Home Blog Page 43

A Quick Guide to Cross-Site Request Forgery (CSRF) and How to Prevent It

cross-site request forgery

Cross-site request forgery (CSRF) is a critical web application security vulnerability that is increasingly gaining prominence. As businesses embrace digital transformations with advancing technologies, the threat landscape has also widened for web application vulnerabilities.

The first CSRF vulnerability exploit dates to the early 2000s, but Peter Watkins initially coined the term in 2001. While the first popular CSRF exploit surfaced in 2005, known as the MySpace worm by Samy Kamkar, also known as “Samy worm” – it was the earliest known cross-site scripting worm – which has revolutionized the web security space.

In 2007, cross-site request forgery ranked 5th place in the OWASP Top 10 and later dropped from the OWASP framework owing to the low incidence rate in 2017. However, cross-site vulnerabilities made headlines once again in 2018, with high-profile cases reporting CSRF bugs. Multiple organizations like Facebook were also exposed to cross-site forgery request vulnerabilities.

Before understanding the implications of CSRF exploits, it is crucial to know CSRF’s meaning and fundamentals. This blog explains CSRF, its key concepts, how it works, and how to prevent it.

What is Cross-Site Request Forgery (CSRF)?

Alternately known as Session Riding or Sea Surf, Cross-Site Request Forgery is an attack method wherein threat actors design malicious requests to trick the users into visiting a duplicate website. The attacker can craft a fraudulent request, embed the malicious link in image tags, and trick the user into downloading the image through phishing or other techniques.

Typically, CSRF attacks target websites that trust some form of authentication by users before performing any action. It exploits a vulnerability in a web application when it cannot detect the difference between a valid user request and a forged one when the user is authenticated to the site. During a successful execution of a CSRF attack, an authenticated user is misdirected to a malicious website to perform actions with commands sent by the attacker.

An unsuspecting user is under the impression that they are performing an action on a legitimate website and unknowingly allow attackers to intrude on their system.

CSRF exploits can also occur because of cookies that are abused during cross-site requests. The process of fetching data from a third-party website is known as a cross-site request. Since all cookies, including session cookies, are also included in browser requests, the CSRF attack can be triggered.

Examples of Cross-Site Request Forgery Attack

Cross-Site Request Forgery attack is executed when a cybercriminal copies the layout, design, or website format from where data is being pulled [1].

Let’s understand a CSRF example in the context of a user logging into an e-commerce portal to purchase a product. For the CSRF attack to be triggered, the user must be authenticated to the site in an active session. The attacker exploits this trust and sends forged requests on behalf of the authenticated user. When the attack is successful, the attacker deceives the web application used to send their information to a fake website or place an order on their behalf.

The following section discusses the key concepts and components of CSRF and how it is carried out.

Key Concepts of Cross-Site Request Forgery

Successful execution of cross-site forgery attack includes two main techniques:

  • Cross-site forgery attack relies on social engineering methods to deceive targeted users into clicking a forged link or URL. The common ones include phishing mail, a fake chat link, a tracking system, or a fake push notification that will redirect the user to the fraudulent site.
  • CSRF attack aims to target users for performing state change requests. State changing requests do not reveal the data response of the request to the attacker and are used to only make some alterations in the data values, such as changing the email address, placing an order, changing passwords etc.

Through such attacks, the attacker can take control of the entire web application under some scenarios.

Components of Cross-Site Request Forgery

A Cross-Site Request Forgery attack consists of two main elements:

  1. Cross-Site: The user is tricked into clicking a fake link that takes them to a target website designed to steal information from the victim.
  2. Request Forgery: Cybercriminals send the malicious links to the user’s website or browser to which they are authenticated and trick them into clicking the duplicated link or values.

Learn More About CSRF Attacks

How Does a CSRF Attack Work?

As explained above, the CSRF attack is triggered when the user is authenticated to the web application, and the attacker can exploit the active session to trick the users.

There are two main methods of carrying out cross-site scripting intrusion:

1. GET Method

GET is an HTTP method that is used to retrieve any information from the specified resource.

To execute a cross-site forgery attack using the GET request, the user simply clicks on the forged link to find the malicious webpage. This website executes a script that sends an unsolicited request. Since the victim is unaware that they are on the duplicated platform, they perform the command and submit their credentials or download the cookies for the hacker to manipulate [2].

It is always wise not to use the HTTP GET request to perform state change requests dealing with sensitive data. Sending an HTTP GET request doesn’t result in data change generally. But in some situations, web apps still use GET instead of the POST to perform state changes. These activities include changing passwords or submitting a record etc. So, the GET HTTP method should be used to send non-sensitive data only, or attackers can exploit cross-site requests to execute an undesired action on the victim’s behalf.

2. POST Method

An HTTP POST request sends data to the server, which is embedded in the message body itself. While GET request is a convenient way to exploit CSRF vulnerability, most state-changing activities are done through HTTP POST requests. While it’s a myth that CSRF vulnerability cannot be exploited through the POST request, it is not the case. The attacker can deceive the user by creating a forged website that transmits malicious JavaScript and causes the user’s web browser to perform an undesirable action by sending a POST request when the page loads.

The following section highlights a few methods linked to CSRF protection.

Cross-Site Request Forgery Prevention Techniques

CSRF has severe ramifications on an individual’s data. It is even more concerning for organizations as attackers can use CSRF attacks to perform fraudulent transactions or disrupt the entire operation by accessing system-level privileges.

