Home Blog Page 196

DXC’s Xchanging Subsidiary Falls Prey to Ransomware Attack

ransomware, ryuk ransomware, cox media

Xchanging, DXC Technology’s subsidiary and an Australian based IT services provider rendering services to insurance companies, reportedly experienced a ransomware attack. According to its website, Xchanging is primarily insurance managed services provider operating as a separate entity and thus, the ransomware attack did not affect any of DXCs mainframe systems and networks.

The main concern arises from the fact that DXC technology provides services across various industry verticals. It serves nearly 6,000 private and public sector customers across 70 countries and add to this, the DXC Partner Network including industry cloud experts like Amazon Web Services (AWS), Google Cloud, Microsoft, PwC, and many others. Thus, a security failure in their mainframe could potentially affect all these stakeholders associated with the company. However, Xchanging is confident that the incident solely remained isolated to their environment alone. In addition, DXC  did not indicate that data has been compromised or lost.

DXC itself has now taken all necessary steps to remediate the damages caused by the ransomware attack and hopes to resolve and restore all its affected services at the earliest. Additionally, it has also informed the required law enforcement agencies and cyber regulatory body about the incident, who are now working in tandem with them to speed up the investigation process.

Talking About Ransomware…

Have you heard about the Thanos ransomware? The rising popularity of this family of ransomware is associated with the fact that it is being advertised in the underground forums as Ransomware-as-a-service (RaaS) tool that exploits the RIPlace technique in the Windows file system This technique goes undetected in most antivirus, anti-ransomware, and Endpoint Detection and Response (EDR) solutions as it bypasses the security products by replacing all sensitive files on the victim’s machine.

It has been reportedly developed by a threat actor named as “Nosophoros”. However, a lot has changed since its initial emergence and now the latest feature of RIPlace technique has been integrated and used since February.

Read more about this ransomware family in the article “Snap Your Fingers Twice, Thanos Ransomware is Here!”

 

NSA Issues Guidelines on Securing Virtual Private Networks

NSA security advisory

The U.S. National Security Agency (NSA) issued a set of guidelines on securing IPsec (IP security) and Virtual Private Networks (VPNs) against potential cyberthreats. The NSA advisory also highlighted the importance of using strong cryptography techniques to protect sensitive information and communication when connecting to remote servers via third-party sources.

“Many organizations currently utilize IP Security and Virtual Private Networks to connect remote sites and enable telework capabilities. These connections use cryptography to protect sensitive information that traverses untrusted networks. To protect this traffic and ensure data confidentiality, it is critical that these VPNs use strong cryptography. This guidance identifies common VPN misconfigurations and vulnerabilities,” NSA said in the advisory.

Securing Virtual Private Networks

For a secure VPN, NSA recommended certain guidelines, including:

  • Reduce the VPN gateway attack surface
  • Verify that the cryptographic algorithms are Committee on National Security Systems Policy (CNSSP) 15-compliant
  • Avoid using default VPN settings
  • Remove unused or non-compliant cryptography suites
  • Apply vendor-provided updates for VPN gateways and clients

“VPNs are essential for enabling remote access and securely connecting remote sites, but without proper configuration, patch management, and hardening, VPNs are vulnerable to attack,” the advisory added.

Mitigating Attack Surface

The advisory stated that VPN gateways can be accessed directly from the internet and are exposed to network scanning, zero-day vulnerabilities, and brute force attacks. In order to defend against these vulnerabilities, NSA urged network administrators to execute traffic filtering rules, which include:

  • Restrict all traffic to the VPN gateway, limiting access to only UDP port 500, UDP port 4500, and ESP
  • When possible, limit accepted traffic to known VPN peer IP addresses. Remote access VPNs present the issue of the remote peer IP address being unknown and therefore it cannot be added to a static filtering rule
  • If traffic cannot be filtered to a specific IP address, NSA recommends an Intrusion Prevention System (IPS) in front of the VPN gateway to monitor for undesired IPsec traffic and inspect IPsec session negotiations

“VPNs are essential for enabling remote access and connecting remote sites securely. However, without the proper configuration, patch management, and hardening, VPNs are vulnerable to many different types of attacks. To ensure that the confidentiality and integrity of a VPN is protected, reduce the VPN gateway attack surface, always use CNSSP 15- compliant cryptography suites, avoid using vendor defaults, disable all other cryptography suites, and apply patches in a timely manner,” the NSA concluded.

