Home Blog Page 195

7 in 10 Organizations Suffer Public Cloud Security Breach

July 9, 2020

Misconfigured Cloud Storage Services Led to Over 200 Breaches in Past Two Years

A cloud security survey by cybersecurity firm Sophos revealed that 70% of organizations suffered at least one public cloud security breach in 2019, including other security incidents like ransomware attacks (50%), compromised accounts (25%), exposed data (29%), and cryptojacking (17%).

The survey report titled “The State of Cloud Security 2020” stated that 50% of organizations that use multi-cloud environments are more likely to suffer a cloud security incident than those using a single cloud. Organizations in Europe were less affected by cloud security incidents due to the region’s existing GDPR law. While in India, nearly 93% of organizations were hit by an attack in the last year.

Misconfigurations Increase the Risks

Inadvertent database exposure continues to be a major risk for organizations, with misconfigurations exploited in 66% of reported attacks. Besides, 33% of organizations reported that attackers gained access through stolen cloud provider account credentials. A quarter of organizations stated that managing access to cloud accounts is a primary concern to them. Nearly 96% of respondents admitted that they face issues with their current level of cloud security, while 44% of respondents reported data breaches are the top security concern. Only 1 in 4 respondents stated lack of staff expertise as a top concern.

Chester Wisniewski, the Principal Research Scientist at Sophos, said, “Ransomware, not surprisingly, is one of the most widely reported cybercrimes in the public cloud. The most successful ransomware attacks include data in the public cloud and attackers are shifting their methods to target cloud environments that cripple necessary infrastructure and increase the likelihood of payment. The recent increase in remote working provides extra motivation to disable cloud infrastructure that is being relied on more than ever, so it is worrisome that many organizations still don’t understand their responsibility in securing cloud data and workloads. Cloud security is a shared responsibility, and organizations need to carefully manage and monitor cloud environments in order to stay one step ahead of determined attackers.”

The survey findings are based on the responses from more than 3,500 IT managers across 26 countries in Europe, the Americas, Asia Pacific, the Middle East, and Africa that currently host data and workloads in the public cloud.

Cloud Security Risks on Rise

A similar survey, “State of Cloud Security,” conducted by Fugue revealed that IT and cloud security professionals are concerned about the security of their cloud environments as several organizations working remotely. The survey found that 96% of cloud engineering teams are at present 100% working from home, while 83% of them completed the transition or are still in the process. It also found that 84% (who are making the shift) are concerned about security vulnerabilities created during the swift adoption of new access policies, networks, and devices used for managing cloud infrastructure remotely. The survey stressed that preventing cloud misconfiguration remains a challenge for cloud engineering and security teams, with 73% of them citing more than 10 incidents per day, 36% experiencing more than 100 per day, and 10% suffering more than 500 per day.

Surge in Cyberattacks Leaves Economic Impact on U.S. State and Local Governments

July 9, 2020

Cybersecurity meeting, Biden Administration and Tech Giants, Zero-Trust Model

A survey report from KnowBe4, a provider of security awareness training for social engineering, spear phishing and ransomware attacks, revealed that rising ransomware attacks on municipalities continue to impact state and local governments across the U.S.

In its report “The Economic Impact of Cyberattacks on Municipalities”, KnowBe4 stated that ransomware attacks are becoming a costly affair, and the ransom paid per event in municipalities from 2017 to 2020 was $125,6971. Ransomware attacks not only leave a financial impact, but also result in break of trust and confidence of citizens and stakeholders. The survey broke down the economic impact into five target areas: the average financial loss from state and local governments, the denial of service to citizens due to financial loss, the frequency and the risk of recurring attacks, the challenge of allocating capital to prevent attacks, and the decline of economic investment in municipalities.

Other findings from the survey report include:

Ransomware attacks can cause significant downtime and denial of critical community services, such as healthcare and law enforcement. The analysis revealed that the average downtime that results from a ransomware attack is 9.6 days.
Attacks on local government have risen significantly. In the single year between 2018 and 2019, known attacks on local governments rose 58.5%.
Government officials’ awareness level of the need for cybersecurity is low. 48% of elected councilors and/or commissioners are either slightly aware or do not know the extent of the need for cybersecurity measures in the community.

