Home Blog Page 172

CIPL and DSCI Stress on Enabling Cross-border Data Transfers Between India and U.S.

American Cybersecurity Literacy Act

The Data Security Council of India (DSCI) and the Centre for Information Policy Research (CIPL) have jointly released a report on enabling responsible cross-border data transfers between India and the U.S. with regard to India’s proposed Personal Data Protection (PDP) Bill. The report, “Enabling Accountable Data Transfers from India to the United States,” is intended to inform the Joint Parliamentary Committee’s review of the PDP Bill and Indian Government officials working on a potential future trade deal with the U.S. It also highlights the importance of accountable data processing mechanisms to govern data flows between the countries.

The Report Aims to:

  • Outline relevant provisions of the PDP Bill in Chapter VII (Restriction on Transfer of Personal Data Outside India) and section 50 on Codes of Practice that apply to transfers of data from India to the U.S.
  • Evaluate the PDP Bill’s transfer provisions in light of established mechanisms for cross-border data transfers in other global data protection regimes
  • Consider available options to govern India-U.S. data flows

According to the DSCI, the report suggested two practical options to enable data flows between India and the U.S. in line with the PDP Bill. These include:

Certifications and Codes of Practice: India can enable data flows to the U.S. by including certifications and codes of practice as data transfer mechanisms in the PDP Bill, which could become interoperable with other certification schemes and codes, including the APEC Cross-Border Privacy Rules (“CBPR”) and EU GDPR certifications and codes of conduct.

Adequacy Finding: India could facilitate transfers to the U.S. through the PDP Bill’s existing provision authorizing adequacy findings for data transfer purposes. Tools to facilitate such a finding could include an India-U.S. trade agreement specifying a commitment to recognize or elaborate upon relevant transfer mechanisms coupled with a formally binding cooperation agreement or MOU between the Indian Development Partnership Agreement (DPA) and the U.S. Federal Trade Commission (FTC).

The report was launched after a virtual roundtable discussion between the government officials of both the countries including Dr. Rajendra Kumar, Additional Secretary, Ministry of Electronics and Information Technology; Betsy Border, Counsel for International Consumer Protection, U.S. Federal Trade Commission; and James Sullivan, Deputy Assistant Secretary for Services Industry and Analysis U.S. Department of Commerce.

Rama Vedashree, CEO, DSCI, said, “Given the importance of U.S. geography for India’s tech industry, which is estimated to touch close to $100 billion this year,  DSCI and CIPL have undertaken the development of this report to propose potential mechanisms to facilitate data flows between the two countries; it also analyses potential challenges in transferring data outside of India under the context of the PDP bill 2019. We hope the report recommendations inform the privacy discourse in India, and the concerned stakeholders, especially the Joint Parliamentary Committee, in its deliberations, and also MeitY and Ministry of Commerce as they work towards growing India’s digital economy and the tech sector.”

Markus Heyder, Vice President and Senior Policy Counselor, CIPL, said, “In finalizing the PDP bill, India has a real chance to shape the data flow landscape it wants to participate in for the coming years. To ensure continued and responsible flow of data between both India and the U.S., India should seek to enable certifications and codes of practice that can be made interoperable with other global accountability and transfer schemes. India should also think about making an adequacy finding for CBPR certified entities, whether that is via an India-U.S. trade agreement or other means. By addressing these issues, the joint Parliamentary Committee will prevent unnecessary barriers to data transfers for the Indian economy while ensuring effective data protection for its citizens.”

Given India’s growing IT capabilities, digital exports represent a major export sector for the country. Cross-border data transfer is of critical value as India looks forward to updating its data privacy policy.

Do More with Less! SMBs Proactively Address Cybersecurity Challenges

Cybersecurity Investment Estimated to Grow up to 6% in 2020

Small to medium-sized businesses (SMBs) are procuring security tools to prevent cyberattacks with limited cybersecurity budgets and resources. According to the “SMB IT Security Report”  from Untangle, a provider of comprehensive network security for SMBs and distributed enterprises, SMBs are continuing to do more with less, with 38% of SMBs allocating $1,000 or less to their IT security budget, in comparison to 29% in 2019 and 27% in 2018. The report also revealed that 78% of SMB employees are working remotely, with an estimated 56% suggesting some positions will be permanently remote going forward.

