Home Blog Page 161

Online Celebrity Searches Could Potentially Trigger Cyber Risks

Media Industry

Users rely on the internet to find information about their favorite celebrities, which makes them vulnerable to various cyber risks. Cybercriminals are capitalizing on users’ interest by spreading malware via search results. To highlight the same, McAfee’s Annual Threat Report revealed the names of some of the top celebrities in the U.S. and India whose search links lead to malware or malicious sites.

According to McAfee, actress Anna Kendrick is the most dangerous celebrity to search online followed by veteran female leads, talk show hosts, and musicians like Blake Lively, Taylor Swift, and Jimmy Kimmel.

2020 Top 10 Celebrities in the U.S. include:

The survey also highlighted that Indians have been active online searching the internet for a wide variety of entertainment, owing to the COVID-19 lockdown. McAfee identified the top 10 popular celebrities generating the riskiest search results online in India. Football sensation Cristiano Ronaldo has topped the list, including other famous film personalities like Shahrukh Khan, Anushka Sharma, Sara Ali Khan, Sonakshi Sinha, Arijit Singh, etc. 

2020 Top 10 Dangerous Celebrities to Search Online in India:

How to Stay Safe Online?

McAfee recommended certain security steps for safe online behavior, which include:

  • Users looking for popular coming-of-age films from the last decade, as well as updates on their favorite celebrities, should be cautious and only click on links to reliable sources. The safest thing to do is to wait for official releases and leverage legitimate TV and movie streaming platforms, instead of visiting third-party websites that could contain malware.
  • It is important to only use legitimate music streaming platforms, even if they come at a cost. Many illegal downloads are riddled with malware or adware disguised as mp3 files.
  • Safeguard yourself from cybercriminals with a comprehensive security solution. This can help protect you from malware, phishing attacks, and other threats.
  • Kids are fans of celebrities too, so ensure that limits are set for your child on their devices and use parental control software to help minimize exposure to potentially malicious or inappropriate websites.

“Cybercriminals use consumers’ fascination with celebrity culture to drive unsuspecting fans to malicious websites that install malware on their devices, potentially putting personal information and log-in details in the wrong hands. Consumers are searching the web for free online entertainment now more than ever, and as cybercriminals continue to implement deceptive practices such as fake sites claiming to offer free content, it is crucial that fans stay vigilant about protecting their digital lives and think twice before clicking,” said Baker Nanduru, VP of McAfee’s Consumer Endpoint Segment.

Second Largest GDPR Fine! H&M Fined €35.2 Mn for Violating Employees’ Data

GDPR fines in 2020

Popular fashion retailer Hennes & Mauritz Online Shop A.B. & Co KG (H&M) was fined €35.2 (US$41.1 million) by the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) for violating the General Data Protection Regulation (GDPR). In an official release, HmbBfDI stated the management of the H&M Service Center in Nuremberg unauthorizedly monitored its employees’ personal information.

H&M Violations

H&M’s data privacy violations included extensive use of its staff data, including their holiday experiences, medical symptoms, and diagnoses for illnesses. The HmbBfDI’s investigation also found that some managers of H&M also acquired employees’ private details like their informal chats, including family issues and religious beliefs by illegally recording their conversations at the workplace. It also found that the company used this private data to evaluate employees’ work performance. Besides, the illicitly obtained data became accessible company-wide for several hours in October 2019 due to misconfiguration.

“In addition to a meticulous evaluation of individual work performance, the data collected in this way was used, among other things, to obtain a detailed profile of employees for measures and decisions regarding their employment. The combination of collecting details about their private lives and the recording of their activities led to a particularly intensive encroachment on employees’ civil rights,” the HmbBfDI said.

Prof. Dr. Johannes Caspar, Hamburg’s Commissioner for Data Protection and Freedom of Information, said, “This case documents a serious disregard for employee data protection at the H&M site in Nuremberg. The amount of the fine imposed is therefore adequate and effective to deter companies from violating the privacy of their employees. Management’s efforts to compensate those affected on site and to restore confidence in the company as an employer have to be seen expressly positively. The transparent information provided by those responsible and the guarantee of financial compensation certainly show the intention to give the employees the respect and appreciation they deserve as dependent workers in their daily work for their company.”

The H&M management apologized to its staff and agreed to compensate the affected employees. This is the second largest GDPR fine imposed on a single company. Last year, the French data regulator, CNIL, fined Google €50 Mn (around US$57 million) for breaching the GDPR.

