Cyber Defense eMagazine November 2020 Edition
Cyber Defense eMagazine November Edition for 2020 #CDM #CYBERDEFENSEMAG @CyberDefenseMag by @Miliefsky a world-renowned cyber security expert and the Publisher of Cyber Defense Magazine as part of the Cyber Defense Media Group as well as Yan Ross, US Editor-in-Chief, Pieruligi Paganini, Co-founder & International Editor-in-Chief, Stevin Miliefsky, President and many more writers, partners and supporters who make this an awesome publication! Thank you all and to our readers! OSINT ROCKS! #CDM #CDMG #OSINT #CYBERSECURITY #INFOSEC #BEST #PRACTICES #TIPS #TECHNIQUES
Cyber Defense eMagazine November Edition for 2020 #CDM #CYBERDEFENSEMAG @CyberDefenseMag by @Miliefsky a world-renowned cyber security expert and the Publisher of Cyber Defense Magazine as part of the Cyber Defense Media Group as well as Yan Ross, US Editor-in-Chief, Pieruligi Paganini, Co-founder & International Editor-in-Chief, Stevin Miliefsky, President and many more writers, partners and supporters who make this an awesome publication! Thank you all and to our readers! OSINT ROCKS! #CDM #CDMG #OSINT #CYBERSECURITY #INFOSEC #BEST #PRACTICES #TIPS #TECHNIQUES
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
4 Reasons Why <strong>Cyber</strong> Security Is<br />
Important in Your Business<br />
Changing <strong>Cyber</strong>security Culture One Habit<br />
at A Time<br />
Ransomware Is Evolving<br />
Data Migration Security<br />
…and much more…<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 1<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
CONTENTS<br />
Welcome to CDM’s <strong>November</strong> <strong>2020</strong> Issue ---------------------------------------------------------------------------------------- 7<br />
4 Reasons Why <strong>Cyber</strong> Security Is Important in Your Business --------------------------------------------------- 21<br />
By Gabe Nelson, Content Specialist, Bonus.ly<br />
Changing <strong>Cyber</strong>security Culture One Habit at A Time ------------------------------------------------------------- 26<br />
By George Finney, Chief Security Officer for Southern Methodist University and Author of Well Aware:<br />
Master the Nine <strong>Cyber</strong>security Habits to Protect Your Future<br />
In the Midst of the Pandemic, <strong>Cyber</strong>security Professionals Show an Uptick in Job, Salary Satisfaction<br />
Despite High Stress Levels ------------------------------------------------------------------------------------------------ 29<br />
By Samantha Humphries, security strategist, Exabeam<br />
3 Educational <strong>Cyber</strong> Security Steps for The Protection of Your Personal Data ------------------------------ 34<br />
By Ankit Rajpurohit<br />
Why <strong>Cyber</strong>security Awareness is More Important During COVID-19 ------------------------------------------ 39<br />
By Susan Alexandra, Contributing Writer<br />
Ransomware Is Evolving--------------------------------------------------------------------------------------------------- 42<br />
By Jeff Warren, General Manager, Products, Stealthbits Technologies, Inc.<br />
How COVID Tests the Resilience of Your Cloud Data Infrastructure -------------------------------------------- 46<br />
By Noah Johnson, Co-founder & CTO, Dasera<br />
The Impact of Ransomware on Cloud Services and How to Stop Attacks ------------------------------------- 50<br />
By Davit Asatryan, Product Manager, Spin Technology<br />
Perfecting Your <strong>Cyber</strong>security Sales Process ------------------------------------------------------------------------- 53<br />
by Katie Teitler, Senior Analyst, TAG <strong>Cyber</strong><br />
Data Migration Security --------------------------------------------------------------------------------------------------- 58<br />
By Devin Partida, <strong>Cyber</strong>security Writer, ReHack Magazine<br />
Has Your Data Been Leaked to the Dark Web? ---------------------------------------------------------------------- 61<br />
By Randy Reiter CEO of Don’t Be Breached<br />
No Meows Is Good News: Proactive Nosql Database Security in The Era of Meow Attacks ------------- 64<br />
By Jack Harper, Director of Professional Services at Couchbase<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 2<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Takeaway from the SANS Institute Attack: Without Proper Care, “Consent Phishing” Can Happen to<br />
Anyone ------------------------------------------------------------------------------------------------------------------------- 68<br />
By Chloé Messdaghi, VP of Strategy, Point3 Security<br />
Behind the Scenes of AppSec’s Misalignment------------------------------------------------------------------------ 71<br />
By John Worrall, CEO at ZeroNorth<br />
Emotet Attacks Surge in <strong>2020</strong>, but Could Be Prevented ----------------------------------------------------------- 74<br />
By Dan Piazza, Technical Product Manager, Stealthbits Technologies, Inc.<br />
Zero Trust Model Is Meaningless Without TLS Inspection -------------------------------------------------------- 77<br />
By Babur Khan, Technical Marketing Engineer at A10 Networks<br />
Automated Pentesting – Ready to Replace Humans? ------------------------------------------------------------- 81<br />
By Alex Haynes, CISO, CDL<br />
Mitigating the Pitfalls of Onedrive Security -------------------------------------------------------------------------- 84<br />
By Veniamin Simonov, Director of Product Management, at NAKIVO Inc.<br />
Emerging Technologies Create A New Line of <strong>Defense</strong> in The Fight Against Fraud ------------------------ 87<br />
By Brett Beranek, Vice President and General Manager, Security and Biometrics, Nuance Communications<br />
How to Adapt Financial Services to The Online Space Securely – And Still Sleep at Night --------------- 90<br />
By Robert Capps, VP of Marketplace, NuData, a Mastercard Company<br />
<strong>Cyber</strong>security Best Practices for End Users --------------------------------------------------------------------------- 94<br />
By Jay Ryerse, CISSP, Vice President of <strong>Cyber</strong>security Initiatives, ConnectWise<br />
The One-Stop Spear Phishing <strong>Defense</strong> Guide You Will Ever Need ---------------------------------------------- 98<br />
By Jeff Penner, Senior Manager at ActiveCo Technology Management.<br />
The Serverless Security Machine -------------------------------------------------------------------------------------- 102<br />
By Art Sturdevant, Director of Operations, Censys<br />
Unlocking the Promise of Packet Capture -------------------------------------------------------------------------- 105<br />
By Kathryn Ash, President, IPCopper, Inc.<br />
Intelligent Protection Against DNS DDoS Attacks is Critical Part of <strong>Cyber</strong>security Architecture ------ 108<br />
By Ashraf Sheet, Regional Director, Middle East & Africa at Infoblox<br />
NCSAM Provided an Opportunity to Reset Our Approach to <strong>Cyber</strong>security -------------------------------- 111<br />
By Sam Humphries, Security Strategist, Exabeam<br />
How Blockchain Is Helping Stop the Spread of COVID-19 ------------------------------------------------------- 116<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 3<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
By Robert Galarza, CEO, TruTrace Technologies<br />
Patched Minimizes Risk - But Opens the Door for Compatibility Problems -------------------------------- 119<br />
By Egon Rinderer, Global Vice President of Technology & Federal CTO, Tanium<br />
For Federal Agencies, Securing Internet of Things Devices Is A Growing Challenge --------------------- 123<br />
By Katherine Gronberg, Vice President of Government Affairs, Forescout<br />
Nations—Not Individuals—Are After Your IP ---------------------------------------------------------------------- 126<br />
By Ryan Benner, Anexinet<br />
Video Intercom Systems Reinvent Building Security ------------------------------------------------------------- 130<br />
By Melvin Braide, Content Writer<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 4<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
@MILIEFSKY<br />
From the<br />
Publisher…<br />
New <strong>Cyber</strong><strong>Defense</strong>Magazine.com website, plus updates at <strong>Cyber</strong><strong>Defense</strong>TV.com & <strong>Cyber</strong><strong>Defense</strong>Radio.com<br />
Dear Friends,<br />
Viewing, as I do on a regular basis, both public reports and other resources on developing trends in cybersecurity,<br />
I see continued focus on the effects of and responses related to COVID-19.<br />
I’d like to reiterate my observation from last month: “As the months go by with no apparent resolution of the<br />
COVID-19 impact on business, employment, and our economy in general, the importance of cybersecurity<br />
continues to grow in every sector.”<br />
As demonstrated by the articles we publish in <strong>Cyber</strong> <strong>Defense</strong> Magazine for <strong>November</strong>, the authors and their<br />
organizations continue to address cybersecurity implications at all levels.<br />
In the main, this is good news for our readers, as we are fortunate to receive for publication the best thinking and<br />
guidance from the best cybersecurity professionals in the field today. The effects of COVID-19 on nearly all<br />
enterprises which depend on cyberspace for their operations are growing. The actionable intelligence <strong>Cyber</strong><br />
<strong>Defense</strong> Magazine provides is the first and best means of meeting these challenges.<br />
On that note, we are looking for infosec innovators who are one step ahead of the next threat, so we’ve opened<br />
up our 9 th annual Global InfoSec Awards for 2021, this month. Nominations at www.cyberdefenseawards.com.<br />
In addition to the relevant articles in the <strong>November</strong> issue, we are pleased to continue providing the powerful<br />
combination of monthly <strong>eMagazine</strong>s, daily updates, and features on the <strong>Cyber</strong> <strong>Defense</strong> Magazine home page, and<br />
webinars featuring national and international experts on topics of current interest.<br />
Warmest regards,<br />
Gary S. Miliefsky<br />
Gary S.Miliefsky, CISSP®, fmDHS<br />
CEO, <strong>Cyber</strong> <strong>Defense</strong> Media Group<br />
Publisher, <strong>Cyber</strong> <strong>Defense</strong> Magazine<br />
P.S. When you share a story or an article or information about<br />
CDM, please use #CDM and @<strong>Cyber</strong><strong>Defense</strong>Mag and<br />
@Miliefsky – it helps spread the word about our free resources<br />
even more quickly<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 5<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
@CYBERDEFENSEMAG<br />
CYBER DEFENSE eMAGAZINE<br />
Published monthly by the team at <strong>Cyber</strong> <strong>Defense</strong> Media Group and<br />
distributed electronically via opt-in Email, HTML, PDF and Online<br />
Flipbook formats.<br />
PRESIDENT & CO-FOUNDER<br />
Stevin Miliefsky<br />
stevinv@cyberdefensemagazine.com<br />
InfoSec Knowledge is Power. We will<br />
always strive to provide the latest, most<br />
up to date FREE InfoSec information.<br />
From the International<br />
Editor-in-Chief…<br />
From the international perspective, we can see growth and<br />
deepening of the challenges we face in this time of the novel<br />
Coronavirus.<br />
Although there do not appear to be reliable statistics on the<br />
correlation between national reports on newly diagnosed COVID-<br />
19 cases and the adverse influence on the economic sector,<br />
common sense tells us that such a relationship must exist.<br />
Social distancing and isolation, whether voluntary or mandated,<br />
continue to impact both financial and emotional wellbeing of<br />
national and international populations.<br />
In that context, we can but hope that in our world of cybersecurity<br />
and privacy, there may be room for both national and global<br />
interests.<br />
While we don’t formally take positions for or against individual<br />
national policies, we can only encourage cooperation and<br />
compatibility among nations on cybersecurity and privacy matters.<br />
Let me re-post my query from last month: “Hypothetically: What if<br />
there were a vaccine against cyber exploits? Would it be shared<br />
among nations? Could our hope for positive results overcome our<br />
fear of national competitive disadvantage?”<br />
I’d still like to think so.<br />
To our faithful readers, we thank you,<br />
Pierluigi Paganini<br />
International Editor-in-Chief<br />
INTERNATIONAL EDITOR-IN-CHIEF & CO-FOUNDER<br />
Pierluigi Paganini, CEH<br />
Pierluigi.paganini@cyberdefensemagazine.com<br />
US EDITOR-IN-CHIEF<br />
Yan Ross, JD<br />
Yan.Ross@cyberdefensemediagroup.com<br />
ADVERTISING<br />
Marketing Team<br />
marketing@cyberdefensemagazine.com<br />
CONTACT US:<br />
<strong>Cyber</strong> <strong>Defense</strong> Magazine<br />
Toll Free: 1-833-844-9468<br />
International: +1-603-280-4451<br />
SKYPE: cyber.defense<br />
http://www.cyberdefensemagazine.com<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine, a division of<br />
CYBER DEFENSE MEDIA GROUP (a Steven G. Samuels LLC d/b/a)<br />
276 Fifth Avenue, Suite 704, New York, NY 10001<br />
EIN: 454-18-8465, DUNS# 078358935.<br />
All rights reserved worldwide.<br />
PUBLISHER<br />
Gary S. Miliefsky, CISSP®<br />
Learn more about our founder & publisher at:<br />
http://www.cyberdefensemagazine.com/about-our-founder/<br />
8 YEARS OF EXCELLENCE!<br />
Providing free information, best practices, tips and<br />
techniques on cybersecurity since 2012, <strong>Cyber</strong> <strong>Defense</strong><br />
magazine is your go-to-source for Information Security.<br />
We’re a proud division of <strong>Cyber</strong> <strong>Defense</strong> Media Group:<br />
CYBERDEFENSEMEDIAGROUP.COM<br />
MAGAZINE TV RADIO AWARDS<br />
WEBINARS<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 6<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Welcome to CDM’s <strong>November</strong> <strong>2020</strong> Issue<br />
From the U.S. Editor-in-Chief<br />
In receiving and reviewing the article submissions from over 30 authors for the <strong>November</strong> edition<br />
of <strong>Cyber</strong> <strong>Defense</strong> Magazine, I am struck by the thoughtful and actionable information provided<br />
by our contributors. They represent a broad range of professionals, from CISOs, to providers of<br />
cybersecurity products and services, to commenters from other media. They do enjoy in<br />
common a passion and willingness to share their knowledge and wisdom, all to our mutual<br />
benefit.<br />
To be sure, it’s not getting any easier. There are no cure-all solutions for the current challenges<br />
of social distancing and isolation we are experiencing in the world of business, government, and<br />
even personal use of cyber facilities.<br />
My work in cybersecurity is grounded in my continuing study and writing on risk management.<br />
Of particular note is the need to make informed decisions on the scope of risks to retain and<br />
those to be laid off on others, such as through insurance and related resources. In that context,<br />
I see the range of articles in the <strong>November</strong> issue as providing valuable information on meeting<br />
the threats and risks we all face during this time of the COVID-19 pandemic.<br />
May I commend your review of the Table of Contents first, so you can prioritize reading the<br />
articles which most closely pertain to your own cybersecurity concerns. (I make this suggestion<br />
with full confidence that all of the articles have value to all of our readers, just to differing<br />
degrees.)<br />
With that introduction, we are pleased to present the <strong>November</strong> <strong>2020</strong> issue of <strong>Cyber</strong> <strong>Defense</strong><br />
Magazine.<br />
Wishing you all success in your cyber security endeavors,<br />
Yan Ross<br />
US Editor-in-Chief<br />
<strong>Cyber</strong> <strong>Defense</strong> Magazine<br />
About the US Editor-in-Chief<br />
Yan Ross, J.D., is a <strong>Cyber</strong>security Journalist & US Editor-in-Chief for<br />
<strong>Cyber</strong> <strong>Defense</strong> Magazine. He is an accredited author and educator and<br />
has provided editorial services for award-winning best-selling books on<br />
a variety of topics. He also serves as ICFE's Director of Special Projects,<br />
and the author of the Certified Identity Theft Risk Management Specialist<br />
® XV CITRMS® course. As an accredited educator for over 20 years,<br />
Yan addresses risk management in the areas of identity theft, privacy,<br />
and cyber security for consumers and organizations holding sensitive personal information. You can<br />
reach him via his e-mail address at yan.ross@cyberdefensemediagroup.com<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 7<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 8<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 9<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 10<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 11<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 12<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 13<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 14<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 15<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 16<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 17<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 18<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 19<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 20<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
4 Reasons Why <strong>Cyber</strong> Security Is Important in Your<br />
Business<br />
By Gabe Nelson, Content Specialist, Bonus.ly<br />
<strong>Cyber</strong>-attacks are incredibly common and anyone can fall victim to them. <strong>Cyber</strong>-attacks can cause<br />
electrical blackouts, failure of military equipment, and breaches of national security secrets. Entire cities<br />
have been hacked and personal information is used maliciously.<br />
While those might seem large-scale and unlikely to occur in your business understanding that no<br />
computer or internet account is immune to the potential cyber-attack is key to having great cyber security.<br />
Even small businesses run the risk of having valuable information stolen. <strong>Cyber</strong>-attacks are so common<br />
it’s not a matter of if a data breach will happen but when because modern businesses rely heavily on<br />
technology.<br />
Smaller businesses are often easier targets for cyber-attacks because they lack the resources to set up<br />
adequate cyber security. Don't let your business run the risk of being attacked; setting up a good defense<br />
with cyber security is more important than ever. This can be ensured by hiring certified IT professionals<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 21<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
who can be found using this State of It Jobs Map. Here are some reasons why cyber security is important<br />
in your business:<br />
1. <strong>Cyber</strong>-attacks Affect Everyone<br />
Anytime your personal data can be taken by someone who is unauthorized to have it is considered a<br />
cyber-attack. Data breaches are incredibly commonplace, which is why having adequate password<br />
strength is crucial as a consumer. As a business owner, your customers and patrons trust you with their<br />
information.<br />
It’s not safe to assume you’re fine and no one would want to steal your business’ information. If you are<br />
thinking about your business in terms of longevity, you want to stay on top of the cyber security trends<br />
and protect the information.<br />
As a business owner, the topic of cyber security might seem overwhelming and complex. However, a<br />
basic understanding of technology is considered essential for running a business in today's world. It’s<br />
also important that you are diligent in hiring certified IT professionals; especially if you have any kind of<br />
online presence.<br />
<strong>Cyber</strong>-attacks can be launched through email text messaging and voice phishing. And what may be even<br />
worse, a reputational attack can be launched. This is where individuals post negative information on<br />
social media websites and blog posts to harm your business’s reputation and brand image.<br />
<strong>Cyber</strong>-attacks in security breaches can cause millions of dollars in damage to recover data and penalties<br />
that need to be paid. All of these expenses can cause even large businesses to go under. Being prepared<br />
with excellent cyber security could be the reason your business stays solvent. Protecting your financial<br />
information allows your business to keep going forward.<br />
<strong>Cyber</strong>-attacks cause downtime with businesses, meaning time spent where you will not be able to run<br />
your business at all. The downtime your company endures could be hours, even days. The monetary<br />
cost of each and operable hour might be devastating to your business.<br />
Arming your business with cyber security not only protects your customer's information but also allows<br />
your business to keep running as usual without interruption. What might seem harmless such as an<br />
employee clicking a link in an email could open the doors to a complex cyber security attack disguised<br />
as a bank notification.<br />
Damages could include not only financial ramifications but also the possibility of job loss for employees.<br />
If you want your business to succeed you need to be aware of cyber security issues. Unfortunately,<br />
danger is literally lurking in every email unless you know what to look for. Don't let your business be at<br />
risk for failure, stay on top of your cyber security.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 22<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
2. Reassure Your Customers<br />
Your business reputation depends on you staying on top of cyber security. Your customers put their trust<br />
in your business, and that you will keep their private information safe. To lose that trust could be<br />
devastating for your company moving forward.<br />
You need to reassure your customers that you are doing everything in your control to combat cyberattacks.<br />
You may not be able to prevent cyber-attacks completely, but you can protect yourself from the<br />
disastrous legal and public relations consequences of a data breach.<br />
Staying on top of security updates is an easy way to prevent cyber-attacks. Many security hacks exploit<br />
known holes in systems. <strong>Cyber</strong> security companies are often making updates in order to increase<br />
security. But if you delay updates or even postpone them you leave yourself vulnerable to a cyber-attack.<br />
Making cyber security a priority for your business is a smart move. You can reassure your customers that<br />
you are doing everything in your power to keep their information safe and stay in business long term.<br />
3. Security May Not Keep Up with Technology<br />
There’s one thing for certain, technology<br />
is updating frequently. And with a<br />
change in applications, programs, and<br />
even 5G capabilities comes changes in<br />
how cyber security works. You need to<br />
be sure that you’re following<br />
recommendations and updating your<br />
protections as you add new technology<br />
to your business.<br />
One way to limit cyber security issues is<br />
to limit which employees can access<br />
information. Most cyber-attacks are just<br />
waiting for someone to slip up and make<br />
an error. Limiting the number of people who can access data and information can help, but it probably<br />
isn’t enough to prevent cyber-attacks altogether.<br />
Because technology changes quickly malicious individuals are finding new and unique ways to attack.<br />
Hackers can now utilize artificial intelligence to trigger automated cyber-attacks when they find an<br />
opportunity to do so. Taking the time to educate your employees about cyber-attacks and your<br />
companies’ risk is only the first step.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 23<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
The world is moving into using cloud computing more and storing personal information not on their<br />
computers but in internet databases. This gives hackers more potential hacking options.<br />
The increase in cyber vulnerabilities is not just limited to software and emails. Don’t trust cloud storage<br />
alone to keep information safe.<br />
If your business is updating its technology your cyber security options should also be updating. Do not<br />
let your cyber security lapse or become an afterthought especially if you're storing customer information<br />
or data. Even if your business isn’t utilizing the latest technology, the hackers certainly are.<br />
4. <strong>Cyber</strong> Issues May Lead to More Legislation<br />
Because cyber-crimes are getting more attention, legislators have stepped in to demand public<br />
disclosure. There are national guidelines from the Federal Trade Commission that can help you respond<br />
to a data breach. Plus, many states have their own laws that businesses have to follow.<br />
Keep your business away from the risk of both data breaches and the consequences that could result.<br />
Being forced to disclose a data breach could open you up to lawsuits and other fines which could damage<br />
your business beyond recovery.<br />
Certainly harsher penalties should be placed on perpetrators of attack but that's simply the first step.<br />
Being sure to stay on top of any laws passed as a business owner and following cyber security<br />
recommendations can help protect your business from any negative fallout from a cyber-attack.<br />
A Final Thought<br />
The good news is that with vigilance, many<br />
attacks can be avoided. Businesses are<br />
vulnerable to cyber-attacks but preparedness<br />
can help prevent them. Staying on top of security<br />
updates and making sure you’re aware of the<br />
technologies your business uses and that they’re<br />
adequately protected is a great start to keeping<br />
attacks at bay.<br />
<strong>Cyber</strong> security will never stop being important; in<br />
fact, it will likely become more important every<br />
year. Keep your business strong and your customer’s information safe when you take cyber security<br />
seriously.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 24<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Gabe Nelson is a content specialist of over 7 years of experience,<br />
currently working with Bonus.ly. Bonus.ly is a company that helps with<br />
employee recognition to bring teams together. Just out of high school<br />
he set off crab fishing on the Bering Sea in Alaska. From there he went<br />
back home to finish his college degree at the University of Montana. He<br />
has a passion and keen understanding when it comes to Employee<br />
Relations inside and out. He has written hundreds of content pieces in<br />
numerous niches. Currently, he lives in Missouri with his wife and kids.<br />
Gabe can be reached online at:<br />
https://twitter.com/GabeBNelson<br />
https://www.linkedin.com/in/gabrielnelson87/<br />
and at our company website https://bonus.ly/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 25<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Changing <strong>Cyber</strong>security Culture One Habit at A Time<br />
By George Finney, Chief Security Officer for Southern Methodist University and Author of<br />
Well Aware: Master the Nine <strong>Cyber</strong>security Habits to Protect Your Future<br />
My first job out of college was at a call center doing tech support for an Internet Service Provider. This<br />
was a long time ago, but one of the first things I learned were the phrases “ID10T Error” and “PEBKAC”.<br />
Both were jabs at the sometimes-frustrating customers who would do weird things like use their CD tray<br />
as a cup holder. We still use these acronyms today and have built them into our culture as though they<br />
were a motto.<br />
In cybersecurity, everyone knows our secret motto:” people are the weakest link.” We say this even<br />
though it’s totally wrong. People aren’t the weakest link. As Lance Spitzner of the SANS Institute says,<br />
“People aren’t the weakest link, they are the largest attack surface.” And this way of thinking is making<br />
us less secure.<br />
In the 1960s, Lenore Jacobson conducted an experiment. Jacobson was an elementary school principal,<br />
and she had just read an study by psychologist Dr. Robert Rosenthal about how expectations can lead<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 26<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
to higher performance. So she set out to give all the students in her elementary school an IQ test. Then<br />
she shared this information with the teachers. But she lied to the teachers about the students’ scores.<br />
The students that she said had the highest test scores were actually the lowest and vice versa.<br />
At the end of the school year the students were tested again. The students that the teachers believed to<br />
have the highest scores in the beginning made significantly more improvement than the students the<br />
teachers believed to have the lowest scores. What mattered more than students innate intellectual ability<br />
was the teacher’s belief that the students were “intellectual bloomers”.<br />
If we in the cybersecurity community believe that people are the weakest link and always will be, then<br />
our belief will ensure that this comes true. But what if we believed something different?<br />
When I came into my role as a CISO, I did a monthly report to my executive team with lots of dashboards.<br />
I was constantly searching for metrics that should show how effective our security program was. There<br />
are lots of metrics you can report on, like the total volume of attacks, that are helpful to understand the<br />
scope of the problem, but don’t reflect how good a job your team is doing. A large volume of attacks<br />
doesn’t mean you aren’t good at your job, it just means that you are a large target.<br />
We began sending simulated phishing messages to our users in 2014, and I started reporting on the<br />
number of users that clicked on the phishing links. Over time this number went down, but I realized that<br />
this metric didn’t tell the whole story. Focusing on how low the percentage got focused on the negative<br />
aspects of my campaign and distracted from the positive. Instead of saying that we reduced our click<br />
through rate down to 3%, I started saying that we increased our phishing recognition rate to 97%.<br />
For me, this was a big change. Instead of normalizing bad behavior, I started sending the message that<br />
the vast majority of our community was highly effective at recognizing phishing.<br />
This approach was, for lack of a better term, infectious. In my security awareness newsletters, I began<br />
using images that are of people, not random pictures of technology, to reinforce the message that people<br />
are the ones we’re protecting. I began telling stories of how people were impacted by security incidents,<br />
and more importantly how they responded. I wanted to show my community how to improve rather than<br />
constantly telling them to improve.<br />
But all this required that I let go of the belief that people are the problem and I had to start believing that<br />
they were the solution. And one of the ways that I’ve changed my security program is to embrace what I<br />
call “fearless learning”. When someone makes a mistake, whether or not they can learn from that<br />
mistakes comes down to whether they’re afraid of changing afterwards. If they feel like they could me<br />
made a scapegoat and be fired means, from a neuroscience perspective, that their cognitive capacity will<br />
be reduced. We see this degradation of mental capacity effect in all kinds of stressful situations.<br />
When a user clicks on a phishing message, I never report this information to anyone. I’ve gotten requests<br />
from people who want to use this information to discipline employees. I’ve resisted this at all costs<br />
because I want to create a culture where users have a safe environment to learn and practice before<br />
there is an incident. I do this because I believe that they can change their habits. And I’ve seen that this<br />
is possible.<br />
Stanford Professor BJ Fogg believes the reason we fail at changing things in our lives is because we<br />
start big. In his book, Tiny Habits, he describes habits as a rope with hundreds of knots. If you go for the<br />
largest knot to unravel, you will fail. But if you loosen an easy knot, you will be able to work your way up<br />
