Home Blog Page 158

Business Email Compromise Leaves Global Footprints in 50 Countries

BEC Scammers Exploit Email Auto-Forwarding Rules, FBI warns

A new investigative report from security solutions provider Agari revealed the geographic locations of business email compromise (BEC) cybercriminals. The investigation found that email fraudsters are operating globally across 50 countries with 25% of scammers in the U.S. In a BEC attack, cybercriminals first steal legitimate business email account credentials, which are later used to launch financial fraud campaigns like fraudulent email messages, requests for out-of-channel funds transfers, and deleted accounting trails.

Agari stated that its Cyber Intelligence Division (CID) identified money mule networks of cybercriminals in every state, including the District of Columbia. Hackers use money mule networks to launder and quickly move money offshore.

Key Findings:

  • Over 2,900 global money mule bank accounts were uncovered, with more than 900 identified money mules located in the U.S.
  • BEC cybercriminals demanded $64 million illicit funds in total.
  • An average of $247,000 of payments were requested to Hong Kong money mule accounts, six times higher than in the U.S.
  • BEC cybercriminals are located across 50 countries where 50% of email fraudsters located in Nigeria and 25% located in the U.S.
  • Nearly 48% of U.S.-based email scammers are located in five states: California, Georgia, Florida, Texas, and New York.
  • The five cities with the biggest volume of clusters of email scammers include Atlanta, GA, New York, NY, Los Angeles, CA, Houston, TX, and Miami, FL.

Agari Chief Identity Officer Armen Najarian, said, “A CISO I spoke to just last week explained her number-one goal is customer trust – to earn it, maintain it, and respect it. The information unveiled today as a result of our ACID team’s investigations enables CISOs to learn something new about the threat landscape they are working in and how to adapt their security controls to stay ahead of fraudsters. And ultimately those actions taken by the CISO organization earn and sustain consumer trust.”

BEC Attacks – A Remunerative Business for Cybercriminals

A similar research from the APWG (Anti-Phishing Working Group) revealed how enterprises lose their wealth to BEC attacks. In its “Phishing Activity Trends Report,” APWG highlighted that the average wire transfer loss from BEC attacks surged from $54,000 in Q1 2020 to $80,183 in Q2 2020, as cybercriminals expected high returns. Read the full story here.

Need for Cyber Training! Survey Finds Security Awareness Gaps in Indian Organizations

Acronis Cyber Readiness Report, cyberattacks in India, cybercrime in India, India’s Private Sector

A survey from Cyberbit revealed that over 61% of organizations in India do not have enough cybersecurity training modules to train their workforce. It is found that most of the companies rely upon on-the-job training for their Security Operations Center (SOC) team. Over 90% of organizations are not disclosing their security teams to the MITRE ATTCK framework, and only 32% of companies are aligning their training to MITRE. MITRE ATTCK is a globally accessible knowledge base of cybercriminals tactics on real-world observations of cyberattacks.

Nearly 89% of organizations still depend on classroom training, external certificates, and tabletop exercises, which do not provide practical skills. The survey also claimed that organizations know their employees need cybersecurity training but are not implementing any. However, 11% of organizations stated they have deployed a cyber range that exposes SOC teams to simulated cyberattacks.

India Witnessed 1.45 Mn Cyberattacks

Computer Emergency and Response Team – India (CERT-In) recorded over 1.45 million cybersecurity incidents including breaches and hacks between 2015 and 2020. According to India’s Ministry of Electronics and Information Technology (MeITY), Cert-In reported 49,455, 50,362, 53,117, 208,456, 394,499 and 696,938 cybersecurity incidents during the year 2015, 2016, 2017, 2018, 2019 and 2020 (till August) respectively. The figures were out after the ministry was asked about growing cyberattacks targeting Indian citizens as well as commercial and legal entities. According to a report, released by the U.S. Internet Crime Complaint Centre of the Federal Bureau of Investigation, India stands third in the world among the top 20 countries that are victims of internet crimes. Reports also suggest that the number of internet users in India has grown six-fold between 2012-2017 with a compound annual growth rate of 44%.

