Home Blog Page 238

FDA Reveals Potential Vulnerabilities in Certain Medical Devices

Medical device cybersecurity

The U.S. Food and Drug Administration (FDA) has notified patients, health care providers about a set of cybersecurity vulnerabilities mentioned as “SweynTooth.” According to a statement from the FDA, attackers can exploit SweynTooth vulnerabilities to remotely crash devices, stop it from working, or access device functions normally only available to the authorized user. It’s also said that the vulnerabilities may pose risks to a variety of medical devices like pacemakers, glucose monitors, and ultrasound devices.

According to the FDA, SweynTooth affects the wireless communication technology known as Bluetooth Low Energy (BLE), that allows two devices to pair and exchange information to perform their intended functions while preserving battery life and can be found in medical devices as well as other devices such as consumer wearables and IoT devices.

Suzanne Schwartz, deputy director at the FDA’s Center for Devices and Radiological Health, said, “Medical devices are becoming increasingly connected, and connected devices have inherent risks, which make them vulnerable to security breaches. These breaches potentially impact the safety and effectiveness of the device and, if not remedied, may lead to patient harm. The FDA recommends that medical device manufacturers stay alert for cybersecurity vulnerabilities and proactively address them by participating in coordinated disclosure of vulnerabilities as well as providing mitigation strategies. An essential part of the FDA’s strategy is working with manufacturers, health care delivery organizations, security researchers, other government agencies and patients to address cybersecurity concerns that affect medical devices in order to keep patients safe.”

Patient Medical Data Highly Vulnerable to Data Breaches

According to a study from Greenbone Networks, nearly one billion medical images have been exposed online. Greenbone carried out an analysis of over 2,300 medical Picture Archiving and Communication Systems (PACS) servers. PACS servers are governed by a standard called DICOM (Digital Imaging and Communications in Medicine). This standard lays the guideline for medical imaging devices that are networked in order to exchange and archive information about patients and images. DICOM makes use of the IP protocol. PACS servers digitally archive medical images (such as X-ray, CT, MRI scans etc.), which can be shared with or accessed by the attending provider from anywhere across the globe.

Thoma Bravo Acquires Sophos for US$3.9 Billion

Thoma Bravo Acquires Sophos for US$3.9 Billion

Cybersecurity firm Sophos is acquired by Thoma Bravo LLC, a private equity investment firm, in an all-cash deal of US$3.9 billion. Under the terms of the transaction, Sophos stockholders receive US$7.40 per share in cash. As a result of the completion of the acquisition, Sophos common stock was removed from listing on the London Stock Exchange.

Sophos develops security products for communication endpoints, encryption, network security, email security, mobile security, and unified threat management. The company is primarily focused on providing security software solutions to mid-market businesses.Kris Hagerman, CEO, Sophos, said, “Our transition to become a fully next-gen cybersecurity leader continues to rapidly progress. Last quarter, our next-gen product portfolio represented over 60% of our entire business,  and grew 44% year-over-year. And very recently, we launched our most significant network security technology ever, the Sophos XG Firewall with Xstream architecture. With Thoma Bravo as a partner, we believe we can accelerate our progress and get to the future even faster, with dramatic benefits for our customers, our partners and our company as a whole.”

Seth Boro, managing partner at Thoma Bravo, said, “Sophos has been constantly raising the bar with its industry-leading synchronized security, advanced deep learning technology and rapid growth within the MSP channel. We are excited to partner with Sophos to help build upon their success as they further drive innovation in cybersecurity.”

The announcement comes after Sophos partnered with Mapua, a Philippines-based technology university, to offer cybersecurity courses and training to university students. The training alliance comes on the heels of a skills shortage in the cybersecurity sector and frequent data breaches in recent years. The partnership intended to enhance students’ skills and knowledge of cybersecurity. As per the partnership, Sophos will offer train-the-trainer-style education on XG Firewall, which would earn Mapua faculty members the certification to teach the courses and embed these into the university curriculum.

