Tag Archives: Cyber Crime

Immediate Vault

Malware Threats from Unlicensed Software: The Critical First Step for Cyberrisk Management

Posted on by

Waking up to find your company on the front page news and at the center of a data breach is every CEO’s worst nightmare—and for a number of businesses, it has become reality. Today, the threats from cybercrime are real and frightening, and the risks are extraordinary. Cybersecurity is an incredibly complex issue and business leaders are grappling with how to best protect their businesses, understand the new business vulnerabilities, and identify what steps they can take to protect themselves and their customers from becoming a victim of cybercrime.

There is a strong case for organizations to put protection from malware at the top of their risk agenda. In the past year, 43% of companies experienced a data breach. The average organization experiences a malware event every three minutes, and the costs of dealing with that malware can be astronomical. The International Data Corporation (IDC) estimates that enterprises spent $491 billion in 2014 as a result of malware associated with counterfeit and unlicensed software.

A threshold step to mitigating risk is gaining an understanding of your own network and if the software you are using is genuine and fully licensed. Unfortunately, many businesses are failing to take this basic and critical first step to protect themselves.

It has long been suspected that there is a connection between unlicensed software and cybersecurity threats. A new study commissioned by BSA | The Software Alliance and conducted by IDC confirms this as fact.

The study compared rates of unlicensed software installed on PCs with a measure of malware incidents on PCs across 81 countries. Given that 43% of the software installed on PCs globally in 2014 was unlicensed, it’s clear that many businesses are at risk. The findings were sobering. The correlation between the use of unlicensed software and malware is even higher than the correlations between education and income, or that between smoking and lung cancer. The implication for governments, enterprises and consumers is clear: assessing what is in your network and eliminating unlicensed software could help reduce the risk of cybersecurity incidents.

Fortunately there are proven best practices available to tackle the challenges around software licensing.  The world class standard for Software Asset Management is ISO/IEC 19770-1:2012. The importance of implementing internal controls for legal use of technology, including software, has become so critical that COSO now recommends it in its revised Internal Control – Integrated Framework.

While putting controls in place may sound simple, many businesses are missing this first step. Only 35% of companies have written policies requiring the use of properly licensed software. For CEOs, now is the time to start implementing best practices that will help mitigate security risks and avoid your business becoming tomorrow’s news headline. For more information on additional steps you can take, visit BSA’s website.

BSA Global Software Survey

Cyberattacks Targeting Big Companies Up 40%

Posted on by

Five out of six companies with more than 2,500 employees were targeted in cyberattacks in 2014, representing a 40% increase last year, according to Symantec’s annual Internet Security Threat Report. But by no means does that imply big businesses are the primary target: 60% of all targeted attacks struck small- and medium-sized organizations.

The spear-fishing and fraudulent email scams deployed in these hacks have also become more effective. Overall, 14% less email was used to infiltrate an organization’s network, yet 2014 saw a 13% increase in attackers as the cause of a data breach, and the total number of breaches rose from 253 in 2013 to 312 in 2014. This notable increase in precision is a clear indication that companies are not updating their defenses to match current threats.

Fortifying against cyberbreach continues to demand even more concerted effort as malicious actors grow more sophisticated, introducing more and better malware to their campaigns. “While advanced targeted attacks may grab the headlines, non-targeted attacks still make up a majority of malware, which increased by 26% in 2014,” Symantec reported. More than 317 million new pieces of malware were created last year, meaning almost a million new threats were released daily.

Changes in the top causes of data breach offer both good and bad news. While 13% more cyberbreaches were caused by attackers and breaches due to insider theft increased 3%, Symantec found that 15% fewer were due to accidental exposure, theft or loss.

