Home Blog Page 239

Trend Micro Reports 10% Increase in Ransomware Attacks in 2019

Hive Ransomware

Cybersecurity firm Trend Micro stated that it found 10% increase in ransomware detections, despite a 57% decrease in the number of new ransomware families. In its Annual Threat Report 2019, the company stated that healthcare sector remained the most targeted industry, with more than 700 providers affected in 2019. According to the report, nearly 110 state and municipal governments and agencies in the U.S. fell victim to ransomware last year.

Trend Micro also highlighted that it disclosed 171% more high severity vulnerabilities than in 2018. In order to defend against threat landscape, The firm also suggested enterprises to adopt connected threat defense across gateways, networks, servers, and endpoints. Additionally, it also suggested few security practices to enhance company’s security posture:

  • Mitigate ransomware with network segmentation, regular back-ups and continuous network monitoring
  • Update and patch systems and software to protect against known vulnerabilities
  • Enable virtual patching, especially for operating systems that are no longer supported by the vendor
  • Implement multi-factor authentication and least privilege access policies to prevent abuse of tools that can be accessed via admin credentials, like remote desktop protocol, PowerShell and developer tools

Jon Clay, director of global threat communications for Trend Micro, said, “Digital transformation has been a business buzzword for decades, and the concept has yielded very positive results over time. But security is often an afterthought, which leaves digital doors wide open for cybercriminals. Despite the prevalent ideals of digital transformation, lack of basic security hygiene, legacy systems with outdated operating systems and unpatched vulnerabilities are still a reality. This scenario is ideal for ransomware actors looking for a quick return on investment. As long as the ransom scheme continues to be profitable, criminals will continue to leverage it.”

U.S. RailWorks Corp. Reports Data Breach Post Ransomware Attack

US Railroad

The U.S.-based railroad company, RailWorks Corporation, reported a data breach to the Office of the Attorney General of California, which has potentially compromised the confidential PII of its employees. Although the description of the data breach occurrence mentioned in the notice given to the Attorney General is not clear, it does suggest the nature of the attack to be a ransomware attack.

Ransomware Attack on RailWorks Corporation

As per the report, RailWorks Corporation was targeted by a ransomware attack on January 27, 2020. During this attack, RailWorks Corporation’s systems and servers were encrypted, and this potentially led to a data breach of the PII (personally identifiable information) of its 3,000+ employees. The breached employee information includes name, address, driver’s license, Social Security Number (SSN), date of birth, date of employee hiring/termination and/or retirement.

RailWorks informed its employees by email about the data breach incident between January 30 and February 7, 2020. It said that no indication of employee PII misuse was recorded till the time of publish, but as a precautionary measure, it has tied up with Identity Guard Total to provide free credit monitoring to those affected with the data compromise for the next twelve months. This credit monitoring service uses IBM Watson Artificial Intelligence service to keep an eye on the Dark Web and alerts registered user if their SSN, credit cards, and/or bank account numbers are found on unsecured online locations.

Ransomware Attack on U.S. Gas Pipeline

Earlier in February 2020, a ransomware attack on a U.S. natural gas supplying facility brought its operations to a standstill for two days when the organization’s incidence response team implemented a deliberate and controlled shutdown to contain the ransomware spread.

In an alert issued by CISA (Cybersecurity and Infrastructure Security Agency), the government agency did not mention the time, date, type/name of the ransomware or the natural gas facility name that was impacted. But it did mention other vital information like the way this ransomware attack was carried out so that in future other organizations can take useful notes in planning their risk mitigation measures.

Japan’s Trend Micro to Help Boost Cybersecurity in Kazakhstan

NCSC and Microsoft Cyber Accelerator program

Japanese cybersecurity company Trend Micro signed an agreement on scientific and technical cooperation with Kazakh security firm T&T Security, to support a government initiative known as the “Concept of Cyber Security” or “Kazakhstan Cyber Shield.” The new partnership is intended to develop and implement local projects in the field of information security in Kazakhstan.

As per the alliance, T&T Security integrates Trend Micro’s existing security solutions to monitor suspicious network activity, malware threats, prevent intrusions, and protect servers and workstations from potential cyber risks. Founded in 2013, T&T Security helps organizations combat new generation of cyberthreats, which are not detected by traditional antivirus technology. The company claims that its security solution “tLab system” is a leading-edge malware protection product that can identify malicious software.