October Patch Tuesday Alert! Microsoft Fixes 87 Vulnerabilities Including 11 Critical Ones

microsoft ransomware cybersecurity CISOMAG, Microsoft Patch Tuesday October 2020

Like most other tech companies, 2020 has been a tough year for the tech giant Microsoft. In the past seven consecutive months, it has released more than 100 vulnerability fixes in each of its monthly Patch Tuesday updates. If we are to believe, it is probably the support for a distributed workforce that added to the strain of fixing certain issues, which weren’t critical previously. However, this busy year seems to be finally getting better as Microsoft’s Patch Tuesday for October 2020 contained only 87 vulnerability fixes, yet 11 critical ones.

What’s Included in Microsoft Patch Tuesday October 2020

The October release exclusively consists of security fixes for the following software:

  • Microsoft Windows
  • Microsoft Office and Microsoft Office Services and Web Apps
  • Microsoft JET Database Engine
  • Azure Functions
  • Open Source Software
  • Microsoft Exchange Server
  • Visual Studio
  • PowerShellGet
  • Microsoft .NET Framework
  • Microsoft Dynamics
  • Adobe Flash Player
  • Microsoft Windows Codecs Library
Related Story

Microsoft Fixes 129 Vulnerabilities in its September Patch Tuesday

Tenable’s Staff Research Engineer, Satnam Narang, agrees with our commentary and says, “It has been an unusually busy year for Microsoft Patch Tuesday updates. This month’s Patch Tuesday includes fixes for 87 CVEs, 11 of which are rated critical. It also marks the first time since February that Microsoft patched less than 100 CVEs in a single release. These are positive signs. It means Microsoft is getting secured and much more stable adjusting to the current tech demands in the market.”

A Peep into the Vulnerabilities Fixed

Although discussing all 87 vulnerabilities is beyond the scope of this article, let’s have a look at the most critical ones below. For the complete list refer Microsoft’s Release Notes here.

 CVE-2020-16898 : Windows TCP/IP Remote Code Execution Vulnerability

Dubbed as “Bad Neighbor,” CVE-2020-16898, is a critical remote code execution (RCE) vulnerability within the Windows TCP/IP stack. The vulnerability exists due to improper handling of ICMPv6 Router Advertisement packets using Option Type 25 and an even length field. According to a blog post from McAfee, Microsoft Active Protections Program (MAPP) members were provided with a test script that successfully demonstrates exploitation of this vulnerability to cause a denial of service (DoS). While the test scenario does not provide the ability to pivot to RCE, an attacker could craft a wormable exploit to achieve RCE. While an additional bug would be required to craft an exploit, it is likely that we will see proof-of-concept (PoC) code released in near future.

 CVE-2020-16899 : Windows TCP/IP Denial of Service Vulnerability

This CVE is similar to the previous CVE and results from improper handling of ICMPv6 Router Advertisement packets. To exploit this flaw, an attacker needs to send manipulated ICMPv6 Router Advertisement packets which could cause the system to stop responding. While Microsoft does recommend applying security update to patch this flaw, a workaround is available via a PowerShell command to disable ICMPv6 RDNSS (Recursive DNS Server) in the event the patch cannot be immediately applied.

 CVE-2020-16951, CVE-2020-16952 : Microsoft SharePoint Remote Code Execution Vulnerability

These RCE vulnerabilities in Microsoft SharePoint are a result of a failure to validate an application package’s source markup. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code under the context of the SharePoint application pool and the SharePoint server farm account.

 CVE-2020-16947 : Microsoft Outlook Remote Code Execution Vulnerability

This RCE flaw in Microsoft Outlook occurs due to the improper handling of objects in memory. An attacker can exploit this vulnerability using a crafted email file sent to a user using a vulnerable version of Microsoft Outlook. Because Outlook’s Preview Pane is affected by this flaw, a user does not have to open the message for the vulnerability to be exploited. As Outlook is widely used as an enterprise email solution, it is highly recommended to prioritize the patching of this CVE.

 CVE-2020-16929, CVE-2020-16930, CVE-2020-16931, CVE-2020-16932 : Microsoft Excel Remote Code Execution Vulnerability

To exploit these vulnerabilities, an attacker must create a malicious Excel file and prompt its victim to open the file using a vulnerable version of Microsoft Excel, either by attaching the file to an email or hosting it on a website. Successful exploitation would allow an attacker to gain arbitrary code execution on the vulnerable system with the same rights as the current user. The exploitation of this vulnerability can become critical if the current user has administrative privileges, which could grant the attacker the ability to perform a complete takeover of the vulnerable system.