However, CSRF risks can be contained as web application security experts have proposed numerous CSRF prevention measures. Some of the best practices include:

1. Use CSRF Tokens

Organizations can implement CSRF prevention techniques using a CSRF token. These unique tokens have a secret value generated by a server-side application. Developers ensure that these requests are valid by adding a challenge token to every state change request linked to a specific user. These requests can range from transferring funds to adding personal credentials on the back end of the website.  And the token should be valid until the user ends the session. They are also known as the Anti-CSRF token, which protects users from falling prey to forged URL requests as the attackers also need to know the token to send malicious requests to the target user.

CSRF tokens can prevent cross-site request forgery attacks, as attackers fail to construct and feed their victims a fully valid HTTP request [3].

2. Use the SameSite Flag in Cookies

SameSite flag in cookies is a new method or attribute of preventing a CSRF attack. The SameSite attribute can be used to restrict cookies for cross-site requests for all third-party websites. This prevention technique enhances the security of web applications to a large extent. In this scenario, the website uses unique session cookies to determine if authentic users are logged in. Under suspicious behavior, the user or the bot will be blocked before any malicious activity is executed.

3. Implement Training and Raise Awareness

Apart from the above-mentioned cross-site request forgery prevention techniques, taking proactive steps is also important. You need to be well versed with the latest web application vulnerabilities to mitigate the threats arising from CSRF vulnerabilities.

Furthermore, it would help if organizations upskilled their employees periodically, especially those responsible for assessing and analyzing the security aspects of the organization — the IT and cybersecurity teams. A higher level of awareness and knowledge of the latest technologies and resources can help fortify organizations’ web applications’ security. The team involved in the web application development process should know about the risks associated with CSRF vulnerabilities. Sound knowledge of using an anti-CSRF token would be a significant step in making your web applications risk-free. Therefore, mapping your workforce to the proper training certification is also essential to mitigate the risks.

One such credible program is EC-Council’s Web Application Hacking and Security certification program that offers state-of-the-art training to candidates interested in taking their application security/cybersecurity skills to the next level.

Master Web Application Hacking and Security Skills with EC-Council

EC-Council’s Web Application Hacking and Security Training Certification equips you with niche skills aligned with application security job roles. The program covers every aspect of cross-site request forgery and how a web application security professional can identify such attacks. Apart from CSRF attacks, the program also covers different modules of web application vulnerabilities. You’ll learn about automated tools and techniques that will enable you to learn, hack, test, and secure web applications.

The program also includes capture-the-flag challenges to test one’s hacking skills, but the challenger can also follow an instructor to complete the challenge or work alone.

The certification will prove ideal for every aspiring web application penetration tester and organization looking for new ways to strengthen their cybersecurity teams.

Get Certified as a web application security expert -> Register Now

FAQs

1. How do I get my CSRF token?

Ans. You can get a CSRF token through a cryptographic strength pseudo-random number generator (PRNG). This generator is seeded with the timestamp, which signifies the time it was created. It also comes with a static secret.

You can also generate personal tokens by linking the outputs with user-specific entropy and taking the whole structure’s strong hash.

2. What are the two primary types of XSS vulnerabilities?

Ans. The primary XSS vulnerabilities include:

  • Reflected XSS: Malicious script comes from the current HTTP request.
  • Stored XSS: Malicious script comes from the website’s database.

Expert Opinion: Cybersecurity Awareness Month

Cybersecurity Awareness Month

Now in its 18th year, Cybersecurity Awareness Month continues to raise awareness about the importance of cybersecurity across our Nation, ensuring that all Americans have the resources they need to be safer and more secure online.

Brian Pereira, Editor-in-Chief, CISO MAG, sought insight from some of the industry experts on ways to fight phishing attacks, improve the cybersecurity posture, and be cyber aware. Here’s what they have to say:

PrevNext

1. Third parties continue to be a risk

Ditmar Tavares

“Thanks to the news we see (cybersecurity) events on a daily basis. We see organizations are increasing their awareness. Most of them are taking steps to be more secure. I break down cybersecurity awareness into two portions: one is being aware of the field, which I think the state is pretty good as everybody knows what it is and they are concerned about it. The second part of it seems to be a problem — how well organizations know about the threats they are facing, specifically based on what they do. The risk that they are introducing with the actions they take or with the data they are collecting —  or even with the social media posts their employees are doing. Risks are evolving or are introduced with third-party organizations they do business with. That is where most organizations are falling short. Although they know about cybersecurity awareness, I wish they would know specifically what matches their need, what matches their gaps, and what they need to do, tailored to their need and expectations. That’s where they have a lot of work to do.”

2. Be aware of the latest trends

Dr. Frank Ofori

“Looking at the trends and what’s going on with cybercriminals and cyberattacks over the past couple of years, I see organizations struggling to be aware of their situation and also how to mitigate cybercrimes. Cybersecurity awareness is a way for individuals to be able to be aware of the latest trends about how cybercriminals are attacking them. It is also about mitigating these threats. During the pandemic and over the years, we notice that organizations are struggling with cybersecurity awareness. It is not because they lack the resources to do it, but they need to identify what kind of awareness training they want to give to their employees. They ask how will the training impact the employees and also the organization. How do the employees engage themselves in that kind of awareness? Those are some of the bigger challenges organizations are facing. As per a report, there were four million data breaches this year. The Internet Security Consortium says 30% of these threats were caused due to human error. It is coming from phishing, malware, and social engineering. So how do organizations understand what is going on and then equip their employees to be able to mitigate some of these threats?

