Home Blog Page 185

Australia to Spend $1.19 Bn to Boost Cybersecurity

Australia to Spend $1.19 Bn to Boost Cybersecurity

With the surge in cybercrime the country, the Prime Minister of Australia, Scott Morrison, has announced that the country is going to spend A$1.66 billion (US$ 1.19 billion) over the next decade to bolster the cybersecurity defenses for enterprises. According to a media report cyberattacks on private businesses and households incurred a cost of A$29 billion (US$ 20.83 billion) or 1.5% of Australia’s gross domestic product (GDP) to the country.

The increased security investment is aimed to fortify critical infrastructure, boost police efforts to disrupt malicious activities on the dark web and strengthen community awareness on security. The latest cybersecurity spending announcement comes after the Australian Capital Territory, Canberra, commited to spend A$1.35 billion (US$ 0.97 billion) over the next 10 years to strengthen the capabilities of its chief cyber intelligence agency.

Morrison stated that malicious activities are swelling against small and medium businesses and universities in the country. He also stressed that a sophisticated state-sponsored actor targeted all levels of the government, political bodies, essential service providers, and operators of critical infrastructure in June 2020. “We will protect our vital infrastructure and services from cyberattacks. We will support businesses to protect themselves so they can succeed in the digital economy,” Morrison added.

Cyberattacks on Australia

Recently, Scott Morrison briefed about sustained cyberattacks carried out by a sophisticated state-sponsored actor. These cyberattacks are not only targeted toward government organizations but also toward known corporate entities in the country. After a detailed briefing received from the Australian Cyber Security Center (ACSC), Morrison told the media, “Australian organizations are currently being targeted by a sophisticated state-based cyber actor. Organizations across a range of sectors, including all levels of government, industry, political organizations, education, health, central service providers, and operators of other critical infrastructure, are all being targeted.”

Australia – The World’s 15th Secure Country

A study on global comparison of cybersecurity defenses ranked Australia as the world’s 15th secure country. According to the security research firm Comparitech, Australia climbed 12 positions in its latest cybersecurity ranking report. The study evaluated 76 countries’ exposure to security vulnerabilities to find which countries are well prepared for cyberattacks. Comparitech stated that it found improvement in Australia’s cybersecurity readiness with an overall score of 13.95 when compared to the previous year’s 16.34 (lower scores represent better ranking). The scores are based on the indicators of compromise like the percentage of mobiles infected with malware, the frequency of financial malware attacks, and the number of computers infected with viruses in a country.

 

Still Using a Windows 7 Device? Watchout! You Can Get Hacked

Still Using a Windows 7 Device? Watchout! You Can Get Hacked

The FBI warned organizations in the U.S. about security concerns associated with the use of the Windows 7 operating system after it reached its official end-of-life (EOL) earlier this year. In a Private Industry Notification (PIN), the FBI stated that enterprises running Windows 7 systems are vulnerable to getting hacked due to lack of security updates. The notification is intended to help security professionals and system administrators defend against the persistent malicious activities of cybercriminals.

Windows 7 End-of-Life Status

Microsoft ended the security updates and technical support for their Windows 7 OS on January 14, 2020. However, the company is providing Extended Security Update (ESU) services as an additional purchase per-device, which is available for Windows 7 Professional and Enterprise versions. Microsoft will only offer the ESU plan until January 2023.

The FBI stated that continuing to use Windows 7 may attract risks from cybercriminals exploiting the outdated systems and known/newly discovered vulnerabilities.

Microsoft and other industry professionals strongly recommend upgrading computer systems to an actively supported operating system. Migrating to a new operating system can pose its own unique challenges, such as cost for new hardware and software and updating existing custom software. However, these challenges do not outweigh the loss of intellectual property and threats to an organization

— the FBI said in the notification

Threats Associated with Windows 7 OS

The FBI also mentioned several Windows 7 vulnerabilities that have been exploited over the past few years, these include:

  • As of May 2019, 71% of Windows devices used in health care organizations ran an operating system that became unsupported in January 2020. Increased compromises have been observed in the health care industry when an operating system has achieved end of life status. After the Windows XP end of life on 28 April 2014, the health care industry saw a large increase of exposed records the following year.
  • Cybercriminals continue to find entry points into legacy Windows OS and leverage Remote Desktop Protocol (RDP) exploits. Microsoft released an emergency patch for its older operating systems, including Windows 7, after an information security researcher discovered the RDP vulnerability called BlueKeep in May 2019.
  • Since the end of July 2019, malicious RDP activity has increased with the development of a working commercial exploit for the BlueKeep vulnerability. Cybercriminals often use misconfigured or improperly secured RDP access controls to conduct cyberattacks.
  • In 2017, nearly 98% of systems infected with WannaCry employed Windows 7 based operating systems. After Microsoft released a patch in March 2017 for the computer exploit used by the WannaCry ransomware, many Windows 7 systems remained unpatched when the WannaCry attacks began in May 2017. With fewer customers able to maintain a patched Windows 7 system after its end of life, cybercriminals will continue to view Windows 7 as a soft target.