“SMBs are proactively putting tools in place to combat attacks and limit their vulnerabilities even though they continue grappling with limited security budgets and resource constraints. However, dealing with these challenges during a work-from-home shift has created gaping vulnerabilities within an organization’s networks and adds another challenge to an already overburdened IT department,” the report stated.

Key Findings

  • Nearly 32% of SMBs identify budget as their greatest barrier, followed by employees who do not follow IT security guidelines (24%) and limited time to research and understand emerging threats (13%)
  • SMBs rank firewalls (82%), antivirus protection (57%), endpoint security (48%), archiving management and backup and VPN technologies, (47%), and Web filtering (40%) as the most important features when considering which IT security solutions to purchase
  • While SMBs have adopted a hybrid on-premises/cloud-based IT infrastructure for business applications, with a small percentage increase of cloud deployments compared to last year, most SMB’s (71%) have their firewall on site rather than in the cloud
  • Around 45% indicated that they have adjusted or reevaluated their IT security roadmap based on recent security breaches and ransomware attacks
  • Of those SMBs surveyed and who experienced a data breach within the last 12 months, 15% were able to stop the attack or any unauthorized access before sensitive data was extracted.

Scott Devens, CEO at Untangle, said, “As the abnormal becomes our new normal, SMBs need to approach remote work by using a combination of cloud-based applications and on-premises solutions to keep employees and systems safe, and ensure business continuity. SMBs should be looking for technologies that incorporate multi-layered network security tools and a hybrid network infrastructure, such as SD-WAN, to avoid large-scale network vulnerabilities, regardless of budget and resource size.”

1 in 3 SMBs Rely on Free Cybersecurity Tools

A similar research from BullGuard revealed that one in three small businesses with 50 or fewer employees rely on free or consumer-grade cybersecurity tools. The research also pointed out that one in five companies do not use any endpoint security whatsoever. The research, which surveyed small businesses in the U.K. and the U.S., suggested that nearly 43% SMB owners are not prepared for a potential cyberattack or breach leaving their most sensitive financial, customer, and business data at risk.

Imposter Scams Continue to be a Growing Concern for Senior Citizens: DoJ

Senior citizens data

The U.S. Department of Justice (DoJ) issued a fraud alert asking people to be vigilant when providing any sensitive information over the phone. The agency stated that cybercriminals are falsely representing themselves as DOJ authorities to obtain personal information from the call recipients as part of an imposter scam. The warning came after the Office of Justice Programs’ Office for Victims of Crime (OVC) received multiple complaints from individuals stating that they have received calls from unknown parties claiming to be from the DoJ.

Fake DoJ Investigators

According to the National Elder Fraud Hotline, scammers are calling elderly citizens to obtain personal details or leaving a voicemail with a return phone number, which directs them to a recorded menu and then to an operator claiming to be a DoJ’s investigator. The investigator further tries to trick the users into giving away their personal details. The National Elder Fraud Hotline is a resource created by OVC for people to report fraud.

OVC Director Jessica Hart, said, “Phone scams are an ugly and pervasive act of victimization. The scams being reported to our National Elder Fraud Hotline are especially heinous because they show the perpetrators are preying upon one of the most vulnerable segments of our society – the elderly. As if this were not despicable enough, the scammers do so pose as employees of the Justice Department, usurping public trust in the agency that serves as a bastion of fairness and lawfulness while these scams exploit the elderly for financial gain. The first step to identifying these criminals is to have their crimes reported.”

