Home Blog Page 365

Fortnum & Mason hacked, data of 23,000 customers affected

The latest to join the newest group of cyber attack victims is British retail behemoth Fortnum & Mason. The company faced a major data breach wherein personal information of around 23,000 customers might have been compromised. The leaked data may include name, email and home addresses, and social media handles of the users.

Apparently, most of the users who had participated in the online poll for TV personality of the year category at the store’s food and drink awards, hosted by specialist survey and voting company Typeform, are at risk. “At 17.26pm on Friday 29 June, Typeform, a company that provides services that we have used in the past to collect survey responses and voting preferences, notified us that they had suffered a data breach and unfortunately some of our data had been compromised,” said a statement from the company. “The data of approximately 23,000 competition and survey participants who inputted into a Typeform form has been involved in this breach. For the majority of people, only the email address has been exposed. For a smaller proportion of customers, other data such as address, contact number and the social handle has been included.”

On the brighter side, no financial data was compromised during the hack, “These forms did not request bank or payment details, or require passwords,” it said, due to which the website and database of the store remain unaffected.

The incident is the second major breach in a week following similar Ticketmaster hack, where hackers stole data from the website including payment information of several customers. The website issued an alert after noticing a malicious software on a customer support product hosted by its third-party, Inbenta Technologies. “As soon as we discovered the malicious software, we disabled the Inbenta product across all Ticketmaster websites,” stated the alert. Ibenta’s product runs on several Ticketmaster international websites like Ticketmaster International, Ticketmaster UK, GETMEIN! and TicketWeb. Data of users’ of these sites “may have been accessed by an unknown third party,” it said.

Tech Mahindra announces partnership with LIFARS

Abnormal Security Partners with Microsoft to Boost Cybersecurity

To strengthen its threat preventive measures, Tech Mahindra, an IT consultancy tycoon, has announced its partnership with LIFARS, a US-based cybersecurity digital forensics and incident response firm.

According to Tech Mahindra, the association will provide innovative threat responsive services to the users. The partnership will integrate LIFARS’ incident response service with Tech Mahindra’s Security Operations Center (SOC) to develop advanced measures in the areas of threat detection, incident management, and integrated cyber resilience.

Speaking about the strategic partnership, Rajiv Singh, Global Head of Enterprise Security & Risk Management said, “LIFARS and Tech Mahindra’s partnership is aimed at addressing the growing needs of customers to combat the rampantly increasing number of cyber threats. By leveraging the combination of LIFARS’ world-class team of elite cybersecurity specialists for incident response services, and the expertise of Tech Mahindra’s skilled SOC analysts, we will develop an enhanced cyber breach and emergency response service offering,”

The partnership will also allow Tech Mahindra to concentrate on the global cybersecurity space.

“We are very pleased to enter into a strategic partnership with Tech Mahindra in the cybersecurity space. This collaboration will further help us expand our capabilities and reach,” Ondrej Krehel, CEO of LIFARS said. “Today, the market clearly recognizes the immense need for companies to implement thorough cybersecurity measures on-site. Tech Mahindra’s operational skills and reach in SOC delivery, combined with LIFARS’ in-depth cybersecurity knowledge will bring robust solutions and new innovation to the cybersecurity marketplace.”

Tech Mahindra is also operating a SOC at the recently unveiled Cyber Security Operations Center (CSOC) in the capital region of Andhra Pradesh, India. The center is aimed at averting threats looming over the region’s cyber space. It combats cybersecurity threats and provide real time intelligence sharing and threat analysis to all state government departments and entities. The security operations center (SOC) is a blended security analytics platform that ingests, correlates and analyses massive amounts of data. The state has also roped in Pricewaterhouse Coopers (PwC) to frame and adopt best-in-breed practices and frameworks in this domain.

Bithumb releases list of cryptos lost in breach, reduces losses

multi-stage bitcoin scam, Google Ads crypto wallet scam

Following the massive breach where after hackers stole 35 billion won ($31 million) from the South Korean cryptocurrency exchange Bithumb, the company has just released a list of 11 cryptocurrencies lost during the hack as well as the corresponding amounts of each,

Further, the losses of the hack have been reduced to $17 million, which is around 13 million less than the earlier estimated figure. “The main reason for the reduction of the damage is due to the ongoing participation, support and cooperation of cryptocurrency exchanges and cryptocurrencies foundations across the world. Also our quick response to the cyber-attack by removing cryptocurrencies from hot wallet to cold wallet effectively contributed to reducing the overall damage,” the exchange stated in a statement about the reduction in the value of the lost coins.