Also Read: Four Biggest GDPR Fines of 2020

Disclaimer:  The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.  CISO MAG is merely passing on what has been discovered and reported by the source mentioned in the article.

Biggest Malware Collaboration! Researchers Find 11 Banking Trojans Sharing Resources

Trojans, RAT, remote access trojan, Snip3 Crypter-as-a-Service

Security researchers from ESET discovered the biggest collaboration of various banking malware creators across Latin America. The researchers found eleven different banking Trojan families that have been sharing their malware capabilities, distribution channels, and incorporating new tactics, techniques, and procedures (TTPs).

The discovered Trojan families include Amavaldo, Casbaneiro, Grandoreiro, Guildma, Krachulka, Lokorrito, Mekotio, Mispadu, Numando, Vadokrist, and Zumanek. The researchers stated that all these malware families are using the same encryption algorithms, obfuscation techniques, same uncommon third-party libraries, and similar domain generation algorithms to connect to C2 servers.

“The operators of these banking Trojans appear to be in contact with one another. We first spotted this when examining algorithms used for string encryption. Most Latin American banking Trojans use very simple, custom encryption schemes that are generally unknown in the broader programming community, and yet we see the same algorithm being used in six different families. These common features do not end with the binaries’ contents. By examining the distribution chains, we find usage of the same obfuscation methods or packers applied to different scripts,” ESET researchers said.

How a Latin American Banking Trojan Works

  • A typical Latin American banking Trojan collects information on the victim’s device, including system name, username, unique identifiers, and in some cases verifies whether security software is installed or not.
  • The compromised data is sent to a URL distinct from the C&C server.
  • The Trojan attacks by displaying a fake pop-up window crafted specifically to lure the users into clicking on the window.
  • The malware then tries to make it as hard for the victim to get rid of the window by blocking input anywhere else, keeping the window always on top, disabling hotkeys, disabling Task Manager, and blocking mouse manipulation.

“Given so many common features, one might be inclined to think that the authors of these banking Trojans share the fake pop-up windows too, since they are designed to attack customers of the same banks. In fact, the opposite seems to be the case. This is likely the one thing they do by themselves. We have analyzed around 600 of the most recent of these fake windows and it seems they are unique to each family,” the researchers added.

CISA Warns Potential Cyberattacks from State Actors Amid Geo-Political Tensions

IoT Connections to Reach 83 Billion by 2024: Report, CISA alerts critical infrastructure, CISA – FBI holiday season alert

Amid the brewing geopolitical tensions in the U.S. and with the Presidential election being just around the corner, CISA has issued an alert for all operatives of critical infrastructure to look out for possible cyberattacks in the upcoming months. In a broader light of keeping the organizations and businesses safe from this foul play of certain state actors involved, CISA has provided information on specific tactics, techniques, and procedures (TTPs) employed by them.

The Chinese Threat

To the world, China has been on the defensive ever since the U.S. claimed that China was running a cyber espionage campaign against it through Huawei’s 5G contract. However, through many other incidents like the “Taidoor malware attack” and the “Zhenhua data leak,” China’s offensive tactics are being identified and portrayed globally.

CISA notes that “Made in China 2025,” is a 10-year plan outlining China’s top-level policy priority. In pursuit of these national interests, China can target critical infrastructures in the national and economic sectors of the U.S. These critical infrastructure sectors include new energy vehicles, next-generation information technology (IT), biotechnology, new materials, aerospace, maritime engineering, and high-tech ships; railway, robotics, power equipment, and agricultural machinery.

Additionally, there are several Department of Justice (DOJ) indictments over the past few years that provide enough evidence suggesting how Chinese threat actors are continuously targeting the U.S. to exfiltrate its intellectual property (IP) from both public and private domains. Their targets also include western companies with operations inside China.