A Fresh Take on Cybersecurity Awareness

Every year in October we remind our employees that it is time to think about cybersecurity. The cybersecurity awareness campaign has often become an afterthought for the security team and the employees are even less excited. We run the same or a slightly updated training and hang up some new posters in the break room. You might email out a slide presentation and ask everyone to read it and respond “yes I read it”. The annual requirement to check the block on security awareness has lost the value and effect we hope to achieve. Even blending the concept of training and awareness is to some degree misplaced effort. Do we want to teach our staff how to be secure computer users, or do we want them to understand the threats our organization faces and how your team works to defeat them? Those are two very different things and I would like to encourage CISOs, this October, to choose the latter.

By Dick Wilkinson, Chief Technology Officer, New Mexico Judicial Information Division

Security efforts often go unnoticed. The staff and the work they do is a mystery to employees outside of the IT department and even many IT staff are not focused on the security effort. The security team is busy and they are always either improving your defenses or thwarting the next probe or attack. They may not be very engaged with the rest of the organization and don’t get much credit for the hard work they do. The security professionals work behind the scenes and know that their work may be a secret to control sensitive information about your own weaknesses or recent incident responses. This is for a good reason, we don’t want to advertise everything our security team does. The more you talk about the real-world threats and how you respond, the more information you give away about how you defend your system and that could lead to a compromise in the future. I challenge you to place that extreme secrecy aside and let some people peek behind the security curtain just a little bit.

A New Approach to Awareness

This October, take a different approach to cybersecurity awareness, internalize the awareness campaign. Instead of spending all of your time giving training and news snippets that don’t relate to your staff, take the time to show people what your team does and just how well they do it. The following are a few suggestions on how to showcase your team and their efforts while also making your general staff smarter about the threats you face.

Present awards: If you have a big enough security team to highlight some exceptional efforts or individual growth, make October the time you recognize those people. If you can put together a presentation to showcase these people, even better, invite the entire company. Putting your security employees themselves in the spotlight helps people see that they are a part of the larger team and the security professionals are just as motivated as they are to grow and achieve new professional success. Recognize things like new degrees or certifications earned in the last year. Recognize people that were promoted in the last year and describe what that new level of responsibility means. The organization seeing your team and the personal effort they bring to the table will make them more approachable and integrated with the rest of the company. This makes the staff aware that your team is focused on growth.

Highlight your department’s growth or transformation: Moving from the individual member to the team as a whole; this is the chance to show off your own managerial prowess. If the security team had a long project to stand up a totally new SOC tool set. Tell everyone else just how tough that was and what that work means to the company. Describe how the new system detects danger and how your people act to stop it. If you keep statistics like phishing attempts prevented or IP scans detected, now is your chance to show those to a large audience, not just the board and C-Suite. Give the employees information that is concise and easy to digest, and it should have a wow factor. Any mid-size organization sees thousands of phishing attempts in a year and your team has to be always on guard against those threats. Let the employees know that security never stops, even when they go home. Showing the staff just how diligent your team is can raise awareness of the myriad of disciplines that fall under the label security.

Training: Last but not least, training is still going to get the time it deserves. Don’t email slides or buy a training package from a website. Use your team’s expertise to conduct face to face, or virtually live training. Let the SOC analyst show a group of employees what they do when they detect a threat with real tools that they use. People think IT is magic and hackers are wizards, show them the skills you have hired and cultivated to combat that wizardry. You can really wow your company with even some basic show and tell. This will give your security employees a chance to be proud of their work and the general staff will hopefully internalize that value and try to become more connected as part of the security mission. You can take your training objectives and weave them into the show and tell or presentations from your security team. Make a comprehensive plan and then let your team decide what they feel comfortable showcasing. Coach your security team and help them realize this is not bragging about how good we are, this is teaching everyone around us how important security should be in everything they do.