 

 

Hacker Infiltrates 22,900 Unsecured MongoDB Databases to Demand Ransom

Zyxel Devices Vulnerable to Secret Backdoor

An unknown hacker took control of over 22,900 unsecured MongoDB databases that were left online without password protection, a number that accounts for roughly47% of all MongoDB databases available online, according to the Sophos report.

The hacker uploaded a ransom note demanding a 0.015 bitcoin (approximately $140) payment and also threatened to leak the data and then report to GDPR authorities.

“All your data is backed up. You must pay 0.015 BTC within 48 hours to recover it. After 48 hours, we will leak and expose all your data. If you refuse to pay, we will contact the General Data Protection Regulation authority and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server,” the hacker’s ransom note read.

Sophos learned that the hacker used an automated script to scan for misconfigured MongoDB databases online. The hacker accessed the same databases and dropped the same ransom note multiple times.

Focus on Unsecured Databases

Every minute is an opportunity for threat actors when they find an unsecure server left online. A recent security experiment by Comparitech led by cybersecurity researcher Bob Diachenko discovered that cybercriminals attacked a model of an unsecured database 18 times in a single day. In a security alert, Comparitech explained how unauthorized third parties find, gain access, and alter exposed data without any authentication process, leaving users’ privacy at risk. The company set up a honeypot to know how quickly the hackers would attack an Elasticsearch server with a dummy database and fake data in it.

Comparitech left the exposed data from May 11 until May 22, 2020. It found 175 attacks in just eight hours after the server was deployed, and the number of attacks in one day totaled to 22. All attackers were not looking to steal data. Some targeted unsecure servers to mine cryptocurrency, steal passwords, and destroy data, Comparitech stated.

 

The Zero Trust Primer: A Simple Overview of the NIST 800-207 Draft

Research Finds Increase in Botnet and Exploit Activity in Q2 2020

Zero Trust as a concept has but one fundamental assumption. Nothing should be implicitly trusted – not your identities, not your devices, not your network components. “Trust, but Verify”, gives way to “Do not trust. Verify every time.” The draft NIST 800-207 explains the basics of Zero Trust (ZT) and Zero Trust Architecture (ZTA). This article summarizes and simplifies the core concepts of NIST 800-207.

The concept is deceptively simple.

By Chaitanya Kunthe, Co-founder and Chief Operating Officer at Risk Quotient

The challenge, for CISOs, lies not in understanding the concept, but in finding the right path to implement it within their environments.

What is Zero Trust?

Zero Trust is different from the traditional ‘castle and moat’ architecture where you protect your perimeter and stop the bad guys from entering your sacred space. If you can control who comes in, you can trust everyone within your network. Bad guys out there. Good guys in here. You see the problem already?

The modern network does not have clear boundaries. You might have autoscaling container clusters that are hosted by cloud service providers and accessed by your DevOps team from their homes. Your HR team might be running their HRMS as a SaaS. Your security operations centre might be outsourced to a third party. The castle and moat approach fails when what-you-need-to-protect is outside your castle.

Zero Trust Architecture does not care where your assets are or where your users are. That is the beauty of it.

In the NIST 800-207, there are 2 goals of ZT and ZTA:

  • Prevent unauthorised access to data and services
  • Make access control and decisions of access control as granular as possible

The first goal is plain common sense. It is the second one that makes ZTA interesting.

To achieve it, you have to devise an architecture that shrinks ‘implicit trust zones.’ For example, if you have a server zone containing 100 servers, and an admin who has access to the entire server zone then the ‘implicit trust zone’ for the admin is 100 servers wide. Not very Zero Trust.

The trick lies in reducing this 100 servers’ zone to say 5 servers, for admin A, without increasing authorization delays.

