Home Blog Page 133

Managed Security Services: Big Brothers and Guardian Angels

managed services provider (msp)

Big Brother is a fictional character in George Orwell’s dystopian novel “Nineteen Eighty-Four,” published in 1949. The story is about an imaginary state called Oceania, where there is great suffering and social injustice. Its citizens are under the constant surveillance of the governing authorities, mainly through telescreens. The people are constantly reminded of this through the slogan “Big Brother is watching you.” Today, “Big Brother” denotes abuse of government power, particularly in respect to civil liberties, often specifically related to mass surveillance. But “Big Brother” is not always negative. In the context of cybersecurity, an enterprise needs a “Big Brother” or “Guardian Angel” to watch over its infrastructure. And so, this article focuses on the companies who look after your IT infrastructure through managed security services (MSS). We’ve got viewpoints from global CISOs, industry analysts, and Managed Security Service Providers (MSSPs).

By Brian Pereira, Principal Editor, CISO MAG

Here are the key findings of our research:

1. Every type of business and industry is vulnerable

All businesses, regardless of size and sector, are exposed to cyberattacks today. Organizations are digitizing and connecting infrastructure to the cloud and the Internet. Even manufacturing companies, which for decades used operational technologies (OT), are now using SCADA (supervisory control and data acquisition) and IoT devices that are prone to cyberattacks. Ransomware impacted several healthcare companies in 2019.

Malicious actors tend to compromise intellectual property, financial data, credit card details, personally identifiable information (PII), electronic health records (EHR), customer transaction records in retail, blueprints for components, business secrets — and sell it on the Dark Web.

2. Threat landscape is expanding; the nature of attacks is sophisticated

To make threats more sophisticated and targeted in nature, threat actors are employing artificial intelligence, machine learning-based techniques, and stealth technology.

D.C.S. Hariharan, Information Security Risk & Compliance Head, Syngene International Ltd., said, “The emergence of threats such as DDoS attacks, targeted ransomware, cyber extortion, and advanced malware attacks, has led to a higher uptake of advanced security solutions.”

3. Shortage of experienced manpower

The lack of cybersecurity skills and declining security budgets has made it impossible for organizations to monitor its infrastructure effectively and block recurring attacks.
This is more so in the case of small and medium businesses and government organizations that don’t have budgets for hiring high-salaried security professionals.

Dick Wilkinson, IT Security Officer, New Mexico Judicial Information Division, informs us that, in the U.S., a shortage of qualified security employees is driving companies to use a shared resource like a MSS provider or a SOC (Security Operations Center).

“Security employees are in high demand and thus more expensive to hire, so the coverage of an MSS SOC can be a way to close that gap at a lower cost,” said Wilkinson.

4. Regulation & Compliance

With the introduction of new regulations and compliance mandates, organizations will find it a challenge to keep up and yet focus on their core businesses. Non-compliance can also prove to be expensive and lead to business losses, as we have seen in the case of GDPR.

“Organizations must have in-depth knowledge of current privacy laws, regulations and compliance frameworks that affect their business,” said Jason Albuquerque, Chief Information Officer & Chief Information Security Officer, Carousel Industries, Inc. “With the rapidly changing governance, risk and compliance landscape, it becomes extremely difficult to stay up to date with these changes. For this expertise, organizations can look to MSSPs for help.”

MSSPs have experts on compliance and regulation and they can ensure adherence to regulations for data localization, storage, and protection requirements.

“Global MSSPs must have a global data management strategy to be sure that they are not adding a business or compliance risk to their clients. Also, to add additional value for the customer, these subject matter experts can act as consultants to the clients to help build strategies to strengthen their security posture,” added Albuquerque.

5. Traditional security monitoring is inadequate

Traditional security monitoring practices don’t stand a chance when it comes to detecting and blocking modern-day threats. Two traditional approaches, SIEM (security information and event management) and LM (log management), are no longer enough.

“There is a need to have next-generation security operations where Managed Detection and Response (MDR) providers can support enterprises by providing advanced detection, faster incident mitigation, global threat intelligence, and deep threat analytics,” said Hariharan.