Ruslan Abdikalikov, the Deputy Chairman of the Information Security Committee of the Ministry of Digital Development, Innovation and Aerospace Industry of Kazakhstan, stated that that the partnership will strengthen the security posture of the state’s information systems and enhance its cybersecurity landscape.

Earlier, Trend Micro made a strategic partnership with the developer-first security company Snyk to help businesses cope with potential vulnerabilities without interrupting the software delivery process. The alliance integrated open source vulnerability intelligence from Snyk with Trend Micro’s comprehensive ability to detect vulnerabilities for teams operating in a DevOps environment. Snyk helps enterprises in detecting and fixing the vulnerabilities and license violations in open source dependencies. The company claimed that its security solutions platform is built on a comprehensive, proprietary vulnerability database, and maintained by security veterans in Israel and London.

Only 38% of Government Employees Trained on Ransomware Prevention: IBM Report

A recent survey, “Public Sector Security Research,” from IBM Security revealed the results of the local and state employees’ preparedness toward dealing with cyberattacks. The study, jointly conducted by IBM and market research company Harris Poll, found that 73% of government employees are concerned about potential ransomware attacks to cities across the U.S while adding that only 38% of employees were trained to prevent ransomware attacks.

The study, which surveyed 690 people working for state and local agencies in the U.S., highlighted that 52% of security professionals feel their budgets for handling cyberattacks have remained the same over the years. More than 100 cities across the U.S. were hit with ransomware in 2019, with one in six respondents disclosing that their department was affected by a ransomware attack.

Employees in Public Education Sector

Public schools and government education agencies became the biggest target for cybercriminals in 2019. According to the survey findings, ransomware affected school districts in New York, Massachusetts, New Jersey, Louisiana and other states last year. The effects of such attacks resulted in the loss of personal information, including student grades and qualifications, teacher employment and payroll information, family records and medical health records

The study also found that respondents from the field of education had the lowest amount of cybersecurity training compared to other state and local professionals. Nearly, 44% of employees from the public education sector said they hadn’t received basic cybersecurity training, while 70% said they hadn’t received adequate training specifically on how to respond to a cyberattack.

2020 Elections Concerns

The study also found that 63% of respondents were concerned that a cyberattack could disrupt the upcoming elections. The fear of ransomware attacks feel real to a majority of government employees, with 73% expressing their concerns about threats to U.S. cities. Also, the Cybersecurity Infrastructure Security Agency (CISA) earlier warned that ransomware attacks pose a heightened risk to the elections.

“The emerging ransomware epidemic in our cities highlights the need for cities to better prepare for cyberattacks just as frequently as they prepare for natural disasters,” said Wendi Whitmore, VP of Threat Intelligence, IBM Security. “The data in this new study suggests local and state employees recognize the threat but demonstrate overconfidence in their ability to react to and manage it. Meanwhile, cities and states across the country remain a ripe target for cybercriminals.”

Ransomware Attacks and Data Breaches on U.S. Schools and Colleges Triple in 2019

Ransomware attacks, ransomware, Sinclair Broadcast group

According to a report from the K-12 Cybersecurity Resource Center, the K-12 public school districts and education agencies across the U.S. suffered a total of 348 cyberattacks in 2019, which is three times more incidents that were disclosed in 2018. The report, “The State of K-12 Cybersecurity: 2019 Year in Review,” stated that most of the attacks that were significant resulted in the theft of millions of dollars, stolen identities, denial of access to school technology and IT systems for weeks. The effect of such attacks on educational institutions resulted in loss of personal information, including student grades and qualifications, teacher employment and payroll information, and family records and medical health records.

The report also highlighted that 775 cybersecurity incidents impacted students and educators since 2016, in which over 50% of them were due to insiders in the school community, including vendors and other third-party partners. The second most frequent type of security incident suffered by schools, according to the report, was ransomware attacks.

Douglas A. Levin, President of EdTech Strategies and report author, said, “There are important steps policymakers, IT leaders, and educators can collectively take to help mitigate the cyber risks facing school districts. These include investing in greater K-12 IT security capacity, mandating baseline K-12 cybersecurity risk management practices via regulation and supporting enhanced information sharing and research.”