Take this October to change the meaning of awareness, we all know bad actors want to harm our company. How much do we know about our coworkers and what they do to protect us? This is your chance as the CISO to answer that question and gain benefits every step of the way. You can recognize and motivate your security professionals and educate the workforce in new and interesting ways at the same time.

About the Author

Dick WilkinsonDick Wilkinson is the Chief Technology Officer on staff with the Supreme Court of New Mexico. He is a recently retired Army Warrant Officer with 20 years of experience in the intelligence and cybersecurity field. He has led diverse technical missions ranging from satellite operations, combat field digital forensics, enterprise cybersecurity as well as cyber research for the Secretary of Defense.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for them. 

 

How Pandemic Influenced Cybersecurity Budget in Australia

Cryptocurrency scams in Australia

A new research from cybersecurity firm Thycotic revealed that 66% of organizations in Australia are planning to increase their cybersecurity budgets in the next 12 months. The research titled “CISO Decisions” highlighted what motivates companies to invest in cybersecurity and the impact this has on CISO decision making.

Based on the responses from over 900 CISOs and security decision makers globally, the research states that nearly 88% of Australian respondents (77% globally) received boardroom investment for new security projects, either in response to a cyber incident at 59% of organizations (49% globally) or due to fear of audit failure at 29% (28% globally). Nearly 18% of Australian respondents (23% globally) believe that compliance or threats of fines are the most effective way to convince boards to invest in cybersecurity.

COVID-19 Boosts Security Investments

Amid growing cybersecurity risks during the pandemic and the fear of compliance audit failure, most of the CISOs stated that boards are in plan to step up their budgets for cybersecurity. 94% of CISOs in Australia (91% globally) said their board adequately supports them with investment. While two-thirds of Australian respondents (58% globally) believe that in the next financial year they will have increased security budgets due to the COVID-19 outbreak, 41% of them (37% globally) said their investments were turned down because the threat was perceived as low risk.

“Before CISOs can pursue technology innovation they must first educate their stakeholders about the value of cybersecurity. Securing Boardroom investment requires them to strike a delicate balance between innovation and compliance,” said James Legg, CEO at Thycotic.

“While boards are definitely listening and stepping up with increased budget for cybersecurity, they tend to view any investment as a cost rather than adding business value. There are encouraging signs, particularly in APAC where ROI is a leading factor in security investment decisions. However, there is still some way to go, as Boards mainly approve investments after a security incident, or through fear of regulatory penalties for non-compliance. This shows that cybersecurity investment decisions are more about insurance than about any desire to lead the field which, in the long run, limits the industry’s ability to keep pace with the cybercriminals.” said Terence Jackson, CISO at Thycotic.

To address the surge in malware, phishing, and DDoS attacks, EC Council’s CISO MAG has planned a crisp half day virtual engagement, The Australia CISO Confluence, to create more awareness on the need for cybersecurity and its related implications in these testing times. Register here.

 

Insider Threats in Health Care: More Concerning Than Ever Before

Insider attacker leak data

A recent survey from cybersecurity firm Netwrix revealed that majority of the health care organizations are now concerned about insider threats than before the pandemic. In its 2020 Cyber Threats Report, Netwrix highlighted that over 71% of health care providers are worried about the risks of data theft due to the negligence or mistakes of their employees and IT admins. Earlier, organizations in health care sector were mostly concerned about employees accidentally sharing sensitive data (88%) and rogue admins (80%), but now they are worried about phishing (87%), admin mistakes (71%), and data theft by employees (71%).

“Their perceptions of risk are both founded and unfounded. They are correct to be concerned about phishing and IT staff errors, since those types of incidents were experienced by 37% and 39% of respondents, respectively, during the first few months of the pandemic. However, even though 37% suffered improper data sharing, concern about this risk plummeted by 32% points since the pandemic began,” the report stated.

Key Findings

  • Every third health care organization surveyed (32%) experienced a ransomware attack, which is the highest result among all verticals studied.
  • 26% of health care organizations reported data theft by employees; 49% of them were unaware of the incident for weeks or months.
  • Concern about supply chain compromise dropped by a record 50 percentage points from the pre-pandemic level; now, only 25% say it is a top security threat.
  • No respondents were able to discover improper data sharing in minutes. 26% needed hours and 74% had to spend days, weeks, or months to flag the incident.
  • 8 out of 10 health care organizations regularly report on the state on cybersecurity to executive leadership, and 47% are convinced it takes too much time and effort.

