Home Blog Page 289

Cybersecurity could become a Revenue Model for Indian Telcos: IBM India

American multinational information technology company IBM stated that cybersecurity is going to become a major revenue opportunity for Indian telecom operators that may offer security as a service to enterprises. Through its IT outsourcing deals, the technology giant is engaging with major telcos in India for its security-related products, IBM said in a statement.

According to industry sources, IBM is overseeing Vodafone Idea’s Internal Security Operations Center as per its recent IT outsourcing deal. Under its cybersecurity portfolio, IBM is concentrating on threat and fraud management services, IoT security monitoring, managed security, trusted digital identity, and secure authentication.

In its recent survey, IBM revealed that the average cost of a data breach in India has grown 7.29 percent to reach Rs 12.8 crore from Rs 11.9 crore last year (Rs 12.8 crore is approximately 1.8 million USD). A crore denotes 10 million. The exchange rate is currently Rs 70.94 to a dollar. According to the survey report dubbed Cost of a Data Breach 2019, the Per capita cost for a stolen record was raised to Rs 5,019 ($US 70.75), which is an increase of 9.76 percent when compared to the last year.

The survey findings, which are based on in-depth interviews with 507 companies around the world, highlighted that the root cause for 51 percent of data breaches was malicious or criminal attacks, 27 percent of breaches due to technical issues, and human error led to 22 percent of breaches in India.

“Data breaches can cause devastating financial losses and affect an organization’s reputation for years. From lost business to regulatory fines and remediation costs, data breaches have far-reaching consequences. The annual Cost of a Data Breach Report, conducted by the Ponemon Institute and sponsored by IBM Security, analyzes data breach costs reported by 507 organizations across 16 geographies and 17 industries,” IBM said in a post.

IBM stated that they’ve surveyed the cost of data breaches in different industries which suffered a data breach last year. The survey also discovered that data breaches in the U.S. are more expensive, costing USD8.19 million, then the average of the companies worldwide.

Aware Appoints Robert A. Eckel as its New Chief Executive Officer & President

Cybersecurity

Aware, a supplier of biometrics software and services, recently appointed Robert A. Eckel as its Chief Executive Officer and President. Eckel will also serve as a member of the Board of Directors of Aware. Aware provides biometrics software products and development services to governments agencies, system integrators, and solution providers globally.

Previously, Eckel served as the Chief Executive Officer and President North America at Idemia, an Identity, and Security business. Eckel holds significant expertise in biometrics, secure identity, air traffic control, and defense systems.

“I’m excited to be joining an Aware team known for its customer relationships, employee dedication, and exemplary domain knowledge and passion.  Together we’ll continue to expand Aware’s leadership position in the industry and bring effective biometric technology into people’s lives.  One of my passions is to build and lead companies that enable individuals to experience the life we deserve through technology. My background in secure identity solutions, biometrics technology, and complex systems will help me drive this mission for Aware,” Eckel said.

Commenting on the new appointment, Brent Johnstone, Aware’s Chairman of the Board said, “Over the past several years, the Aware team has done a great job expanding our industry-leading biometric technology and platforms to enable us to grow beyond our traditional government market and penetrate the commercial market with a range of robust, flexible, biometric applications and solutions.  We’re excited to name Bob Eckel as the President and Chief Executive Officer of the Aware team to drive our leading biometric technology into the government and the commercial markets as well as explore strategic partnerships. Bob brings a wealth of direct industry experience as well as a track record of driving commercial success.”

Be Prepared, Be Proactive and Practice to Deal with Cyber Threats: Verizon

tech, tech provider

According to the latest Verizon Data Breach Investigations Report and the Verizon Insider Threat Report by American telecommunications company, Verizon, businesses are now more aware than ever of how cybercrime could impact their reputation, and their bottom line. In an industry which has always been marred by lack of cybersecurity talent and cybersecurity being an afterthought, the study highlights a change of thought and trend. It continues to highlight how security has become a boardroom topic.

The company had often stressed on how cyber-threats and trends that should be on every organization’s radar in its annual reports in the last three years. According to the report, it is not only important to understand the threat landscape but also have a comprehensive approach toward dealing with cybersecurity incidents.

“Companies think that having an IR Plan on file means they are prepared for a cyber-attack. But often these plans haven’t been touched, updated or practiced in years and are not cyber-incident-ready,” comments Bryan Sartin, Executive Director, Verizon Global Security Services. “Having an out-of-date plan is just as bad as having no plan at all. IR Plans need to be treated as ‘living documents’, regularly updated, and breach scenarios practiced in order for them to be truly effective,” Verizon said in a statement.