Pankit Desai, Co-founder and CEO at SEQURETEK, said, “Companies are now seeking MSSPs with an integrated model. Earlier, there were separate entities for monitoring, for response, and managing. Today there is a capability that looks at identification to remediation and response, to detection. You need one value chain—someone who orchestrates it end-to-end.”

managed security services

The move to Managed Security Services

Boards in companies take cybersecurity very seriously today, more so after digitalization. A cyberattack on IT infrastructure could bring business operations to a halt, peeving customers, partners, and shareholders. That could lead to a decline in the share price of a company, loss of customers, and irreparable damage to its reputation.

An organization can take two paths to reduce the chances of that happening: They could either have an in-house security team working round the clock in shifts to monitor and manage infrastructure. The other option (and a more cost-effective one) is to outsource their security management to a third-party or MSSP.

About the Author

Brian PereiraBrian Pereira is the Principal Editor of CISO MAG. He has been writing on business technology concepts for the past 26 years and has achieved basic certifications in cloud computing (IBM) and cybersecurity (EC-Council).

managed security services

This cover story first appeared in the February issue of CISO MAG. Get your preview here.
To read the full version, Subscribe now!

 

Ghost of the Cyber Past, Present, and Future [INFOGRAPHIC]

Gift Cards, cyber ghosts

HOHo Ho! It’s Christmas! The holiday season is the perfect time to re-read Charles Dickens’ timeless classic, “A Christmas Carol.” To those of you who don’t know, the story revolves around an obnoxious hermit, Ebenezer Scrooge, who despises Christmas. He breathes bitterness by saying, “BAH! Hambug” in response to his nephew’s “Merry Christmas!” However, he seeks redemption after the ghosts of Christmas Past, Present, and Yet to Come impart him with lessons of morality.

But Scrooge is not limited to Dickens’ classic. Today, he has made his way to the digital world, spewing malware strains and data breaches. While we’re stuck indoors – thanks to the pandemic – sales of online stores are booming. Holidays are a hot favorite of cybercriminals for targeting both the retail industry and shoppers. Thanksgiving, Halloween, Black Friday, and now Christmas!

While we frantically search for the best deals, let’s be vigilant about all the malicious websites, emails, and links aiming to pilfer our financial information.

Cyber Ghosts

About the Author

Pooja Tikekar is a Feature Writer and part of the editorial team at CISO MAG. She writes news reports and feature articles on cybersecurity technologies and trends.

More from the author.

 

Visibility is Power – What You Don’t Know Can’t Get You Further

Jason Lim is the Founder & CEO of Cydentiq. Having 15 years of expertise in the information technology industry and identity security domain, Jason gained substantial experience in various roles including leadership, strategic advisory for identity security, service delivery, business development, marketing strategy, team development and success mentoring. He is highly passionate in the areas of identity management and insider threat. He is also the subject matter expert of privileged access management and has been providing extensive advisory service across different industries especially financial services. Jason is an active public speaker in cybersecurity & technology conferences such as EC-Council, ISACA Malaysia Chapter & Malaysia Institute of Accountants (MIA), and others.

Prior to this startup journey, he was the Vice President of Cybersecurity at Wiki Labs, responsible to build the new cybersecurity business division and drive go-to-market strategies. Under his leadership, Jason has successfully transformed the business into a growing & profitable model. As part of his cybersecurity journey, Jason has established his remarkable milestones at MasterSAM, was responsible to drive company operation & strategic direction in Malaysia & Singapore, and also the business expansion to the Asia Pacific region before the company was acquired by Silverlake.

In an interesting conversation with CISO MAG, Jason Lim discusses the challenges he faced while setting up the cybersecurity division at Wiki Labs, his views on Privileged Access Management Risk, and much more.

Do you think the current cybersecurity measures would be relevant in another two years, or will it become obsolete?

Today, cyber threats are evolving. Cyber attacks are getting more sophisticated and organized. Prevention is no longer an effective strategy because you can’t protect if you don’t have the visibility. Visibility is the key in today’s complex environment. While we have billions of data collected from different sources, it is important to know how can we get good information and provide better insights from it to make decisions. Organizations should start leveraging a good analytical platform that uses artificial intelligence, machine or deep learning technologies to accelerate data processing and analysis for quicker business value and decision. Organizations today also lack response capability. Many times, when they are under attack, they often panic.