Ransomware Attacks on K-12 Schools

According to a report from Emsisoft, an anti-malware and anti-virus service provider, there were around 86 universities, colleges, and school districts impacted, which in turn disrupted operations of nearly 1,224 individual schools due to ransomware attacks. The report also shared a list of  top three incidents of public schools being affected by ransomware attacks:

Louisiana public schools: In July 2019, Louisiana Governor declared a state of emergency after three public school districts fell victim to ransomware. A State of Emergency was re-invoked in November when another ransomware attack affected 10% of Louisiana’s 5,000 network servers and more than 1,500 computers.

Rockville Centre School District: On July 25, 2019, Ryuk ransomware hit Rockville Centre School District. The district’s insurance carrier negotiated the ransom demand of US$176,000 down to US$88,000, which was covered by them.

Las Cruces Public Schools: In late October 2019, a ransomware attack infected thousands of servers and devices in Las Cruces Public Schools, New Mexico. The district disagreed to pay the ransom and instead ended up reformatting close to 30,000 devices.

K-12 Cybersecurity Act

K-12 district schools have been a soft target for cybercriminals. To address the same, two U.S. Senators, Gary Peters (Michigan) and Rick Scott (Florida), both members of the Senate’s National Security and Government Affairs Committee, have tabled a new bill called “K-12 Cybersecurity Act” in December 2019.

The K-12 Cybersecurity Act was introduced to address the rising threat prospective on K-12 schools.  The Act directs the DHS Cybersecurity and Infrastructure Security Agency (CISA) to first study the specific cybersecurity risks associated with K-12 educational institutions. Once the study is done, CISA will then be responsible to develop cybersecurity recommendations and set up online tools to help schools with their cybersecurity requirements.

Technical Error in Samsung’s U.K. Website Exposes Customers’ Data

Smartphone manufacturer Samsung Electronics Co. Ltd. revealed that a technical glitch on its U.K. website temporarily exposed the private information of around 150 customers. The issue came to light after some of its customers reported that they were able to access information of other customers on the website.

The South Korean manufacturer said the error exposed customer data including names, contact details, addresses, email IDs, and details of previous orders. However, the company clarified that only its U.K. customers were affected, and no credit card and financial information were exposed in the incident. Samsung halted all user logins into the website, after it became aware of the error until the issue was resolved. The company also stated that it will notify the affected customers.

Technical Glitches in Samsung Galaxy S10

In October 2019, Samsung issued an apology after a user reported technical issues with fingerprint recognition on its flagship Galaxy S10 smartphone. The user stated that she bought a new US$3.50 screen protector for her Galaxy S10 device and then registered her fingerprint for its on-screen fingerprint recognition security feature. She later realized that her husband was able to unlock her phone even without registering his fingerprint with the mobile phone’s fingerprint reader. To double-check this flaw, she asked her sister to unlock the phone using her fingerprint and to her surprise, this worked as well.

It is a known fact that smartphone biometric security features are not as secure as they claim to be but fooling the Samsung Galaxy S10 device with a mere US$3.50 screen protector is difficult to digest. This is not the first time that Samsung faced issues with its biometric security features. Previously, Samsung’s other flagship smartphone, Galaxy S8, was laced with facial and iris recognition biometric security feature issues.

NULLCON to Launch 11th Edition of Cybersecurity Conference in Goa, India

NULLCON Goa

All roads lead to Goa, India’s tourist destination, next week, for the NULLCON 2020 Conference.  NULLCON, Asia’s leading information security conference, training and exhibition platform is all set to happen on March 6 and 7, 2020 at the Taj Hotel & Convention Centre, Dona Paula, Goa. It is one of the largest information security conferences where hackers, industry experts, vendors, delegates from the government, CISOs and other C-Suite executives come together to discuss the current scenario of information security and what lies ahead.

NULLCON started in 2010 and this is the 11th edition of the conference and exhibition. NULLCON offers extensive platforms, technical sessions, panels, and training workshops for the exchange of information about zero-day vulnerabilities, latest attack vectors, and other cyberthreats. Here, security researchers and experts from various fields discuss information security, along with showcasing multiple offensive and defensive security technologies.