Even though we have technology like intrusion detection systems and all the technology in place to make sure that cybercriminals don’t attack our networks — humans are the weakest link People just click on links in unknown emails, without knowledge from where those emails are coming from.

We also need to be aware of our personal security awareness. We can all become targets to adversaries. We unknowingly put our PII into the garbage bin and somebody could get it and then we become a target. And it is also your family and the organization who are at risk. So security is everybody’s responsibility.”

3. Cybersecurity is a shared responsibility

Le Nguyen Truong Giang

“In the past, there were many statements like cybersecurity is a shared responsibility or cybersecurity in the workplace is everyone’s business. But most stakeholders didn’t know much about cybersecurity; they did not do enough to protect the business’ information assets. However, the increased volume of cyberattacks is a significant warning that every business is at risk of a cyberattack; they could be victims of a cyber attack or breach. As the result, there are collaborative efforts between government and industry to raise awareness about the importance of cybersecurity and to ensure that all stakeholders have the resources they need to be safer and more secure online. According to many data breach investigation reports, most cyberattacks were traced back to human errors. Obviously, CEOs, business directors, and managers want to keep their data safe or protect their business’ information assets against cyberthreats, so they have to educate their colleagues and create a workplace culture surrounding cybersecurity awareness.

In my opinion, most organizations have already acknowledged business risks related to cyberattacks; but they lack the ability somehow to identify, prevent, detect and respond to cyberthreats. They are facing many difficulties, not only due to limited budgets for technology investment, lack of well-defined processes for building and optimizing, and also skilled security personnel.”

4. Employees are possibly your largest failure points

Dr Imtiaz Abdul Kader

“I see two elements when we speak about the state of cybersecurity and the threats associated with it. One is the readiness of the skills, the training that is required, and from that perspective, we still have a long way to go. There are special schools sponsored by corporates that are looking at advancing the skills because as you know, one of the key threats when working from home is ransomware, malware. So employees are possibly your largest failure points. If you look at some of the research, they quote anywhere from 40% – 50% in terms of the employees’ willingness to click on a link that will then introduce malware into the system. We still have a long way to go in terms of that. One of the things we are doing to improve the state of cybersecurity within our region is to partner with specialist companies, as well as bring in those skills that through training currently, advance the capabilities within the organizations. On a scale of 0 – 10, I would give it a rating of 6.5 — as you know the cybersecurity threats keep advancing and we have to advance with it. So I think the state of readiness will always be in flux.”

5. Pakistan govt wants to ensure that citizens are aware of their privacy rights

Jawad Kazim

“Cybersecurity has been important in Pakistan for the past 10 years. We got our first policy 10 years ago, and we are celebrating cybersecurity awareness month here in our university. In my previous role, I was heading the cybersecurity department at a leading university. The higher education commission encourages the universities to have events on cybersecurity. At the moment there are campaigns going on about cybersecurity awareness. The good news is that last month we had a consultation document for our privacy policy that was approved by our parliament; it is currently a draft but is expected to become a law by the end of this year. Our government wants to ensure that every citizen is aware of their privacy rights. This is very similar to GDPR. So, this is really important when you have a policy, governance, and the involvement of the parliament. It comes from the highest office.”

6. We have a long way to go for complete cybersecurity awareness

Seth

“Initially, there was not much cybersecurity awareness in Ghana. It started gaining ground in 2018 and as a result, the Government of Ghana developed laws and legal documents, and regulations for some of the sectors. In early 2018, the financial sector, and notably the Bank of Ghana gave a directive to regulate the banking industry. It wanted every bank to institute cybersecurity to ensure that every bank is well prepared to deal with cybercrime. The Government of Ghana launched the cybersecurity awareness month program and it also took the opportunity to launch the Cybersecurity Act from the national cybersecurity authority. And for cybersecurity awareness month we have a series of programs for each sector. Because of the directive and proactiveness of the Bank of Ghana to regulate all the financial institutions to be aware of what is going on, because of all the cyberattacks in Africa. So we have an annual program to sensitize all our staff. We organize at least two training sessions for our staff every year. This was organized for the past two years. So the awareness level for our staff has increased. And they understand all the various threats and the sources of cybercrime. Awareness is increasing but we still have some way to go for complete awareness. It is gaining ground.”

Pledge to Online Security This International Internet Day

IPv4 Address Price, International Internet Day

Finding a person without having an online presence is difficult these days. Not emotionally, but today most people maintain virtual relations leveraging the ease of the internet. Due to increased digitalization, people are more connected than ever. Besides, the pandemic has impacted the way we think about the concept of home, with most of us finding digital comfort on social media platforms. The dependency on the internet has become inevitable for users, as companies of all sizes today provide online services. It’s really hard to imagine today’s life without the internet; hence, October 29 is marked as International Internet Day.

By Rudra Srinivas, Senior Feature Writer, CISO MAG

No doubt, the internet is one of the greatest inventions in the world of technology, connecting millions of networks and users across the world. However, the internet is also an entry point for multiple security issues if not used mindfully. International Internet Day continues to recognize the internet’s invention and bring awareness on the safe usage of the technology online.

Origin of International Internet Day

The International Internet Day has been observed every year on October 29, worldwide, since 2005. It was promoted by the Association of Internet Users to commemorate the first-ever communication between two computers on October 29, 1969, via Advanced Research Projects Agency Network (ARPANET), which is the predecessor of the commercial internet. Since then, the internet has evolved and become a significant part of our lives.