Commonly Known TTPs of Chinese Threat Actors

The following table denotes the Pre-Att&ck TTPs that are commonly used by Chinese threat actors before launching an attack:

Technique Description
Acquire and/or Use 3rd Party Software Services [T1330] Staging and launching attacks from software as a service solution (SaaS) that cannot be easily tied back to the APT.
Compromise 3rd Party Infrastructure to Support Delivery [T1334] Compromising infrastructure owned by other parties to facilitate attacks (instead of directly purchasing infrastructure).
Domain Registration Hijacking [T1326] Changing the registration of a domain name without the permission of its original registrant and then using the legitimate domain as a launch point for malicious purposes.
Acquire Open-Source Intelligence (OSINT) Data Sets and Information [T1247] Gathering data and information from publicly available sources, including public-facing websites of the target organization.
Conduct Active Scanning [T1254] Gathering information on target systems by scanning the systems for vulnerabilities. Adversaries are likely using tools such as Shodan to identify vulnerable devices connected to the internet.
Analyze Architecture and Configuration Posture [T1288] Analyzing technical scan results to identify architectural flaws, misconfigurations, or improper security controls in victim networks.

 

As per CISA, these TTPs and associated IOCs are difficult to detect and hence need to be carefully monitored. Many state-sponsored APT groups like APT3, APT10, APT19, APT40 and APT41 are said to be actively employing these pre-attack techniques.

In the Enterprise Att&ck TTPs, Chinese threat actors are seen using commonly available security testing tools and frameworks such as:

  • Cobalt Strike and Beacon
  • Mimikatz
  • PoisonIvy
  • PowerShell Empire
  • China Chopper Web Shell and more.

Mitigation Steps

On studying the TTPs and IOCs at large, CISA suggested a few mitigation steps that are noted below:

  • Adopt heightened security awareness and vigilance.
  • Establish and keep indent response plans ready.
  • Concentrate on patch and configuration management. Keep all systems and networks updated.
  • Exercise access control. Disable unwanted access, ports, protocols, and services. Minimize the operational landscape.
  • Install network and email traffic monitoring solutions to restrict malicious break-in from these nodes.

Marty Edwards, VP of OT Security, Director of ICS-CERT and Co-Chair of the Control Systems Interagency Working Group, said, “Today’s CISA alert about possible state-sponsored attacks against the country’s most sensitive and valuable critical infrastructure is what the cybersecurity community has been warning about for some time. For years, we have seen steady momentum of new, targeted attacks against the US that seek to compromise the systems we rely on to function as a modern society. With Covid-19, our reliance on critical infrastructure – from railways to energy to agriculture to pharmaceuticals — has gone into hyperdrive. This dependence is extremely lucrative to cybercriminals looking to wreak havoc.”

 

Egregor: A Spin-off of Sekhmet Ransomware

Ransomware attacks, LockBit Ransomware

Researchers from cybersecurity firm Appgate uncovered a new ransomware variant “Egregor” targeting organizations globally to encrypt files that hold sensitive information. The researchers stated that Egregor seems to be derived from the Sekhmet malware family. The threat group uses code obfuscation and packed payloads to escape security detection. The researchers also found Egregor’s news website hosted on the dark web, which is used for leaking stolen data and other malicious activities.

After encrypting sensitive files, the ransomware group asked companies for ransom. Egregor’s ransom note specifically states that if the ransom is not paid by the company within 3 days, and aside from leaking part of the stolen data, they will distribute the files via mass media where the company’s partners and clients will know that the company was attacked. However, if the company agrees to pay the ransom, the hackers provide recommendations for securing the company’s network after decrypting all the files.

“The Egregor payload can only be decrypted if the correct key is provided in the process’ command line, which means that the file cannot be analyzed, either manually or using a sandbox, if the exact same command line that the attackers used to run the ransomware isn’t provided,” Appgate stated.

Egregor’s “hall of shame” lists 13 different companies, including the global logistics company GEFCO, which also fell prey to a cyberattack recently.  

121.4 Mn Ransomware Attacks Recorded in H1 of 2020

A  survey from cybersecurity firm SonicWall revealed that the opportunistic use of COVID-19 pandemic by cybercriminals has resulted in the rise of ransomware and IoT malware attacks globally. The survey “2020 SonicWall Cyber Threat Report” found that ransomware continues to be the most concerning threat to enterprises and the preferred attack method, with 121.4 million attacks (20% increase) reported globally in the first half of 2020. The threat researchers recorded 79.9 million ransomware attacks (109% increase) in the U.S. and 5.9 million ransomware attacks (6% decline) in the U.K.

Only 1 in 4 Organizations Keep Payment Data Secure

Cardholder payment data

Even though COVID-19 has brought its fair share of limelight on cybersecurity, cardholder payment data continues to be far from secure. According to new research by Verizon, only one in four organizations keep cardholder payment data secure. This is even after the fact that cardholder payment data is among the hot favorite for cybercriminals, with 9 out of 10 data breaches being financially motivated. In fact, 99% of security incidents analyzed by the recent 2020 Data Breach Investigation Report were focused on acquiring payment data for criminal use.

