Home Blog Page 240

U.K.’s Financial Conduct Authority Admits to Accidental Data Breach

biggest data breaches in India,data breach, Aptoide Android App Admits Data Breach, Suspends Sign-Up Option Temporarily, Panasonic

The U.K.’s Financial Conduct Authority (FCA) apologized after it accidentally exposed the confidential details of around 1,600 consumers who complained against it, in response to a Freedom of Information (FoI) request for data. In an official notice, the regulator stated that certain underlying classified information like names, addresses, and phone numbers of complainants may have been accessible on its website. However, the company clarified that no financial, payment card, passport or other identity information were exposed in the incident.

According to FCA, the exposed information is related to the individuals who complained between January 02, 2018, and July 17, 2019. FCA removed the relevant data from its website immediately after noticing the breach. “We have undertaken a full review to identify the extent of any information that may have been accessible. Our primary concern is to ensure the protection and safeguarding of individuals who may be identifiable from the data,” FCA said in a statement.

The regulator is reaching out to apologize the affected users and advise them of the extent of the data disclosed. It also reported the incident to the U.K.’s data privacy watchdog – the Information Commissioner’s Office.

 Lack of Cyber Readiness Among U.K. Businesses

According to a survey from data security firm Clearswift, around 70% of financial firms in the U.K. reported security incidents in 2019, in which half of the incidents occurred due to internal errors. The research, which surveyed 100 senior business decision-makers from financial organizations in the U.K., highlighted that most of the attacks have originated due to employees who failed to follow proper data protection policies. Apart from employees’ errors, the survey also revealed other reasons that led to attacks, including downloads of malware or viruses from third-party devices like USBs, and file transfers to unsecured sources.

Rising Cyberattacks on U.K. Businesses

A research from business and financial adviser Grant Thornton UK LLP discovered that cyberattacks are a present danger for businesses in the U.K. The research report, “Cybersecurity – the Board Report”, stated that the businesses are not prepared to manage the cyber risks. It also revealed that the mid-market businesses in the U.K. have lost around £30 billion (US$37 billion) in 2019 due to security breaches. Grant Thornton stated they surveyed over 500 U.K. mid-market companies, in which half of them reported losses of up to 10% of their income over cyberattacks.

NTT-AT and (ISC)2 Unite to Strengthen Cloud Security Workforce in Japan

U.S. and Australia to Jointly Develop Cyber Training Platform

The International Information System Security Certification Consortium (ISC)², a non-profit organization that provides training for cybersecurity professionals, announced an expansion of its strategic partnership with NTT Advanced Technology Corporation (NTT-AT) to strengthen cloud security workforce in Japan. The alliance is intended to bring more local-language cybersecurity training in the country.

Recognized as an Official Training Provider (OTP) of (ISC)2, NTT-AT offers public training on the official Certified Cloud Security Professional (CCSP) Common Body of Knowledge (CBK), helping reinforce cloud security capabilities of organizations throughout Japan. In addition to cultivating advanced security experts, NTT-AT is also focused on developing highly value-added security services and related products in order to support NTT Group’s businesses.

Clayton Jones, Managing Director at (ISC)², said, “There are few companies in Japan with the reach and scale that an organization like NTT-AT has, and our combined partnership will drive needed cloud security workforce development that helps to protect and defend critical data.”

“NTT-AT is committed to bringing top-quality cloud and cybersecurity training to Japan in order to help build a safe and secure cyber environment. Our collaboration with (ISC)2 enables us to provide official training to support a strong and skilled workforce,” said George Kimura, Chief Executive Officer at NTT-AT.

(ISC)² Partnership with Tokyo Police Department

In order to keep its forces updated with the latest cybersecurity trends and tactics, the Tokyo Metropolitan Police Department (TMPD) recently signed a Memorandum of Understanding (MoU) with the (ISC)². The alliance was aimed to revamp TMPD’s traditional law enforcement tactics and embrace the latest cybersecurity toolsets and expertise to counter the rising global cyber threat scenario.

