BUSINESS WIRE: Singapore’s Government Technology Agency (GovTech) and Cyber Security Agency of Singapore (CSA) announced the successful conclusion of the latest Government Bug Bounty Programme (GBBP), HackerOne, the leading hacker-powered security platform, part of the Singapore Government’s ongoing initiative to build a secure and resilient Smart Nation. During the three-week hacking challenge, more than 400 hackers globally were invited to look for security weaknesses in the Singapore Government’s digital assets. Hackers won $11,750 in exchange for reporting 26 valid security weaknesses to GovTech so they could be safely fixed. Through their bug bounty program, Singapore is improving the security of its internet-facing government systems with help from hackers.

The GBBP ran from 27 December 2018 to 16 January 2019 and welcomed 400 ethical hackers to test five internet-facing government systems. Of the 26 valid vulnerabilities reported through the GBBP on HackerOne, seven were considered low severity, 18 were medium severity, and one was high severity. One-quarter of all participating hackers and seven out of the top 10 hackers who earned bounties were from Singapore. Following these successful programs, GovTech and CSA plan to expand the next edition of the GBBP to include more Government internet-connected systems and websites.

“National security cannot exist without cybersecurity,” said Marten Mickos, CEO of HackerOne. “The Singapore Government has fully realized this. They are governmental pioneers in safeguarding vital internet connected systems with the help of an army of over 300,000 ethical hackers. They realize that bug bounty programs allow us to bring the best minds together to counter the risks of today’s cyber environment.”

This is the Singapore government’s second successful bug bounty programme with industry leader HackerOne, following the first bug bounty programme by the Singapore Ministry of Defence (MINDEF). By bringing together a community of cyber defenders who share the common goal of developing a safe and resilient cyberspace, the GBBP builds collective ownership over the cybersecurity of Government systems and websites, which is vital to achieve Singapore’s Smart Nation goals.

HackerOne was selected to manage the bug bounty programme because of its largest credentialled global ethical hacker community and proven results with MINDEF and proven track record of success with governments globally. GovTech and MINDEF join government agencies like the U.S. Department of Defense, U.S. General Service Administration, and the European Commission who partner with HackerOne to find their critical security vulnerabilities with help from the global hacker community.

Along several tried and tested attack surfaces that have been gaining traction, cyber-criminals are going strong with newer forms of attack that may seem alarming.  A report by cybersecurity firm Webroot points out that nearly 40 percent of malicious URLs were found on good domains. According to the study, legitimate websites have been frequently compromised to host malicious content.

The report also pointed out that home user devices are more than twice as likely to get infected as business devices with nearly sixty-eight percent infections in consumer devices than 32 percent in a business endpoint. According to it, phishing attacks increased 36 percent, with the number of phishing sites growing 220 percent over the course of 2018.

The report suggested, while ransomware was less of a problem in 2018, it became more targeted. “We expect major commodity ransomware to decline further in 2019; however, new ransomware families will emerge as malware authors turn to more targeted attacks, and companies will still fall victim to ransomware. Many ransomware attacks in 2018 used the Remote Desktop Protocol (RDP) as an attack vector, leveraging tools such as Shodan to scan for systems with inadequate RDP settings. These unsecured RDP connections may be used to gain access to a given system and browse all its data as well as shared drives, providing criminals enough intel to decide whether to deploy ransomware or some other type of malware,” read a release.

Other key findings including the method in which malware tried to install itself. According to the report, nearly a third  of malware tried to install itself in %appdata% folders which was at 29 percent, among others were %temp% at 24.5 percent, and %cache% at 17.5 percent. These locations were the most common hiding paths used by malware.

The report also pointed out that devices that use Windows 10 are at least twice as secure as those running Windows 7 and that despite the decrease in cryptocurrency prices, cryptomining and cryptojacking are on the rise.

“We wax poetic about innovation in the cybersecurity field, but you only have to take one look at the stats in this year’s report to know that the true innovators are the cybercriminals. They continue to find new ways to combine attack methods or compromise new and existing vectors for maximum results. My call to businesses today is to be aware, assess your risk, create a layered approach that protects multiple threat vectors and, above all, train your users to be an asset—not a weak link—in your cybersecurity program,” Hal Lonas, CTO, Webroot.

The University of Connecticut Health Center recently suffered a breach that potentially compromised personal data of around 326,000 individuals. In an official statement, the health center stated that unknown intruders accessed the email accounts of several UConn Health employees on December 24, 2018, affecting 326,000 patients’ information.

UConn Health provides health services to the citizens of Connecticut through innovative integration of research, education, and clinical care. The Connecticut-based academic medical center stated the breached data includes, names, dates of birth, addresses, social security numbers, billing and appointment information, and other medical information.

The health center stated that it’s enhancing the security of the impacted accounts to prevent further unauthorized access. It also notified the law enforcement and retained a forensic security firm to investigate for any personal information in the impacted email accounts.

“At this point, we are not aware of any fraud or identity theft to any individual as a result of this incident and do not know if any personal information was ever viewed or acquired by the unauthorized party. Nevertheless, because we cannot isolate exactly what, if any, information may have been accessed, we notified individuals whose information was in the impacted accounts. The incident had no impact on our computer networks or electronic medical record systems,” the health center said in a statement.

UConn Health is offering free identity theft protection services to the patients who impacted in the breach. It also suggested the affected individuals monitor their credit reports, account statements, and benefit statements for any suspicious activity.

“We take our responsibility to safeguard personal information seriously and apologize for any inconvenience or concern this incident might cause. We have taken and will continue to take steps to help prevent something like this from happening again, including evaluating additional platforms for educating staff and reviewing technical controls,” the statement added.