Cybercrimes Targeting Older Adults

Recently, the FBI warned users to be vigilant about online romance scams, in which cybercriminals exploit people looking for romantic partners on dating websites, apps, or social media networks. The agency noticed that the majority of the victims of romance frauds were single adults over the age of 55 in Utah, Idaho, and Montana. The FBI’s Internet Crime Complaint Center (IC3) stated that confidence frauds incurred huge financial losses to victims when compared to other cybercrimes. The IC3 received nearly 100 complaints from victims reporting more than $1 million in losses to romance scams in Idaho last year. Nearly 20,000 complaints related to romance scams were reported to IC3, with losses of more than $475 million.

Microsoft Fixes 129 Vulnerabilities in its September Patch Tuesday

Brand Phishing Attacks

Microsoft’s September Patch Tuesday saw the technology giant releasing updates to address 129 vulnerabilities: 23 of which were deemed critical, 105 were important, and the rest were moderate in severity. The latest Patch Tuesday addressed vulnerabilities in Microsoft Windows, the Edge browser, ChakraCore, Internet Explorer, SQL Server, Office and Office Services and Web Apps, Microsoft Dynamics, Visual Studio, Exchange Server, ASP.NET, OneDrive, and Azure DevOps.

The most critical ones identified in the Patch Tuesday include:

  • SharePoint (CVE-2020-1200, CVE-2020-1210, CVE-2020-1452, CVE-2020-1453, CVE-2020-1576, CVE-2020-1595)
  • SharePoint Server (CVE-2020-1460)
  • Graphics Device Interface (CVE-2020-1285)
  • Dynamics 365 systems (CVE-2020-16857, CVE-2020-16862)
  • Media Audio Decoder (CVE-2020-1593, CVE-2020-1508)
  • COM for Windows (CVE-2020-0922)
  • Text Service Module (CVE-2020-0908)
  • Codecs Library (CVE-2020-1319, CVE-2020-1129)
  • Camera Codec Pack (CVE-2020-0997)
  • Visual Studio (CVE-2020-16874)

Among the vulnerabilities were a crop of RCEs in Microsoft Office products, which particularly concerns students and teachers during the time of COVID-19 and e-learning. “Some of the most severe vulnerabilities in this month’s release include a pair of remote code execution flaws in Microsoft SharePoint and a critical vulnerability in Microsoft Exchange Server. CVE-2020-1210 is a vulnerability in SharePoint due to a failure to check an application package’s source markup. To exploit this flaw, an attacker would need to be able to upload a SharePoint application package to a vulnerable SharePoint site. This vulnerability is reminiscent of a similar SharePoint remote code execution flaw, CVE-2019-0604, that has been exploited in the wild by threat actors since at least April 2019,” stated Satnam Narang, Staff Research Engineer at Tenable, in a recent release to CISO MAG.

He added, “CVE-2020-1576 is another SharePoint flaw patched this month that’s also similar to CVE-2020-1210.CVE-2020-16875 is a memory corruption vulnerability in Microsoft Exchange Server due to improper handling of objects in memory. Exploitation of this flaw would simply require an attacker to send a malicious email containing the exploit code to a vulnerable Exchange server. This vulnerability would allow the attacker to run arbitrary code, which could grant them access to create new accounts, access, modify or remove data, and install programs.”

System administrators are advised to review the threat posed by RCE vulnerabilities as they could be exploited on Windows or SharePoint to corrupt or erase system data.

NetWalker Ransomware Gang Holds Argentina’s Immigration Agency at Ransom

covid-19 malware ransomware, netwalker ransomware

Argentina’s immigration agency, Dirección Nacional de Migraciones (DNM), suspended operations for over four hours after its systems were attacked by NetWalker ransomware. In order to free up the affected computers, the operators demanded $4 million worth Bitcoins in ransom. As per a local media report from Infobae, the government authorities said that they “will not negotiate with the hackers and neither are they too concerned with getting that (compromised) data back.”

 Key Highlights 

  • Hackers attacked Argentina’s immigration agency, Dirección Nacional de Migraciones (DNM) in the last week of August.
  • The immigration offices and control posts throughout the country had to be pulled offline for nearly four hours.
  • The SICaM system (Integrated Migration Capture System) used to track international crossings was heavily affected.