The company had assured that it would cover all losses so that users would not be affected.

“However, users who lost funds must apply for compensation from the theft to be eligible for the distribution of the funds. The exchange is also offering another form of compensation in the form of interest earned on the lost funds from the time of the hack to the time of the application. The interest rate will be 10% calculated annually and applied to the time frame mentioned,” suggests a report on Ethereum World News.

Cyber incidents have had a major impact on the cryptocurrencies and its values. Within an hour of information going public, the price of Bitcoin price had dropped nearly $200. Dr Robert Statica while speaking to Ethereum World News had stated that, “Exchanges have to take immediate & drastic cybersecurity measures but also look at how the coins & wallets are protected in transit and at rest. Unless changes are being made right away, the attacks and their magnitude will intensify both in frequency and volume.”

Skill gap paradox of cybersecurity

cyber security jobs

The infosec skill gap might become way worse than anticipated. A report by Cybersecurity Ventures suggests that by 2021, cybercrime will cost organizations more than $6 trillion annually while there will be 3.5 million unfilled security jobs. But the buck doesn’t stop there. Another recent study, by Ponemon, suggests that “A lack of skilled personnel is the biggest barrier to successfully deploying security automation.”

The study by Ponemon, which surveyed 1,859 IT and IT security practitioners in Germany, France, the United Kingdom and the United States, pointed out that 57 percent of respondents were unable to recruit knowledgeable or skilled personnel to deploy their security automation tools. “This barrier is followed by the inability to apply controls that span the entire enterprise, according to 55 percent of respondents.”

The Ponemon study followed the importance of security automation where majority of participants felt that security automation improves organizations’ security posture. When asked the respondents to rate the importance of security automation on a scale of 1 to 10, nearly 70 percent stated that security automation is crucial to the security posture of the company while nearly 80 percent rated the importance as very high in the next two years. The survey pointed out that, “The top two benefits of security automation are the increased productivity of IT security personnel and the automated correlation of threat behavior to address the volume of threats (64 percent and 60 percent of respondent, respectively). 54 percent of respondents say these technologies simplify the process of detecting and responding to cyber threats and vulnerabilities.”

While skill gap in the space continues to be a perennial problem. According to Peninsula Press, “More than 209,000 cybersecurity jobs in the U.S. are unfilled, and postings are up 74 percent over the past five years.” The report also estimated that the demand for cybersecurity professionals may grow by 53 percent through 2018. “The number of jobs in information security is going to grow tenfold in the next 10 years,” said Virginia Lehmkuhl-Dakhwe, director of the Jay Pinson STEM Education Center at San Jose State University told Peninsula Press. “We have to do much more if we want to meet that demand, at the university level as well as K-12.”

An earlier survey by EC-Council had noticed that skill gap in the cybersecurity industry spanned all levels, from CISOs to security analysts. “Most CISOs have several job openings yet to be filled and CISOs and the others involved in the recruiting process are looking for prospects with relevant certifications and experience. A major hurdle in the recruitment process is finding the right fit both with culture, personality, and experience that matches the job,” the study said.

Balbix invests $20M for a predictive model to strengthen cybersecurity

Startup funding

With an attempt to avoid cybersecurity adversities, Balbix has raised $20 million towards its business expansion. Balbix is a breach controlling platform that aids companies avoid security threats. The funding allows the company in further developing an advance preventive model that detects and resolve cyber threats. Earlier, the CEO of Balbix, Gaurav Banga has raised $8.6 million toward business growth. He’s also the co-founder of Bromium, a cybersecurity provider founded in the year 2010.

The company is making smart moves in developing the preventive model uses artificial intelligence and machine learning techniques in finding out vulnerabilities in an organization and strengthening the security architecture. The solution plugs into existing operational model to generate the company’s security weaknesses and threats.

In an interview, Banga said, “At enterprise scale, keeping everything up to snuff is very hard. Most organizations have little visibility into attack surfaces, the right decisions aren’t made, and projects aren’t secured.”

He also commented, “Ask any CIO, CEO or board member of a public company and that was the year that everyone woke up [and] figured their careers were at risk. It should have happened before, but it took the Equifax breach… they realized this thing is real and it can have a career-altering impact on their work and personal life.”