A lack of understanding exists for how cyberattacks occur and how to mitigate them. 53.3% of local government institutions do not keep track of their cyberattacks. Stu Sjouwerman, CEO, KnowBe4, said, “State and local government entities are often operating on tight budgets and cannot afford to be hit with ransomware. We have found that municipalities are struggling to keep up with the barrage of frequent cyberattacks and although significant, the impact goes beyond financial implications. Critical services such as health care and law enforcement would be put in a very difficult situation if their services went down for any period of time, which is why it’s so important to train all employees, especially those working in municipalities, to help prevent cyberattacks.”

Lack of funding for cybersecurity initiatives is a pressing issue because without initiatives like cybersecurity awareness training, municipalities are vulnerable to social engineering attacks – which in turn could expose an entire database of sensitive information to threat actors.

Curtains down on CISO MAG’s Middle East CISO Forum

July 9, 2020

The Middle East region has often been quick to embrace emerging technologies and comprehensive countermeasures to fortify its cybersecurity prowess. The scenario was not very different even during the time of the COVID-19 pandemic. With the heightened need for Work from Home protocols, vulnerabilities in the remote-working space also increased manifold. To address the cyberthreats emerging from several newer vectors and to bring several thought leaders and cybersecurity stalwarts together to discuss the new normal, CISO MAG recently hosted the Middle East CISO Forum. Unlike the earlier CISO MAG’s Middle East CISO Summits, this event took a virtual format to create awareness on the need for cybersecurity and its related implications in the times of a pandemic.

The Middle East CISO Forum also brought forth a dynamic mix of senior cybersecurity experts to deliver real insights on how to redefine security frameworks and efficiently mitigate cyberthreats to an audience comprising of CEOs, CIOs, CTOs, CSOs, CISOs, CDOs, SVP, VP, Directors, IT Security Advisors, Ethical Hackers, Head of Planning, Governance, Risk, Head of SCADA, Head of Automation, Smart Grids, Digital Oilfields, ICT, IT Auditors, Information Security Managers and IT Consultants from several countries across the world.

The Forum began with a special address by Dr. Sohail Munir, Advisor – Emerging Technologies and Digital Innovation, Smart Dubai Government on AI, Blockchain, Cloud – Cyberthreats, and opportunities. Sohail Munir is the Advisor for Emerging Technologies and Digital Transformation at Smart Dubai Government. He is a seasoned industry professional with over 23 years of Program Management experience in the space of GovTech, Smart City, Safe City, Digital Transformation, Digital ID, C4I Systems, and FinTech. Munir’s current R&D interests are in the space of Digital Government Transformation using Blockchain, IoT, Cloud Computing, Software Defined Networking, Data Analytics, AI, and Machine Learning. In his address,a he stressed on three key areas to leverage AI, Blockchain, and Cloud. These include: Protect AI-powered systems: Secure AI training data, training pipelines and ML models; AI to enhance cybersecurity defense: Use ML to understand patterns, uncover attacks and automate aspects of cybersecurity processes, while augmenting the actions of human security analysts; and Adversarial AI: Identifying attacks and defending against them will be an important addition to the cybersecurity role.

This was followed by a technical address by Dr. Moataz Binali, Vice President, Trend Micro, Middle East & North Africa, which focused on Securing the Digital Transformation for MENA Region. In his address, he stressed on how 2 out top 5 biggest risks to businesses in MENA are cybersecurity-related. He also highlighted global practices to implement a cybersecurity strategy fit for digital transformation. These included Connected Threat Defense, Hybrid Cloud Security, XDR (anything detection & response), XGEN (cross generational threat defense), and Virtual Patching. As Vice President for Trend Micro Middle East and North Africa (MENA), Dr. Binali is responsible for spearheading the company’s strategy across the region, and advancing its position as a leader in cybersecurity that is passionate to make the world safe for exchanging digital information.

The following technical address was by Ray Kafity, Vice President, Middle East Turkey and Africa (META), Attivo Networks. Kafity possesses rich experience in sales and marketing management of high-tech solutions. He also has an extensive industry experience in broadband telecommunications, internet acceleration through caching appliances, internet/web content security networks, and application acceleration, and various cybersecurity prevention and detection solutions. His address focused on Cyber Deception & MITRE ATT&CK Framework for Advanced Cyber Threat Detection and Response.