to the bigger challenges. And with each small knot, you build your own skill at mastering change.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 27<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Changing our cybersecurity cultures may seem like an insurmountable problem, but it’s not. We can start,<br />
not just small, but tiny. We need to make it incredibly easy to get started. We need to celebrate even the<br />
smallest successes rather than condemning mistakes. And over time, we can start to build momentum.<br />
As I’ve researched the habits we use in cybersecurity, I distilled all of the advice and training we give to<br />
people down to nine distinct categories of habits. The habits are: Literacy, Skepticism, Vigilance, Secrecy,<br />
Culture, Diligence, Community, Mirroring, and Deception.<br />
The nine cybersecurity habits are what Fogg calls constellations of tiny habits. Changing works best when<br />
you focus on related habits all at the same time. If you miss a habit for a day because you went on<br />
vacation, that’s ok. If you only do the minimum, you still celebrate because you’re building a lasting habit.<br />
And you get the satisfaction of knowing that you’re not just protecting yourself, but you’re protecting those<br />
around you as well.<br />
Can making tiny changes really change the whole culture of an entire organization?<br />
To be successful, we need to start small. We don’t need to change everyone all at once. But to start, we<br />
do need a small committed group of people to be our vanguard. These will create a tipping point to<br />
change our culture. According to Dr. Damon Centola at the University of Pennsylvania, the tipping point<br />
for creating large scale change is only around 25% of the population of a group.<br />
25% is still a large number, but we don’t need to start big. We can start by working with 10 people to<br />
teach them how to change their cybersecurity habits. And if we deputize them to be cybersecurity habit<br />
evangelists, each of them can teach 10 more. But it starts with believing people are the solution to our<br />
cybersecurity challenges.<br />
Changing culture won’t happen overnight. But it will happen if we change one habit at a time.<br />
About the Author<br />
George Finney is a CISO, author, speaker, professor, and consultant who<br />
believes that people are the key to solving our cybersecurity challenges. He<br />
has worked in cybersecurity for nearly 20 years and has helped startups,<br />
global telecommunications firms, and nonprofits improve their security<br />
posture. As a part of his passion for education, George has taught<br />
cybersecurity at Southern Methodist University and is the author of Well<br />
Aware: Master the Nine <strong>Cyber</strong>security Habits to Protect Your Future. George<br />
has been recognized by Security Magazine as one of their top cybersecurity<br />
leaders in 2018 and is a part of the Texas CISO Council.<br />
George can be reached via LinkedIn, Twitter @wellawaresecure, and on his<br />
website where you can find more information about the nine cybersecurity<br />
habits http://www.wellawaresecurity.com/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 28<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
In the Midst of the Pandemic, <strong>Cyber</strong>security<br />
Professionals Show an Uptick in Job, Salary Satisfaction<br />
Despite High Stress Levels<br />
By Samantha Humphries, security strategist, Exabeam<br />
Interested in a career in cybersecurity -- or are you wondering what your peers in the space are thinking?<br />
Exabeam’s <strong>2020</strong> <strong>Cyber</strong>security Professionals Salary, Skills and Stress Survey, compiled from a survey<br />
of 351 international security professionals has revealed some interesting findings:<br />
● <strong>Cyber</strong>security professionals are satisfied and secure in their jobs despite high-stress levels<br />
● Ongoing education and automation are opportunities for positive change<br />
● Diversity is still low, but moving in the right direction<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 29<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Fifty-three percent of participants reported they felt their jobs were “stressful” or “very stressful.” Further<br />
analysis results reveal that professionals in medium businesses with 251-500 employees are more<br />
stressed than their peers in smaller and large enterprises. Based on respondents’ titles, SOC content<br />
creation engineers and security engineers reported the highest stress (at 80% and 75%, respectively). In<br />
terms of the type of work, participants with packet analysis and penetration testing responsibilities<br />
reported the highest stress (57% and 58%, respectively). And respondents in Australia cited the lowest<br />
stress levels compared to their peers in the U.S., Australia, Singapore, and Germany.<br />
Yet, despite the high levels of stress, an overwhelming majority (96%) of cybersecurity professionals<br />
stated they were happy with their role and responsibilities, and 89% reported being secure or very secure<br />
in their careers. Seventy-seven percent cited a positive work/life balance.<br />
Respondents were also satisfied with their salaries. Eighty-seven percent of respondents reported they<br />
are pleased with their wages and earnings. Salary satisfaction was generally similar, regardless of<br />
gender, industry, company size, or title. The one notable difference was a lower salary satisfaction<br />
reported by respondents without a college degree.<br />
Figure 1: Eighty-seven percent of cybersecurity professionals report satisfaction with their current<br />
salaries.<br />
The paradox between high job stress and high job satisfaction could be related to the inherent nature of<br />
cybersecurity itself. <strong>Cyber</strong>security is just hard work. Security professionals accept and embrace this<br />
reality.<br />
Senior managers should be aware of their staff’s stress level and proactively reach out to their teams.<br />
Fifty-four percent of respondents reported that frequently communicating with their managers about their<br />
objectives is a primary method for managing heavy workloads. Managers should be empathetic in their<br />
endeavor to understand and address factors contributing to their employees’ high-stress levels.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 30<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Senior leaders: Use ongoing education and automation as career levers for your team<br />
Senior leaders should also take an active interest in their team’s career paths, including their ongoing<br />
education. Investing in training would help employees develop advanced skills, open up new job<br />
opportunities, and enable organizations to deal more effectively with new, emerging threats.<br />
Many cybersecurity professionals are highly educated and value learning. Sixty-six percent cited being<br />
self-educated. Ninety-six percent of respondents have a degree or have completed some college. Of<br />
those with a degree, 43% hold a master’s degree. Regarding ongoing learning, 34% are participating in<br />
continuing education, with 33% using their funds.<br />
Figure 2: A significant number of security staff fund their own education leaving an opportunity for<br />
employers to add training as a benefit.<br />
Education and training are also critical, given the increase and importance of automation in cybersecurity.<br />
Eighty-eight percent of respondents believe automation would make their jobs easier. Forty percent are<br />
currently using artificial intelligence and machine learning. Eighty-six percent believe SOAR technology<br />
can help security analysts and SOCs improve SOC response times.<br />
Despite the use of automation and the view that it simplifies cybersecurity work, 47% of respondents also<br />
believe it’s a threat to their jobs.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 31<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Figure 3: Forty-seven percent of respondents view automation including AI and machine learning as a<br />
threat to job security.<br />
Security leaders should reassure staff members that automation improves productivity and outcomes<br />
rather than eliminate jobs. Leaders can discuss how automation provides security professionals with an<br />
opportunity to transition from lower-valued activities to other high profile, strategic projects. Senior<br />
security leaders may also consider partnering with their IT peers to share automation best practices<br />
further to alleviate concerns.<br />
Diversity is still low, but remote work provides an opportunity to accelerate change.<br />
Last year, our survey highlighted the lack of diversity in the cybersecurity profession. This year, there’s<br />
been some progress as 21% of respondents self-identified as women. However, our survey also revealed<br />
that women in most countries are paid less than their male counterparts.<br />
As remote work continues to take hold in most organizations, senior managers have an opportunity to<br />
diversify their workforce further by recruiting talent from anywhere in the world. A diverse team can bring<br />
creativity and new out-of-the-box ideas to cybersecurity. Studies have shown that diversity is a<br />
competitive advantage. Another related study found diverse groups make better decisions 87% of the<br />
time. In particular, women carry a high level of emotional IQ and empathy, which aids in facilitating team<br />
collaboration. To protect users within an organization, cybersecurity teams should reflect a broader, more<br />
diverse workforce to address threats that are continually changing. Fresh ideas, better teaming, and new<br />
cybersecurity approaches will yield positive results for the business and professionals.<br />
Download the full <strong>2020</strong> <strong>Cyber</strong>security Professionals Salary, Skills and Stress Survey report for further<br />
insights from your peers.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 32<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Samantha Humphries has 20 years of experience in<br />
cybersecurity, and during this time has held a plethora of<br />
roles, one of her favourite titles being Global Threat<br />
Response Manager, which definitely sounds more glamorous<br />
than it was in reality. She has defined strategy for multiple<br />
security products and technologies, helped hundreds of<br />
organizations of all shapes, sizes, and geographies recover<br />
and learn from cyberattacks, and trained many people on<br />
security concepts and solutions. In her current role at<br />
Exabeam, she has responsibility for EMEA, data lake,<br />
compliance, and all things related to cloud. Samantha authors<br />
articles for various security publications, and is a regular<br />
speaker and volunteer at industry events, including BSides,<br />
IPExpo, <strong>Cyber</strong>SecurityX, The Diana Initiative, and Blue Team Village (DEF CON).<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 33<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
3 Educational <strong>Cyber</strong> Security Steps for The Protection of<br />
Your Personal Data<br />
By Ankit Rajpurohit<br />
1. Data protection on the Internet<br />
Our data is collected, stored, analyzed, sold, and exchanged like never before. And we should not forget<br />
that they are often stolen and abused.<br />
Data has become a "currency" for many digital services that we receive "for free. Instead of currencies,<br />
people pay by sharing their data across countless applications. This trend of data as currency concerns<br />
every part of our lives - networked homes, connected cars, health and fitness management, map and<br />
traffic tools, online shopping. Consumers do not trust companies in terms of their data, but they do not<br />
know what to do about it.<br />
Given the numerous excesses and cases of data leaks that filled the headlines, our position is that you<br />
need to start an open conversation with your consumers about how you use and protect their data.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 34<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
That almost always triggers a bigger debate. How do we do that? What about data and privacy? How do<br />
we strike a balance between openness and sharing too much information?<br />
For many brands, this may be the first situation in which they will have to work deeply on reputation and<br />
crises or problems. Companies may witness fans of their brand turn into "techruptors" - a pioneering<br />
audience that research shows will be at the forefront of the demand for change in the way companies<br />
operate and treat them. So we advise you to be proactive, inform yourself and prepare for the coming<br />
changes, and thus increase the chances of keeping the "techruptors" as your allies and fans.<br />
2. Misuse of personal data on the Internet<br />
The expansion of social networks also has a "dark side" - there is a noticeable increase in criminal<br />
activities aimed at users. We are witnessing a qualitative and quantitative expansion of social networks.<br />
This expansion, however, also has a "dark side" - there is a noticeable increase in criminal activities<br />
directed at users.<br />
Privacy is the cancer-wound of online social networking. Although it is not possible to say that all services<br />
on the Internet put privacy at the forefront, in social networks, privacy is most drastically, most concretely,<br />
and most often violated. Users themselves post personal information, data, and material that belongs to<br />
the private domain, and then share it with other users. In this way, they unknowingly and directly provide<br />
an opportunity for their data to be misused.<br />
The user's privacy is violated by the very publication of any information on the social website because it<br />
automatically belongs to the company and remains stored on its servers even when the user closes the<br />
account.<br />
By accepting strangers as friends on social networks, the user risks that his data, which he shares only<br />
with friends, will be used for various purposes. Private data such as e-mail addresses can reach spam<br />
lists so that the user receives e-mail of his own free will, which is usually of a commercial or propaganda<br />
nature. Visiting suspicious links on social<br />
networks, for example, puts the user at risk of<br />
becoming infected with "harmful" software,<br />
exposing the data to the public, and becoming<br />
a subject of fake multimedia content.<br />
Bearing in mind that most, if not all social<br />
networks are based on economic business<br />
principles, the technical platform of social<br />
networks is designed to collect from users the<br />
data necessary to meet and communicate with<br />
others, but also data that are segmented and<br />
used in filtering. marketing purposes.<br />
It is noticeable that personal data from social<br />
networks are used to realize the initial stages<br />
of a certain criminal activity, while the sequel is<br />
realized classically, in the real world.<br />
In this context, social networks are used to find collaborators and perpetrators of criminal activity, to<br />
recruit victims to prepare the crime, to gather relevant information, to assist in carrying out certain<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 35<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
activities, to provide funds and the like. With the advent of social networks and the spread of electronic<br />
transaction services, criminals have, so to speak, begun not only to innovate methods for committing<br />
fraud but also to automate personal data collection techniques to make as much money as possible.<br />
<strong>Cyber</strong>criminals use social engineering and phishing techniques to access the victim's personal<br />
information. In this way, victims can suffer significant financial losses or, in more serious cases, even the<br />
loss of "electronic identity", which is used for criminal purposes. The damage caused by data theft,<br />
therefore, should not be expressed only in financial loss but also in the loss of psychological integrity of<br />
personality, reputation, and credibility.<br />
Users of social networks, due to the lack of education regarding the dangers to which they are exposed,<br />
recklessly leave information and multimedia content on their profiles that can be misused by differently<br />
motivated Internet users. In addition to being at risk of violating personal privacy and abusing private<br />
content, users are at risk of political or ideological manipulation.<br />
The information posted on a social network can be misused by a criminal. Users, unaware of the dangers,<br />
leave information about their residential address, telephone numbers, information on whether they live<br />
alone or in a community, etc.<br />
3. How to get more secure codes<br />
When we think about the privacy of our data, the first thing that comes to mind should be the password.<br />
Why? Because, in essence, the classic symmetric encryption is reduced to the code that the user enters<br />
and the data to which that code is applied using a certain algorithm a finite number of times. Let's look at<br />
where we rely on codes today to protect ourselves from attackers and preserve privacy. First, we all use<br />
email, then social networks, maybe we are active on forums or use one of the cloud storage services,<br />
there is also access to our computer or phone, wireless (Wi-fi) network to which we are connected, et<br />
cetera. The list can be tediously long, and you have to take care of all these codes to access a particular<br />
account.<br />
The Internet user has more than 10 different accounts, that number of exact codes is not easy to<br />
remember, and it can be especially difficult to remember which code is for which account. To make<br />
everyday life easier for the average user, there are password managers in the cyber world.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 36<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
More importantly, there are those among them who are open source. Password managers, like Keeper<br />
Password Managers, will generate a random password/phrase of the desired length and security for your<br />
account, storing it in an encrypted database with other accounts. The database of all your accounts is<br />
encrypted with one code that you must remember. The advantage of the Keeper Password Manager,<br />
which you can read more about here, is that you remember one password instead of each account<br />
separately. There are also network password managers who synchronize the encrypted password<br />
database with a network server. That way, if you lose your device where you kept the passwords, you<br />
can still access your passwords stored on the server. Redundancy of all your ciphers is really necessary,<br />
especially if you are not good at remembering ciphers. How you generate and where you store the codes<br />
is definitely up to you.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 37<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Using secure passwords is not difficult, and programs like password managers make it as easy as<br />
possible. It’s definitely worth a little effort around your ciphers, not because we’re hiding something, but<br />
so we don’t get a headache when some hacker breaks in.<br />
About the Author<br />
Ankit Rajpurohit is a tech lover and enthusiast who prefers to<br />
write about security steps, internet protection, and how to prevent<br />
your devices from hackers and potential harm. His main goal is<br />
to help people, through his articles, to upgrade their online<br />
protection.”<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 38<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Why <strong>Cyber</strong>security Awareness is More Important During<br />
COVID-19<br />
Do you know the need for cybersecurity training for your organization? If not, learn more about the<br />
importance!<br />
By Susan Alexandra, Contributing Writer<br />
<strong>Cyber</strong>-attacks, malicious activity, and phishing scams have significantly increased during this pandemic<br />
of COVID-19. With that, it has highlighted the importance of cybersecurity more than ever before. There<br />
have been reports of hackers and cybercriminals exploiting the pandemic with fake websites, money<br />
scams, and emails being phishing scams.<br />
So, we thought of spreading awareness about cybersecurity. That being said, here are some areas for<br />
you to consider within your personal and organizational cybersecurity.<br />
Phishing and the COVID-19 Pandemic<br />
As the public seeks details on the global pandemic, coronavirus phishing attacks have targeted recent<br />
trends in news and statements released by governments.<br />
As a result of coronavirus-related phishing attacks, the National Fraud Intelligence Bureau (NFIB)<br />
reported a 400% rise in scams.<br />
Recent campaigns have also seen cybercrimes build emails masquerading and fake websites as official<br />
authorities, like the HMRC and World Health Organization, to compromise accounts, steal personal<br />
information, and hack malicious apps.<br />
The most common scams are those which claim to share tips about how to prevent infection, access to<br />
personal protective equipment, provide financial support advice, and offer updates about virus spread.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 39<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
According to a study, the click rate for phishing attacks has increased from less than 5% to more than<br />
40% for COVID-19 scams. This number was increased significantly by provoking fear and curiosity<br />
amongst individuals.<br />
Remote Work Vulnerabilities<br />
Work from home has now become the new standard; however, there is a rise in threats for several<br />
businesses. Around 95 percent of <strong>Cyber</strong>security professionals claim they face additional challenges, with<br />
new remote work demands and increased threats.<br />
The sudden change in circumstances has changed the way employees access business applications<br />
and increased the potential of future attacks.<br />
To steal sensitive information, hackers exploit several vulnerabilities in unsecured Wi-Fi and to take<br />
advantage of workplace disruption.To stay safe from such exploitation, you must download VPN to keep<br />
your sensitive information safe.<br />
With some workers forced to use personal devices for work tasks, the risk of malware finding its way on<br />
devices has also increased, resulting in personal and work-related information being compromised.<br />
These devices also lack the resources built into corporate networks, including custom firewalls, corporate<br />
antivirus software, and online backup resources. The use of personal computers offers hackers many<br />
chances to exploit.<br />
Some organizations are also urging their staff to turn off voice assistants and smart speakers like Apple<br />
HomePod, Amazon Echo, and Google Home devices to prevent fraudsters from listening to confidential<br />
conversations and conference calls.<br />
The Northeastern University study shows that smart speakers accidentally activate as many as 19 times<br />
a day, recording as much as 43 seconds of audio each time. The latest research also shows that 59<br />
percent of smart speaker consumers have concerns about privacy, with front and center undesirable<br />
listening and data collection.<br />
Even in regular times, remote working can make people vulnerable to attacks. The current environment,<br />
however, has created the perfect storm where spammers, hackers, and scammers will thrive.<br />
Zscaler researchers say they have seen a 15% -20% increase in hacking incidents every month since<br />
January, and a rise in hacking threats using terms like "Covid-19" or "coronavirus."<br />
Video Conferencing and COVID-19<br />
Just like any other technology, video conferencing is also at risk for the privacy and security of personal<br />
information if not appropriately handled. With organizations and individuals increasingly relying on video<br />
conferencing, hackers have been targeting the opportunity quickly.<br />
As a result, fraudsters and cybercriminals have managed to enter video conferencing calls as well as<br />
eavesdropping on private conversations, hijacked screen controls, and launched many malicious attacks.<br />
Security issues were posed earlier this year when a UK cabinet meeting's Zoom ID was posted in a social<br />
media post. Some of the cabinet ministers' usernames were also identified along with the ID, which<br />
allowed hackers to access the private meeting.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 40<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
The Washington Post also revealed that thousands of Zoom meetings can be accessed online, including<br />
financial meetings, counseling sessions, school classes, and telehealth calls that exposed children's<br />
faces and other details.<br />
While most applications for video conferencing have controls that can be programmed to minimize these<br />
hazards, it also poses a variety of additional dangers, such as having sensitive data displayed in the<br />
background of the video or unintentionally displaying confidential information on the screen. With saying<br />
that, user education is essential for raising awareness about the risks of video conferencing and how to<br />
alleviate them.<br />
Combatting Business Email Compromise During a Crisis<br />
With the significant increase in coronavirus-related phishing attacks around the world, business email<br />
compromise attacks are now considered one of the biggest threats facing organizations.<br />
BEC attacks are expected to double each year to over $5 billion by 2023, according to Gartner, leading<br />
to major financial losses for companies by 2023.<br />
Though relatively easy to execute and low-tech, these sophisticated scams not only cause devastating<br />
financial losses but also affect organizational integrity, relationships, and the trust of stakeholders.<br />
A study took place in February, and according to that, BEC attacks increased by nearly 25 percent,<br />
ranging from fake invoices to CEO frauds and compromising employee email accounts. To further<br />
leverage Covid-19 fears, fraudsters have been cashing in by asking companies to contribute to bogus<br />
charities and invoicing for cleaning products and PPE.<br />
Fraudsters and hackers are continually changing their strategies to take advantage of new<br />
circumstances, and this pandemic is no exception. When cybercriminals increase their efforts, knowledge<br />
of these emerging threats and tactics becomes the most effective tool against them.<br />
Scammers will be swift to take advantage of any security lapses, and organizations should continue to<br />
empower and educate staff to remain vigilant. <strong>Cyber</strong>security is the responsibility of all, and creating a<br />
culture of cyber awareness with so many potential attack points is the key to improving security.<br />
About the Author<br />
Susan Alexandra is an independent contributing author at SecurityToday<br />
and Tripwire. She is a small business owner, traveler and investor in<br />
cryptocurrencies.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 41<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Ransomware Is Evolving<br />
These attacks thrive on overprovisioned administrator access. Understanding where data resides, and<br />
adopting zero standing privilege are key.<br />
By Jeff Warren, General Manager, Products, Stealthbits Technologies, Inc.<br />
When most people think of a ransomware attack, they probably imagine their company coming to a<br />
screeching halt as the infection spreads across the network, encrypting everything in its path and leaving<br />
a trail of ransom notes in its wake. This type of devastating event can take an organization down for<br />
hours, days, or indefinitely. Regardless of whether the ransom is paid, however, the cost of these attacks<br />
can be astronomical.<br />
These days, companies are better prepared for catastrophic events, with detailed incident response and<br />
disaster recovery plans in place. Increased cloud adoption also makes this more achievable and helps<br />
avoid ransomware-related downtime. There is a growing community drive to help infected organizations,<br />
with initiatives like The No More Ransom Project, which exists to help companies avoid ransom payments<br />
and decrypt their data for free. Additionally, law enforcement agencies, including the FBI, are advising<br />
victims not to pay these ransoms as the proceeds help fund further cybercrime.<br />
Ransomware groups are aware of these trends and are responding with a renewed focus on the added<br />
exfiltration of sensitive data, which they can use to extort companies into paying an even more exorbitant<br />
ransom.<br />
Ransomware’s New Tricks Are After Your Sensitive Data<br />
The goal of ransomware has never been crypto-locking an organization’s IT network – that’s just a means<br />
to an end. Ransomware is about extorting a ransom payment, by any means necessary. As organizations<br />
become more prepared to recover from a crypto-ransomware event, attackers are pivoting into new ways<br />
of putting the pressure on organizations to pay up.<br />
The threat of a data breach is enough to get any organization’s attention. This has become a weapon of<br />
choice for the Maze Ransomware Group, which has been involved in several high-profile ransomwareattacks-turned-data-breach<br />
this year. At first, they will crypto-lock your systems, and then if the ransom<br />
is not paid, they will leak compromised sensitive data to force their victim’s hand. They have even gone<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 42<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
as far as hosting a “Name and Shame” site where they will expose a company’s private data to the world<br />
to prove they have it.<br />
This behavior is a logical extension of the more advanced, human-operated tactics that have been used<br />
in targeted ransomware attacks. Once an adversary lands within a victim’s network, they perform<br />
reconnaissance, learn the lay of the land, and gradually expand their foothold, acquiring more privileges<br />
as they go. We’ve seen common malware variants leveraged by multiple attack groups like the Emotet<br />
malware, which comes with an evolving bag of tricks to commoditize this infection and lateral movement.<br />
This process typically ends with Domain Administrator access within an Active Directory domain and<br />
provides the attackers carte blanche ability to move within the organization and access any and all data,<br />
including sensitive personnel and customer records. It’s a simple behavior change for these adversaries<br />
to gather and exfiltrate this data prior to dropping a crypto-ransomware payload.<br />
The Maze Ransomware Group isn’t alone in this approach. We’ve seen other recent examples of attacks<br />
resulting in data breaches affecting students in the Clarke County school district and children and parents<br />
participating in Child Protective Services. Each of these attacks leaked information including Social<br />
Security Numbers, showing attackers have no remorse when it comes to putting the identities of innocent<br />
bystanders in their wake – even children.<br />
This seemingly subtle, yet highly substantial evolution in ransomware is catching companies off guard.<br />
The focus has been on recovering from a ransomware attack, not mitigating a data breach. Whether a<br />
ransomware attack constituted a data breach had once been a debated topic that was taken on a caseby-case<br />
basis, but that is quickly becoming a thing of the past as the data is undoubtedly stolen and, in<br />
many cases, exposed.<br />
This shift in behavior by ransomware groups should not be taken lightly. The message is loud and clear.<br />
Attackers will go to whatever lengths necessary to extort a ransom payment, and the identities of millions<br />
of unsuspecting victims are at risk.<br />
An Attack on Data Privacy<br />
This behavioral shift is concerning in more ways than one. It’s hard enough to protect your network from<br />
crypto ransomware. Now, with each ransomware attack equating to a potential data breach, new<br />
challenges arise.<br />
Recently, companies have been more focused on data privacy with the rise in regulations such as the<br />
EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).<br />
These regulations place a greater responsibility on organizations to protect their customer and employee<br />
