Home Blog Page 265

Cybersecurity Market in India Rise to US$3.05 Bn by 2022: Study

Acronis Cyber Readiness Report, cyberattacks in India, cybercrime in India, India’s Private Sector

According to a joint study by PwC India and Data Security Council of India (DSCI), the cybersecurity market in India will grow from US$1.97 billion in 2019 to US$3.05 billion by 2022, at a compound annual growth rate (CAGR) of 15.3 percent. It’s believed that the growth in the Indian cybersecurity market is around 1.5X of the global security market.

The study also stated that Banking, Financial Services and Insurance (BFSI), IT, and government are the top three sectors with the largest market share in cybersecurity expenditure in the country.

“The BFSI sector accounts for 26 percent of the total expenditure in the cybersecurity market and is expected to increase its expenditure to US$810 million from the existing US$518 million by 2022, at a CAGR of 16.1 percent,” the report stated.

The growth in cybersecurity expenditure is due to several factors like tightened norms from regulators, data localization, utility payments, e-commerce, and online insurance marketplaces. Also, the revolution in payments technology using AI, blockchain, IoT, and the introduction of mobile point of sale (POS) devices has brought a host of financial solutions in the country, according to the report.

The report also highlighted that the average cost of a data breach in India has gone up to INR 11.9 Cr (US$ 16M), which is an increase of 8 percent from 2017.

Cybersecurity Products in India

The study anticipates that cybersecurity products in India will grow at a higher rate. It is believed that data protection and endpoint security tools will grow at a CAGR of 22.2 percent and 19.1 percent respectively over three years.

“Artificial intelligence and machine learning applications are being embedded into the cyber suite of offerings—especially in security intelligence, detection and response (IDR), endpoint security and security testing. The key use cases stem from the ability to use predictive analytics and heuristics in drawing quick statistical inferences, thereby helping in detecting and lessening threats with an optimized number of resources and savings. A natural outcome of such developments is the emergence of products and platforms specializing in these areas,” the report added.

DSCI also mentioned that global regulations like General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), and Health Information Trust Alliance (HITRUST) will continue to have an impact on the Indian cybersecurity market.

SBI warns: Public Charging Stations Can be Used for Juice Jacking

State Bank of India

Is your mobile phone running out of juice?  Need a quick charge? Ah, there is a public charging station! Wait, is it safe? May not be, says SBI. Beware, you can be a victim of Juice Jacking.

One of India’s largest and premier government controlled banking institution, the State Bank of India has publicly issued a warning of ‘Juice Jacking’ through its twitter handle. In a country like India where digital economy is still in its nascent stage, this social and digital awareness campaign is welcomed by many. The bank in its tweet advised its customers and general public to “think twice before plugging-in their phone at (pubic) charging stations, as hackers can maliciously infect their smartphone with a malware.”

What is Juice Jacking?

In simple words, Juice Jacking is an attack carried out by hackers through a USB charging cable. When a user plugs in the charging cable in his mobile’s charging port, and connects it to any of the rigged charging stations installed at public spaces such as airports, train stations, hotels, cafes etc – it gives a back-door entry to hackers into the compromised device. The charging port which is also used for data transfer over the USB, is pointed as the main cause of concern over here. Installing malware, cleaning user data, asking ransom in exchange for access to personal data on the phone, personal and financial account hijacking are just some of the many nefarious things that a hacker can do with this unrestricted access.

Steps to Mitigate the Risks

In order to guard your phone against Juice Jacking, take these precautionary measures:

  • Avoid using public charging stations. These are soft targets for hackers as they are often kept unguarded and without any surveillance. Even while using them, go behind the charging station and check the power source of the USB ports.
  • Always use your own AC charging adapter and cable for charging the device. And be sure to plug it into the AC wall socket, and not the USB socket on the wall.
  • Stay guarded against a stranger’s device and laptop. Do not connect with an unknown person’s laptop or PC for charging your electronic devices and vice-versa.
  • For emergency situations, buy and carry a certified power bank with enough capacity to take care of your device’s emergency power backup needs.
  • It may be difficult to find, but try to use a cable that can be used only as a charging cable and not a data cable. This can be a task as almost all mobile devices come with a charger that is capable of charging as well as data transfer.
  • Frequent travelers should use a USB blocker. It is a small device that blocks the data connection on the USB cable by blocking its data pins.