The First Message

The first message was sent to programmer Bill Duvall at Stanford Research Institute by UCLA professor Leonard Kleinrock and his student and programmer Charley Cline. The programmers tried to send the word “login” as the first message but ended up sending only “lo” letters as the connection between the computers crashed.  The word login was sent later after restoring the computers.

How the Internet Transformed Human Lives

Today, the internet is everywhere, and almost everything is on the internet. One can dig for details about everything on the internet without involving human interactions. The invention of the internet has created several job opportunities and business ideas. The internet has changed the way people communicate, socialize, shop, and go about their daily routine. The internet even changed how people find their love interests and life partners, with online dating apps and sites, become a thing now.

Internet – A Gateway to Cyber Risks

Technology has its pros and cons. Misuse of the internet, such as cyberbullying, cyberterrorism, cybercrime or money laundering, or cybersex trafficking, may get users into severe security repercussions.

The more we are connected, the more we become vulnerable to various online threats. In tandem with users and enterprises, the internet has also given multiple opportunities to cybercriminals to prey on sensitive data online. Security issues like ransomware attacks, data breaches, and malware threats continue to prevail as most users and organizations lack necessary cybersecurity measures. Unfortunately, the lack of awareness also traps users into several identity thefts and frauds online.

Practicing internet security and raising security awareness will eventually boost users’ online security and privacy.

Also Read: 6 Steps to Boost your Online Security

Rajashekhar RajahariaCommenting on how the internet has changed human lives and continued to become an entry point for new threats, Rajashekhar Rajaharia, an independent cybersecurity researcher from India, said, “The Internet has become a part of our daily life. But on the other hand, due to a lack of knowledge in rural areas, it is also becoming dangerous. The government and NGOs should run regular campaigns to educate how to protect themselves and money from online threats. Online Scams and threats are taking the place of robbery and extortion. Rules should be strict for data breaches and cybercrime.”

Wrap Up

To build or break is in our hands. Our online security would depend on how wisely we use the internet. As we celebrate International Internet Day, let’s sit back and reflect on contributing to our online security and doing our part in making cyberspace safe.

About the Author:

Rudra Srinivas

Rudra Srinivas is a Senior Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.       

More from the Rudra.

 

Forrester Report Predicts 1 in 10 Experienced Security Professionals Will Exit Industry in 2022

Threat predictions 2022, Forrester 2022 predictions for Cybersecurity, Risk, and Privacy

Forrester has released its Predictions 2022: Cybersecurity, Risk, and Privacy report revealing an important aspect of security professionals quitting their jobs.

The report claims that one in 10 experienced security professionals will exit the industry. Per 2021 data, more than half (51%) of cybersecurity executives faced extreme stress or burnout, and another 65% wanted to quit their jobs due to extreme stress levels. 

A widely prevalent trend of 2021, the “Great Resignation,” is posing to be a big challenge to businesses in maintaining continuity and their workforce. It is also heavily impacting the security and privacy of the company, exposing it to increased risk.

The Big Quit 

The Great Resignation, also known as the Big Quit, is the ongoing trend in the U.S.,  where employees voluntarily quit their jobs, from spring 2021 to the present, in response to the COVID-19 pandemic. Some economists described the Great Resignation as a general strike while discussing Striketober, a strike wave that began in October 2021.

Forrester Predictions

60% of security incidents will involve third parties: With cyberattacks targeting smaller vendors and suppliers, third-party incidents will increase, and SolarWinds-style headlines will plague firms that don’t invest in the pillars of risk management — people, process, and technology.

In today’s evolving digital world, a supply chain attack is not a new threat. In fact, 80% of retail data breaches are due to supply chain attacks. Today, a growing number of hackers are adopting sophisticated tools and techniques to attack a company’s supply chain management and wreak havoc in business operations. These attacks can be devastating and may at times have an irreversible impact on the business.

See also: Discussing the Impact of the Kaseya Supply Chain Attacks

One-fifth of firms will embed cyber insurance policies in third-party contracts: Before signing new and renewing existing suppliers, organizations will demand policies embedded in their contracts, stipulating that the partner assumes the risk of an intruder jumping from the partners to the organization’s environment. Smaller policies reduce exposure for cyber insurers, while also reducing the policyholder’s risk of working with new and existing suppliers with varying cybersecurity postures.

As organizations grapple with security breaches, the mass exodus of IT workforce is only exacerbating the security problem. Human resource is an asset that is as critical as any digital asset. It is an organization’s most valuable asset. Stability and growth depend on human capital, which is why an excellent administration of these resources is required. All breaches in some way or the other are related to human errors and vulnerabilities.

The case in hand is the Facebook outage, where supposedly a human error — faulty configuration changes made to Facebook routers — caused the entire network to shut down, restricting all access to both digital and physical to the systems and data center. When IT experts leave, they take with them a wealth of insider privileged information, which, if misused, can cause serious implications on the working of an organization and, if they turn hostile, many imposters waiting to recruit.

U.S. Bans China Telecom Americas Citing National Security Issues

U.S. and China

China-based services and products continue to concern the world over security issues. The U.S. Federal Communications Commission (FCC) has recently revoked China Telecom Americas’, a U.S. subsidiary of a Chinese state-owned enterprise China Telecom Corporation, license to provide interstate and international telecommunication services citing national security risks. In an official order, the agency asked Telecom Americas to discontinue its services in the U.S. within 60 days.

“Promoting national security is an integral part of the Commission’s responsibility to advance the public interest, and today’s action carries out that mission to safeguard the nation’s telecommunications infrastructure from potential security threats,” the FCC said.