“We started this company so that we could use cutting-edge machine learning algorithms to automatically and comprehensively measure the security and attack surface, and to produce relevant insights for all stakeholders. You look at the numbers and you could easily have hundreds of millions or tens of billions of data points to watch for vulnerabilities- you have to make sure they are OK.” he added.

Ticketmaster hacked, payment information of several customers may have been compromised

ICO fined Ticketmaster

Ticketing website, Ticketmaster, became the most recent victim of a cyber attack and data breach, after hackers stole data from the website including payment information of several customers.

The website issued an alert after noticing a malicious software on a customer support product hosted by its third-party, Inbenta Technologies. “As soon as we discovered the malicious software, we disabled the Inbenta product across all Ticketmaster websites,” stated the alert. Ibenta’s product runs on several Ticketmaster international websites like Ticketmaster International, Ticketmaster UK, GETMEIN! and TicketWeb. Data of users’ of these sites “may have been accessed by an unknown third party,” it said.

Affected customers may include UK citizens who purchased or attempted to purchase tickets between February and June 23 2018, as well as international customers who purchased, or attempted to purchase tickets between September 2017 and June 23, 2018.

According to the website, “Less than 5% of our global customer base has been affected by this incident. Customers in North America have not been affected,” while reports from BBC suggest that the breach has affected up to 40,000 UK customers.

The company has deployed forensic teams and security experts to work around the issue understand how the data was compromised. “We are working with relevant authorities, as well as credit card companies and banks,” it said.

“After an incident like this, criminals from around the world will jump at the chance to try and catch a few unsuspecting people out,” said Brooks Wallace from the cyber-security specialist Trusted Knight to BBC. “If you receive any emails purporting to be from Ticketmaster asking for any personal information, discard them. If you need to contact Ticketmaster, type the website address into your browser and log-in that way.

 

Irish companies face little or no difference to day-to-day operations post GDPR: Survey

Irish businesses

More than half the Irish companies do not think that the introduction of Global Data Protection and Regulation (GDPR) has influenced their day-to-day operations, suggests a study by MicroWarehouse. The report states that 57% of Irish companies for one month since the compliance deadline of May 25 did not find any difference in their daily activities.

The survey also points out that with regard to companies coming under GDPR compliance, several small and medium enterprise did not enact any rigorous preparation model. While 20 percent of large companies had not only utilized the time allotted but even went to the extent of hiring an interim CISO, or engaging a GDPR accelerator to be compliant.

For nearly 32 percent of the respondents, amendments to data breach procedures in the company was the action taken to ensure compliance under GDPR. While, with regards to the cost, nearly 90 percent of small and medium enterprises spent €5,000 ($5,770) in preparation of the deadline, whereas 43 percent of the larger companies spent up to €20,000 ($23,075) to ensure compliance.

An alarming trend was that, when asked about cybersecurity concerns and the level of priority placed, only 13 percent of the companies stated that cybersecurity was one of the key concerns. While 35 percent of the respondents stated that cybersecurity and related issues were never discussed at management level.

“As we all know, there was considerable pressure placed on businesses to become GDPR compliant by a strict deadline and as such, we were interested to see how it has impacted their business since that date,” said Aidan Finn, Technical Sales Lead at MicroWarehouse to Irish Examiner. “It also highlights the costs associated with becoming GDPR compliant, which is particularly onerous on SMEs who are subject to the same regulations as larger companies. In relation to cybersecurity and hacking, we were shocked to learn that security of data is so far down the agenda at a senior management level. Particularly in an era of cyber crime and data leaks, one would think ensuring the security of your network would be in the company’s best interest.”

Royal Bank of Canada invests $2m in BGU’s cybersecurity research center

Royal Bank of Canada

With an aim to strengthen the artificial intelligence and machine learning practices, The Royal Bank of Canada (RBC) is investing $2 million in Cybersecurity Research Center at Ben-Gurion University. The funding supports the development of existing artificial intelligence, creation of advance protection methods, machine learning procedures and for mitigation of their vulnerability to data threats.

The research center will be supervised by Prof. Yuval Elovici and Dr. Asaf Shabtai from the Department of Software and Information Systems Engineering at the Ben-Gurion University Cybersecurity Research Center.

Speaking on the latest move, Martin Wildberger, Executive Vice President at RBC said, “In today’s incredibly complex world, we need advanced technology like AI and machine learning to continue developing leading-edge cyber security. This partnership will help support our cyber defense by working with prominent experts in the field, such as the researchers at Ben-Gurion University.”