Protective Measures

The FBI also recommended organizations to follow a multilayered approach to defend against cybercriminals, which include:

  • Upgrading operating systems to the latest supported version.
  • Ensuring anti-virus, spam filters, and firewalls are up to date, properly configured, and secure.
  • Auditing network configurations and isolate computer systems that cannot be updated.
  • Auditing your network for systems using RDP, closing unused RDP ports, applying two-factor authentication wherever possible, and logging RDP login attempts.

 

UberEATS Suffers Data Breach; Personal Records of Users Leaked on Dark Web

UberEATS Suffers Data Breach; Personal Records of Users Leaked on Dark Web

The U.S.-based online food ordering and delivery platform UberEATS is the latest victim of a data breach. Security researchers from cybersecurity firm Cyble came across unknown hackers leaking personal records of UberEATS customers and employees on darknet forums.

“During our research process, the Cyble Research Team got hold of some informative details related to this leak,” Cyble said in a release.

What Information Was Exposed

  • 9 TXT files leaked, which contained details of UberEATS delivery drivers, delivery partners, and customers.
  • Around 579 UberEATS customers’ files and login credentials were exposed on the dark web.
  • Leak of over 100 delivery drivers’ personal data including, full name, contact details, trip details, bank card details, and account creation date.

Exposed Data on Dark Web

Image Source: Cyble

How to Mitigate Data Breach Risks

Data breaches can pose serious security issues to individuals and organizations when the stolen data falls in the wrong hands. Cyble recommended certain security tips to protect personal data against attackers:

  • Never share personal information, including financial information over the phone, email, or SMS.
  • Use strong passwords and enforce multi-factor authentication or two-factor authentication (2FA) where possible.
  • Regularly monitor your financial transaction, if you notice any suspicious transaction, contact your bank immediately.
  • Turn-on automatic software update feature on your computer, mobile and other connected devices where possible and pragmatic.
  • Use a reputed anti-virus and internet security software package on your connected devices including PC, laptop, mobile. 

Attacks on Food Delivery Platforms

Multiple security incidents have been reported on food delivery services as cybercriminals are taking advantage of the ongoing pandemic  to target businesses and users online. In a recent incident, threat actors launched a distributed denial-of-service (DDoS) attack on Germany-based food delivery firm Takeaway.com (Liefrando.de). Attackers demanded two Bitcoins (around US$11,000) in ransom to stop the attack. Earlier, DoorDash, a San Francisco-based food-delivery service provider, faced a massive data breach that affected data of around 4.9 million people (its customers, delivery workers, and merchants), who were using its service platform. The company said that an unauthorized third-party accessed its user data on May 4, 2019. DoorDash clarified that users who joined its services platform on or before April 5, 2018, were affected in the incident.

 

97% Indian Organizations Experienced at Least One Business-Impacting Cyberattack in the Past 12 Months: Forrester Study

CEO, cybersecurity, CISO, Future of the CISO

The attacks on Indian organizations have increased in the past two years, yet only four in 10 security leaders in India have a clear picture about how much at risk, or how secure their organizations are. Most Indian organizations (97%) have experienced a business-impacting cyberattack in the past 12 months, according to both business and security executives. And 76% of respondents in India have witnessed a dramatic increase in the number of business-impacting cyberattacks over the past two years. The data is drawn from “The Rise of the Business-Aligned Security Executive,” a commissioned study of more than 800 global business and cybersecurity leaders, including 54 local respondents, conducted by Forrester Consulting on behalf of Tenable, a Cyber Exposure company.

“Business-impacting” relates to a cyberattack or compromise that results in a loss of customer, employee, or other confidential data; interruption of day-to-day operations; ransomware payout; financial loss or theft; and/or theft of intellectual property.

Unfortunately, these business-impacting cyberattacks had damaging effects, with organizations reporting identity theft (44%), financial loss or theft (38%), and ransomware payout (33%). 67% of security leaders in India say these attacks also involved operational technology (OT).

Business leaders want a clear picture of how much at risk they are and how that risk is changing as they plan and execute business strategies. But only four out of 10 of local security leaders say they can answer the fundamental question, “How secure, or at risk, are we?” with a high level of confidence, despite the prevalence of business-impacting cyberattacks.