Brendan Carr, the Commissioner of the FCC, stated the latest move is a critical initiative towards defending against constant cyberthreats from China.

Order Endorsed by Executive Branch Agencies

The decision to withdraw China Telecom Americas services comes after the U.S. Executive Branch agencies (the Departments of Justice, Defense, State, Commerce, Homeland Security, and the U.S. Trade Representative) recommended the FCC in April 2020 significant security risks.

The Executive Branch unveiled its findings to the FCC, which include:

  • China Telecom Americas is subject to exploitation, influence, and control by the Chinese government and is highly likely to be forced to comply with Chinese government requests without sufficient legal procedures subject to independent judicial oversight.
  • The Control by the Chinese government raises significant national security and law enforcement risks by providing opportunities for China Telecom Americas, its parent entities, and the Chinese government to access, store, disrupt, and/or misroute U.S. communications, which in turn allow them to engage in espionage and other harmful activities against the U.S.
  • The China Telecom Americas conduct and representations to the Commission and other U.S. government agencies demonstrate a lack of candor, trustworthiness, and reliability that erodes the baseline level of trust that the Commission and other U.S. government agencies require of telecommunications carriers.
  • The telecom wilfully violated two of the five provisions of the 2007 Letter of Assurances with the Executive Branch agencies, compliance with which is an express condition of its international section 214 authorizations.

Chinese Telecoms Face the Heat

This is not the first Chinese telecom has encountered security concerns from government authorities. Earlier, the Chinese telecommunications service provider Huawei experienced severe backlashes from the Australian government and other countries over security and cyberespionage campaigns.  A security report has alleged that Huawei has been recruiting high-level operatives linked to China’s military and intelligence agencies. It is suspected that over 100 Huawei employees had connections with the Chinese military and state-sponsored hacking operations.

As Part of Cybersecurity Initiate

The latest move to stop the China Telecom Americas services in the U.S. could be another critical step of the Biden Administration, which is constantly trying to mitigate the state-sponsored attacks from China, Russia, and across the globe. The U.S. government has been initiating several cybersecurity measures to address the rising cyberthreats. As part of their multiple cybersecurity initiatives, the U.S. recently hosted a virtual meeting this month involving over 30 countries to address the expanding cyberthreat landscape.

Creator of Zero-Trust Model Says Trust Did Not Exist in a Digital World

It seems no security conference or conversation is complete without a discussion on zero trust. But not long ago, “trust” was only a human emotion and did not exist in the digital world.  The zero-trust model and zero-trust architecture are not new concepts and were devised in the last decade. The terms increased in popularity since the pandemic struck in 2020, and they are now more relevant than ever, especially as we now find ourselves living in a time in which there is no network perimeter.

In an exclusive interview with Brian Pereira, Editor-in-Chief, CISO Mag, John Kindervag Senior Vice President Cybersecurity Strategy and ON2IT Global Fellow, explains the genesis of the Zero-Trust model, and what he wanted it to be, when he came up with the term in 2008.

Kindervag said there were two worlds back then. The internal network was safe, trusted, and secure. It had the highest level of trust. The external network had the lowest level of trust. He opposed the idea that the network needed to have a crunchy, hardened layer on the outside, and a soft, chewy inside. For a long time, security professionals assumed that malicious individuals wouldn’t get past the “hard, crunchy outside,” as he writes in his paper. He suggested that there should be a lot of crunchy, and a little bit of softness on the inside, which is the data that needs to be protected. In his words, “Zero trust needs to be like a chocolate chip cookie.”

The paper suggested that the way to confront new threats was to eliminate the soft, chewy center and make security ubiquitous throughout the network, not just the perimeter. So, the zero-trust model was created to help security professionals do this effectively.

The zero-trust definition is more widespread today, with zero-trust architecture extending way beyond the corporate perimeter and onto the cloud and remote access platforms.

Kindervag joined ON2IT in March of 2021 as Senior Vice President Cybersecurity Strategy and ON2IT Global Fellow. He spent the previous four years at Palo Alto Networks as Field CTO. Before Palo Alto Networks, John spent eight and one-half years at Forrester Research as a Vice President and Principal Analyst on the Security and Risk Team. John is considered one of the world’s foremost cybersecurity experts.

About the Interviewer

Brian PereiraBrian Pereira is the Editor-in-Chief of CISO MAG. He has been writing on business technology concepts for the past 27 years and has achieved foundational certifications in cloud computing (IBM) and cybersecurity (EC-Council).

 

More stories from Brian

McAfee and FireEye Release 2022 Threat Predictions for Enterprises

Threat predictions 2022

McAfee Enterprise and FireEye have released their 2022 Threat Predictions, analyzing the threat vectors that continue to impact enterprises and will wreak even deeper havoc across the globe in 2022. As adversaries learn from the successful attacks of 2021, they will further their expertise on ransomware, social media trickery, and the continued dependence of organizations on a remote workforce.

“Over this past year, we have seen cybercriminals get smarter and quicker at retooling their tactics to follow new bad actor schemes – from ransomware to nation-states – and we don’t anticipate that changing in 2022,” said Raj Samani, fellow and chief scientist of the combined company. “With the evolving threat landscape and the continued impact of the global pandemic, it is crucial that enterprises stay aware of the cybersecurity trends so that they can be proactive and actionable in protecting their information.”

