Security researchers from Kaspersky found that cybercriminals are using thousands of inactive domains to redirect users to malicious URLs. According to Kaspersky, cybercriminals kept 1,000 inactive websites for sale on auction platforms, which redirected the visitors to over 2500 malicious URLs. The URLs were designed to automatically download the “Shlayer Trojan,” a malware that tries to steal information from macOS computers. Between March 2019 to February 2020, 89% of these unwanted domains redirected users to ad-related pages and 11% redirected to malicious sites that contained a malicious script.
“We noticed that from time to time visitors who initially went to the now inactive website of the app developer did not land on the auction stub, but on a malicious resource. Next, we learned that the stub site redirects visitors not to a specific resource, but to different websites, including ones on partner networks. The type of redirect can vary depending on the country and user agent: When accessing from a macOS device, the victim might land on a page that downloads the Shlayer Trojan,” the researchers said.
“We checked the list of addresses from which Shlayer was downloaded and found that the vast majority of domain names had been put up for auction on the same trading platform. Then we decided to check the requests to the resource that Razor Enhanced users got redirected to, and found that around 100 other stubs on this trading platform sent their visitors to the same address. During the study, we found about 1,000 of these pages in total, but the real figure is probably much higher,” the researchers added. While the attackers behind this malicious campaign are unknown, researchers said that it can be an act of a well-organized network for financial gains.
Risks with Malicious URLs
Opening or downloading malicious links or attachments could result in severe security issues. A research from security firm NetMotion revealed that cyberthreats soared as remote workers visited risky websites outside of corporate networks. The analysis found that remote employees clicked on 76,440 links that redirected them to malicious websites. NetMotion highlighted that they collected a sample of network traffic data to find users who accessed blocked URLs or risky content. All these sites were visited on office laptops while working from home via home or public Wi-Fi or a data network.
Google Cloud Next ’20: OnAir kicked off today and Google announced new solutions across its smart data analytics and security portfolios, to help accelerate customers’ ability to digitally transform with cloud computing. The announcements concerning cloud security and compliance include a new Confidential Computing portfolio and Assured Workloads for Governments.
Analysis and reporting by Brian Pereira, Principal Editor, CISO MAG
Google Cloud Next ’20: OnAir is a free, nine-week, in-depth digital event series starting July 14. It will have over 200 sessions ranging from compelling keynotes from industry luminaries to advanced learning opportunities with top Google developers.
Confidential Computing protects sensitive data
A major concern for enterprises is how to process sensitive data while keeping it private. To get around this, Google Cloud encrypts data-at-rest and in-transit. But customer data must be decrypted for processing, opening up a possibility of a confidentiality breach. That concern may have just been addressed with Confidential Computing, which Google believes is a “breakthrough technology.”
Confidential Computing encrypts data in-use — while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU). Google says this technology will transform the way organizations process data in the cloud, maintain control over their data, and preserve confidentiality.
Confidential VMs is the first product in Google Cloud’s Confidential Computing portfolio. Google Cloud already employs a variety of isolation and sandboxing techniques as part of its cloud infrastructure to help make its multi-tenant architecture secure. Confidential VMs, now in beta, take this to the next level by offering memory encryption so that customers can further isolate workloads in the cloud.
Confidential VMs are available on AMD CPUs and take advantage of the secure encrypted virtualization supported by 2nd Gen AMD EPYC CPUs.
“Customers across all industries are navigating the complexities of compliance and privacy in the cloud, especially those in regulated industries, such as financial services firms, health care companies, and government agencies,” said Sunil Potti, General Manager and VP of Security at Google Cloud. “These companies want to adopt the latest cloud technologies, but strict requirements for data privacy or compliance are often barriers. Confidential VMs will help us better serve customers in these industries, so they can securely take advantage of the innovation of the cloud while also simplifying security operations.”
Thomas Kurian, CEO, Google Cloud
Delivering the keynote address at Google Cloud Next ’20: OnAir, Thomas Kurian, CEO, Google Cloud said Confidential Computing will ensure that Google’s customer data is not only encrypted at rest or in transit but also while it is being processed.
Kurian said Google has also developed other solutions to protect customer data and to give threat visibility – for intrusion monitoring and for zero trust access to apps that are web-based and which reside on Google cloud and on other clouds.