In the early hours of August 27, 2020, the DNM’s tech support started receiving multiple calls from various offices stating they were not able to access their Microsoft suite-based files (eg. Word, Excel). On closer inspection, the support team found that their computer systems, including Microsoft applications and shared folders, were hit by a computer virus, which incapacitated their operations. The IT team promptly took precautionary measures to contain the spread by shutting down their central server, which led to the four hours long service outage.

A Million Dollar Ransom Demand

According to the information shared by Bleeping Computers, NetWalker ransomware gang first demanded a ransom of $2 million in exchange of the decryption key. However, with no response from the government authorities, the gang decided to tighten the screws by increasing their ransom demand to 355 Bitcoins (accounting to nearly US$4 million) and releasing a sample of the leaked and encrypted data on the Tor site hosted by the cybercriminals.

Argentina: A Ransomware Hot Bed?

On July 18, 2020, an Argentine telecommunication services provider, Telecom Argentina, reportedly fell prey to a ransomware attack. The effects of the attack were first noticed when the Telecom’s employees started facing issues and lag in their systems while accessing the company’s VPN (virtual private network). The internal security systems instantly set-off the alarms but not before the ransomware was installed in over 18,000 workstations. According to reports and screenshots shared over Twitter, the ransomware gang demanded a ransom worth $7.5 million in Monero (XMR) cryptocurrency. Looking at the similarities in the modus operandi, some of the experts believe that the two attacks could have common perpetrators, although it is just an assumption.

Palo Alto Networks Partners with Net Friends to Boost Security Platforms

Cybersecurity firm Palo Alto Networks is partnering with managed IT services provider Net Friends to deliver exclusive access to its enterprise-grade product suite for businesses of all sizes.

Palo Alto Networks covers several segments like firewalls, cloud-monitoring and compliance, endpoint protection, and threat detection services. Based in North Carolina, Net Friends provides comprehensive managed IT services, IT security and strategy solutions to organizations.

Net Friends has built its managed service offerings around Palo Alto’s network security tools, including their firewalls and extended detection and response platform (Cortex XDR). The latest partnership allows Net Friends to deliver access to Palo Alto’s Advanced Threat Protection and DNS Security firewall subscriptions, Endpoint Protection products, and Cloud Application Security (Prisma) services.

John Snyder, President and CEO of Net Friends, said, “Net Friends first purchased six Palo Alto firewalls to protect our data centers and offices back in 2013, and we have been observing how they have stayed miles ahead of every other firewall or endpoint protection vendor in the market by prioritizing investments in security features. We have uncovered so many solutions we can bring to our customers.”

Recently, Palo Alto Networks also entered into an acquisition agreement with risk management and digital forensics consulting firm Crypsis Group in a proposed deal of $265 million. The acquisition strengthens Palo Alto’s security platform Cortex XDR by combining with Crypsis Group’s security consulting and forensics capabilities and enables in collecting rich security telemetry, manage breaches, and initiate rapid response actions. Palo Alto is also planning to integrate Crypsis Group’s processes and technology into Cortex XDR to further enhance its ability to safeguard organizations at every stage of the security lifecycle.

China Unwraps its Global Data Security Initiative

global data security initiative

In the recent past, China has been heavily scrutinized by countries like the U.S., India, and Australia for waging a cyberwar against their public, private, and critical infrastructure. The U.S. first cornered China with the Huawei cyber espionage claims and later with the TikTok data exfiltration accusation. Amidst all these accusations and allegations, Beijing has maintained that it has not crossed any lines of data sovereignty and shall continue to do so. Reassuring these words, Chinese Foreign Minister, Wang Yi, has unveiled China’s initiative that will set global standards on data security.

Wang Yi was addressing a global digital governance seminar in Beijing on September 8, 2020, where he introduced this initiative in a bid to bring all nations on the same page. He made his intentions clear as to what the initiative must include by talking about how technology firms must avoid creation of backdoors in their products and services that could allow data to be exfiltrated illegally. Wang Yi also urged the participants to respect the sovereignty, jurisdiction, and data management rights of other countries.