“With 39% of health care organizations experiencing incidents due to errors by IT staff, this industry should pay particular attention to the activities of privileged users. Even one mistake can bring the entire organization to a standstill, leaving it unable to take care of patients. To mitigate the risk of admin mistakes, it is essential to rigorously enforce the least privilege principle through regular privilege attestation. To ensure quick detection of unauthorized modifications, health care organizations are advised to automate both monitoring of changes and checking of all system configurations against a healthy baseline,” said Ilia Sotnikov, VP of Product Management at Netwrix.

ACSC Issues a Red Alert for a New Wave of Emotet Malware Campaign

Remote Access Scams

The Australian Cyber Security Centre (ACSC) has issued a high alert warning for a new wave of Emotet malware campaigns specifically targeting Australia’s critical infrastructure and other government agencies. Back in 2019, the ACSC had issued a similar red alert for the Emotet malware campaign but over the due course of the pandemic, the number remained below alert levels. However, the ACSC noted that the Emotet campaigns are further used to deploy ransomware attacks and network compromises, and even a small spike in its number of attacks at this moment is unaffordable.

The Observations

Emotet malware is generally spread through malicious emails (phishing/spear-phishing attacks) containing either MS-Office or PDF file attachments. These attachments contain macros or malicious links, which when enabled or clicked downloads the Emotet malware.

In its latest campaign targeting the Australian services, Emotet operators seem to be using email thread hijacking to spread its vicious circle. The ACSC says, “This technique involves the malware stealing an infected victim’s email contacts and recent email threads and exfiltrating this information to an actor-controlled Command and Control (C2) server. The actor then sends further phishing emails containing a malicious Emotet attachment, leveraging existing email threads with uninfected contacts, and spoofing the infected victim’s email address.”

On successful compromise, Emotet tries to move laterally by using brute force attacks over user credentials and by manipulating the shared drives on the network. Additionally, Emotet is also known to drop secondary payloads such as TrickBot malware/botnet. Trickbot allows an attacker to further harvest emails and credentials and save it to another C2 server. It then moves laterally within a network using exploits to compromise other systems on the infected network.Australia CISO Confluence

Related Story

Australia to Spend $1.19 Bn to Boost Cybersecurity

The Recommendations

ACSC’s researchers stated, “Emotet download domains are extremely fast-cycling, and it is impossible to maintain an accurate, up-to-date list of indicators of compromise. While domain and IP address blocking may be effective temporarily, this is unlikely to provide long term protection.”

As a long-term precautionary measure, ACSC gave the following recommendations:

  • Hardening of macro settings on all workstations using MS-Office.
  • Apply the latest patches to OS.
  • Perform a scheduled daily backup of at least critical data, if not all.
  • Use email scanning solution for added security other than apt staff training.
  • Use network segmentation to avoid spread in case of compromise.
  • Immediately alert ACSC and/or other required agencies in case of an attack.

Microsoft Downs TrickBot Operations

As said earlier, Emotet is known to drop secondary payloads such as the TrickBot botnet, and the latest data analyzed by Microsoft – through its MS Office 365 Advanced Threat Detection – suggested that Trickbot had been the most prolific malware operation using COVID-19 themed phishing emails. Owing to these high numbers, Microsoft along with a group of other tech companies including Lumen’s Black Lotus Labs, ESET, Financial Services Information Sharing and Analysis Center (FS-ISAC), NTT, and Broadcom’s Symantec, has collectively taken the fight against the threat actors by trying to shut them off from the backend.

That’s right! Post-approval from the U.S. District Court for the Eastern District of Virginia, the said companies analyzed over 186,000 TrickBot samples to track down the malware’s C2 server and the corresponding IP addresses along with other TTPs applied to evade detection. They have for the moment disabled these IP’s rendering the C2 servers inaccessible and therefore shutting out the operators from accessing the exfiltrated data.