Assured Workloads for Governments
Google is also introducing Assured Workloads for Government, which is currently in Private Beta. Google says the product will help serve government workloads without the compromises of traditional “government clouds.” This service simplifies the compliance configuration process and provides seamless platform compatibility between government and commercial cloud environments.
In a virtual press briefing held last week, Google spokespersons said Assured Workloads for Governments will first be launched for the US Government and later be extended to other global governments.
Google Cloud CEO, Thomas Kurian said during his keynote that (in the near future because it is still in beta) Assured Workloads will ensure those customer workloads on Google Cloud will automatically comply with industry standards and also with the organization’s own security policies.
CISO MAG interprets this as “compliance by default” though we are unsure how Google is going to enable that. Every industry has specific standards in addition to the region-wise standards like GDPR. We also asked Google Cloud a question about future compliance with India’s forthcoming Personal Data Protection Act (PDPA) and are awaiting a response.
For now, it seems Google is only focusing on the Government for Assured Workloads, and that too only in the U.S.
In a blog post, Christopher Johnson, Security & Product Manager, Google Cloud and Bhavna Batra, Trust & Compliance PMM, Google Cloud wrote: “With Assured Workloads for Government, Google Cloud customers can quickly and easily create controlled environments where U.S. data location and personnel access controls are automatically enforced in any of our U.S. cloud regions. Assured Workloads for Government helps government customers, suppliers, and contractors to meet the high security and compliance standards set forth by the Department of Defense (i.e., IL4), the FBI’s Criminal Justice Information Services Division (CJIS), and the Federal Risk and Authorization Management Program (FedRAMP), while still having access to all the latest features in our portfolio.”
New BigQuery Omni solution enables data analysis across cloud platforms
It is now common to see enterprise workloads across multiple clouds, on-premises, and on proprietary systems. This results in siloed data stored across these clouds and a major challenge is analyzing this data for business insights. The data needs to be consolidated into a common resource pool such as a data lake before it can be processed or analyzed. Google just solved this problem with its new BigQuery Omni solution.
Google says BigQuery Omni is a multi-cloud analytics solution that enables customers to bring the power of BigQuery to data stored in Google Cloud, Amazon Web Services (AWS) and Azure (coming soon).
Google Cloud CEO, Thomas Kurian said BigQuery Omni enables customers to query their data on other clouds like AWS and Azure. “We bring the power of Big Query Analytics to where your data sits without the need to pay expensive Egress fees for moving that data from other cloud providers to Google Cloud,” said Kurian.
He also mentioned that Streaming Analytics can support 100 parallel streams in Big Query.
Powered by Google Cloud’s Anthos, BigQuery Omni will allow customers to connect directly to their data across Google Cloud, AWS and Azure for analysis without having to move or copy datasets. Through a single user interface, customers will be able to analyze data in the region where it is stored, providing a unified analytics experience.
“For customers, moving data across different clouds is both cumbersome and expensive. To address this, we continue to invest in multi-cloud in an effort to democratize access to the best technologies for our customers, no matter what cloud provider they’re using today,” said Debanjan Saha, General Manager of Data Analytics, Google Cloud. “BigQuery Omni provides enterprises with the openness and portability they need to break down silos and create actionable business insights, all without having to pay expensive egress fees for moving data from other cloud providers to Google Cloud.”
Our Analysis
These new products (especially Confidential VMs) will bring more confidence to organizations who are skeptical about data privacy and compliance on the cloud. Compliance with industry standards is especially important to regulated industries like banking, insurance, telecom, and health care. We feel Assured Workloads is crucial for governments who are facing increasing attacks on their infrastructure by hackers from enemy nations through cyber warfare. But Google says the product is in “private beta” now so we will have to wait for it.
Three years ago, on July 14, 2017, we launched CISO MAG with a vision to report unbiased and authentic news to information security professionals working in critical sectors to help them prevent, respond to, and counter security challenges. Ever since then, it has been a journey of publishing that can’t be explained in mere words — years of anxiety, toil, long hours, and sleepless nights. But it has all been worth it!