It was followed by a special address by Eng. Meshal Abdulla BinHussain, Information Technology Director, Ministry of Finance, UAE. His address focused on cyber threats looming in cyber space. According to him, “Current threat environments of cyber space shall revise and redefine the accurate and relevant policies and processes to Identify, investigate and thwart cyberattacks, share the intel with community and secure the computer networks. The nature of threats may not be considered as simple, but maybe targeting to inflict strategic & economic impact on entities.” He added, “Multitude of cybercriminals are targeting computer systems as cybersecurity is changing. Cybercrime has become established and sophisticated. This makes it easier since we live in a data-driven and connected era where Big Data and the Internet of Things are increasingly leveraged across entities.” According to him, the key strategies to overcome these threat vectors include: Define a country-wide Cybersecurity Strategy with clear directions and objectives, Cover the gaps in existing legislation to ensure judicial support, Involvement of top management of Entities in Cyber Defense, and Create an authorized Community of Cyber Security Professionals & Entities against Cyber Attack by governing authorities.

BinHussain’s session was followed by a technical address by Rani Hmayssi, Regional Manager, Google Cloud MENA, in which he spoke on Cloud Security for the Modern CISO. He followed a timeline of event starting from the outbreak of the Coronavirus, its effect on consumers around the world, the plummeting stock market, and the increased remote working scenarios. He went on to differentiate between the new normal which can both be an obstacle and an accelerator. He also stressed on how Google Cloud has been an enabler for WFH. He also spoke on the zero-trust model as well as methods for solving security data overload. Hmayssi currently leads Google Cloud’s security presence in the Middle East and helps organizations achieve their digital transformation objectives using Cloud and AI.

The session was followed by the highlight of the Forum, which was the Panel discussion on Addressing New Cybersecurity Blind Spots – Leveraging AI and ML. The session was moderated by Dr. Erdal Ozkaya, Managing Director & Regional CISO, Standard Chartered Bank (UAE). The panelists of the discussion were Sultan Altukhaim, Director, Information Security Department (CISO), Risk Management, Capital Market Authority; Abdullah Biary, CISO, Salama Cooperative Insurance Company; Thomas Heuckeroth, Group Cybersecurity Lead, Emirates Group; and Majd Sinan, Trend Micro Country Manager, UAE.

Following the first panel discussion, Mariana Pereira, Director of Email Security Products EMEA, Darktrace took a technical session on Faking It: Combatting Email Impersonation with AI. As the Director of Email Security Products at Darktrace, her primary focus lies on the capabilities of AI cyber defenses against email-borne attacks. Pereira works closely with the development, analyst, and marketing teams to advise technical and non-technical audiences on how best to augment cyber resilience within the email domain, and how to implement AI technology as a means of defense.

Pereira’s session was followed by the last panel discussion on the topic, Cybersecurity as a Transformation Enabler in an Era of Hyper Connectivity and Cloud. The discussion was moderated by Piyush Kumar Chowhan, Group CIO, Lulu International, and the panelists were Ali Abdulla Alsadadi, Head of IT, National Oil and Gas Authority (Bahrain); Mohamed Saad Mousa, Chief Information Security Officer, Ikea; Mariana Pereira, Director of Email Security Products EMEA, Darktrace; Mohannad Alkalash, Founder, CyberX; and Piergiorgio Di Giacomo, Chronicle Security Lead, Google Cloud in participation.

All the sessions and panel discussions were followed by a live Q&A with the audience. You can watch the entire recording of the Middle East CISO Forum at https://attendee.gotowebinar.com/recording/3725001766794837774

The title sponsor of the Middle East CISO Forum was Trend Micro. Other sponsors of the Forum include Attivo Networks (Platinum Partner), Google Cloud (Gold Partner), Dark Trace (Gold Partner), and CyberX (Silver Partner). The media partners of the event were CXO Insight (Middle East) and UAEBusiness.com.

About CISO MAG

CISO MAG is a publication from EC-Council, which provides unbiased and useful information to the professionals working to secure critical sectors. The information security magazine includes news, comprehensive analysis, cutting-edge features, and contributions from thought leaders, that are nothing like the ordinary. Within the first year of launch, the magazine reached a global readership of over 50,000 readers. The magazine also has an Editorial Advisory Board that comprises some of the foremost innovators and thought leaders in the cybersecurity space. Apart from this, CISO MAG also presents a platform that reach out to the cybersecurity professionals across the globe through its Summits and Awards and Power List surveys.