Adam Palmer, Chief Cybersecurity Strategist, Tenable, business-impacting cyberattacks
Adam Palmer, Chief Cybersecurity Strategist, Tenable

Speaking to CISO MAG Adam Palmer, Chief Cybersecurity Strategist, Tenable said, “Many security leaders use the heat matrices, the red, amber, green (RAG) scores to try to describe risk to the business leaders. This is really IT talk. Every organization I worked at did this. RAG scores do not say anything to really quantify the risk or help people understand the reduction in risk. How can a business leader make a decision, based on a color in RAG scores? There is a gap in communication between how IT people speak (technical or ambiguous) and the expectations of business leaders–quantitative understanding of risk.”

RELATED STORY

Optimizing Security for Your Business

Global findings for business-impacting cyberattacks

Looking at global respondents, fewer than 50% of security leaders said they are framing cybersecurity threats within the context of a specific business risk. For example, though 96% of respondents had developed response strategies to the COVID-19 pandemic, 75% of business and security leaders admitted their response strategies were only “somewhat” aligned.

“The heart of it is really the lack of partnership between the security and the business leaders. There’s not enough alignment of metrics and objectives with business strategic priorities. I see that organizations report risk in a very qualitative language. This is not the language of business leaders. They have to consider industry benchmarking frameworks and accurately report it to the business. In times like today, with the pandemic, it is more important than ever for business leaders to understand their level of risks,” added Palmer.

Organizations with security and business leaders who are aligned in measuring and managing cybersecurity as a strategic business risk deliver demonstrable results. Compared to their siloed peers, business-aligned security leaders are:

  • Eight times more likely to be highly confident in their ability to report on their organizations’ level of security or risk.
    • 90% are very or completely confident in their ability to demonstrate that cybersecurity investments are positively impacting business performance compared with 55% of their siloed counterparts.
    • 85% have metrics to track cybersecurity ROI and impact on business performance versus just 25% of their siloed peers.
  • Organizations with business-aligned cybersecurity leaders are also:
    • Three times more likely to ensure cybersecurity objectives are in lock step with business priorities.
    • Three times more likely to have a holistic understanding of their organization’s entire attack surface.
    • Three times more likely to use a combination of asset criticality and vulnerability data when prioritizing remediation efforts.
Business-impacting cyberattack, Renaud Deraison, Chief Technology Officer and co-founder, Tenable
Renaud Deraison, Chief Technology Officer and co-founder, Tenable

“In the future, there will be two kinds of CISO — those who align themselves directly with the business and everyone else. The only way to thrive in this era of digital acceleration is to bring cyber into every business question, decision, and investment,” said Renaud Deraison, Chief Technology Officer and co-founder, Tenable. “We believe this study shows that forward-leaning organizations view cybersecurity strategy as essential to innovation and that when security and the business work hand-in-glove, the results can be transformational.”

Forrester Consulting conducted the online survey of 416 security and 425 business executives, as well as telephonic interviews with five business and security executives, to examine cybersecurity strategies and practices at midsize to large enterprises in Australia, Brazil, France, Germany, India, Japan, Mexico, Saudi Arabia, the U.K., and the U.S. The study was fielded in April 2020.

To read the full study, visit https://www.tenable.com/analyst-research/forrester-cyber-risk-report-2020

U.S. Issues a Code Red for a New Strain of “Taidoor” Virus from China

U.S. and China

The U.S. law enforcement agencies like the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD), have jointly issued a malware alert against a new strain of “Taidoor” malware. The FBI was very confident in stating that the new variant was introduced by Chinese state actors that are planning to attack various industries in the U.S. as a retaliation to the current geopolitical tension between the two nations.

 Key Highlights 

  • The Malware Analysis Report (MAR) has been jointly prepared by the CISA, FBI and DoD.
  • The FBI is confident that Chinese state sponsored actors are behind this new variant of Taidoor malware.
  • Four Taidoor samples have already been uploaded by the U.S. Cyber Command on Google’s VirusTotal repository.
  • Threat actors are using this malware variant along with proxy servers to maintain access to the victims’ networks and carry further exploitation.

Taidoor’s Evolution

Taidoor was first sighted in 2008 and continues to be active to date. It has been largely used in cyber espionage campaigns across the globe, notably in countries like Taiwan, Japan, and the U.S. According to a FireEye report published in 2013, Taidoor malware is traditionally delivered as a spear-phishing email attachment. If opened, the Taidoor malware is dropped onto the target’s system, which then starts communicating with a command and control (C2) server. Taidoor connects to its C2 server using HTTP, and the “GET” request. This has been consistent since 2008.

However, the same study also stated that Taidoor is a constantly evolving and persistent malware threat. A tactical change was observed by the researchers in the years 2011-2012, when the malicious email attachments started dropping a “downloader,” which then installed the traditional Taidoor malware from over the Internet.

This however has further evolved, according to the Malware Analysis Report (MAR) shared by CISA. “Taidoor is now installed on a target’s system as a service dynamic link library (DLL) and is comprised of two files. The first file is a loader, which is started as a service. The loader decrypts the second file, and executes it in memory, which is the main Remote Access Trojan (RAT).”