In a similar warning earlier, the Los Angeles District Attorney urged travelers to avoid public USB power charging stations in hotels, airports, and other public locations. The Attorney’s warning described many attack vectors that cybercriminals use to abuse USB wall chargers. And the most common way is via “pluggable” USB wall chargers that can be plugged into an AC socket by attackers to leave malware at public charging stations.

Thief Stole Payroll Data of 29,000 Facebook Employees

Facebook Data leak, Facebook bans cyber mercenary

Some tens of thousands of current and former Facebook employees are impacted after a thief stole corporate hard drives from an employee’s car. According to Bloomberg, banking information of 29,000 Facebook employees in the U.S. was compromised.

The hard drives, which were unencrypted, contained payroll data like employee names, bank account numbers, social security numbers, salary details, bonus amounts, and equity details. However, Facebook clarified that the stolen drives didn’t include Facebook users’ data.

“We worked with law enforcement as they investigated a recent car break-in and theft of an employee’s bag containing company equipment with employee payroll information stored on it. We have seen no evidence of abuse and believe this was a smash and grab crime rather than an attempt to steal employee information,” Facebook said in a statement.

According to sources, the incident occurred on November 17. Facebook started notifying the affected employees from December 13 after realizing the issue on November 20.

The employee who was robbed is a member of Facebook’s payroll department. Facebook stated that it has taken disciplinary action against the employee, as it is unethical to carry the company’s sensitive information outside the office.

Facebook authorities stated that it’s working with law enforcement to recover the information. The social networking giant also offered affected employees a two-year subscription to an identity theft monitoring service.

Data breach woes for Facebook don’t seem to be ending. Facebook and its subsidiaries like WhatsApp and Instagram faced several security instances in recent years for exposing personal data of its users.

Recently, Facebook admitted a data breach involving 100 third-party app developers who had improper data access. In a blog post, Facebook’s Konstantinos Papamiltiadis, Director of Platform Partnerships revealed that app developers had access to user data such as group member names and profile pictures through the Group API.

Prior to April 2018, app developers had unrestricted access to group members’ information. But with changes made in Group API posts in April 2018, this has changed. The app developers now only have limited access to group information such as group name, number of users, and the content in group posts.

According to Facebook’s new framework designed on the guidelines of their agreement with the Federal Trade Commission (FTC), Facebook is required to conduct timely and scheduled audits of all its products and services for factors such as data breach, privacy adherence, etc.

Google Chrome Introduces Improved Password & Phishing Protection

Google

In a recent update, Google has rolled-out Chrome 79 stable version for its users. This version of Chrome consists of two very important browser security features – Improved password protection and real-time phishing protection.

Malware attacks, data breaches, phishing attacks, are all real-world problems. Fake websites and URL hijacking scams are at their peak especially during the holiday season and convince users to enter their passwords and other sensitive information. With all due diligence, data security is now top priority for the platforms which provide them. Google Chrome has always stressed on built-in safety protections, and now they’re expanding those boundaries.

Compromised Password Warning

Google first introduced password breach warnings as a Password Checkup extension early in the year. Password Checkup compares passwords and usernames of users with Google’s very own database consisting of more than 4 billion compromised credentials known to Google.

According to Google this is how it works:

  • Whenever Google discovers a username and password exposed by another company’s data breach, a hashed and encrypted copy of this data is saved on its servers with a secret key known only to Google.
  • When a user signs into a website, Chrome sends a hashed copy of the entered username and password to Google, encrypted with a secret key only known to Chrome. Absolutely no one, including Google, can derive username or password from this encrypted copy.
  • In order to determine if the username and password has appeared in any breach, Google uses a technique called private set intersection. It involves multiple layers of encryption and compares the encrypted username and password (received from Chrome) with all the encrypted breached usernames and passwords (in Google’s database), without revealing the username and password. Chrome sends a 3-byte SHA256 hash prefix of username to reduce the scale of the data joined from 4 billion records down to 250 records, while still ensuring the anonymity of username.
  • If the username and password have been compromised, Chrome notifies this to the respective user only. Users are strongly recommended to change their password.

