Home Blog Page 175

Pro Tips: Things to Remember Before Leveraging IaaS for Cloud Computing

Nanocore Netwire AsyncRAT, Cloud security, cloud computing

Cloud computing is the on-demand availability of computer system resources and computing power with no user’s direct management. To some, it’s a new way of running a business; to others, it’s a way of storing data, but in reality, it’s much more than that. While there are many advantages of cloud computing for businesses, such as reduced maintenance costs, minimum capital expenditure, excellent scaling opportunities, agility, flexibility, and data recovery, there are some downsides. Depending on the cloud computing service model, security challenges differ, and so do solutions. Let’s take the IaaS service model, for example. What are some of the worst things that can happen to businesses using IaaS?

What Is Infrastructure as a Service? 

Being the most common cloud computing service model, IaaS offers the fundamental virtual servers, networking, operating systems, and data storage – on-demand to enterprises. It represents the virtual equivalent of a traditional data center. Those who decide on the IaaS service model don’t have to own any personal hardware or manage its components. It is all managed by the service provider. And they pay for it on a usage basis – with pay-as-you-go payment options. Furthermore, businesses can easily deploy their apps on IaaS. Organizations can deploy their own virtual machines, workloads, and apps on top of the hypervisor layer – in the region and availability zone of their choice. IaaS key features include an enterprise-grade infrastructure, OPEX, flexible features, ease-of-use, and virtual management. There are additional services like performance and usage monitoring, load balancing, and scaling. This makes IaaS ideal for small and medium-sized organizations that look for a cost-effective IT solution.

Security Challenges

Not a single system is entirely safe, and there will always be security issues to address. Some of the most crucial security challenges of IaaS are listed below.

Service Level Agreement (SLA) Issues

Using SLAs guarantees the acceptable level of quality of service (QoS). An SLA contains contract definition, negotiation, monitoring, and enforcement. Contract definition and negotiation are essential to determine the benefits and responsibilities of both sides. Any ambiguity in SLA will leave a client exposed to vulnerabilities since it will affect the system’s security.

Platform Virtualization Issues

This component allows for faster scaling and is one of the fundamental parts of cloud computing. Every virtual machine (VM) should remain in isolation and not have access to other virtual disks, memory, or apps on the same host. When the communication between a VM and a host happens, attackers might exploit some features and gain access to data transfers. Sysadmin could also take advantage of the position and exploit the features.

Computer Hardware Issues

The IaaS interface is stored in distributed physical resources, such as network components, CPUs, and other storage devices. Even though service providers keep the physical components in a secured area, about 70% of attacks happen within the organization. If the attacker physically reaches the machine, two things could happen, depending on their intentions:

  • Denying service by shutting the machine down.
  • Accessing the machine to steal or corrupt data.

Optimal Solutions

There are no perfect solutions to issues that might occur in evolving systems. Service providers need to do their best to keep track of new security solutions and implement them if necessary.

Service Level Agreement (SLA) Solution

To ensure the proper service and trust between the providers and clients, SLA needs to be monitored, together with QoS. Proper monitoring and enforcement of SLA could be delegated to a third party.

Platform Virtualization Solution

Since IaaS is a shared environment, it needs a precise configuration to keep the VMs isolated. Cloud service providers need to work on securing their VMs, and a Trusted Virtual Datacenter can help. TVDc solves both infrastructure and management security problems. It enforces control access schemes on the network, based on security labels and management prototype. It acts as a closed box that prevents tampering or inspecting any content that circulates.

Computer Hardware Solution

The possibility of an attacker shutting down the machine can be minimized by keeping strict control over who has access to the location. When it comes to stealing or corrupting data, the recommended solution is encryption, using both the session ID and the user’s ID for key management.

Other Disadvantages of IaaS

Other issues that happen with IaaS are provider outages, permanent data loss, the vulnerability of applications, lack of expertise. To solve these, companies must focus on staff training. Providers must ensure data and network encryption, use the Cloud Access Security Broker (CASB) tool that identifies data risks, and monitor/audit the anomalies.

