gaining visual evidence of illegal activity while it occurs is critical for use during an investigation. Technology that records screen-by-screen activity at the application level creates the comprehensive data trail needed for courtroom presentation.

A combination of these activities can assist organizations in identifying anomalies in employee behavior, track digital activities and contrast them with an employee’s normal routine or that of a peer group’s pattern. If incongruities appear, advanced risk-management technology develops a data trail and a case strong enough to stand up in court. Leveraging these measures, insider fraud can be discovered at an earlier stage to prevent customer data breaches and malicious attacks.

Morpho Hacker Group Targets Intellectual Property

Posted on by

With the highly-publicized rise in cyberbreaches, we have seen hackers break into systems for a variety of reasons: criminal enterprises simply stealing money, thieves gathering Social Security or credit card numbers to sell on the black market, state-sponsored groups taking confidential information, and malicious actors taking passwords or personal data to use to hit more valuable targets. Now, another group of financially-motivated hackers has emerged with a different agenda that may have even riskier implications for businesses.

According to a new report from computer security company Symantec, a group it calls Morpho has attacked multiple multibillion-dollar companies across an array of industries in pursuit of one thing: intellectual property. While it is not entirely clear what they do with this information, they may aim to sell it to competitors or nation states, the firm reports. “The group may be operating as ‘hackers for hire,’ targeting corporations on request,” Symantec reported. “Alternatively, it may select its own targets and either sell stolen information to the highest bidder or use it for insider trading purposes.”

Victimized businesses have spanned the Internet, software, pharmaceutical, legal and commodities fields, and the researchers believe the Morpho group is the same one that breached Facebook, Twitter, Apple and Microsoft in 2013.

Symantec does not believe the group is affiliated with or acting on behalf of any particular country as they have attacked businesses without regard for the nationality of its targets. But, as the New York Times reported, ” the researchers said there were clues that the hackers might be English speakers — their malicious code is written in fluent English — and they named their encryption keys after memes in American pop culture and gaming. Researchers also said the attackers worked during United States working hours, though they conceded that might just be because that is when their targets are most active.”

The researchers have tied Morpho to attacks against 49 different organizations in more than 20 countries, deploying custom hacking tools that are able to break into both Windows and Apple computers, suggesting it has plenty of resources and expertise. The group has been active since at least March 2012, the report said, and their attacks have not only continued to the present day, but have increased in number. “Over time, a picture has emerged of a cybercrime gang systematically targeting large corporations in order to steal confidential data,” Symantec said.

Morpho hacking victims by industry

Morpho hackers have also been exceptionally careful, from preliminary reconnaissance to cleaning up evidence.

In some cases, to help best determine the valuable trade secrets they would steal, the group intercepted company emails as well as business databases containing legal and policy documents, financial records, product descriptions and training documents. In one case, they were able to compromise a physical security system that monitors employee and visitor movements in corporate buildings. After getting the data they wanted, they scrubbed their tracks, even making sure the servers they used to orchestrate the attacks were rented using the anonymous digital currency Bitcoin.

In short, the hackers are really good, according to Vikram Thakur, a senior manager of the attack investigations team at Symantec. “Who they are? We don’t know. They are virtually impossible to track,” he said.

47% of Consumers Have Not Changed Passwords in 5 Years

Posted on by

online security passwords

More than 20% of consumers use passwords that are more than 10 years old, and 47% use passwords that have not been changed in five years, according to a recent report by account security company TeleSign. What’s more, respondents had an average of 24 online accounts, but only six unique passwords to protect them. A total of 73% of accounts use duplicate passwords.

Consumers recognize their own vulnerability.

online pharmacy priligy with best prices today in the USA

Four out of five consumers worry about online security, with 45% saying they are extremely or very concerned about their accounts being hacked – something 40% of respondents had experienced in the past year.

consumers worried about cybersecurity

While some companies may worry that adding too many security measures may frustrate or discourage users, this concern appears unfounded. Two thirds of respondents said they want online companies to provide more security, such as two-factor authentication (2FA). The real issue may be education. Even where this extra layer of protection is available, TeleSign found, a majority has not enabled it, with most among these users reporting that they do not understand what it is or how to use it. But, the survey found, 72% of consumers want to learn more about how to better secure their data.

learning about cybersecurity

“The number-one tip most experts give for increasing account security and stopping the fallout from data breaches is to turn on two-factor authentication,” said Steve Jillings, CEO of TeleSign. “Yet our research shows that the majority of consumers (61%) do not know what two-factor authentication is, even though it’s available on almost every account, free to the consumer and just waiting to be turned on.

online pharmacy abilify with best prices today in the USA

”

There is some good news, however. Some users in the United States are particularly learning – and acting upon – valuable lessons from highly publicized data breaches, with more people in the U.K. turning on 2FA because the site requires it, while more people in the U.S. did so to get an extra layer of protection. According to TeleSign, compared to respondents in the U.K., almost six times as many U.S. consumers turned on 2FA because their personal information was exposed in a data breach (17% vs. 3% of U.K. consumers). About three times the share of U.S. consumers enabled 2FA because they read or heard about a data breach (24% vs. 7%) or had an account hacked (23% vs. 9%).

Cyberbreach and Reputation Woes Hack Away at Bottom Line for 44% of Financial Firms

Posted on by

According to the 2015 Makovsky Wall Street Reputation Study, released Thursday, 42% of U.S. consumers believe that failure to protect personal and financial information is the biggest threat to the reputation of the financial firms they use. What’s more, three-quarters of respondents said that the unauthorized access of their personal and financial information would likely lead them to take their business elsewhere. In fact, security of personal and financial information is much more important to customers compared to a financial services firm’s ethical responsibility to customers and the community (23%).

Executives from financial services firms seem to know this already: 83% agree that the ability to combat cyber threats and protect personal data will be one of the biggest issues in building reputation in the next year.

The study found that this trend is already having a very real impact: 44% of financial services companies report losing 20% or more of their business in the past year due to reputation and customer satisfaction issues. When asked to rank the issues that negatively affected their company’s reputation over the last 12 months, the top three “strongly agree” responses in 2015 from communications, marketing and investor relations executives at financial services firms were:

  • Financial performance (47%), up from 27% in 2014
  • Corporate governance (45%), up from 24% in 2014
  • Data breaches (42%), up from 24% in 2014

Earning consumer trust will take some extraordinary effort, as a seemingly constant stream of breaches in the news and personal experiences have clearly made customers more skeptical of data security across a range of industries. When asked which institution they trust more with their personal information and safeguarding privacy, today’s consumers ranked traditional financial institutions—including insurers—higher by a wide margin over new online providers, but a larger percentage of consumers do not trust any organization to be able to protect their data:

  • Bank/brokerage, insurance, or credit card company (33%)
  • U.S. Government (IRS, Social Security) or U.S. Postal Service (13%)
  • Current healthcare company (4%)
  • Online wallets (PayPal, Google Wallet, Apple Pay) (4%)
  • Retail chain or small businesses (4%)
  • All other (3%)
  • None of these organizations or companies can be trusted (39%)