 2022 Predictions:

  1. Social media easy bait to mark targets: Social media will continue to be a platform of choice for hackers for infiltrating organizations for their criminal gain. Hackers are spending more time on target research and establishing fake profiles to ensure fruitful attacks. Targeting of individuals has proven to be a very successful channel, and the use of this vector could grow not only through espionage groups but also other threat actors.
  2. Nation-states turn to hackers for hire: It has been noticed that states are hiring cybercriminals to initiate malware attacks. In many cases, a start-up company is formed, and a web of front companies or existing “technology” companies are involved in operations that are directed and controlled by the countries’ intelligence ministries. In May 2021, for example, the U.S. government charged four Chinese nationals who were working for state-owned front companies. The front companies facilitated hackers to create malware, attack targets of interest to gain business intelligence, trade secrets, and information about sensitive technologies.
  3. Game of Ransomware Thrones: Self-reliant cybercrime groups will increase and shift the balance of power within the Ransomware-as-a-Service (RaaS) eco-kingdom from those who control the ransomware to those who control the victim’s networks. Ransomware has generated billions of dollars in recent years, and it’s only a matter of time before some individuals who believe they aren’t getting their fair share become unhappy.
  4. The growth of smaller affiliates: For a long time, RaaS admins and developers were prioritized as the top targets, often neglecting the affiliates since they were perceived as less skilled. This, combined with the lack of disruptions in the RaaS ecosystem, created an atmosphere where those lesser-skilled affiliates could thrive and grow into very competent cybercriminals, eventually with a mind of their own.
  5. Keep A Close Eye on API: Onset of 5G network and IoT traffic between API services and apps are lucrative targets, causing unwanted exposure of information. The network, being relatively new, is open to exposure and vulnerabilities. In most cases, attacks targeting APIs go undetected as they are generally considered trusted paths and lack the same level of governance and security controls.
  6. Hijackers Will Target Your Application Containers: Containers have become the de-facto platform of modern cloud applications. However, the accelerated use of containers increases the attack surface for an organization. The exploitation of public-facing applications (MITRE T1190) is a technique often used by APT and Ransomware groups. The Cloud Security Alliance (CSA) identified multiple container risk groups, including Image, Orchestrator, Registry, Container, Host OS, and Hardware.
  7. Zero Cares About Zero-Days: 2021 is already being touted as one of the worst years on record with respect to the volume of zero-day vulnerabilities exploited in the wild. The scope of these exploitations, the diversity of targeted applications, and ultimately the consequences to organizations were all notable. As we look to 2022, we expect these factors to drive an increase in the speed at which organizations respond. The time to repurpose vulnerabilities into working exploits will be measured in hours and there’s nothing you can do about it… except patch.

2020 and 2021 were witnesses to organizations falling prey to increased ransomware attacks through social engineering trickery, posing as cybersecurity firms for penetration testing and instigating malicious attacks on the network, ransomware attacks, vulnerable 5G networks, and IoT devices, cloud containers, and zero-day vulnerabilities. The report does provide a realistic peek into the looming threat landscape as we move towards 2022.

As reported, the rollout of 5G technologies has accelerated the proliferation of IoT and smart devices around the world, making unsuspecting recruits available for botnet armies to launch crushing attacks on a massive scale. Similarly, a survey “State of DevSecOps,” from Accurics revealed that misconfigured cloud storage services in 93% of cloud deployments led to over 200 breaches in the past two years, exposing more than 30 billion records.  It also stressed that cloud data breaches are expected to increase in both velocity and scale.

Organizations and essential services across the spectrum must proactively evaluate their security posture in the light of the past successful attacks and take a cue to fix the vulnerabilities, increase employee awareness and not let their guard down.

Empowering Your Team to Fight Cybercrime: What You Need to Know

cybercrime

Cybersecurity continues to be a pressing issue for businesses across the Asia-Pacific (APAC) region. We’ve all seen the headlines and statistics, and threats continue to escalate as cybercriminals employ tricker tactics to breakthrough company defenses.

By James Forbes-May, Vice President, Asia-Pacific, Barracuda

In the past year alone, we’ve witnessed a number of worrying trends threatening businesses in the region, including a huge 64% uptick in the number of ransomware attacks; with 81% of organizations in APAC, Europe, the Middle East, and Africa (EMEA), and the United States (U.S.) reporting having suffered at least one security breach in the last 12 months. Our research also shows that the average organization is targeted by over 700 social engineering attacks each year- and it’s not just CEOs or personnel in financial roles who are being targeted. In fact, 77% of Business Email Compromise (BEC) attacks are targeting lower-level staff across a variety of roles, and why? Because cybercriminals know that even with the strongest security strategy and safeguards in place, the weakest link is usually the human link.

This situation has been exacerbated by the COVID-19 pandemic, which has made remote working the norm for most employees across APAC, seeing IT teams scrambling to roll out solutions to allow employees to access company data and systems from home, balancing usability with risk. Ultimately, however, the risk is increased, as thanks to increased work pressures, stress, isolation, and reliance on home computer systems and networks, employees are more likely to make mistakes and new vulnerabilities arise – potentially opening the door to attackers.

This month is National Cybersecurity Awareness Month (NCSAM), a United States led initiative with global relevance. This year’s theme is “Do Your Part. #BeCyberSmart,” underlining the need for all employees to do what they can in the fight against cybercrime.

To help you and your employees play their part, we have put together some key pointers to ensure your team has the best possible chance of success when it comes to playing an active role in defending your business from cybercrime.

  1. It all starts with training

Your people are your first line of defense against attack, so in these increasingly challenging times, email threat simulation and training are an important first step in turning employees into one of your most effective security assets.