Wang Yi said, “Global data security rules that reflect the wishes of all countries and respect the interests of all parties should be reached on the basis of universal participation by all parties.” Taking an indirect jibe at the countries pointing fingers at it, he also added, “Some individual countries are aggressively pursuing unilateralism, throwing dirty water on other countries under the pretext of ‘cleanliness’, and conducting global hunts on leading companies of other countries under the pretext of security. This is naked bullying and should be opposed and rejected.”

The Need for a Global Data Security Regulatory Body

In a recent exclusive interview with Nikhil Korgaonkar, Regional Director, Arcserve India & SAARC, we asked him how multiple region-specific regulatory bodies restrict the growth of businesses and if there really is a need for a single data protection and privacy body. Korgaonkar said, “Businesses are reeling under the challenge of what we call compliance fatigue. GDPR in Europe; HIPAA, SOX, and FACTA in the U.S.; the California Consumer Protection Act, which came into force earlier this year; LGPD in Brazil; there is a multitude of compliance regulations that businesses face today. According to an estimate, CISOs spend 30% of their time dealing with compliance issues, an indication of how much productive mind space is being consumed by the fragmented regulatory landscape. There is certainly a need for a universal regulatory body and policy relating to data protection and privacy.

For that to happen, however, all the countries will need to come up with the same level of data security preparedness and understanding. It will have to be a symphony where each player plays their part to bring out a well-coordinated piece, which is music to everyone’s ears.”

New “Baka” Skimmer Designed to Evade Detection: Visa

one million card data exposed

Payment cards provider Visa has warned its users about a new credit card skimming malware dubbed “Baka” that can evade traditional detection methods. The skimmer was discovered by Visa’s Payment Fraud Disruption (PFD) division while analyzing a command and control (C2) server, which also found seven C2 servers hosting the Baka skimming kit.

Baka: The Unique Skimmer

Along with the basic features offered by various skimming kits, the Baka skimmer has certain advanced capabilities that helps it bypass security scanners. In addition, the skimmer can erase itself from the victim’s device’s memory after exfiltrating data.

“The most compelling components of this kit are the unique loader and obfuscation method. The skimmer loads dynamically to avoid static malware scanners and uses unique encryption parameters for each victim to obfuscate the malicious code. PFD assesses that this skimmer variant avoids detection and analysis by removing itself from memory when it detects the possibility of dynamic analysis with Developer Tools or when data has been successfully exfiltrated,” Visa said.

Indicators of Compromise

Visa observed the following seven domains hosting the Baka skimming kit:

Domain Names jquery-cycle[.]com

b-metric[.]com

apienclave[.]com

quicdn[.]com

apisquere[.]com

ordercheck[.]online

pridecdn[.]com

According to Visa’s PFD division, the skimmer performs five operations after it is injected.

  1. Generate a decryption function to decrypt the list of fields from which the skimmer will steal data.
  2. Skim the targeted fields every 100 milliseconds. When the attacker generates the skimming script for a victim, they specify which fields are targeted.
  3. Check if the skimmer found data every 100 milliseconds. This function then calls for data exfiltration and sets a flag called “this.load” indicating the skimmer successfully exfiltrated data.
  4. Check if the script should send data to the exfiltration gateway every 3 seconds. If the captured data flag is set, the exfiltration gateway URL is decrypted using the current victim merchant’s domain name as the key. The script then encodes the skimmed data into the GET parameters of the exfiltration URL.
  5. The last operation that is scheduled is a clean-up function. If data is exfiltrated, the clean-up function removes the entire skimming code from memory to avoid detection.