Real-time Phishing Protection

Google’s Safe Browsing keeps track of the malicious and potentially harmful sites on the web and shares this information with other browsers, to keep the internet more secure. The refresh rate of this list is 30 minutes. It protects close to 4 billion devices on a daily basis against all kinds of security threats, including phishing.

However, some phishing sites dodge the 30-minute window, either by continuous domain switching or by hiding from Google crawlers. But real-time phishing will now inspect the URLs of pages visited by users with Safe Browsing’s servers in real-time. On visiting a website, Chrome checks it against a list stored in the user’s computer that are known to be safe. If the website is not on this safe-list, Chrome then checks the same URL with Google’s database (after dropping any username or password embedded in the URL) to find out whether the site is malicious or not. Google’s analysis has shown that this results in a 30 percent increase in protections by warning users on malicious sites that are brand new.

Additionally, if this check determines that the site is indeed suspicious or malicious, Chrome immediately shows a warning to change your compromised password. In case the Google Account password was used for Google Chrome login and the same was phished, then Chrome also offers to notify Google as an added layer of protection to ensure user account isn’t compromised.

TrapX Security Appoints Ori Bach as Chief Executive Officer

Cybersecurity firm TrapX Security recently announced that it has named Ori Bach as its new Chief Executive Officer.  Mr. Bach who previously served as TrapX’s Chief Product Officer and EMEA General Manager comes to his new role with more than two decades of senior cybersecurity and high-tech experience in companies such as IBM-Security, Trusteer and NICE-Actimize.

Founded in 2012, TrapX Security is the pioneer in Cyber Deception Technology. The company claims that its DeceptionGrid solution quickly detects, deceives, and defeats advanced cyber-attacks and human attackers in real-time.

Mr. Bach will lead TrapX’s executive management team in scaling the business, expanding its global footprint and accelerating technology innovation designed to help its customers stay ahead of an increasingly complex cyber threat landscape.

“Deception technology has become a cornerstone of achieving cyber-resiliency. TrapX is leading the Deception market with its patented emulation technology. I am looking forward to working with the amazing talent at TrapX as we revolutionize the way that security teams tackle advanced threats,” Bach said.

In July this year, TrapX completed US$ 18 million financing round led by Ibex Investors along with the participation from the existing investors, BRM, Opus Capital, Intel Capital, Liberty Technology Venture Capital, and Strategic Cyber Ventures. The San Jose-based company stated the new proceedings will help to expand the company’s reach globally.

Microsoft Reveals Smart Phishing Techniques of 2019

Phishing, phishing attacks

Security experts said cybercriminals are customizing their Phishing attack methods to trick companies and their users. According to Microsoft, phishing campaigns grew from 0.2 percent in January 2018 to 0.6 percent in October 2019.

In its recently released 2019 Cybersecurity Trends report, Microsoft highlighted that phishing was one of the attack vectors that was rising over the past two years. “In 2019, we saw phishing attacks reach new levels of creativity and sophistication,” Microsoft said.

The tech giant reviewed three of the intelligent phishing attacks it had seen in 2019, which include:

Hijacking Search Results

In this technique, attackers make use of URLs that point to a legitimate source but route to compromised websites that eventually lead to phishing.

How it works

  • Attackers redirect web traffic that was hijacked from legitimate sites to their websites
  • Once the domains became the top Google search result, they send emails to victims linking the Google search result
  • If the victim clicks the Google link, they’ll be taken to an attacker-controlled website, which eventually redirects the user to a phishing site

“Using this technique, phishers were able to send phishing emails that contained only legitimate URLs (i.e., link to search results), and a trusted domain,” Microsoft stated.

Customized 404 Not Found Pages

In this technique, attackers use a custom 404 NOT Found page that’s designed to look like a legitimate Microsoft account sign-in page.

Phishers include URL links that pointed to non-existent pages. When a user accessed the URL, the phishing site redirects them to a phishing page instead of the server’s standard 404 error page.

Detailing the technique, Microsoft said, “A phishing campaign targeting Microsoft uses such a technique, giving phishers virtually unlimited phishing URLs. When Microsoft’s security systems would scan the link, they’d receive a 404-error back (because the link didn’t exist), and Microsoft would deem the link safe.”