Nigeria Among Top 10 Countries Impacted by Mobile Malware: Kaspersky Lab

Pegasus Spyware, Mobile Security, spyware

In its report titled “Mobile Malware Evolution 2019,” global cybersecurity firm Kaspersky Lab states that Nigeria is among the top 10 countries in the world where users are attacked by mobile malware. The report adds that Nigeria dropped four places to the number seven spot in the list, recording 33.16% attacks of the total share.

Two other African countries made it to the list: Algeria in fourth place (40.2%) and Tanzania in eight place (28.51%). The list was topped by Iran (60.64%) with the highest number of attacks on users. Pakistan and Bangladesh are in second and third place respectively.

The good news, according to Kaspersky Lab, is that there has been an overall decline in the number of mobile threats distributed as installation packages or apps, over three consecutive years.

To quote from the report: “For three consecutive years, we have seen an overall decline in the number of mobile threats distributed as installation packages. The picture largely depends on specific cybercriminal campaigns: some have become less active, others have completely ceased, and new players have yet to gain momentum.

The situation is similar to the number of attacks using mobile threats: whereas in 2018 we observed a total of 116.5 million attacks, in 2019 the figure was down to 80 million.”

Last month, Kaspersky reported that cybercriminals are targeting the popularity of pop stars such as Ariana Grande, Taylor Swift and Post Malone, with over half (55%) of detected malicious files named after them. Another teenage pop music sensation, Billie Elish, has seen a tremendous increase in fan following owing to her notable hits like, Bad guy, Xanny and Everything I wanted. This has led to a subsequent rise in cybercriminals abusing her name and songs to target her followers.

The regions most affected with these malware attacks are the UAE and Nigeria.

Silence Hacking Crew Threatens of a DDoS Attack Against Australian Banks

DDoS Attacks

Australian banking and financial institutions received extortion emails threatening them of possible distributed denial of service (DDoS) attacks against them. To avert this situation the extortioners demanded a ransom that needs to be paid in the form of Monero (XMR) cryptocurrency. The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) is aware of this extortion campaign and issued threat advice to all Australian organizations.

The DDoS Scare for Australian Banks

The Silence Hacking Crew claimed the responsibility of this threat campaign, however, ACSC was not able to confirm these claims until going to print. Silence hackers are one of the most active Advanced Persistent Threat (APT) actors’ group reportedly backed by Russian state-sponsors. The crew is specifically targeting the financial sector due to the huge amount of customer PII data that these institutions possess (which also makes them most vulnerable in case of a cyberattack) and their capability of paying larger ransom amounts.

The ACSC confirmed that although the ransom driven DDoS (better known as RDoS) campaign has been running actively across the country, no instances of successful DDoS attacks have been reported yet. However, it also recommended that being prepared for such type of a cyberattack is the best immediate incidence response strategy before a DoS attack is initiated.

Silence Hackers Target Banks Around the Globe

Earlier in January 2020, researchers from Kaspersky discovered thousands of attack notifications on popular banks in the sub-Saharan Africa (SSA) region. Researchers said that signatures of the Silence hacker group were observed in these attacks. They reportedly deployed a malicious code on the bank’s network to run malicious commands on hosts and allegedly used the access to orchestrate fund withdrawals from the bank’s ATMs.

In another instance, the research firm Group-IB discovered that the same group of hackers breached multiple banks in 25 plus countries worldwide, including Bangladesh, India, Sri Lanka, and Kyrgyzstan. The worst-hit of them was the Dutch Bangla Bank where the attackers apparently scooped out more than US$3 million in an ATM cash-out attack in May 2019.

54% of Organizations Don’t Follow Best Data Security Practices: Report

Global Cybersecurity Outlook 2022,Cybersecurity, CEO, CISO

Cybersecurity firm Netwrix announced the release of its report called “2020 Data Risk & Security” that surveyed nearly 1,045 decision-makers in the security field to know about how their organizations treat sensitive and regulated data during each stage of its lifecycle. The study is intended to identify common security gaps in data processing activities.