data and improve data breach notification policies. Failure to comply can result in fines, and even class<br />
action lawsuits by affected individuals.<br />
As if ransomware wasn’t costly enough, modern privacy regulations up the ante. As a result, new<br />
strategies are needed to shift focus from recovering from a ransomware attack to mitigating the risks<br />
associated with credential and data theft and protecting your critical data from the prying hands of<br />
attackers.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 43<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
You Can’t Protect What You Don’t Know<br />
Traditional ransomware strategy would dictate you just need to be able to blow away compromised<br />
devices and restore from backup. While this is still a costly endeavor, it is becoming more and more<br />
reasonable, and admittedly still worthwhile. With ransomware focusing on exfiltration before encryption,<br />
data security now lands squarely in the middle of ransomware prevention.<br />
The first step to mitigating a data breach is to gain an understanding of where your data resides. This is<br />
also typically required for companies undertaking Data Privacy Impact Assessment (DPIA) or a Data Risk<br />
Assessment (DRA).<br />
While many organizations can point to where customer and employee data enters their organization, its<br />
typically difficult to track where it goes from there. Examples of activities that can lead to data sprawl for<br />
sensitive customer data can include:<br />
• Extracting information from applications into spreadsheets and saving them to network file shares,<br />
collaboration sites, or sending as email attachments<br />
• Pasting or discussing sensitive information within chat applications like Microsoft Teams or Slack<br />
• Creating copies of production data for development or integration testing<br />
• Employees saving local copies of customer data to their laptops to work with, and then leaving them behind<br />
If you don’t take the time to locate this data within your network, you can trust that your attackers will.<br />
Once you can identify and corral your sensitive data, you can now focus on protecting it.<br />
Zero Trust is Not Enough, It’s Time for Zero Standing Privilege<br />
Most ransomware attacks follow similar patterns. After the initial infection occurs within the network, they<br />
will go through a pattern of credential compromise, lateral movement, and privilege escalation. These<br />
attacks thrive on overprovisioned administrator access, and in many cases can compromise an entire<br />
Active Directory domain within hours of initial compromise.<br />
Many cybersecurity initiatives have focused on implementing the tenets of a Zero Trust Model, with the<br />
mantra of “never trust, always verify” and a focus on implementing a least privilege model and adopting<br />
strong authentication. All of this is a great step towards improved security and mitigation of data breach<br />
activity.<br />
However, attackers have proven they can still patiently learn the ins and outs of any network,<br />
masquerading as legitimate users, bypassing multi-factor authentication (MFA) and other obstacles put<br />
in their way. One of the primary contributors to this being possible is an overabundance of privileged<br />
accounts that maintain persistent access to an organization’s IT infrastructure. Regardless of whether<br />
privileged account credentials have been rotated, attackers can still compromise these accounts and<br />
leverage the artifacts they leave behind to move laterally on their way to privileged escalation, and<br />
ultimately domain dominance.<br />
A new focus needs to be on evolving the Zero Trust methodology to one of Zero Standing Privilege,<br />
where persistent privileged access is removed altogether, specifically for privileged accounts. This<br />
doesn’t mean only Domain Administrator and root accounts with full administrative access; this includes<br />
any users with highly privileged access to your critical systems and private data.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 44<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
When these individuals need access, they must go through special procedures to be granted just enough<br />
access, only when they need that access, and then the privileges should be entirely removed when their<br />
privileged activity is done.<br />
The removal of the vast majority of privileged accounts is what will ultimately reduce the attack surface<br />
every organization is struggling to defend. It raises the drawbridge around your sensitive data, keeping<br />
attackers out. This not only helps companies protect themselves from ransomware attacks, but keep the<br />
data and identities safe for the individuals who they rely on the most – their customers and employees.<br />
About the Author<br />
Jeff Warren is Stealthbits’ General Manager of Products. Jeff and his<br />
teams are responsible for designing and delivering Stealthbits’ high<br />
quality, innovative solutions. He has held multiple roles within the<br />
Technical Product Management group since joining the organization a<br />
decade ago, initially building Stealthbits’ SharePoint management<br />
offerings before shifting focus to the organization’s Data Access<br />
Governance solution portfolio as a whole. Before joining Stealthbits, Jeff<br />
was a Software Engineer at Wall Street Network, a solutions provider<br />
specializing in GIS software and custom SharePoint development. Jeff<br />
holds a Bachelor of Science degree in Information Systems from the University of Delaware.<br />
Jeff can be reached on Twitter at @SbitsJeff and at our company website https://www.stealthbits.com/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 45<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
How COVID Tests the Resilience of Your Cloud Data<br />
Infrastructure<br />
By Noah Johnson, Co-founder & CTO, Dasera<br />
In recent years, we’ve seen a massive shift as companies eliminate the physical restraints of IT<br />
infrastructure and its users by moving to a cloud-based computing environment. According to a Gartner<br />
forecast from <strong>November</strong> 2019, worldwide public cloud revenue is predicted to increase to a whopping<br />
$308.5 billion.<br />
“As organizations increase their reliance on cloud technologies, IT teams are rushing to embrace cloudbuilt<br />
applications and relocate existing digital assets.”<br />
While this is great for convenience and your wallet, the security of your infrastructure comes into question<br />
when so many businesses have shifted to a work from home setting, whether permanent or temporary.<br />
How resilient is your cloud data infrastructure when the safety net of the perimeter is gone, and what is<br />
the best way to protect yourself and your data moving forward?<br />
COVID-19 and the new environment<br />
We have seen so many changes this year in how we live our lives that it’s become hard to keep up. While<br />
the big shifts, like permanent or extended work from home, have been obvious changes, what about the<br />
more subtle ones, like protecting your business while your employees are working remotely?<br />
The attacks on cloud services more than doubled in 2019. In the Red Book of Insider Threats, Amol<br />
Kulkarni, Chief Product Officer at Crowdstrike mentions a 330% increase in e-crime attacks since the<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 46<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
start of the pandemic. In the same book, Jintendra Joshi, the Head of Information Security at BetterUp<br />
says, “In the post-COVID world, our perimeters have disappeared and the line between trusted insiders<br />
and outsiders have blurred.”<br />
Without the safety net of the perimeter in-office, companies need to innovate when it comes to their<br />
security just as much as they’ve had to with remote work.<br />
Personal networks<br />
The biggest security issue that companies face right now is the simple fact that employees and<br />
contractors have to access the cloud via less secure personal networks and personal devices. This<br />
means that before <strong>2020</strong>, protecting your networks or endpoints was the simple solution to cloud data<br />
breaches, the solution that blanketed all of your employees under one security umbrella. With your<br />
employees working from home or using personal devices, that security umbrella has all but closed.<br />
Instead of focusing on the missing blanket, businesses should put a magnifying glass on how data is<br />
being used by employees in order to protect against cloud data breaches. This approach is based on two<br />
salient points:<br />
• Security has to be applied at runtime, rather than just at rest or after the fact<br />
• Security has to sit closer to the source i.e. the datasets where sensitive data is stored<br />
Adopting a proactive approach that protects data upstream and at runtime doesn’t have to be<br />
complicated; all it takes is foreseeing how data is used in normal situations and identifying anomalies that<br />
can result in breaches.<br />
Let’s use two scenarios that can potentially be very dangerous in the current COVID pandemic.<br />
Know when an employee is being unnecessarily inquisitive<br />
The pandemic has left a trail of employees experiencing remote work burnout. Reports suggest as many<br />
as 69% of employees are experiencing burnout symptoms while working from home. Combining this with<br />
employees taking fewer holidays means lesser opportunities to decompress and relax. Tired and<br />
frustrated employees might also behave recklessly or become prone to errors of judgement.<br />
This leads to situations where people might use cloud data in ways that are not appropriate or in line with<br />
company ethics and policies. For example:<br />
• Looking at a celebrity’s PII data out of inquisitiveness (e.g. health issues or items bought)<br />
• Finding out what their partner or ex has been doing in an app (e.g. purchase/ messaging history)<br />
• Checking out data on their peers’ work (e.g. sales performance of other reps or territories)<br />
How you can build resiliency: every time a data request hits a cloud repository, it generates a SQL<br />
query. This SQL query holds the key to understanding anomalous behaviors. AI solutions like Dasera<br />
can identify when a possible (accidental or malicious) privacy violation happens. Alternatively, if the<br />
number of data requests per day aren’t too high, the security ops team should review the logs manually.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 47<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
If a violation occurs, bring it up with the person, their manager, and in some cases (e.g. repeat offenders)<br />
send the case to HR or the person in for training.<br />
The extra line of defense against a credential thief<br />
External hackers are leveraging the uncertainty of the times and the additional vulnerability of remote<br />
teams to step up their phishing attacks and stealing credentials. Once an external attacker possesses<br />
valid credentials, it’s very hard for security teams to differentiate between an actual user (who’s getting<br />
work done) and a thief trying to steal information.<br />
Attackers now apply several sophistications in their exfiltration attempts in order to bypass established<br />
security systems that monitor user behavior. Once again the SQL acts as the best possible means to add<br />
an extra layer of protection against nefarious activities.<br />
How you can build resiliency: AI can once again understand which data fields are more sensitive and<br />
personal in nature (e.g. emails, social security numbers) compared to others (e.g. last purchase date).<br />
Algorithms can also detect even the most sophisticated exfiltration attempts on these fields e.g. data<br />
downloaded in randomized batches that are not big enough to flag alerts in your current security stack.<br />
How resilient would you say your cloud data in use is?<br />
The question readers should ask themselves at this point is: am I 100% certain neither of the above<br />
scenarios happened in our organization since March or April <strong>2020</strong>? Shopify just announced two of its<br />
employees siphoned off customer data for personal gain. The pandemic has thrown all security teams in<br />
the deep end of the pool. And the speed of business requires all of us to be agile and to be able to<br />
leverage cloud data to grow faster. The difference in resilience determines which security team keeps<br />
dealing with incidents versus which one becomes a true enabler of cloud technology.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 48<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Noah Johnson is Co-founder & CTO, Dasera<br />
Noah Johnson is a security researcher, entrepreneur,<br />
and co-founder & CTO of Dasera. Noah received his<br />
Ph.D. in Computer Science from UC Berkeley and has<br />
founded three companies based on his academic<br />
research. Noah recently developed the first practical<br />
system to provide differential privacy for general SQL<br />
queries. This work was featured in Wired and Gizmodo,<br />
and serves as the technical foundation of Dasera’s<br />
products. Previously Noah led a team of students in<br />
developing a platform for automated security analysis<br />
of mobile apps. Noah commercialized this work by co-founding Ensighta Security, which was acquired<br />
by FireEye in 2012. Noah received several awards as a graduate student including the Signature<br />
Innovation Fellowship, Sevin Rosen Award for Innovation, and the Tony Leong Lim Pre-Doctoral Award.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 49<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
The Impact of Ransomware on Cloud Services and How<br />
to Stop Attacks<br />
By Davit Asatryan, Product Manager, Spin Technology<br />
Cloud technology and services continue to gain popularity due to their ability to allow businesses to cut<br />
costs, improve an outdated IT infrastructure, and stay current with the competition. However, security<br />
isn’t always top of mind when adding new services. The dramatic increase in connected devices and the<br />
web of hardware and software used to connect to the internet and cloud means organizational data is<br />
more vulnerable than ever to attack. Without the proper security protections to protect employees using<br />
these cloud services, organizations can easily fall victim to ransomware.<br />
Ransomware works by infiltrating a user’s PC or mobile device via malicious software that is usually<br />
installed unintentionally after clicking a link in an email that’s posed as something else. Once installed,<br />
the software uses cryptography to prevent users from accessing their files and demands a sum of money<br />
to unencrypt the data. Until recently, ransomware was mostly an issue on local computers or mobile<br />
devices. However, the most recent wave of ransomware attacks is infiltrating cloud apps. This introduces<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 50<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
a new and more serious threat for modern businesses, especially those that rushed to the cloud to enable<br />
remote workers without taking proper security precautions.<br />
Types of Ransomware<br />
A large percentage of malware is known to deliver ransomware, and more than half of malware-infected<br />
files are shared publicly. The most common types of cloud malware include JavaScript exploits and<br />
droppers, Microsoft Office macros, PDF exploits, Linux malware, and Backdoors. If a hacker manages to<br />
gain access to a cloud service provider successfully, they can essentially launch a ransomware attack<br />
that can affect every customer.<br />
Ransomware called Cerber targets Office 365 users via malicious macros in Office documents attached<br />
to spam emails. While Office 365 automatically disables macros to prevent malware from entering the<br />
system, Cerber uses social engineering to trick the user into bypassing this security feature. While many<br />
cloud services offer the option to recover a previous version of files, this does not mean that they are<br />
safe from ransomware. If the user has the opportunity to delete these previous versions, so does the<br />
malware. The cloud can also spread malware to other users through the sharing of infected files and<br />
automatic syncing. For example, Virlock ransomware specifically targets cloud storage and collaboration<br />
platforms, allowing it to replicate rapidly through the whole network from a single infected user.<br />
Cloud applications, including file sharing, collaboration, and social networks, are becoming one of the<br />
most common ways of spreading malware. One out of every ten companies has malware in their cloud<br />
storage facility. It is therefore vital that any company using the cloud for storage or collaboration invests<br />
in automated daily backup and daily cloud apps auditing to detect and recover from malware attacks.<br />
However, these examples do not mean that using the cloud for backup and collaboration is riskier than<br />
confining all software to in-house. Most small to medium businesses do not have the resources to ensure<br />
state-of-the-art security for their data. In this case, relying on the more sophisticated security measures<br />
of enterprise cloud providers is both economical and provides enhanced data security.<br />
Reducing the Risk and Impact of Ransomware in the Cloud<br />
The best way to protect yourself from vulnerabilities is to ensure that software is always kept up to date<br />
and patched for urgent security updates. Many businesses struggle with ensuring patches are current<br />
and installed on every machine within the organization. Hence, a system for deploying updates in a timely<br />
fashion is essential for network integrity. Mobile code such as Java and Flash can make calls to a website<br />
to download malicious software. Removing them from your browser will increase the security and make<br />
ransomware attacks less likely. It is also essential to provide thorough security training for staff and<br />
educate them on how malware can infect files. This alone can reduce the risk of ransomware that is<br />
installed due to a user clicking a link in a phishing email, for example.<br />
Each organization should carefully develop its IT security policies, making sure to account for working in<br />
the cloud. For example, restricting the use of cloud applications to enterprise-level software will<br />
significantly reduce the risk of malware attacks due to their superior security controls. Cloud-based<br />
antivirus software, network monitoring, and threat detection, including the ability to block suspicious<br />
activity, is another effective way to create a more secure computing environment when there are a lot of<br />
users on the network. Regular backups with efficient recovery capability are the best way to recover from<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 51<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
a ransomware attack. They allow an earlier, unencrypted version of the data to be restored, thereby<br />
nullifying the effect of the ransomware.<br />
Most cloud service providers have secure backups (this should be an essential requirement when looking<br />
for a cloud provider), however, if they do not have an efficient recovery procedure in place, it may take<br />
days or weeks to restore files to their original unencrypted state, which can cost affected organizations<br />
substantially in terms of lost business hours. It’s also essential that cloud service providers use<br />
sophisticated and up-to-date anti-malware on their servers to detect infected files.<br />
Encryption is Key<br />
In many cloud applications such as Google Apps, Office 365, and Salesforce, data is created in the cloud<br />
and copied to the backup provider. Cloud backup providers have their security in place to ensure the<br />
safety of the physical servers, but data may be vulnerable while it is in transit. Any communication of data<br />
between the client and the cloud provider must be encrypted. Not all encryption algorithms are equal,<br />
and it’s important to make sure the provider you use is utilizing industry-standard encryption protocols.<br />
Cloud data services should use only protocol TLSv1.1 or higher. Additionally, they should own a security<br />
certificate that has been confirmed by a well-known and trusted certification. Data should be encrypted<br />
while in transit and once it reaches the servers of the cloud provider and remains in storage. Storing the<br />
data in encrypted format means that if an unauthorized person manages to achieve physical or electronic<br />
access to these backup servers, the actual data will still be inaccessible.<br />
A Multi-Faceted <strong>Defense</strong><br />
Businesses are becoming increasingly high-tech and connected. As their needs and demands grow, so<br />
too will the digital security industry to meet these needs. The security needs of digital businesses include<br />
more sophisticated security policies and management, advanced monitoring, detection, and autoresponse<br />
systems, and more secure access control. The challenge is providing all these things in an<br />
environment that is growing and has diverse needs. Businesses need to remain vigilant and continuously<br />
alert to the potential of cloud ransomware attacks, especially in a national climate where employees are<br />
working off-site and using unprotected personal devices to access company cloud files.<br />
About the Author<br />
Davit Asatryan, Product Manager, Spin Technology.Davit Asatryan is a<br />
Product Manager who has been working with Spin Technology since 2018.<br />
He is a Cloud Security & Backup specialist focused on protecting G Suite<br />
& Office 365 data.Davit can be reached online at (davit@spintech.ai) and<br />
at our company website www.spin.ai.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 52<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Perfecting Your <strong>Cyber</strong>security Sales Process<br />
by Katie Teitler, Senior Analyst, TAG <strong>Cyber</strong><br />
How Is Your <strong>Cyber</strong> Security Sales Process?<br />
Sales has been around since the dawn of tradesmanship. Even before the term was codified, heck,<br />
probably before humans’ early ancestors spoke a language anyone alive today would recognize, humans<br />
have been selling wares. Looking at more recent history, pre-1990s or so, sales were conducted in person<br />
or over the phone. In person—even door-to-door—sales were considered the best and most reliable<br />
method. If you could look someone in the eye and shake their hand, your chances of making a sale were<br />
greatly increased.<br />
When email and the internet started to become ubiquitous, salespeople held on to tried and true methods,<br />
dialing for dollars, as it were, and racking up thousands of dollars in travel fees and air miles to visit<br />
prospects in cities wide and far. By the early 2000s, the digital realm changed sales for good. LinkedIn<br />
was launched in 2002 and suddenly businesspeople had a new way to connect. It wasn’t long before<br />
savvy salespeople saw an opportunity and started trying to connect with new, prospective clients, then<br />
move them to the next phase, a.k.a., the one-on-one, in-person meeting where the relationship was fully<br />
developed.<br />
As time went on, and other platforms made it easier for salespeople to find their “financial buyer” via a<br />
quick internet search, the number of unsolicited cyber sales pitches increased exponentially. Executives<br />
were inundated with the one-two punch of email-followed-by-phone-message—always under 30<br />
seconds!—in an effort to reach new prospects. As it became easier for salespeople to identify and<br />
connect with potential buyers, buyers found new ways to filter out the noise. Thus, it grew even more<br />
imperative for salespeople to connect with a greater number of people every day. It didn’t matter how you<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 53<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
got through. Just get through. Just get someone to take a call. Just get someone to sit through a demo.<br />
Just get them to know you.<br />
Sales digital transformation<br />
Consequently, over the last few decades, sales has evolved from a highly personalized profession to a<br />
high velocity numbers game. Especially in light of COVID, without any in-person meetings or industry<br />
events, and as the economy has presented numerous sales challenges, enterprise buyers have reported<br />
a massive uptick in digital solicitations. But because cyber security product sales, for many (not all), has<br />
become high volume, high velocity outreach, product seekers and budget holders have become the<br />
causalities of a spray and prey sales approach. TAG <strong>Cyber</strong>’s enterprise clients note this all the time: I’m<br />
receiving more LinkedIn messages where the person has no idea what my job title is or what my<br />
responsibilities are. I got two emails today where the note read, “Dear %FirstName%.” I, myself, have<br />
receive several messages in the last few weeks asking if I am interested in buying networking equipment,<br />
phishing prevention software, video conferencing software, and lead generation lists. I’m a cyber security<br />
industry analyst. I need none of these things (OK, maybe technically I need the phishing [spam]<br />
prevention but it’s not my network, not my budget, not my decision).<br />
Quite simply, this spray and pray approach doesn’t work for end users, practitioners, implementers...i.e.,<br />
buyers. Good salespeople know this, but they can feel trapped by arbitrary metrics required by<br />
management teams pushing employees to hit their quotas. Somehow, a good portion of sales has<br />
become like the 1980s perfume sales reps in the mall who would ask if you wanted a spritz of their new<br />
perfume, and even when you said no, would spray it in your direction anyway. Maybe the shopper will<br />
catch a whiff and realize they really do want to buy this perfume. Today, the sales process has changed,<br />
and many salespeople have lost sight of the need to educate themselves on prospects—the individuals<br />
they’re contacting—before reaching out. And spritzing.<br />
The art of taking the time to get to know a prospect has been lost, and it has been precipitated by our<br />
overreliance on technology and the rush, rush, rush world we live in. As a result, nearly every time we<br />
talk to an enterprise security client about vendor product selection, we hear the same things: It’s hard to<br />
find a salesperson who will listen to what we need. Vendors have canned product pitches, and they all<br />
focus on the same “differentiators” as their competitors. We went through multiple sales calls and an<br />
entire demo then found out their product is incompatible with our environment. On the first call, the vendor<br />
said they could do X, but when we were ready to purchase, they said they’d be building that capability<br />
custom and we wouldn’t have it until 4 weeks after we deploy.<br />
But we know that there are good cyber salespeople out there who believe in their products and have just<br />
lost their way. The startup SaaS culture has turned sales into metrics rather than relationships. And it’s<br />
hurting both sides of the equation.<br />
Because, as analysts, we sit at the intersection of vendors and buyers, we recommend cyber security<br />
salespeople return to the “old-fashioned” mentality of a personalized sales approach but combined with<br />
the advantages of modern technology. If done correctly, the result will be more conversations, more<br />
opportunities, and more (possibly higher value) sales. One challenge, in certain cases, will be convincing<br />
sales managers to adjust metrics to reflect the time and effort it takes to get to the first meeting—more<br />
reflective of a pre-2000s sales cycle where “hitting the number” is more important than number of new<br />
contacts added to the CRM.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 54<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Do your homework<br />
For those with true sales persuasive powers (or enough trust of their sales leadership), we recommend<br />
getting back to sales basics. Selling your cyber security solution is about people and their needs. And no<br />
two companies have the exact same needs, so throw out the corporate pitch deck and start your meetings<br />
with conversations. Before you're given the permission for a conversation, though, you'll need to do your<br />
homework on the person whom you’re trying to convince to make time in their schedule. This convincing<br />
will require more time than stalking the surface of someone‘s LinkedIn profile. For instance, my profile<br />
says that I am a cyber security analyst. Job titles in security can be tricky, but it’s well worth a<br />
salesperson’s time to a) visit my company’s website to see what the company does and the context of<br />
my work as an employee and, b) look at my LinkedIn activity. Literally two minutes is all it would take<br />
someone to figure out that I am a research analyst, not the person who monitors network/cloud<br />
technologies and investigates alerts and security issues.<br />
Many security executives intentionally have sparse social media profiles, but a quick Google search will<br />
often provide greater context about the person’s offline activity and interests. For instance, before Ed<br />
(TAG <strong>Cyber</strong>’s CEO, founder, and lead analyst) founded TAG <strong>Cyber</strong>, he did a ton of presenting and<br />
speaking as AT&T’s Chief Security Officer. His presentations were varied—Ed could/can speak<br />
eloquently on any security topic—but often his presentations reflected what his internal team was<br />
currently working on. Even if this isn’t the case for other CSOs/CISOs, it’s at least an opening for a<br />
conversation. And it shows the CSO/CISO that the salesperson bothered to minimally look into the<br />
individual rather than simply spamming them because of their job title.<br />
For large, publicly traded companies, salespeople should peek at the Annual Report/10K, other investor<br />
information, and company press releases to see what security tidbits they can glean. As cyber security<br />
has become a top-line business risk, security initiatives have made their way into these public documents<br />
and can give hints about the company’s approach to security. And again, if it doesn’t give the salesperson<br />
specific information about the prospect, referencing business goals in the context of security will at least<br />
demonstrates effort to learn and listen. That said, don’t half @$s it. Do your homework with honest<br />
intentions and you’re more likely to gain the connection.<br />
After the connection<br />
If the salesperson has done a bit of background investigation and catches the eye or ear of a potential<br />
buyer, the next step is...more research! This time, though, in the form of listening. Use the 80/20 rule:<br />
listen 80% of the time; speak 20% of the time. If you’re a salesperson doing more speaking than listening<br />
on your first few calls, you’re headed down the wrong path. Don't make it about your groundbreaking,<br />
fully automated, cloud-based, zero latency, environment-agnostic powered by artificial intelligence<br />
solution.<br />
Go in with the intention of fact finding. A good salesperson must understand the buyer’s/enterprise’s:<br />
●<br />
Business requirements: How will the technology be used? In what context? What are the<br />
intended outcomes? What are the KPIs the tool will be measured against? Who will be responsible<br />
for the day-to-day management/operation of technology? How much professional service support<br />
will they need? Are there additional stakeholders involved in the decision (who are not involved<br />
in current discussions)?<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 55<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
●<br />
●<br />
Architectural requirements: What networks/data/apps/OSs/languages does it need to support?<br />
Does the company run legacy tech, or does it operate int he cloud only? Will the company need<br />
help migrating from on-prem to cloud? What are the company’s plans for scaling?<br />
Implementation requirements: Can the company support network changes? Can the company<br />
support integrations themselves? What is their timeframe for implementation? What is their<br />
timeline for results/reports/data?<br />
The main thing for salespeople to remember is that there are humans on the other end of the<br />