The Verizon Business 2020 Payment Security Report pointed out that a lack of long-term payment security strategy and execution is among the key reasons why payment data is handled so precariously. Several companies are struggling to retain qualified CISOs or security managers, and this is another reason for this alarming trend that puts a dent on sustained compliance within the Payment Card Industry Data Security Standard (PCI DSS).

The report highlighted that only 27.9% of global organizations maintained full compliance with PCI DSS. Even here there has been a decline in compliance with a 27.5%-point drop since compliance peaked in 2016.

“Unfortunately, we see many businesses lacking the resources and commitment from senior business leaders to support long-term data security and compliance initiatives. This is unacceptable,” said Sampath Sowmyanarayan, President, Global Enterprise, Verizon Business. “The recent coronavirus pandemic has driven consumers away from the traditional use of cash to contactless methods of payment with payment cards as well as mobile devices. This has generated more electronic payment data and consumers trust businesses to safeguard their information. Payment security has to be seen as an on-going business priority by all companies that handle any payment data, they have a fundamental responsibility to their customers, suppliers and consumers.”

The report also underscored that even security testing has taken a backseat for several companies where just a little over half the surveyed organizations successfully test security systems and processes as well as unmonitored system access. Here, only two-thirds of all businesses track and monitor access to business-critical systems adequately, while only 7 out of 10 financial institutions (70.6%) maintain essential perimeter security controls.

“This report is a welcome wake-up call to organizations that strong leadership is required to address failures to adequately manage payment security,” said Maxine Holt, Senior Research Director at Omdia.

Father of the Internet, Vinton Cerf Calls for Balanced Regulation of the Internet

Internet Regulation, Vinton Cerf, Vice President and Chief Internet Evangelist, Google

Delivering the keynote in the Future Stream at CYBERSEC Global Forum 2020 last week, Vinton Cerf, Vice President and Chief Internet Evangelist, Google, said the Internet impacts many lives and offers several opportunities. It has evolved rapidly and kept up with change. But there is also a dark side to the Internet. He mentioned common threats and spoke about the Internet being misused for cross-border warfare. To curb this, a government can take extreme steps like surveillance, censorship or blocking websites. He called for a balanced response towards protecting citizens from harm through the Internet.

Cerf, popularly known as one of the “Fathers of the Internet,” contributes to global policy development and the continued spread of the Internet. He is the co-designer of the TCP/IP protocols and the architecture of the Internet. Cerf has served in executive positions at MCI, the Corporation for National Research Initiatives and the Defense Advanced Research Projects Agency and on the faculty of Stanford University. He served as chairman of the board of the Internet Corporation for Assigned Names and Numbers (ICANN) from 2000-2007 and has been a Visiting Scientist at the Jet Propulsion Laboratory since 1998. Cerf was also the founding president of the Internet Society (ISOC) from 1992-1995.

AUDIO: Listening time: 11 mins 47 sec

Excerpts from his presentation follow:

QUOTE

It is important for us to remember that the Internet has become a … part of many lives, and it is vital that we keep it open. A place where information can be shared, discovered, and where information can be generated. We are in a situation now, in some parts of the world, where that openness is under some threat. Governments must take a balanced response to the harms affecting its citizens.

One thing for sure is that the Internet has shown a remarkable ability to adapt and evolve to the changing situation of our world — as we depend increasingly on digital technology, the internet has managed to keep up.

But I am sorry to say that this platform, which is so enabling, also enables some fairly bad behaviors. We see misinformation and disinformation, the spread of malware, denial of service attacks, hacking, fraud, bullying, social divisiveness — there are a variety of bad things that happen in the online environment because it is such a powerful tool. And people are going to use those tools to do harm.

On cross-border cyber warfare…

Most governments are concerned about the safety and security of their citizens, and they see this abusive behavior and they feel like they need to respond to it because their citizens are harmed. To make matters worse, harm can come across the country borders. The Internet is insensitive to the boundaries of countries.

An attacker could be in one country and the victim could be in another country. So, we must think how we are going to cooperate across those international boundaries in order to protect our citizens from harm. That’s going to require serious cooperation across international boundaries in order to come up with common norms and practices that will help countries protect their citizens.

