Home Blog Page 145

“Relying heavily on firewalls does nothing against determined adversaries”

Tim Bandos was recently announced as the Chief Information Security Officer (CISO) for Digital Guardian. He has over 15 years of experience to the position including his five years as VP of cybersecurity at Digital Guardian. Prior to joining Digital Guardian, Bandos was Director of Cybersecurity for Dupont where he was responsible for overseeing internal controls, incident response, and threat intelligence.

In a recent interview with Augustin Kurian from CISO MAG, Tim spoke about console management, blockchain, effective implementation of USB control and encryption, shadow IoT among several other trends.

In most enterprises, the endpoint security realm is about managing multiple management consoles, each reporting their point of view on devices’ health. The situation becomes complicated when the may-a-time consoles can’t even agree on the inventory count as each of them reports independent numbers with considerable time spent on reconciliation. You have been tasked with the development of DG EDR. How do you think this problem can be fixed? 

This particular problem around asset inventory plagues many organizations and there are varying reasons why they all report disparate numbers amongst each other. Some security solutions may not support certain operating system types, or as devices go offline, they’re not properly being updated in the list. I believe relying entirely on a technology to do this is not the best approach. It requires a process as well to adequately account for all IT assets in your inventory, which gets continuously updated and reviewed. Network scanners can do a great job at identifying live nodes on a network and even identifying potential rogue endpoints. Coupling that data with your inventory list is essential, in addition to knowing the primary usage of the device and whether it stores sensitive data. This upfront work will dramatically increase your success in rolling out an EDR program. If you miss even a single device, such as an externally facing RDP server used for remote access, it could be used as an entrance vector by an adversary. If that turns out to be the case, your visibility into detecting that attack is now zero. So, acquiring complete coverage will require a bit of upfront work first to ensure your entire enterprise is being monitored appropriately.

How do you see the uptake for managed security services today, as compared to, say, two years ago? From which types of businesses (small, medium, large) do you see the maximum uptake for outsourced security services? (Nearly half of all cyberattacks in the U.S. target SMBs). What is driving demand for managed security services?

I’ve seen a dramatic increase in SMBs latching on to managed security services over the last several years given the number of benefits that can be derived out of the partnership. One of the most difficult challenges is hiring employees with the right level of skills to cover the broad swath of capabilities required to sufficiently protect an organization. Take Incident Response for example – if a cyberattack occurs, you would need a fleet of resources with the ability to conduct digital forensics, log analysis, possibly reverse engineering, and more. Managed security services provide these capabilities on Day 1 and you no longer have to rely on the single IT guy wearing 15 different hats. The benefits of a managed solution, such as more time to focus on your business, lowering your costs in multiple areas, quick access to expertise, etc., all drive this growing demand we’ve observed recently.

How do you think MSMEs are handling cybersecurity post-COVID-19? You have pointed out that there are hundreds of terabytes of potentially sensitive, unencrypted corporate data floating around at any given time due to an increase in the volume of data downloaded to USB media by employees since the onset of COVID-19. What are your suggestions for smaller companies for effective implementation of USB control and encryption?

I believe it’s been difficult for some MSME’s to properly address cybersecurity-related concerns during this pandemic. Implementing controls and purchasing technology during a time when funds and even resources may be strapped is a considerable challenge. We’ve seen this play out with the amount of data egress occurring across our managed services customer base; specifically to USB devices and various cloud storage sites. It comes down to the culture and workflow you’re looking to set in your organization. Having policies in place that prevent USB usage can be enforced with Group Policy Object  (GPO ) settings along with requiring users to encrypt their PCs with something like BitLocker. When it comes to filesharing and interacting with sensitive data, it’s important to store them in a technology that provides you control over permissions, the ability to encrypt, password protect, classify, etc. Services like OneDrive or Dropbox have these types of features, which can provide a significant level of comfort with how your employees access, interact with, and share sensitive information such as financial, legal, or HR data.

The virtualization of computing, software-defined storage, and networking has given birth to hyperconverged infrastructures. Implicit trust is gone and has made way for a more effective practice- explicit identity-based trust. The rapid shift to work-from-home has accelerated the adoption of Zero Trust frameworks. Do you believe Zero Trust-as-a-Service will be a necessary component of security strategies for 2021 and beyond? 