CyberCube, a provider of cyber risk analytics, announced that Munich Re has selected its cyber insurance analytics platform to support state-of-the-art quantification, modeling, and control cyber accumulation risk. Munich Re is the market leader in the swiftly growing cyber (re)insurance market and offers both insurance and reinsurance under one roof.

CyberCube delivers the world’s leading cyber risk analytics for the insurance industry. With best-in-class data access and advanced multidisciplinary analytics, the company’s Software as a Service platform helps insurance companies make better decisions when underwriting cyber risk and managing cyber risk aggregation.

Insurers and reinsurers are in the process of quantifying both the extent of the opportunity and the risk posed by cyber risk. It is critical for reinsurers to look at the cascading impact of largely aggregated cyber-attacks and prepare for it. CyberCube will provide advanced risk modeling capabilities to Munich Re with several cyber risk aggregation scenarios.

Speaking on the new initiative, Pascal Millaire, CEO of CyberCube said, “CyberCube is delighted to support Munich Re in making significant progress to tackle one of the largest opportunities – and threats – to the global P&C (re)insurance market in our generation. Our industry-leading cyber risk-modeling platform is powered by several best-in-class data sources and Symantec’s leading threat intelligence. We are pleased to use these capabilities to support a leader in the reinsurance market.”

Stefan Golling, Chief Underwriter of Munich Re said, “Cyber insurance is a key focus of our innovation strategy. We have made significant investments in our own cyber risk expertise and we seek to complement this with insights from the cyber ecosystem. Leveraging the capabilities of CyberCube will help our underwriting and risk modeling teams in better quantifying cyber risk and understanding potential cyber accumulation scenarios.”

FireMon announced the results of its inaugural State of Hybrid Cloud Security Survey. The survey polled over 400 information security professionals, ranging from operations to c-level, about their practices maintaining network security across hybrid cloud environments. The survey aims to shed a light on the challenges security and network professionals face as they expand hybrid cloud initiatives.

 Cloud Business and Cloud Security Misalignment

Cloud-based business initiatives are accelerating faster than security organizations’ ability to secure them. The 2019 State of Hybrid Cloud Security survey revealed 60% of respondents either agreed or strongly agreed that this was happening in their organizations. In many cases, security personnel are not even included in cloud business initiatives.

Additional key findings include:

• Only 56% of respondents indicated that network security, security operations or security compliance teams are responsible for cloud security.
• In the remaining 44% of cases, IT/cloud teams, application owners or other teams outside the security organization are responsible for cloud security.

Similarly, the relationship between security and DevOps is inconsistent across organizations, which can impact the consistency of cloud security controls, as more enterprises deploy “as-a-Service” models in the cloud. In some cases, DevOps and security are fully aligned and working well together. In other cases, the relationship is difficult or even dysfunctional:

• 39% of respondents said they are using Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) models concurrently.
• 7% of respondents said they are part of the DevOps team, as part of the emerging DevSecOps trend.
• However, 30% indicated their relationship with DevOps is either complicated, contentious, not worth mentioning or non-existent.

Existing Security Tools Can’t Handle Scale and Complexity

The 2019 State of Hybrid Cloud Security survey found that enterprises are inadvertently introducing complexity into their environments by deploying multiple solutions on-premise as well as across multiple private and public clouds. That complexity is compounded by a lack of integrated tools and training needed to holistically manage and secure hybrid cloud environments. Respondents also cited a lack of integration across tools, and lack of qualified personnel or insufficient training for using the tools, as key roadblocks to achieving cross-environment security management.

Key findings include:

• 59% of respondents use two or more different firewalls in their environment, with 67% also using two or more public cloud platforms.
• More than 80% of respondents are challenged with the limitations and complexity of security tools used for managing security across hybrid cloud environments.
• Only 28% of respondents said they were using tools that can work across multiple environments to manage network security.
• Almost 36% indicated using native tools for each environment or manual process, which means they are managing security in a stand-alone fashion within each component of a hybrid environment.
• 44.5% of respondents said their top three challenges for securing public cloud environments are: lack of visibility, lack of training and lack of control.

Mandate: Do More with Less

The transition to hybrid cloud environments has dramatically expanded the enterprise attack surface and, subsequently, the range of assets that must be secured, but security resources are not expanding at that same scale. Budget and staffing are the key resource constraints cited:

• 57.5% of respondents indicated that less than 25% of their security budget was dedicated to cloud security.
• 52% indicated they had security teams of 10 people or fewer.

“The results of our survey are compelling, but not surprising. In large, complex enterprise environments, budget constraints, lack of clarity around which team is responsible for cloud security, and the absence of standards for managing security across hybrid cloud environments are impairing organizations’ ability to secure their cloud business initiatives,” said FireMon Vice President of Technology Alliances Tim Woods. “This problem will only be solved with a new generation of security technologies and processes that fully integrate with DevOps and provide end-to-end visibility and continuous security and compliance across hybrid environments.”

Woods added that there is clear indication that many companies are no longer aligned to a central security policy or security doctrine that provides the necessary security guardrails across their hybrid environments. “In the absence of a concise security rule book, where departments are managing their own security controls, they will do so on a best-effort basis,” he said. “You can be guaranteed that this opens the door for increased risk.  If decentralized security responsibility is the future for cloud-first strategies, and we believe it is, then we must look for a way to reestablish a global security management strategy that aligns business intent, with compliance intent, with security intent.  Security implementations should closely reflect a central security doctrine. Security must be a component of application deployments where both are synchronized to each other.”

To download the FireMon State of Hybrid Cloud Security report, visit the FireMon website:https://www.firemon.com/2019-state-of-hybrid-cloud-security.