Balanced response

I think we need to achieve a balanced response to these harms.

It is possible to go to an extreme and to try to protect people by suppressing the information, by censoring information, by limiting access to various websites. While that makes sense for certain conditions, it certainly should not make sense for every condition.

It is very important to keep the Internet open to allow people to explore its content and to generate/share content they believe is important to other people.

It seems to me that what we seek is attention between protecting people’s safety — using surveillance and other kinds of techniques and protecting their privacy.

In theory, these should not have to conflict. Protecting privacy is important but there are some people who will argue that protection of privacy leads to harm — because some people whose privacy is protected will seek to do harm in a way that is private.

So, we have to find some middle ground where it is possible to give strong protections to people’s privacy while at the same time, figuring out how law enforcement, especially across international boundaries, can be affected while preserving the important freedoms that we find enshrined in the universal declaration of human rights.

UNQUOTE

VMware Adds New Edge to its SASE Capabilities

VMware future ready workforce

Legacy networking and security approaches lack the automation, cloud-scale, and intrinsic security needed to connect and protect apps, data, and users across a globally distributed supply chain. Thus, there is an urgent need for converging cloud networking, cloud security, and zero-trust network access with best in class web security to deliver flexibility, agility, and scalability for enterprises of all sizes. In response to this, VMware announced its Future Ready Workforce solutions that not only provide exceptional workforce experiences and end-to-end Zero Trust security controls but also simplified management.

VMware’s Future Ready Workforce solutions combine its Secure Access Service Edge (SASE), digital workspace, and endpoint security capabilities to help IT teams manage and optimize more secure access to any app, on any cloud, and from any device while providing a simple, high performant, and a safer user experience for the distributed workforce.

SASE: An Emerging Solution for Unified Network and Security in the Cloud

The SASE platform offered by VMware is a cloud-first offering that delivers application quality assurance, intrinsic security, and operational simplicity that is ideal for organizations that are supporting a work from anywhere workforce. At the core, it provides the following features:

  • Comprehensive SD-WAN – VMware has been positioned as a leader in the Gartner 2020 Magic Quadrant for WAN Edge Infrastructure. Its global SD-WAN network has expanded to more than 2,700 cloud service nodes across 130 points of presence (POPs). The new VMware Edge Network Intelligence gives IT teams added visibility and telemetry into the end-user experience as applications are accessed from anywhere, and application traffic traverses many different networks. The Dell EMC SD-WAN Solution powered by VMware now also includes a built-in LTE to support mobile clinics / temporary sites as well as higher reliability for work from home.
  • Zero Trust Network Access (ZTNA) – VMware Secure Access is a ZTNA service that combines VMware Workspace ONE and VMware SD-WAN into a single, cloud-hosted offering that enables more secure, optimized, and high-performance access for remote and mobile users.
  • Cloud & Web Security – VMware is partnering with leading companies to provide customers flexibility and choice in meeting their cloud and web security requirements.
    • The new VMware Cloud Web Security service will integrate Menlo Security’s secure web gateway (SWG), cloud access service broker (CASB), Data Loss Prevention, sandbox, and remote browser isolation capabilities natively into the VMware SASE solution. VMware Cloud Web Security will be offered to businesses of all sizes as a ready to use solution.
    • VMware and Zscaler announced an expanded strategic relationship to enable enterprises to combine VMware SD-WAN and VMware Secure Access with Zscaler Internet Access into a best of breed SASE solution.
  • Integrated Next-Gen Firewall as a Service – The VMware NSX Firewall is a Layer 7 firewall that will be integrated into the VMware SASE Platform for cloud-delivered firewall as a service in both single-tenanted and multi-tenanted deployment options. This will complement the firewall capabilities of the existing VMware SD-WAN solution today.

Rajiv Ramaswami, Chief Operating Officer, Products and Cloud Services, VMware said, “Organizations are navigating one of the most significant disruptions of our generation. These challenges will accelerate a shift to cloud-centric strategies, like SASE, that address the requirements of enabling people to work from anywhere. The VMware Future Ready Workforce solutions help businesses enable their people to work from anywhere with intrinsic security, delightful end-user experiences, and lower operational complexity.”

A Vision for the Future of Work

The pandemic has likely changed the future of work forever. According to VMware research, 42% of global employees surveyed said the ability to work remotely is a prerequisite to their job, not just a perk. 90% said that it is the responsibility of the employer to ensure employees have appropriate access to digital tools to enable remote work. However, enabling a distributed workforce is fraught with challenges ranging from remote employee on-boarding, visibility and compliance, security, employee safety, and more.