Within the year of its inception, CISO MAG crossed 50,000 readers across 100 countries, which just continued to grow. It was then that it became clear— there was no looking back.
In the last three years, a lot changed. We grew bigger as a team; we came up with newer initiatives. We interviewed hundreds of security leaders and built a solid community of C-level executives in the information security domain. We tackled every hurdle that was thrown at us, and we continued to march forward as a team. Even when the pandemic hit us, and the world stalled, we continued to do what we do best. And eventually, we became what we aspired to be — the voice of the cybersecurity industry.
There are a few things that haven’t changed: our dedication, outrageous persistence and journalistic ethics to bring out a better cybersecurity e-magazine, issue after issue, and to keep our audience updated about every major cybersecurity incident happening across the globe.
We also took to our self the responsibility of introducing a few of the biggest names in cybersecurity to our readers—including the likes of Brian Krebs, Rik Ferguson, and few more who would soon make their appearance.
This year, the e-magazine was completely redesigned for a contemporary look that is appealing to our readers. The CISO MAG website would also have a bold new design this year. In addition, we would be establishing a community and board for those who contribute articles on a regular basis.
Since people enjoy content in different forms and video being the most consumed content globally, we introduced webinars to drive a wider engagement and educate the attendees about the happenings in the cyberspace. The visual interactive sessions, surveys, live Q&A have enabled us to have a diverse audience and more opportunities to connect with industry professionals.
We conducted webinars with high profile personalities, including:
Bryan Ware, Assistant Director for Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), Department of Homeland Security (DHS)
Chris Roberts, Researcher, Hacker and CISO
Erdal Ozkaya, Regional CISO at a Global Bank
Thomas Tschersich, Chief Security Officer (CSO) Deutsche Telekom
CISO MAG editors are on track to produce four Market Research reports this year:
Network Security
Cloud Security
Data Security
Endpoint Security
The credit for whatever CISO MAG has achieved in the last three years goes to an executive contributor panel comprising of a few of the best cybersecurity experts in the world. And the rest and most of it goes a bunch of hard-working professional staff of CISO MAG who are always looking at outdoing themselves to improve the content, its quality and reach daily.
Last but not the least, we would like to earnestly thank you — the readers of CISO MAG — for your interest. It has been your continued feedback that has enabled us to get better year by year. Please keep sending us your feedback and ideas. We would always be profoundly indebted to you.
We will continue to carry the torch that guides every stakeholder of safe internet.
Cheers to the years that have gone by! Cheers to the years to come!
A recent survey from cybersecurity firm Bitdefender revealed that nearly 50% of infosec professionals admitted that their organization doesn’t have a contingency plan to handle a situation like COVID-19 or a similar. In the survey “the Indelible Impact Of Covid-19 On Cybersecurity” 86% of respondents stated that cyberattacks were on the rise during the pandemic.
The survey also highlighted that supply chain attacks, cyberwarfare, and IoT attacks increased by 38%, followed by ransomware attacks by 31% and DDoS attacks by 36%. 2 in 5 organizations said that their employees were using untrusted networks and 38% reported there is a definitive risk in another person having access to an employee company device. Financial services (43%), healthcare (34%), and the public sector (29%) were the most affected by cybersecurity risks at the moment.
“As a result of the increase in home working, many changes have been made to security strategies. Yet, despite their fears of a rise in attacks, only 14% have invested a significant amount of money in upgrading security stacks, 12% have bought additional cybersecurity insurance, and only 11% have implemented a zero trust policy — all of which indicates more changes are still to be made,” the report said.
“The pandemic has provided a valuable opportunity to infosec professionals to learn how to tackle changes in workforce patterns, and how to plan for unexpected events. One in three infosec professionals (31%) say they intend to keep 24/7 IT support, and will increase the number of training sessions in IT security for employees. Almost a quarter (23%) have also cited that they are going to increase the cooperation with key business stakeholders when defining cybersecurity policies, and an equal percentage will increase outsourcing IT security expertise,” the report added.