I realize organizations today spend so much time and effort in ensuring they have good policy and they stay compliant to the regulations such as PCI DSS, ISMS, etc. There is nothing wrong with this, but the fact is that it is not just about gaining a tick at the compliance level. Even if you are 100% compliant, it does not mean you are 100% hack-proof. Organizations need to start building a holistic approach to cyber resilience. Cyber maturity assessment is recommended to provide an in-depth review of an organization’s ability to protect its information assets from cyber threats. It combines the view of people, process, and technology to identify areas of vulnerability, prioritize areas for remediation, and demonstrate both corporate and operational compliance, turning information risk to business advantage. My advice for organizations would be to continuously review their cyber resilience strategy and preparedness against cyber threats.

According to a recent Privileged Access Management Risk and Compliance Report, 70 percent of organizations fail to fully discover privileged accounts and 40 percent do nothing at all to discover these accounts. How worrying is this and what can be done to counter this?

Visibility is the power – what you don’t know can’t get you further. Privileged accounts are always the prime target of attackers as they provide the direct path to your network. There is no need to break the windows if you have the key. With privileged account access, you become the “king” and you could do anything you want, including suspending critical service, extracting sensitive information, installing malware, injecting malicious code into programs, deleting entire filesystem, etc. Statistics show that most of the data breach incidents reported today are caused by compromised credentials, lack of visibility and access control, and unauthorized access to critical systems. Ask yourself a few questions – how many firewalls and servers are there in your organization? How many privileged accounts are there within each system? Has anyone changed the default passwords? Do you control who can access those critical systems? How do you monitor third-party vendor access? How do you mitigate the risk of password sharing?

I would recommend the 4A principles to complete your privileged access management framework:

Authentication: It is important to know that securing a system with just the password is no longer a good protection strategy. Password is always a hacker’s best friend. Hackers may take time to crack the password, depending on its complexity and algorithm. But, the fact is, once the password is compromised, they can access your critical data freely. There is a need to build an extra layer of protection for privileged access to reduce the attack surface. Many security compliance standards have emphasized the need for multi-factor authentication in their regulatory guidelines as a part of the best security practice today.

Authorization: It is highly recommended to adopt the least privilege model as the best security practice. At Zero-Trust principle, it emphasizes trusting nobody by default, meaning that nobody should have the access to the system until they are granted proper authorization.

Access: To satisfy the Role-Based Access Control (RBAC) principle, the access should always be restricted and relevant to the user’s function role. Use auto-login technology to connect to critical systems, thus, eliminating the exposure risk of privileged credentials. Each privileged access should be restricted within a specific period and none should have administrative access at all times. The privileged credentials must be periodically randomized – either right after use, schedule, or manual trigger, based on strong password complexity requirements.

Audit: Auditing is an important process that examines and ensures proper security control is always in place to fulfill regulatory compliance standards. Some of the frequently asked questions from auditors are: when was your last change of password, how do you audit their activities performed on the server? Do you restrict your administrators’ access? What is your approval process? Be sure to monitor and record user activities; the recorded data must be available instantly to allow real-time monitoring or session playback so that one can take immediate action when necessary.

You also hold great expertise in Identity and Access Management. According to you, what are the major challenges in this area?

In the past, cyber attackers spent their time devising ingenious malware, hunting vulnerabilities, stealing credit card information, and exploiting systems for financial gain. Today, cyber-attacks are getting more sophisticated and identity theft has become one of the prominent attacks. Attackers just need to find only one weakness among millions of exposure points to gain the door access to the organization. The top three challenges are:

Compliance gap due to lack of access review

It’s often a nightmare for IT department when it comes to access review audit – processes tend to be manual and they struggle hard to collaborate with business units to generate application entitlement reports, and often collect inconsistent outcomes, run manual consolidation, and eventually fail the regulatory compliance. Most organizations struggle to answer the basic question: “Who has access to what?” Over time, certain employees may have been granted excessive rights or privileged access to critical systems. Organizations tend to be weak in this visibility context, as a result, the audit does flag out these scenarios. There is no centralized and holistic view of the user access matrix across the entire organization. You can never get it right without fundamental visibility.

Manual provisioning and de-provisioning of access

I have seen several examples where a new hire, especially a replacement, is simply granted the same access rights as the existing staff – often by “cloning” their account – without reviewing his/her appropriateness of existing access. During the hiring process, HR would typically inform IT to manually create an identity and assign appropriate rights to the new employee. Over time, the employee may have requested additional access which requires manual grant and revoke operations according to the approved timeframe. If an employee gets promoted or transferred to a different department, his/her current and new roles will also need to be managed properly. When the employee leaves the organization, his/her account would eventually be deactivated and removed one day. Can you imagine there are so many gaps that exist due to a huge hassle of manual operation running behind this? Orphan accounts are the best scenario to prove this challenge.