To address these challenges, VMware Workspace Security has unified the endpoint management and endpoint security platform enabling its customers the power to leverage the potential of big data and provide comprehensive endpoint visibility as well as actionable insights in conjunction with data-driven prevention technology through a single dashboard. VMware’s new Workspace ONE and Workspace Security offerings are also introduced to better secure work-related devices that are easy to deploy, manage, and scale including:

  • VMware Workspace Security Remote – Combines unified endpoint management (UEM), endpoint security, and remote IT support into an integrated solution. It enables broader compliance and help to operationalize security updates. Workspace Security Remote brings the two teams, technologies, and consoles closer together to enhance overall device health, provide Zero Trust access, and efficiently automate threat response.
  • VMware Workspace Security VDI – This new age solution goes beyond legacy solutions. It integrates Carbon Black technology directly into the VMware vSphere Hypervisor and VMtools to deliver an agentless approach with improved anti-tamper capabilities, audit, and remediation, and uses behavioral detection to protect against ransomware and file-less malware.

VMware Workspace Security Remote and VMware Workspace Security VDI have already been made available. However, VMware Edge Network Intelligence is expected to be available latest by October 30, 2020. VMware Cloud Web Security is expected to be available in VMware’s Fiscal Q1 FY22, and NSX Firewall as a Service for the VMware SASE Platform is expected to be available in FY22.

Small Businesses are Not Prepared for Evolving Cyberthreats: Report

CISO, Cybersecurity

A survey from the Nationwide Agent Authority, a provider of diversified insurance and financial services, revealed that most of the businesses and consumers in the U.S. are not prepared to defend against evolving cyberthreats. The survey uncovered four scenarios in particular, these include:

1. Small Businesses are Underprepared

Nearly 50% of cyberattacks are aimed at small businesses, but only 37% of small business owners reported believing they are at risk to fall victim to a cyberattack. About one-third of businesses said they are not confident they could recover if their business was attacked.

While 50% of small business owners believe they are prepared to handle a cyberattack, only 39% of independent agents believe that their customers are prepared to prevent one. Only 17% of small business owners say they have cyber liability insurance, and half (53%) say they do not offer cybersecurity training to their employees. Eight in 10 agents admitted that most of their clients are unsure of how they are exposed to cybersecurity risks and they do not know what is covered in a cyber insurance policy.

2. Middle Market Businesses have Better Cyber Footing

According to the survey, the middle market businesses have a greater awareness and are more prepared for cyberattacks compared to small businesses. Though 70% of middle market business owners are concerned about cyber risks, over 79% said they are confident and well prepared to address cyberattacks.

“This confidence may be warranted as they are more likely than small business owners to have taken key security precautions, including purchasing cybersecurity insurance (71%). They also appreciate the support they are receiving from agents, with 70% indicating they trust their agent to provide insurance council on cyberthreats,” the survey stated.

3. Consumers Underrate their Cyber Risk Exposure

The survey found that consumers have limited knowledge of cyberthreats. Around 40% of consumers stated that they have never been a victim of any kind of cyberattacks. It is also observed that consumers are unaware of what it takes to recover from an attack, with just 51% believing they could recover. Four in 10 do not know how much it would cost to recover from a cyberattack. Only 62% reported being knowledgeable about ID theft, 56% stated they know about malware, and only 57% know about phishing attacks. While 32% said they feel prepared to protect themselves from evolving threats, only 13% of consumers indicate that they are cyber insured.

4. Cyber Insurers Help Clients with Evolving Cyberthreats

The survey stated that insurance agents can make their clients aware of evolving cyber risks, with 52% of agents surveyed said they discuss cybersecurity threats with their customers often. Over 50% of agents said they are familiar with emerging cyberthreats, including 58% – IoT security breaches, 58% – Mobile point of sale malware, 53% – Denial of Service (DoS) attacks, and 47% – Deep fake attacks.

“It is encouraging that middle-market business owners appear to be more attune to risks and are proactively preparing their defense. But regardless of the type of client, now is an important time for insurance agents to talk to their customers about cybersecurity solutions and best practices,” said Catherine Rudow, Vice President of Cyber Insurance for Nationwide.