Remote Work Threatens Businesses
A similar study from HiveIO revealed that nearly 85% of organizations anticipate a larger remote workforce will threaten operations because of new risks. “The IT departments are working at a deficit in their ability to support and maintain business continuity while optimizing IT support,” the report said. The study stated that several organizations are unable to introduce new security solutions designed to improve the efficiency of work-from-home employees. Around 70% of respondents admitted that they have suffered increased costs due to the ongoing pandemic. And 25% of respondents reported shrinking staff support and another 18% fear additional staff reductions.
A survey on the current state of security operations center (SOC) performance revealed that even though organizations have increased their cybersecurity budget on SOC, the overall results are not satisfactory. It is found that the average annual cybersecurity budget for organizations rose $6 million to $31 million, with the SOC representing one-third of that total.
According to the survey, jointly conducted by Devo Technology and Ponemon Institute, 72% of IT security practitioners in organizations with a SOC classify the unit as essential or very important to their organization’s cybersecurity strategy. However, 1 in 6 (60%) of SOC team members are considering changing their careers due to stress associated with the current field.
The survey also highlighted that high-performing teams have led strong business consensus, with 73% of SOC objectives aligned with business objectives, versus low performers for whom 63% have no alignment at all. The three major actions for organizations to relieve SOC analyst pain are greater workflow automation (71%), implementing advanced analytics/machine learning (63%), and access to more out-of-the-box content (55%).
70% suffer a lack of visibility into the IT infrastructure
64% combat turf issues between IT and the SOC
While 76% say training/retention is highly important, more than 50% have no formal programs in place, and more than 50% cite the lack of skilled personnel as a major factor in SOC inefficiency
Mean time to response (MTTR) remains unacceptably high, with 39% saying their average time to resolve an incident is months or even years
71% need greater automation, especially as they continue to spend substantial manual cycles on tasks such as alert management (47%), evidence gathering (50%), and malware protection and defense (50%)
Environmental factors are driving substantially higher pain, including information overload (67%, up from 62%), burnout from increased workloads (75%, up from 73%) and complexity and chaos in the SOC (53%, up from 49%)
Not surprisingly, the perennial issue of a skills shortage (seen by more than 50% of respondents) is close to the heart of the issue.
Organizations have too many tools (nearly 40%), and more than half don’t have all the data necessary, nor the ability to capture actionable intelligence
“For respondents, whose organizations have invested in people, process, and technology, the performance differences are stark. Strong business alignment (73%) and extensive training (67%) help high-performing SOCs more than double the effectiveness of their lower-performing brethren. However, the pain and barriers facing SOC teams are universal and worsening, with higher performers citing 10% more pain at an extreme level (9-10 on a 10-point scale), and virtually no difference in the level below that (7-8),” the survey stated.
The survey findings are based on the responses from 585 IT and IT security practitioners in organizations that have a SOC and aware of their organizations’ cybersecurity practices.
Threat intelligence firm Cyble discovered that personal records of U.S. citizens were exposed on darknet forums. The researchers stated that an unknown hacker posted an advertisement on the dark web claiming that they had stolen personal details of more than 40,000 U.S. citizens. The exposed information included citizens’ first names, last names, address, city, state, Zip codes, social security numbers (SSNs), and date of birth.
Image Source: Cyble
Cyble’s researchers also recommended certain security measures to online users, these include:
Never share personal information, including financial information over the phone, email, or SMS
Use strong passwords and enforce multi-factor authentication where possible
Regularly monitor your financial transaction, if you notice any suspicious transaction, contact your bank immediately
Turn-on automatic software update feature on your computer, mobile and other connected devices where possible and pragmatic
Use a reputed anti-virus and internet security software package on your connected devices including PC, laptop, and smartphone
Stolen Data Floods Darknet
The discovery comes after Cyble recently identified and reported another massive data breach, in which the members of the “Shiny Hunters” hacking group compromised 73.2 million user records from over 11 companies and kept them on the darknet for sale. The hackers are from the same group who are behind the Tokopedia data breach, in which 91 million user records were compromised and kept on sale on the hacking forums for $5,000. Later, the group breached India-based online learning platform Unacademy, which exposed details of 22 million users and kept the records for sale on the darknet forums for $2,000.
Several incidents have been reported in recent times about hackers selling stolen information on the darknet markets. According to Cyble, attackers were also selling over 267 million Facebook records for £500 (US$623) on dark websites and hacker forums. The records contain information that could allow attackers to perform spear phishing or SMS attacks to steal credentials.