Danny Shtaier, High-Tech Business Development, at BGN Technologies said, “This partnership provides our researchers with the opportunity to further apply their leadership in cyber security research to the banking industry, where security is crucial for daily operations and the safety of customers.”

Many Canadian organizations have magnified their investment and focus on cybersecurity. In November 2017, Optiv Security, a provider of end-to-end cyber security solutions, announced that it is continuing to accelerate its growth strategy by acquiring Conexsys, a Toronto-based security and networking solutions provider. This acquisition increased Optiv’s ability to serve Canadian, U.S. and global clients with expanded skills, knowledge and presence. Additionally, Optiv enhanced its vertical presence in government markets, with the strong business relationships Conexsys brings with the Canadian government.

Ping Identity acquires Elastic Beam and launches new platform to secure APIs

Partnership

Identity Defined Security company Ping Identity publicized the acquisition of API cybersecurity provider Elastic Beam and the launch of PingIntelligence for APIs on June 26, 2018, in Boston.

A Denver-based software developer founded in 2002, Ping Identity claims to be the first company to use artificial intelligence (AI) to safeguard API infrastructures in public and hybrid clouds. The company stated that PingIntelligence for APIs gives a high-level of intelligence to detect and block cyber attacks that target APIs. The company also offers various software solutions like identity management, multi-factor authentication, and single sign-on tools which are best suitable for financial and healthcare markets.

Andre Durand, the CEO of Ping Identity, said in a press release, “We believe that adding intelligence based on machine learning analytics to the Ping Identity Platform is the next wave of identity security. For years, Ping has been delivering API security to global organizations with market-leading products like PingFederate and PingAccess.”

“This acquisition extends our leadership by providing a comprehensive intelligence-based approach to API security. As an industry, it’s critical that we make decisions based on the ever-changing nature of context and behavior versus pre-defined policies that attempt to capture when, where and why a user is trying to access something,” he added.

Elastic Beam was established by Bernard Harguindeguy and Uday Subbarayan in 2014. Before its acquisition, Elastic Beam created its first hybrid cloud software that combines artificial intelligence and API to avoid data and system threats. The new technology will now help Ping Identity to help businesses identify and avoid cyber attacks that target API vulnerabilities.

On speaking about the acquisition, the founder of Elastic Beam, Bernard Harguindeguy said, “We’re thrilled to be a part of Ping Identity, a company that places equal weight on the importance of this growing issue. Integrating Elastic Beam into Ping Identity delivers a strong, intelligent security solution for APIs that simply has not existed until now.”

London Office for Rapid Cybersecurity Advancement opens today

London

The world’s first cyber innovation center, located in the Queen Elizabeth Olympic Park in London, opens today. The £13.5 million London Office for Rapid Cybersecurity Advancement (LORCA) is funded by the government and will help in the development of technology for protecting the country against cyber threats.

The LORCA will be run by Plexal from its Here East headquarters and will support UK’s entrepreneurs to come up with innovative solutions to resolve cybersecurity challenges.  It’s estimated that the innovation centre could also generate around 2000 job opportunities in the UK.

Matt Hancock, Digital Secretary of State, is going to inaugurate the new government-funded cyber innovation centre. Speaking ahead of the opening, Hancock said “It is fantastic to open this new centre, where some of our most talented entrepreneurs and innovative companies will develop the cyber security technology of tomorrow.”

“We are investing £1.9bn to protect the nation from cyber threats, have introduced new laws to strengthen our defences, and developed a wealth of free help and guidance for businesses available through our National Cyber Security Centre,” he added.

The Lloyds Banking Group will be the founding partner and involved in choosing and supporting the start-ups/entrepreneurs having a special focus on cybersecurity in the financial sector.

Lydia Ragoonanan, director of Lorca, said: “The threats posed to businesses by cyber-attacks are continually changing. We are proud to be working with industry to understand their needs, with investors who can help develop the solutions scale at pace, and with incredible innovators who are helping secure the UK’s position as a world leader in cyber security. By bringing all these things together in our new centre, we will stay ahead and help British businesses grow and succeed.”

Britain is constantly making efforts to fight against cyber threats. In February, Britain’s Home Secretary Amber Rudd announced United Kingdom’s partnership with a London-based startup to develop an algorithm which will be used to identify terrorist content on the Internet. ASI Data Science, the company that worked in collaboration with UK Home Office, announced on its official Twitter handle that the accuracy of the algorithm is close to 99.9%.

1...364365366...409Page 365 of 409