Too many passwords to manage

We’ve all been there before. We waited too long, and our password expired. Or we made a change, and somehow that change didn’t trickle down to all of the relevant systems we need to access. If we need to use multiple applications at work, do we use different passwords and make it complex? Most people hate complex and expired passwords and figure out another easy password to remember. Password creation, update, and deletion (CRUD) is a real issue with real costs that IT wants to reduce. Having automated tools that are easy to use and can integrate with existing systems can alleviate much of the pain here along with a single-sign-on solution that is protected with multi-factor authentication.

Disclaimer

When this interview was taken, Jason Lim was the Vice President of Cybersecurity at Wiki Labs. Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Operation Nova: Global Law Enforcement Agencies Seize ‘Safe-Inet’ Criminal VPN Service

Safe-Inet VPN

A coordinated effort led by German Police, with support from other global law enforcement bodies including Europol and FBI, among others, has resulted in the seizure of Safe-Inet VPN service, which was touted as the hot favorite of cybercriminals to carry out malicious activities. The VPN provider’s service was shut down completely on Monday, December 21, followed by a physical seizure of its infrastructure in Germany, Switzerland, France, the Netherlands, and the U.S.

Safe-Inet VPN
Image Credit: Europol

Why Safe-Inet VPN Services were Shut Down?

According to Europol, the Safe-Inet VPN service has been active over the past decade. Europol said that its service gained popularity among the underground cybercriminals as a “Bulletproof” service since it boasted of tools having up to five layers of anonymous VPN security. This degree of protection allowed cybercriminals a virtual shield that law enforcement organizations around the globe found difficult to penetrate.

Riding the wave of its popularity, the VPN service was sold at a higher premium to underground threat actors whose operations included ransomware attacks, e-Skimming frauds, data breaches, and various other forms of cybercriminal activities.

Europol said, “The Law enforcement was able to identify some 250 companies worldwide which were being spied on by the criminals using this VPN. These companies were subsequently warned of an imminent ransomware attack against their systems, allowing them to take measures to protect themselves against such an attack.”

The Takedown

The international takedown was codenamed “Operation Nova.” The law enforcement agencies involved in the takedown include:

  • Germany: Reutlingen Police Headquarters (Polizeipräsidium Reutlingen)
  • Europol: European Cybercrime Centre (EC3)
  • The Netherlands: National Police (Politie)
  • Switzerland: Cantonal Police of Argovia (Kantonspolizei Aargau)
  • United States:  Federal Bureau of Investigation (FBI)
  • France: Judicial Police (Direction Centrale de la Police Judiciaire)

The takedown was a coordinated effort by the agencies mentioned above, as Safe-Inet’s infrastructure was spread across the globe. Europol, however, played a pivotal role in making it possible. The European Cybercrime Centre (EC3) led the path forward to bring all the law enforcement agencies together for devising a joint strategy to prepare for the final takedown.

Edvardas Šileris, Head of Europol’s European Cybercrime Centre, said, “The strong working relationship fostered by Europol between the investigators involved in this case on either side of the world was central in bringing down this service.”

Safe-Inet’s seizure served as an example of the much-needed international cooperation between countries to take down cybercriminals and make the internet a safer space.

What the U.S. DoJ Said

According to the statement by the U.S. Department of Justice,  Operation Nova helped seize three domains providing similar services – SAFE-INET.COM, SAFE-INET.NET and INSORG.ORG – which were used for criminal activities. It added that the service websites were offered in English and Russian languages, shedding light on the geo-targets of its providers.

Post the seizure, all agencies are further investigating the log files and physical infrastructure confiscated from Safe-Inet to get a hold of all the cybercriminals using it as a service.

Related News:

Europol and European Commission Launch New Decryption Platform to Combat Encryption Misuse

Google Explains the Root Cause of the 47 Minutes Global Outage of its Services

Google Announced US$1 Million for its “Be Internet Awesome” Initiative

A recent outage of Google services such as Gmail, YouTube, Google Drive, and Maps  severely affected the operations of users and organizations across the globe. All customer-facing Google services that require Google OAuth access were unavailable for 47 minutes. The search engine giant stated that the disruption was caused due to a security flaw in its global authentication system.