According to the report, 91% of respondents were certain their sensitive data is stored safely while one in four organizations admitting they had discovered such data outside of designated secure locations last year.

The report also highlighted that 61% of organizations that are subject to the GDPR collect more customer data than the law permits. It’s found that 66% of CIOs don’t have cybersecurity and risk KPIs that are regularly reported to their executives. Nearly 54% of organizations said that they do not follow the security practices like reviewing user access rights to data on a regular basis. It also revealed that 30% of system administrators granted direct access to sensitive and regulated data base only on user requests.

Steve Dickson, CEO, Netwrix, said, Even as cybersecurity budgets grow, data breaches continue to increase in both number and size. Cybersecurity leaders need to find more effective ways to manage data security risks and show return on investment to the executive team. Gaining more visibility into data, internal processes and user activity will enable them to prioritize their efforts, mitigate security and compliance risks more efficiently, and prove the effectiveness of their investments.”

“Unstructured data often accounts for nearly 80% of the data footprint of an organization. The true extent and size of unstructured data are often unknown due to compression, deduplication and the number of copies of data within the organization. Beyond the substantial proportion of dark data prevalent in the average organization, within the unstructured dataset is often found more than 10 copies of the same files just through data protection, backup and recovery, business continuity, testing, and other automated activities,” Dickson added.

Raytheon Partners IronNet for Enhanced Protection for OT/IT Systems

Raytheon Partners IronNet for Enhanced Protection for OT/IT Systems

Military contracting giant Raytheon and cybersecurity startup IronNet Cybersecurity Inc. have partnered to develop cyber solutions for defense of operational and information technology (OT/IT) systems. The new alliance integrates Raytheon’s managed security services with IronNet’s advanced analysis and threat sharing tools to build new solutions for enterprise protection.

Raytheon stated that the combined solutions are intended to be a part of defense offering for critical infrastructure and national security networks. The partnership strengthens OT/IT platforms to increase resiliency for systems that orchestrate sensing, control, networking, and analytics to interact with the physical world, and enable secure performance.

John DeSimone, Vice President of cybersecurity at Raytheon Intelligence, Information and Services, said, “Protecting critical infrastructure is no longer a private sector concern, but a national security imperative. We know malicious actors seek to disrupt global economies through attacks on technology systems that keep our lights on, food supplies safe and militaries prepared. This partnership offers the integration of advanced cyber products and operations experience to the global market.”

GEN (Ret.) Keith Alexander, CEO and Founder of IronNet Cybersecurity, said, “Considering the role Raytheon plays in securing government agencies, global businesses, and even nations, we are excited to work together as we shift the cybersecurity defense paradigm from one that sees organizations defending alone to one that operates as a part of a collective. We can all benefit from working together to increase the visibility we have into incoming threats, sharing that information, and defending more quickly.”

Earlier, Raytheon received US$406 million Indefinite Delivery/Indefinite Quantity contract award from the U.S. Army for ARC-231A radio systems. The ARC-231A is software-defined and can accommodate rapid upgrades without requiring the radio to be removed from its platform. The radios will be installed on a variety of army platforms, including the UH-60 Black Hawk, UH-72 Lakota utility helicopter, and the AH-64 Apache attack helicopter.

Canadians Neglect Personal Data Security: Equifax Reports

Most individuals in Canada think they’re not vulnerable to identity thefts and neglect checking credit reports that help detect fraud, a recent consumer survey conducted by Equifax revealed. The credit reporting agency advised Canadians to remain vigilant against online fraudsters and identity thefts after it found that only 29% of survey respondents checked their credit report last year and only 38% indicated they would report fraud to a credit bureau. Equifax asked individuals to report any fraud alerts on their credit reports to prevent fraudulent activities.

While most (92%) agreed that fraud and identity theft is a serious issue, the new survey data also suggests Canadians are feeling less vulnerable to fraudsters online, on-the-go, at-home and in-store. In the same survey conducted by Equifax in 2017 and 2019, 80 percent of survey respondents said they felt vulnerable to online fraud versus only 72% in 2020.