John Grim from Verizon Threat Research Advisory Center (VTRAC) and Investigative Response Team said, “IR Plans can be kept current by including stakeholder feedback, lessons learned from breach simulation testing as well as intelligence insights on the latest cyber-tactics being used. This enables the plan to constantly re-create itself reflecting the ever-changing cyber-security landscape.”

Verizon has also identified six typical phases every incident response plan which begins with: Planning and preparation; Detection and validation; Containment and eradication; Containment and eradication; Collection and analysis; Remediation and recovery; and Assessment and adjustment.

In another study, according to research by Infosys Knowledge Institute (IKI), the research arm of Infosys, titled ‘Assuring Digital-Trust’ nearly half i.e. 48 percent of corporate boards and 63 percent of business leaders are actively involved in cybersecurity strategy discussions.

IKI surveyed 867 senior executives from 847 firms with annual revenues over US$500 million. These firms were from countries like the U.S., Europe, Australia and New Zealand (ANZ). The research points out that security has finally taken the center stage.

FortifyData Announces Bob Morrell as its New President and CEO

Cybersecurity software company FortifyData recently announced the appointment of Bob Morrell as its new CEO and President. Bob Morrell was previously co-founder and CEO of Riskonnect. He is also a serial entrepreneur and a pioneer in risk management software.

In his new role, Morrell will lead the deployment of FortifyData’s cyber risk platform. He also oversees the strategic direction of the company and growing its global sales.

FortifyData helps public and private enterprises enhance their cybersecurity posture. It’s said that FortifyData’s cyber risk management platform allows companies to comply with industry security standards, including ISO 27001, PCI, HIPAA, SOC 2, NIST, and 23NYC500.

Speaking on his new role, Bob Morrell said, “What excites me most about FortifyData is the opportunity we have to protect companies from their biggest risk: cybercrime. Ultimately, companies are looking for a platform that provides a clear line of sight to their cyber risk exposure with an integrated, holistic solution, and that’s what we provide. It’s not just the bigger companies that need help. I see a lot of opportunities to help businesses of all sizes to navigate this increasingly complex world of cybersecurity.”

“We’re thrilled to have Bob Morrell join the company. Bob has vast experience establishing and growing software technology companies and we’re confident he can help us build on our solid foundation to take FortifyData to the next level. We are all excited about our future as we charge ahead to deliver the best cyber risk management platform in the world,” said Victor Gamra, founder and CTO of FortifyData.

Yahoo Data Breach Victims will get US$ 100 Compensation

Yahoo

In one of the biggest class-action lawsuit settlements in the United States history, Yahoo Inc. has agreed to pay US$ 117.5 million over a series of data breaches that affected its users between 2012 and 2016. The affected users will likely get US$ 100 in compensation or two years of credit monitoring services for free.

Yahoo urged the Settlement Class Members to claim for the reimbursement. In case users already hold credit monitoring services, they can opt for cash payment, which is less than US$ 100 or more (up to US$ 358) per user, depending on how many users are claiming for the settlement, Yahoo said in a statement.

According to Yahoo, anyone who had a Yahoo account between January 1, 2012, and December 31, 2016, and is a resident of the United States or Israel is eligible for the settlement.

“You may additionally provide documentation or proof to receive reimbursement of up to $25,000.00 in out-of-pocket losses, including lost time, that you believe you suffered or are suffering because of the Data Breaches. As to documented lost time, you can receive payment for up to 15 hours of time at an hourly rate of $25.00 per hour or unpaid time off work at your actual hourly rate, whichever is greater. If your lost time is not documented, you can receive payment for up to five hours at that same rate,” the statement added.

In December 2016, Yahoo had admitted that more than one billion accounts were compromised in the infamous 2013 breach. However, the company later revealed that all three billion company’s accounts were compromised.

The hack exposed user account information, which includes name, email address, hashed passwords, birthdays, phone numbers, and, in some cases, encrypted or unencrypted security questions and answers. However, the company’s investigation confirmed that credit card and bank account data was not hacked in the breach.

In a post titled, “Yahoo 2013 Account Security Update FAQs”, the company said, “Yahoo is providing notice to additional user accounts affected by an August 2013 theft of user data previously announced by the company in December 2016. This is not a new security issue. In 2016, Yahoo previously took action to protect all user accounts”.