 Cyberattacks on Japan Defense Sector

Multiple cyberattacks were reported by enterprises in Japan in recent times. Pasco Corp. and Kobe Steel, which render services to the Japanese armed forces, recently disclosed a data breach that took place in May 2018 and June 2015. Pasco Corp. is an aerial image surveillance provider and has tie-ups with the Japanese Ministry of Defense for delivering the latest satellite images to monitor the work and progress at various defense bases and other locations.

The other companies that reported data breaches targeting Japan’s defense secrets were NEC and Mitsubishi. On January 31, 2020, NEC, in a brief statement, accepted the data breach and stated that its network was penetrated and compromised to a cyberattack that was launched in December 2016. In January 2020, Japanese electronics manufacturer Mitsubishi Electric confirmed that it was hit by a cyberattack in June 2019. According to the internal investigation, which began in September 2019, the security incident compromised the information of Mitsubishi’s public and private business partners, defense-related details, and data on critical social infrastructure like electricity and railways.

Shadow IoT Devices Become Growing Risk Factor to Enterprise Security: Zscaler

IoT attacks

Cloud security company Zscaler stated in its report “IoT Devices in the Enterprise 2020: Shadow IoT Emerges as Security Threat,” that the shift in shadow IoT emerged as a security threat to enterprises’ security posture.

As enterprises embraced mobility and always-on connectivity for employees, the lines have blurred between company-owned and privately-owned devices, and between the workplace and the home. Zscaler stated that in many cases enterprise IT teams might not even be aware of some of the devices generating IoT traffic, and this new culture of shadow IoT is creating new IoT-based attack vectors for cybercriminals.

What are Shadow IoT Devices?

Shadow IoT devices are internet connected devices or sensors used inside an organization without the knowledge of the IT team in a company. A shadow IoT device can be any smart device like personal laptops, smartphones, fitness trackers, and smart home gadgets.

According to the report, the top unauthorized IoT devices include data collection terminals, digital signage media players, industrial control devices, medical devices, networking devices, payment terminals, printers, digital home assistants, TV set-top boxes, IP cameras, smart home devices, smart TVs, smartwatches, and even automotive multimedia systems. It also stated that new exploits are emerging to target unauthorized IoT devices like the RIFT botnet, which looks for vulnerabilities in network cameras, IP cameras, DVRs, and home routers.

The report also highlighted that the majority of IoT based transactions are insecure with 83% of IoT-based transactions occurring over plain-text channels, whereas only 17% use secure (SSL) channels. Zscaler claimed that it blocked 14,000 IoT-based malware attempts per month.

Deepen Desai, Vice President of Security Research at Zscaler, said, “We have entered a new age of IoT device usage within the enterprise. Employees are exposing enterprises to a large swath of threats by using personal devices, accessing home devices, and monitoring personal entities through corporate networks. As an industry, we need to implement security strategies that safeguard enterprise networks by removing shadow IoT devices from the attack surface while continuously improving the detection and prevention of attacks that target these devices.”

Shadow IoT Devices Become a Growing Risk Factor

An earlier report from cloud-managed services provider Infoblox revealed that organizations in the U.S. (46%), Spain (35%), and the U.K. (33%) believe that there are more than 1,000 non-business related IoT devices connected to their enterprise networks at a time.

The report, “What’s Lurking in the Shadows 2020” surveyed 2,650 security professionals across the U.S., U.K., Germany, Spain, the Netherlands, and UAE to know the role of shadow IoT devices in enterprise networks. Infoblox claimed that its research gained a better understanding of the challenges faced by security leaders in managing shadow IoT devices across their networks.

77% of Security Professionals Report Physical Security is Not Optimized

active directory
active directory

A research by cloud security firm Morphean which surveyed over 1000 IT decision-makers across Europe revealed that physical security systems are not optimized. According to the research, 77% of IT managers stated that physical security is not optimized and 20% identified physical security as a priority for improvement in 2020. While, nearly 50% of IT managers stated that currently, they’re using cloud-based video surveillance (VSaaS) or access control (ACaaS) solutions.