Threat Summary
Name Taidoor
Threat type Malware, Remote Access Trojan (RAT)
File Type 32-bit Windows DLL file
Number of .dll files used while installing the malware Two (“ml.dll” is a Taidoor loader which decrypts and loads “svchost.dll” that is identified as Taidoor malware)
Files used for spreading Malware
  • 0d0ccfe7cd476e2e2498b854cef2e6f959df817e52924b3a8bcdae7a8faaa686 (svchost.dll)
  • 363ea096a3f6d06d56dc97ff1618607d462f366139df70c88310bbf77b9f9f90 (svchost.dll)
  • 4a0688baf9661d3737ee82f8992a0a665732c91704f28688f643115648c107d4 (ml.dll)
  • 6e6d3a831c03b09d9e4a54859329fbfd428083f8f5bc5f27abbfdd9c47ec0e57 (rasautoex.dll)

Mitigation Measures Suggested by CISA

CISA and FBI have already informed the affected victims, but they are still uncertain about the exact number of users affected by Taidoor. It recommends the following mitigation measures:

  • Conduct a regular review to determine if there is a security concern or compromise.
  • Implement detection tools for detecting malicious activities.
  • Additionally, customers and users of any IT service provider must:
    • Review and verify all connections between their systems, service provider systems, and other client enclaves.
    • Restrict access to service provider accounts in their environment only for appropriate purposes and disable them when not actively used.
  • Check and maintain all system log file that could serve as a proof for investigation in case of an intrusion.

Your Mobile Location Data Could Pose Security Threats: NSA

Your Mobile Location Data Could Pose Security Threats: NSA

The U.S. National Security Agency (NSA) warned about the security risks associated with location data tracked via mobile phones and other connected devices. The NSA released a detailed guidance report primarily intended for the Department of Defense (DoD) and Federal agencies personnel, and also noted that it could be useful to a wide range of users.

NSA stated that location data is valuable and must be protected against adversaries. The exploitation of  location data can reveal details about the number of users in a location, user movements, and can expose unknown associations between users and locations.

“Mitigations reduce, but do not eliminate, location tracking risks in mobile devices. Most users rely on features disabled by such mitigations, making such safeguards impractical. Users should be aware of these risks and act based on their specific situation and risk tolerance. When location exposure could be detrimental to a mission, users should prioritize mission risk and apply location tracking mitigations to the greatest extent possible. While the guidance in this document may be useful to a wide range of users, it is intended primarily for NSS/DoD system users,” NSA said in a statement.

Not Just Limited to Mobile Phones

According to the NSA report, any device that sends and receives wireless signals is vulnerable to location data risks. Connected devices like fitness trackers, smart watches, smart medical devices, or built-in vehicle communication devices often store users’ geolocation information, which is automatically synced to cloud accounts. This could also pose a risk of location data exposure if the accounts or the servers linked to the accounts are compromised.

“Personal and household smart devices (e.g., light bulbs, cookware, thermostats, home security, etc.) often contain wireless capabilities of which the user is unaware. Such IoT devices can be difficult to secure, most have no way to turn off wireless features, and little, if any, security built in. These security and privacy issues could result in these devices collecting and exposing sensitive location information about all devices that have come into range of the IoT devices,” the statement added.

Location Risks with Apps and Social Networks

Most of the mobile apps request permission for location and other resources that are not required. They even collect, aggregate, and transmit information that exposes a user’s location. Users must be vigilant while sharing information or location data on applications and social media networks.

“If errors occur in the privacy settings on social media sites, information may be exposed to a wider audience than intended. Pictures posted on social media may have location data stored in hidden metadata. Even without explicit location data, pictures may reveal location information through picture content,” the NSA explained.

Risk Mitigation

The NSA also recommended security measures to mitigate location data risks:

  • Disable radios when they are not actively in use: disable Bluetooth (BT) and turn off Wi-Fi if these capabilities are not needed. Use Airplane Mode when the device is not in use. Ensure BT and Wi-Fi are disabled when Airplane Mode is engaged.
  • Disable location services settings on the device.
  • Set privacy settings to ensure apps are not using or sharing location data.
  • Avoid using apps related to location if possible, since these apps inherently expose user location data. If used, location privacy/permission settings for such apps should be set to either not allow location data usage or, at most, allow location data usage only while using the app. Examples of apps that relate to location are maps, compasses, traffic apps, fitness apps, apps for finding local restaurants, and shopping apps.
  • Set privacy settings to limit ad tracking, noting that these restrictions are at the vendor’s discretion.
  • Reset the advertising ID for the device on a regular basis. At a minimum, this should be on a weekly basis.
  • Turn off settings (typically known as Find My Device settings) that allow a lost, stolen, or misplaced device to be tracked.
  • Minimize web-browsing on the device as much as possible and set browser privacy/permission location settings to not allow location data usage.
  • Use an anonymizing Virtual Private Network (VPN) to help obscure location.
  • Minimize the amount of data with location information that is stored in the cloud, if possible.