About EC-Council

EC-Council, officially incorporated as the International Council of E-Commerce Consultants, was formed to create information security training and certification programs to help the very community our connected economy would rely on to save them from a devastating Cyberattack. EC-Council rapidly gained the support of top researchers and subject matter experts around the world and launched its first Information Security Program, the Certified Ethical Hacker. With this ever-growing team of subject matter experts and InfoSec researchers, EC-Council continued to build various standards, certifications and training programs in the electronic commerce and information security space, becoming the largest cybersecurity certification body in the world. Learn more at https://www.eccouncil.org.

Bolstering Cybersecurity Posture with Red, Blue and Purple Teams

July 9, 2020

Post the COVID-19 outbreak, organizations worldwide need to revisit their existing business model and bring in radical changes into the ongoing business operations by streamlining the various business processes and the underlying technology stack that will support the business operations. COVID-19 has made most of the global organizations to start working from home with the help of remote connection capabilities established in place. Such situations may continue very well even after the crisis get over. Because across the globe, organizations have a view that working from home kind of approaches give significant cost savings and productivity improvement. But the other side of such new approach will increase the cyberthreat landscape of the organizations, which is revealed by the recently emerging cyberthreats targeting remote workers.

By Vimal Mani, Head of Information & Cyber Security Operations of Bank of Sharjah

New methods and techniques need to be considered for implementation for bolstering the cybersecurity posture of organizations globally. There are many new techniques being explored for strengthening cybersecurity posture such as Zero Trust, Defence in Depth and others. In the same line, several global organizations have started building Red Teams, Blue Teams and Purple Teams as part of their Cybersecurity Capability Development.

What are Red, Blue and Purple Teams?

Red and Blue Teams are generally exercises carried out by military forces to mimic an enemy and his attack techniques and device counterattack techniques to prevent the attacks from enemy. This Red Team approach is being adopted by contemporary business organizations globally to device fool proof business strategies that will help them in winning over their competition.

In recent past, global organizations have started embracing the Red and Blue Team approaches for bolstering their cybersecurity capabilities for addressing the dynamically emerging cyberthreats from adversaries. Organizations conduct Red Teaming engagements through external consultants as well develop their own internal Red Teams.

What are Red Teaming Engagements?

Red Team engagements are full-fledged cybersecurity assessments in which consultants wear the hats of adversaries and try emulating real life cyberattack scenarios on the client organizations based on mutual agreements. This helps organizations in identifying the gaps, weakness, and single point of failures in the enterprise wide security architecture. The consultants use logical, physical, and social engineering attack techniques used by real hackers in the industry. But these attack vectors get customized inline to the agreement signed with the organizations, which will have defined boundaries for these Red Teaming engagements.

The following types of attacks may be emulated during the Red Teaming engagements:

Physical Attacks
Internal Network Penetration Attacks
External Network Penetration Attacks
Social Engineering (Phishing, Vishing, Smishing etc.)
Wireless Network Penetration Attacks
Pivoting
Achievement of goals agreed (Data Exfiltration etc.)

Who are Blue Team Members?

Generally an organisation’s in house IT Security & SOC Team members who fight against cyberattacks are considered as Blue Team Members. Blue Team members need to ensure that the critical information assets owned by the organization are secured from various kinds of attacks that may be targeted on them by adversaries and Red Team members who mimic the adversaries. Also the Blue Team Members need to handle the complete cycle of incident management which will be led by SOC team from the front. The following list of activities are performed by Blue Team members:

Vulnerability Analysis
Patch Management
Internal Penetration Testing
System Hardening
Implementation of Security Baselines
Configuration Reviews & Changes Implementation
Compliance Reviews
Log Monitoring
Incident Analysis (Triaging)
Remediation Planning & Implementation

Who are Purple Team Members?

Purple Teaming is a newly emerging concept in cybersecurity. Purple Team is a team of cybersecurity professionals playing both the roles of Red Team & Blue Team in ongoing and integrated manner for providing much reliable cyber assurance for organizations who employ them. As a Red Team, they will collect the intelligence on Tactics, Techniques and Procedures (TTPs) used by adversaries. Then as a Blue Team, they will analyse these TTPs and configure, tune, and improve the incident detection and response capability of the organisations who employ them. Another example is, as a Red Team, they can send out phishing emails to staff and as a Blue Team they can conduct structured security awareness trainings to staff. This Purple Team may not be a separate team and they will be the individuals who are part of an organisations existing Cybersecurity Team and their job is to maximize the effectiveness of their team in preventing the incidents in a timely manner.