phone/keyboard/screen who need to solve real problems for their businesses. For them, buying a product<br />
is about a need, not your quota. While it’s a conundrum—the more product you push, the more you get<br />
paid, the better your job security—the irony is that the more you listen, the quicker and easier it will be to<br />
find the right buyers and the less time you will spend time sending blind emails.<br />
For example, on a recent call with a major enterprise, the security program owners were complaining that<br />
they were about to enter the POC stage with a security vendor and it became clear the vendor was<br />
unaware that the company was still running a large chunk of its infrastructure on Linux/Unix. To the<br />
enterprise, it was obvious—it’s what they dealt with every day. The vendor, on the other hand, was<br />
thinking about its cloud-friendly tech and missed a major foundational element that made the product<br />
incompatible with the enterprise’s environment.<br />
Because the vendor didn’t take the time to learn about the business’s requirements, discussions were<br />
halted in their tracks after months of conversations. This was wasted time for everyone; the salesperson<br />
would have been better served gathering requirements in the first calls and moving on to a more viable<br />
prospect with real sales potential, and the enterprise would have been better off evaluating a different<br />
vendor.<br />
More than enough prospects to fill your funnel<br />
The reality of today’s cyber security landscape is that there are more than enough enterprise buyers. The<br />
trick is finding the right match. And salespeople won’t do that with vanilla emails or messages that aren’t<br />
suited to the buyer and don’t touch on a pain point.<br />
Every day I log on to social media and see end user friends and colleagues complaining about the<br />
inappropriate and off-target messages they’re receiving from product salespeople. Yet, they all need to<br />
buy products to run their companies! In fairness, and salespeople know this, there is some recalcitrance<br />
around the idea of “sales.” The spray and prey method used by few (but too many) salespeople has<br />
soured the soup for potential buyers—they’ve come to expect a smash and grab approach rather than<br />
someone who takes the time to get to know them and their security technology needs.<br />
Technology has made it possible for people to reach farther and wider than ever before. And as such,<br />
there’s been a loss of personalization in how we interact. However, technology has also given us the<br />
tools to learn more about people—or any subject—from anywhere and at any time. While digital<br />
transformation has largely made sales a numbers game, it also has the potential to bring it back around<br />
and create opportunities for customization. One very successful salesperson I know recently said to me,<br />
“Sales has gone way too far into metrics and away from actually being human and solving real needs.<br />
So, anything I can do to correct that is top of my list. It's easier for me to work on a problem when they<br />
know I'm not just trying to shove software down their throats.”<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 56<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Though sales culture won’t change overnight, I firmly believe we have a huge opportunity—as most of<br />
us still sit at home, working in isolation—to start connecting better with others. In a sales context, this will<br />
result in less time spent on emails that are inevitably filtered directly into spam, never read, and only<br />
count toward arbitrary metrics goals. A personalized approach to connecting will, in fact, lead to quicker,<br />
larger deals that end in bigger paychecks and President’s Club awards...when we can all travel and see<br />
each other in person again.<br />
About the Author<br />
Katie Teitler is a Senior Analyst at TAG <strong>Cyber</strong><br />
where she collaborates with security<br />
organizations on market messaging, positioning,<br />
and strategy. In previous roles, she has<br />
managed, written, and published content for two<br />
research firms, a cybersecurity events company,<br />
and a security software vendor. Katie is a coauthor<br />
of “Zero Trust Security for Dummies."<br />
Katie Teitler can be reached online at katie@tag-cyber.com and at our company website https://www.tagcyber.com/.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 57<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Data Migration Security<br />
WHAT TO KNOW<br />
By Devin Partida, <strong>Cyber</strong>security Writer, ReHack Magazine<br />
If you're planning a data migration soon, there are some crucial things to do to increase the likelihood of<br />
keeping it safe. Migrating data means moving it between locations, formats or locations.<br />
Prioritizing data security is essential for successful outcomes. However, doing that is not as<br />
straightforward as some people think. These tips will help with that all-important matter.<br />
1. Confirm the Location of Your Critical Data<br />
If your data migration includes critical content, do you know where all of it resides? If not, you're in the<br />
majority. Research indicates that 82% of respondents from organizations did not know where those<br />
enterprises kept all the critical data. The same study showed that 55% cited data fragmentation across<br />
multiple databases as slowing their progress.<br />
That's a data security risk because it could give the false impression that all the most important<br />
information got safely moved to the new destination. That may not be a valid conclusion to make. Audit<br />
the data before a migration happens. Doing that helps ensure you find all the necessary records. Tools<br />
also exist to help find duplicate or obsolete content that you can delete before starting to move the data.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 58<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
2. Plan a Phased Migration<br />
When learning about data migrations, you'll almost certainly come across details about a process called<br />
Extract, Transform and Load (ETL). It encompasses the three main stages that happen when moving<br />
information.<br />
The extract portion involves collecting data and reading it from a database. The transform step then<br />
converts the extracted data from its previous form to the format required by the new location. Finally, the<br />
load step writes the data to the target database.<br />
Keep security in a top-of-mind position by opting for a phased approach. In other words, decide to migrate<br />
your least-important data first. Focus on the material that has business value but does not include<br />
sensitive details.<br />
You should also hold off on migrating any data deemed essential to your company's operations. Doing<br />
that allows you to vet the security of the data host's systems and avoid major unforeseen problems.<br />
3. Become Familiar With Applicable <strong>Cyber</strong>security and Encryption Protocols<br />
A frequently chosen kind of migration occurs when companies shift some of their on-premises information<br />
to cloud data centers. This decision is often a smart one from a data security standpoint. Cloud platforms<br />
usually include dedicated encryption and cybersecurity protocols that customers automatically have<br />
access to through their service packages.<br />
However, consider how you could beef up cybersecurity and data encryption with additional measures<br />
applied by your company. Taking that approach is especially wise when the information in question is<br />
highly sensitive or includes customer details.<br />
When people get word of data breaches or other security-related matters affecting their details, they<br />
rapidly lose trust in the involved companies.<br />
4. Back Up the Data First<br />
As you map out the schedule for data migration, don't start moving the content before backing up all the<br />
files. Even if things go relatively smoothly, you could still end up with missing, incomplete or corrupt files.<br />
Having the data backed up supports data security by letting you restore content when needed.<br />
Weigh the pros and cons of all the options available to you before choosing one. For example, if you're<br />
only migrating a small number of files, putting them on a USB drive might be the simplest possibility. A<br />
mirrored drive or a cloud backup service is likely more appropriate for more extensive migration efforts.<br />
5. Maintain All Necessary Compliance and Access Requirements<br />
If your data migration involves keeping some content in on-premises facilities, and moving the rest to the<br />
cloud, ensure that your security standards are identically tight across those locations. A common way to<br />
do that is to set up security policies for aspects like access control. Once you lay out the desired security<br />
environment for the data, check that the cloud host meets or exceeds them.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 59<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Verify that your data security plans include specifics for all applicable laws that dictate how to handle<br />
customer information, such as the General Data Protection Regulation (GDPR). Other data privacy<br />
stipulations relate to patient medical data. Your company must continue to abide by the rules before,<br />
during and after a migration.<br />
Fortunately, automated tools can make that easier by automatically applying the parameters you set.<br />
Cutting Data Migration Risks<br />
Many of today's businesses are extremely dependent on data. The trouble is that the information<br />
possessed by a company could grow to such a gigantic amount that migrating it becomes too much of a<br />
hassle or prohibitively costly.<br />
Moving smaller databases of information still includes risks that could threaten data security. However,<br />
by following the suggestions here and doing more research to determine which challenges your company<br />
faces, you can reduce data migration problems.<br />
About the Author<br />
Devin Partida is a cybersecurity and technology writer. She is also<br />
the Editor-in-Chief at ReHack.com.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 60<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Has Your Data Been Leaked to the Dark Web?<br />
By Randy Reiter CEO of Don’t Be Breached<br />
The part of the internet not indexed by search engines is referred to as the Dark Web. The Dark Web is<br />
however frequently misunderstood. The Dark Web is a network of forums, websites and communication<br />
tools like email. What differentiates the Dark Web from the traditional internet is that users are required<br />
to run a suite of tools such as the Tor browser that assists in hiding web traffic. The Tor browser routes<br />
a web page request through a series of proxy servers operated by thousands of volunteers around the<br />
globe that renders an IP address untraceable.<br />
The Dark Web is used for both illegal and respected activities. Criminals exploit the Dark Web’s<br />
anonymity to sell drugs and guns. Organizations like Facebook and the United Nations use the Dark Web<br />
to protect political and religious dissidents in oppressive nations. Legitimate actors like law enforcement<br />
organizations, cryptologists and journalists also use the Dark Web to be anonymous or investigate illegal<br />
activities.<br />
A 2019 study, Into the Web of Profit, conducted by Dr. Michael McGuires at the University of Surrey,<br />
shows that the number of Dark Web listings that could harm an enterprise has risen by 20% since 2016.<br />
Of all listings (excluding those selling drugs), 60% could potentially harm enterprises.<br />
On the Dark Web one can purchase personnel information such as names, addresses, phone numbers,<br />
tax ids, credit card numbers, login ids, passwords and hacked Netflix accounts. Software that hackers<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 61<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
use to break into workstations and servers are also for sale. Some of the darker items for sale include<br />
guns, drugs, counterfeit money and Hackers that can be hired to perform cyber-attacks.<br />
For example for $500 the credentials to a $50,000 bank account can be purchased. Or for $500 one can<br />
buy prepaid debit cards having a $2,500 balance. A lifetime Netflix premium account goes for $6.<br />
In a recent <strong>2020</strong> report by the security company ImmuniWeb they report that 97% of the leading<br />
cybersecurity companies had data leaks or security incidents exposed of the Dark Web. They found over<br />
4,000 incidents of stolen confidential data exposed on the Dark Web per cybersecurity company. Half<br />
the Dark Web exposed data was plaintext credentials such as financial and personal information.<br />
A large number of these data leaks were attributed to cybersecurity company third party suppliers or subcontractors.<br />
Some of these data breaches occurred as recent as August, <strong>2020</strong>.<br />
Even cybersecurity companies are not immune to Data Breaches (e.g. caused by Zero Day attacks and<br />
other methods). The ImmuniWeb report covered almost 400 cybersecurity companies in the USA,<br />
Canada, UK, Ireland, Germany, France, Czech Republic, Israel, Japan, Russia and India. <strong>Cyber</strong>security<br />
companies in the US suffered the highest incidents, followed by the UK and Canada, then Ireland, Japan,<br />
Germany, Israel, the Czech Republic, Russia, and Slovakia.<br />
Today’s mega Data Breaches are now costing companies $392 to recover from.<br />
How to Stop Confidential Database Data from Being Ransomed or Sold on the Dark Web?<br />
Confidential database data includes: credit card, tax ID, medical, social media, corporate, manufacturing,<br />
law enforcement, defense, homeland security and public utility data. This data is almost always stored in<br />
Cassandra, DB2, Informix, MongoDB, MariaDB, MySQL, Oracle, PostgreSQL, SAP Hana, SQL Server<br />
and Sybase databases. Once inside the security perimeter (e.g. via a Zero Day attack) a Hacker or Rogue<br />
Insider can use commonly installed database utilities to steal confidential database data.<br />
Non-intrusive network sniffing can capture and analyze the normal database query and SQL activity from<br />
a network tap or proxy server with no impact on the database server. This SQL activity is very predictable.<br />
Database servers servicing 10,000 end-users typically process daily 2,000 to 10,000 unique query or<br />
SQL commands that run millions of times a day.<br />
Advanced SQL Behavioral Analysis of Database Query and SQL Activity Prevents Data Breaches<br />
Advanced SQL Behavioral Analysis of the database SQL activity can learn what the normal database<br />
activity is. Then from a network tap or proxy server the database query and SQL activity can be nonintrusively<br />
monitored in real-time and non-normal SQL activity immediately identified. These approaches<br />
are inexpensive to setup. Now nonnormal database SQL activity from Hackers or Rogue Insiders can be<br />
detected in a few milli seconds. The Hacker or Rogue Insider database session can be immediately<br />
terminated and the Security Team notified so that confidential database data is not ransomed or sold on<br />
the Dark Web.<br />
Advanced SQL Behavioral Analysis of the query activity can go even further and learn the maximum<br />
amount of data queried plus the IP addresses all queries were submitted from for each of the 2,000 to<br />
10,000 unique SQL queries sent to a database. This type of data protection can detect never before<br />
observed query activity, queries sent from a never observed IP address and queries sending more data<br />
to an IP address than the query has ever sent before. This allows real-time detection of Hackers and<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 62<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Rogue Insiders attempting to steal confidential database data. Once detected the security team can be<br />
notified within a few milli-seconds so that an embarrassing and costly data breach is prevented.<br />
About the Author<br />
Randy Reiter is the CEO of Don’t Be Breached a Sql Power Tools<br />
company. He is the architect of the Database <strong>Cyber</strong> Security Guard<br />
product, a database Data Breach prevention product for Informix,<br />
MariaDB, Microsoft SQL Server, MySQL, Oracle and Sybase<br />
databases. He has a Master’s Degree in Computer Science and has<br />
worked extensively over the past 25 years with real-time network<br />
sniffing and database security. Randy can be reached online at<br />
rreiter@DontBeBreached.com, www.DontBeBreached.com and<br />
www.SqlPower.com/<strong>Cyber</strong>-Attacks.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 63<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
No Meows Is Good News: Proactive Nosql Database<br />
Security in The Era of Meow Attacks<br />
By Jack Harper, Director of Professional Services at Couchbase<br />
This summer, a spate of cyberattacks in which cybercriminals targeted internet connected ElasticSearch<br />
and other unsecured databases continued to fuel concerns about database security. And the attacks<br />
were not only prolific, they were more brazen: the “Meow” attacks in particular were a series of automated<br />
malware that completely destroyed unsecured databases vs. taking the data hostage. It was game over<br />
before the ball was even in play.<br />
Deja Vu?<br />
In 2017, thousands of unsecured instances of MongoDB and ElasticSearch fell prey to attacks by a threat<br />
actor using the moniker Krakeno. These types of attacks resurfaced this summer with nearly 30,000<br />
users affected in July. Thousands of businesses lost their data in this mass data hostage event, then the<br />
Meow attack came along--accessing unsecured databases-- and one-upped the Krakeno-like attacks by<br />
completely destroying the data with its automated malware.<br />
The ongoing attacks suggest that database administrators or developers continue to overlook appropriate<br />
security in their internet-facing databases (NoSQL) that are at the crux of these attacks, leaving them to<br />
fall prey to the likes of Meow. To understand how to implement adequate security in a NoSQL<br />
environment, let’s first take a closer look at what a NoSQL database is and better educate ourselves on<br />
what tighter security controls in a NoSQL environment actually look like.<br />
A NoSQL Primer<br />
NoSQL databases are a product of the 21 st century’s desire to deliver increasingly fast, always-on digital<br />
experiences. Unlike their older and better-known ‘relational' database relatives that require predictable<br />
and structured data to operate, NoSQL (Not-Only-SQL) provides an extremely dynamic and cloud-<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 64<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
friendly way for organizations to manage real-time, unstructured data. NoSQL databases commonly<br />
deployed to be internet-facing, which can allow cybercriminals to poke holes in them if they are unguarded<br />
or poorly planned and executed.<br />
The reality is that modern applications need NoSQL databases, which places the onus on the designers<br />
and developers to build or use better systems to protect them. The issue can be addressed if vendors<br />
create secure-by-default features and users follow security best practices.<br />
Planning is everything<br />
It really is this simple: plan correctly, and your business will be able to prevent vulnerabilities and leaks<br />
before they occur. And it starts with choosing the right NoSQL provider. If the vendor sells security as a<br />
bolt-on feature that’s not baked into the system, they probably aren't the right partner to start with. It’s<br />
your duty to ask the hard questions around their knowledge of end-to-end security. Check their<br />
development logs to see if they have been reporting vulnerabilities in their systems and ask about how<br />
easy it is to implement security capabilities around the database. Research can be a tedious step in<br />
selecting the right provider, but it’s also imperative. It could make the difference between suffering an<br />
attack and not.<br />
Next, think about how your data is secured in transit. Data is never only transferred behind the firewall, a<br />
lot of it is going to move outside of your organization, and while this isn't dangerous in and of itself, it is<br />
where the most risk lies. Beyond your network are a host of third parties that may not follow your<br />
encryption policies, making it even more important for you to encrypt every dataset – regardless of where<br />
it’s stored. Make sure your planning includes securing data both at rest and in transit by investing in SSL<br />
connections for client/server and server/server communications.<br />
Your NoSQL database needs to form part of your security planning and must have a visible security<br />
roadmap that provides insights into how its developers are ensuring that it is continually updated and<br />
secured. As with any new technology, improvements are continuous, making it essential for your teams<br />
to regularly check and implement these changes, especially if they have a material impact on your<br />
cybersecurity policies or needs.<br />
Nine tips to NoSQL security success<br />
Once the planning is done, now it’s time to put it into practice. Here are nine tips on how to avoid falling<br />
prey to cyber-attacks--or becoming “Meow Mix”:<br />
#1 Don’t expose raw databases to the internet. This is a fundamental security rule, and as simple as<br />
it sounds, it is important as they come. If you don’t store all your nodes behind a secure database firewall,<br />
you risk the security of your sensitive information.<br />
#2 Keep your software up to date. Security professionals will warn that security starts at the weakest<br />
link, and this is often out of date server operating systems. So unless you install the latest encryption<br />
patches, no data security can be guaranteed. As the WannaCry, Spectre/Meltdown, and now Meow<br />
attacks have highlighted, there’s no substitute for responsible patch management.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 65<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
#3 Delete “default” and sample databases. The word “default” is the playground for cybercriminals.<br />
Those who have suffered cyber breaches will know, it can nearly always be replaced with the phrase<br />
insecure: default passwords are weak passwords; default settings are unsafe settings. If there is a default<br />
anything in your environment – always delete it.<br />
#4 Strong passwords are essential. Again, another seemingly mundane and straightforward action,<br />
but one that is the most overlooked. Default or weak passwords attract cybercriminals like bees to honey.<br />
Change passwords often, use unique passwords for different projects, make sure passwords are strong,<br />
and very importantly, change all default passwords.<br />
#5 Use role-based access control (RBAC) and Active Directory. Control privileges to both<br />
administrative activities and data access with fine-grained access control. Also, protect user credentials<br />
and manage them at a centrally controlled place with Active Directory.<br />
#6 Encrypt your data in-transit, on the wire, and at rest: Make sure that your data is encrypted as it<br />
travels over networks during client-server communications or when it is being replicated within the<br />
database server or being replicated between database servers in different data centers/zones/regions.<br />
Likewise, you should encrypt the data when it is stored for persistence. These measures prevent<br />
unauthorized access to data at all levels.<br />
#7 Use updated TLS Ciphers. Transport Layer Security (TLS) enables secure network communications.<br />
This security can be further enhanced by using updated versions of the ciphers and/or by picking<br />
customized ciphers. On top, a well-thought-out policy for certification expiration/rotation/revocation<br />
should also be implemented.<br />
#8 Limit port access. Allow firewalled access to the minimum set of network ports that are needed for<br />
your database to work.<br />
#9 Report security issues immediately. If your database has been breached or you think there may<br />
be a security flaw, report it. Immediately. There is a community of people out there that can offer you<br />
advice and benefit from this information. Security is always better when we pool resources and work<br />
together as an industry – keeping us one step ahead of cybercriminals.<br />
A problem shared<br />
Hackers and cybercriminals are always going to be part and parcel of our business life. It is a bleak<br />
reality. We need to invest in education and adopt best practices, and we need to acknowledge that<br />
ensuring compliance and adopting good security policies is an industry-wide responsibility.<br />
For those of us deploying, implementing, and developing on databases, this is even more relevant. From<br />
web, mobile, and app developers through to C-suite and technology executives, everyone involved in<br />
databases has responsibility for ensuring they are secure. NoSQL vendors also have a responsibility to<br />
ensure that their systems provide users with the tools to secure themselves better and secure their<br />
services by default.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 66<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
If the recent spate of attacks is anything to go by, it is unrealistic to think that NoSQL data breaches and<br />
leaks are a thing of the past. Instead, we need to view each one as a reminder for businesses to take<br />
database security seriously.<br />
About the Author<br />
My name is Jack Harper, I am the Director of Professional<br />
Services at Couchbase.<br />
Jack Harper is a leader on the Professional Services team at<br />
Couchbase, where he leverages nearly 20 years of<br />
experience identifying, mitigating, and resolving technical<br />
issues as well as architecting and implementing solutions for<br />
customers. His background also includes extensive<br />
experience with software testing and QA best practices and<br />
methodologies as they relate to various implementations of<br />
the SDLC (Agile, XP, RAD, waterfall). Jack is a Certified PMP<br />
(Project Management Professional) with 6+ years’<br />
experience working on software development projects.<br />
Jack Harper can be reached online at (TWITTER, LinkedIn<br />
and at our company website https://www.couchbase.com /<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 67<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Takeaway from the SANS Institute Attack: Without<br />
Proper Care, “Consent Phishing” Can Happen to Anyone<br />
Gamified Training for Security Teams Can Raise Vigilance and Advance Skills to Defend Against the<br />
Latest Attack Exploits.<br />
By Chloé Messdaghi, VP of Strategy, Point3 Security<br />
The SANS Institute, established in 1989 as a cooperative research and education organization, has<br />
helped train and inform more than 165,000 security professionals around the world – from auditors and<br />
network administrators to chief information security officers and security experts across the global<br />
information security community.<br />
A deeply trusted source for information security training, security certifications and research, the SANS<br />
Institute also operates the Internet's well-regarded early warning system - the Internet Storm Center.<br />
So when the SANS Institute reported it was the victim of a phishing attack that led to the theft of 28,000<br />
records, the cybersecurity community echoed with the question: how could that have happened?<br />
We don’t know if the SANS employee who clicked the bad link (or links) was on the security team or if<br />
they were in another function such as sales, marketing or operations. If they were not on the security side<br />
of SANS, there’s the strong potential that they were apathetic about cybersecurity because they’ve never<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 68<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
had an attack targeted at them before. If the phishing target was someone not on the SANS security<br />
team, it begs questions about what kind of training they had. Many companies train hundreds or<br />
thousands of “civilian” non-technical employees virtually and dryly, with multiple choice questions and<br />
very basic content, rather than employing ongoing training and testing.<br />
And as we’ve seen, if the employee is checking their email on their phone or a smaller device, they’re<br />
more likely to click on a bad link – both because the visual acuity to the bad link is very poor and because<br />
of the sense of immediacy that these devices drive in us all.<br />
It’s so important to train employees never to click on an embedded link from a stranger, and never click<br />
on a short URL such as a Bitly. Email recipients must be trained and regularly reminded to look for and<br />
identify the entire link before clicking on it – every time.<br />
We might not ever know exactly how the person fell into the trap - SANS might not share that - but the<br />
malicious payload could have been within any incoming message. A bogus sales or prospect email, a<br />
message purporting to be from the recipient’s manager, or some intriguing topic of broader interest are<br />
common ploys, as are urgent company security warnings, employee bonus and holiday notifications, and<br />
even messages claiming to hold confidential personnel data.<br />
Phishers definitely understand the human element, and they work to understand peoples’ pain points and<br />
passions to make their emails compelling. They also know when to send a phishing email to drive<br />
immediate responses. That why we counsel that if a supposed work email comes in after work hours, it’s<br />
best not to respond – especially from a mobile device. Or if there’s a time-sensitive, must respond email,<br />
the sender should also text the receiver both to let them know and to help the recipient know that the<br />
email is legitimate.<br />
And if the phishing victim at SANS actually IS someone on the security team, it’s important to realize that<br />
they’re likely not apathetic to security practices but that the organization either may not be investing in<br />
their own security teams, or team members may be suffering from burn out.<br />
It’s important to realize that burn-out is a natural by-product of both the transition to WFH and the urgency<br />
of the current situation. This means it’s more important than ever to gain an unbiased and equitable<br />
performance measurements, and to invest in the security team's development and up-skills training, and<br />
do so in ways (such as gamification) that are personally engaging as well as professionally helpful.<br />
Otherwise, we’re at risk of depending on security teams who are both under equipped and undermotivated<br />
to protect their colleagues.<br />
The objective assessment of skills that gamified training provides is also a wellspring of useful, unbiased<br />
information on some of the inherent strengths and weaknesses of individual employees, and helps both<br />
team members and employers address skills gaps in positive ways.<br />
At the core, gamification is play – it’s also an assessment means that offers benefits without injury to data<br />
or concern to talented team members. It’s proving to be a great way to cultivate talent, both security pros<br />
and those they serve, growing their skills in ways that hit the temporal lobe, actually rewards participants,<br />
and keeps vigilance against phishing and other attack methods front of mind.<br />
As the latest findings from Juniper Threat Labs on the continually evolving IcedID trojan and malware<br />
dropper show, the sophistication level of exploits is growing constantly, and bad actors are investing<br />
heavily in innovation.<br />
And unfortunately, too many companies aren’t following suit in investing in either their teams or defense<br />
strategies. For example, recent IBM findings showed that only one third of companies had a breach<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 69<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
playbook, and of those having playbooks, most applied them inconsistently. Given that the average<br />
breach costs the organization $8.9 million, not counting the opportunity costs of lost business, it’s clear<br />
that proactive, ongoing cybersecurity awareness is imperative.<br />
At this point, the only two things that we know are that we are seeing more phishing attacks this year<br />