 

Misconfigured Cloud Storage Services Led to Over 200 Breaches in Past Two Years

Misconfigured Cloud Storage Services Led to Over 200 Breaches in Past Two Years

Cloud security professionals across the globe are concerned about the security of their cloud environments as several organizations are working remotely since the pandemic hit. The prevention of cloud misconfigurations remains a challenge for organizations that are swiftly adopting new access policies, networks, and devices used for managing cloud infrastructure remotely.

A survey “State of DevSecOps,” from Accurics revealed that misconfigured cloud storage services in 93% of cloud deployments led to over 200 breaches in the past two years, exposing more than 30 billion records.  It also stressed that cloud data breaches are expected to increase in both velocity and scale. Around 91% of the cloud deployments evaluated had at least one major data breach and one in two (50%) deployments had unprotected credentials stored in container configuration files.

Other Key Findings include:

  • Misconfigured cloud storage services are commonplace in a stunning 93% of the cloud deployments analyzed, and most also have at least one network exposure where a security group is left wide open.
  • One emerging problem area is that despite the broad availability of tools, hardcoded private keys turned up in 72% of the deployments analyzed. Specifically, unprotected credentials stored in container configuration files were found in half of these deployments, which is an issue given that 84% of organizations use containers.
  • Around 41% of the organizations had high privileges associated with the hardcoded keys and were used to provision compute resources; any breach involving these would expose all associated resources. Hardcoded keys have contributed to a number of cloud breaches.
  • Network exposures resulting from misconfigured routing rules posed the greatest risk to all organizations. In 100% of deployments, an altered routing rule exposed a private subnet containing sensitive resources like databases, to the internet.
  • Automated detection of risks paired with a manual approach to resolution is creating alert fatigue, and only 6% of issues are being addressed. An emerging practice known as Remediation as Code, in which the code to resolve the issue is automatically generated, is enabling organizations to address 80% of risks.

Accurics advised organizations to implement certain security practices like encrypting databases, rotating access keys, and implementing multi-factor authentication for enhanced cloud security.

The adoption of cloud native infrastructure such as containers, serverless, and service mesh is fueling innovation, misconfigurations are becoming commonplace and creating serious risk exposure for organizations. As cloud infrastructure becomes increasingly programmable, we believe that the most effective defense is to codify security into development pipelines and enforce it throughout the lifecycle of the infrastructure. The receptiveness of the developer community toward assuming more security responsibility has been encouraging and a step in the right direction

 

           – Om Moolchandani, Accurics Co-founder & CTO

Misconfigurations Increase the Risks

A similar survey, “The State of Cloud Security 2020,” revealed that inadvertent database exposure continues to be a major risk for organizations, with misconfigurations exploited in 66% of reported attacks. Besides, 33% of organizations reported that attackers gained access through stolen cloud provider account credentials.  A quarter of organizations stated that managing access to cloud accounts is a primary concern to them. Nearly 96% of respondents admitted that they face issues with their current level of cloud security, while 44% of respondents reported data breaches are the top security concern. Only one in four respondents stated lack of staff expertise as a top concern.

 

Hackers Favored Google and Amazon for Brand Phishing Attacks in Q2 2020

Hackers Favored Google and Amazon for Brand Phishing Attacks in Q2 2020

Google and Amazon were the top used brands in phishing attacks (13%) during Q2 2020, according to Check Point’s Brand Phishing Report. The report highlighted various other brands that were frequently impersonated by hackers in their cyber activities to steal victims’ sensitive information. Check Point stated that technology, banking, and social networking are the most targeted sectors in brand phishing attacks.

Brand Phishing Attack: An Overview

  • In brand phishing attacks, attackers impersonate the official website of a popular brand by creating a similar domain name or URL of the original site.
  • The links to the fraudulent website are then sent to targeted individuals via email or SMS.
  • Once the user clicks on the link, it redirects them to a fake website which often contains a form intended to steal user credentials, payment details, or sensitive information.

Top Phishing Brands

According to the report, WhatsApp and Facebook stood at third and fourth positions with 9% brand phishing attacks. Similarly, Microsoft and its brand Outlook, which stood at fifth and sixth spots, were imitated in 7% and 3% of attacks, respectively. Apple (the leading phishing brand in Q1 2020) fell to seventh place in the current rankings with 2% of attacks, followed by Netflix, Huawei, and PayPal at eighth, ninth and tenth spots (2% attacks).

Image Source: Check Point

Top Phishing Brands Per Vector

Email phishing exploits were the second most common type after web-based exploits.  “The reason for this change may be the easing of global Covid-19 related restrictions, which have seen businesses re-opening and employees returning to work,” the report said.