Core Areas of Zero Trust

ZT 1

ZTA focuses on three core areas:

  • Enterprise identities and devices
  • Enterprise Resources
  • Trust Verification Systems (Policy Decision Points (PDP) & Policy Enforcement Points (PEP) and policy engine)

Enterprise identity and devices: This has two parts. First, the device authenticates the identity (user) and checks if the request is valid. This is already implemented in organizations today. Think of your average run-of-the-mill VPN connection – the user logs in to the device (authenticate the identity) and then the VPN application checks for a proper VPN certificate (valid request).

Trust Verification Systems: Here is where ZT really comes into its own. Your verification system should judge the level of confidence on the identity as well as the request and not just provide access when the base criteria are met.

The level of confidence is the trust that the verification system (Policy Engine /PDP / PEP) has in the system + identity making the request based on certain criteria. Some points that can be considered:

  • Does the device + identity normally connect at these times?
  • Does the identity connect from various devices? Which ones are trusted?
  • Is there anything out of pattern in the request?

Think of your VPN server that is accepting connections. Does it analyze the level of confidence in the request? If it were, it could provide different levels of access based on the level of confidence it has on the request. These are what Zero Trust calls ‘dynamic risk-based policies’ to access resources.

This ‘Trust Algorithm’ or ‘Policy Engine’ is the brain behind Zero Trust.

Resource: No surprises here. They can be any system, applications, devices, data, information etc. that have some value for the organization.

Tenets of Zero Trust Architecture

There are 7 basic tenets that every zero trust architecture must try to achieve:

zt 2

Consider these as the ‘goals’ of zero trust’:

  • All data sources and computing services are considered as ‘resources’
  • All communication is secured (internal or external)
  • All access is provided ‘per-session’
  • Access is provided based on a dynamic risk-based policy
  • All devices should be in the most secure state possible. They should be monitored for this
  • Dynamic authentication and authorization is strictly enforced before granting access
  • Collect as much information about the network and infrastructure as possible

Getting Started with Implementing Zero Trust Architecture

Here we move a little away from the basics and talk more from the implementation perspective.

CISOs should start thinking of their enterprise in terms of these tenets and create a plan that will take them from where they are to a zero trust architecture. There are many paths to zero trust. As long as you comply with these tenets, you can say that you are a zero trust company.

You need not comply to all of these tenets. Pick and choose what makes your network more secure.

Here are a few logical steps to get you started:

  • Identify all the resources in your organization – data sources as well as computing resources used. Check if they have basic authentication and request validity checks. You can use your existing asset databases, configuration databases etc. for this.
  • List all the ‘identities’ in your organization. How many and what type of identities do you manage? This might not be easily available as most organizations do not track identities as effectively as they track assets. However, you are in luck if you have an IDAM solution implemented across the organization.
  • Now, the tricky part – identify the places where the identities need to interact with the resources. It is almost like creating a data flow diagram. At each interaction point, identify levels of confidence. For example, a known user and device connecting from an unknown IP would have a lesser level of confidence as compared to a known user and device connecting from a known IP. This can get very daunting. A piecemeal approach is best suited here.
  • Identify the level of access to provide at various levels of trust.
  • Identify if your current access control tools can deliver what you expect. If not, calculate the risk associated with not being able to identify the level of confidence. If the risk is unacceptable, look for a solution that meets your requirement

Implementing zero trust is a very strategic exercise. You cannot have a tool that you can plug, and it magically implements zero trust in your organization. If you want to implement zero trust, prepare to roll up your sleeves and painstakingly proceed step by step.

You might now have more questions, like:

  1. What are the risks of implementing Zero Trust?
  2. What inputs should the trust algorithm consider?
  3. What are the different deployment scenarios in which Zero Trust can be implemented?

The NIST 800-207 draft is a detailed document that answers these questions. It contains many sections that a would-be practitioner of Zero Trust would be interested in. If this has piqued your interest, download the standard from the NIST website and go through it.

About the author:

Chaitanya KuntheChaitanya Kunthe is a seasoned cybersecurity mentor who believes in simplifying things. He is the Co-founder and Chief Operating Officer at Risk Quotient, where he mentors the team to provide innovative and practical cybersecurity advice.