Related Story

Coronavirus Propagates Emotet Malspam Campaign in Japan

APT Actors Exploit Multiple Legacy Vulnerabilities to Target SLTT and Govt. Networks

Cyber Espionage Campaign Naikon APT

The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI claimed that cybercriminals obtained unauthorized access to government networks by exploiting multiple legacy vulnerabilities in VPNs and the Windows platform. In a joint security alert, the agencies stated that they observed advanced persistent threat (APT) actors targeting federal and state, local, tribal, and territorial (SLTT) government networks, and non-government networks. “CISA is aware of some instances where this activity resulted in unauthorized access to elections support systems; however, CISA has no evidence to date that integrity of elections data has been compromised,” the alert said.

The APT actors leveraged legacy network access and exploited critical Netlogon vulnerability CVE-2020-1472 to compromise all Active Directory (AD) identity services. It also found that hackers leveraged vulnerabilities in internet-facing infrastructure, External Remote Services to gain initial access into systems. “Actors have then been observed using legitimate remote access tools, such as VPN and Remote Desktop Protocol (RDP), to access the environment with the compromised credentials. Observed activity targets multiple sectors and is not limited to SLTT entities,” the alert added.

CISA urged system administrators to review their internet-facing infrastructure for these or similar vulnerabilities that could be exploited by attackers, including Juniper CVE-2020-1631, Pulse Secure CVE-2019-11510, Citrix NetScaler CVE-2019-19781, and Palo Alto Networks CVE-2020-2021.

The agencies also recommended certain protective measures to secure the organization’s VPNs. These include:

  • Update VPNs, network infrastructure devices, and devices being used to remote into work environments with the latest software patches and security configurations.
  • Implement multi-factor authentication (MFA) on all VPN connections to increase security. Physical security tokens are the most secure form of MFA, followed by authenticator app-based MFA. SMS and email-based MFA should only be used when no other forms are available.
  • Discontinue unused VPN servers. Reduce your organization’s attack surface by discontinuing unused VPN servers, which may act as a point of entry for attackers.

 ALSO READ: FBI and CISA Warn About Threat Actors Spreading Disinformation on Elections

Are You Cyber-aware? EC-Council’s Aware App Gamifies Learning

Ec-Council-Aware App

The world is reforming. Technology has become an integral part of our lives and businesses are undergoing a radical digital transformation. And digital transformation brings with it an array of cyber risks. CISOs and security professionals are always on the go to confront cyberattacks or data breaches. A joint study from Stanford University Professor Jeff Hancock and security firm Tessian revealed that 88% of data breach incidents are caused by human error. So, what is the best way to create a cyber-aware environment?

By Pooja Tikekar, Feature Writer, CISO MAG

Recently, EC-Council launched its cybersecurity training solution, Aware. Aware is a user-friendly and easy-to-access training app that helps end-users understand security risks on a cyber battlefield. Aware is for all in the organization — C-levels, managers, executives, employees, contractors, temporary workers — who are looking for information to defend their organizations from cyberattacks.

EC-Council Aware is available on Android and iOS platforms. The setup does not require technological acumen, and users can Sign Up to create a new profile or use their existing social media profiles (Google, Facebook, and LinkedIn).

Aware’s Salient Features

  • Automatic Enrolment: Users will be automatically enrolled in the training they need based on their success during phishing simulations.
  • Upload Your Training Content: Once an organization is registered, the admin is authorized to upload training videos/modules, limit no bar. The training modules are required to be SCORM-compliant (Sharable Content Object Reference Model). Organizations can also add a company logo to the training videos/modules, which would help in branding and promotion.
  • Customizable E-learning Content: Users can customize their training programs to suit their requirements.
  • Scheduled Reminders: To ensure the completion of training, the app sets deadlines and reminds users of the timeframe they set in the beginning.
  • Advanced and Automated Reports: Aware’s advanced reports helps users know how well they are performing on phishing simulations and testing, and more. Reports can be generated using the in-built templates to keep the teams/staff informed about the areas they need to improve on.
  • Customizable Training Certificates: Complete the training and voilà! Aware pats your back with a Certificate of Training with customizable text options.

Learn with Fun

Science has proved that learning is fun. And the idea of having fun while learning makes information processing an enjoyable experience. Do you remember the last time you sat down to hone your skills at work?