“The majority of authenticated services experienced similar control plane impact: elevated error rates across all Google Cloud Platform and Google Workspace APIs and Consoles. Products continued to deliver service normally during the incident except where specifically called out below. Most services recovered automatically within a short period of time,” Google said.

 The Root Cause

In an official statement, Google stated that its User ID Service maintains a unique identifier for every account and handles authentication credentials for OAuth tokens and cookies. This service rejects users’ requests when it detects outdated data.

“As part of an ongoing migration of the User ID Service to a new quota system, a change was made in October to register the User ID Service with the new quota system, but parts of the previous quota system were left in place which incorrectly reported the usage for the User ID Service as 0. An existing grace period on enforcing quota restrictions delayed the impact, which eventually expired, triggering automated quota systems to decrease the quota allowed for the User ID service and triggering this incident,” Google explained.

Nearly 15% of users’ requests to Google Cloud Storage (GCS) were affected in the incident, especially the users of OAuth, HMAC, or email authentication.

“The majority of impact was resolved, however, there was lingering impact, for <1% of clients that attempted to finalize resumable uploads that started during the window. These uploads were left in a non-resumable state; the error code GCS returned was retryable, but subsequent retries were unable to make progress, leaving these objects unfinalized,” Google added.

Google and Microsoft Join Facebook’s Legal Battle Against Israel’s NSO

Facebook NSO lawsuit

Facebook has been at loggerheads with Israel-based hacking company NSO since last year. It has accused the NSO of exploiting a bug in WhatsApp that wrongfully rendered them rights to surveil more than 1,400 people. NSO has since maintained that its products are strictly used to curb crime and combat terror. However, some reports suggest it has been using the proprietary spyware – known as “Pegasus” – against top lawyers, reporters, and even nutritionists. Noting this as a grievous issue, other tech companies, namely, Google, Microsoft, CISCO, and Dell Technologies-owned VMware have now announced their support towards the social media giant.

Related News:

Facebook sues NSO Group for violating Computer Fraud and Abuse Act

NSO Claims “Sovereign Immunity”

In April 2020, the NSO group filed a request to dismiss the lawsuit pressed by Facebook arguing that it provided hacking tools to police and spy agencies around the globe, and hence, it should be granted “Sovereign Immunity” as foreign governments enjoy in any lawsuit.

The basis of NSO’s arguments was made on two grounds:

  1. The Foreign Sovereign Immunities Act (FSIA): The law that limits whether a foreign state can be sued in U.S. court.
  2. Federal Rule of Civil Procedure 19 (Rule 19): The rule that governs the joinder of parties in civil lawsuits.

The justification provided was not enough and found unfit on both counts. The appeal was correspondingly dismissed by the Northern District of California in July 2020. The NSO has, however, filed once again with the Ninth Circuit for overturning this ruling.

Why Other Tech Giants Support Facebook

Based on a Citizenlab report,  four Pegasus operators had successfully abused an exploit chain known as “KISMET.” KISMET exploited a zero-day vulnerability in the then-latest iPhone 11 iOS 13.5.1. The targets of these operators were 36 personal phones of Al Jazeera employees, including journalists, producers, anchors, and executives. Facebook found the same vulnerability being abused in its case as well; however, the number of targets grew to 1,400.

Considering the NSO’s client base, the targeted numbers unearthed until now are only a fraction of the actual number. Fearing this and the subsequent violation of human rights, other tech giants have joined forces with Facebook to argue against granting sovereign immunity to the NSO. In a brief argument filed with the Ninth Circuit, they said,

“This would lead to a proliferation of hacking technology, and in the foreseeable future, we will have more foreign governments with powerful and dangerous cyber-surveillance tools. That, in turn, means dramatically more opportunities for those tools to fall into the wrong hands and be used nefariously.”

It will now be interesting to see whether the U.S. court still agrees with the argument presented by Facebook and other tech giants or accepts the defendant’s plea of overturning the previous ruling and abolishing the lawsuit altogether.

Leaked Ledger Database Dumped on Raidforums Dark Market

Compromised Email Accounts

Cryptocurrency wallet manufacturer Ledger is facing the consequences of a data leak on its website, which took place in June 2020. The company recently found that threat actors are posting the leaked data of millions of Ledger wallet customers on the dark web marketplace “Raidforums” for free. The data dump contains sensitive information, including email addresses, contact details, and residential addresses.