 

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

Was it Stuxnet 2.0? Cyberattack on Iran’s Natanz Nuclear Facility

Israel and Iran, Iran cyberattack, cyber war

A fire broke out at Iran’s Natanz nuclear facility on July 2, 2020. The Atomic Energy Organization of Iran (AEOI) spokesman Behruz Kamalvandi, said that the incident took place at one of the industrial sheds under construction at the Natanz uranium enrichment plant. And although the fire caused significant damage, no casualties were reported. However, now reports suggest that this was a sabotage attempt by state actors initiated through a cyberattack on Iran’s nuclear facility.

Attempt at Stuxnet 2.0?

The Shahid Ahmadi Roshan Natanz Nuclear Complex is a known nuclear facility in Iran. The UN nuclear watchdog – International Atomic Energy Agency (IAEA) – is keeping a close eye on the proceedings at this facility for the past few years. Why? Because this site has an underground facility that can produce enriched uranium which acts as fuel for reactors but also works as a basic component for creating nuclear weapons.

Although no official statement was given from Iran, a post in the Al-Jareeda daily cited an unnamed senior source as saying that an Israeli cyberattack is behind this entire episode, which was initiated with an intent of sabotage and push the progress of the nuclear enrichment program back by two months. This is very similar to a 2010 cyberattack against the same adversary, which then came to be known as the first known cyber weapon, the Stuxnet.

The First known Cyber Weapon

Stuxnet was a computer worm designed specifically by the U.S. and Israel to target the industrial control systems (ICS) made by Siemens. It was a self-replicating malware that used Windows vulnerabilities to penetrate the SCADA. Once in, it targeted the systems controlling the centrifuges in the Iranian nuclear plant. Although no affirmation of the exact impact was publicly given by Iran, unofficial statements claimed that almost 1,000 centrifuges were damaged in this cyberattack, which delayed the completion of the Iranian nuclear plant.

Although there are many possibilities behind this incident, but nothing can be affirmed unless Iran confirms these theories, which Behrouz Kamalvandi says, “will be declared in due course for security reasons.”

Massive Data Breach Exposes PII of 99,000 V Shred Customers and Trainers

V Shred Data Breach

Security research firm vpnMentor reported that fitness brand V Shred suffered a data breach that exposed the personally identifiable information (PII) of 99,000 of its customers and trainers. The exposed information included V Shred users’ names, home addresses, social security numbers, email addresses, dates of birth, social media accounts details, age, usernames, passwords, sensitive photos of V Shred customers, gender, and citizenship status.

According to vpnMentor’s report, an unsecured AWS S3 bucket exposed V Shred’s database, which contained 1.3 million files, containing 606GB data. The exposed database contained three types of .CSV files: the CSV file #1 has 96,000+ entries of lead generation list; CSV file #2 has V Shred client email list, with 3,522 entries; and CSV file #3 has a list of 52 trainers working for V Shred, including their email addresses. The unsecured database is now secured after vpnMentor reported the issue to V Shred.

“The data was stored on a misconfigured Amazon Web Services (AWS) S3 bucket, which was completely open to public access. The URL of the bucket contained V Shred, and many of the files contained the company’s logo and other identifiers,” the report said.

How to Secure an AWS S3 Bucket

vpnMentor also recommended certain instructions to AWS users to secure S3 buckets, these include:

  • Make the bucket private and add authentication protocols
  • Follow AWS access and authentication best practices
  • Add more layers of protection to their S3 bucket to further restrict who can access it from every point of entry

“It is important to note that open, publicly viewable S3 buckets are not a flaw of AWS. They are usually the result of an error by the owner of the bucket,” the report added.

Data Breaches on Fitness Firms

In a similar data breach, security researchers discovered an open database, which belongs to fitness tech company Kinomap, exposing 42 million records (40GB data) of its users for at least a month. The database includes PII of users from across 80 countries, including North America, Australia, Japan, the U.K., Belgium, Finland, and Hungary. The exposed PII included full names, home country, email addresses, usernames, Kinomap account details, gender, timestamps for exercises and the date they joined Kinomap. vpnMentor stated that it notified the French firm on March 28, 2020, immediately after the discovery. The database was fixed on April 12, 2020, after the French data protection regulator had been informed.