The brand NULLCON was derived from “null” – the open security community, a registered not-for-profit society and the largest active security community in India.

Here are some of the highlights of the 11th edition of NULLCON.

NULLCON – Surveillance and Zero-Day:  

  1. Talk: The Metadata Trap: Whistleblowers in the Age of Surveillance and Big Data

Speaker: Micah Lee, Director of Information Security at The Intercept https://nullcon.net/website/goa-2020/speakers/micah-lee.php

Micah will discuss the evidence used against the eight (so far) U.S. government workers that the Trump Administration has prosecuted for talking to and sharing documents with the media, and what this means for the safety of whistleblowers in a world where everything we do is being logged. The surveillance is global, so the lessons are global as well.

  1. Talk: How KRACKing Amazon Echo exposed a billion+ vulnerable Wi-Fi devices

Speaker: Robert Lipovsky, Senior Malware Researcher at ESET

https://nullcon.net/website/goa-2020/speakers/robert-lipovsky.php

This talk will discuss Wi-Fi zero-day vulnerabilities involved in KRACKing Amazon Echo and Kindle. The attack, which could enable adversaries to decrypt wireless network packets, affects Wi-Fi chipsets used in over a billion devices.

NULLCON – macOS/iOS Security:

  1. Talk: Putting it all together: building an iOS jailbreak from scratch

Speaker: Umang Raghuvanshi, Security Researcher, specializing in iOS kernel and browser exploitation.

https://nullcon.net/website/goa-2020/speakers/umang-raghuvanshi.php

This talk will discuss in detail how iOS devices can be jailbroken.

  1. Talk: KTRW: The journey to build a debuggable iPhone

Speaker: Brandon Azad, Security Researched, at Google Project Zero

https://nullcon.net/website/goa-2020/speakers/brandon-azad.php

This talk will discuss a high severity bug found in Apple devices where a local attacker can gain elevated privileges on Apple TvOS and is assigned CVE-2020-3837.

NULLCON – Legal and Policy:

Panel Discussion: Hack the law: Protection for ethical cybersecurity research in India”

Moderator: Apar Gupta, Executive Director, Internet Freedom Foundation

https://nullcon.net/website/goa-2020/speakers/hack-the-law.php

This Panel Discussion will clearly assess the legal landscape, the needs of cybersecurity experts in India and the necessary legal reforms. The focus will be on different government policy and legislative initiatives such as the Cyber Security Policy, the Information Technology Act, Data Protection Bill and even sometimes tertiary laws such as defamation.

To register for a NULLCON Goa 2020 complimentary conference media pass (6th & 7th
March 2020):  https://nullcon.net/website/media-pass.php

CISO MAG’s editor Brian Pereira will be onsite to cover the NULLCON 2020 Conference in Goa.

Milton Security Group and SynED Partner to Boost Cyber Workforce in California

cybersecurty

Cybersecurity firm Milton Security Group announced a new partnership with SynED to increase employment opportunities in the cybersecurity industry in California. SynED is a non-profit organization that works with educational institutions, training partners, placement agencies, and service providers to increase a strong and highly skilled workforce across California.

Milton Security and SynED have established a baseline of skills to evaluate and further develop cybersecurity candidates. Milton Security will share this knowledge to assist other organizations in placing their candidates and building a stronger cybersecurity workforce. The company is specialized in 24/7 cyber threat hunting, monitoring, and incident response services.

Commenting on the new alliance, Ethan Coulter, President of Milton Security, said, “We help passionate people find their path into this industry. This not only benefits professionals seeking to enter our industry, but our customers as well, and yes, even our competitors. Our goal is to help even more people enter the cybersecurity industry and we have established a successful legacy by hiring individuals who do not fit a traditional mold.”

Scott Young, President of SynED, said, “Through strong partnerships, like we have with Milton Security, we will build the foundation of a new approach for developing a robust cybersecurity talent supply chain and subsequently strengthening the overall security of our nation. We are thrilled to work with such passionate and visionary partners.”