Data Breach Overview

Earlier, Ledger stated that an unauthorized third party accessed a portion of its e-commerce and marketing database via exploiting an Application Programming Interface (API) Key.

“Contact and order details were involved. This is mostly the email address of our customers, approximately 1M addresses. Further to investigating the situation we have also been able to establish that, for a subset of 9,500 customers were also exposed, such as first and last name, postal address, phone number or ordered products,” Ledger said in a statement.

Related Story: How to Safeguard Your Cryptocurrency Wallet

Breached Data on Dark Web

Following the data breach, most of Ledger’s customers received phishing emails and malicious messages tricking them into entering personal details. Hackers shared two files that contained the breached data. The first file “All Emails (Subscription).txt” holds the email addresses of 1,075,382 Ledger users, whereas the second file, “Ledger Orders (Buyers) only.txt,” includes sensitive data like names, mailing addresses, and phone numbers for 272,853 people.

Several cryptocurrency traders are reporting about the data dump on social media.

Ledger says…

Suit Up! Ransomware Task Force is Here

ransomware task force

Ransomware has continued to plague digital transformation since the onset of the pandemic. A recent survey from cybersecurity firm CrowdStrike, revealed that nearly 56% of organizations reported a ransomware attack in the last year. With reports of an extended lockdown in parts of Europe being enforced again, there seems to be no stopping for digitization, which inversely means a larger threat surface is exposed and, that ransomware threat will keep growing larger by the day.

To counter this threat, the Institute for Security and Technology (IST) has decided to bring together a formidable team that can help steer the ship away from rough waters; they call this team – the Ransomware Task Force (RTF).

What is the Ransomware Task Force?

The Institute for Security and Technology launched the Ransomware Task Force in partnership with experts from multiple domains like the industry, government, law enforcement, nonprofits, cybersecurity insurance, and international organizations. The RTF’s founding members believe that ransomware is a much larger and complex threat for any organization to handle single-handedly. Thus, having a consortium or council of members who can provide clear recommendations for both public and private sector organizations will significantly reduce the threat and the impact posed by such cybercriminals.

Ransomware incidents need a check as this economically destructive cybercrime has increasingly led to dangerous, physical consequences. Hospitals, Schools, City Governments, and others have been targeted and held hostage by malicious actors seeking ransoms or payouts in exchange. The ransomware menace is not just limited to one sector; this is the prime reason why the IST has involved people from various sectors.  They aim to get a closer perspective of every sector and not only cybersecurity.

The Ransomware Task Force will synthesize a clear framework of actionable solutions. It will assess existing solutions at varying levels, identify the gaps in solution application, and create a roadmap of clear objectives and actionable guidelines for high-level decision-makers. To achieve the goals of the final roadmap, the RTF will share their expertise through papers and catalogs and engage stakeholders across industries to implement vetted solutions.

Partners of the RTF

The founding members of the Ransomware Task Force include some known names like:

  • Aspen Digital
  • Citrix
  • The Cyber Threat Alliance
  • Cybereason
  • The CyberPeace Institute
  • The Cybersecurity Coalition
  • The Global Cyber Alliance
  • McAfee
  • Microsoft
  • Rapid7
  • Resilience
  • SecurityScorecard
  • Shadowserver Foundation
  • Stratigos Security
  • Team Cymru
  • Third Way
  • UT Austin Stauss Center
  • Venable LLP

The official Ransomware Task Force website, with information on the membership plans and leadership roles, will be launched in the first half of January 2021.

Indian BFSI Leaders Press for a Hybrid Approach for HSM

Financial services organizations, banks, retailers, insurance providers, and payment application developers are seeing rapid changes in the way they do business. Attack vectors are growing in sophistication, and organizations are increasingly relying on hardware security modules (HSMs) to provide the highest possible security. To address this, CISO MAG recently hosted a closed-door virtual roundtable dubbed, “Gearing for Greatness- The future of India’s BFSI ecosystem with Sachin Y Shende, General Manager, Reserve Bank of India, chairing the discussion.”