“From an IAM perspective, human and device identities are treated equally”

Amruta Gawde_interview

From dispersing office spaces to remote working, COVID-19 forced organizations to have a holistic approach to cybersecurity. Business continuity transformed overnight to navigate through the pandemic. The industry also experienced a paradigm shift in embracing human error, addressing cyberthreats, and securing data.

In a digitally enabled economy, Identity and Access Management plays a critical role in the security and resiliency of an enterprise. Hence, IAM and data security are inseparably linked. IAM empowers its users to self-authenticate, thereby reducing time-consuming tasks such as help-desk tickets and password resets.

To dive deeper into how IAM systems enhance productivity in today’s cut-throat business world, Pooja Tikekar, Feature Writer at CISO MAG, engaged in a conversation with Amruta Gawde, Practices Program Manager – IAM, Simeio Solutions.

Amruta has around 14 years of experience in Information Security, with 12 of those in IAM domain, spanning across organizations like Vaau, Sun Microsystems, PwC and Simeio Solutions. While in Simeio, Amruta has worn multiple hats on the delivery side from techno-functional to customer engagement. Backed by her extensive customer-facing experience, she took the responsibility of heading the IAM practices for Simeio to build Simeio’s Center of Excellence. Her program combines technical innovation with IAM thought leadership to build innovative solutions.

Edited excerpts of the interview follow:

2020 is an alarming year for data security. Exposure of PII is at an all-time high. Although two-factor or multi-factor authentication is a standard remedy, how does Identity and Access Management (IAM) help in safeguarding digital identities compared to the traditional security practices?

Traditional security practices either focus on perimeter protection (assuming all the threats are external) or on the post-breach detective approach.

While this is obviously an important aspect of security, a significant percentage of breaches are a result of privileged/administrative access being abused by staff either inadvertently or intentionally. In addition to two-factor or multi-factor authentication (which falls under the gamut of IAM),  IAM focuses on building a strong framework of access control and access enforcement for ensuring the “Least Privilege” security principal – Provide minimum required access. As a result, you cannot employ the privileges that you do not have. Additionally, every access provided and subsequently utilized, has supported the audit trail, which helps in compliance.

COVID-19 and the dispersed work from home format has intensified security risks. What is the role of IAM in securing enterprise networks in decentralized environments?

The need for ‘Any Time Any Where Any Device Any Content’ (ATAWADAC) services have significantly increased. Thanks to this new era of remote working and decentralized environments, IAM which was always relevant to any organization’s security strategy, has gained a lot more traction.

An IAM solution provides a centralized platform for automated provisioning and de-provisioning of required privileges to vendors, employees, partners, and mobile or IoT devices alike.

IAM solutions also have analytical intelligence to add contextual references during authentication and authorizations. For example, if an employee usually logs in between 9-5, any logins outside of those hours would require additional authentication. Static administrative privileges and shared admin credentials, that can be stolen, are a history with just-in-time privilege escalation using advanced privileged access management solutions.

As technology evolves, so does Identity and Access Management. How are IAM systems evolving to get better at authenticating users, apps, and devices to enhance security posture?

The IAM space has been constantly evolving. Recently introduced GDPR regulations require privacy protection and consent management in consumer transactions. IAM solutions provide fine-grained authorization and consent management during logins and data access as a result. Increased WFH has increased the need for ATAWADAC and secure remote access. Striking the right balance of security and user experience gave rise to zero trust (don’t trust, authenticate every time) and a need to go passwordless, which are the latest trends in IAM. Increase in the IoT devices has resulted in adaptive/contextual authentication and artificial intelligence in IAM solutions. Analytical intelligence/threat analytics are commonplace. The need for self-sovereign identity (user-created and controlled identity) has caused significant advancement in IAM solutions as well. We are also seeing one major change that is – the traditional IAM solutions were administrator friendly – complex to configure and use, and centrally managed. The modern IAM solutions are business-friendly, keeping the synergy between business, security, compliance, and user-friendliness a priority over customizations and technical complexities.

It is said that single sign-on (SSO) requires a focus on the safety of user credentials, and hence deemed critical. How does SSO authenticate third-party applications or websites? Is it practical?

Single sign-on is definitely practical given that most organizations leverage third-party cloud applications to better help deliver products and services to their customers.

Given the increase in complex eco-systems that contain multiple applications, IAM solutions inherently provide the capability of SSO.