Man-in-the-Middle Phishing

 In the Man-in-the-Middle (MitM) technique, users could be tricked by a legitimately looking login page.

“One particular phishing campaign in 2019 took impersonation to the next level. Instead of attackers copying elements from the spoofed legitimate website, a man-in-the-middle component captured company-specific information like logos, banners, text, and background images from Microsoft’s rendering site. The result was the exact same experience as the legitimate sign-page, which could significantly reduce suspicion,” Microsoft explained.

Also, a recent investigation by the Microsoft threat research team revealed that 44 million users were reusing their usernames and passwords. The tech-giant stated it scanned all the company’s user accounts between January 2019, and March 2019. The scanning was performed on a database of around 3 billion leaked credentials, which was obtained from multiple sources like public databases and law enforcement, Microsoft said.

New Ransomware “Zeppelin” Targets High Profiles in Canada and Europe

ransomware, fonix, fonix ransomware, Cybereason Partners with Intel for Hardware-Enabled Ransomware Prevention, Kronos

Security researchers stated that cybercriminals have created a new ransomware variant titled “Zeppelin” to target healthcare and IT companies in the U.S., Canada, and Europe. It’s said that Zeppelin ransomware is reportedly a new variant of the VegaLocker/Buran ransomware.

Background of the Ransomware

According to the BlackBerry Cylance Threat Research team, Zeppelin is the newest member of the Delphi-based Ransomware-as-a-Service (RaaS) family based on the same code and features with its predecessors VegaLocker.

Beginning its journey as VegaLocker, the ransomware was developed on Russian hacker forums under the name Buran, in May 2019. VegaLocker samples were first discovered in a malvertising operation on Yandex.Direct, a Russian online advertising network.

The campaign was aimed at Russian speaking users. Several new versions of VegaLocker ransomware appeared during this year, carrying a different name: Jamper, Storm, and Buran, etc. The latest variant of this ransomware is Zeppelin.

Zeppelin Ransomware

BlackBerry Cylance research team stated that Zeppelin was being used in targeted attacks against healthcare and other IT companies in the U.S., Canada, and Europe. The researchers also said the ransomware also targeted Managed Service Providers (MSPs) to infect customers via management software.

Researchers believed that threat actors have dropped the ransomware through Remote Desktop servers that are online.

“The recent campaign that utilizes the newest variant, Zeppelin, is visibly distinct. The first samples of Zeppelin–with compilation timestamps no earlier than November 6, 2019–were discovered targeting a handful of carefully chosen tech and healthcare companies in Europe and the U.S.,” researchers said.

Injection Process

Once installed, Zeppelin will check the victim’s country code to make sure it’s not running in countries like the Russian Federation, Ukraine, Belorussia, and Kazakhstan.

Depending on the options set during the building process, it will either check the machine’s default language and default country calling code or use an online service to obtain the victim’s external IP address.

The ransomware then starts terminating various processes including ones associated with the database, backup, and mail servers.

While encrypting files, Zeppelin creates ransom notes as “!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT — You are not able to decrypt it by yourself! The only method of recovering files is to purchase a unique private key. Only we can give you this key and only we can recover your files.”

The notes contain other information about what happened to the victim’s files, and how they could contact hackers for payment methods.

The Three Key Takeaways for Cybersecurity in 2020

RAT, Trojan, Remote Access Trojan

By Lux Rao, Director – Solutions & Consulting, NTT Ltd. (India)

Lux Rao, Director – Solutions & Consulting, NTT Ltd. (India)
Lux Rao, Director – Solutions & Consulting, NTT Ltd. (India)

As enterprises face a barrage of cyberattacks, and the nature of these attacks is growing in sophistication, it is becoming difficult to pinpoint the vulnerabilities. The bad actors are becoming smarter and more coordinated. It has become a very organized industry, even though it is a dark industry. So here are three key aspects that organizations must immediately address as they prepare their cybersecurity strategy for 2020.

Firstly, enterprises need to be in a state of perennial alert. That calls for a set of robust threat intel, with an early warning or an advanced information system.

Whether an enterprise can do it on their own or depend on partners is not even a question. Organizations will have to work with partners who can provide threat intel and secure all flanks for an enterprise.