than ever before, and that SANS was fast and forthright in responding to this attack. While some personal<br />
information was disclosed, it could have been far worse – fortunately, no financial information was<br />
leaked.<br />
The takeaway is: we all need to stay aware, humble and prepared – if a phishing attack can snag<br />
someone at the SANS institute, it can happen to any of us who let our guard down.<br />
About the Author<br />
Chloé Messdaghi is vice president of strategy at Point3 Security,<br />
president at Women of Security (WoSEC), founder of<br />
WeAreHackerz, ethical hacker advocate, podcaster, and is an<br />
expert in the cybersecurity industry. She is a frequent speaker<br />
at cybersecurity conferences and events, and is a trusted source<br />
to business and security media.<br />
Chloé Messdaghi, VP of Strategy, Point3 Security<br />
Chloé can be reached online at @ChloeMessdaghi and at our<br />
company website Point3.net (ittakesahuman.com).<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 70<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Behind the Scenes of AppSec’s Misalignment<br />
There’s something to be heard in the conversation.<br />
By John Worrall, CEO at ZeroNorth<br />
We live in a world defined by software, which is precisely why it must be secure. From the everyday<br />
applications we use on our devices to the avionic software of modern commercial aircraft, the code<br />
embedded behind the functions of civilization matters in every way. But there’s a problem. Our current<br />
approach to building and delivering this critical software is now in the midst of a serious evolution, as it<br />
moves from siloed processes and mindsets to something more unified.<br />
Our current model for building secure software often revolves around buying a scanning tool… and then<br />
another… and another… until we find ourselves with a craftsman-like approach that produces data in<br />
different formats. Aside from the deep knowledge needed to run each tool, the even bigger obstacle is<br />
processing the overwhelming amount of information resulting from those scans. And just like a craftsmanstyle<br />
approach, it isn’t scalable and can’t cover the needs of a growing business—or a planet becoming<br />
increasingly reliant on software.<br />
Proof of the Problem<br />
Fortunately for those who care about the security of modern applications, there are some solutions on<br />
the horizon. A recent report conducted by the Ponemon Institute and sponsored by ZeroNorth provides<br />
some real insight on how the ownership and governance of application security is fragmented and in<br />
need of repair. But this “repair” comes from better relationships, not better code.<br />
Ponemon’s report clearly illustrates just how deep the divide between AppSec and DevOps has grown,<br />
more specifically around the issue of how to build secure software from day one. According to the<br />
research, 77% of developers say this existing schism affects their ability to meet organizational<br />
expectations, such as deadlines, while 70% of AppSec professionals claim the divide puts the security of<br />
applications at risk. 1 And what we see as a result is not technology holding up progress, but people.<br />
1<br />
Source: Revealing the Cultural Divide Between Application Security and Development<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 71<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
As organizations continue to look for more effective ways of prioritizing software security, without<br />
impacting productivity, they are realizing that developers view these measures as a hindrance to<br />
innovation and speed. And, of course, AppSec teams believe DevOps should be far more vigilant about<br />
ensuring security happens at all stages of the development life cycle. In fact, 65% of security pros say<br />
developers publish code with known vulnerabilities, while the same exact percentage (65%) of<br />
developers say the security team doesn’t understand the pressure they’re facing. 2 And therein lies the<br />
misalignment.<br />
Another part of this misalignment comes from a lack of clarity about who actually owns the security piece<br />
in the first place. Only 67% of AppSec professionals believe their team is ultimately responsible for the<br />
security of software applications, compared to just 39% of developers. These numbers alone indicate a<br />
massive gap in the larger security effort, a gap that raises serious questions about accountability and<br />
visibility. When misalignment within an organization is this extreme, and no one knows who’s “watching<br />
the kids,” the integrity and success of the business is jeopardized.<br />
Thoughts for the Future<br />
So, what does a more unified mindset around security look like? It starts with a mutual understanding of<br />
each other’s roles and responsibilities, of each other’s requirements. A more federated outlook on<br />
AppSec means everyone involved—from security to business to product leaders—are doing their<br />
prescribed part to ensure security is prioritized. But it requires a coordinated effort and unified approach.<br />
The work is fragmented and so are the results. Everyone has to bond on their shared desire to build and<br />
deliver quality software to market, together as a larger team.<br />
Then we can improve things. This divide between security and development professionals offers up a<br />
much-needed opportunity for change, in both thinking and practice. With the right moves, CISOs and<br />
other security leaders can bridge this gap by embracing a unified approach for AppSec. This would allow<br />
security teams to sets standards and provides frameworks, while DevOps and product teams execute<br />
their work within those guidelines. By serving as unifier, CISO and other security leaders have a chance<br />
to make security front-and-center, without hindering the speed and velocity requirements of the Dev<br />
teams.<br />
The “right moves” will be different among organizations, but modeling a mindset and culture of security<br />
first is a great start. Everyone involved needs to remember that a robust AppSec program is not just nice<br />
to have, or worse an obstacle—it’s a business imperative. In this scenario, CISOs can advise teams to<br />
formulate a stronger coordinated effort, where security, DevOps and business teams come together for<br />
the good of software, for the good of the world. It may sound dramatic, but it’s entirely true.<br />
Security leaders also need to ensure the proper resources are allocated to safeguard applications in the<br />
development and production phase of the software life cycle. This includes training and support to help<br />
developers build the necessary secure coding skills. They also need to implement continuous testing<br />
throughout the development life cycle, starting at code check-in, to find and fix vulnerabilities early in the<br />
process. These moves help to stay on top of vulnerabilities, improve developer productivity and get<br />
product releases out the door on time. As members of senior leadership, CISOs need to build security<br />
into the organization’s overall risk management strategy and report out on the business’ most important<br />
KPIs.<br />
2<br />
Source: Revealing the Cultural Divide Between Application Security and Development<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 72<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Next Steps<br />
Where we go from here is actually pretty clear. We need to build a shared vision, bring teams together<br />
and communicate about who does what and when. Commitment from both sides is critical to build this<br />
kind of collaborative relationship, but it is possible. And once everyone acknowledges the many ways<br />
security can improve the final outcome, including all the business benefits resulting from strong product<br />
security, they will hopefully find things just work better when everyone’s on the same side.<br />
About the Author<br />
John Worrall joined ZeroNorth in 2019 as chief executive officer,<br />
leading the company in its delivery of the only platform for risk-based<br />
vulnerability orchestration across applications and infrastructure. As<br />
CEO, John heads up all aspects of the company’s strategy, product,<br />
operations and go-to-market functions. Prior to this role, John was<br />
chief marketing officer (CMO) at <strong>Cyber</strong>Ark, where he played a critical<br />
role in leading the company through its initial public offering. He also<br />
held the position of executive vice president at CounterTack, serving<br />
on the leadership team that secured the company’s Series A funding.<br />
Before his time at CounterTack, he was the chief marketing officer at<br />
ActivIdentity; vice president and general manager of the Security<br />
Intelligence & Event Management business unit at RSA; and CMO at<br />
RSA. John holds a bachelor’s degree in economics from St. Lawrence University.<br />
Website: https://www.zeronorth.io/<br />
SOCIALS:<br />
Twitter<br />
Personal<br />
Company<br />
LinkedIn<br />
Personal<br />
Company<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 73<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Emotet Attacks Surge in <strong>2020</strong>, but Could Be Prevented<br />
By Dan Piazza, Technical Product Manager, Stealthbits Technologies, Inc.<br />
The Emotet malware, originally detected as a banking trojan in 2014, has become one of those most<br />
prevalent malware threats in <strong>2020</strong>, and the economic fallout from an Emotet attack can range into millions<br />
of dollars (USD). Over the years Emotet has evolved well beyond a banking trojan and is typically<br />
delivered via phishing emails that turn infected hosts into bots and malware spreaders. Emotet is also no<br />
longer content simply executing its own malicious code – once a victim is infected Emotet can download<br />
additional malware into the network, such as Ryuk or Trickbot.<br />
However, the biggest threat Emotet brings is still the spread of ransomware throughout an organization<br />
– encrypting everything in its path and often exfiltrating sensitive data so the attacker can threaten the<br />
victim with a public leak of that information if the ransom isn’t paid.<br />
Emotet is also quite hard to detect and eliminate. Emotet is polymorphic – meaning it constantly changes<br />
itself to maintain persistence and avoid signature-based detection by endpoint protection. It’s also<br />
modular, meaning components can easily be swapped in and out depending on what an attacker wants<br />
to achieve. Some variants act as ransomware, others target cryptocurrency wallets, and some may<br />
propagate botnets. Emotet is even aware of when it’s running inside a VM and will lay dormant to avoid<br />
detection in sandboxed environments – which security researchers use to observe and decompile<br />
malware in a safe space.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 74<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Coupled with a wide variety of attack techniques, one could say Emotet’s complexity and effectiveness<br />
make it “enterprise-grade” malware. Additional techniques used by Emotet include password grabbers,<br />
software packing, obfuscated files, network sniffing, process discovery, remote service exploits,<br />
command and control (C2) using non-standard ports, data exfiltration via C2 channels, and more. With<br />
its current feature set and ability to quickly evolve, the danger Emotet poses is clear.<br />
Taking advantage of another recent malware trend, Emotet has also become a malware-as-a-service<br />
that’s sold to various threat actors on the dark web that otherwise may not have had the capability of<br />
developing such complex malware themselves. This opens the door to less-skilled attackers utilizing the<br />
power of Emotet, resulting in even wider spread of the already prevalent malware. Add this to the malware<br />
“dropper” capabilities of Emotet, and it’s single-handedly keeping older malware variants alive, spreading,<br />
and prospering.<br />
User Education – More Important Than Ever<br />
Given that most Emotet infections start as phishing emails, this surge in matured Emotet attacks is a<br />
perfect example of why organizations need to continuously educate users on how to detect and avoid<br />
modern phishing emails. Although spam filters and other methods of blocking malicious messages should<br />
be in place for all organizations, it only takes one email to get through and successfully trick a user for<br />
Emotet to start moving laterally throughout a network and eventually into domain admin rights. Emotet<br />
will also hijack legitimate, existing email threads once a host has been infected, so users need to be wary<br />
of every email they receive and not just new threads from fake or spoofed addresses.<br />
Unfortunately, it's inevitable that a user will eventually slip up, succumb to a phishing attack, and become<br />
infected. That's when Emotet starts to move laterally through a network until it gains domain admin rights,<br />
which brings up two valuable points: limit special share access, and keep all systems patched and up to<br />
date. Emotet, and the malware variants it delivers, often prefer to target admin$, c$, and ipc$ shares to<br />
enumerate and move through a network. By limiting access to these shares to the absolute minimum, it’s<br />
possible to slow Emotet down and block its go-to infection routes. This should be coupled with ensuring<br />
all systems are running the latest updates provided by software and OS vendors, so vulnerable exploits<br />
can be patched and eliminated as they’re discovered.<br />
Limiting the Scope of Attacks<br />
<strong>Cyber</strong>security software, such as privileged access management, can also limit the scope of what<br />
privileged sessions (that Emotet targets) can do by not only limiting access to resources, but also by<br />
limiting which specific actions can be taken during these sessions. The goal of this workflow is to reduce<br />
the standing privilege in a network to zero, which drastically reduces the attack surface for Emotet and<br />
buys time for the security team to remove the threat once detected.<br />
Emotet continues to be a major threat and source of stress for IT and security professionals everywhere,<br />
however with proper preventative measures it’s possible to halt it dead in its tracks.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 75<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Dan Piazza is a Technical Product Manager at Stealthbits<br />
Technologies, responsible for File Systems and Sensitive Data<br />
in their Data Access Governance solution, StealthAUDIT. He’s<br />
worked in technical roles since 2013, with a passion for<br />
cybersecurity, data protection, storage, and automation.<br />
Stealthbits is a cybersecurity software company focused on<br />
protecting sensitive data and the credentials attackers use to<br />
steal that data.<br />
Dan can be reached online at linkedin.com/in/danieljpiazza<br />
and at our company website https://www.stealthbits.com/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 76<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Zero Trust Model Is Meaningless Without TLS Inspection<br />
Protecting users against modern, invisible cyber threats<br />
By Babur Khan, Technical Marketing Engineer at A10 Networks<br />
A security strategy is only as strong as its weakest point. No matter how extensive your network defenses<br />
are, if there is even one blind spot, you are still vulnerable to attacks. This is true even for the Zero Trust<br />
model, at the core of modern cybersecurity. Fortunately, there is a way to fix it.<br />
Zero Trust Model: The Perfect Security Strategy…with a Catch<br />
Zero Trust security / Zero Trust model has become a critical element of network defense. Its rise has<br />
been driven by the way traditional concepts of secured zones, perimeters, network segments—even<br />
“inside” and “outside”—have been rendered outdated by the modern cyberthreat landscape. After all, you<br />
can’t count on walls to keep you safe from insider attacks by people with legitimate access, prevent multilevel<br />
attacks designed to bring networks down, or stop lateral movement during the course of an attack.<br />
• The Zero Trust model responds to these challenges by adopting the approach of “trust nobody”—inside or<br />
outside the network. <strong>Cyber</strong>security strategies are redesigned accordingly along four key principles:<br />
• Create network micro-segments and micro-perimeters to restrict east-west traffic flow and limit excessive<br />
user privileges and access as much as possible.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 77<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
• Strengthen incident detection and response using comprehensive analytics and automation.<br />
• Integrate solutions across multi-vendor networks with ease, so they can work together seamlessly, enabling<br />
compliance and unified security. The solutions should also be easy to use so that additional complexity can<br />
be removed.<br />
• Provide comprehensive and centralized visibility into users, devices, data, the network, and workflows.<br />
This sounds good in principle. Even the name “Zero Trust Security” is reassuring, with absolute terms<br />
that suggest absolute protection. But there is a catch: The Zero Trust model works only when you have<br />
full visibility into people and their activities. If something is invisible, there is no way for you to ensure that<br />
it does not pose a risk. And that is true for the vast majority of network traffic thanks to the widespread<br />
use of encryption.<br />
Zero Trust Model / Zero Trust Security Blind Spot<br />
Encryption is now ubiquitous across the internet. Google reports that over 90 percent of the traffic passing<br />
through its services is encrypted, and the numbers are similar for other vendors as well. This trend has<br />
been great for privacy—but it is devastating for security, whether you are implementing a Zero Trust<br />
model or something different. As encryption renders network traffic invisible to legacy solutions, your<br />
network’s security stack is effectively useless.<br />
In response, many security vendors incorporate TLS inspection into their solutions. In effect, they decrypt<br />
traffic, inspect it, and then re-encrypt it before passing it on. But this “distributed TLS inspection”<br />
approach, in which decryption and re-encryption happens separately for each device in the security stack,<br />
brings problems of its own. Network bottlenecks and performance problems typically compromise service<br />
quality for business users and customers—an unacceptable penalty in today’s competitive business<br />
environment. What is more, the need to deploy private keys in multiple locations across the multi-vendor,<br />
multi-device security infrastructure expands the attack surface, increasing risk.<br />
For the Zero Trust model to deliver on its promise, companies need a way to eliminate the Zero Trust<br />
model blind spot without sacrificing service quality.<br />
Full Encrypted Traffic Visibility via TLS inspection<br />
avoid the downsides of distributed encryption, a solution must provide full visibility to the enterprise<br />
security infrastructure through a dedicated, centralized SSL decryption solution. This needs to be<br />
complemented by a multi-layered security approach for optimal protection.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 78<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Solutions need to take a “decrypt once, inspect many times” approach, letting the entire security<br />
infrastructure inspect all traffic in clear text, at fast speeds, to avoid performance penalties and excess<br />
complexity. The following additional features also support the four key principles of Zero Trust discussed<br />
above:<br />
User access control – SSL Insight can enforce authentication and authorization policies to restrict user<br />
access, log detailed user access information, and provide the ability to apply different security policies<br />
based on user and group IDs. Additional security services including URL filtering, application visibility<br />
and control, threat intelligence, and threat investigation help strengthen the security efficacy of the entire<br />
enterprise network.<br />
Micro-segmentation – Granular traffic control, user and group ID-based traffic control, and support for<br />
multi-tenancy facilitate micro-segmentation.<br />
Rapid incident detection and response – The Harmony® Controller SSLi app provides comprehensive,<br />
centralized visibility, and the ability to manage all SSL Insight deployments remotely from one location,<br />
ensuring that uniform policies are applied across the organization.<br />
Flexible deployment and integration – As a vendor-agnostic solution, SSL Insight integrates easily<br />
with existing security devices by placing them in a secure decrypt zone.<br />
Ease of Use – SSL Insight can be deployed within minutes in any network environment without causing<br />
any network outages or disruptions. Centralized management enables full visibility, uniform security<br />
policy enforcement, unified analytics, and SaaS traffic visibility across all SSL Insight deployments.<br />
Without centralized and dedicated SSL inspection/TLS inspection, the Zero Trust model is unable to do<br />
what it was designed to do – protect our networks, users and data from threats residing inside and outside<br />
the network. SSL Insight provides a complete solution that not only enables the inspection of all incoming<br />
and outgoing traffic, but also provides additional security services that can help strengthen your Zero<br />
Trust strategy<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 79<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Babur Nawaz Khan is a Technical Marketing Engineer at A10<br />
Networks. He primarily focuses on A10's Enterprise Security and<br />
DDoS Protection solutions. Prior to this, he was a member of A10's<br />
Corporate Systems Engineering team, focusing on Application<br />
Delivery Controllers. Babur holds a master's degree in Computer<br />
Science from the University of Maryland, Baltimore County.<br />
Babur can be reached at our company website<br />
https://www.a10networks.com/contact-us/contact-sales/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 80<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Automated Pentesting – Ready to Replace Humans?<br />
Is Automation the end of human pentesting?<br />
By Alex Haynes, CISO, CDL<br />
In the past few years, automation in many spheres of <strong>Cyber</strong>security has increased dramatically, but<br />
pentesting has remained stubbornly immune to this. While crowdsourced security has evolved as an<br />
alternative to pentesting in the past 10 years, it’s not based on automation but simply throwing more<br />
humans at a problem (and in the process, creating its own set of weaknesses). Recently though,<br />
automated pentesting tools have now surfaced to a point where they are usable to automate pentesting<br />
under certain conditions. This begs the question, are human pentesters heading for redundancy? Can<br />
we replace them with these tools?<br />
To answer this question, we need to understand how they work, and crucially, what they don’t do. While<br />
I’ve spent a great deal of the past year testing these tools and comparing them in like-for-like tests against<br />
a human pentester, the big caveat here is that these automation tools are improving at a phenomenal<br />
rate, so depending on when you read this, it may already be out of date.<br />
First of all, the ‘delivery’ of the pentest is done by either an agent or a VM, which effectively simulates the<br />
pentester’s laptop and/or attack proxy plugging into your network. So far, so normal. The pentesting bot<br />
will then perform reconnaissance on its environment by performing identical scans to what a human<br />
would do – so where you often have human pentesters perform a vulnerability scan with their tool of<br />
choice or just a ports and services sweep with nmap or masscan. Once they’ve established where they<br />
sit within the environment they will filter through what they’ve found and this is where their similarities to<br />
vulnerability scanners end.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 81<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Vulnerability scanners will simply list a series of vulnerabilities and potential vulnerabilities that have been<br />
found with no context as to their exploitability and will simply regurgitate CVE references and CVSS<br />
scores. They will sometimes paste ‘proof’ that the system is vulnerable but don’t cater well to false<br />
positives. The automated pentesting tools will then choose out of this list of targets the ‘best’ system to<br />
take over, making decisions based on ease of exploit, noise and other such factors. So for example, if it<br />
was presented with an windows machine which was vulnerable to eternalblue it may favour this over<br />
brute forcing an open SSH port that authenticates with a password as it’s a known quantity and much<br />
faster/easier exploit.<br />
Once it gains a foothold, it will propagate itself through the network, mimicking the way a pentester or<br />
attacker would do it, but the only difference being it actually installs a version of its own agent on the<br />
exploited machine and continues its pivot from there (there are variations in how different vendors do<br />
this). It then starts the process again from scratch, but this time will also make sure it forensically<br />
investigates the machine it has landed on to give it more ammunition to continue it’s journey through your<br />
network. This is where it will dump password hashes if possible or look for hardcoded credentials or SSH<br />
keys. It will then add this to its repertoire for the next round of its expansion. So while previously it may<br />
have just repeated the scan/exploit/pivot this time it will try a pass the hash attack, or try connecting to<br />
an SSH port using the key it just pilfered. Then, it pivots again from here and so on and so forth.<br />
If you notice a lot of similarities between how a human pentester behaves then you’re absolutely right –<br />
a lot of this is exactly how pentesters (and to a less extent) attackers behave. The toolsets are similar<br />
and the techniques and vectors used to pivot are identical in many ways. So what’s different?<br />
Well first of all, the act of automation gives a few advantages over the ageing pentesting methodology<br />
(and equally chaotic crowdsourced methodology).<br />
The speed of the test and reporting is many magnitudes faster, and the reports are actually surprisingly<br />
readable (after verifying with some QSA’s, they will also pass the various PCI-DSS pentesting<br />
requirements). No more waiting days or weeks for a report that has been drafted by humans hands and<br />
gone through a few rounds of QA before being delivered into your hands. This is one of the primary<br />
weaknesses of human pentests since the adoption of continuous delivery has caused many pentest<br />
reports to become out of date as soon as they are delivered since the environment on which the test was<br />
completed has been updated multiple times since, and therefore, had potential vulnerabilities and<br />
misconfigurations introduced that weren’t present at the time of the pentest. This is why traditional<br />
pentesting is more akin to a snapshot of your security posture at a particular point in time.<br />
Automated pentesting tools get around this limitation by being able to run tests daily, or twice daily, or on<br />
every change, and have a report delivered almost instantly. This means you can potentially pentest your<br />
environment daily and detect changes in configuration on an exploitability level on a daily basis too rather<br />
than relying on a report delivered weeks later.<br />
The 2 nd advantage is the entry point. While with a human pentest you may typically give them a specific<br />
entry point into your network, with an automated pentest you can run the same pentest multiple times<br />
from different entry points to uncover vulnerable vectors within your network and monitor various impact<br />
scenarios depending on the entry point. While this is theoretically possible with a human it would require<br />
a huge budgetary investment due to having to pay each time for a different test.<br />
So what are the downsides to all this? Well first off, automated pentesting tools don’t understand web<br />
applications – at all. While they will detect something like a web server at the ports/services level they<br />
won’t understand that you have an IDOR vulnerability in your internal API or a SSRF in an internal web<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 82<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
page that you can use to pivot further. This is because the web stack today is complex, and to be fair<br />
even specialist scanners (like Web Application Scanners), have a hard time detecting vulnerabilities that<br />
aren’t low hanging fruit (such as XSS or SQLi). This leads to a secondary weakness in automated<br />
pentesting tools in that you can only use them ‘inside’ the network. As most exposed company<br />
infrastructure will be web based, and automated pentesting tools don’t understand these, you’ll still need<br />
to stick to a good ol’ fashioned human pentester for testing from the outside.<br />
To conclude, the technology shows a lot of promise, but it’s early days and while they aren’t ready to<br />
make human pentesters redundant just yet, they do have a role in meeting today’s offensive security<br />
challenges that can’t be met without automation.<br />
About the Author<br />
Alex Haynes is a former pentester with a background in offensive<br />
security and is credited for discovering vulnerabilities in products by<br />
Microsoft, Adobe, Pinterest, Amazon Web Services and IBM. He is<br />
a former top 10 ranked researcher on Bugcrowd and a member of<br />
the Synack Red Team. He is currently CISO at CDL. Alex has<br />
contributed to United States <strong>Cyber</strong> Security Magazine, <strong>Cyber</strong><br />
<strong>Defense</strong> Magazine, Infosecurity Magazine, and IAPP tech blog. He<br />
is also a regular speaker at security conferences on the topic of<br />
offensive security.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 83<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Mitigating the Pitfalls of Onedrive Security<br />
By Veniamin Simonov, Director of Product Management, at NAKIVO Inc.<br />
With COVID-19 triggering a potential long-term shift to working from home, SecOps teams are coming<br />
under increasing pressure to keep data safe and systems secure. When it comes to cloud storage and<br />
the protection of business data and applications, remote work has increased the threat of data loss and<br />
data theft. Teleworking has also laid bare the data safety shortcomings of even established services like<br />
Microsoft OneDrive.<br />
Millions of people and businesses rely on OneDrive as a cloud storage and synchronization service and<br />
for good reason. It’s been built with cybersecurity in mind. It is also one of the best and most powerful<br />
cloud storage and syncing apps around, beating out DropBox, iCloud and Google Drive thanks to its ease<br />
of use and simplicity. However, users should not rush to store all their data in OneDrive or any online<br />
platform without carefully considering the data safety risks of cloud storage. If you want to use OneDrive<br />
safely you should know the risks beforehand so you can make better decisions to reduce the probability<br />
of undesired scenarios.<br />
The three main safety and security concerns users should consider are data theft, data corruption and<br />
data loss. In this article, we discuss how to mitigate them.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 84<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Not even Microsoft is fool proof<br />
While Microsoft maintains that files stored on OneDrive are secure because they are encrypted on<br />
Microsoft servers, this doesn’t mean you cannot be hacked. Aggressive hackers can access your drive<br />
through trivial but surprisingly common mistakes. Using simple passwords and storing them in obvious<br />
locations on your computer is a great example of a common error that could weaken your security. If it’s<br />
easy for you to find, then it’s easy to do so for a persistent hacker too.<br />
The risk is only further heightened by operating on public Wi-Fi networks, especially if you need to log in<br />