Conclusion

Cloud computing is a new way of storing data and running platforms and apps. Infrastructure as a Service is one of three service models of cloud computing, and it has its advantages and disadvantages. While many businesses turn to IaaS, some tend to ignore the other side of the coin. Paying attention to the SLA will ensure both sides are satisfied while the service runs. Virtual Machines can be kept safe with control access schemes such as access control lists (ACLs). Physically located data storage should be kept secured using proper encryption keys. With the implementation of these recommended solutions, Infrastructure as a Service becomes a safe place where businesses can thrive.

CISO MAG APAC CISO SUMMIT | An EC-Council Initiative – Platinum Partner DarkTrace

https://youtu.be/Lq7ERzpH5QM?list=PLRmoLV6UOL5w5YhhAWxBS8J-ZOwp07GCV

APAC CISO Summit Panel Discussion on Fortifying Cybersecurity strategy through comprehensive risk…

https://youtu.be/JG1e042nCc8?list=PLRmoLV6UOL5w5YhhAWxBS8J-ZOwp07GCV

APAC CISO SUMMIT Panel Discussion on APAC is the global IoT spending leader

https://youtu.be/KH6aNrtoQbU?list=PLRmoLV6UOL5w5YhhAWxBS8J-ZOwp07GCV

EC-Council’s CISO MAG All Set to Host the 2nd Africa CISO Summit in September

2nd Africa CISO Summit

EC-Council’s CISO MAG is all set to host the 2nd edition of its Africa CISO Summit on September 17, 2020, where a vibrant mix of senior cybersecurity experts will deliver key insights on how to redefine security frameworks and efficiently mitigate business risks. Over 300 information security leaders from over 100 of the top companies in the region will grace the event.

Registrations are open here.

The event will witness a slew of discussions by Harrison Nnaji, Chief Information Security Officer at First Bank Nigeria; Justin Williams, Executive Group Information Security at MTN Group; Daniel O. Adaramola, Chief Information Security Officer (CISO) at Unity Bank; Zaid Parak, Group Chief Information Security Officer at Discovery Limited; Hassan Hafez, Head of IT at Total Egypt; Prasanna Kumar Burri, Group CIO at Dangote Industries Limited; and Abeer Khedr, Information Security Director at the National Bank of Egypt.

Despite being one of the largest hubs of cybercrime incidents, Africa has leaped forward, thanks to the cybersecurity initiatives taken by both public and private entities. The onset of COVID-19 has also brought to light the reality of evolved and disruptive cyberattacks, which needs to be addressed, thus, placing a major emphasis on the adoption of dynamic technology solutions as well as the development of a future-ready cybersecurity strategy.

With businesses now transitioning into a hyper-connected digital ecosystem and a new remote operational model, the protection of vital business data, financial operations, intellectual properties and critical infrastructure networks are the top priorities. The growing threat profile in the region demands an overhaul of the cybersecurity landscape across the distributed enterprise network to safeguard critical data, sustain enterprise-wide operations, and ensure business continuity.

To ensure the success of a sustainable and digital-first economy, cooperation between the private sector and regulatory entities, skill development, mass awareness, and investments into developing the right cybersecurity framework is crucial.

EC-Council’s CISO MAG believes that visionaries in the industry who have dedicated their lives to the cause of creating a secure cyber world will be responsible for bridging this gap. Hence, the event will address the topics that are more relevant to the cybersecurity industry in Africa like the COVID-19 cyber outlook, safeguarding the domestic business community, inclusive capacity building through the right public-private partnerships, overhauling the cybersecurity strategy to strengthen enterprise-wide defense in times of a pandemic, adopting dynamic endpoint security protocols to protect the distributed enterprise network while mitigating risks, and leveraging analytics to deploy defense-in-depth and enable agile business scalability.

To know more about the event, click here.

About CISO MAG 

CISO MAG, an EC-Council initiative, is a cybersecurity magazine delivering cutting-edge updates about the latest happenings in the cybersecurity world. It is a handbook for CISOs, CXOs, and every responsible stakeholder of secure Internet space.

Events information can be found at https://events.cisomag.com/

For more information, contact: 

Name: Deepali Mistry

Email: [email protected]

Phone: +91-9833151933

Now Trending! Hackers Lure Single Adults with Online Romance Scams

Dating Apps

The FBI is warning users to be vigilant about online romance scams, also known as confidence frauds.  In this fraud trend, cybercriminals exploit people looking for romantic partners on dating websites, apps, or social media networks. The agency noticed that the majority of the victims of romance frauds were single adults over the age of 55 in Utah, Idaho, and Montana.