Mitigation Measures

  • Institute recurring checks in eCommerce environments for communications with the C2s.
  • Ensure familiarity and vigilance with code integrated into eCommerce environments via service providers.
  • Closely vet utilized Content Delivery Networks (CDN) and other third-party resources.
  • Regularly scan and test eCommerce sites for vulnerabilities or malware.
  • Regularly ensure shopping cart, other services, and all software are upgraded or patched to the latest versions to keep attackers out. Set up a Web Application Firewall to block suspicious and malicious requests from reaching the website.
  • Limit access to the administrative portal and accounts to those who need them
  • Require strong administrative passwords (use a password manager for best results) and enable two-factor authentication.
  • Consider using a fully hosted checkout solution where customers enter their payment details on another webpage hosted by that checkout solution, separate from the merchant’s site. This is the most secure way to protect the merchant and their customers from eCommerce skimming malware.

“Attackers are looking to break into your organization either by a broken VPN or RDP protocols”

It’s not every day that one gets to meet an influential person from the world of cybersecurity. CISO MAG caught up with Yotam Gutman, Marketing Director at SentinelOne. He once served as Lt. Commander in the Israel Navy. He was chosen as one of the top 5 Security Influencers to Follow on LinkedIn.

Lt. Commander (Ret.) Israel Navy, Gutman has filled several operational, technical, and business positions at defense, HLS, Intelligence, and cybersecurity companies, and provided consulting services for numerous others. He joined SentinelOne 8 months ago to oversee local marketing activities in Israel and contribute to the global content marketing team. Gutman founded and managed the Cybersecurity Marketing Professionals Community, which includes over 300 marketing professionals from more than 170 cyber companies.

In a Zoom call with Brian Pereira, Principal Editor, CISO MAG, Gutman tells us about his journey from the Israeli Navy to Homeland Security and then to a cybersecurity startup ecosystem in Israel, finally becoming the Marketing Director at SentinelOne. He also discusses how SentinelOne grew from a startup to a global organization in less than a decade.

Edited excerpts from the interview follow:

You served the Israeli Navy but how did you get into cybersecurity? What are your core interests in this field?

My route into cybersecurity was a peculiar one. Like most Israelis, I served in the armed forces, specifically in the Israeli Navy, where I was an officer for six and a half years, starting with serving on missile ships.  Later, I served as an instructor at the naval academy. On completion of service, I started working with Israeli defense companies, which worked extensively with India. After that, I moved to Homeland Security, and you will recall the terrorist attacks in Mumbai, around 2008. Israeli companies work with governments and organizations all over the world to improve their internal security, smart cities, and border security. Four years later, I saw that form of terrorism is starting to decline and that there is an emerging field called cybersecurity.

In 2010, there was a cyberattack on Iran’s nuclear facility (Stuxnet), and that incident highlighted the need to secure not just the IT infrastructure and the data that resides within but also the physical infrastructure.

Pursuing the current opportunities, I have worked with Israeli startups–there are 350 cybersecurity startups in Israel that are divided into roughly 150 cybersecurity product categories, collectively. My niche within that was to take my previous experience, product skills, pre-sale skills, marketing skills, and help those companies with their product offerings. And for the past six years, I moved between companies until I found my current position.

During this time, I met hundreds of local marketers and professionals and there was much sharing in communities, and we also established a community of like-minded professionals to share information about cybersecurity and marketing. Currently, this community has 350 members from all the major cybersecurity companies in Israel.

Can you tell us the story of SentinelOne and how it scaled up so quickly? How did you land up at SentinelOne? What are you involved in these days?

SentinelOne was established more than seven years ago and it was just like any other startup. People (in the company) knew one another from the military service and they came up with an idea to improve endpoint security. SentinelOne grew very rapidly and most of the company is now located overseas. The HQ is in the U.S. and they now have a large presence in the EU. We just established the first Asia Pacific HQ in Singapore. So, it has grown very quickly, and we now have 500 employees and many customers.

I got into it through one of the people in the community, who is also an ex-Israeli Navy. He suggested that I help them boost their marketing efforts on the local front. SentinelOne has been investing in brand awareness and brand recognition globally, especially in the North American market. And in the local market, it never got sufficient attention. But when it got to a point where we needed to recruit about 100 people each year, the lack of public awareness became a challenge.

I joined about a year ago. I began as a consultant and then I saw it as a good fit, and later joined full time, last January.