EC-Council Aware makes learning fun and effective. It is power-packed with challenging games and quizzes to offer its users a memorable screen time. Users can choose from millions of live games and host quizzes on the go, in the classroom, or at parties. Teachers can now save time and assign homework using creative challenges and track learning progress.

The app also offers premium plans —  Aware! Plus and Aware! Pro — for corporate trainers to engage in exciting remote training.

An Assembly for All

Creativity, trivia, and training, EC-Council Aware is a cyber assembly for everyone. It nurtures a cyber-aware culture to better understand cyberthreats and their potential to incapacitate a business and its information assets. In tough times like the pandemic, raising appropriate awareness about ransomware or phishing is a must. It’s more important than ever to encourage collective effort to minimize the risk of cybercrimes.

And with the Aware app, organizations can not only train employees but also pave the way to a compliant digital future. #BeCyberSmart

Put on your quizmaster hat and download EC-Council Aware from the Google Play Store or Apple Store. For more information, visit https://aware.eccouncil.org.

About the Author

Pooja Tikekar is a Feature Writer and part of the editorial team at CISO MAG. She writes news reports and feature articles on cybersecurity technologies and trends.

More from the author.

 

NCSAM: Hybrid Workforce and its Cybersecurity Implications

In an interview at the TIME100 Honorees: Visions for the Future event, Alphabet CEO Sundar Pichai said “We firmly believe that in-person, being together, having a sense of community is super important when you have to solve hard problems and create something new so we don’t see that changing. But we do think we need to create more flexibility and more hybrid models.” It is safe to say that the pandemic has changed the workforce for good, and a hybrid model— a blend of both remote and in-office methods of working, will eventually take precedence. But the security of a hybrid model is still a far cry. During this year’s National Cybersecurity Awareness Month, let us look at how the changing workforce dynamics will change cybersecurity for good.

In its 17th year, National Cybersecurity Awareness Month (NCSAM) continues to work towards raising awareness about the importance of cybersecurity globally, ensuring that every nation has the required resources to be safer and more secure online. With this year’s theme as ‘Do Your Part. #BeCyberSmart’, each one of us needs to cooperate and work towards a cybercrime free world.

 

– Anil Bhasin, regional vice president, India & SAARC, Palo Alto Networks.

Cybersecurity has become a critical part of our lives, especially with the COVID-19 pandemic forcing us to accept the new normal, its importance has risen more than ever, everywhere: in organizations irrespective of its size, government offices to the individual home user.”

According to a study by cybersecurity firm Tessian, half of all the organizations experienced cybersecurity incidents during the remote working period. In its research titled, “Securing the Future of Hybrid Working,” Tessian also noted that phishing remained the most prevalent threat facing employees working remotely. The study also noted that working in an office five days a week will be “a thing of the past.” According to the majority of IT leaders surveyed, three-quarters of IT decision-makers (75%) believed the future of work will be “remote” or “hybrid” — where employees choose to split their time between working in the office and anywhere else they’d like. The study also found that most employees prefer hybrid working environments, with just 11% exclusively preferring office work.

Tim Sadler, CEO and Co-Founder of Tessian noted, “While remote working was an option for some employees pre-pandemic, and while some companies are more familiar with flexible working arrangements, not all employees got to experience it because of scheduling and business demands which meant they still needed to physically be in the office. Now, the majority of office workers are working from home. And it’s going to be hard for businesses to justify why their workers need to come into the office every day of the week, post-pandemic.”

Sleepless Nights for IT Leaders

Tessian also derived the findings from its previous survey titled “The Psychology of Human Error,” where it revealed that 43% of employees had made mistakes that led to security incidents, in turn jeopardizing the organization’s cybersecurity. Due to this trend, IT leaders now (from the current research) fear employees’ unsafe data practices could compromise their company’s security and lead to more data breaches and phishing attacks.

The “Securing the Future of Hybrid Working” study also revealed that 43% of security incidents that occurred between March and July 2020 were caused by malicious insiders and over a quarter of businesses (27%) experienced more security breaches caused by insider threats during this period, compared to the five months before the pandemic. It also revealed a 25% increase in the number of employees attempts to exfiltrate data to unauthorized email accounts between March to July 2020, compared to the five months prior.

1...157158159...410Page 158 of 410