to your Office 365 account. If the firewall is configured improperly on a router, attackers can use open<br />
ports and vulnerabilities to infect computers.<br />
Another risk factor is providing more permissions than needed when sharing files on OneDrive, which<br />
gives other users the power to delete data, write unwanted changes to files and corrupt files if their<br />
computers are infected by viruses. Companies should avoid granting administrator privileges when they<br />
are not needed. Administrators should create regular user accounts for themselves for sending emails<br />
and working on routine tasks such as sharing files on OneDrive and editing Office 365 documents.<br />
Disaster can also strike when using an operating system without the latest security patches for software<br />
such as Windows or Flash Player. Browsers can also have hidden vulnerabilities that can lead to exploits<br />
as hackers manage to get control of a user’s machine.<br />
Of course, all these risks can be running in the background without the user’s knowledge for a prolonged<br />
period of time. A delayed response only makes matters worse and further compromises users, resulting<br />
in significant losses and making it difficult to restore any lost data. However, users may be able to prevent<br />
data loss by using the OneDrive security recommendations, which are rules to abide by for optimal use<br />
of cloud software.<br />
What are the security recommendations for using OneDrive?<br />
There are the obvious recommendations, such as using a strong password and making sure that your<br />
anti-virus software is up to scratch to make sure that it can detect malicious files on your computer and<br />
delete them to prevent infection and data loss. But there are also other official recommendations, such<br />
as deploying two-factor authentication with the Microsoft Authenticator mobile app. This will stop anyone<br />
from getting to your files even if they figure out your password. For example, if a thief accesses your<br />
device with a saved password, your phone acts as a second form of authentication.<br />
You can also protect more sensitive data with the OneDrive personal vault, as it requires another form of<br />
identification and automatically locks after a certain amount of time. This is especially useful if your device<br />
is compromised while your regular storage folder is unlocked.<br />
OneDrive also provides the Office 365 admin center for administrators of organizations to manage their<br />
security settings centrally. Its Security and Compliance Center and automation tools and security<br />
monitoring systems allow users to configure automated alerts that are triggered by suspicious activity.<br />
Exchange Online Protection is a feature that can protect Office 365 accounts in your organization against<br />
spam and malware. Microsoft Threat Intelligence and Advanced Threat protection also help protect Office<br />
365 users against malware.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 85<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
It’s the little things that count<br />
On any account, a user should not underestimate the importance of security or data protection. Avoiding<br />
the little errors, such as storing passwords, payment data and other critical files on OneDrive in a careless<br />
manner can make all the difference when it comes to creating a secure home office set up for employees.<br />
It’s the small changes that can make a big difference when it comes to data protection.<br />
This is because most of the security concerns for OneDrive stem from oversight and user error. To date,<br />
there is no evidence of data leaks caused by Microsoft errors from data centers used for OneDrive cloud<br />
storage. Microsoft uses modern technologies and standards for security and removes any found issues<br />
as soon as they are identified. Microsoft helps protect its users from potential threats by identifying and<br />
analyzing software and online content. When you download, install and run software, it checks the<br />
reputation of downloaded programs and ensures you’re protected against known threats. Users are also<br />
warned about software that is unidentifiable. On Microsoft’s end, encryption is performed when storing<br />
data on Microsoft servers and when transferring data over networks – and encryption is the king of data<br />
protection.<br />
Overall, just because Microsoft hasn’t experienced a OneDrive hack itself, doesn’t mean that users don’t<br />
have to worry about that. This is especially a risk when the virtual workforce is working from a variety of<br />
locations and accessing cloud storage via a number of devices. No antivirus or protection technology is<br />
perfect. So, as remote home and business users, it’s now more important than ever for them to be aware<br />
of and deploy OneDrive’s security recommendations, and that they work with network administrators to<br />
keep their networks safe in today’s accelerated threat landscape. If users can take a proactive approach<br />
and apply recommendations as they are communicated, OneDrive will continue to be a viable cloud<br />
service to support today’s remote working environment. End of article.<br />
About the Author<br />
My Name is Veniamin Simonov. I am Director of Product<br />
Management at Nakivo, and I am responsible for driving the<br />
execution of features and functionality for NAKIVO Backup &<br />
Replication. My background includes several positions in product<br />
management, with 10 years of experience working with<br />
virtualization and cloud technology.<br />
Veniamin can be reached online at @Naviko and at our company<br />
website https://www.nakivo.com/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 86<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Emerging Technologies Create A New Line of <strong>Defense</strong> in<br />
The Fight Against Fraud<br />
ARTIFICIAL INTELLIGENCE POWERS VOICE BIOMETRICS FOR A MORE SECURE,<br />
FRICTIONLESS CUSTOMER EXPERIENCE<br />
By Brett Beranek, Vice President and General Manager, Security and Biometrics, Nuance<br />
Communications<br />
A growing number of organizations are deploying biometrics for a simpler, more secure way for<br />
customers to validate their identities and do business with your organization. These emerging<br />
technologies, often powered by artificial intelligence, not only help to combat near-constant attacks by<br />
hackers, but they also provide your customers with high levels of security and convenience.<br />
Social disruptions, such as a global pandemic, produce new realities that create paradigms in myriad<br />
areas of life. That can mean accelerated transitions into new ways of living, from permanent work-fromhome<br />
arrangements and telehealth to remote schooling and virtual socializing. Simultaneously, these<br />
digital behaviors are opening new doors to hackers and fraudsters, who remain ready to capitalize on<br />
any vulnerabilities, chaos, and uncertainty.<br />
For example, Nuance has learned from its customers that the volume of fraud attacks is on the rise –<br />
ranging from 200% - 400% in the past few weeks, depending on the industry. Some of these relate<br />
directly to the pandemic, with recent reports 1 suggesting there have been at least 500 coronavirus-related<br />
scams and over 2,000 phishing attempts so far. This figure is only set to increase as time goes by. These<br />
crimes come with a hefty price tag, costing the global economy more than $5 trillion annually 2 .<br />
1<br />
The Guardian, April <strong>2020</strong><br />
2 Crowe Financial Cost of Fraud Report.<br />
3<br />
Choose.co.uk, March <strong>2020</strong><br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 87<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Fraud is preventable<br />
Your first line of defense often means reminding your customers to use unique passwords not replicated<br />
on other sites, to enable multi-factor authentication, and to establish challenging questions to verify<br />
identities in the case of a forgotten password. As long as passwords are the first line of defense, then<br />
fraud losses will continue increasing year-after-year as it has for the past two decades. Fraudsters will<br />
leverage the tried-and-true methods of phishing for passwords, or leveraging the password reset process<br />
(e.g. OTP SMS or security questions) to perpetrate their fraud. I recently interviewed a fraud victim, Rob<br />
Ross, who lost over $1m because of this OTP SMS password reset mechanism alone. As an industry,<br />
we need to definitely put a big red X on passwords, password reset processes, and OTP SMS<br />
mechanisms if we ever stand a chance to start reversing the trend and see decreases in fraud losses.<br />
Server-Side biometric authentication and fraud prevention solutions offer a new line of defense<br />
Server-side biometrics modalities such as voice biometrics have proven hyper-effective at eliminating<br />
passwords, PINs, and security questions as authentication mechanisms in contact centers. You may<br />
have experienced yourself, maybe the last time you called your bank, that you were seamlessly<br />
authenticated this way. What you may not be aware of, is that regardless of if you authenticated this way<br />
or not, voice biometrics was also used to detect fraud on all incoming calls. This is the benefit of an<br />
integrated approach to using biometrics for both fraud prevention and authentication. Organizations have<br />
reported phenomenal results when this approach is taken; For example, HSBC reported over $500m in<br />
reduced fraud losses in 2019 due to this approach 3 .<br />
How is it that contact centers have become, in many cases, more innovative than digital channels such<br />
as mobile apps and websites when it comes to authentication and fraud prevention? One explanation is<br />
in the easy access to “free” device side biometric modalities, such as fingerprint readers and facial<br />
recognition on smartphones, which unfortunately by their very design, have had no impact on fraud<br />
prevention or the elimination of passwords. At the end of the day, because these biometrics modalities<br />
are device-based, they can’t be used to detect fraudsters (no ability to create a watchlist), and they require<br />
a reset process – which is often a PIN or a password.<br />
We have fallen into the trap of “free” and this has represented an immense gift to the fraud community.<br />
Device-side biometrics have created an illusion of increased security, which we are now paying a hefty<br />
price for.<br />
Server-side biometrics, deployed in an integrated fashion for both authentication and fraud prevention,<br />
are an essential tool to rid ourselves of passwords, security questions and OTP SMS. Let us learn from<br />
our peers in the contact center industry and apply these technologies to all of our customer engagement<br />
channels and finally put an end to the incessantly rampant fraud scourge.<br />
Consider a contact center environment with an integrated biometric authentication and fraud prevention<br />
solution in place. When a customer calls into the contact center, they can ditch the password and PIN<br />
and instead use the power of their voice, simply speaking the phrase “My voice is my password” to gain<br />
immediate access to their account. Biometric authentication analyzes more than 140 physical and<br />
behavioral characteristics, including the speaker’s accent and rhythm, to create a unique, individual<br />
voiceprint. In addition, the intelligence built into the authentication software can distinguish between live<br />
speakers and recordings by monitoring sound frequencies. As a result, these voiceprints are vastly more<br />
secure than conventional passwords; that is, hackers can steal a password, but they can’t steal a person’s<br />
voice or reverse-engineer it, even if they were to gain access to the voiceprint from the server.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 88<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Beyond seamless, frictionless authentication to confirm a customer’s identity, an AI-powered fraud<br />
prevention platform can engage in real-time authentication to help ensure swift and accurate fraud<br />
prevention. If a criminal were to insert him- or herself into a conversation, for example, the intelligence<br />
can quickly identify it and help to prevent financial losses. Likewise, by automatically analyzing calls in<br />
real time, intelligent fraud prevention solutions can easily and quickly identify potential fraud cases before<br />
a crime is committed.<br />
These solutions can help to improve your security efforts across multiple channels (interactive voice<br />
response, SMS chat, virtual assistant, and live chat) to create an efficient, intelligent, more secure<br />
customer experience. And while these solutions can help shore up your boundaries and protocols now<br />
as you adapt to and cope with a time of social disruption, they also set the foundation for a more secure<br />
future.<br />
About the Author<br />
Brett Beranek is the Vice President and General Manager at Nuance<br />
Communications. He is responsible for overseeing every aspect of the<br />
security and biometric business at Nuance. Prior to joining Nuance, he<br />
has held over the past decade various business development &<br />
marketing positions within the enterprise B2B security software space.<br />
Beranek has extensive experience with biometric technologies, in<br />
particular in his role as a founding partner of Viion Systems, a startup<br />
focused on developing facial recognition software solutions for the<br />
enterprise market. Beranek also has in-depth experience with a wide<br />
range of other security technologies, including fingerprint biometrics,<br />
video analytics for the physical security space and license plate<br />
recognition technology. He has earned a Bachelor of Commerce, Information Systems Major, from McGill<br />
University as well as an Executive Marketing certificate from Massachusetts Institute of Technology’s<br />
Sloan School of Management. Brett can be reached on our company website https://www.nuance.com.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 89<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
How to Adapt Financial Services to The Online Space<br />
Securely – And Still Sleep at Night<br />
Financial institutions, like eCommerce industries, are leading today’s fast, pandemic-driven transition to<br />
the digital space. A change that will become a norm.<br />
By Robert Capps, VP of Marketplace, NuData, a Mastercard Company<br />
Branches have now reopened, but many customers will continue to transact online and enjoy the<br />
convenience of banking in pajamas. In a recent NuData webinar with Aite Group’s Julie Conroy, she<br />
shared that, “one bank’s public investor filing says that 75% of their servicing transactions are now digital<br />
in the wake of the pandemic.” In addition, for many financial service employees, the period of remote<br />
work that began in the spring is still ongoing, with no clear end in sight.<br />
Few would disagree that this digital transformation is a positive development that makes financial<br />
services more accessible to everyone, but it doesn’t come without risks. When evolution is rushed, the<br />
established technologies and processes may leave vulnerabilities that bad actors can take advantage of.<br />
To support a streamlined, consistent digital customer experience while also ensuring security, your<br />
organization may need to add additional layers of protection.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 90<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Add a pandemic to fraud prevention<br />
One-third of finance login attempts within the NuData client network are high risk. This is not a negligible<br />
proportion of the average financial institution’s online traffic.<br />
As Robert Capps explains during the same webinar with the Aite Group, “even when those login attempts<br />
are unsuccessful, they hurt your bottom line by raising operational costs.” He also added, “You’re paying<br />
for more bandwidth, more servers, more licensing fees to run software on those servers, more space in<br />
a data center, more power — and so on — all to process transactions that have zero to negative value<br />
for your company.” For many companies, these expenses run into the double-digit millions or more. By<br />
getting top-of-funnel fraud attacks under control, you could reduce your fraud losses but also impact your<br />
bottom line.<br />
Fraud prevention was already a mind-bending challenge, but the pandemic has made it even worse for<br />
many financial institutions. With many offices closed and travel restricted, users log in from fewer<br />
locations on fewer different devices, making them, at first sight, easier to identify and differentiate from<br />
fraudsters. But financial customers have also changed their habits in sometimes unpredictable ways.<br />
They complete different types of transactions and transact more frequently, at different times of day,<br />
compared to before the pandemic. These behavioral changes thwart some financial institutions’ existing<br />
fraud risk models, increasing false positives, while still letting fraud through.<br />
It doesn’t help that cybercriminals are adopting ever more sophisticated tactics to bypass financial<br />
institutions’ defenses. According to NuData research, in the first half of <strong>2020</strong>, 96% of attacks against<br />
financial institutions were sophisticated. These are attacks that tried to mimic human behavior in an<br />
attempt to blend in with legitimate traffic. Some attacks take it one step further and solve bot challenges<br />
such as CAPTCHAs by sending them to human farms — essentially call centers for fraudsters. Humanfarm<br />
workers are paid to process as many requests as possible, manually. Financial institutions need to<br />
understand how these attacks happen and how they behave, to tell them apart from legitimate users.<br />
WFH-ing safely<br />
Remote work poses another growing challenge for financial institutions, as it may increase some types<br />
of fraud risk. Many cyberthreats start at home — for example, a personal device on the home network<br />
infected with malware can be an entry point. Bad actors can use that back door to infect a corporate<br />
asset on the same network. It’s increasingly common for the initial attacker to sell such access to a third<br />
party, who then exploits the breach to compromise user data or perform any number of malicious actions.<br />
5 steps to lose the fear of cyberthreats<br />
When shoring up your cybersecurity protections, prioritize solutions — both internal and external — that<br />
enable an uninterrupted customer journey. As mentioned during the Aite Group webinar, 22% of<br />
consumers left their credit or debit card issuer because of a poor experience. Here are a few ways to<br />
tighten security without adding too much friction.<br />
1. Tighten permissions for administrative users. Lessen the risk of internal fraud or data leakage<br />
by reducing the amount of sensitive information that employees can access, for example, by<br />
anonymizing personally identifiable information (PII). Behavioral analytics tools (see #5 below)<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 91<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
can also help identify anomalous behaviors, such as an employee accessing datasets that aren’t<br />
necessary for their work.<br />
2. Use a VPN to enable access to internal tools. This is a best practice when people are working<br />
from home networks that are generally less secure than networks at the operational center.<br />
3. Employ a bot detection tool to block automated attacks. While bot detection is often placed<br />
as a protection for customer accounts, during COVID-19, we’ve seen an increase in bots directed<br />
at employee services in the work-from-home environment. Protect both sides to minimize your<br />
risk.<br />
4. Use behavioral analytics and passive biometrics to validate identity. A worker at a human<br />
farm cutting and pasting stolen personal information from a spreadsheet doesn’t interact with an<br />
online form the same way as a “good” user who is inputting their own information they know by<br />
heart. And your trusted employee doesn’t use a mouse quite the same way as their roommate<br />
who’s borrowing their computer. Understanding baseline behavioral and passive biometric<br />
signatures for employees and customers lets you quickly flag anomalies that call into question<br />
who’s actually sitting in front of the screen, even if they had all the right credentials.<br />
5. Educate both employees and customers. In any system of cyber defenses, humans are usually<br />
the weakest link. Strengthen it by teaching both customers and employees to look out for threats<br />
in their everyday environment, especially social engineering attacks. On the employee side, it’s<br />
especially important to educate call center workers who may be focused on delivering great<br />
customer experience more than looking out for social engineering threats.<br />
The strongest cyber defenses are not one but many at once. If accelerating your digital transformation<br />
efforts during COVID-19 didn’t leave time to add the necessary protections, now is a good time to start<br />
catching up. By setting up the infrastructure to make remote work more secure, educating employees<br />
and customers about cyber threats and using advanced tools to continuously validate user identity, you<br />
can make your new normal more secure — without sacrificing customer experience.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 92<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Robert Capps<br />
VP of Marketplace, NuData, a Mastercard Company<br />
Robert is NuData Security’s Vice President of Marketplace<br />
Innovation. He is an industry-recognized technologist,<br />
thought leader, and advisor with over twenty-five years of<br />
experience in retail, payments, financial services, and<br />
cybercrime investigation and prosecution. Robert brings his<br />
industry insight and vision to drive market-leading products<br />
and services for NuData Security, and is the public<br />
spokesperson for the organization.<br />
He is passionate about bringing safety to the digital world in<br />
the shape of cutting-edge technologies, so companies and end users don’t have to worry about risks<br />
from cybercrime.<br />
In previous roles, Robert served as the Global Head of Payments, Security and Fraud for StubHub, as<br />
the Head of Consumer Security for Wachovia and Golden West Financial, and continues to advise early<br />
stage startups.<br />
Robert Capps can be reached online Robert.capps@mastercard.com, nudatasecurity.com<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 93<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong>security Best Practices for End Users<br />
By Jay Ryerse, CISSP, Vice President of <strong>Cyber</strong>security Initiatives, ConnectWise<br />
When it comes to cybersecurity, there are a few misunderstandings. Many clients believe that they’re<br />
completely secure and risk-free after hiring a technology solution provider (TSP) to manage their security.<br />
However, the inaction of employees is the biggest risk to an organization’s information security.<br />
Human error is one of the main points of weakness. In fact, it is reported that 90% of cyberattacks are<br />
caused by human behavior. Knowing this, it’s crucial for businesses to undergo cybersecurity training.<br />
This will ensure that team members learn how to protect sensitive information, understand their<br />
responsibilities, and recognize signs of a malicious threat.<br />
As a TSP, you will mostly likely be responsible for providing security education, training, and guidance<br />
on policies for your clients.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 94<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Security awareness training should focus on:<br />
• Phishing and social engineering<br />
• Access, passwords, and connection<br />
• Device security<br />
• Physical security<br />
Let’s dive into the tips and best practices that you can teach your clients and end users.<br />
Phishing and Social Engineering<br />
An attack that deceives a user or administrator into disclosing information is considered social<br />
engineering. Phishing, a common social engineering attack, is an attempt to gain control of sensitive<br />
information like credit cards and passwords through email or chat.<br />
Phishing and social engineering attacks are extremely successful because they appear to come from a<br />
credible source. Some giveaways of a phishing attack include links containing random numbers and<br />
letters, typos, an odd sense of urgency, or a general sense that something feels off about the request.<br />
Avoiding Phishing and Social Engineering Attacks<br />
What should clients do if they’ve been involved in a phishing attack?<br />
• Don’t click! If end users feel like something isn’t right, they shouldn’t click on a link or attachment or give<br />
out sensitive information.<br />
• Tell IT or your TSP. Alerting the right person or department in a timely manner is critical in preventing a<br />
phishing scam from spreading company-wide. Always encourage your clients to ask you to investigate or<br />
provide next steps.<br />
Access, Passwords, and Connection<br />
It’s important to go over the different elements of the network, such as access privileges, passwords, and<br />
the network connection itself during cybersecurity training.<br />
Your clients should be aware of which colleagues are general users versus privileged users. Typically,<br />
privileged access is given to users who carry out administrative-level functions or need access to<br />
sensitive data. Your client’s employees should know what user type they are in order to understand what<br />
applications, information, or functions are accessible to them.<br />
When it comes to passwords, especially those used to access IT environments, employees need to be<br />
using best practices. Passwords should be unique to each application or site, contain at least eight<br />
characters with a combination of letters and special characters, and exclude obvious information like<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 95<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
names and birthdays. Generally, it’s best to change and/or update passwords about every six months.<br />
Password management applications, like 1Password, can help make this process easier.<br />
Employees should be cautious about using network connections outside of their home or work. Even<br />
encrypted data on a personal device can be exposed to vulnerabilities through a public network<br />
connection. It’s important to educate and encourage end users to only connect to trusted networks or<br />
secure the connection with proper VPN settings.<br />
Device Security<br />
Today, there is an increasing popularity to Bring Your Own Device (BYOD), meaning an increased<br />
number of mobile or personal devices in the workplace, connecting to the corporate network, and<br />
accessing company data. Introducing outside devices to the network increases the amount of entry points<br />
for threats. With this in mind, mobile devices need to be securely connected to the corporate network and<br />
remain in the employee’s possession.<br />
Personal mobile devices are vulnerable to the same threats that company desktops and laptops face.<br />
Without pre-installed endpoint protection, tablets and smartphones may be even less secure. It’s<br />
important for users to be aware of the applications they’re installing, websites they’re browsing, and links<br />
they’re clicking on.<br />
Physical Security<br />
Online threats aren’t the only risks that employees need to be aware of. Physical security is also a factor<br />
in keeping sensitive information protected. How many times have you accidentally left your computer or<br />
mobile device unattended? It happens to all of us. Unfortunately, an employee’s data would instantly be<br />
at risk if someone decided to steal their unattended phone or log in to their computer.<br />
Here are a few ways that clients can improve their physical security in and out of the office:<br />
• Keep devices locked. Get in the habit of doing this every time you leave your desk. For Windows users,<br />
press and hold the Windows key, then press the “L” key. For Mac users, press Control + Shift + Eject (or<br />
the Power key) at the same time.<br />
• Secure your docs. Keep all of your documents in a locked cabinet, rather than leaving sensitive information<br />
out and about. Before leaving for the day, store important documents in a safe or locked cabinet.<br />
• Properly discard info. When throwing away or getting rid of documents and files, make sure you’re<br />
shredding them and discarding them appropriately.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 96<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Jay Ryerse, CISSP, is the Vice President of <strong>Cyber</strong>security<br />
Initiatives for ConnectWise. He brings more than 25 years<br />
of experience providing information technology and<br />
security solutions to businesses of all sizes. He’s the<br />
previous owner of a successful Atlanta-based MSP and<br />
was the CEO of CARVIR, the cybersecurity company<br />
acquired by Continuum in 2018. Jay is the author of<br />
“Technology 101 For Business Owners”, was named to<br />
“The World’s TOP MSP Executives, Entrepreneurs &<br />
Experts” in 2014 by MSPmentor.net, and was the “2015<br />
Better Your Best” winner from Technology Marketing Toolkit. Today he works closely with IT service<br />
providers and MSPs to provide insight and best practices for securing business networks.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 97<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
The One-Stop Spear Phishing <strong>Defense</strong> Guide You Will<br />
Ever Need<br />
By Jeff Penner, Senior Manager at ActiveCo Technology Management.<br />
Is your business ready to combat spear phishing attacks?<br />
It’s a question that gives many seasoned CTOs bad jitters.<br />
The truth is that you can shore up your technical systems with the latest IDS systems, firewalls and all<br />
manners of monitoring, but with each new report of unprecedented data and security breach coming in<br />
now, the threat of security vulnerabilities always seems to loom only a stone’s throw away. The problem<br />
does not lie only with the detection and flagging capabilities of your safety systems. It is likely that your<br />
IT systems are doing a sophisticated job of that already. But that doesn’t guarantee your safety from<br />
phishing attacks.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 98<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
IT Outsourcing firm has considerable experience in both planning and executing pre-emptive safety<br />
tactics to protect businesses from spear phishing. In this article, we will lay out exactly why and how your<br />
business needs to be covered beyond standard IT double checks.<br />
Not a computer problem, but a very human one<br />
The scope of building systemic responses against phishing attacks is always limited as it’s mostly limited<br />
to a purely technical response. This is simply not enough. There can be no systemic defense against<br />
phishing as the threats/ vulnerabilities can literally come from anywhere in the system.<br />
Phishing attacks almost always catch businesses unawares simply because beyond a small coterie of<br />
technical experts, the rest of people involved simply cannot grasp the scope of how a few apparently<br />
insignificant human errors/ breach of protocols can have such a devastating impact on the business.<br />
No matter how many horrifying security breaches pop up in the news every day, the average office-goer<br />
(which may include even high-ranking executives and managers) is trained to think of security<br />
vulnerabilities as ‘someone else’s (most likely IT’s) problem’.<br />
In my view, this mindset problem causes more vulnerability in the system than any technical loophole<br />
you may encounter.<br />
Recognize that clever social engineering can always beat the best-designed firewalls<br />
As far as security systems are concerned, a business can only be as strong as the human links holding<br />
it together. This means enabling everyone from the busboy and interns to the executives running on<br />
attention bias by default to learn how close and personal security problems can get. Their imaginations<br />
need to extend more than the obvious Nigerian prince scams to understand just how sophisticated<br />