The survey also highlighted that millennials are at risk of identity theft. According to Equifax, a greater number of millennials don’t know how to address identity theft. The survey cites that they clicked on fraudulent email links, they don’t worry about credit card fraud or believe they won’t be targeted because they don’t have enough money; they don’t check bank or credit card statements, and are less likely to change social media passwords as needed.

Julie Kuzmic, Director of Consumer Advocacy, Equifax Canada, said, “Hackers, fraudsters and identity thieves are always on the hunt to get your personal information. We can’t be complacent about this and one of the best ways to spot identity theft is by checking credit reports for unrecognized activities, which may provide an indication that someone has been applying for credit in your name or fraudulently accessing your accounts. I’m particularly concerned for younger adults who may be misguided in some of their beliefs and actions surrounding identity theft.”

Canadian Legislation Lacks Cybersecurity Awareness

Earlier, a similar survey from Keyfactor, a provider of secure digital identity management solutions, revealed that the Canadian government isn’t doing enough to protect businesses and consumers from data breaches. It found that 87% of surveyed cybersecurity pros think that more privacy and security legislation is required to better protect Canada’s businesses and consumers.

According to the survey, 58% of respondents think regulators and the Canadian officials have not tried to regulate the security guidance on measures like data encryption. The survey also highlighted that 50% of respondents thought of manual and complex processes as their greatest challenge in managing Public Key Infrastructure (PKI), while 43% of respondents were concerned about their ability to securely adopt DevOps, cloud, and IoT.

Cyberthreats: The New Threat Frontier for Singapore Armed Forces

Cyber weapons, cyber threats

The threat landscape for governments is no longer limited to land, air and sea. This is very evident from the policy and budget restructuring that Singapore is doing, keeping in mind the country’s digital boundaries and the cyberthreats associated with it. Singapore’s Defense Minister, Ng Eng Hen, announced the formation of a integrated cyber command and force to defend the country’s digital frontier.

Speaking in the Singapore Parliament on behalf of the Ministry of Defence (MINDEF), Dr. Ng further stated that the responsibility of finding the right personnel with the right aptitude will be overseen by a team led by the Chief of Defence Force (CDF) and Permanent Secretary (Defence Development). The process of complete integration will take time, but it is important to “build an integrated cyber command and force, especially against foreign cyber actors, both state and non-state who seek to undermine our stability and/or pose a threat to national security.” Once the CDF is completely established and functional, it will continue to oversee mission outcomes, while the Chief of Command, Control, Communications, Computers and Intelligence (C4I) will report the daily cyber warnings to the CDF.

The new SAF cyber command will have the responsibility of providing advanced threat intelligence, assessment and issue warnings for potential cyberattack threats. “The universe of cyber threats and activists is large, and the cyber command will have to prioritize its efforts and focus on key threats so as to not dissipate resources,” Dr. Ng added.

Besides cyberthreats, the Defence Minister also said that the country’s maritime capabilities and counter-terrorism intelligence are also being restructured keeping in mind the geopolitical stress in the surrounding region.

Earlier, in order to boost cybersecurity and tackle next-generation cyberthreats, the Singapore government decided to adopt new data protection measures. The government also established a committee, named Public Sector Data Security Review Committee, to review its data security practices.  As per reports, this committee inspected around 336 network systems across 94 government agencies and observed international data security practices in the financial and healthcare sectors.

“An organization’s security culture requires care and feeding”

Ravinder Arora, Chief Information Security Officer, IRIS Software

Ravinder Arora, Chief Information Security Officer, IRIS Software is an award-winning CISO, speaker and trainer. He is the winner of the TOP100 CISO Award (2014-2017), Innovative CIO Award (2017), and Info-Sec Maestros Award (2017, 2018). He also won the Best CIO and CISO Award from Enterprise IT World. Arora is a much sought-after CIO/CISO in India and has served on many panels and committees on Information Security. 

He has worked with India’s National Skill Development Mission (under the aegis of the Ministry of Skill Development and Entrepreneurship) for creating cybersecurity awareness and sharing knowledge with students. 