The discussion saw several topics like changing dynamics in the hardware security module (HSM) industry, merging of general-purpose and financial HSM technologies, emerging role of cloud key management and cloud financial HSMs, among several others. As General Manager of RBI,    was in-charge of RBI’s Primary Data Centre (Tier IV DC), implemented and managed mission-critical payment systems of national importance (i.e. NEFT, RTGS & SFMS) and various applications as well as critical IT infrastructure. He was instrumental in implementing the information Security Operation Centre (iSOC), a new approach for holistically managing cybersecurity. Shende continually revamped IT infrastructure for better availability and to meet the exponential growth of NEFT / RTGS transactions and played a marquee role in the establishment of RBI private cloud.

The speakers in the roundtable included Ramesh Lakshminarayanan, Group Head – Information Technology and CTO, HDFC Bank; Sankarson Banerjee, Chief Information Officer, RBL Bank; Deepak Sharma, President & Chief Digital Officer, Kotak Mahindra Bank Ltd; Supriya Datta, Senior VP Technology at NSE (National Stock Exchange of India); Manoj Shrivastava, Chief Information Security Officer, Future Generali India Insurance Company; Siba Narayan Panda, a Subject Matter Expert; and Adam Cason, Vice President, Global and Strategic Alliances, Futurex.

“HSMs have historically been mandated for applications such as financial acquiring, card issuance, and mobile payment security. In recent years, however, organizations have been using HSMs for even greater numbers of use cases, such as within Cheque Truncation Systems (CTS), Real Time Gross Settlement (RTGS) applications, and tokenization for retailers.”

– Sachin Y Shende, General Manager, Reserve Bank of India

Shende began the discussion on the adoption of HSMs and asked about which among cloud vs. on-premises was more advisable? Sankarson Banerjee took the lead to explain how his organization has deployed both.

“We have both in place. I believe for short-term transactions, it is sensible to have it on cloud, as the encryption is also for a shorter duration. But for long-term projects, it is better that they are hosted on-premises.”

– Sankarson Banerjee, Chief Information Officer, RBL Bank

 

 

“Since 2004, HSMs have been active and were deployed for several key projects. But back in the day, cloud wasn’t available. In fact, for the next 5-10 years, cloud was just coming in. And that trend continues for several organizations. Even though the BFSI sector has transformed significantly, many companies have still not adopted HSM on cloud.”

– Siba Narayan Panda, a Subject Matter Expert

He also noted that several new players have entered the sector and have changed its landscape, but the older ones are continuing with their legacy platforms. According to him, it is paramount for every organization to have a robust security culture.

“NSE continues to deploy many functions on-premises, while areas like emails are ones with HSMs on the cloud.”

– Supriya Datta, Senior VP Technology at NSE (National Stock Exchange of India)

 

 

She also pressed for a hybrid approach. Supriya Datta is currently engaged with the National Stock Exchange (NSE) as Senior VP of Technology. Here, she executes the role of a CIO for the Exchange Index and Market Data Business line, Exchange Commodity segment, and NSE IFSC. Additionally, she also leads innovation in blockchain at NSE and is responsible for the identification of possible blockchain use cases along with business, conducts feasibility and proof of concepts, furthering production deployment.

Ramesh Lakshminarayanan spoke about evaluating cloud infrastructure. According to him, “You must have all the controls and tenancy even if it is hosted on the cloud.” He also advocated that HSM assessment need some standardization.

– Ramesh Lakshminarayanan, Group Head – Information Technology and CTO, HDFC Bank

 

Adam Cason concurred with the idea and added that GP HSM and Payment HSM can be converged into a single infrastructure.

“I personally prefer the hybrid approach.” As Vice President, Global and Strategic Alliances at Futurex, Cason works with technology and channel partners worldwide to help them integrate Futurex’s FIPS 140-2 Level 3 and PCI HSM validated hardware security modules and key management solutions into their customers’ enterprise security architecture, in both on-premises and cloud environments.

– Adam Cason, Vice President, Global and Strategic Alliances, Futurex

 

“We have everything on-premises. The challenge that comes to my mind is the current key management solution.”

– Deepak Sharma, President & Chief Digital Officer, Kotak Mahindra Bank Ltd

 

 

According to him, even HSM-as-a-service has a lot of scope. Sharma heads Kotak Mahindra Bank’s digital initiatives where he drives digital transformation, business model innovation, and future-ready initiatives of the bank. He is responsible for efficiency, productivity, customer experience, and growth of the business through digital intervention across digital channels, lending, payments, investments, insurance, trade & forex for the Retail, SME, Private Wealth, and Institutional Banking segments.