targeted phishing attacks can get just by using information in the public domain to be able to dupe<br />
everyone from high-ranking political officers, bureaucrats, company leaders and entire boards and<br />
trustees of organizations.<br />
Whether your system is targeted with phishing, spear fishing or vishing attacks, your staff needs to be<br />
made aware enough about each to detect anomalies a mile way. They also need to be empowered<br />
enough to be able to be proactive when an emergency arises and resourceful enough to follow protocols<br />
without fearing a backlash when they report an incident or admit an error. A toxic or emotionally charged<br />
office atmosphere can be as or even more harmful to your business’ security than a long-running<br />
undetected systemic vulnerability.<br />
Most businesses will benefit tremendously from setting up transparent incident management and security<br />
breach reporting systems that train key personnel in how to respond and protocols to follow in case of a<br />
breach.<br />
Drive the vulnerabilities home and make the problems ‘real’<br />
One of the problems in preparing for security breaches is that few people outside the IT department have<br />
a notion of what to expect in the case of a breach.<br />
Many businesses are starting to realize just how important employee awareness and proactivity is in<br />
traversing fraught scenarios in the case of a threat/ attack. But traditional modes of top-down employee<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 99<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
communications, such as pamphlets, fliers and organization-wide communiqués mostly prove ineffective<br />
in driving the desired levels of security awareness and engagement.<br />
We advise most clients to walk the opposite route. Instead of routine server downtime notifications and<br />
multiple security checkpoint clearances that naturally tend to get associated with a ‘punishment’ neural<br />
association with security protocols, we encourage clients to do fairly informal, small group meetings or<br />
roadshows that discuss potential vulnerabilities in a manner that makes the problems appear closer and<br />
more ‘real’. Discuss latest breaches by all means, but also brainstorm or maybe even create roleplaying<br />
games around how to detect deceptions if someone sends emails to group members while posing to be<br />
a key team member, a vendor/ supplier or even top leaders in the organization.<br />
Divide and stay safe<br />
When it comes to systemic checks to ensure security, your best line of defense can come from separation<br />
of responsibilities, flatter hierarchies and procedures that require at least dual or multiple authorizations<br />
to initiate transactions. Whatever security structure you may come up with, please remember that its<br />
usability is always limited to a few weeks or months. Every system is vulnerable to insider threats and it’s<br />
in your company’s best interest to review and refresh the protocols every few days/ weeks/ months<br />
depending on sensitivity of data. Systemic reviews and risk analysis should be mandatory both<br />
periodically and after key exits/ inductions to ensure every team member remains up to date with the<br />
latest processes. For sensitive data and key financial transactions – extra controls should be<br />
implemented.<br />
Conduct penetration tests at regular intervals<br />
Regular fire drills and hazard awareness are a pain for everyone involved – including drill conductors.<br />
They involve downtime, slow productivity for minutes/ hours, and do cost a pretty penny in annual<br />
budgets. But in real usage scenario, they do save lives – the value of which can scarcely be calculated.<br />
With heightened data risks, we hope security penetration tests should become a regular feature in most<br />
workplaces. Simply put, these tests deploy security experts in the role of hackers who tap into the length<br />
and breadth of a business looking for potential security issues and vulnerabilities. Many businesses do<br />
not have the requisite resources and expertise to conduct these tests in-house. IT support Vancouver<br />
can help you be prepared for and execute security penetration tests efficiently to cover the scope of all<br />
major and minor vulnerabilities at your workplace.<br />
Recognize that spear phishing attacks cannot be isolated<br />
Unlike conventional security products such as antivirus or anti-malware software that most people are<br />
familiar with shoring up your system against phishing attacks cannot be an endpoint approach. Spear<br />
phishing works on the basis of having enough internal knowledge of your business, technical systems<br />
and key human resources in advance to be able to extort confidence in fraudulent activities despite being<br />
on alert.<br />
Building up defense against spear phishing tactics requires developing systemic resilience against a<br />
multitude of attack vectors. This involves keeping a tab on potential sources of attack, their short and<br />
long-term goals, understanding how they choose and build rapport with their intended victims and<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 100<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
ecognizing parts of your system most likely to be under threat. Your system needs to be in shape to be<br />
able to fight off spear phishing attempts before, during and after an attempted breach. You also need to<br />
consult with experts with direct knowledge of dealing with rapidly evolving threats from unknown sources<br />
in businesses of like size and magnitude as your organization. IT security Vancouver can be a good place<br />
to start your research into strengthening your business’ defenses against targeted spear phishing attacks.<br />
About the Author<br />
Jeff Penner is a senior manager at ActiveCo Technology<br />
Management, an IT Outsourcing Vancouver company. Jeff has<br />
been in the managed services industry since 2015, understanding<br />
what business owners are looking for from technology, and<br />
helping them find it. The most important element for a business<br />
owner taking on a new technology partner is peace of mind and<br />
thus Jeff directs his efforts on finding practical information that any<br />
leader can apply to their business. Jeff lives in Vancouver, BC,<br />
sharing his love for learning and “the great indoors” with his 2<br />
daughters. Stay connected on Twitter.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 101<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
The Serverless Security Machine<br />
By Art Sturdevant, Director of Operations, Censys<br />
Servers are BS. They require constant maintenance, monitoring and tweaking. As a security practitioner, regardless<br />
of where your team lands on the org chart, you’re being charged with securing an ever-evolving landscape against<br />
all internal and external threats. The time required just to keep basic services functioning is daunting and now,<br />
you’re probably working even harder to secure and protect your remote workforce, all while working from home.<br />
While the amount of time required to evaluate and respond to threats is constantly increasing, security budgets,<br />
personnel, and tooling are not being adjusted at the same rate or are only adjusted in response to a particular threat<br />
or incident.<br />
Given that time is at such a premium, why is your team still deploying infrastructure that requires constant<br />
supervision? With all these demands on your team, now is the time to move to a serverless infrastructure.<br />
Traditional servers are great in that they can be provisioned and run forever, but unless the server is under constant<br />
load, you’re likely wasting money and resources managing it. Teams are using all kinds of complex tools to deploy<br />
new servers, apply configurations, update users, and apply security patches and still, there are servers that live<br />
outside of these tools or silently lose connectivity, never to be managed again. Every time a new server is deployed,<br />
you’re really managing three different problems -- server updates, software updates, and code updates.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 102<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Server updates can be risky, which is why large organizations employ a CAB to approve changes and security<br />
updates. Teams schedule downtime or work to deploy across zones without interruption, but because these<br />
changes apply to the entire operating system and are likely not authored by your team, it can be difficult to anticipate<br />
how the change will affect the service you’re trying to manage and even tougher to debug.<br />
Software updates are easier to manage and are likely better understood since the code was written by a team you<br />
know. If you’re already familiar with CI/CD models, then you might already be well suited to the serverless lifestyle.<br />
Code changes go in, peers review the changes, and the code is deployed in a seamless fashion. It may not always<br />
be that flawless, but debugging code you wrote is almost always easier than debugging operating system changes<br />
or behaviors.<br />
By moving to a serverless architecture, you’re removing all the issues around software and security updates, system<br />
breaches, user provisioning, system health monitoring and more. These issues are no longer your team’s problem<br />
because you’re only responsible for deploying code that runs. All of the system updates and application updates<br />
used to run the code are maintained behind the scenes.<br />
Moving to a serverless architecture doesn’t have to be “all or nothing” in order to maximize your time investment.<br />
For example, a good first step might be to evaluate the servers in your environment that only perform one task or<br />
those that are heavily underutilized. A good sign that you’ve identified a solid candidate is when you find a<br />
service/server that is performing a very event-driven task such as a server that collects and ships logs from various<br />
SaaS services or systems. If the service operates on a schedule or cron job - you’ve got a perfect first candidate!<br />
Most users start by moving to a containerized version of their code. Docker is a popular tool and is available on<br />
nearly all platforms. Once you’ve containerized your code, simply deploy it to a docker host, or a cloud service<br />
capable of running containers. Every major cloud provider has support for running containers in production<br />
environments.<br />
If you’re looking for something that is truly serverless, consider evaluating a cloud provider’s “Function as a Service”<br />
(FaaS) offering. These come with a slight learning curve but also a lot of great features including a deployment<br />
model that is easier than containers. FaaS is a model to deploy code (think a python script) and to run it over and<br />
over in response to an event. A common scenario might be to fire a chat notification if a storage bucket becomes<br />
public, or to update TLS certificates on specific hosts as they near expiration. A serverless architecture can allow<br />
your team to quickly deploy proof of concept applications, or full blown applications to manage all corners of your<br />
security program.<br />
Although serverless assets can and often do reduce the administrative burden of managing servers, there are some<br />
limitations to be aware of as you adopt this new model.<br />
- Potential Learning Curve: Containerization and FaaS both require a new skillset. If for no other reason than<br />
to get deployment working in a seamless fashion from your Continuous Integration/Continuous Deployment<br />
tool. Once your team understands the requirements to deploy a service, this is a very repeatable process.<br />
Deploying your first serverless project is likely an afternoon project for you or your team.<br />
- Additional Expense: Misconfigurations can result in higher costs than a traditional virtual appliance in the<br />
cloud. However, even at the increased expense, consider that your team doesn’t need to manage updates,<br />
security patches, or worry about attackers compromising the server. It is a good idea to understand cloud<br />
pricing models before automating these tasks to avoid a surprise at the end of the month. Functions should<br />
be designed to read each word in the book, not each letter and not the whole book either.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 103<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
- Increased Latency: Depending on the cloud provider, FaaS and containerized services could result in<br />
increased latency because of the “cold start time”. However, once the service is started up, running a<br />
second or hundredth service should be fairly quick.<br />
- Task Timeouts: Most cloud providers limit the amount of time a FaaS task can run before it is terminated.<br />
A common timeout is between 30 seconds and 15 minutes. If you have a long-running task, you might want<br />
to consider breaking it into smaller tasks or moving to containerization since container deployments do not<br />
have the same timeout limitations.<br />
- Updates Require Redeployments: To update containers with new code or new software packages, you’ll<br />
need to redeploy the container to the cloud. If you’re updating a FaaS function, you’ll just need to redeploy<br />
the code. While this might seem like a headache, if you update and deploy using CI/CD tools, this is actually<br />
pretty straightforward. Most clouds allow you to deploy with a canary model - meaning you can direct some<br />
traffic to your new code and some to your old code and keep adjusting until you’re confident that you haven’t<br />
introduced any unexpected problems.<br />
Help your security team alleviate the administrative burdens of managing servers by moving to a fully serverless<br />
infrastructure. It may seem daunting at first, but once you have a couple of services or workflows moved over, you’ll<br />
wonder why you didn’t make the move sooner.<br />
About the Author<br />
Art Sturdevant is the Director of Operations at Censys. An Information<br />
Security professional with over 15 years experience, Art maintains a passion<br />
for open-source projects, entrepreneurship, and the outdoors. Before joining<br />
Censys in 2019, he was a Sr. Security Engineer for Duo Security and is also<br />
a graduate of Central Michigan University where he graduated with honors<br />
with a Bachelor of Science in Business Administration. To learn more about<br />
Censys, visit censys.io or email Art at art@censys.io.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 104<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Unlocking the Promise of Packet Capture<br />
By Kathryn Ash, President, IPCopper, Inc.<br />
It turns out that IT people do get plenty of exercise. From the job description it sounds like a desk job, but<br />
that promise of getting all the answers without leaving the desk hasn’t panned out. Take the example of<br />
a small 50 Mbps network – it produces around 10 TB of data per month, given 1/3 utilization over 24/7.<br />
That’s only about one hard drive’s worth, so why doesn’t everybody just capture their data in full and reap<br />
the benefits of packet capture by solving technical problems, finding security flaws and, well, getting all<br />
the answers? Why does all troubleshooting still start with a ping, just like it did decades ago? The answer<br />
is glaringly simple: capturing the packets is easy. Making sense of the data is the hard part.<br />
Take a mundane yet essential security task such as making sure all computers on the corporate campus<br />
are using up-to-date SSL. You could check every computer on the network. Or, you could check every<br />
packet on the network. The first takes your time and effort. The second is done by a machine: tell the<br />
machine to examine every packet to answer two questions: Is it SSL, and, if so, which version?<br />
Making sense of packet capture data unlocks numerous possibilities for managing, monitoring, controlling<br />
and securing computer networks, from detecting and keeping tabs on a new device the second it sends<br />
out its first ARP to ferreting out zombie computers and alerting when a client computer’s bandwidth<br />
utilization suddenly looks more like a server’s. Likewise with identifying servers, tracking which computers<br />
checked in with the antivirus update server or even finding out who is sucking up all the bandwidth. This<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 105<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
is all in addition to figuring out who is downloading or uploading files to China and what those files contain.<br />
It’s all in the packets.<br />
While those terabytes of data may prove to be worth their virtual weight in gold, without the processing<br />
power and a system to unlock the value from the packets, they don’t amount to the cost of a hard drive.<br />
A single packet capture appliance lacks the oomph needed to extract value from the data – it bottlenecks<br />
at either the hard drives or the processor, resulting in long waits for queries, packet loss or both.<br />
Distributed packet capture systems, however, aggregate and orchestrate the processing power of<br />
multiple machines to blast through hundreds and thousands of terabytes of full packet capture, while<br />
capturing new packets at the same time.<br />
In today’s computing environment a distributed system of four to eight machines, even with low-cost<br />
processors (yes, even down to yesterday’s desktops), has ample capacity and responsiveness to crunch<br />
the load from a 50 Mbps network. To get a one-minute response to a query spanning one month of data,<br />
you are looking at a ratio of 43,000:1, that is, one minute to process what took over 43,000 minutes to<br />
capture. A low-cost chassis with one regular HDD would deliver about 1 Gbps processing, while an SSD<br />
would deliver 5-7 Gbps. A system of eight machines translates to 8 to 56 Gbps raw processing<br />
throughput, maybe even, on a really good day, 100 Gbps. That brings the ratio down to around 1000:1.<br />
Cutting out the payload would make it possible to take care of that one month of data in 1-2 minutes (and<br />
if your software doesn’t do reports on the payload, what’s the use of having them anyway?). The power<br />
to process the payload and software to generate reports on the payload, however, gives you that very<br />
magical ability to get the answers and solve problems with the data to back it up – without having to hoof<br />
it around campus, checking individual computers one by one. Rather than cutting out the payload to<br />
speed up queries, software for a good distributed packet capture system multiplies the processing<br />
throughput of the hardware 10 to 100 times, making it possible to both capture the payload and get<br />
reports spanning one month of full packet data in less than one minute, even with a small set up of only<br />
four to eight machines. This is a game changer when it comes to packet capture and managing and<br />
monitoring networks, not the least because reports and aggregates take far less storage space than raw<br />
packet capture, meaning the sky’s the limit when it comes to the depth and breadth of the reports<br />
possible.<br />
Once you get a taste of what a distributed system offers, you can expand it further by adding more<br />
hardware to increase the lookback period. This in turn makes it possible to trace problems from the<br />
beginning, rather than investigating them mid-stream and attempting to extrapolate – seeing how a<br />
problem started brings you a lot closer to seeing how it was triggered, than seeing how it ended.<br />
Incidentally, adding more hardware also adds to the available raw processing power, making it possible<br />
to do even more in less time – one of the beauties of a distributed system is its affordable scalability.<br />
In addition to getting results and relegating marathons to your free time, you can also add in feeling good<br />
about doing your part to combat e-waste. Recycling is always good and saving money by reincarnating<br />
old, slow desktops that everyone hates into supercomputers for networking makes you a “green”<br />
champion, in more ways than one.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 106<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Kathryn Ash is the President of IPCopper, Inc., a manufacturer of<br />
network appliances based in Portland, Oregon. She has been<br />
with the company for over the past decade, guiding the<br />
development and marketing of its cutting edge technology for<br />
packet capture and analysis, most recently presiding over the<br />
debut of its newest product, Lateral Data Processing for<br />
Distributed Packet Capture. Email Kathryn at<br />
kathryn.ash@ipcopper.com or visit http://www.ipcopper.com/.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 107<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Intelligent Protection Against DNS DDoS Attacks is<br />
Critical Part of <strong>Cyber</strong>security Architecture<br />
By Ashraf Sheet, Regional Director, Middle East & Africa at Infoblox<br />
In <strong>2020</strong> DDoS attacks continue to increase both in volume and in frequency. Nexusguard Research 3 just<br />
reported a 542% increase in DDoS attacks in the first quarter of <strong>2020</strong> when compared with the last quarter<br />
of 2019. The NexusGuard research team also detected unusual traffic patterns from ISPs which included<br />
traffic generated from infected devices.<br />
In rare harmony, Kaspersky also reported that DDoS attacks have doubled in the first quarter of 202<br />
when compared to the last quarter of 2019 4 . Kaspersky also found that DDoS cyberattacks are increasing<br />
in duration – the average attack duration increased by 24% in the first quarter of <strong>2020</strong> compared with the<br />
same quarter one year ago.<br />
3<br />
https://www.businesswire.com/news/home/<strong>2020</strong>0630005295/en/DDoS-Attacks-Increase-542-Quarter-over-<br />
Quarter-Pandemic-Nexusguard/<br />
4<br />
https://securityintelligence.com/articles/avoid-ddos-attacks/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 108<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
DNS and DDoS attack vectors have emerged as one of the critical weapons of choice to support fraud,<br />
extortion, and malicious attack. Threat actors may be politically motivated, part of organized crime, or<br />
even nation-state cyberwarfare operatives.<br />
The COVID-19 pandemic was the genesis of this new opportunity as the disease continues to impact<br />
businesses and economies worldwide. The net result is that <strong>2020</strong> has become the year of the teleworker.<br />
The use of online services from home and other remote locations became more critical than ever.<br />
Students are online. Employees are serving customers online. Many of us are working from home and<br />
highly dependent on internet connectivity. The mix of devices we use often includes our laptops and<br />
mobile devices. Threat actors have moved with lightspeed to leverage this opportunity.<br />
But just when you thought it could not get worse, it does. DDoS for hire (otherwise known as “booter”<br />
services) allows threat actors to access thousands of pre-configured servers that can be used to launch<br />
DDoS assaults against any organization. Booters are web-based services that provide criminal DDoS<br />
services for hire. These tools are often referred to in polite conversation as IP stressors, which are<br />
legitimately used to test your networks and servers for resiliency. Certainly, stress testing your own<br />
network is normal. But deploying such technology to create a DDoS attack against external parties is<br />
illegal and malicious criminal activity. The great majority of these servers are hijacked, and malicious<br />
activity is usually completely unknown to their owners.<br />
As you would expect, booters are sold on the dark web using untraceable currencies such as Bitcoin. An<br />
informal survey showed that you could “purchase” the use of a compromised server for between $10 to<br />
$150 or more. You get the passwords and access to the server. Some criminal enterprises sell access<br />
to the use of booters “as a service” and vary pricing by the number of attacks you wish to launch, the<br />
duration of the attacks, and even price out the addition of customer support!<br />
As quickly as law enforcement agencies can find them and shut them down, new ones still seem to spring<br />
up. The number of these servers for sale at times looks quite large, with many tens of thousands of<br />
hijacked servers accessible at meagre cost for a motivated attacker.<br />
The DDoS attacks launched by these threat actor booter sites take us back to basics. As always, the mix<br />
of readily usable attack techniques includes DNS amplification and DNS reflection. They may be used<br />
alone and in combination. An amplification attack is a technique used by threat actors where a small<br />
query can trigger a massive response. In this scenario, threat actors flood the server with short requests<br />
that require long responses, allowing a small compute resource to overload the targeted DNS server.<br />
The DNS server is so busy attempting to respond to all these malicious requests that it doesn’t have time<br />
to respond to legitimate ones, and network activity grinds to a halt.<br />
The reflection attack vector sends queries that appear to come from the target of the attack. The huge<br />
volume of responses, which are amplified, are then sent to the target effectively overwhelming the target.<br />
In this scenario, the attacker sends a query to a recursive name server with a spoofed source IP address.<br />
Instead of the real IP address, the threat actor places the target (victim) IP address as the source IP<br />
address. The recursive name server retrieves the answer to the query from the authoritative name server<br />
and sends it to the target.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 109<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
A sophisticated threat actor can combine the two techniques by spoofing the targets’ IP address and<br />
sending a carefully crafted query that will result in a large payload. This double punch can be an<br />
overwhelming DNS DDoS attack scenario. This allows the threat actor to attack two different targets at<br />
the same time easily.<br />
Comprehensive and intelligent protection against DNS DDoS attacks should be an essential part of your<br />
cybersecurity architecture.<br />
About the Author<br />
Ashraf Sheet is Regional Director, Middle East & Africa at Infoblox. He is<br />
a network and security expert in the region and has held various<br />
progressive roles including senior security consultant, leader for<br />
Managed Security services and head of Security Business Unit for local<br />
and multinational companies.<br />
Ashraf can be reached online at (asheet@infoblox.com) and at our<br />
company website https://www.infoblox.com/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 110<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
NCSAM Provided an Opportunity to Reset Our Approach<br />
to <strong>Cyber</strong>security<br />
October marked National <strong>Cyber</strong> Security Awareness Month, but experts warn that cybersecurity<br />
requires attention 24/7/365<br />
By Sam Humphries, Security Strategist, Exabeam<br />
Earlier this year in the rapid transition to a remote workforce, we saw security leaders looking to quickly<br />
find the right balance between ensuring the organization’s productivity needs are met, and keeping the<br />
organization secure. Finding this equilibrium continues. As we maintain a working-from-home structure,<br />
we cannot afford to be complacent when it comes to cybersecurity.<br />
This National <strong>Cyber</strong>security Awareness Month (NCSAM) provided organizations with an opportunity to<br />
hit the reset button. A combination of training, organizational alignment and technology is the right<br />
approach to detecting and stopping security threats. Effective training should help employees understand<br />
and buy-in to the importance of cybersecurity, and in the BYOH (bring your own home) world,<br />
organizations should broaden awareness efforts to include helping users secure their home<br />
environments.<br />
As the cyber-threat landscape becomes increasingly sophisticated, we must continue to arm our security<br />
teams with the knowledge and tools required to succeed in building a better cyber defense. Below, eight<br />
industry experts discuss the importance of NCSAM and encourage organizations to secure their<br />
businesses every day of the year.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 111<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Torsten George, cybersecurity evangelist, Centrify<br />
"National <strong>Cyber</strong> Security Awareness Month is an excellent opportunity to remind businesses and<br />
consumers alike to never let their guard down when it comes to protecting access to data. All data has<br />
some kind of value, whether it’s a PIN code, digital medical records, social security numbers, social media<br />
posts, or even blood oxygen levels from your fancy new watch. This year's theme, ‘Do Your Part: Be<br />
#<strong>Cyber</strong>Smart,’ takes on increased significance, as our work and personal lives continue to blur, more<br />
devices are connected to the internet than ever, and a historic amount of critical personal and business<br />
data is shared digitally.<br />
If there's one takeaway for businesses, it's that cyber-attackers no longer ‘hack’ in – they log in using<br />
weak, stolen, or phished credentials. This is especially damaging when it comes to privileged credentials,<br />
such as those used by IT administrators to access critical infrastructure, which are estimated to be<br />
involved in 80% of data breaches. So how can we reduce this number as we move into the holiday season<br />
and 2021?<br />
Granting 'least privilege' is essential to preventing unauthorized access to business-critical systems and<br />
sensitive data by both insiders and external threat actors. Striving towards zero-standing privileges and<br />
only granting just-enough, just-in-time access to target systems and infrastructure limits lateral<br />
movement. As organizations continue their digital transformation journeys, they should look to cloudready<br />
solutions that can scale with modern business needs. By embedding these key principles into the<br />
security stack, the risk of employees' credentials being compromised and/or abused can be dramatically<br />
reduced, compliance can be strengthened, and the organization can be more secure."<br />
Gijsbert Janssen van Doorn, director technical marketing, Zerto<br />
“As organizations transitioned into remote working almost overnight, security teams were left to quickly<br />
ensure their businesses were secure, while trying to fill in the cracks left behind by the introduction of<br />
new networks, new devices, and new cyber attacks.<br />
It isn’t a surprise that cybercriminals started taking advantage of this almost immediately, carrying out<br />
ransomware attacks throughout the pandemic as businesses did everything they could to remain<br />
operational. However, away from the private sector, where healthcare and public sector organisations<br />
have been facing huge pressures to manage and control the COVID-19 outbreak, bad actors have posed<br />
a significant threat. Keeping healthcare operations running in normal circumstances is absolutely critical,<br />
but in the middle of a pandemic, that significance is only magnified.<br />
This year, National <strong>Cyber</strong>security Awareness Month emphasized personal accountability as well as the<br />
importance of taking proactive steps to enhance cybersecurity. Employees, now more than ever, need to<br />
remain vigilant in protecting their organization. Ransomware attacks can and will still occur, so cyber<br />
resilience is imperative. With a 72% increase in ransomware attacks during COVID-19, organizations<br />
need to be prepared for the inevitable.<br />
Once compromised, it’s too late to take any preventative measures. Organizations need to be able to<br />
recover data and get back to operating swiftly and painlessly without paying a ransom. Key to this is<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 112<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
leveraging IT resilience solutions that can quickly and effectively provide recovery after an attack. With<br />
the right continuous data protection tools in place, businesses need not worry about paying ransoms and<br />