The MGM Resorts, in February 2020, reported a data breach that affected nearly 10.6 million of its guests. The company took help of two cybersecurity firms to probe the incident and correspondingly beefed-up the security lines to avoid such breaches in the future. However, it was recently discovered that a cybercriminal is selling details of 142,479,937 MGM Resorts’ guests, which might have been originally leaked during the first MGM Resorts data breach that took place in the summer of 2019. The offer price of this data on the dark web is placed at $2,939.76.
The Story So Far…
The actual data breach took place in July 2019.
MGM notified its guests about the data breach in August 2019.
The cause of the original data breach was traced back to a misconfigured cloud server.
10.6 million guest details including names, date of birth, email addresses, phone numbers, etc., were compromised as per MGM’s statement.
No reports of loss of financial data like payment card information or password information.
In February 2020, MGM officially confirmed details about the 2019 data breach after these records appeared as a free download on an underground forum.
In July 2020, 142 million MGM Resorts’ guest details appear for sale on the dark web for a price of $2,939.
The cybercriminal behind this latest sale has claimed to have obtained the MGM Resorts data after he recently carried out a data breach against DataViper, a data leak monitoring service of Night Lion Security. Although the compromised data does not involve any financial details and/or personal IDs like the SSN (social security number) or license and passport numbers, it would be wise for MGM customers to take the following as precautionary measures:
Change all passwords of accounts related to MGM resorts bookings.
Set up a credit monitoring service if you do not have one.
Beware of phishing and smishing attacks.
Be vigilant and report any suspicious activity to the authorities concerned.
Keep a track of all the records and communications between MGM and yourself. This could potentially be very useful in case of filing a class-action lawsuit.
In the last two decades, the cybersecurity landscape has evolved, but security processes and controls have failed to integrate quality outside — in view of new cyberthreats and risks. Cyberthreat intelligence is an increasingly overused terminology, confusing the industry and blurring the lines between information and quality intelligence. This is where CYFIRMA steps in.
By Mihir Bagwe, Technical Writer, CISO MAG
CYFIRMA is a cyberthreat intelligence analytics platform company with a flagship product called DeCYFIR. This product is designed using Artificial Intelligence and Machine Learning (AI/ML) to provide real-time insights, threat visibility, and situational awareness to prevent business losses. It helps organizations discover and decode unknown cyberthreats and mitigate potential risks. The platform aggregates, correlates and analyzes information from the open and dark web, to effectively identify and process potential threats at the planning stage of a cyberattack. It provides deep insights into the cyberthreat landscape, and amplifies the preparedness of organizations by providing relevant, predictive, and prioritized cyberthreat visibility and intelligence.
The predictive capability of the platform gives organizations deep insights that correlate data to form a threat story, providing context to every threat, increasing the accuracy of threat alerts, and helping clients prioritize resources for cyberattack prevention. It also equips organizations with a multi-layered approach to cybersecurity and helps form strategic, management, and tactical viewpoints.
A Company to Watch
The company’s growth and service offerings depend mainly on the leadership, guidance, and mentoring of its C-suite, and CYFIRMA has got the perfect piece to fit in this puzzle. CYFIRMA’s Chairman and CEO, Kumar Ritesh, has over two decades of experience in global cybersecurity leadership and has various certifications including PMP, CISSP, CISM, CISSP-ISSAP, TOGAF 9.1, CIPM, and CIPT, among others, to back his knowledge and skill set. He is a highly dynamic executive displaying a high grade of technological acumen and business skills, along with a strong track record of developing successful cybersecurity strategies, products, policies, standards, and solutions.
His resume also includes the development of prototypes for data loss prevention, social profile risk assessment, web content assessment management, intelligence-led cyber risk management, and adaptive cyberthreat intelligence tools.
Kumar Ritesh, CEO, CYFIRMA
“Cyberthreat intelligence is an increasingly overused terminology, confusing the industry and blurring the lines between information and quality intelligence. This is where CYFIRMA steps-in.”