The report also highlighted that the increased appetite for hosted security presents an opportunity for IT resellers and physical security installers to help businesses improve their physical security, while also educating them on the potential business intelligence when VSaaS and ACaaS are integrated in the cloud. Through partnering, both sides can deliver optimal system set up protecting both the physical environment and the cybersecurity of systems through a comprehensive overarching solution that will better serve the needs of the market.

Rodrigue Zbinden, CEO of Morphean, said, “As the in-house IT department becomes increasingly involved in the purchasing and on-boarding of network connected surveillance and access control devices, greater collaboration will be required between IT resellers and physical security installers. In effect, the fast and effective provision of these systems that are fully optimized and fit-for-purpose, requires cooperation between the IT and physical security industries that are speaking the same language.”

Security Professionals are Overconfident on their Security Tools

A similar survey from Keysight Technologies, a technology firm that helps enterprises, service providers, and governments accelerate innovation to connect and secure the world, revealed that security professionals are overconfident in their tools with 50% of respondents reporting that they have experienced a security breach because one or more of their security products was not working as expected.

The survey, “Security Operations Effectiveness”, found that just over half (57%) of security professionals were confident their current security solutions are working as intended. Yet only 35% of survey respondents stated that they conduct testing to ensure their security products are configured and operating as they expect. To close this gap, 86% of respondents see strong value in security test solutions that can actively test their company’s security products and posture, using both internal and external attack vectors.

What Early Adopters Need to Know About SASE

Cloud Security, 80% of Organizations Suffered a Cloud Data Breach in the Past 18 Months

Last year, Gartner introduced the term Secure Access Service Edge or SASE in their technology hype cycle. Almost immediately, it grabbed enormous attention from the vendors and enterprise consumers. Existing and new technology players began highlighting the benefits of SASE, marketing their offerings to attract customers. But what is this SASE? Why should we care about it? Is it truly a game-changer? In my opinion, the concept is not entirely new; the branding and the timing of the terminology attracted a lot of attention. SASE provides networking & security as a cloud-based service as opposed to discrete solutions, which are not relevant in today’s environment–where application and data access is needed from everywhere, and from any type of device. Before we delve into the world of SASE, let’s examine the technologies used by organizations for connecting and securing applications, and why do they need to look at newer alternatives.

By Parthasarathi Chakraborty, Director–Infrastructure & Cloud Security Architecture, Bank of Montreal

Enterprise applications used to be hosted in corporate datacenters and within the perimeters of the organization. Users had to backhaul to the company network for accessing applications. Introduction of cloud hosted applications, increasing dependency on third-party SaaS, and workforce mobility has made the traffic backhauling inconvenient, and perimeter centric security as less efficient. Nevertheless, a plethora of networking and security solutions made the integration even more challenging, security incident response is more cumbersome and responsible for lowering of the return on technology investments. That’s why organizations started looking for “integrated” solutions that bind networking with security services and make it a single pane of glass for easier operations. They offer better context and data sharing between controls for improved efficiency and increased portability of the solution suite to address the ever-changing form factor of user compute.

Gartner’s SASE concept is the reflection of the same in a cloud-based service offering. The future of networking and security will be in an integrated “as a service offering” from cloud to enable users to access data from anywhere, anytime and on any type of device.

Major components of a good SASE security plane may include a proxy-based secure web gateway, URL filtering, SSL interception, data leakage protection, content isolation, advanced threat protection including dynamic detonation, firewall/IPS as a service, DDOS/WAF as a service, DNS security, CASB or cloud access security broker (for SaaS) and other security controls based on zero trust security model.  Whereas the network plane integrated with security controls may include intelligent connectivity solutions like SD-WAN (software defined wide area networking). This is done to minimize connectivity cost & intelligent latency, to reduce routing to the applications hosted anywhere – cloud or corporate datacenter), VPN replacement with SDP (software defined perimeter), Content distribution service, WAN optimization, policy-based routing, class of service and quality of service assurance from the cloud. There is no prescriptive list of networking or security controls within the SASE framework, key is to have the integrated as a service offering. That’s where the industry vendors are stretching by offering solutions in their stronghold as SASE.