Google Calendar Possibly Revealing Users’ Data: Researcher

Google Calendar

Security researchers have issued a warning over how attackers are exploiting Google’s Calendar feature to target users with a credential-stealing attack.

Avinash Jain, a security researcher from India, explained how misconfigured settings in google services can be exploited. The researcher revealed that by using Google dork (advance search query), he was able to see all the public google calendars/users who’ve set their calendar as public. He also stated that hackers are making phishing attacks, by abusing Google Calendar services, to trick users into giving away sensitive information like passwords, card details, and other financial data.

“This is an intended feature provided by Google Calendar but what if a user doesn’t intend to share the calendar until he shares the link and still someone is able to find the public link of their calendar. Then that becomes a problem. And what if someone belonging to an organization makes their official google calendar public — They might end up disclosing internal information of the company,” Avinash said in a blog post.

Perhaps, the issue is not the latest. Earlier, threat intelligence and cybersecurity firm Kaspersky stated that it detected many unsolicited pop-up calendar notifications sent to Gmail users by cybercriminals as a sophisticated spam email attack. The calendar phishing emails exploited the automatic addition and notification of calendar invitations feature for people using Gmail on their mobiles.

The scam occurs when an attacker sends an unsolicited calendar invitation carrying a link to a phishing URL and encourage the recipient to click on the link. The user then redirected to a fake website, appears to be original, that features a simple questionnaire and offered a prize after completion.

The victim will be asked to fill in personal details like name, phone number, address, and bank details in order to steal the victim’s money or identity. The researchers urged the users to turn off the ‘automatically add invitations’ option to the Google calendar to avoid calendar scams.

Microsoft owned GitHub acquires Semmle

Acquisition

Microsoft-owned GitHub recently announced that it has acquired code analysis provider Semmle in an undisclosed amount. Based in San Francisco, Semmle develops an engineering analytics solution. It helps developers and security researchers discover potential vulnerabilities in their code.

Founded in 2006, Semmle claims that its products have been used by NASA, Uber, Google, and Microsoft to enhance their cybersecurity posture.

GitHub stated that it’s now a Common Vulnerabilities and Exposures (CVE) Numbering Authority and with the latest acquisition it will become easy for code contributors to report potential vulnerabilities directly from the repositories.

“Open source has had a remarkable run over the past 20 years. Today almost every software product from any vendor or community includes open-source code in its supply chain. We all benefit from the open-source model, and we all have a role to play in making open source successful for the next 20 years,” GitHub said in a blog post. “Both of these announcements are part of our larger strategy to secure the world’s code.”

“We’re so excited to be joined by the Semmle team and to welcome their world-class engineers and security researchers to GitHub. Together, we’ll bring their work to all open source communities and to our customers. As a community of developers, maintainers, and researchers, we can all work together toward more secure software for everyone,” GitHub added.

GitHub faced severe criticism recently due to a series of data breaches. Canonical, the maker of the Ubuntu operating system, recently revealed that it has suffered a hacker attack. In an official statement, the company stated that hackers have compromised its GitHub account, a code-sharing site, on July 6, 2019, and created 11 new repositories. It’s believed that the attackers apparently didn’t access any sensitive information or manipulated source codes.

Github faced a similar issue when a Chinese drone maker Da-Jiang Innovations (DJI) landed itself into a cybersecurity row over a bug bounty issue. On November 21, 2017, Kevin Finisterre, an independent security researcher, claimed that he found a private key publicly posted on code-sharing site Github, after which he was able to access confidential and sensitive customer information and saw “unencrypted flight logs, passports, drivers’ licenses, and identification cards.”

Cybersecurity startup Acronis secures US$ 147 million

Cybersecurity solutions provider Acronis recently secured US$ 147 million in an investment round led by Goldman Sachs. With the latest investment, the Singapore and Switzerland-based company reached to the valuation of over one billion dollars.

Serguei Beloussov, the founder and CEO of Acronis, stated the new proceeds will be used to expand the company’s engineering team, build additional data centers, grow its business reach in North America, and pursue acquisitions.

Founded in 2003, Acronis offers cyber protection, solving safety, accessibility, privacy, authenticity, and security (SAPAS) challenges with innovative backup, disaster recovery, and enterprise file sync and share solutions to enterprises in hybrid cloud environments and on-premises. The company claims that its Acronis Cyber Platform protects all the data in any environment, including cloud, physical, virtual, mobile workloads, and applications.