 

U.S. Schools Suffer Over 1,300 Data Breaches Since 2005

U.S. Schools Suffer Over 1,300 Data Breaches Since 2005

A research from technology website Comparitech revealed that K–12 school districts and colleges across the U.S. have suffered over 1,300 data breaches since 2005. More than 24.5 million records have been compromised in the data breaches.

According to the research, hacking is the topmost cause of data breaches in schools and colleges, with 45.9% of hacking incidents reported. Accidental data disclosure is second with 21% incidents in schools and 27.3% in colleges, followed by data theft or loss of data storage devices (11.1% in schools, and 14.7% in colleges).

Other findings from the research include:

  • California is a hot spot for both college and K-12 data breaches with 12.2% of the 985 college data breaches and 10.6% of the 21.5 million records affected.
  • New York reported most of the data breaches, with 63 breaches affecting almost half a million records.
  • Arizona is one of the worst-hit states by number of records affected, with 2.83 million people affected.
  • Wyoming is the only state to have no known reported education breaches.
  • 2008 had the most education data breaches, but 2013 and 2017 were the biggest years by the number of records affected.
  • The majority of records compromised in college data breaches with 3.07 million and 2.9 million records affected in 2013 and 2017 respectively.
  • The biggest years for K–12 schools were 2018 and 2019 with 991,340 and 804,734 records affected, respectively.

“There does not appear to be any kind of trend in the breach numbers for K-12 schools or colleges, nor does there seem to be a pattern with college records affected. However, over the past few years, there has been a significant increase in the number of school records affected,” the report said.

Ransomware Attacks on K-12 Schools

Earlier, a similar report revealed that around 86 universities, colleges, and school districts were impacted, which in turn disrupted operations of nearly 1,224 individual schools due to ransomware attacks. The report also shared a list of  top three incidents of public schools being affected by ransomware attacks.

K-12 Cybersecurity Act

In order to address the rising cyberthreats on K-12 schools, two U.S. Senators, Gary Peters (Michigan) and Rick Scott (Florida), both members of the Senate’s National Security and Government Affairs Committee, have tabled a bill called “K-12 Cybersecurity Act” in December 2019. The Act directs the DHS Cybersecurity and Infrastructure Security Agency (CISA) to first study the specific cybersecurity risks associated with K-12 educational institutions. Once the study is done, CISA will then be responsible to develop cybersecurity recommendations and set up online tools to help schools with their cybersecurity requirements.

 

Data Breach Affects 384,319 BMW Customers in the U.K.

BMW Data Breach

KELA, a darknet intelligence firm discovered that a hacker group “KelvinSecurity” compromised the personal information of 384,319 BMW customers in the U.K. and put them for sale on various darknet forums, SC Magazine reported.

The hacker group claimed that they got the BMW database from a call center that handles customers’ information of various automobile brands. The stolen database contains over 500,000 customer records dated between 2016 and 2018, affecting U.K. owners of other car manufacturers, including Honda, Mercedes, SEAT, and Hyundai in the U.K.

The exposed BMW owners’ information included sensitive information such as surnames, email iDs, vehicle registration numbers, residential address, dealer names, car registration information, names of dealerships. KELA also discovered multiple databases exposed by KelvinSecurity, including  data related to the U.S. government contractors and the Russian military weapons development. The hacker group also exposed over 28 databases on various darknet forums for free, affecting organizations in Iran, Australia, Mexico, U.S., Sweden, Indonesia, and France.

OceanLotus Targets BMW

Earlier, a notorious APT hacker group “OceanLotus” compromised the network systems of BMW and installed a hacking tool known as “Cobalt Strike” to spy and control its systems. According to a research report from Bayerischer Rundfunk, the attack was traced back to state-sponsored hackers from Vietnam. Security analysts from BMW stated that they identified the hacker’s penetration into their company’s network system.