Challenges

The challenges early adopters will face here will be no different from what they see in on-premises technologies. Distinct technology controls offered as a service with minimal integration and context sharing between those, basically shifts the problem from datacenter to the cloud. The reason for it lies in the fact that there is no set definition of controls needed to be in the SASE space. Classic networking vendors are either building a few security features or acquiring some security companies devoid of tight integration, to emerge as a “new” SASE player. The same holds true for traditional security players: they lack expertise in the networking space and then “partner” with network players to provide “an on-paper integrated” SASE offerings.

Evaluation Criteria

Here is what an organization should consider while evaluating a SASE vendor.

  • Integrated networking & security as a service
    • Avoid a “stitching approach” which means multiple vendor products offered “together” as partners or acquired solutions with poor integration capabilities
  • Look for solutions built from the group up with offerings in the networking and security space
    • Look for solutions with better data and context sharing for a complete end-to-end picture
  • Prefer solutions written in cloud native technology
    • Hardware instances or virtualization will be less preferred compared to container-based offerings leveraging microservices technology
  • Identity-based security filtering based on the principles of zero trust networking
    • Select products allowing granular policies based on immutable identities of humans and machines
  • Prefer solutions with open APIs for better integration with the rest of the control suite
    • Built on next generation technologies like artificial intelligence and machine learning

Conclusion

To conclude, SASE is the direction organizations should be looking to embrace without repeating the same mistakes of on-premises network with too many independent solutions at the cost of higher level of complexity and lower integration capability. Industry solutions offered in this space fall into three distinct categories: strong network as a service offered by traditional networking vendors, strong security players providing security as a service or CDN providers helping with content distribution from cloud. Network vendors not having a stronghold in security can either acquire a security solution or partner with other security vendors. The same is true for classic security vendors entering into the SASE space.  The net impact is lack of context sharing, poor integration and operational complexity that defeats the core goals of the SASE concept. We should prefer solutions having the most depth & broader breadth covering network and security areas well enough to provide one integrated “as a service” solution written in cloud-native development platforms with open integration capabilities. The market is still full of network or security niche players. It would be prudent to take a  cautious approach of waiting till solutions are available with equally strong network & security offerings.

Everybody is selling the SASE concept in their offerings now, but to me, it is exactly the same as the on-premise problem moved to cloud except that few vendors are bridging the gap with an integrated cloud-based networking & security offering.

The goal here is not to be prescriptive but to present the facts, and the final decision stays with the individuals in charge of technology selections based on organizational objectives and risk appetite.

About the Author

Parthasarathi Chakraborty is Director – Infrastructure & Cloud Security Architecture at the Bank of MontrealParthasarathi Chakraborty is Director – Infrastructure & Cloud Security Architecture at the Bank of Montreal. Previously, he held executive leadership roles at Guardian Life, JP Morgan, Bank of America, and Merrill Lynch.

He is a member of the Forbes Technology Council, Rutgers University Cyber Security Advisory Board, and the New Jersey Institute of Technology CSLA Advisory.

He achieved certifications for CISSP, CCSP, CEH, CHFA, MS (Infosec-WGU), and MS (Technology Management-Columbia University).

Views expressed in this article are personal. CISO MAG does not endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Japan, Canada and U.K. Welcome Google’s Titan Key

Google Cybersecurity Action Team Google, EU warns Google

Google introduced USB-C Titan Security Keys in Japan, Canada and the UK including countries like Austria, France, Germany, Italy, Spain, and Switzerland. The Google Titan Security Key is a piece of hardware that acts as a second line of defense against phishing and malicious threats.