Secondly, AI and ML-based systems are becoming crucial factors in the evaluation and selection of security solutions. The volume (of attacks) is large, so you need to have not just machine learning, but also a constant learning algorithm that knows what the bad actors are up to, right up to the minute. This mitigates threats or provides early warning to enterprises.

Your partner could analyze threats, and not just for one technology, but for all technologies. The bad actor can enter through any door. If you secure your front door, which is your data center with robust prevention systems, and if you have a vulnerable backdoor, a trojan horse, then even the sensors can become the attack vector.

The third one is interesting. The identity is not limited to only humans now. By 2021 there will be nearly 50 – 55 billion devices and sensors for 7.5 billion people. That’s seven sensors or devices per human being.

So, you need to be looking at identity management not just from a human perspective, but it should identify and secure humans, applications and machines. You need to have one view and you need to monitor that behavior constantly.

The Personal Data Protection Bill, 2019

India’s Personal Data Protection Bill, 2019 is also a progressive move in regulating how a user’s data is protected without compromising data sovereignty. It will represent a huge shift in the way enterprises handle data. Organizations will be expected to overcome several unique regulatory and compliance challenges to meet the requirements of the regulation. This is not seen as a big challenge for implementation as Indian organizations are already very sensitive about security. GDPR was a big movement and it made everyone take security more seriously, but only as “best practices.” There is scope for full compliance and by focusing on the principle of “data protection by design and default,” this Bill will encourage organizations to make privacy and data protection a part of core business values, instead of a casual afterthought.

Since most organisations now will collect, store and process the data within the country to avoid any complications, it will also make India a processing hub. It will also allay data privacy fears, thereby giving us (in India), as well as the global players, the added confidence to actively participate in our growing digital economy.

These are some of the key takeaways, which are very relevant in geographies like India. India’s adoption of the digital twin has been very elementary so far. It is still shaping up, but once it comes into the mainstream, we need to be looking at that as well. It could be a target for attackers.

Disclaimer:  Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. 

How to Recover from a Data Breach With ID Assist

DEO data breach

By ID Assist

As businesses continue to welcome digital transformation with open arms, the challenges they face are increasing. Electronic data is being widely used for daily operations. Small scale organizations are using Big Data for analyzing customer trends and maximizing profits. In this era where data is costlier than oil, growing pools of personal and financial information are being shared and stored online. These growing numbers have also directed the eyeballs of cybercriminals towards financial institutions and individuals, with an intent of data breach and identity theft.

Data breach and Identity Theft Overview in Numbers

Data breach and identity theft are the major contributors to cybercriminals’ growing pockets. They have continued to evolve and develop new mechanisms to commit financial fraud. A Data Breach Report from Risk Based Security and Identity Fraud Study from Javelin Strategy & Research for 2019 shows a few interesting figures:

  • There were 5,183 breaches reported in the first nine months of 2019 exposing 7.9 billion records.
  • Compared to Q3 2018, the total number of breaches was up 33.3% and the total number of records exposed more than doubled, up 112%.
  • 70 percent of data breaches happen against companies with fewer than 100 employees.
  • The cost of a data breach has risen 12% over the past 5 years to US$3.92 million per incident on average.
  • Healthcare sector was the most expensive industry for data breach costs, with the total cost of a data breach in 2019 averaging US$6.45 million.
  • In Q3 alone, six breaches exposed 100 million or more records, accounting for 3.1 billion records exposed between July 1 and September 30, 2019.
  • Identity theft numbers have fallen from 16.7 million in 2017 to 14.4 million in 2018.
  • However, the same study revealed that the identity fraud costs for the victims has nearly doubled to US$1.7 billion in 2018 as compared to 2016.
  • Mobile phone account takeovers are major contributors to the rising identity theft numbers. Reason – these takeovers have nearly doubled to 680,000 victims in 2018, compared to 380,000 in 2017. Having a hostile mobile phone account takeover empowers users to bypass two (2FA) and multi-factor (MFA) authentication techniques.
  • Good news – The study shows that using embedded chip cards is helping to keep attackers at bay for card frauds. It has shown the steepest decline as compared to other fraud types in 2018, with losses recorded at US$14.7 billion in 2018, down from US$16.8 billion in 2017.