BMW  took down the compromised computers and blocked the path that was used by hackers to penetrate the network. To get access to other computers, hackers created a fake website that gave the impression of belonging to the BMW branch in Thailand, as they can monitor networks and find out which folders and files that users logged in. The report also claimed the hackers behind the BMW attack targeted the South Korean automotive manufacturer Hyundai.

 

Are You Remotely Secure?

remote work

COVID-19 pandemic has pushed the concept of remote working beyond any preconceived growth expectations. It doesn’t appear a short-term situation as many organizations and their employees benefit from this new business structure. Rightfully so, IT and security teams should be “virtual” fist-bumping to celebrate rapidly transitioning operations and, in most cases, avoiding any extensive downtime or security breach. After a momentary breath, businesses must now look to long term operational sustainability and security. Organizations must soon revisit and reassess the security gaps or corners cut in haste to deliver services so as not to leave convenient doors open for attacker exploitation. We’ve seen before that attackers seek to capitalize on times of disruption like these both for quick wins and establishing a foothold for a more sophisticated attack.

By Carolyn Crandall, Chief Deception Officer and CMO at Attivo Networks

An Uptick in Cyberattack Frequency

According to the FBI, cybercrime has increased 300% since the start of the COVID-19 pandemic. If there was ever a time for attackers to open their crime toolboxes, it is now. We also may not have seen the worst of things. Dwell time – the time to detect attackers within the network – currently averages months. With this in mind, advanced attackers may not have come forward yet to reveal their inside presence or to present their demands. During this next phase of supporting remote workers, organizations must have robust detection capabilities that can not only alert security teams promptly when an adversary evades prevention defenses but also deliver company-centric threat intelligence on attacker methods and targets.

Altered Employee Behavior = Unpredictable Attack Surface

With an increase in the number of remote workers and changing behavioral patterns, traditional security controls can’t reliably protect an organization’s network infrastructure or remote employees. Many organizations dramatically increased their company bandwidth to support remote operations and split-tunneled VPNs to separate work from personal traffic. Unfortunately, this created new risks as security tools like network firewalls, Intrusion Prevention Systems, web gateways, and others don’t operate well for such VPNs. With split- tunneling, employee traffic doesn’t always traverse the company network, and under these circumstances lacks the same protections as onsite employees. Security teams also see increased risks as they may not gain access to monitoring and incident response systems without creating gaps in perimeter firewalls. Additionally, detection technologies that rely on network behavior anomalies will be inaccurate, as employees connect from different networks and systems, and change baseline behaviors.

Organizations must also prepare for the risks of distracted employees working remotely on personal or unpatched home computers, which may use less-secure emails. System hygiene may also be harder to monitor as employees may not stay updated on patching or may load unauthorized software, creating risk. Many security teams fear that attackers are hiding silently within these systems, awaiting the day they connect directly to the company network.

System compromises are virtually inevitable, and organizations must prepare with a safety net that detects when systems connect, and the attacker attempts to swim upstream to find their target. Many organizations have learned first-hand the value of cyber deception, which provides efficient and non-disruptive “eyes inside the network” visibility to attackers across all attack surfaces and threat vectors. The concept is to create a detection net over the endpoint and a deception fabric throughout the network to discover attackers regardless of how they attack. An effective way to look at this is through the MITRE ATT&CK framework. There are 12 consolidated steps an attacker will take, from initial compromise, lateral movement, privilege escalation, to data exfiltration. Deception works to derail the attacker in 11 out of 12 of these steps. However, many find the most value in detecting lateral movement activity and closing gaps that Endpoint Detection and Response (EDR) solutions don’t cover. Network decoys project throughout along with endpoint credentials, mapped shares, deception data, or applications that breadcrumb attackers to an engagement server, away from production assets, and alert on their presence. Notably, using the MITRE ATT&CK testing methodology, Attivo demonstrated a 42% improvement in detection rates over EDR solutions alone.

Insider Threats, Former Employees, and Third Parties

With the advent of remote working, data may also be leaving the organization in ways not accessed or stored before. Additionally, there have also been unprecedented levels of employee turnover, which challenges security teams to keep up with employee or supplier access rights. It can also make using traditional data loss prevention tools less effective as behaviors, systems, and locations of access have changed.