Google Titan Security Key

Google first introduced the Titan Security Key with USB-A/NFC and Bluetooth/USB/NFC keys in August 2019. The Titan Security Keys provide an additional layer of security, more like a two-step or two-factor verification along with the regular login security.

google, google titan security key, google titan
Pic Credit: Google

These security keys make use of public-key cryptography to verify user identity and support FIDO protocol. In FIDO protocol, the attacker cannot access the targeted victim’s account despite having a legit username or password. To gain access, the public key for the URL is matched with the requestors’ private key (which in this case is the Titan Security Key). Thus, if the attacker does not possess the physical security key (which in a majority of cases holds true), then he/she is unable to access the said URL.

The Titan Security Key also ensures that a user is visiting a legit URL and not being a victim of a phishing attack. However, security keys work only on websites that support hardware security keys, which include personal and/or work accounts of Google, Dropbox, Facebook, GitHub, Twitter and many more.

Google’s Titan M Chip

Google had earlier also introduced the Titan M chip in its Android smartphone’s Pixel series. Titan M is an enterprise-grade security chip custom-built for Google’s smartphone brand, Pixel. This chip secures the most sensitive on-device data and operating system. Titan M helps the bootloader (the program that validates and loads Android when the phone turns on)—make sure that the latest Android version is loaded. It stores the last known safe Android version and restricts attackers from moving to an older and potentially vulnerable Android version on the device. Titan M also prevents attackers’ attempts to unlock the bootloader.

Veeam Software Announces Gil Vega as its New Chief Information Security Officer

Gil Vega

Veeam Software, a provider of Cloud Data Management solutions, appointed Gil Vega as its new CISO. Vega will be a part of the company’s executive management team and is responsible for establishing and maintaining Veeam’s vision and strategy to ensure its information assets and solutions are secure. His role will be pivotal in driving strategies to help customers protect their critical data across multiple environments and ensure regulatory compliance.

Previously, Vega served as a Managing Director and CISO at CME Group, Inc. and as the Associate Chief Information Officer & CISO for the U.S. Department of Energy and U.S. Immigration & Customs Enforcement in Washington, DC. Vega also held various cybersecurity leadership posts within the Department of Defense (DoD) and the Intelligence Community.

Veeam stated that the new leadership will help the company scale internal security and compliance processes and successfully navigate the complex and evolving Cloud Data Management market as customers strive to secure and protect critical data. Founded in 2006, Veeam provides backup solutions that deliver Cloud Data Management services. It also offers a single platform for modernizing backup, accelerating hybrid cloud, and securing data.

Bill Largent, CEO of Veeam, said, “Data is the most critical asset in any organization, but protecting it against threats, both external and internal, is becoming more complex. Cybersecurity is a top concern for business leaders, which is why they look to Veeam to ensure that their data is managed and protected no matter where it resides. To ensure that we continue to pioneer this space and help build out our offerings across all sectors.”

Infosys to Launch its New Cyber Defense Center in Indianapolis

Nearly Half of Global Consumers Affected by Data Breaches

Infosys, a provider of next-generation digital services and consulting, announced that it’s going to launch a new Cyber Defense Center in Indianapolis to strengthen security monitoring, management, and remediation services for organizations around the globe. The Cyber Defense Center, which is going to launch on March 3, 2020, will provide end-to-end, real-time, 24/7 cybersecurity monitoring, threat hunting, security analysis, incident discovery and response, compliance reporting, malware analysis, and protection services to support American businesses in their digital transformation journey.

The new center will be Infosys’ seventh addition to the network of cyber defense centers spread across North America, Europe, and Asia. The facility is dedicated to detect, assess, and respond to cybersecurity threats and breaches.

Vishal Salvi, Chief Information Security Officer & Head of Cyber Security Practice, Infosys, said, “At Infosys, we’re constantly investing in modern, cutting-edge security offerings and solutions to best protect our customers against current and future cyber threats. The Cyber Defense Center is staffed with expert security analysts with niche skills around threat research and intelligence gathering to deliver best-in class services to our customers. Additionally, advanced data analytics and machine learning models are deployed to detect zero-day threats by unknown threat actors. This supports our commitment to helping our customers build a resilient cybersecurity program that operates at scale, while increasing operational efficiency and reducing costs.”