On the local front, I am helping with recruitment marketing, and we look for the top talent in cybersecurity and technology, in general. I’m also part of the global marketing team made up of content marketers, product marketers, people who are tech-savvy — and we create content that generates leads. We publish that content in many channels.

As an outsider, I was impressed with SentinelOne as it achieved something very few companies in the world, especially here in Israel, are able to do on that scale. Last year we did a business of $100 mn globally and this year we hope to increase that.

Even the pandemic has not made a dent in our sales. So, I am envisioning great things for this company.

How did you help customers when the pandemic was announced in March?

When this happened, we were among the first to inform customers about the risks of working from home. We conducted a webinar in early March to inform them. We also reached out to our existing customers and offered to extend the number of licenses. Since they were sending workers home, they would be looking to buy new licenses. That’s not something they were expecting. That’s not something that was budgeted. We offered that to them for a period of 90 days and this was also available to new customers.

We then started monitoring the threat intelligence landscape, and we have a blog with COVID-related threats. We advise people about IOCs (Indicators of Compromise) and compromised IP addresses.  We also beefed up our support and conduct surveys to measure their level of satisfaction.

How has the SentinelOne product evolved to help remote workers in a decentralized environment? Can it stop ransomware?

The product was initially built as an on-prem solution. We observe that people who work from remote locations connect and then they disconnect and go to a coffee shop and continue working. So, our product can work even in a non-connected environment when you are not connected to the cloud, or where there is no Wi-Fi connection. Our product will still secure you in a robust manner.

We invest in the autonomy of the product. We also invest in the ability to perform a roll-back, specifically for ransomware attacks. Sometimes our systems are able to stop these attacks. So, this is behavioral-based. If it is not a known threat, we will pick it up, but sometimes we could be late by a few seconds. That’s why we make sure that the product allows one to roll back and decrypt some of the files. We were also able to detect new forms of ransomware, create a decryptor, and publish it online for anyone to access.

To counter this, we identify a new device on the network and fingerprint it, and we compare it to other devices in the network. Let’s say it is a security camera. If it starts behaving differently from other cameras, we can then block it through the firewall and prevent it from accessing the external world. So, we can restrict its behavior in a cyberattack.

This is an ongoing battle. We have to keep learning what the attackers are doing and keep training our algorithm to respond to the threat.

Read a longer version of this interview in the October 2020 issue of CISO MAG. Subscribe here.

Hackers Shifting Focus from Enterprises Toward High-Value Individuals

CISO MAG Panel Discussion

For a legion of cybersecurity experts plugged from across the globe, CISO MAG and CYFIRMA recently hosted a panel discussion on “The State of Cybersecurity: Why do Breaches Continue to be Unabated.” The discussion was moderated by Jyoti Punjabi, Deputy Business Head, CISO MAG, and the panel had Kumar Ritesh, Founder and CEO, CYFIRMA; Lim Shih Hsien, Chief Security Officer, SP Group; LOI Liang Yang, ASEAN Security Software Segment Leader, IBM; and Chris Roberts, Researcher, Hacker, CISO. in participation. The discussion took a virtual format to create awareness on the need for cybersecurity and its related implications in times of a pandemic.

The discussion began with an address by Jyoti Punjabi who spoke on the dire straits of cybersecurity due to the ongoing pandemic, and how cybersecurity is still an afterthought for several organizations, even though the industry is worth a trillion. She also highlighted how digital is the new normal, attack vectors are witnessing an exponential uptick, and cyberthreats are increasing manifold. Taking the lead, Kumar Ritesh explained, “There are a number of reasons for this trend. To begin with, the controlled environment posed by the pandemic on us, learning how to operate remotely even for business for whom remote working was unimaginable. The transition wasn’t a planned one but was done over night owing to the situation. I don’t think anything like that has ever happened, where there was such prompt action. And knowingly or unknowingly, we have exploded attack vectors without enough emphasis on cybersecurity.”