The consequences of these scams are often financially and emotionally devastating to victims; they rarely get their money back and may not have the ability to recover from the financial loss.

– FBI 

 A $475 Million Scam

The FBI’s Internet Crime Complaint Center (IC3) stated that confidence frauds incurred huge financial losses to victims when compared to other cybercrimes. The IC3 received nearly 100 complaints from victims reporting more than $1 million in losses to romance scams in Idaho last year. Nearly 20,000 complaints related to romance scams were reported to IC3, with losses of more than $475 million.

Protective Measures

The FBI recommended users to follow precautionary measures before developing a romantic relationship with someone online. These include:

  • Research the person’s photo and profile using online searches to see if the material has been used elsewhere.
  • Go slow and ask questions.
  • Beware if the individual seems too perfect or quickly asks you to leave a dating service or social media site to go offline.
  • Beware if the individual attempts to isolate you from friends and family or requests.
  • Beware if the individual promises to meet in person, but then always comes up with an excuse why he or she cannot. If you have not met the person after a few months, for whatever reason, you have good reason to be suspicious.
  • Never send money to anyone you do not know personally.

Rise of Fake Dating Apps

Research from Kaspersky revealed that South Africa is one of the most malware attacked countries via fake dating applications. Nearly 7,734 attacks were detected on 2,548 users in 2019. The country saw a circulation of 1,486 malware threats disguised as over 20 popular dating apps. It is said that South Africa is the most targeted country by fake dating apps accounting to 58% while Kenya reported 10% and Nigeria 4%.

$5 Million Data Breach Suit Filed Against Morgan Stanley

American Cybersecurity Literacy Act

Morgan Stanley, a financial services provider, finds itself stuck in a data breach suit filed by one of its customers, Timothy Smith. The suit claims class action status and alleges Morgan Stanley of improper handling of historical customer data dating as early as 2016. According to Smith, Morgan Stanley failed to thoroughly dispose its data, which led to the potential exposure of his and other customers’ personally identifiable information (PII).

How it Happened

Morgan Stanley reported to the Attorney General and notified its affected customers about two separate data exposure incidents. The first took place in 2016 when Morgan Stanley shut down two of its data centers and correspondingly decommissioned the computer equipment at both locations. As per their standard operating procedure (SOP), a contracted vendor was assigned to delete and dispose all the data from these devices. However, it was later learned that some of these devices still contained historical data of some customers in an unencrypted format.

In the second incident that took place in 2019, Morgan Stanley disconnected and replaced a computer server in a local branch office. This server contained information in encrypted disks that may have had personal information. During a recent inventory check, the company authorities were unable to locate this decommissioned server. Additionally, the server manufacturer subsequently informed Morgan Stanley of a software flaw that could potentially result in small amounts of previously deleted data remaining on the disks in an unencrypted form.

What is at Risk

The IT authority at Morgan Stanley in its self-assessment found that data pertaining to customer account(s) including PII  like account names and numbers (at Morgan Stanley and any linked bank accounts), Social Security number (SSN), passport number (if mentioned), contact information, date of birth, asset value and holdings data were exposed. However, this data did not include online passwords of Morgan Stanley accounts.

What Next for Morgan Stanley

Morgan Stanley is closely monitoring the compromised accounts for any suspicious activity but has not yet detected any misuse of the exposed data. They are also providing the affected customers with a 24-months free credit and identity monitoring service, in case there is a misuse of their identity.

However, the lawsuit alleges, “PII was compromised due to Morgan Stanley’s negligent and/or careless acts and omissions and the failure to protect customers’ data. In addition to Morgan Stanley’s failure to prevent the data breach, the defendant failed to detect the data breach for years, and when they did discover the data breach, it took them over a year, possibly longer, to report it to the affected individuals and the states’ attorneys general.”

Smith also pointed out in the lawsuit that Morgan Stanley did not use reasonable security procedures and practices. They could have prevented the data breach by encrypting the data. This case does not involve a direct breach of a computer system by a third party, but rather an unauthorized disclosure of the PII. Thus, it would be interesting to see the lawmakers’ verdict on this data breach class action suit.