Absolutely. I believe you’ll see a significant increase in the adoption of a Zero Trust-as-a-Service model being used in security strategies beyond 2021. We’ve learned over the years that relying heavily on network security such as firewalls does almost nothing for you when faced with determined adversaries. Also, as organizations move more of their workloads to the cloud, it only becomes more imperative to protect and restrict those whom have access and ensure you have the right level of visibility. This approach will require more granular perimeter enforcements based on who the user is, where they are located, and other elements of data to determine the level of trust that’s granted. Implementing this type of strategy is not something that’ll occur overnight. My recommendation to organizations looking to embrace the Zero Trust model is to first design it and try to avoid the incorporation of legacy systems that aren’t fully capable of taking this journey. For larger and more complex businesses, this may be a multi-year project depending on your IT environment. But for smaller and medium-sized companies, it could be a great opportunity to completely transform how they approach cybersecurity that’ll ultimately protect them from advances being made by threat actors.

Read a longer version of this interview in the next issue of CISO MAG.

Subscribe here

Augustin Kurian

About the Author 

Augustin Kurian is part of the editorial team at CISO MAG and writes interviews and features.

 

‘Mudge’ is Twitter’s New Head of Security

Celebrated hacker Peiter Zatko AKA ‘Mudge’ will take over as the new Head of Security for Twitter. He would be taking his office after a 45- to 60-day review of the platform’s current measures and practices. Reports indicate that Zatko will directly report to CEO Jack Dorsey. In an exclusive with Reuters Zatko also said he will examine “information security, site integrity, physical security, platform integrity — which starts to touch on abuse and manipulation of the platform — and engineering.”

For the uninitiated, Peiter Zatko is among one of the most high-profile hackers in the world. He was also a member of L0pht, a hacker collective that testified in front of Congress on “Weak Computer Security in Government.” During his time with L0pht, Mudge highlighted several security vulnerabilities and also campaigned for safer cyberspace. He has also been credited with releasing several cybersecurity advisories and is also the author of L0phtCrack, a password cracking software.

He has also served in several leadership roles in agencies like DARPA and was also a part of Google’s Advanced Technology and Projects division.

“Looks like the cat is out of the bag. I’m very excited to be joining the executive team at Twitter! I truly believe in the mission of (equitably) serving the public conversation. I will do my best!” Zatko tweeted about his appointment.

This is the second key cybersecurity-related appointment Twitter has in the last couple of months following the mega hack. The short message platform had also come under severe criticism following the account breach of several global leaders and other verified high-profile accounts. During the attack, hackers broke into the backend admin tools and plugged cryptocurrency scams into the high-profile accounts. Following the attack, Twitter had locked and suspended all operations of the affected accounts to investigate the cause and extent of the breach. It also wanted to make sure whether any additional user information was compromised and if any backdoors were created for future account takeovers.

Toward the end of September, Twitter appointed cybersecurity veteran Rinki Sethi as the Chief Information Security Officer.

Lazarus Strikes Again, Attacks Supply Chain in South Korea

Cryptocurrency Lazarus, North Korean TA406, Lazarus Group , Korea Atomic Energy Research Institute

Security researchers from ESET found cybercriminals linked to North-Korean Lazarus group targeting South Korean supply-chains. It was found that attackers exploited legitimate South Korean security software and digital certificates stolen from two different companies to distribute their malware. The hacker group also used illicitly obtained code to sign the malware samples.

Lazarus Supply Chain Attacks

ESET’s researchers stated that South Koreans are often asked to download additional security software while visiting government or banking services online. It is found that attackers abused this process to deploy Lazarus malware from a compromised legitimate website.

“To understand this novel supply-chain attack, you should be aware that WIZVERA VeraPort, referred to as an integration installation program, is a South Korean application that helps manage such additional security software. When WIZVERA VeraPort is installed, users receive and install all necessary software required by a specific website. Minimal user interaction is required to start such software installation. Usually this software is used by government and banking websites in South Korea. For some of these websites it’s mandatory to have WIZVERA VeraPort installed,” explains Anton Cherepanov, ESET researcher who led the investigation into the attack.