Deception presents a unique way to detect exposed credentials as well as policy violations associated with the unauthorized use of employee, cloud, or VPN credentials or prohibited attempts to access systems. For example, since a deception asset has no employee production value, any attempt to scan, access, or exploit a decoy automatically triggers an alert, as will using legitimate credentials on a decoy application. Advanced deception can also go so far as to hide and deny access to threat actors attempting to enumerate AD, access files, folders, network or cloud mapped drives, or that may try to fingerprint servers. Collectively, these tools arm the defender in ways that they simply can’t with other security controls.

Implement Tools That Enable SOCs to Do More with Less and Reduce Alert Fatigue

Simply put, we know that the new volume of security alerts are taxing security departments that are not used to the load of so many employees working remotely. Traditional prevention devices and behavior-based detection tools may not accurately do the job at the required scale.

Defenders need a new tool for their toolbox that covers the gaps, delivers actionable alerts, and augments existing controls, not more of the same. Here are some of the things that Attivo Network does specifically to secure VPN access to corporate networks and ensure the delivery of prompt and accurate alerts.

  • Provides deceptive credentials for VPN accounts on remote worker endpoints and accurately notifies of attempted
  • Projects decoys into the VPN subnets for internal connections. This method provides an extremely effective tool for detecting and alerting unauthorized scanning behavior. It is also essential to consider that most VPN deployments are in bridged mode, resulting in all connections existing on the same broadcast domain. Anyone who gains unauthorized access via VPN can take advantage of this while running network scans, ping sweeps, etc. because it would be difficult for security teams to identify the activity
  • Protects Active Directory (AD) by alerting on any attacker seeking to enumerate AD. The solution goes beyond merely alerting and responds to the unauthorized query with fake data that leads the adversary into a decoy that records telemetry
  • Delivers company-centric threat intelligence on indicators of compromise (IOC) and tactics, techniques, and procedures (TTPs) and can automate isolation, blocking, and threat hunting through native integrations with existing security infrastructure.

Conclusion

While it is impossible to prevent adversaries from attacking a company, using deception technologies will provide early and accurate detection of threats, visibility to attacker lateral movement, and the opportunity to pre-emptively derail attackers from establishing a foothold or conducting their exploit. Now more than ever, security teams need to know what is lurking in their networks, and as such, need the proper tools in place to do so accurately.

About the Author

Carolyn CrandallCarolyn Crandall holds the roles of Chief Deception Officer and CMO at Attivo Networks.  She is a high-impact technology executive with over 30 years of experience in building new markets and successful enterprise infrastructure companies. She has held leadership positions at Cisco, Juniper Networks, Nimble Storage, Riverbed, and Seagate. Crandall has received many industry recognitions including Top 25 Women in Cybersecurity 2019 by Cyber Defense Magazine, Reboot Leadership Honoree (CIO/C-Suite) 2018 by SC Media, Marketing Hall of Femme Honoree 2018 by DMN, Business Woman of the Year 2018 by CEO Today Magazine, Cyber Security Marketer of the Year 2020 by CyberDojo (RSA), and for 9 years a Power Woman by Everything Channel (CRN).

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

How India’s Federal Bank Blocks Debit Card Fraud in Real-Time

Federal Bank Blocks Debit Card Fraud

The Federal Bank is one of India’s largest private sector commercial banks that serves a customer base of more than 10 million. The Bank does over 600,000 debit card transactions every day. It has more than 2,800 touchpoints (over 1,200 branches and over 1,600 ATMs), spread across the country. The bank is a leading technology adopter and was one of the first Indian banks to computerize all its branches. With an increase in fraudulent transactions in the industry, Federal Bank was proactively looking for a counter-fraud solution for both its cardholders and merchants, with real-time and near real-time facilities and mission-critical features that are easy to deploy, responsive and reduce the financial impacts of fraud.

The fraud landscape in India is evolving at a very rapid rate, with fraudsters finding new and innovative ways to game the system and trick banking officials and customers. Customer awareness is also low.