Speaking on the new investment, Serguei Beloussov said, “We are excited about Goldman Sachs’ investment. In 2018, Acronis achieved 20% business growth, and in 2019 it is on track for over 30% growth with the Acronis Cyber Cloud business growing by over 100%. Recently we announced the Acronis Cyber Platform, enabling third-parties to customize, extend, and integrate our cyber protection solutions to the needs of their customers and partners. The investment round led by Goldman Sachs will help us to fast-track the product development through acquisitions of companies and additional resources, and accelerate the growth.”

“We are excited to invest in Acronis at this stage of rapid growth,” said Holger Staude, Vice President GS Growth. “The traditional backup and data protection market is changing due to an innovative solution delivered efficiently by Acronis Cyber Protection through a vast channel of service providers.”

Around 50,000 Cyber Frauds reported in India during 2018-19: RBI

Threat Alert! Attackers Use Malicious Email Accounts to Launch BEC Attacks

India’s central bank, the Reserve Bank of India (RBI), has revealed that it discovered around 50,000 cyber frauds in the country’s Scheduled Commercial Banks (SCB) in 2018-19 fiscal.

In reply to an RTI (Right to Information) query, the RBI stated that cybercrimes are related to ATM, debit and credit cards, and internet banking. It notified that over 50,547 banking frauds occurred in the SCBs that resulted in a loss worth of Rs. 145.08 crore in the last fiscal.

According to the RBI, the total number of banking frauds, including cyber, detected in all the SCBs are 59,826 and the loss incurred is around Rs. 67,432.26 crore. More than 4,269 frauds occurred due to insiders in the banks, involving Rs. 1,014.97 crore loss during the period, RBI added.

In order to curb rising cyber incidents on monetary transactions, RBI recently announced an enhanced security mechanism as part of its agenda for the fiscal year 2018-19. The newly proposed mechanism is intended to provide high-level protection against cyber-threats.

“In an endeavor to strengthen the cybersecurity posture of Indian banks, focused and theme-based IT examinations are planned during 2018-19. Targeted scrutiny, as and when required, would also be conducted for appropriate policy and supervisory intervention,” RBI stated in its annual report.

The RBI’s report said the new agenda includes taking effective steps to initiate the process of developing a cybersecurity culture, endeavor to make cybersecurity a responsibility, and ensure confidentiality, integrity, and availability of information system and resources. According to the report, the new private sector and foreign banks accounted for 36 percent each of all cyber frauds reported in debit, credit, and ATM cards.

With digital transactions witnessing a significant rise, the Indian central bank stated that it’s reinforcing data protection, cybersecurity, and Know Your Customer (KYC) norms to make them more effective.

“With the emerging threat landscape, where organized cybercrime and cyber warfare are gaining prominence, the Department (of Information Technology) is working towards ensuring continuous protection against changing the contours of a cybersecurity threat,” the RBI added.

Cyberinc partners with InfiniVAN

Collaboration, partnership, alliance, KnowBe4 and Agari Partner to Prevent Identity-Based Email Attacks

Cybersecurity startup Cyberinc recently announced its partnership with InfiniVAN to provide local web isolation cloud solutions in the Philippines. The alliance integrates Cyberinc’s Isla Isolation Cloud with InfiniVAN to bring a fully isolated secure internet connection for the users in the region.

Based in California, Cyberinc helps public and private enterprises get a safer internet by proactively preventing email, web, and document-based threats. The company claims that its Isla Isolation Platform uses cutting-edge isolation technology to defuse threats.

Commenting on the new partnership, Samir Shah, CEO at Cyberinc, said, “The InfiniVAN approach to delivering business internet service at par with global standards with world-class fiber optic network infrastructure perfectly aligned with the Cyberinc vision of providing completely secure browsing experience to our customers. Together, we can help our customers scale their cyber defenses and safeguard against an increasingly relevant global problem. We see that Remote Browser Isolation can reduce the attack surface against web and email-based attacks, making the endpoints and networks safer. Our partnership with InfiniVAN will deliver next-generation security solutions to our customers.”

Koji Miyashita, Chairman InfiniVAN, said, “Choosing to partner with Cyberinc was an easy choice for InfiniVAN. Cyberinc’s Isla Isolation Platform provides the security our customers want, in a way that allows them to obtain a secure connection faster by selecting it as a part of their subscription to our internet services or as an add-on functionality. It’s simple to deploy, easy to use, always-on security, that makes cyber defense easy for our large and small customers.”

 

1...288289290...410Page 289 of 410