“The attackers camouflaged the Lazarus malware samples as legitimate software. These samples have similar file names, icons, and resources as legitimate South Korean software. It’s the combination of compromised websites with WIZVERA VeraPort support and specific VeraPort configuration options that allows attackers to perform this attack,” says Peter Kálnai, ESET researcher who analyzed the Lazarus attack with Cherepanov.

The Lazarus Timeline

The Lazarus hacking Group was involved in multiple cyberattacks earlier. In 2018, Kaspersky uncovered AppleJeus, a malicious operation by Lazarus Group to intrude on cryptocurrency exchanges and applications. In December 2019, the researchers discovered a malware dubbed as “Fileless” distributed by the Lazarus group.  For full story click here…

No More “Zoombombers” on Zoom Calls; Zoom Upgrades its Cybersecurity Feature

zoombombers

Video conferencing app maker, Zoom, has launched a new feature in its latest update that will help the conference hosts to block uninvited guests known as “Zoombombers,” from entering the calls. Zoom calls this new feature, “At Risk Meeting Notifier.”

What is “Zoombombing”

Zoombombing attack is an instance where uninvited guests connect to a Zoom meeting room and disrupt the meeting by doing non-contextual things like hurling insults, playing pornographic content, or making threats to other participants. Typically, a Zoombombing incident takes place when participants knowingly or unknowingly shares a Zoom meeting ID (and sometimes its password) on social media, or discussion forums like Reddit and Quora threads.

How “At Risk Meeting Notifier” Will Help

The “At Risk Meeting Notifier” feature will constantly run on Zoom’s backend servers. It is a fully automated process with no manual intervention required. This feature constantly scans and compares the Zoom’s Meeting ID of the conference call against the posts published across social media platforms and certain open web resources like Reddit and Quora.

Upon finding a match, Zoom automatically sends an alert to the meeting host informing them of the match via email. The hosts can then take remedial measures of blocking that Zoombomber by changing the password or scheduling a new meeting to avoid a possible hijack of the meeting.

Related Podcast:

Episode #3: How Zoom is Enhancing Security and Evolving its Product

How to Stop a Zoombomber if he is Already in the Meeting

There is a possibility that participants may leak the meeting credentials to a Zoombomber purposely to cause chaos. So, to stop a Zoombomber who has already entered a meeting, Zoom has introduced a “Suspend Participant Activities” option under the security icon. When the host clicks on this option, all video, audio, in-meeting chat, annotations, screen sharing, and recording is suspended, and all breakout rooms are ended. This should shut down the Zoombomber’s activity immediately. From there, Zoom will ask the host if they want to report a user, and if they do, that user will be removed from the meeting and Zoom’s security team will be notified.

Things to do If You Receive Mail from the “At Risk Meeting Notifier”

Zoom strongly recommends the following actions if admins receive a notification email from Zoom’s new cybersecurity feature:

  • Firstly, report the public post where the Meeting ID has been published. Ask the site admins to remove the link from their website/platform.
  • Delete the existing meeting and schedule a new one instead with a new Meeting ID and additional authentication of a Password/Passcode. This makes the meeting private.
  • Send the new Meeting ID exclusively to only the participants you trust.
  • Enable the following security settings for your meeting/conference call:
    • Meeting password/passcode
    • Waiting room
    • Meeting registration

Additionally, Zoom recommends that if canceling and rescheduling the public meeting is not possible then convert the meeting to a webinar as this gives the host control over who participates with video, audio, chat, and screen sharing.

Related News:

Zoom Beefs Up Security with Two-Factor Authentication

How to Prevent Zoom Credential Theft

Cybercriminals Move to Cloud! Hackers Selling Credentials via “Cloud of Logs”

Cloud of Logs dark web market

A new research from Trend Micro revealed that cybercriminals are using cloud services to accelerate their attacks, in turn decreasing the amount of time enterprises have to identify and respond to a breach. The research also found an underground market “Cloud of Logs” operated by malicious actors who sell stolen credentials to other hacker forums.