Check out the infographics below for more of Symantec’s findings and insights on how hackers operate:

Symantec 2015 Internet Security Threat Report

Symantec Path of a Cyber Attacker

 

Improving IT Training Makes Cyberrisk Every Employee’s Responsibility

Posted on by

IT training cybersecurity

For many organizations, risk management spans four distinct categories – physical, financial, human and intellectual. When thought about in context, it’s easy to see how one risk area might impact another. An earthquake that takes down an office building, for example, has clear financial implications in the form of productivity downtime and the cost of building repairs. Given these seemingly easy correlations, it is baffling that so many businesses remain siloed when it comes to managing each area, especially given how it puts them at a higher risk as a result.

Unsurprisingly, these siloes create a lack of communication throughout an organization. Physical security, for example, can often be dealt with by facilities management teams, whereas financial risk is handled by the finance team.

buy cenforce online www.cappskids.org/wp-content/uploads/2023/10/jpg/cenforce.html no prescription pharmacy

Technology hackers are no strangers to this common, organization-wide breakdown – they prey on communication lapses when strategizing an attack.

The solution is simple: break down these siloes to minimize risk gaps. But, as with most pieces of advice, the steps required to achieve this are much easier said than done, especially when it comes to silo-busting in business. The trick is for an organization to use its employees to its advantage. With collaboration between departments and strengthening universal security training across every department, IT teams can make it much harder for hackers to execute coordinated attacks across the business.

Avoid Letting a Hyperlink Be Your Downfall

Email is the primary communication tool in business, and is also the platform that reinforces employees’ position as being both the biggest threat and biggest asset to risk management. Email also happens to be a commonly chosen route for hackers to take when infiltrating an organization.

Phishing attacks via email, for example, are underpinned by social engineering and can be targeted to specific employees and job functions. According to the August 2014 HP TippingPoint survey, State of Network Security, they are dealt with by nearly 70 percent of IT professionals at least once a week, and involve a hacker disguising a malicious link as one from a “trusted” sender. When clicked by the employee, the link can give hackers the ability to pivot within their target’s network and gain unprecedented access to an organization’s network and beyond. Once attackers breach a system like email, or trick the humans reading those emails into clicking a link, it’s easy for them to exploit the organization’s financial, intellectual and physical assets further.

For example, infrastructure attacks on building control systems, although not new, can now be perpetrated remotely over the Internet.

buy sildalis online www.cappskids.org/wp-content/uploads/2023/10/jpg/sildalis.html no prescription pharmacy

Malware attacks such as Flame, Duqu and Regin highlight how threat attacks are specifically targeted to control systems more and more often. As such, employing a security guard to take watch over an organization’s physical control system is no longer enough to keep outside attacks at bay.

Current IT Security Training is Failing

So, what’s an organization to do? Current training and prevention methods are lackluster, and many organizations still embody the “set it and forget it” method. It’s often assumed that once employees have been trained on IT security once, that’s all it takes. Or worse, IT security training is coupled with other training, thereby diminishing its value. For example, training on an organization’s fire evacuation procedure might be thrown in with IT security training during an employee’s induction sessions.

Organizations that do this are setting themselves up for failure. The IT department has implemented training in a way that works best for them, such as a webinar, PowerPoint or squeezed in with another training for time-saving purposes. This takes the place of training that is tailored to make the most sense for the employees.

How to Revitalize IT Security Training

The key to getting past common training slumps is by not only finding unique ways to train employees to help prevent breaches, but also by having them understand the impact a breach can have on other areas of the business, and even their own job.

Organizations must think outside the box and adopt the mindsets of both the employees and hackers to start making a behavioral change in their users. This includes tactics such as making training apply to specific job titles and departments, suggesting a job swap for a day so one department can learn another’s issues, or leveraging creative ways to remind employees not to click on suspicious links. This could include Christmas cards, SMSs or private social media groups and forums.
buy lipitor online https://royalcitydrugs.com/lipitor.html no prescription

But, IT security can be taken even a step further, being made an organization-wide campaign. How about taking after Facebook and making a game of it?  As reported by a director on the Facebook security team in November 2012, Facebook decided to put an end to dull employee cyber-security training with the launch of Hacktober in 2012. October is National Cyber Security Awareness Month, and throughout the month, Facebook’s cyber security team created a series of simulated security incidents that are targeted at specific internal departments, based upon the types of threats they are most likely to see. Employees that spot a Hacktober attack are rewarded with a prize, thus achieving the goal of being both educational and interesting.