Conclusion

Leveraging the capabilities of Red/Blue/Purple Teams in an integrated manner is need of the hour for organizations globally. It provides great opportunities towards bolstering and improving the cybersecurity posture of organisations. Development of Red/Blue/Purple Team capabilities and integrating them in a seamless manner should be considered as one of the critical action items planned by Information & Cybersecurity Teams in an organization every year. Using these Red/Blue/Purple Teams in an integrated manner will help an organisation in improving its incident management capabilities and introducing state of the art cybersecurity skills, solutions and improving the overall cybersecurity posture of the organization.

About the Author

Vimal Mani, CISA, CISM, Six Sigma Black Belt, is the Head of Information & Cyber Security Operations of Bank of Sharjah. He is responsible for the bank’s information & cybersecurity programs, coordinating security operations spread across the branches in Middle East. Mani is also responsible for coordinating bank wide security strategy and standards, leading periodic security risk assessment efforts, incidents investigation and resolution and coordinating the bank’s security awareness and training programs.

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

Cerberus – A Banking Trojan Disguised as Currency Converter

July 8, 2020

Android Trojan, Trojan, ReverseRat, Numando Banking Trojan

Researchers from Avast discovered a malicious Android app “Cerberus” on the Google Play store spreading a banking Trojan. The Trojan was being spread via a Spanish currency converter app “Calculadora de Moneda” targeting Android users in Spain since March 2020, with 10,000 downloads already. The researchers stated that Cerberus Trojan, if downloaded, can steal banking credentials, bypass security measures, access text messages, and even alter two-factor authentication (2FA).

“As is common with banking malware, Cerberus disguised itself as a genuine app in order to access the banking details of unsuspecting users. What is not so common is that a banking Trojan managed to sneak onto the Google Play Store. To avoid initial detection, the app hid its malicious intentions for the first few weeks while being available on Google Play. During this time, the app acted normally as a legitimate converter, and it does not steal any data or cause any harm. This was possibly to stealthily acquire users before starting any malicious activities, which could have grabbed the attention of malware researchers or Google’s Play Protect team,” the researchers said in a statement.

The Cerberus Trojan app operates stealthily to gain the trust of users and steals their banking data later. The app executes itself in three different stages:

In the first stage, the Calculadora de Moneda app appears normal and does not steal any data from users who have downloaded it.
In the second stage, the normal looking app turns into a malicious dropper, which is intended to download another malicious app onto a device, without the user’s knowledge.
In the final stage, the app activates the malicious Trojan to access the existing genuine banking app on the victim’s device and wait for the user to log in. The Trojan creates a layover on the login screen to capture the credentials.

Avast stated that the malicious app has been taken down after it reported the findings to Google.

Protection Against Banking Trojans

Avast recommended users certain mitigation measures to protect themselves from mobile banking Trojans, these include:

Confirm that the app you are using is a verified banking app. If the interface looks unfamiliar or odd, double-check with the bank’s customer service team.
Use two-factor authentication if your bank offers it as an option.
Only rely on trusted app stores, such as Google Play or Apple’s App Store. Even though the malware slipped into Google Play, its payload was downloaded from an external source. If you deactivate the option to download apps from other sources, you will be safe from this type of banking Trojan activating on your phone.
Before downloading a new app, check its user ratings. If other users are complaining about a bad user experience, it might be an app to avoid.
Pay attention to the permissions an app requests. If you feel that the app is requesting more than it promises to deliver, treat this as a red flag.
Often, malware will ask to become a device administrator to get control over your device. Don’t give this permission to an app unless you know this really is necessary for an app to work.

Not the First Time

In 2019, Kaspersky discovered the Ginp Banking Trojan, which lures Android users to steal their credit card credentials.

For more information, read, “Ginp Banking Trojan Lures Android Users Amidst COVID-19 Outbreak”

Cybercrimes in U.K. Doubled Since 2015, Costing Businesses $108 Bn

July 8, 2020

Cybersecurity Skill Shortage Leads U.K. Firms to Outsourced Security Services

Research from business ISP provider Beaming revealed that the number of businesses in the U.K. that affected by cyberattacks has doubled since 2015. The five-year cybersecurity research stated that 1.5 million businesses (25%) in the U.K. suffered cyberthreats in 2019, compared to 755,000 businesses (13%) in 2015, costing them £87 billion (US$ 108 billion).