Massive Data Trade on Dark Web

Trend Micro stated that terabytes of stolen data trading in cloud logs are making cyberattacks more widespread and effective globally. Information about internal business data and logins for popular providers like Amazon, Google, Twitter, Facebook, and PayPal are put up on sale on the dark web. Attackers sell these logs of cloud data on a subscription basis for $1,000 per month. Access to a single log can include millions of records, where frequently updated data sets can even fetch higher prices.

Trend Micro warned that easy access to stolen credentials allow cybercriminals to streamline and accelerate the execution of attacks and potentially expand their number of targets.

“Once access is purchased for logs of cloud-based stolen data, the purchaser will use the information for secondary infection. For example, Remote Desktop Protocol (RDP) credentials can be found in these logs and are a popular entry point for criminals targeting enterprises with ransomware. This data is sold via access to the cloud logs in which it is stored. This results in more stolen accounts being monetized, and the time from initial data theft to stolen information being used against an enterprise has decreased from weeks to days or hours,” the report said.

Robert McArdle, director of forward-looking threat research for Trend Micro, said, “The new market for access to cloud logs ensures stolen information can be used more quickly and effectively by the cybercrime community—that’s bad news for enterprise security teams. This new cybercriminal market shows how criminals are using cloud technologies to compromise you. Which also means a business is not exempt from this attack method if they only use on-prem services. All organizations will need to double down on preventative measures and ensure they have the visibility and controls needed to react fast to any incidents that occur.”

Australia CISO Confluence: Cybersecurity in a Hyper Connected Ecosystem

For a slew of cybersecurity experts comprising of CEOs, CISOs, CIOs, Vice Presidents, and executives from over 60 countries, CISO MAG hosted the much-awaited Australia CISO Confluence toward the end of October. The confluence had Rapid7 as the Bronze Partner, AISA as the Media Partner, with ITSMF Australia as the supporting associate. The theme of the confluence was Cybersecurity in a Hyper Connected Ecosystem. The discussion took a virtual format to create awareness on the need for cybersecurity and its related implications in times of a pandemic.

The confluence derived realistic insights from senior industry experts on how to redefine security frameworks, mitigate threats and encourage a new culture of cybersecurity to sustain continuity across the region’s business intensive digital ecosystems. The key discussions in the confluence included:

PrevNext

1. Cyber Security Strategy 2020: Public-Private Partnerships to overhaul the cyber resilience of critical infrastructure networks and systems by Damien Manuel, Chairman, Australian Information Security Association

https://www.youtube.com/watch?v=jKxpubM_opw&t=45s&ab_channel=CISOMAG

During the session, Damien Manuel, Chairman, Australian Information Security Association stressed why public-private collaboration is important, who is really responsible for cybersecurity, and also touched on who will do what in the Australian Cyber Security Strategy 2020. He said collaboration is extremely important as the threat paradigm has significantly changed, especially with the rapid adoption of digital technology in the post-COVID-19 world that we now live in.

2. Zero trust – Demystified by Ashwin Pal, Director Cybersecurity, Unisys Asia Pacific

https://www.youtube.com/watch?v=_jLjET_dgVA&list=PLRmoLV6UOL5y09q_q8tMUMz6Z-1YqRmeM&index=1&ab_channel=CISOMAG

In this session, Ashwin Pal, Director Cybersecurity, Unisys Asia Pacific spoke about the concept of zero-trust and how it dates 10 years back. He also discussed key components of zero-trust, the relevance of perimeter, the M&M security model, and challenges that come in with the Zero-Trust philosophy and the key lessons to be learned from his own experiences.

3. Tackling Insider Threat Attacks – Salvatore Trimboli, Chief Technology Officer, E.L & C. Baillieu Limited

https://www.youtube.com/watch?v=8fSQf4zevqs&ab_channel=CISOMAG

In this session, Salvatore Trimboli, Chief Technology Officer, E.L & C. Baillieu Limited spoke about the types of insider threats, the prevention techniques, governance, risk assessment, threat program, and culture. He spoke in-depth about prioritizing the security of critical assets, periodic risk assessments, instilling a culture of data security, and implementing threat aversion protocols.