Personal information is not just valuable to hackers because they gain access to an individual’s financials through Identity theft, but also because every record holds a price tag on the dark web. These records are sold on a scale of a few dollars per credit card details to a few thousand dollars for medical records. Due to the kind of money involved and personal privacy at stake, nations around the globe are now taking data breaches rather seriously and Canada is not far behind.

Canada’s PIPEDA

The Personal Information Protection of Electronic Documents Act (PIPEDA) has undergone some changes with effect from November 1, 2018 and has significantly impacted the compliance requirements and data breach reporting of Canadian businesses. Since the implementation of the improved PIPEDA version, the Office of the Privacy Commissioner of Canada (OPC) has seen reporting of 446 data breaches between November 2018 and June 2019, which has affected around 19 million Canadians. This is a drastic rise of nearly six times in the number of reports received during the same period of November 2017 and June 2018.

Of the 446 breaches reported to the OPC,

  • 59 percent reported the reason as hacking mainly due to “internal bad actors”.
  • 22 percent were from accidental disclosures, such as information being sent to the wrong person or being left behind.
  • 13 percent of reports accounted for the physical loss of data. This includes and is not limited to USB drive, corrupt hard drives and even paper files.
  • 6 percent of the breaches were due to physical theft of things like computers, drives or paper files.

Data Breach and Identity Theft, ID Assist

There are a number of steps that an organization can take to mitigate and manage data breaches.

Best practices to mitigate data breach risks

  • Training & awareness: The most important and often overlooked entity is employee training. As the above data suggests, most breaches occur due to internal bad actors. Thus, spreading awareness across various levels of the organization is of utmost importance.
  • Vulnerability assessment: Find loopholes and secure IT infrastructure/architecture. Regular IT audits, vulnerability assessment of entire system architecture and patching the identified threats should be carried out thoroughly and regularly.
  • Budget allocation: Include cybersecurity in your company’s annual budget for allocating and hiring the necessary resources.
  • Outsource cybersecurity: So that unforeseen security risks are mitigated, and data breach response is handled by respective domain experts. This reduces the risk of future attacks as well.

Managing a Data Breach

We can take adequate measures and follow best practices, however being 100 percent secure is a “Myth.” Even the heavyweight corporates such as Capital One, Marriot, and Desjardins (we will elaborate more on the Desjardins data breach later) have not been spared from data breaches and identity theft scares after pouring in millions in cybersecurity. What businesses of today need to be ready with is a solid plan of action after the data breach security and prevention measures have failed.

So how do we manage a data breach and minimize the damages? We can divide it into 7 steps:

  1. Don’t Panic: Pressing the panic button often leads to chaos. Instead, sit back, assess the damages. Be sincere and admit your company’s mistakes and shoulder responsibility.
  2. Communicate: Inform both your internal stakeholders (employees, managers, PR team, etc.) and external stakeholders (clients, end-users, press and media).
  3. Provide details: After conducting cyber forensics, provide accurate data breach details to all stakeholders. Explain what went wrong.
  4. Provide solutions: Designate a team to provide solutions for affected users. Guide them through and provide them solution from the ongoing problem.
  5. Provide monitoring services: Your customers are already troubled and tensed, but a helping hand in times of crisis helps regain their trust in your company. As a value add and confidence-building measure give them an offer that they can’t resist. Along with 24/7 assistance provide users secure solutions such as identity protection and credit monitoring for free.
  6. Train and educate: The biggest mistake that company’s often make is they neglect the fact that this can happen again. Train your employees and explain how to prevent similar issues in the future.
  7. Discuss: Involve everyone, your C-suite, clients, experts, analysts, media and general public. You never know who might just end up giving you a million-dollar solution.

As mentioned earlier let’s consider the Desjardins data breach and its incidence response. It is one of the prime examples of how an incidence response can be handled efficiently. They ticked off almost all the boxes of data breach management. Have a look:

  • Maintained transparency (with internal and external stakeholders)
  • Went public (Reported it to the OPC and gave a press release)
  • Provided unconditional support to government authorities and its customers
  • Found the root cause of data breach (breach took place due to an internal employee)
  • Got it fixed (Fired the employee and notified OPC about it).
  • With new findings, Desjardins updated the data breach records number and kept OPC and press in the loop (number of records stolen went from 2.9 million to 4.2 million)
  • Provided credit monitoring to all members who do banking with Desjardins, current and past — an estimated 8 million people across Canada.