California Government’s Support to Cybersecurity Education

The government of California earlier announced its support to cybersecurity education and committed to providing programs and events that help train the next generation of cybersecurity professionals. The officials also initiated a program, the California Mayors Cyber Cup (CMCC), which utilizes cyber competitions to spread awareness about cybersecurity and the many career opportunities that exist within that field. CMCC brings students, parents, teachers, government officials, business leaders, and other stakeholders together to create awareness of cybersecurity issues and reinforce the connection between the community and the educational institutions to highlight the many career and business support resources available in each community.

Kr00k Vulnerability Allows Wi-Fi Packet Decryption

Home Routers for botnets

At the ongoing RSA Conference USA 2020 in San Francisco, ESET, an antivirus company, shed light on Kr00k vulnerability that is affecting around a billion people having Wi-Fi chips manufactured by Broadcom and Cypress. It is a security bug or a flaw that forces devices to use a zero-encryption key to partly encrypt communication with the compromised device. Once the attack is complete, the attacker can easily exfiltrate information by intercepting and decrypting data packets sent over the WPA2 network.

These Wi-Fi chips have already been in use on many laptops, smartphones and IoT devices. In fact, ESET confirmed that before respective patches were applied to fix the flaw, the following devices were tested positive for kr00k vulnerability:

  • Amazon Echo / Kindle
  • Apple iPhone / iPad / MacBook
  • Google Nexus
  • Samsung Galaxy
  • Raspberry Pi 3
  • Xiaomi / RedMi
  • And certain Asus and Huawei products

How Kr00k Works

When data is transmitted over the Wi-Fi, it is sent in packets (in this case, over WPA2 network). For data security purpose these packets are encrypted using a unique key. Researchers found that this unique key was getting set to all-zero value.

Disassociation (i.e. disconnection) in Wi-Fi networks is a common phenomenon that happens on a regular basis due to a weak internet signal. But Wi-Fi networks are configured to automatically reconnect to the previously used networks. While reconnecting, the kr00k vulnerability allowed attackers to set the data packet encryption key value to all-zero. Thus, it became easy for the attacker to intercept and decrypt all-zero encrypted packets.

Initially, ESET didn’t go public with its findings. It wanted to help all the stakeholders involved to first rectify the issue and avoid kr00k’s exploitation. Instead, they contacted Broadcom and Cypress to fix the issue and release a security patch to contain the damages. ESET also reported the kr00k vulnerability issue to ICASI to alert other impacted vendors.

A CISO’s Guide to Managing Change and Politics

Board meeting, CISO, leadership

It seems that nearly all CISOs, regardless of whether they’re a transformational CISO or a steady-state CISO, currently are going through some kind of an uplift, transformation, or driving a major program (e.g., Zero Trust). While there are many challenges involved, it’s important to note that they are not technological. In fact, they are far from it – these challenges will be mostly organizational and political.

By Jinan Budge, Principal Analyst, Forrester

And yet most CISOs are not equipped to deal with this for several reasons. They are bombarded with tactical requests; they’re dealing with a security image that’s transcended the ages yet not everyone in the organization loves the security team, and will not always be welcoming to security initiatives; security professionals generally hate the idea of politics and avoid it at all costs; and change is difficult for many people. Because of these, many detractors come out of the woodwork when a CISO kicks off a new security program.

CISOs Need to Drive Change Using The 3 P’s: People. Process. Politics.

For CISOs to ensure the success of their security function and programs, they will need several qualities seldom discussed in the security industry: leadership, business insight, people skills, determination, pragmatism, and personal resilience. They can best navigate their way through organizations by paying attention to three crucial P’s: People. Process. Politics.

People: Supporters and Detractors 

The very best strategy in the world will go nowhere unless CISOs manage to execute it. In order to execute, they will need to convince stakeholders to undertake the journey with them, or at least support them in their respective journeys. Remember, everything comes down to human interactions, and human interaction is inherently complex and political.