Manoj Shrivastava continued, “There must be guidelines from the government on what should go on cloud and what should stay on-premises.”

– Manoj Shrivastava, Chief Information Security Officer, Future Generali India Insurance Company

 

According to him, security challenges even have psychological effects, and cyberattacks can affect the GDP and the economy. Shrivastava is an information and cybersecurity professional and into the Information Technology field for about two decades.

The roundtable also saw discussions on Crypto-as-a-Service – single HSM and key management infrastructure for multiple business applications, and also the impact of COVID-19 on the BFSI Sector.

How to Secure Your Mobile Apps

Mobile Apps Security, mobile apps

Despite multiple security scans, malicious applications make their way into your mobile devices. Most of these unsecured or malicious apps come with several security risks, and cybercriminals often rely on them to compromise and pilfer sensitive information from millions of users. In addition, organizational applications are prone to greater cybersecurity risks as they can provide access to the entire corporate systems and employees’ personal information.

By Rudra Srinivas, Feature Writer, CISO MAG

According to research, there is a nearly 51% surge in the use of spyware and stalkerware globally since the lockdown was announced. Even the FBI issued a warning about threat actors targeting users with fake banking apps to compromise bank accounts. Mobile banking apps witnessed a 50% increase in usage since the beginning of 2020.

Cyberthreats Due to Insecure Mobile Apps

Poor application security can heighten mobile security risks. It is imperative for users and organizations to boost their mobile application security to defend against evolving cyberthreats.

Mobile app security issues can lead to a variety of cyberthreats like:

  • Theft of sensitive data like login credentials and financial details
  • Access to corporate data and networks
  • Lead to SIM jacking/hijacking attacks 
  • Negative impact on an organization’s reputation
  • Impact on millions of users

Need for Mobile App Security

Robust mobile security measures can protect your applications from criminal intrusions and digital frauds. Mobile app security concerns continue to be a cyberthreat. Recently, Google removed 21 malicious Android apps from its Play Store after discovering intrusive adware and Trojans in them. It was found that the fraudulent apps were disguised as gaming apps and contained “HiddenAds Trojan.”  According to a report, 70% of mobile and desktop apps contain open-source security flaws. It was revealed that most of the applications have at least one security flaw, which stems from the use of an open-source library.

4 Factors Affecting Mobile App Security

1. Public Wi-Fi

A secure internet connection is essential when it comes to protecting your mobile applications from cyber risks. Threat actors often target users in a public Wi-Fi network by exploiting flaws in WPA2 encryption. Avoid public internet networks while using critical apps, especially sensitive data involved apps like banking or other financial related apps. Even when accessing your home network, use a Virtual Private Network (VPN) for additional security.

2. Malicious Apps

As mentioned earlier, most of the applications with in-built malicious code escape even robust security checks. The only way to prevent such fraudulent apps from spreading across your mobile phones is by installing apps only from official app stores after thorough research. For more information, read How to Spot Malicious or Fake Apps

3. Outdated OS

Security flaws in operating systems can pose a serious threat to mobile app security. Whether it is a smartphone or any connected device, updating the OS is highly recommended to defend against evolving hacker intrusions. Fix the known and unknown vulnerabilities by applying regular patches and security upgrades as soon as manufacturers release updates.

4. Easy Authorization

The smartness of an app depends on the information that it collects from the user. Weak passwords or the same four-digit code for all the apps puts their security at a high risk. Create a strong authentication process like Two-Factor Authentication (2FA) or Multi-Factor Authentication (MFA) to prevent password guessing attempts and unauthorized intrusions from cybercriminals.

How to Defend?

  • Download only original applications from trusted market places. Look for the Google Play Protect logo.
  • Ensure the data/communication between servers and mobile apps is encrypted.
  • Set-up automatic cached data wiping option.
  • While installing the app, grant access to resources on the phone in a highly discretionary manner (Ask why a particular app needs access to your contacts list or camera).
  • Invest in a paid mobile security app to scan for malware and viruses.

In conclusion

A single vulnerability or malware can cause a severe impact on users’ sensitive data and online identity. Mobile app security is not entirely the manufacturers’ responsibility. End-users must also follow the required security precautions while installing and using mobile applications.

About the Author

 

Rudra Srinivas is a Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.

1...132133134...410Page 133 of 410