4. Panel Discussion: Deploying a zero-trust architecture to protect critical functionality and services while securing business continuity

https://www.youtube.com/watch?v=lUFR9flQbT4&ab_channel=CISOMAG

Participants of the panel discussion included:

  • Helaine Leggat, Managing Partner, ICT Legal Consulting
  • Rassoul Ghaznavi Zadeh, Director of Information Security, ResMed
  • Daniel Pludek, Chief Technology Officer, Kip McGarth Education Centres
  • Andrew Collins, Chief Information Officer & Chief Security Officer, Sport Integrity Australia
  • Moderator: Kelly Henney, Partner & National Leader Data Privacy Services, KPMG

5. Leveraging cloud and AI to derive a proactive and rapid incident response mechanism

https://www.youtube.com/watch?v=qKkxYSDtDn4&ab_channel=CISOMAG

Participants of the panel discussion included:

  • Andrew Wan, Chief Information Security Officer, The Smith Family
  • Daminda Kumara, Head of Cyber Security and Risk, Wesfarmers Industrial and Safety
  • Wayne Burke, VP & Co-Founder, Cyber2labs LLC
  • Ts. Dr. Aswami Ariffin, SVP Cyber Security Responsive Services Division, CyberSecurity Malaysia, President, DFRS
  • Neil Campbell, Vice President and Head of Asia Pacific & Japan, Rapid7
  • Moderator: Rafael Narezzi, Chief Information Security Officer, WiseEnergy

6. Fireside Chat: Dynamic security countermeasures to enhance data security and privacy

https://www.youtube.com/watch?v=t7mjU3O5194&t=1s&ab_channel=CISOMAG

Participants of the fireside chat included:

  • Nicki Doble, Group Chief Information Officer, Cover More Insurance
  • Amit Chaubey, Head of Cyber Security Risk, Governance & Compliance, Ausgrid
  • Moderator: Jacqueline Kernot, Partner Cyber Security, EY

 

Leaked Document Row! Google CEO Sundar Pichai Apologizes to EU’s Thierry Breton

Google Cybersecurity Action Team Google, EU warns Google

Google CEO, Sundar Pichai, who was under fire from Europe’s industry chief, Thierry Breton, over a leaked internal document has since apologized to Breton. According to a statement from the European Commission, both dignitaries exchanged notes in a video-conference call that was initiated and scheduled by Google much before the leak took place. Breton confronted Pichai on the call stating the leaked document seemed to be proposing ways to counter the EU’s tough new rules for technology companies, and this was not acceptable.

Pichai was taken aback by the document shared with him and had no knowledge of it, neither had any memory of signing-off any such document in the past. Yet, because the harsh words used by Breton like “Internet is not (the) Wild West,” Pichai apologized to Breton. According to Pichai, the manner in which the leak came out portrayed his and Google’s views on EU’s laws in bad light, which he also stated was never the position of the company.

Related News:

Google is the Monopoly Gatekeeper to the Internet, says DoJ

Breton added, “Europe’s position is clear; everyone is welcome on our continent as long as they respect our rules. We need clear and transparent rules, a predictable environment and balanced rights and obligations. Everything that is allowed offline should be authorized online; and everything that is forbidden offline should be banned online.”

Breton’s DSA and DMA draft

Breton is set to announce the new draft rules known as the Digital Services Act (DSA) and the Digital Markets Act (DMA) together with the European Competition Commissioner, Margrethe Vestager, on December 2, 2020. The European Commission believes that these two acts will strengthen the Single Market for digital services and foster innovation and competitiveness of the European online environment.

The new DSA will modify the current legal framework on two counts:

First: It will propose clear rules framing the responsibilities of digital services to address the risks faced by their users and protect their rights.

Second: It will propose rules covering larger online platforms like Google, Facebook, Amazon, etc. that are currently acting as gatekeepers. At the moment, they are setting the rules of the game for their users and competitors. The initiative will ensure that these platforms behave fairly and can be challenged by new entrants and existing competitors, so that consumers have the widest choice, and the Single Market remains competitive and open to innovations.