The research also highlighted that large-scale businesses were the most affected, with 9 in 10 companies (87%) reporting cyberattacks. Small and Medium Businesses (SMBs) have seen the steepest rise in attacks, compared to 28% of firms hit in 2015, to 62% in 2019.

Other Notable Findings from Beaming’s Study include:

Over the past five years larger companies were consistently breached at a higher rate than smaller businesses. The risk of becoming a victim increases by more than 60% when a company hires its first employees.
Although more companies are taking measures against cybercrimes, uptake of these measures remains very low overall. In 2015, 5% of businesses had a cybersecurity policy; that figure is now 9%. In 2015, 30% of businesses had a firewall at the network perimeter; that figure is now 37%. In 2015, 20% of businesses put in place employee training and awareness-raising measures; that figure is now 22%.
More than a fifth of small (20%), medium (24%) and large companies (36%) now discuss a range of cyberthreats at the board level. The proportion of businesses taking additional steps to mitigate a range of cyber-risks has increased from 16% in 2015 to 37% last year.
Malware continues to be the biggest concern for business leaders, with 45% of them taking additional measures to combat it (compared to 26% in 2015).
In 2019, Phishing was the most common form of successful attack on every size of business – with the exception of micro companies, where 1% more fell victim to malware (although in 2018 phishing was also by far the biggest threat to micros too). The proportion of businesses hit by phishing attacks grew by 50% in five years, from 6% in 2015 to 9% in 2019.
Staff members were responsible – either through malicious intent, neglect, or genuine mistakes – for breaches in more than a third of cases. Business leaders held employees accountable for 37% of breaches in 2015, and 36% in 2019.
Beaming’s research indicates that almost two-thirds (61%) of U.K. businesses have minimal levels of cybersecurity defenses in place, relying on anti-virus software and basic router protection to keep them safe. 69% of micro businesses and 58% of small companies were in this situation at the start of 2020.

Sonia Blizzard, Managing Director of Beaming, said, “Cybercrime is one of the first fields to embrace automation, allowing hackers to launch increasingly sophisticated attacks with unprecedented scale and frequency. Businesses of all sizes need to think hard about improving the resilience of their IT and communication systems, to minimize the chances of being breached and the potential impact.”

She added: “The threat has grown astronomically over the last five years. What used to be seen as a big-business problem has become a serious concern for every company director, manager, and IT professional out there. Small businesses are now on the front line in the war against cybercrime. But they have not invested in cybersecurity or employee education at the same rate as their larger counterparts, and they are easier targets as a result.”

Deloitte Prescribes 5-Step Security Approach to Protect Enterprises and WFH Employees

July 8, 2020

With no end in sight to COVID-19, organizations have now accepted work from home (WFH) as the new normal. In fact, many Indian companies took a decision recently to let a section of their workforce to work from home permanently. This has been well accepted by millennials and Gen Z workers, according to a survey by Deloitte. But there are myriad cybersecurity challenges faced during the pandemic.

Deloitte’s 9th Global Millennial Survey 2020 stated cybersecurity to be a top concern amongst Indian millennials, which is a clear reflection of a number of cyberattacks that have been witnessed on MNCs operating in India, in the past week alone.

The survey further states that 86% of millennials and 83% of Gen Zs agreed they prefer the option to work from home in the future, to relieve stress.

With work from home (WFH) becoming the “new normal” amidst the COVID-19 crisis and cyber attackers and virus lurking in the shadows, enterprises can adopt a five-step approach to reassess their exposure to cyber challenges and secure their enterprises, as per a Deloitte perspective.

The five-step approach includes:

Implement multi-factor authentication: Organizations should enable multi-factor authentication (MFA) across all internet-accessible remote access services including Web and cloud-based email, Collaboration platforms, Virtual private network (VPN) connections and Remote desktop services.

Implement an ongoing cyber threat education and awareness program for organizational users: Educate users on current threats, the dangers of opening attachments or clicking links from untrusted sources, and the basic actions needed to prevent infection. It is essential to educate users to be wary of unexpected email messages, and to authenticate them with their ostensible senders before opening any links or attachments within them.

Know your most critical data and systems and where they are located: Not all data and systems are of the same value to organizations and attackers. Knowing the ‘what’ and ‘where’ of critical data and systems allows you to target resources on your most important assets first. Critical data and systems can be overlooked, especially when trying to protect everything in an organization. Ensure critical data is backed up and systems are recoverable.