Kumar Ritesh has more than two decades of global cybersecurity leadership experience across all facets of the industry. A highly dynamic executive who successfully blends technology expertise with business acumen, he has a strong track record of developing successful cybersecurity strategies, products, policies, standards, and solutions, in addition to running complex cybersecurity programs. Today, Ritesh leads one of the foremost threat discovery and cyber-intelligence company, CYFIRMA, where its cloud-based analytics platform helps organizations decode threats and predict upcoming cyberattacks.

Ritesh added, “In the midst of all of these the bigger concern became geopolitical rifts between states and most of us are facing several state-sponsored attacks most of the time. While we look at ourselves as the defenders, we are set back due to constraints like budget, resources, etc.

“Another interesting trend we noticed from the cyber-intelligence front was that newer nations started to jump into the cybercrime economy. We have seen a big uptick in the last six months where new nations have joined the bandwagon of the cybercrime economy. Apart from that, there has also been a shift in the interest of hackers. They are moving away from enterprises toward high-value individuals, leveraging the work from the home format.”

Concurring Ritesh’s opinion, LOI Liang Yang said, “I completely agree with Ritesh here. In fact, every other day I am getting messages from someone or the other asking me to help them break into an enterprise. So, yeah, the threats are real.” He added that in the past few months he witnessed a steep increase in the number of attacks from several vectors of cyberthreats.

LOI Liang Yang is a Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker, and CompTIA Security+ cybersecurity consultant. LOI advises large enterprises including multiple fortune 500 companies on security strategy to protect against advanced threats.

LOI has a cybersecurity channel with more than 4 million views and over 170,000 global subscribers tuned to all his cybersecurity tutorials and lectures. LOI also teaches ethical hacking and network defense to the next generation of cybersecurity professionals.

Lim Shih Hsien also shared a similar assessment from a blue team perspective. Lim Shih Hsien is the Chief Security Officer, SP Group. He is currently responsible for managing the cyber and physical security risks for the SP Group, which owns and operates electricity and gas transmission and distribution businesses in Singapore and Australia.

Prior to joining SP in February 2019, Shih Hsien was heading the information security and data privacy functions for The Hong Kong Jockey Club. Before taking on this role in 2011, he was a member of the MOH Holdings P/L management team that was responsible for establishing the security technical architecture and policies for Singapore’s National Electronic Health Record (NEHR). Shih Hsien has also previously held senior positions in Singapore Airlines and Infocomm Development Authority of Singapore.

“We are in different times. There was a time when we were behind a wall, but now there is no perimeter as such, so that is possibly how COVID-19 has changed the world,” added Chris Roberts, Researcher, Hacker, CISO.

Roberts possesses a rich experience within the domain of information security and is globally recognized as one of the pioneering wizards on vulnerability research and counter-threat intelligence. He has worked on a multiplicity of projects specializing in intelligence gathering, DarkNet research, deception technologies, and cryptography with a number of organizations, and has been credited by many of the top Information Technology and Security disciplines.

The panelists also took questions from the audience. You can find the full version of the panel discussion here.

About CISO MAG

CISO MAG, an EC-Council initiative, is a cybersecurity magazine delivering cutting-edge updates about the latest happenings in the cybersecurity world. It is the handbook for CISOs, CXOs, and every responsible stakeholder of a secure Internet space.  Learn more at https://cisomag.com/

About CYFIRMA

Headquartered in Singapore and Tokyo, CYFIRMA is a leading Predictive Cyber Threat Visibility & Intelligence Platform company. Its cloud-based AI and ML powered Cyber Intelligence Analytics Platform (CAP) v2.0 helps organizations proactively identify potential threats at the planning stage of cyberattacks, offers deep insights into their cyber landscape, and amplifies preparedness by keeping the organization’s cybersecurity posture up-to-date, resilient, and ready against upcoming attacks.

CYFIRMA works with many Fortune 500 companies. The company has offices and teams located in Singapore, Tokyo, and India. Official websites: https://www.cyfirma.com/ and https://www.cyfirma.jp/

1...171172173...410Page 172 of 410