6 Steps to Boost your Online Security

Penetration Testing, continuous testing, security testing

The year 2020 is certainly considered as the year of change. The pandemic has changed/impacted every facet of life — from the way we used to commute to the way we worked. Even cybercriminals have become more creative with their online scams — leveraging the aftereffects of COVID-19, like remote work. You might be a click away from fraudulent adware or malicious links, leaving yours and the organization’s critical data at risk. Besides following basic security measures, online users must adhere to additional precautions to secure their online presence.

By Rudra Srinivas, Feature Writer, CISO MAG

Below are the six security tips to increase online security:

1. Using Password Manager

We cannot ignore the importance of managing passwords while talking about online security. Using a strong password or passphrase will provide maximum security to your network and the devices you use. However, strong passwords/passphrases are often leaked in data breaches when companies mismanage their user data. Hackers trade stolen credentials on various darknet forums to other bad actors. Having different passwords for every account will reduce the domino effect of brute-force attacks, in which hackers try many passwords with the hope of eventually guessing correctly. Using a password manager like LastPass, Dashlane, or 1 Password will enhance the security of your passwords and encourages the use of separate passwords for each individual account/site.

2. Clear the Cache

We often neglect to clear the cache data until we face some technical issues. Personal data like saved searches, browsing history, and home addresses can be saved into the cookies and cache folders of your internet browser. Therefore, delete your browser cookies and clear the browser history on a regular basis to protect your device/information from cyber risks. Do this from the Settings menu in your browser.

3. Update Regularly

Threat actors often look for new vulnerabilities to exploit and break into your device/network to pilfer sensitive information. Make sure you update your operating system, applications, browser, and device firmware regularly.

4. Using Virtual Private Network

A Virtual Private Network (VPN) helps improve a user’s data privacy and security on the internet. VPNs provide a secure connection for users when joining another network online. It also changes your IP address and location, making your browsing activity safe and private from threat actors. Even if hackers penetrate your network, they still cannot compromise/access your data when a VPN is used.

 5. 2FA

Though two-factor authentications (2FA) make the login process a bit longer, it strengthens users’ internet security. Using 2FA means you have an extra layer of security to your network.

6. Don’t Get Phished by Click Baits

Phishing scams via malicious ads and emails are rampant in the online world. Be vigilant about what you click as they could be malicious. Attackers lure users with phishing links to automatically download malware and infect the device. Never click on links in emails, messages, and social media sites unless they are genuine and received from a known source.

Wrap Up

Attackers are using innovative hacking techniques to break into users’ networks/devices to steal sensitive information. It is our responsibility to secure our endpoints and networks against online intruders.

About the Author

 

Rudra Srinivas is a Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.

“The North Face” Faces the Brunt of a Credential Stuffing Attack

credential phishing campaigns
– Popular outdoor clothing and accessories retailer – “The North Face” – was hit by a credential stuffing attack on October 8 & 9.
– Apart from email IDs and passwords, the retail giant believes users’ PII (personally identifiable information) and store purchase history may have been accessed by the cybercriminals.

What Happened in the North?

According to the data breach notification, the company said that it was “alerted to an unusual activity” involving its website, thenorthface.com, on October 9, 2020. To clear the growing suspicion, the company’s IT team conducted a thorough internal investigation. Through this, it found conclusive evidence that cybercriminals were targeting its customers through a credential stuffing attack on their website. The North Face immediately took responsive measures by resetting an undisclosed number of customer accounts.

How Does a Credential Stuffing Attack Work?

Credential stuffing is a malicious activity where cybercriminals take advantage of people reusing the same passwords across multiple online accounts. It is like a single key working across multiple locks.

how Credential Stuffing Attacks Work, the north face credential stuffing attack

However, this attack vector only works when passwords and/or other PII are reused by users for more than one account. These PII and passwords are typically stolen from another source, such as a data breach of another company or website, and then with the help of botnets are “stuffed” and tested across various popular websites. This is exactly what happened in the case of “The North Face”, thus, resulting in unauthorized access of cybercriminals into its specific data set.