Update your patching regularly: Internet-facing infrastructure is a primary target for attackers. By patching this infrastructure, you can help prevent attackers from exploiting known vulnerabilities in the software in order to gain access to your network and systems. It is recommended to apply patches within 48 hours of release.

Monitor and analyze activity on your most critical systems: A critical component of protecting your environment is to understand what is happening in real-time. Without this visibility and what has already happened to your systems and data, you are effectively operating blind.

Speaking on the recent cyberattacks, Shree Parthasarathy, Partner and National Leader – Cyber Risk Services, Deloitte India, said, ”In the era dominated by digital transformation, Indian enterprises have been susceptible to some major cyber-attacks and threats as a result of businesses transitioning to cloud with broader networking capabilities.”

While these threats are not new, their sophistication and frequency have increased and there is an immediate need for businesses to draw a crisis management and resiliency plan of action.

“A robust and consistent layer of identity and access management built with a multi-factor authentication and encryption policy will help in aligning a thoughtful cybersecurity policy to overcome the dual crisis hovering over the country,” he added.

Hackers Hide Phishing Links Inside .ics Calendar Invitations

July 8, 2020

Threat actors are finding innovative methods to phish people into clicking/downloading malicious links or entering sensitive information on fake forms. In a recent security discovery, the Cofense Phishing Defense Center (PDC) found that cybercriminals are using calendar invitations to launch phishing attacks.

Researchers at Cofense found a new phishing campaign to target enterprise email environments that deliver .ics calendar invitations, which contain phishing links in the email body with the subject “Fault Detection from Message Center,” from a sender named “Walker”. The hackers used a compromised email account of a school district to bypass email filters.

The Phishing Page

The fake calendar invitation contains a malicious URL, hosted on Microsoft’s SharePoint site, and also displays another link that redirects the user to a phishing site. When a user clicks on the calendar invitation, it redirects them to a document hosted on the SharePoint site, which contains yet another malicious link. In case the victim clicks on the second link, they are redirected to a phishing website hosted by Google that looks like a legitimate Wells Fargo banking login page. The bogus page asks the users to enter their sensitive information like login details, account numbers, PIN, and email credentials. After entering all the sensitive information, the user will be redirected to the actual Wells Fargo login page to make the user believe that their account is secured.

“Cofense observed the use of several compromised accounts used to send this campaign. Using a compromised real account originating from Office 365 allows the email to bypass email filters that rely on DKIM/SPF. The story in this phish is a version of a classic lure “suspicious activity on the user’s bank account.” This attachment, however, does not jibe with the ruse considering it’s a calendar invite. A more fitting lure would have been something like “I attached a meeting invite; can you please attend,” the researchers said in a statement.

Google Calendar Scam

Threat intelligence and cybersecurity firm Kaspersky stated that scammers made phishing attacks, by abusing Google Calendar services, to trick users into giving away sensitive information like passwords, card details, and other financial data. Several unsolicited pop-up calendar notifications were sent to Gmail users by cybercriminals as a sophisticated spam email attack. The calendar phishing emails exploit the automatic addition and notification of calendar invitations feature for people using Gmail on their mobiles.

Telehealth Privacy and Security

July 8, 2020

The Coronavirus pandemic has catalyzed a rapid increase of telehealth adoption. Leveraging telehealth platforms, patients are able to speak with doctors and nurses without having to risk exposure to themselves or others.

By Ian Terry, Information Security Consultant at Intraprise Health

The increase has been so drastic, the U.S. Department of Health and Human Services and its Office of Civil Rights (OCR) and the FBI have released special guidance related to the use of telehealth systems, particularly how they have come under attack by malicious actors and advanced persistent threats (APT).

For privacy and security practitioners in healthcare, the increased use of telehealth and government attention signals the need to learn more about telehealth systems, the security risks associated with their use and strategies for mitigating those risks.

Telehealth and Protected Health Information

Telehealth is the use of systems and services to provide health care diagnoses and to connect providers to patients remotely. Often, patients will use applications on their device to connect via videoconference with doctors.

Similar to a conventional provider environment like a hospital or urgent care office, patients must relay information like their birthdate, age and medical history as well as their current symptoms during a telehealth session. The doctor can then prescribe medicine or treatment based on this virtual visit. All of this information is considered protected health information (PHI), which means it must be protected according to HIPAA requirements.

Companies that use or develop telehealth software must ensure their telehealth solution is adequately vetted, configured and used in such a way that demonstrates HIPAA compliance and protects the privacy and security of patients’ PHI.