Before IRIS Software he served organizations like Hewlett Packard and GENPACT. 

In an exclusive interview with Brian Pereira, Principal Editor, CISO MAG, Arora reveals the initiatives and strategies he undertakes to make employees and management cyber-aware, in a very engaging way. We also asked him about the qualities and abilities that make a good CISO.

Are organizations in India doing enough to make their employees aware about cybersecurity? Is it only the larger companies in regulated industries?

Information security has become one of the most important and challenging issues facing today’s organizations. With use of technology and widespread connectedness to the environment, organizations increasingly have become exposed to numerous and varied threats. Outsourcing and offshoring bring new partners into an extended enterprise, with different technologies, cultures, and sensitivities to information management. Contracting, telecommuting, and mobile workers all contribute to new security risks.

A survey conducted by Computer Security Institute with the participation of the FBI’s Computer Intrusion Squad clearly stated that: “Overall financial losses from 530 survey respondents totaled US$201,797,340…”

The report also states: “Cyber-crimes and other information security breaches are widespread and diverse. A full 92% of respondents reported attacks.”

Most Indian organizations (90%) faced challenges regarding employee or leadership cybersecurity awareness and education. I would say many organizations have started working in this domain but still have a long way to go.

We can say “Yes” for large companies. This is a culture change but slowly, small companies are also getting this change in their culture.

What are some of the initiatives you have taken in your company to make employees and senior management cyber-aware?

An organization’s security culture requires care and feeding. It is not something that grows in a positive way, organically. You must invest in a security culture. A sustainable security culture is bigger than just a single event. When a security culture is sustainable, it transforms security from a one-time event into a lifecycle that generates security returns forever.

There are different programs that we run periodically to ensure awareness among employees and leadership. A month ago, we conducted Information Security Awareness Week in our organization. There were floor sessions on cybersecurity, different games, and a drill for identifying security champions. The most exciting item on the agenda was the information security skit. Apart from this, we have data privacy training that are mandatory to attend by every employee.

Apart from general awareness, there is also a need for application security knowledge. Application security awareness (AppSec) is for developers and testers within the organization, and we are doing this as we are a software company. AppSec awareness is teaching the more advanced lessons that staff need to know to build secure products and services. Our AppSec training is based on OWASP top vulnerabilities and guidelines. 

What impact has GDPR and other laws made on Indian organizations? Do you observe a change of attitude towards cybersecurity?

GDPR will replace the 1995 Data Protection Directive and is aimed at protecting the personal data of EU citizens in the new digital world. The regulation covers all the EU member states and citizens, so all global enterprises with operations or customers in EU must comply. Europe is a significant market for the ITeS, BPO and pharmaceutical sectors in India. The size of the IT industry in the top two EU member states (Germany and France) is estimated to be around US$155–220 billion. For the Indian IT industry to keep continuing to do business in Europe, it needs to comply with GDPR.

Indian companies are likely to face increased compliance costs on the back of GDPR or risk huge penalties if they fail to comply. But they could see it as a business opportunity. Moreover, following the Supreme Court’s verdict, a data protection framework has been proposed by the Srikrishna Committee in India. Of course, whether the legislation will satisfy the criteria laid down under the GDPR or not remains to be seen.

Penalties are high for non-compliance of these laws, so we can see a sense of seriousness and change of attitude towards cybersecurity.    

You have won a lot of awards and have been a Top100 CISO in India. What are the special abilities and strategies that have got you these accolades? What are the qualities that make a good CISO?

I would say I can closely listen and be ready to speak with anyone in a friendly and approachable manner. I can make risk-based business-oriented decisions and execute them.

I like to contribute to the information security community and that’s why community also rewards me, with awards. I am also a regular speaker in several colleges in India and have written more than 20 articles on cybersecurity for leading magazines.