In today’s complicated threat landscape, every employee must be responsible for email security. Just one mistake by one employee, clicking on one link in one email, could result in fraud, a data breach, huge costs, and damage to your company’s reputation.

User security awareness training helps every employee in your organization to recognize, avoid, and report potential threats that can compromise critical data and systems, including phishing, malware, ransomware, and spyware. As part of the training, mock phishing and other attack simulations can be used to test and reinforce good behavior, encouraging a culture of cyber awareness and security best practices across your organization. And while we would always recommend frequent training, we know that this is not possible for every organization. The good news is that even a little goes a long way. We discovered that after just two security awareness training campaigns, the accuracy of user-reported emails increased by 74%. That means users were more likely to spot an actual or simulated email threat, at a much higher rate than prior to completing any training activities, making even the most basic training a valuable step towards securing your business against attack.

  1. Securing your remote workforce

Remote working has created numerous new challenges for businesses across APAC. Ultimately, functionality needs to go hand in hand with security – which has seen many companies struggle to secure the endpoint with a growing range of work and home systems to support. Meanwhile, cyberattacks continue to intensify, being predicted to inflict $6 trillion in damages globally this year.

Establishing strong security policies for employees to follow when working from home is therefore essential. This can include making sure that employees are regularly updating desktop security such as anti-malware, antivirus, and personal firewalls, whilst also making sure they secure network appliances and smart devices. IoT botnet attacks have risen approximately 500% over the past couple of years. These botnets harness millions of routers, and other vulnerable devices which can be used in DDoS, remote command execution, and other attacks. To minimize this risk, employees need to make sure they are using strong passwords for all devices and applications, while also making sure to regularly update device software to protect against new exploits. Likewise, it’s important to ensure that employees are installing and maintaining solutions to protect them from malicious email attacks. Many email systems have some built-in protection, but the best defense is always going to be a security-conscious email user. Making sure they know your policies around reporting threats, can go a long way in keeping your business safe from attack.

  1. Don’t underestimate the power of backup & data protection

As one of your most valuable assets, it’s never been more important to protect your data, so making sure employees are regularly backing up data stored on their desktop, home network devices, or in a cloud application like OneDrive, should be your top priority. After all, it’s a key safety net, which if done correctly, should ensure they don’t lose access to any important data, no matter what happens. Beyond straightforward backup, data protection now includes archiving, off-site replication, encryption, and more, which can all play their part in saving valuable data in the event of hardware failure, human error, natural disaster or in the event of a breach. These days, utilizing the cloud offers a convenient way to help you do this, especially when following the best practice 3-2-1 backup rule: that is, backing up at least three copies, in two different formats, with one copy stored offline. Malware including ransomware often targets backup servers and can spread across logical domains, meaning that it’s vital that organizations have a safe “air-gapped” copy of their data off-site for disaster recovery purposes. This is where the cloud comes in handy, making this process child’s play and the easiest possible way to stay backed-up and protected against all odds.

  1. Taking a Zero Trust approach

While personal accountability and awareness play a significant role in the fight against cybercrime, making sure you are providing your team with the backup firepower they need to win in the fight is an absolute must. This means having a watertight cybersecurity strategy in place with a suite of tools to deliver secure end-to-end access, addressing application, cloud, and network security concerns, whilst protecting data and email. The requirements list is long but should start with a Virtual Private Network (VPN) that funnels traffic through a firewall, VPN concentrator, or remote desktop, which forms the starting point for building a robust Zero Trust roadmap, which is the cornerstone of securing your work-from-home team.

While traditional networks were usually based on a “trust but verify” security model, with the implicit trust of everything within, a Zero Trust model creates an environment of “never trust, always verify”, which in this increasingly complex threat landscape could be your saving grace. In the words of Institute of Electrical and Electronics Engineers (IEEE) Senior member Jack Burbank: “Zero trust is not a single product, nor is it a single approach or technique. It is a mindset, a decision. It is an organization saying, ‘Network security is a priority and then putting resources behind that statement.”

About the Author

James Forbes-May, Vice President, APAC, Barracuda Networks2James Forbes-May is the Vice President for the Asia Pacific region at Barracuda Networks, where he is responsible for the company’s growth and expansion in the core markets such as Japan, China, ANZ, India, and Southeast Asia. James joined Barracuda in 2015 and since then has been pivotal in developing the region.

James has over 30 years of experience in the software industry, where has a track record of building the Asia Pacific region and leading teams, He also has over 15 years of experience in the software storage sector.

James is based out of Barracuda’s APAC headquarters in Hong Kong. Previously: Arcserve, CA, Vision Solutions, Yosemite Software and Seagate Software.

DISCLAIMER

Views expressed in this article are personal. The facts, opinions, and language in the article do not necessarily reflect the views of CISO MAG.

See also: Cybersecurity Awareness Month 2021: Here’s What the Experts Have to Say

North Korea’s Lazarus Group Targets IT Supply Chains with MATA Malware

Cryptocurrency Lazarus, North Korean TA406, Lazarus Group , Korea Atomic Energy Research Institute

Lazarus, a notorious advanced persistent threat (APT) group that needs no introduction in the cyberthreat landscape, strikes again with improved malware variants. The North Korea-backed group is better known for its state-sponsored cyberespionage and attacks extended across the globe. Cybersecurity experts identified the two latest supply-chain attack campaigns from the Lazarus group targeting multiple downstream companies.

According to the Q3 2021 APT Trends report from Kaspersky, the attackers behind the Lazarus group used MATA malware along with Blindingcan and Copperhedge backdoors to attack the defense sector, a software solutions vendor based in Latvia, and a think tank located in South Korea.