Top 3 Attacked Vectors

table

How to Stay Safe

Check Point recommended certain security measures to avoid falling victim to phishing scams, these include:

  • Verify you are using or ordering from an authentic website. One way to do this is NOT to click on promotional links in emails, and instead Google your desired retailer and click the link from the Google results page.
  • Beware of special offers. An 80% discount on a new iPhone is usually not a reliable or trustworthy purchase opportunity.
  • Beware of lookalike domains, spelling errors in emails or websites, and unfamiliar email senders.

 

“In the COVID-19 situation, 98% employees are working from home and this invites many new risks”

Bharat Panchal is working as a Chief Risk Officer for India, Middle East & Africa for FIS, a Fortune 500 and global fintech leader.

He is responsible for creating risk culture at FIS and its ecosystem by way of designing, implementing and monitoring risk controls. Panchal holds an MBA degree in Information Systems and has around 26+ years of experience in risk management, mainly in the banking and telecommunication industry. He has been honoured with prestigious “Security Leader of the Year” Award in 2014 and 2017 by Data Security Council of India (DSCI) for his significant contribution to cybersecurity in the banking sector.

By Augustin Kurian, Senior Feature Writer, CISO MAG

You are responsible for creating a risk culture at FIS and its ecosystem. What are the biggest challenges you face in doing so, and how do you overcome these challenges? Apart from this, what is your charter at FIS and your plan for this year?

Today, ‘risk’ is not a static or dry subject. Technology has brought lots of dynamic changes in our life, so risk is also now dynamic in the ever-changing threat landscape. This is an amalgamation of many things. It should begin by changing the attitude of people. Because even if you have good technology and processes, you will need to nurture people to increase their risk-taking ability. When it comes to risk management, it gives confidence to people on how much more risk they can take. Because risk management is a function that is safeguarding them by early warning about such events – it is how efficiently you can manage it.

Risk is more about predictability. So, for any risk manager, the plan is always to identify more and more risk which may occur. So, if we have impacted in certain areas, which are probably a concern for risk, compliance and security and many other central functions. We continuously monitor such activities and events which may potentially turn into a risk later. We are cautious about that. We are aware of those risks and try to mitigate them as and when they occur. It is always a future-proof planning.

The big difference you need is to walk the talk — become a role model, and that is how you can bring a risk culture in the organization. So, in a nutshell, it is about influencing people that risk should be considered as an enabler.

Looking back on your career, especially your role as Chief of Risk Management for National Payments Corporation of India (NPCI) – what were your biggest achievements? What were some of the innovations on the security side that were introduced during your tenure at NPCI?

I think this was the best era that India has ever witnessed with the digital wave – be it for the financial sector, be it for banking, be it even for a common man. India, at large, was introduced with the DBT (Direct Benefit Transfer) in banking in the last ten years. Earlier, the bank branch was the only option for any banking transactional activities. Unless you physically visited the bank, nothing was possible. Now, everything has moved into the digital space. It has spread across the banks and now almost every banking institution in the country is implementing mobile-based transaction, web-based transaction or UPI.

I was lucky to be part of this first-ever digital evolution in India’s banking sector. What we did at NPCI is what every Indian is using today — be it mobile banking, IMPS, UPI, RuPay, NETC, BBPS or AEPS, the most efficiently used product by the government today for DBT (Direct Benefit Transfer). I think, for me, it was a worthy field on which I have roped. In addition to the implementation of robust security controls within NPCI’s own infrastructure, whatever risk framework or controls I have created for the entire ecosystem have become staple today. Some of them are like real-time fraud monitoring, implementation of a network compliance program for over 2000 banks by a single network, member onboarding program, card vendor security program, very unique settlement risk management etc.

The implementation of common adequate control across banks was really a big challenge because India is a country with diversity in terms of digital banking — public sector, private sector banks, cooperative banks, and very small community banks. So, every bank had a different way of dealing with security. Hence, keeping every bank connected with NPCI’s central platform in a controlled environment, with millions of transactions occurring every day while providing safety and security in each transaction were few of our key achievements.

More businesses are embracing digital and outsourcing pieces of IT functionality to third parties. Third-party vendors in-turn outsource to sub-contractors. That increases the risk quotient and broadens the attack surface for the organization. What should organizations be doing to mitigate these new risks?

Banks are becoming technology companies today due to the fact of increased dependency on technology. Yet their biggest functionality remain is banking. Nobody else understands about credit risk, market risk and liquidity risk better than banks do. But when it comes to technology risks, banks or the financial institutions are not always capable to manage them in an efficient way.

And this is the point when there is more reliance on outsourcing. Fintech approach for the IT infrastructure has helped increase the digital footprint of banks to meet the demand from customers for seamless availability 24/7. Earlier banks used to stop activities at 4 pm. Now it is round the clock as it is outsourced to Fintech companies who are running the show. Fintechs need not know banking, all they need to know is how to run the technology for banking. So, that is a good model which has emerged.