Part of a CISO’s job is communicating directly with the board. That will involve reporting on progress, seeking funds for development, ensuring the company’s data security goals and objectives are being met, and being able to explain why, if they are not. Unfortunately for the CISOs, boards generally don’t speak “infosec.” So, their job also means translating their requirements, goals and reports into digestible chunks that a Board of directors can fully understand.

An important aspect of being a CISO is to remember that they can, if they really want, create a super vault, unbreakable and un-hackable, where information cannot escape. But this vault is probably going to impede the business from making money. After all, a business needs information to flow. A good CISO will always be playing a balancing act between what is good for security and what’s good for the business. 

You have worked with the National Skill Development Mission for creating cybersecurity awareness and sharing knowledge with students. What needs to be done in our education system to create more cybersecurity professionals or at least, nurture an interest towards cybersecurity in young minds?

I think there is clear gap in cybersecurity demand and supply of the right skill set. According to a 2019 survey, the current requirement of cybersecurity professionals is pegged at 3 million, whereas, the cybersecurity workforce is less than 0.1 million in India.

There is a lack of infrastructure in cybersecurity training in India. Many Indian institutes have launched courses on cybersecurity. But most of these courses are theoretical, based on presentations. These don’t expose candidates to practical real-world aspects of cybersecurity and the underlying dynamics–which could radically differ from one to another.

The Indian government, along with the top tier technical institutes, needs to improve the curriculum of such courses that comprise hands-on training using technologies such as cyber ranges. 

What is your biggest fear as a CISO? What gives you sleepless nights? And how are you preparing to counter that, with technology and strategy?

I think each morning seems to bring new reports of hacks, privacy breaches, and threats to national defense or our critical infrastructure. As the attacks become more sophisticated and more frequently perpetrated by nation-states, and criminal syndicates emerge, my fear is same as that of any other CISO–that my organization should be protected from any cyberattack, especially ransomware.

To counter these attacks, the most important part is to recognize the warning signs. Compliance lapses, audit issues, and a lack of metrics and transparency can all be harbingers of potential security problems as well. It’s very important to make time for innovation in security strategies and to use the latest tools and technologies.

Online Payment Fraud Losses Estimated to US$200 Billion: Research

Digital Fraud

A new report from Juniper Networks, a provider of AI-driven networks, revealed that businesses in eCommerce, airline ticketing, money transfer, and banking services will lose over US$200 billion to online payment fraud in the next five years. The research report, “Online Payment Fraud: Emerging Threats, Segment Analysis & Market Forecasts 2020-2024”, found that the increasing ubiquity of digital payments provides an ever-increasing attack surface for fraudsters.

According to the study, digital money transfer is a growing area for payment fraud, with losses growing by 130% from 2020 to 2024. Digital money transfer fraud is particularly strong in emerging markets, with payments vulnerable to SIM swapping fraud and synthetic identities, with less robust security measures in place.

Machine Learning to Defend Against Online Frauds

The research also highlighted that machine learning has become a crucial tool in the fraud detection and prevention arsenal as it enables payments industry stakeholders to analyze transaction flows in a holistic way, unlocking hidden insights on fraudulent behaviors. It also stated that the incorporation of machine-learning into fraud detection and prevention software will drive spending forward, reaching US$10 billion in 2024, a 15% increase from 2020.

Research co-author Nick Maynard said, “The rapidly evolving nature of payment fraud and increased sophistication in attack methods requires machine learning adoption at scale, in order to minimize risk. Constant innovation in analytics and data models is increasingly essential to constraining fraudulent behaviors in payments”.

Earlier, in similar research, Juniper revealed that Asia-Pacific (APAC) service providers were concerned over their security infrastructure as they adopted new technologies like distributed clouds, IoT, and 5G. According to the research findings, only 29% were satisfied with their current firewall. Around 65% will upgrade their firewall within the next year. And, 61%t plan to increase spending on firewall products and services in the future. The findings are based on the responses of IT decision-makers from service providers across APAC. The report also highlighted that increased adoption of new technologies forced service providers to scale up and scale-out their security infrastructure to remain relevant and secure.

1...237238239...410Page 238 of 410