Shalini Warrier, Executive Director, Federal Bank
Shalini Warrier, Executive Director, Federal Bank

In an email interview with CISO MAG,  Shalini Warrier, Executive Director, Federal Bank said, “We have noticed that a lot of frauds are of the vishing type, where customers are tricked by fraudsters and end up sharing their secured credentials to fraudsters over the phone. The fraudsters are becoming increasingly sophisticated in their methodologies, and sometimes, even educated individuals fall prey to their attacks.”

According to RBI data (India’s banking regulator), from October to December 2019, debit card fraud alone reached 11,058 cases involving INR 94.5 crore (approximately US$12.4 million). While traditional rules-only fraud detection systems are adequate at detecting known threats, they are not as effective or efficient at uncovering new criminal fraud strategies or zero-day attacks, putting banks and their customers at risk.

“Our core challenge was the absence of a robust online real-time capability to prevent frauds on debit card transactions,” said Warrier. “We had the capability for post facto analysis, based on which we could make changes for the future. However, that is akin to closing the stable door after the horse has bolted! Further, our overall debit card spends were increasing courtesy the changes we made on the business front. Hence, in order to ensure our risk mitigation strategies kept pace with changes in the environment and the demands of the business, we really needed an effective online real-time monitoring system.”

To address the evolving threat of fraud and offer additional security for digital transactions, Federal Bank sought to deploy a rules-based solution with real-time monitoring for deterring, detecting and blocking fraud.

“The first criteria for us was the ability to handle volumes in a robust, resilient, consistent, and stable manner.  Further, we were looking for a system that could provide a high level of flexibility and agility so that changes in rules could be made dynamically, as and when required.  Of course, with the increasing use of online digital channels, we needed to ensure that the solution had an ability to interact, seamlessly, with online channels,” said Warrier.

Federal Bank opted for ACI Worldwide’s customized fraud and risk management solution at two action levels: cards and merchants. After deploying UP Payments Risk Management for real-time monitoring of card transactions, the bank saw a considerable drop in fraudulent transactions, including vishing fraud. In addition to alerting customers of risks, the solution also includes automated alerts that have helped the bank recognize and decline potential fraudulent transactions on more than 2,700 cards over a recent six-month period.

“Our Debit Card Switch is an ACI product, and we have worked effectively with ACI over the last 10 – 15 years. After taking all the above criteria into account and evaluating various solutions, we concluded that ACI’s PRM (Proactive Risk Manager) would be the best suited for our requirement.  It also enabled us to ensure seamless integration without Debit Card Switch,” added Warrier.

Through ACI’s solution, the bank can enhance fraud detection capabilities with insights into real-time status of card transactions based on pre-defined parameters, empowering the bank to provide better customer experience and security.

Warrier informs that the initial solution was deployed in March, 2015. However, several enhancements and upgrades were made in the last few years. The most recent upgrade was done in December 2019.

“Our objective was to equip Federal Bank with real-time reactivity and adaptation to emerging fraud trends, enabling faster decision-making,” said Kaushik Roy, Vice President and Country Leader – South Asia, ACI Worldwide.

Business Benefits

Warrier informs us that the solution gives the business the ability to confidently market debit card products, knowing that there is an effective risk management tool that can ensure minimal fraud.  The PRM solution enables businesses to grow with full assurance of risk mitigation. She acknowledges that the bank has realized a return on investment.

Going forward, Federal Bank wants to make continual investments in upgrades and enhancements. Its plans include:

  • Usage of past data in identifying suspicious transactions with the help of an analytical engine using AI-ML.
  • Real-time step-up authentication mechanism for highly suspicious transactions.
  • Ability to make use of customer profile data and customer device profile in transaction authorization.

ACI Worldwide is a Universal Payments (UP) company that powers electronic payments for more than 6,000 organizations around the world. More than 1,000 of the largest financial institutions and intermediaries, as well as thousands of global merchants, rely on ACI to execute $14 trillion each day in payments and securities. In addition, myriad organizations utilize its electronic bill presentment and payment services.

———————-

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the Bank or the Solution provider. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

1...195196197...410Page 196 of 410