Selection of IT partners for outsourcing is a very important aspect and risk parameters for outsourcing decision-making must include safety, security and availability as a core risk requirement and that is where FIS comes in. We provide safety, security, availability, which are the prominent requirement for the bank, from the outsourcing perspective, which provides so much efficiency. Today, we are present in 132 countries because of this reason. This model is working successfully for a large sector of banks in the US, India, Europe or in Latin America.

But when it comes to outsourcing, one needs to understand very clearly what to outsource and what not to outsource. Regulatory compliance has become stricter and demands lots of checks and balances on the risk appetite of banks and eventually, the banks are responsible to comply. Hence, banks must know that what they are outsourcing in view of the business compliance requirements.

We see a lot of fraud happening in India and people are now hesitant to use mobile wallet apps. There are reported cases where people have lost their life savings through wallet fraud. Do you think it is a weakness of the technology and poor security controls or is it just a lack of awareness and alertness?

Well, frauds can happen because of two reasons. One, there is a technical flaw, which the customer is not aware of, but a fraudster or hacker exploits it and uses it to commit frauds. Second, the customers knowingly or unknowingly give away credentials to fraudsters which are used later to commit fraudulent activities.

When a customer goes to an ATM and his card is skimmed, he will never come to know of it. He has just done the transaction as he has been doing. Later, his card gets used fraudulently. So, here the customer is not involved. But that’s not the case in all type of channels. Let’s take an example of UPI. In UPI or any mobile wallet based on UPI, there are three layers of security, which cannot be compromised technically.

All frauds happening today on UPI are not because of a technical flaw but because of the customers’ unawareness. Unless a customer shares some information to a fraudster, one cannot just compromise an account. It is just impossible. With my experience after investigating so many frauds in my previous role, I have concluded that no UPI frauds are happening today without the customers’ involvement. In my view, 80% of fraud in India, especially in this segment of mobile and UPI happen out of greed. Customers often get calls like – you have got a bonus; you have got PF (Provident Fund); you have got some LIC policy which you had started two years ago; or you have got some reward. So, you know, all this is out of greed and people are giving information to fraudsters.

20% of frauds are happening because of fear like – your account is going to be blocked or account will be deactivated unless some amount is paid. All this is because of the fear that is being created. Eventually, it is social engineering that is used successfully by fraudsters and customers are falling prey to it. When the customer shares all the credentials, shared OTP, received fraud SMS, clicked a link somewhere which they received on WhatsApp or email or SMS which have been redirected to a Google form which asks the customers to fill in details such as – name, mobile number, card number, expiry date, CVV, OTP, everything. If the customers fill up this form, no technology can safeguard them. However, I am not saying that technology is 100% fool proof. It could be possible that some or the other flaw may be detected. But the current platform is much secure compared to any other products.

What are the initiatives taken by the regulator and the Indian authorities to address wallet fraud?

There is continuous improvement happening in all aspects. RBI has now formed a fraud data repository in which banks need to compulsorily report frauds, which can be used for analytics purpose and some action can be taken to overcome them. Banks are now investing in resources for the real-time monitoring of fraud. We have a solution for the real-time fraud monitoring – Memento – which many banks have implemented or are in the process to implement in India. This can successfully predict the probability of frauds before the accounts are debited. Banks are investing in these kinds of innovative products. We are also helping our customers, those who are availing services from FIS, to invest not only in technology but also in people and services. So, together we can provide them with some experts and technology to solve this fraud mania. A lot of innovation is happening by banks, by regulators and by leaders like us in terms of fraud prevention.

With the current WFH situation and moratorium announcement by the RBI, there have been reports on the surge in attacks on several fronts. What are the key things to keep in mind to mitigate frauds?

I think there are no credible data available, as of now, which can confirm that there is a significant increase in the number of attacks. But, from the informal sources and going by the trend that I have been following, there is an increase in the number of cyberattacks. But eventually what will happen is that they will come in light only when people come back to the office, brainstorm, analyse the data and compare it with pre and post-Corona situation.

Only then we will have the real statistics about the increase. There are two parts to it. One, for sure, is that while we all know maximum people are working from home, it is too difficult to replicate the same controlled environment of working from the office. So, there is a possibility where some or the other weak control may be exploited by the fraudsters, resulting in damage. Fortunately, no such events have been reported so far. But there could be a remote possibility because the level of control varies from work from home than in the organization. Probably the critical infrastructure and the big organizations are having adequate controls, but they may want to enhance the controls than what it is right now.