Related News:

Hackers Target Loyalty Programs to Obtain Users’ Sensitive Data

As mentioned earlier, apart from the email IDs and passwords, it is possible that cybercriminals have accessed users’ purchase information that includes, billing and shipping address, VIPeak customer loyalty point total, email preferences, first and last name, birthday (if it was saved), and telephone number (if it was saved). This information, however, did not contain any payment card (credit/debit) details including the card CVV number, as it was never saved on thenorthface.com website.

How to Avoid Credential Stuffing Damages

Although The North Face claims that none of the critically valuable information was leaked from their end, it is possible that some of the PII was leaked in an earlier data breach from where these stolen credentials were used in the first place. So, how do we avoid any damages from a credential stuffing attack?

The first and the best line of defense against credential stuffing attack is using a unique password for every account across the internet. Do not recycle and reuse same password across all website as a breach in one of the accounts could potentially compromise the safety of all your accounts.

Tips to create a strong and unique password for each account
  • Use at least one UPPERCASE and one lower case letter
  • Use at least one (0,1,2,3,4,5,6,7,8,9)
  • Use at least one special character (such as “!,” “%,” or “$”)
  • Use a minimum of 8 characters in your password
  • In case of creating and remembering passwords for multiple accounts,
    • Create a strong base password using above rules (Example: 8$ciTeK#).
    • Use part of the account URL at a start or end of the base password (Example for Facebook: FB8$ciTeK# or 8$ciTeK#FB or F8$ciTeK#B).

Credential stuffing has become a serious issue in recent years and its evidence is provided by a recent report from Akamai which found that more than 100 billion credential stuffing attacks took place between July 2018 and June 2020. Thus, it is time to act now and act quickly. Using the tips provided above may not be full-proof but it surely raises your protection shield a bit higher than it was earlier.

Related News:

Media Industry Becomes a Common Ground for Credential Stuffing Attacks

How to Prevent Zoom Credential Theft

ICO’s Ticket for Data Breach! Ticketmaster Fined £1.25 Mn Over 2018 Cyberattack

ICO fined Ticketmaster

The U.K.’s Information Commissioner’s Office (ICO) recently penalized Ticketing website Ticketmaster for £1.25 million ($1.65 million) following a data breach in 2018. The privacy watchdog claimed that Ticketmaster failed to protect its customers’ private information and violated the GDPR laws. Hackers installed malicious software on to the customer support chat-bot on Ticketmaster’s online payment page to pilfer sensitive and financial data from more than 9.4 million customers in Europe and 1.5 million in the U.K.

The incident affected customers who purchased or attempted to purchase tickets between February and June 23, 2018, as well as international customers who purchased, or attempted to purchase tickets between September 2017 and June 23, 2018.

ICO’s investigation found the data breach compromised customer names, payment card numbers, expiry dates, and CVV numbers. In addition, over 60,000 payment cards belonging to Barclays Bank customers were subjected to known fraud and 6,000 cards were replaced by Monzo Bank after it suspected fraudulent use as a result of the data breach.

Related Story: Four Biggest GDPR Fines of 2020

The ICO found that Ticketmaster failed to:

  • Assess the risks of using a chat-bot on its payment page
  • Identify and implement appropriate security measures to negate the risks
  • Identify the source of suggested fraudulent activity in a timely manner

James Dipple-Johnstone, Deputy Commissioner said, “When customers handed over their personal details, they expected Ticketmaster to look after them. But they did not. Ticketmaster should have done more to reduce the risk of a cyberattack. Its failure to do so meant that millions of people in the U.K. and Europe were exposed to potential fraud. The £1.25 million fine we’ve issued today will send a message to other organizations that looking after their customers’ personal details safely should be at the top of their agenda.”

Biggest ICO Fine!

Recently, the ICO fined British Airways (BA) £20 million (approximately US$26 million) for failing to protect its customers’ sensitive information in a cyberattack in 2018. ICO’s investigation found that the airline was handling its customers’ data without adequate cybersecurity measures. For full story click here…

1...144145146...410Page 145 of 410