Cybersecurity Become a Board Room Imperative: Infosys

According to new research by Infosys Knowledge Institute (IKI), the research arm of Infosys, titled “Assuring Digital-Trust,” 48% of corporate boards and 63% of business leaders were actively involved in cybersecurity strategy discussions. IKI surveyed 867 senior executives from 847 firms with annual revenues over US$500 million. These firms were from countries like the U.S., Europe, Australia, and New Zealand. The report pointed out that organizations are now finding it difficult to embed security in their enterprise IT architecture due to several factors like lack of cybersecurity talent, and inability to keep up with the technological advancements and evolving threat landscape.

Cybersecurity Market is Estimated to Exceed US$281.74 Billion by 2027: Report

A recent survey from Fortune Business Insights revealed that global cybersecurity market value is projected to reach US$281.74 billion by 2027, exhibiting a CAGR of 12.6% during the forecast period from 2020 to 2027. According to the report, the requirement for advanced cybersecurity solutions is growing exponentially with the growth in the number of cyberthreats. The survey also highlighted that cybersecurity market growth is driven by the rising adoption of e-commerce online platforms and the emergence of disruptive technologies like Artificial Intelligence, Internet of Things, Blockchain, and others.

It’s said that the traditional cybersecurity solutions are not enough accomplished for securing the organizations from advance threats of cloud, network, endpoint security, among others. In addition, huge algorithms are required for cybersecurity solution providers to develop technically advanced solutions. Further, the high cost associated with cybersecurity solutions and services limits the adoption among small and medium enterprises.

The report also highlighted that the adoption of cybersecurity solutions is expected to grow with increasing investments from countries such as India, Italy, Spain, Canada, Oman, South Korea, Qatar, and others. Also, rising demand for enterprise security solutions from industries including banking, financial services and insurance (BFSI), manufacturing, along with aerospace & defense and healthcare sectors is anticipated to boost the market size in the forthcoming years.

“One of the key trends that enable the overall growth of cybersecurity market is the rising adoption of cloud computing. Cybersecurity solutions are based on complex mathematical prediction models, handling large amounts of data. This data monitoring can only be fulfilled by cloud technology in a secure and reliable environment at low cost. Key players such as IBM Corporation, Cisco System and others, are focusing on integrating cloud computing with cybersecurity solutions. These cloud computing services are backed up by Analytics as a Service (AaaS) offerings, allowing users to detect and mitigate uncertain threats quickly,” he added.

Jim Scholefield Joins Marriott International as CIDO

Marriott International announced the appointment of Jim Scholefield as Chief Information and Digital Officer (CIDO). The appointment came into effect on February 24, 2020. In this new role, Scholefield will be responsible for leading all aspects of the company’s information technology and digital strategies.

“Jim will play a pivotal role in driving our technology modernization efforts as we embark on a new chapter in the company’s technology journey to support our future growth, both within our core lodging business and new ventures,” said Stephanie Linnartz, Group President, Consumer Operations, Technology & Emerging Businesses.

The appointment of Scholefield comes after the retirement of Bruce Hoffmeister, former Chief Information Officer at Marriott, who stepped down from his position after working for 30 years with Marriott.

Cybersecurity Pressure at Marriott

Scholefield will have a huge pressure toward guiding the cybersecurity policies of Marriott. Marriott was at the epicenter of a massive breach affecting up to 500 million guests. Hackers extracted people’s personal data as well as loyalty program, payment, reservation information as well as encrypted credit stole card data of 100 million customers. The first breach originated in 2014 at Starwood, which was acquired by Marriott International in 2016. It was uncovered after four years in September 2018, when a security tool alerted about an unauthorized data access. Consequently, the company faced a class-action suit, and its shares also fell around 5.6%.

In July 2019, the UK’s Information Commissioner’s Office (ICO) imposed a £99,200,396 (US$123,705,870) fine on Marriott International, for the data breach. The ICO stated that Marriott failed to protect its customers’ information, violating the EU’s General Data Protection Regulation (GDPR) regulations.

1...239240241...410Page 240 of 410