Old Malware in a New Campaign

Previously, the Lazarus group leveraged MATA malware to target various e-commerce and IT firms in India, South Korea, Poland, Germany, Turkey, and Japan to distribute ransomware and steal sensitive information.

But in its latest campaign, MATA was used for cyberespionage activities. The threat actors reportedly leveraged a Trojanized version of the malware to execute a multi-staged infection chain beginning with a downloader that deploys additional malware from compromised C2 servers.

MATA possesses several components like loader, orchestrator, and plugins to infect Windows, Linux, and macOS operating systems.

“We were able to acquire several MATA components, including plugins. The MATA malware discovered in this campaign has evolved compared to previous versions and uses a legitimate, stolen certificate to sign some of its components. Through this research, we discovered a stronger connection between MATA and the Lazarus group, including the fact that the downloader malware fetching MATA malware showed ties to TangoDaiwbo, which we had previously attributed to the Lazarus group,” Kaspersky said.

Lazarus Turns to Supply Chain Attacks

The latest malware campaigns from the Lazarus Group represent the group’s growing interest in leveraging trusted IT supply chain vendors as a gateway to corporate networks. The attackers obtained access to a South Korean security software vendor’s network to exploit the corporate software and a Latvia-based IT asset-monitoring product vendor by deploying Blindingcan and Copperhedge backdoors. Earlier, the U.S. Cybersecurity & Infrastructure Security Agency (CISA)  had issued security alerts 1 & 2 — warning about the two malware backdoors.

Supply chain attacks are certainly not new to the security landscape. Several destructive supply chain attacks like SolarWinds and Kaseya caused severe damage to the critical infrastructures and triggered additional threats worldwide.

Why Businesses Should Be Invested in Digital Identity in 2021

digital forensics, cyber forensics, forensics, digital identity

Historically identity has been document-centric, requiring the physical presence of a user and a verifiable, government (or other authority)-issued document. However, as transactional interactions have moved online, digital identity has become increasingly critical to business success. The need for digital identity technology has never been more crucial, with three main catalysts driving growth: digital transformation, cybersecurity, and technological innovation.

By Ubaid Dhiyan, Director at Union Square Advisors

The Age of Digital Transformation

The pandemic forced many organizations to adapt and digitally transform their business to find success in a world where physical and digital identities continue to converge. While physical identities can be traced back for as long as bureaucratic and record-keeping methods have existed, digital identity is a recent construct with much greater fluidity. Digital identity use cases range from providing minimal documentation to requiring exact digital representations of physical documents and biometric verification.

For example, many employees now desire a seamless online experience considering hybrid and virtual work, forcing enterprises to implement a single sign-on feature for their employees. With this single sign-on feature, employees’ identities are identified, authenticated, and then authorized digitally, all in one step, to access a company’s systems.

Another example is the emergence of the consumerization of government. This is the idea that citizens have greater expectations of a consumer-like experience in their interactions with the government, or any other large institution like schools, healthcare providers, or financial institutions. For these users, a consumer-like experience includes a more seamless way of proving their identity through digital means.

The Threat of Cybersecurity Attacks

New cybersecurity vulnerabilities emerged as many organizations raced to digitally transform their businesses, moving online in light of Covid-19. These vulnerabilities became especially clear as we saw a significant rise in cyberattacks. For example, the attack on JBS SA meat supplier and the cyberattack on the Colonial Pipeline. These cyberattacks forced businesses to re-evaluate cybersecurity’s role in their long-term strategies. Identity management plays a key role in improving cybersecurity, and as a result, businesses have begun to turn their attention to identity management best practices.

Identity and access management (IAM) is the process that organizations use to define and manage the roles and access privileges that users and devices have access to via a variety of cloud and company-related applications. As we start to see the executive leadership of companies shift their business priorities and investments towards cybersecurity, it will go hand in hand with an increase in investments in this type of software. 

Technological Innovation

Finally, as innovative technology continues to emerge, there will be an increased demand for evolved digital identity software, similar to how the rise of the Internet caused a newfound demand for digital identities. For example, financial institutions and e-commerce companies continue to innovate payments technology. However, with the progression of payments technology comes the increased risk of fraud. Fraud detection is a primary use case for digital identity proofing. When the need for fraud detection increases as modern payment technology is produced, the demand for digital identity proofing technology increases as well.

These three factors show that the need for digital identity software is not slowing down anytime soon. As digital identities are a key aspect of digital transformation, cybersecurity and the maturation of technology, we fully expect significant activity in the digital identity software market in the years to come.

About the Author

ubaid dhiyanUbaid Dhiyan is a Director at Union Square Advisors. Ubaid is a technologist, engineer, and investment banker with over 18 years of experience working with companies ranging from startups to large publicly traded entities. Prior to joining Union Square, Ubaid was a member of J.P. Morgan’s Technology Investment Banking team based in San Francisco, where he focused on M&A advisory, debt and equity capital raises for Software and IT Infrastructure companies. Prior to J.P. Morgan, Ubaid spent several years at Juniper Networks and Force10 Networks in sales and engineering roles.

Ubaid graduated with an MBA from UC Berkeley’s Haas School of Business with a focus in Finance and Strategy. He received a Master’s in Electrical Engineering from the University of Southern California and a Bachelor’s in Electrical Engineering from the University of Mumbai.

DISCLAIMER

Views expressed in this article are personal. The facts, opinions, and language in the article do not necessarily reflect the views of CISO MAG.

1...424344...409Page 43 of 409