Broadly speaking, stakeholders will fall into two camps: supporters and detractors. Each has its own set of needs, and like any other project, CISOs need to be methodical in their approach of engaging them. It’s not uncommon to see CISOs immediately resorting to reactive or one-off announcements about their strategy or program, typically acting too late. This only serves to fuel detractors and doesn’t give stakeholders the chance to support CISOs. Experience also indicates there’s a lot of fear of engagement, typically because no one likes criticism. Yet CISOs can achieve much more favorable and faster results if they follow these simple, yet often missed steps:

  • Understanding exactly who their key players are: Identify who needs to be on board with the strategy and role they assume in the approval, delivery, and maintenance of the plan.
  • Preparing the ground and socializing their strategy: Plant the seed of the need of the change, understand what each stakeholder needs and what they’re concerned about, and have socialization conversations one stakeholder at a time.
  • Listening and turning criticisms into a solution: You will improve your chances of influencing and convincing your stakeholders if you listen more than you talk.

Politics: Be ethical and maintain integrity to achieve great opportunity 

We as human beings tend to shy away from politics for good reasons, the most obvious one being because of what we see on television in our politicians. Typically, we equate elements of their rhetoric with backstabbing. But that is not in fact how senior leaders see politics – they see it as their greatest opportunity to really listen, really understand what people are saying, and persuade and build influence.  When CISOs listen, they have several advantages such as really hearing what the concerns of the stakeholder are and how to overcome them.  CISOs can then build a coalition of the willing for their strategy. By being transparent, CISOs are also building their reputation as a visible leader rather than a back-office operator.

Process: Utilize your persuasion and influence toolkit 

The conversation about politics, influence, and persuasion is not one that is discussed often in security. To the uninitiated, it may even sound like some high-level concept. Some might even confuse it with “begging on your knees.” Yet, CISOs can follow a thorough process with each of their stakeholders. This is professional political maneuvering at its finest that can absolutely be done with ethics, finesse and integrity. Follow these tools:

  • Collective Momentum: Socialize the security vision, strategy and change program and build momentum. When you finally present the vision, the CISO can list the engaged sponsors.
  • Authority: There’s nothing like influence from the top down. If the CEO believes in something, most of the time, the organization falls into line.
  • Mutual Exchange: If a CISO aids a potential sponsor over and above what’s required, they build goodwill. They may be able to use that later.
  • Scarcity: CISOs can use time or resource limits (such as regulatory deadlines or vendor discounts) to create urgency.
  • Foresight: CISOs need to keep their sponsors briefed and be transparent about all situations, positive and negative.
  • Relationship: CISOs need to build a positive relationship with the key players ahead of time, so that this relationship can influence the response.

CISOs Need to Decide Their Type and Flex Their Leadership Muscles Accordingly

CISOs should ask themselves how much of their current success is a result of their technical knowledge, and how much is the result of their ability to collaborate and persuade. Better still, they should do some self-reflection and decide the type of CISO they want to be. Currently, six types of security leaders exist: Transformational CISO, Post-Breach CISO, Tactical/Operational Expert CISO, Compliance and Risk Guru, Steady State CISO, and Customer-facing Evangelist.

Regardless of CISO type, CISOs will need to manage change, deal with politics and people. By doing this mindfully and understanding the type of CISO they are, CISOs can find their perfect organizational culture, be clear on which type background and characteristics serve best, know when to exit a toxic environment, plan for their future, be prepared for upcoming challenges, and build a positive, high performing team that reflects their type.

Additionally, they will execute security programs and likely deal with stakeholders at some level. This will require them to prioritize their role as a leader, and this involves them having to sharpen leadership skills, especially those that are unfamiliar. To help them do that, they should find mentors, executive coaches or mentors, as well as build a positive, high-performing team that reflects their CISO type. They will also need to manage their mental health to avoid burnout. Depending on respective CISO type, they should also seriously consider building their communication and public speaking skills.

And they should always remember, being political does not mean backstabbing, and change happens all the time, everywhere, whether they notice it or not. This leaves the CISO with a simple choice: help to drive change forward or simply follow change as it occurs.

About the Author

Jinan Budge, Principal Analyst, Forrester Jinan is an experienced leader serving security and risk professionals who specializes in transformational change and building sustainable cybersecurity, digital, and information risk management capabilities. Jinan has delivered outstanding results using strategic and innovative thinking in the cybersecurity field — building, standing up, and delivering significant cyber transformation strategies across the public and private sectors. Jinan’s research centers on building transformational and effective security programs by focusing and communicating the business issues and value of security to organizations and executives.

Views expressed in this article are personal. CISO MAG does not endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

 

1...238239240...410Page 239 of 410