This provides the ability to access both internal and third-party cloud application using a single ID, such as an Enterprise ID or a Social ID (Facebook or Google)

The Trust establishment with third-party applications is achieved through a concept of federation, which is like a digital third-party agreement between the identity provider (IAM solution) and the service provider (third-party applications).

Another relatable scenario that you would have witnessed is sometimes when you play a quiz online, in the end, it asks your permission to post the results to your Facebook page. In this case, the quiz app wants access to your Facebook profile. As a user, you do not want your Facebook account to share your credentials with this third-party, while allowing this temporary access. Also, you want to select what data should be exchanged. This is all achieved in the backend through IAM.

The Internet of Things (IoT) landscape is experiencing a paradigm shift. Businesses are now concerned with managing multiple “things” connected to their network. How does IAM provide security against IoT devices that are trying to access the network?

From the ­­­IAM perspective – human and device identities are treated equally. As we saw earlier, ATAWADAC is the need of the hour. Just like a human identity, every IoT device needs to authenticate itself and it is only allowed to access, what it is authorized to access within the given context. It needs to establish trust with third-party applications, all its transactions are audited, and so on.

Additionally, advanced API security and end-point privilege management devices ensure that the access is secure.

Tell us a bit about Cloud IAM and its role in cloud security. How can it help prevent data breaches and possible financial losses?

Cloud IAM, like other cloud services, are IAM solutions offered as-a-service. Customers do not need to pay for licenses, infrastructure, upgrades of the IAM platform. It is completely built, managed (availability, auto-scaling based on load, performance, etc.), run, and maintained for you. Cloud IAM allows you to unbundle the services and choose what you want to use, you pay for what you use. The accountability of data security is outsourced to the IAM service providers. It also gives you the flexibility to change the IAM service provider should you wish to do so. It integrates with native cloud platforms for key security features such as API security and provides identity management for the users of the cloud platform itself.

Choosing an IAM solution can be a daunting task, especially in these testing times. What primary factors determine an accurate IAM framework and what are its compliance requirements? Is it cost-effective for consumers and businesses alike?

I would recommend finding an IAM consultation partner who would help you define the IAM roadmap and help you determine what solution would work for your requirements.

An IAM solution covers multiple areas such as governance, identity management, authentication, authorization, SSO, privileged identity management, threat analytics, and intelligence under the IAM umbrella, which address a variety of business problems.

Pretty much all IAM partners offer you most of the functionalities with cost variation. The consumer-only products are light and may cost lesser. However, if you are looking to address different types of users including employees, B2B partners and consumers, enterprise IAM solutions are a better fit.

While some organizations do build their own IAM solutions, this is not recommended.

The key is to identify and prioritize business problems/objectives with respect to audit & compliance, security, operations simplification, risk management, cost-saving, digital transformation, number and types of assets, and types of identities.

There are multiple research firms such as Gartner, Forrester, KuppingerCole that publish market trends, and leading vendors analysis periodically.

Technology selection alone is not sufficient. It is important to align processes supporting your IAM roadmap and an adoption and maintenance plan. Outsourcing to professionals for implementation of IAM solution or opting for cloud IAM or Identity-as-a-Service (IDaaS) platforms is a better way to ensure that you are realizing maximum value out of your investment.

In fact, a customer-owned IAM solution requires significant investment in infrastructure and license costs during implementation and/or maintenance alike. Whereas, IDaaS platforms ensure that the customer does not have to bear the cost of infrastructure, licensing, upgrade, maintenance and you can switch shop without a second thought.

What is the IAM strategy of Simeio in a post-pandemic world?

Simeio has always been customer-centric and IAM focused. The pandemic has triggered significant digital transformation. Everything has gone online, from shopping to government services to doctor’s consultations, and you no longer require physical presence and access. As a result, the importance of secure virtual presence and verification of digital identity has increased exponentially. IAM has hence become the need of the hour. We have supported multiple of our customers through this digital transformation and their key security challenges. Our only target has been to make this transition to the secure digital world as smooth, secure, and fast as possible. We are focusing on combining our years of experience in this space, to enable customers to realize quick ROI through ready-to-consume, business-friendly, secure, feature-rich, modern Identity-as-a-service solutions.

About the Author

Pooja Tikekar is a Feature Writer, and part of the editorial team at CISO MAG. She writes news and feature stories on cybersecurity trends.

More from the author.

 

1...160161162...410Page 161 of 410