The second is on the consumer side. There are many frauds reported especially with the announcement of the moratorium of loans. And it is a universal fact that fraudsters are always much ahead of us. The day moratorium was announced, people started selling false products, asking people for their card details, account details, OTP and everything. There is greed, as I mentioned earlier. Customers give everything without knowing that there is no need to give username and password of net banking accounts to avail moratorium benefits. There are multiple cases of this new modus operandi in this moratorium and fraudsters have duped people with the false information that RBI has announced three months but they can extend the time up to another three months.

Customers are asked to pay some amount which the fraudsters get. Again, it is not an account taking over. But you know if I am paying, let’s say INR 2 lakh a month (approximately US$2,633.44), and INR 6 lakh for three months (approximately US$7,900.64), instead of that I am going to save INR 12 lakh for six months (approximately US$15,801.28), I might not mind giving INR 10000 (approximately US$131.683) to a guy who is offering me a six months ease of payment.

People have paid money to fraudsters in such cases where they get an extension in the moratorium for six months. Several such things are happening and unfortunately, people are falling into the trap of fraudsters. But again, my take on this is that greed and fear are the biggest reasons. Customers need to act wisely. There is no bank anywhere in the world that will ask for username and password ever, for any reason whatsoever. This message must go to the customer and that is how one can prevent frauds.

How will the world be after this COVID-19 phase? What do you expect to be different in a post-lockdown world?

I think the service culture must change significantly post the COVID-19 situation, because the way we used to analyse risk in terms of various scenarios and various probabilities, has gone for a toss completely.

Because, for example, we used to have business continuity from city to city and country to country. But nobody ever thought that the whole world will be shut for so many days. So that has changed completely. We never envisaged that not more than 1 or 2% people will work from home if there is a demand and remaining will be available. The situation has completely reversed. Only 1 or 2% of the people are working in the office and 98% are working from home. This invites many new risks. And therefore, these were never thought of.

From a credit perspective, whatever business proposition we did about receivables has gone for a toss, which has impacted other liquidity issues. Because at no point of time did anyone envisage a lockdown for three or four months down the line. I believe it is the time where we, the risk professionals, must think for complete different risk scenarios in the future because of newer risks which were never ever thought of, have emerged. A newer risk covering product may come from the insurance side with new risk modelling or risk analytics models for banking may completely change for the aforementioned scenarios.

Newer services and newer methods will be identified because the world has changed significantly right now and that will impact the ability of risk managers to see things differently and control those in the time ahead. So that is something which is very, very important from the risk side.

Augustin Kurian is a Senior Feature Writer and part of the editorial team at CISO MAG. He writes news features on cybersecurity trends.

Now Patched! Vulnerabilities in Newsletter Plugin Affect Over 300,000 Sites

Cybercriminals Tried to Access Database Logins of 1.3 Mn WordPress Sites

The threat intelligence team from cybersecurity firm Wordfence, urged users of WordPress sites to update their installations to defend against threat actors who are trying to exploit vulnerabilities  in WordPress plugins. The plugin vulnerabilities are now fixed.

Rated as medium and high severity issues, the two flaws “Reflected Cross-Site Scripting (XSS)” and “PHP Object Injection”  were found in the Newsletter WordPress plugin, which has over 300,000 installations. If exploited successfully, the vulnerabilities may allow hackers to create backdoors, add rogue admins, or take control over the website, affecting around 300,000 sites. Wordfence advised users to fix the vulnerabilities by updating them with the latest version 6.8.3.

Reflected Cross-Site Scripting Flaw

The Cross-Site Scripting (XSS) vulnerabilities are used to take over a website if an administrator accesses a page on their site containing a malicious JavaScript. An attacker can trick a victim into clicking a specially crafted link to make changes to a site.

Exploiting a Reflected XSS vulnerability usually relies on an attacker tricking their victim into clicking a malicious link which sends the victim to the vulnerable site along with a malicious payload. This can be done in a number of ways, but it is common to first link to an intermediate site controlled by the attacker, which then sends a request containing a malicious payload to the vulnerable site on behalf of the victim     

–    researchers explained. 

PHP Object Injection Vulnerability

Attackers use the PHP Object Injection flaw to inject a PHP object that might be processed by code from another plugin or theme. It is used to execute arbitrary code, upload files, or other tactics that could lead to website takeover.

The researchers strongly recommended users to update to the latest version of the Newsletter plugin to avoid any intrusions.

Hackers Target 1.3 Mn WordPress websites

Recently, security experts discovered that cybercriminals targeted around 1.3 million WordPress websites in a single day to steal database login credentials. It is found that hackers tried to steal config files by exploiting known XSS vulnerabilities in WordPress plugins and themes. The attackers tried to download the wp-config.php WordPress configuration file, which contains connection details, authentication unique keys, and salts along with database credentials. In case attackers successfully exploited any vulnerable plugins used by the targeted sites, they could easily steal login credentials from the databases and take control over the websites.

 

1...184185186...410Page 185 of 410