Ritesh always observed that organizations struggled to understand the external threat landscape, as their cyber posture management was highly focused on internal protection, security controls, and building firewalls. This was proving ineffective, given that threat actors always kept modifying their approach, methodology, and techniques. A productized offering was needed to help organizations consume multi-dimensional intelligence driven by deep technology —thereby making cyber posture management efficient and effective.
CYFIRMA’s clients are exclusively provided with:
Client-tailored and customized Outside-in/Hacker’s view of the cyberthreat landscape.
Multi-dimensional strategic, management and tactical cyberthreat visibility and intelligence.
Threat indicators at the planning stage versus the execution and exploitation phase of a cyberattack.
Indicator centered threat hunting capabilities, which could be as simple as a conversation or geo-political issue driving the cyberthreats and risks.
An ability to integrate intelligence and insight into risk management, cyber posture management, and regulatory, compliance, governance, investment, and resource management.
Deeper analytical insights into situational awareness, cyberattacks and events, incidents, vulnerabilities, technology, or regulatory shift.
CYFIRMA has a team of highly experienced professionals with rich expertise in the cybersecurity domain along with AI and ML, among others. We believe CYFIRMA is the company to watch out for in 2020, especially with its core product DeCYFIR, which is being upgraded.
Seed Funding: Total investment in US$3million, as part of Antuit Group, CYFIRMA was Incubated since 2017
List of investors: Goldman Sachs, Zodius Capital
Lead Investor: Goldman Sachs
Series A Funding: Total investment in Series A, US$5 million.
List of investors: Goldman Sachs and Zodius Capital
Lead Investor: Goldman Sachs
Awards
CYFIRMA was selected as “Most valuable brand of 2019” by prestigious journal IndustryWired
Recognized in Aspioneer’s “10 Most Trusted Cybersecurity Solution Providers, 2019”
Selected in the list of “Top 25 cybersecurity companies – 2019” by CIO Applications
CYFIRMA is Featured in ICE71’s latest Singapore Cybersecurity Startup Map
Acclaimed as one of the “Top 10 Artificial Intelligence-Driven Solution Provider 2019” by Enterprise Security amongst 230 competitors
Listed in the prestigious Cyber Startup Observatory – US CyberSlide, APAC CyberSlide, Singapore CyberSlide and Japan CyberSlide
Named in APAC Business Headlines Magazine’s “10 Sought After Risk Management Solution Providers in 2019”
Industry-wise Services
Defense & Security
Manufacturing
Health care
Travel & Hospitality
Retail
PRODUCTS & SERVICES
Offerings
CYFIRMA’s proprietary and award-winning cloud-based Cyber Intelligence Analytics Platform essentially provides the following:
Broad range of cyber intelligence use cases
Real-time multi-layered intelligence
Early threat visibility
Holistic cyber situational insights
Cyber trending and current landscape
Deeper analysis and research
An illustrative dashboard
The following core DeCYFIR modules drive the consumption of CYFIRMA’s insights and intelligence:
Threat Visibility & Intelligence: Provides comprehensive multi-dimensional strategic, management and tactical intelligence and insight into the latest cyberthreats applicable to an organization, industry, and geography.
Cyber Awareness: Provides real-time cyber insights, trends, the latest cyber news, technology, and regulatory changes, emerging cyber-attacks, vulnerabilities, and exploits.
Cyber Incident Analytics: Enables analysis of malicious files and automatic correlation with threat landscape to present affiliations to any threat actors, campaigns, and indicators.
Besides these, CYFIRMA’s service offerings also include:
Daily Cyberthreat Intelligence reports
Weekly Security Updates
Cyber Education
Vulnerability Analytics
Brand/Individual Cyber Risk Monitoring and Cyber Risk Scoring
Company Timeline
About the Author
Mihir Bagwe is a Tech Writer and part of the editorial team at CISO MAG. He writes news features, technical blogs, and conducts interviews on latest cybersecurity technologies and trends.
With four months toward the Election Day, and several state-sponsored cyberattacks already targeting the 2020 election, cybersecurity has taken the center stage. The presumptive Democratic nominee for President, Joe Biden hired former White House cybersecurity official Chris DeRusha as the CISO for his election campaign and Jacky Chang as Chief Technology Officer.