Beginning with IT security to eradicate risk throughout the organization is only possible by approaching it from a human-interest angle. Humans are both the perpetrators and victims, and it’s time IT starts designing training that reflects that. Above all else, mitigating risk requires organization-wide support, including from the C-suite. Organizations can make quite an impact on prevention—not by spending a large budget on training, but by taking it back to their employees and helping them understand the ripple effect just one malicious email or link can have.

Guarding Against PoSeidon and Other Point-of-Sale Breaches

Posted on by

According to Cisco’s Security Solutions team, there is a new malware family targeting point-of-sale (PoS) systems, infecting machines to scrape memory for credit card information and send the payment card data to servers for harvesting and, likely, resale. This malware, which the group has nicknamed PoSeidon, works like this:

Unlike other PoS memory scrapers that store captured payment card data locally until attackers log in to download it, PCWorld reported, PoSeidon communicates directly with external servers and can update itself automatically, and also has defenses against reverse engineering.

PoS malware using the “memory scraping” technique also caused the Home Depot and Target data breaches. In the latter, hackers were able to save names, credit card numbers, expiration dates, security codes from the backs of cards and encrypted PINs when at least 40 million customers swiped at in-store registers.

“The new PoSeidon malware has retailers on alert, particularly as the frequency and relative ease with which POS system breaches are occurring is forcing them to take a closer look at their IT infrastructure and reassess how secure it actually is,” said Andrew Avanessian, EVP of consultancy and technology services at security firm Avecto. “It is also prompting many to ask, what will it take to get ahead of these attacks?”

Avanessian believes the answer is clear: a more defense-in-depth approach to security. “While perimeter technologies like firewalls can prevent against certain types of external attack, it cannot block malware that has already found its way onto endpoints within an organization,” he explained.

buy abilify online metabolicleader.com/p7pmm/img/jpg/abilify.html no prescription pharmacy

“With a multi-layered security strategy that incorporates solutions like patching, application whitelisting and privilege management, organizations can more effectively protect against the spread of malware, defending their valuable assets and ultimately their reputation.”

As I wrote in the March 2014 issue of Risk Management, the adoption of EMV chip technology presents one of the most promising ways to increase PoS security. Already common in Europe, EMV technology—named for its founders, Eurocard, MasterCard and Visa—utilizes embedded chips that, unlike magnetic strips, make it nearly impossible to counterfeit cards. In Europe, 81% of cards have EMV chips, and countries that have adopted the technology saw sharp declines in credit card fraud. Meanwhile, the United States accounts for 27% of worldwide credit transactions, but sees 47% of card fraud.

As organizations roll-out chip and pin technology across the country, these breaches may start to decline, Avanessian agrees, but he urges a more holistic approach to fighting PoSeidon and other PoS malware. “EMV (or chip-and-pin) will absolutely help stop card fraud, however, retailers should not become complacent and think this is the silver bullet they have been waiting for,” he said. “Yes it will help stop fraud once the details have been stolen, but it does not stop businesses from being breached. Companies gather a huge amount of data about their patrons, such as names and addresses, and this data is still valuable to fraudsters.

buy lexapro online metabolicleader.com/p7pmm/img/jpg/lexapro.html no prescription pharmacy

Unless retails take a multi-layer defense-in-depth approach to security, they will still get breached.”

To prevent consumers from losing and shopping elsewhere, Avanessian believes it is critical to evolve the means of combatting cyberattack just as the means of hacking has changed. “In our experience, retailers are still relying on antiquated ‘detection’-based technologies to keep the bad guys out. They all spent hundreds of thousands of dollars on detection, yet they still get breached,” he said.

buy arimidex online metabolicleader.com/p7pmm/img/jpg/arimidex.html no prescription pharmacy

“The world has changed, the players have changed, cyberattacks are now a trillion dollar industry—the approach has to change.”