Executing such a systematic incidence response plan not only shows transparency of processes to your clients but also reinstates their trust in your company, which is the basis of PIPEDA. As we have already seen: The question isn’t about if your data will be compromised. The question is when? So, what should you look for in a solution?

A solution like ID Assist has all the features to protect your company from identity theft and data breaches.

What is ID Assist?

ID Assist is the 911 for data breaches. It’s a turnkey solution that can be deployed immediately to limit the damage for your customers―and brand― in the event of a crisis. Canada has two primary credit reporting agencies — Equifax® and TransUnion® who record information received from creditors. A single lender may use one or both credit reporting bureaus to check your customers’ creditworthiness. Thus, ID Assist holds the upper hand over here as it provides dual bureau credit monitoring to its customers. It also acts as an early warning system that alerts the customers and helps limit the damages caused by identity theft and financial fraud.

At times just monitoring is not enough and if your identity has already been stolen then ID Assist will still be there for you. How? It provides full expert restoration assistance to all its customers along with a certain degree of legal assistance through a limited power of attorney. This means all your bases are covered and you may now heave a sigh of relief!

Conclusion

From the above narrative, we can conclude that data breach and identity theft can affect all types of businesses and individuals whose data is shared or stored online. It means that having a data breach prevention plan for defense and an incident response plan as an offense to such attacks is no longer an option; it’s a must-have and unique service providers such as ID Assist perfectly fit the bill for being an integral part of this plan. Frequent security assessments, IT audits, patch fixes and having a set of fixed guidelines in the form of an incidence response plan helps in minimizing loss of data and more importantly, your clients’ trust.

Start your breach readiness plan today – make sure your organization is ready with ID Assist.

Green Padlocks Used as Phishing Baits

Phishing Campaign on FINRA

A green padlock followed by the organization name (also in green color) means that website uses an Extended Validation (EV) certificate. Green padlocks without the following organization name in green color, means that website uses a TLS/SSL certificate and not EV certificate. An EV certificate is a special website certificate that requires a significantly more stringent identity verification process than other types of certificates. To verify and prove exclusive rights to use a domain, the domain owner must confirm its legal, operational and physical existence, and prove the entity has authorized the issuance of the certificate. This verified identity information is included within the certificate, with business name and country, presented directly in the browser window. But with free and open certificate issuing authorities like Let’s Encrypt, who are providing the same level of encryption and certificates for small organizations, cybercriminals are using them for impersonating phishing sites as legitimate ones.

“Year over year, month over month, phishing is becoming more prevalent,” says Bob Maley, NormShield’s CSO. “The bad actors are getting these phishing domains and registering them. Then they are standing up phishing sites on those domains that are essentially clones of the various e-commerce sites to fool the end user into believing they’re on a legitimate e-commerce site.”

NormShield’s report also threw up a few surprising numbers related to phishing attacks carried out in the past few years:

  • The number of potential phishing domains for top 50 ecommerce sites has multiplied 6x times in the last four years. While it was under 1,000 in 2016, it now stands well above 6,000 so far in 2019.
  • The number of phishing domains registered in the first 9 months of 2019 is 11% higher than during the same period in 2018.
  • 30 percent of the possible phishing domains registered in 2019 have certifications. When compared with 2018, the number of certified phishing domains are three times higher in 2019.

Experts still are and recommend users to look for the domain registrars of suspicious websites and not just the green padlock icons in the URL box. Cybercriminals have a tendency of using free and low-cost registrars for setting up phishing domains. They further advice to avoid random clicking on URLs that come in holiday seasons’ promotional emails and to be careful with typo mistakes that leads to typosqautting/URL hijacking. refusing to provide saved credentials for sites also can be a strong indicator of an illegitimate phishing website.

In a similar research done earlierby Venafi, a cybersecurity software company which secures and protects cryptographic keys and digital certificates, the company said it had uncovered nearly 100,000 typosquatting/fake domains with valid TLS certificates impersonating as major retailers.

1...264265266...410Page 265 of 410