DeRusha is a credible cybersecurity executive with experience in managing federal and state government programs, coordinating cybersecurity operations, and developing and implementing strategy and governance. Prior to this, he was an advisor to the White House and also held cybersecurity positions with the State of Michigan, the Department of Homeland Security, and Ford Motor Co. Chang was a senior engineer on Hillary Clinton’s 2016 presidential campaign and worked for the Democratic National Committee’s voter protection team during the 2018 midterms.
“Biden for President takes cybersecurity seriously and is proud to have hired high-quality personnel with a diverse breadth of experience, knowledge, and expertise to ensure our campaign remains secure,” the campaign said in a statement. “Jacky and Chris will be central to strengthening the infrastructure we’ve built to mitigate cyberthreats, bolster our voter protection efforts, and enhance the overall efficiency and security of the entire campaign.”
Even though elections have been at the forefront of cyberattacks, lately, the concept of a CISO for a campaign is still a novelty. This was even after Russian hackers exposed emails of Hillary Clinton in the 2016 elections.
The upcoming election has already witnessed a slew of cyberattacks targeted against it. A recent survey stressed that 70% of cybersecurity professionals most likely believe their local governments cannot defend election infrastructure against cyberattacks from domestic and foreign threat actors.
The majority of cyberattacks targeting election campaigns come from automated machines that inevitably spread information and direct attacks on the vote-counting systems. Industry experts opine that the ongoing pandemic brings additional security hurdles to the election season. It is suspected that cybercriminals might take advantage of the crisis to spread false information and initiate cyberattacks, making security experts concerned about election data protection.
“When we think about threats to the upcoming elections, I would break them up into two groups. For undermining the election, disinformation operations supported by cyber operations pose the greatest threat,” said Marcus Fowler, Former CIA executive, and currently Director of Strategic Threat at AI security firm Darktrace, in an exclusive interview with CISO MAG. “Adversaries looking to hack a campaign to get the upper hand will likely be going after the information that could reputationally damage a candidate. This is less about broad disruption or undermining trust, and more about swaying individual voters and out-maneuvering a campaign. One would hope that we don’t see this type of targeting between campaigns, as we have enough to worry about from foreign actors”
He added, “As for best practices, the most immediate step that needs to be taken is that state and federal agencies and municipalities need to review their processes and communication plans around a ransomware event, especially one conducted around the election that could have an impact on voting. I think State, Local, and Federal agencies need to be more strategic–resourcing their cybersecurity teams more efficiently and more in-line with the current threats, and leveraging technology that will help buy back time for their security teams through autonomous response and investigation.”
Dunzo, an India-based on-demand delivery provider app that has seen large investments from Google on the back of its top-notch services, reported a limited data breach that compromised its customer database. However, the breach has now been resolved and Dunzo has beefed up its security.
Mukund Jha, CTO of Dunzo, on Saturday, informed that an unauthorized access to its database had taken place potentially through a third-party service provider, which led to customer information compromise.
Things we know so far…
Threat actors initiated a breach through a third-party vendor of Dunzo
The data breach was only limited to user databases
User phone numbers and email addresses were compromised
No loss of payment information like credit card details was reported as per initial investigations
As per Mukund’s statement, Dunzo has always prioritized users’ data security and privacy and thus felt obligated to inform them about the immediate security safeguards implemented by the company post the data breach reporting.
Safeguarding steps taken
All networks and access points to Dunzo’s databases have been secured
All access tokens and passwords have been changed and updated
Security infrastructure has been upgraded and all potentially vulnerable ports are closed
All access privileges to network and system infrastructure have been reviewed and upgraded
All third-party plugins and integrations have been reviewed and upgraded
Logging and tracing have been further enhanced to monitor any suspicious activity
Data breach incidences can be complex and organizations handling customer data need to be doubly sure that no backdoors are present in the databases that will affect them in the future. Thus, Mukund said, “While our best teams are working on resolving and strengthening our security efforts, we’re also engaged with leading cybersecurity firms and experts to further strengthen these efforts. We are taking all necessary steps to resolve the security breach and will keep you updated if we know more.”
Ensuring that you get the best experience is our only purpose for using cookies. If you wish to continue, please accept. You are welcome to provide a controlled consent by visiting the cookie settings. For any further queries or information, please see our privacy policy.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