Threat to Privacy! 61% of Organizations Suffered an Insider Attack Last Year

Insider Threats

A survey from cloud security firm Bitglass revealed the state of enterprise security related to insider threats. In its “2020 Insider Threat Report,” Bitglass stated that negligent or careless employees can pose severe security risks to organizations. Mitigating insider attacks is challenging for an organization’s IT or cybersecurity team since access to legitimate credentials can put the entire enterprise network in danger.

With businesses undergoing rapid migrations and working remotely due to the ongoing pandemic, securing against insider threats has become a challenge for many organizations. Nearly 61% of respondents reported at least one insider attack in the last 12 months. Several organizations admitted that they cannot detect insider threats from personal devices (82%) or the cloud (50%), and 81% of them find it difficult to assess the impact of insider attacks. While 49% of respondents stated that one week typically goes by before insider attacks are detected, 44% said that another week usually passes before the organization recovers from the attack.

The survey also highlighted that 73% of organizations’ security budgets are decreasing or staying flat over the next year. “Few respondents have a single platform that delivers complete, unified visibility and control for any interaction. When dealing with multiple disjointed tools that provide disparate levels of protection, security professionals spend an inordinate amount of time managing each of the solutions individually,” the report stated.

Anurag Kahol, CTO of Bitglass, said, “Enterprises report that loss of critical data and disruption to business operations are the biggest repercussions of insider attacks. Along with brand damage, remediation costs, legal liabilities, and loss of revenue, these are serious ramifications that must be prevented. Enterprises need a multi-faceted security platform that is designed to monitor user behavior, secure personal devices, deliver maximum uptime and cost savings, and prevent leakage on any interaction. Only then can they defend against insider threats.”

The survey findings are based on the responses from security professionals to understand how their businesses balance budgetary and data protection concerns while defending against insider threats.

Insider Threats on Rise

Several industry experts stressed that insider threats are the primary concern for every security leader, as many organizations fail to address the insiders within their own company. As a result, numerous data breaches happen due to employee negligence or unintentional actions like responding to a phishing email with sensitive information or downloading malicious content. A recent survey report “2020 Cost of Insider Threats: Global Report” from the Ponemon Institute revealed that insider threats increased by 47% from 3,200 in 2018 to 4,716 in 2020. It also revealed that the cost of insider threat incidents also surged by 31% from $8.76 million in 2018 to $11.45 million in 2020.

Data Security Alert! American Payroll Association Suffers Web Skimming Attack

New Programming Language

The American Payroll Association (APA) disclosed it was a victim of a data breach on July 13, 2020, which affected its employees and customers’ information. The hackers injected a web skimmer on the company’s website login and checkout pages. In a security alert, APA stated that the threat actors extracted personal data by exploiting a vulnerability in the association’s content management system (CMS).

Information Accessed in the Data Breach

The attackers gained access to users’ login information like usernames, passwords, payment card information like credit card numbers, and personal information like names, dates of birth, email address, job titles and roles; primary job function, addresses, employee industry, and type of payroll software used. In addition, they also obtained profile photos and social media username data associated with some accounts.

APA notified the users affected in the incident and offered 12 months of free credit monitoring and $1,000,000 in identity theft insurance.

“Since discovering the cyberattack, APA has installed the latest security patches from our content management system to prevent any further exploitation of their website. APA technicians also reviewed all code changes made to the APA website since January; installed additional antivirus software on our servers; and increased the frequency of security patch implementation,” the Association said.

Magecart Attack, Again?

The attack that APA suffered is known as the Magecart attack (also called web skimming or e-skimming attacks) in which attackers inject malicious JavaScript code on e-commerce websites after exploiting a CMS vulnerability. Multiple security incidents have been reported on Magecart hackers earlier. Recently, researchers from threat intelligence firm RiskIQ uncovered a new Magecart campaign dubbed as “Magecart Group 7” that compromised over 19 e-commerce websites to steal customers’ payment card data. The researchers discovered a software skimmer “MakeFrame,” which injects HTML iframes into the targeted websites to obtain payment information.

1...174175176...410Page 175 of 410