Security Risks – New “Friends” and Familiar Faces

Telehealth relies on many of the products and technologies with which we are already familiar in both professional and consumer settings. As such, they are prone to many of the same vulnerabilities and risks.

Attackers can intercept data transmitted between the patient and provider during telehealth sessions if encryption and authentication protocols are not properly utilized. Or they could hijack a legitimate user’s credentials and impersonate them during a session, adding an additional layer of complexity to identity theft. In this situation, the victim’s healthcare records could be inaccurately modified – potentially affecting their care for years to come until the illegitimate modifications are rectified.

These types of attacks occur in real time. But attackers can also exploit telehealth environments to obtain patient data-at-rest. In some instances, recordings, notes and patient data collected or created during sessions could be saved to servers or smart phones. If these devices are not adequately encrypted, they could be the targets of a successful data exfiltration attempt.

The introduction of telehealth solutions into providers’ service offerings can speed and improve the provision of healthcare to their patients but can also broaden their attack surface. Organizations should be prepared to expand their security program to compensate, accounting for risks to confidentiality, integrity and availability (CIA) of patient information before they suffer a costly and damaging data breach.

Tele-Help Me Out – What Can We Do?

Providers or business associates looking to use telehealth solutions or ensure existing solutions are secure, should consider the following:

Perform a Security Risk Assessment of the Telehealth Solution and Its Vendor

Commonly referred to as a third-party risk assessment, this type of assessment is performed by the organization to evaluate the security posture of a vendor as well as the controls implemented in their product or service.

For telehealth solutions, assessors should examine prospective telehealth solutions’ documentation and collaborate with vendors’ technical specialists to compare the solution’s technical security controls with organizational standards.

Further, organizations should solicit information related to the vendor’s own cybersecurity/information security program – especially if they are storing or transmitting any patient data (e.g. if they are a SaaS solution). This involves reviewing their policy and process documentation to ensure they have a HIPAA-compliant program in place.

Request or Perform an Application Penetration Test

Providers should request any application penetration testing results or findings associated with the telehealth product from the vendor. Because penetration testing simulates real-world attacker scenarios, they are one of the most effective ways for evaluating the security of a program.

Reviewing and discussing ‘pen’ test activities with prospective telehealth vendors provides insight specific to the application as well as a demonstration of a vendor’s respect for cybersecurity – if a vendor doesn’t perform in-depth penetration testing of their telehealth product, it may be worth looking elsewhere for a partnership where security is mutually valued.

Improve Your Telehealth Policies, Procedures, and Training Materials

Like any technology used by your workforce, data security is highly dependent on how it is used. It is important that your workforce is following processes and policies that are tailored to the unique risks associated with telehealth platforms.

Leveraging policy can ensure your company has the authority to enforce standards of behavior when using telehealth platforms. Process and procedure documentation arms your workforce with step-by-step instructions on how to perform their duties appropriately.

Additionally, education and training on the appropriate use of telehealth platforms — particularly training on HIPAA privacy and security best practices — should be given to workforce members who use it. For example, reminding doctors to destroy any handwritten notes and ensure that telehealth sessions take place away from bystanders to avoid an incidental disclosure scenario.

OCR Enforcement Discretion – This Means We Don’t Have to Worry, Right?

(OCR) announced that it would not impose penalties for noncompliance with regulatory requirements under HIPAA rules against care providers employing telehealth during the COVID-19 public health emergency.

For providers, this means they can temporarily get away with HIPAA noncompliance when implementing and using telehealth systems “in good faith” to serve patients, reduce potential exposure to COVID-19 and handle the abrupt increase in volume.

Additionally, this allows covered health care providers to use popular applications that allow for video chats such as Apple FaceTime and Zoom to provide telehealth services.

This relaxation of enforcement allows providers to quickly pivot towards telehealth integration. Providers should be aware, however, that this does not altogether absolve their responsibility to privacy and security when using telehealth systems – at least, not in the long term.

Though the Notification of Enforcement Discretion does not have an expiration date, OCR has stated they will issue a notice to the public when it is no longer exercising the enforcement discretion. When that day comes, transitioning will be easier for providers that did their due diligence ahead of time – assessing risk, establishing Business Associate Agreements (BAAs) and Data Exchange Agreements, and ensuring their policy and process documentation speaks accurately to their use of telehealth platforms.