can instead simply recover pre-attack data files within seconds.”<br />
Carl D’Halluin, CTO, Datadobi<br />
"The COVID-19 pandemic and remote work economy has served to exacerbate existing cyberthreats<br />
such as inside threat actors, ransomware, or a storage platform-specific bug or hack. Downtime caused<br />
by these attacks can come at a very high cost for organizations — both financially and reputationally.<br />
Unstructured data business continuity planning and protection — whether on-premises or in the cloud —<br />
is still lagging dangerously far behind other cybersecurity efforts. Even worse, hackers are increasingly<br />
viewing NAS (network-attached storage) as a highly-profitable target. It’s important for IT and security<br />
leaders to consider this data when building out security strategies.<br />
“No IT professional wants to imagine the worst-case scenario happening to them: a situation where their<br />
NAS or object storage has been locked up by hackers. As organizations increasingly rely on unstructured<br />
data to perform day-to-day business-critical functions, they need to maintain instantaneous access to this<br />
core data. The best practice would be for organizations to maintain a secure ‘golden copy’ of businesscritical<br />
data in an air-gapped location of their choosing (a physical bunker site, data center, or public<br />
cloud). The golden copy complements the traditional data protection strategy by providing an extra layer<br />
of insurance so that in the event of a cyberattack, business operations can continue.”<br />
Jay Ryserse, CISSP, VP of <strong>Cyber</strong>security Initiatives at ConnectWise<br />
“<strong>Cyber</strong>security is a journey, not a destination. The need to reinforce policy and best practices around<br />
cyber hygiene requires continuing education. Whether it's education for your team or conversations about<br />
culture with your customers, you have to consider it’s an ongoing process that requires maintenance.<br />
While National <strong>Cyber</strong> Security Awareness Month is a great opportunity to discuss the current issues we’re<br />
facing and make plans to address them, cybersecurity is critical 365 days a year. <strong>Cyber</strong> crime doesn’t<br />
rest and neither should organizations.<br />
The month also presented a good opportunity to discuss the growing importance of cybersecurity within<br />
the managed service provider (MSP) community. When we review the results of a recent survey we<br />
conducted with Vanson Bourne, the importance of investing in ongoing cybersecurity education is evident<br />
in the data. Ninety-one percent of SMBs say they would consider using or moving to a new IT service<br />
provider if it offered the ‘right’ cybersecurity solution. For most, that means having confidence that their<br />
provider will be able to respond to cyber attacks and minimize any damage. If I’m an MSP, I’m going to<br />
focus on educating my team on how to deliver the ‘right’ cybersecurity solutions. MSPs owe it to<br />
themselves to keep up with trends and knowledge in cybersecurity in order to increase their service<br />
offerings and provide their customers with the protection they’re seeking.”<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 113<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Surya Varanasi, CTO, StorCentric<br />
“As cyber threats continue to raise concerns across virtually all industries, particularly healthcare and<br />
financial, it is important that organizations remain compliant and find solutions that implement the latest<br />
encrypted technology to protect their data and the data of their customers.<br />
To support business continuity, as well as ensure data protection and security, IT professionals should<br />
look for policy-based solutions with the ability to fingerprint and encrypt data to fortify businesses against<br />
viruses, ransomware, and other bad actors. Solutions that are able to restore from virtual shortcuts can<br />
decrease the amount of time spent retrieving data and help users bring their businesses back up quickly.<br />
Implementing self-healing technology can help the system to automatically ensure it is in order and<br />
ensure your last line of defense is continuously updated and ready to go. This is an immutable copy that<br />
can’t be altered and it is replicated to a remote location using an encrypted transfer. While you can’t<br />
eliminate cybercrime, you can take steps to help organizations be prepared to evade and/or recover from<br />
it.”<br />
Jeff Hussey, CEO, Tempered<br />
“National <strong>Cyber</strong> Security Awareness Month is the perfect time to bring awareness to the work that needs<br />
to be done to secure our critical infrastructure. Critical infrastructure — from electrical grids, and smart<br />
city applications to water treatment plants — have vulnerabilities that pose enormous cyber risk and in<br />
turn, risks to communities. Traditionally, these networks have been physically managed and air-gapped.<br />
Managing and securing these networks and remote sites today is difficult, as new technologies are added<br />
to legacy systems.<br />
Fortunately, state-of-the-art secure networking solutions are now available that extend secure<br />
connectivity across physical, virtual, and cloud platforms and secure every endpoint in your network, with<br />
true micro-segmentation and secure remote access. These solutions not only eliminate network-based<br />
attacks, but they also reduce the cost and complexity required to effectively manage critical infrastructure<br />
for governments, utilities, and IoT applications.”<br />
Trevor Bidle, VP of Information Security and Compliance Officer, US Signal<br />
“When we celebrated National <strong>Cyber</strong> Security Awareness Month in 2019, no one could have predicted<br />
that at that time the following year, the world would be in the midst of a pandemic -- and that many<br />
companies would be faced with the technological challenges of a newly distributed workforce.<br />
Compounding this issue, 64,000 IT professionals are expected to have lost their jobs by the end of <strong>2020</strong>,<br />
while cybercrime has quadrupled -- leaving organizations short-staffed yet increasingly targeted by<br />
hackers. The solution for some may be to turn to a third-party SOC that can offload some of the security<br />
posture decisions and monitoring.<br />
For years, vulnerability management tools have been reactive rather than proactive -- only spotting weak<br />
points on the network after they’ve been compromised by a hacker. But the most effective, modern<br />
solutions use threat intelligence to proactively identify, classify and prioritize vulnerabilities based on<br />
criticality -- allowing organizations to catch them before the bad guys do.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 114<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Many businesses struggle to set up, scan and effectively analyze vulnerability scan results in a way that<br />
drives meaningful action to remedy the issues, however. IT and security departments who want to expand<br />
their teams through a third-party SOC can turn to these highly-trained experts to manage vulnerability<br />
scanning, report analysis and remediation recommendations. In addition to vulnerability management,<br />
organizations can use third-party providers for backup and disaster recovery to help restore data in the<br />
face of ransomware attacks, and to help build and test effective incident response plans.<br />
While there are additional considerations, these steps are a strong start toward a more secure future,<br />
even in these unpredictable times. And it’s important to remember, there’s no shame in asking for help.”<br />
JG Heithcock, General Manager of Retrospect, Inc., a StorCentric Company<br />
“National <strong>Cyber</strong>security Awareness Month served as a reminder that cyber criminals continue to exploit<br />
the pandemic and remote workforce by targeting organizations through phishing, malware distribution,<br />
false domain names, and other attacks on teleworking infrastructure.<br />
Preparing for cybercrime attacks through the use of proven techniques will protect your data and critical<br />
systems, helping your organization to minimize risks, rapidly recover if necessary, and maintain<br />
operations. This includes updating your system and investing in anti-malware software; protecting your<br />
endpoints and not just servers or file sharing systems; implementing a 3-2-1 backup strategy consisting<br />
of: 3 copies of data, 2 different formats and 1 offsite location; routinely monitoring backups to help detect<br />
ransomware; and no matter how uncomfortable it might seem, do not pay the ransom in the event of a<br />
ransomware attack as this doesn’t guarantee your data will be restored.”<br />
About the Author<br />
Sam Humphries, security strategist, Exabeam<br />
Samantha has 20 years of experience in cyber security, and during<br />
this time has held a plethora of roles, one of her favourite titles<br />
being Global Threat Response Manager, which definitely sounds<br />
more glamorous than it was in reality. She has defined strategy for<br />
multiple security products and technologies, helped hundreds of<br />
organisations of all shapes, sizes, and geographies recover and<br />
learn from cyberattacks, and trained many people on security<br />
concepts and solutions.<br />
In her current role as global product marketing team at Exabeam,<br />
she has responsibility for EMEA, Data Lake, compliance, and all<br />
things related to cloud. Samantha authors articles for various<br />
security publications, and is a regular speaker and volunteer at industry events, including BSides, IPExpo,<br />
<strong>Cyber</strong>SecurityX, The Diana Initiative, and Blue Team Village (DEFCON). Samantha can be reached at<br />
our company website http://www.exabeam.com.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 115<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
How Blockchain Is Helping Stop the Spread of COVID-19<br />
By Robert Galarza, CEO, TruTrace Technologies<br />
By now, we all know the cost of COVID-19. Many countries have struggled to contain the virus, forcing<br />
people to practice social distancing, wear masks and take extra precautions to minimize exposure.<br />
Frontline workers are unable to secure the PPE needed to keep them safe. News outlets and social<br />
media are pushing information on the public, right and wrong, causing rifts amongst communities.<br />
The pandemic has ignited a crisis of trust that affects people, governments, products and processes.<br />
What has become clear in the quest to contain and combat the virus is the need for timely data from<br />
reliable sources.<br />
Crypto technology can verify, secure and share data, making it ideal for managing some of the biggest<br />
issues surrounding the spread of coronavirus — the lack of data security, outdated surveillance systems<br />
and poor supply chain management.<br />
Blockchain can build new paradigms of trust by providing transparency for managing and sharing<br />
information. Using decentralization and blockchain technologies, organizations around the world are able<br />
to connect like never before, uniting humanity in a collective front to fight COVID-19 and future viruses.<br />
Let’s examine three ways blockchain is helping stop the spread of COVID-19.<br />
How Blockchain Manages Data Sharing<br />
In March <strong>2020</strong>, the World Health Organization (WHO) partnered with several major tech companies<br />
(including Microsoft, IBM and Oracle), along with international health organizations and government<br />
agencies to launch an open data hub called MiPasa.<br />
Created by HACERA, the platform aims to detect COVID-19 carriers and infection hotspots quickly and<br />
precisely. MiPasa will securely share information among individuals, hospitals and authorities, which will<br />
aid in public health analysis and create a single source of verified and up-to-date information.<br />
Governments around the world are introducing contact tracing apps — smartphone apps which use<br />
phone tracking technology to oversee the population’s movement in an effort to monitor and control<br />
outbreaks. One of the main challenges associated with the adoption of these apps is the need to ensure<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 116<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
data protection and privacy for users. That’s where blockchain comes in as a means to store data in<br />
ledgers, protecting it from unauthorized access.<br />
Governments that implement crypto techniques can tackle the pandemic while ensuring patient privacy<br />
is uncompromised. Facilitating the sharing of essential COVID-19 related data will help in diagnosis,<br />
treatment and research for developing a vaccine.<br />
How Blockchain Helps Track Donations<br />
Blockchain ensures donations — monetary or medical equipment — are transparent and traceable.<br />
Previous handling of public donations and the distribution of aid has caused distrust in the perception of<br />
some charity organizations, which has given rise to donation tracking platforms like Shenzong.<br />
Blockchain’s transparency provides donors with full traceability of donations, from the point of being<br />
received, to how donations have been matched to areas most in need, to when donations are delivered.<br />
By ensuring donations are reaching the correct destinations, those most in need will receive the medical<br />
equipment needed to help stop the spread of the coronavirus.<br />
How Blockchain Protects Supply Chains<br />
One of the biggest issues that has emerged from the pandemic is the inability to authenticate healthcare<br />
products, leading to a breakdown of trust in supply chains. The unprecedented demand for quality<br />
disinfectants around the world has created an opportunity for counterfeit and defective products to flood<br />
the market. Unfortunately, thousands of defective products are reaching the market because people are<br />
trying to cut corners. This is the biggest dark spot for a lot of PPE orders; they don’t know where the<br />
products are coming from. The FDA’s recent warnings about deficient and even dangerous products in<br />
the market reinforces the need for reliable products.<br />
Blockchain allows consumers and healthcare practitioners to track the origin and providence of medical<br />
supplies, ensuring products are trustworthy, transparent and traceable. Utilizing digital ledgers,<br />
blockchain records supply chain data on a granular level, connecting information in a way that can be<br />
quickly and rapidly accessed.<br />
Dynamic recall systems are designed to recall a batch lot, so if a product is discovered to be faulty,<br />
blockchain facilitates the ability to connect all the data points back to the original source. This provides<br />
data security to manufacturers on the materials used that can be tracked from origin. Subsequently,<br />
purchasers are reassured they are buying safe, quality products.<br />
A positive note to take away from the tragedy of the pandemic is the acceleration of innovative systems<br />
to help stop the virus from spreading. We might yet see personalized wellness as the next step for<br />
blockchain in the fight against the coronavirus. Blockchain has the capability to manage lifestyle on an<br />
individual level — sleep patterns, fitness levels, nutrition — and how you can best maximize your health<br />
to build the T cells and create the antibodies in your system to stay healthy.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 117<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Robert Galarza is Chief Executive Officer of TruTrace Technologies,<br />
developer of the first integrated blockchain platform that registers and<br />
tracks intellectual property from Genome to Sale for the cannabis<br />
industry.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 118<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Patched Minimizes Risk - But Opens the Door for<br />
Compatibility Problems<br />
How to Remediate Federal Systems with Zerologon Vulnerability<br />
By Egon Rinderer, Global Vice President of Technology & Federal CTO, Tanium<br />
In September, the <strong>Cyber</strong>security and Infrastructure Security Agency (CISA) released a notice stating the<br />
Zerologon vulnerability poses an “unacceptable risk” to the federal civilian executive branch, and required<br />
that all federal agencies “immediately apply the Windows Server August <strong>2020</strong> security update” or<br />
disconnect from federal networks. Zerologon is perhaps one of the most significant vulnerabilities to hit<br />
in a long time.<br />
Back in August, Microsoft released the software update Netlogon EoP – or zerologon – to mitigate a<br />
critical vulnerability in the Windows Netlogon Remote Protocol server interface. Netlogon allows devices<br />
to authenticate to the domain controller (DC) and update their password in the Active Directory (AD).<br />
Netlogon is designed for specific tasks like maintaining relationships between members of domains and<br />
the DC, or between many DCs across one or many domains, and replicating the DC database. At the<br />
time of the update, this was only the first update in a phased rollout expected to conclude February 2021.<br />
Federal systems go through routine patches and software updates. These fix and improve security<br />
vulnerabilities and other bugs cybercriminals might use to gain unauthorized access to a user’s device<br />
and sensitive data. Software vendors release critical patches with the intent of protecting the<br />
organizations and users leveraging the software. But, sometimes while the patch may safeguard against<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 119<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
the latest threat, it can also unintentionally create other issues across the network. Ideally, organizations<br />
have a test environment where they can first deploy the patch and measure the effectiveness as well as<br />
any issues it might cause (e.g., if a mission critical tool or function is unavailable). But, test environments<br />
aren’t always identical to the production environment, and some organizations may not have one at all.<br />
While not identical, the impact of this latest patch is reminiscent of the fallout from the Microsoft patch for<br />
Meltdown (CVE-2017-5754). Distribution of the patch was altogether halted at one point due to the issues<br />
it caused for some machines (e.g., failure to boot). What’s unique about the patch for zerologon, however,<br />
is that Microsoft knew prior to release that there would be compatibility issues, which explains the<br />
complexity in the response and guidance—phased implementation, partial enforcement now and more<br />
coming later, an option to go to full enforcement sooner, new logged events to tell you when those<br />
compatibility issues are happening, and a GPO to exempt specific systems from the new restriction.<br />
These patch complexities can leave some networks and users in a precarious position. With the patch<br />
comes certain compatibility issues, but without the patch, hackers can use this vulnerability to create<br />
easy-to-use exploits. This vulnerability allows attackers to impersonate any computer to the DC in the<br />
agency network and change their password – all while going unnoticed by IT teams. Hackers can also<br />
execute remote procedure calls on their behalf to gain access to corporate networks.<br />
In the case of zerologon, since an agency’s active directory rarely, if ever, gets completely rebuilt or<br />
replaced over time, a skilled cybercriminal could quietly establish long-term, full administrative<br />
persistence inside the entire network and remain unnoticed. Further, agencies underestimate its impact<br />
because it 'only affects DCs.’ But the problem is agencies often have far more DCs than they think – and<br />
those DCs are spread all over the globe. Control of any DC grants the ability to do anything they want on<br />
any member machine in the AD forest, including hide persistence on them.<br />
Roadblocks to Closing the Vulnerability<br />
Zerologon isn’t something you can just patch and forget. Remediation requires several steps and<br />
repeated validation. Further, tactics by bad actors are evolving daily – so it is more critical than ever to<br />
routinely update systems to prevent breaches.<br />
The solution is not as simple as shutting the insecure channels of communications, as this can potentially<br />
break other applications and platforms. It is very difficult to determine the impact without rigorous testing.<br />
The exploit depends on signing and encryption being optional. When the protocol’s less-secure option is<br />
unavailable, the exploit no longer works. The patch brings a subtle change to the Netlogon protocol that<br />
breaks the “all-zeroes” exploit technique. This means that even when you can’t require<br />
signing/encryption, successful exploitation of the protocol’s weakness is now mathematically many orders<br />
of magnitude more difficult than it was (That’s good news!).<br />
After patching DCs, you should determine whether any authorized computers are being blocked or will<br />
be blocked in full-enforcement mode (what MS refers to as “Phase II”), so that they can be updated,<br />
retired, or exempted with the new group policy setting.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 120<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Further, DCs often receive patches later than other systems in the agency network because of a “don’t<br />
rock the boat” mentality. Having the DCs updated and stable is critical – and this means patches and<br />
security updates are approached with hesitation. The bottom line? This vulnerability exposes the keys to<br />
the kingdom – and it is absolutely critical that agencies understand it and take it seriously.<br />
Next Steps<br />
Zerologon patches are only available for versions of Windows that are still supported and receive security<br />
updates. But in practice, many networks have legacy Windows devices or non-Windows devices that<br />
communicate with DCs using the protocol. Federal IT teams who have the patch should utilize the<br />
Microsoft guidance:<br />
• Deploy the August 11, <strong>2020</strong> updates to all applicable DCs in the forest including read-only DCs<br />
• Collect events in DC event logs to determine which devices in the environment are using<br />
vulnerable Netlogon secure channel connections<br />
• Address Netlogon event IDs 5827 and 5828, indicating non-compliant machines that are being<br />
blocked now, and event ID 5829 indicating noncompliant machines that will be blocked when full<br />
enforcement is applied<br />
• Move to enforcement mode in advance of the February 9, 2021 enforcement phase<br />
• Deploy February 9, 2021 updates<br />
Agencies that use Microsoft Windows are better served by taking a holistic risk management approach,<br />
using complete, accurate, and real-time data from a single source to reduce risk and improve security. In<br />
doing so, they can also reduce the number of point products, reallocate budget and scarce resources,<br />
and justify future budget requests for critical security activities – all while providing a more comprehensive<br />
view of the security landscape that enables more strategic business decisions.<br />
Leveraging a single platform that integrates endpoint management and security unifies teams, effectively<br />
breaking down the data silos and closing the accountability, visibility, and resilience gaps that often exist<br />
between IT operations and security teams.<br />
A platform approach also gives agencies end-to-end visibility across end users, DCs, servers, and cloud<br />
endpoints, and the ability to identify assets, protect systems, detect threats, respond to attacks, and<br />
recover at scale. When agencies achieve complete visibility and control, the risk from cyberattacks is<br />
significantly reduced and their ability to make good business decisions is improved.<br />
At this stage, agencies that use the Netlogon server are aware of the vulnerability and the risk it brings.<br />
IT teams must prioritize standard checks for patches and routinely complete vulnerability assessments<br />
to analyze and determine the current level of risk.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 121<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Egon Rinderer is the Global Vice President of Technology and<br />
Federal CTO at Tanium. With 30 years of Federal and private<br />
sector industry experience, Egon currently leads the global<br />
Enterprise Services Organization as well as leading Tanium<br />
Federal as Chief Technology Officer. Joining Tanium at a time<br />
when the company was made up of less than 20 employees,<br />
he has held roles ranging from Technical Account Manager to<br />
Federal Pod Lead to global Vice President of the TAM<br />
organization. Prior to joining Tanium, Egon was with Intel<br />
Corporation and served throughout the US military and<br />
intelligence community in the United States and abroad in an<br />
operational capacity. Egon can be reached at<br />
egon.rinderer@tanium.com, online at<br />
https://www.linkedin.com/in/egon-rinderer/, or at our company website at<br />
https://www.tanium.com/solutions/federal-government/<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 122<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
For Federal Agencies, Securing Internet of Things<br />
Devices Is A Growing Challenge<br />
By Katherine Gronberg, Vice President of Government Affairs, Forescout<br />
In June, the cybersecurity company JSOF, with help from Forescout, released some eye-opening<br />
research about a set of 19 vulnerabilities, collectively known as Ripple20. The Ripple20 vulnerabilities<br />
are found within the TCP-IP protocol code sold by Ohio-based software company, Treck, and are used<br />
by a wide range of Internet of Things (IoT) and Operational Technology (OT) devices. An OT device<br />
refers to a specific type of computing device that manages, monitors or controls operations that are more<br />
physical or industrial in nature, such as an environmental control or security system. The Ripple20<br />
vulnerabilities make these devices susceptible to remote code execution exploits, which is a type of<br />
exploit that allows an attacker to take full control of a device. This can allow attackers to disrupt the<br />
operations of an organization or to leverage that device as an entry point onto the network to attack other<br />
sensitive assets or information.<br />
A TCP-IP stack is an embedded library of code that allows a device to communicate over the internet.<br />
Treck’s code was built to handle the TCP-IP protocol that connects devices to networks and the internet<br />
and as previously mentioned, is incorporated into a range of IoT and OT devices. Unfortunately,<br />
organizations rarely know the component makeup of their IoT devices, as there is currently no<br />
requirement for manufacturers to provide customers a bill of materials that describes the specific<br />
hardware and software components contained in IoT and OT devices. Common types of devices running<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 123<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Treck include office printers, medical infusion pumps, security cameras, video conferencing tools and<br />
building automation systems, to cite a few examples.<br />
Federal agencies are heavily affected by the Ripple20 vulnerabilities as they increasingly rely on<br />
networked IoT and OT to perform their missions. Forescout sees hundreds, and in some cases<br />
thousands, of smart devices and IoT devices, as well as OT devices, on government networks. We have<br />
seen examples of federal agencies that purchase smart appliances for use in kitchens or labs, but which<br />
the manufacturer will not warranty unless the appliance is granted an internet connection, which may<br />
violate an agency’s policies. Out of a sample of 90,000 devices found running Treck, nearly 6,000 were<br />
in use within the government sector. According to Forescout research, devices and equipment for<br />
heating/ventilation/air conditioning (HVAC), emergency communications and IP camera systems (like<br />
those used for physical building security monitoring) have emerged as riskiest for government agencies.<br />
The pervasiveness of IoT and OT on government networks, with a significant number of those containing<br />
the Ripple20 vulnerability, should signal how important it is that federal agencies have a way to identify<br />
and manage the cyber risks of these kinds of devices. Yet, federal agencies have struggled mightily with<br />
this problem. This is partially because agencies’ IT security functions haven’t really wanted to address<br />
the security of these operational systems and left them largely to the system owners to figure out (e.g.<br />
the facilities management people). Further, until now, none of these parties had adequate tools to<br />
address the security of these devices. IoT and OT devices are not like traditional computers; they are<br />
difficult to detect and can be difficult to identify correctly. They cannot run traditional security software the<br />
way a computer can. In our experiences with new federal customers, we have found that most are<br />
unaware of how much IoT and OT is actually present on their networks.<br />
At the policy level, government leaders have focused their attention on creating conditions and standards<br />
for the manufacturers of IoT and OT to meet, including potentially requiring them to build certain security<br />
features into products. But the IoT attack environment is, frankly, too explosive for static feature<br />
requirements or point-in-time product or vendor certifications to suffice. Examples of such constructs<br />
include IoT product or manufacturer certification processes, the requirement for manufacturers to provide<br />
software or hardware bills of materials, and certification-based “device tagging” mechanisms. While these<br />
ideas will provide agencies more information about the IoT running on their networks, the overall federal<br />
strategy being implemented has to balance these methods with an equal or greater emphasis on<br />
augmenting behavior-based, continuous monitoring approaches. These refer to methods that allow<br />
agencies to monitor, in real time, the network access, posture and behavior of all devices and associated<br />
users, and to continuously enforce controls and compliance on these devices.<br />
These methods are currently being implemented within the Department of <strong>Defense</strong> (DoD) through the<br />
Comply-to-Connect (C2C) program. The overarching goal of C2C is to improve the authentication,<br />
authorization, compliance assessment and automated remediation of all devices and systems connecting<br />
to a network. Within the C2C framework, IT, IoT and OT devices and systems are detected<br />
instantaneously upon presenting themselves to the network. They are identified, assessed for signs of<br />
compromise and other anomalous configurations and behaviors, and finally assessed for their<br />
compliance with DoD security policies. Compliant devices and systems gain the desired level access to<br />
the network, while unauthorized ones are held in quarantine until they successfully meet requirements.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 124<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
C2C allows the DoD to inspect every single device for malicious code, prohibited software,<br />
noncompliance and other risks. In responding to challenges of today, C2C applies to IoT devices as well<br />
as systems for industrial control, weapons, medical gear, commercial smart devices and embedded<br />
controls. The program has in its scope all devices and systems within a “single pane of glass,” under a<br />
singular security architecture, as opposed to the security of different device types and systems being<br />
managed by disparate teams within DoD.<br />
The capabilities of C2C will form the foundation of the DoD’s efforts to implement an enterprise Zero<br />
Trust architecture, most importantly, by restricting any device’s network access until it has proven itself<br />
trustworthy. Once approved, C2C requires the continuous monitoring of an endpoint, enforcing its access<br />
to data resources via network segmentation and limited penetration to other networked resources. The<br />
National Institute of Standards and Technology (NIST) has published some especially important guidance<br />
on both Zero Trust and Continuous Monitoring.<br />
There is no turning back to a pre-IoT/OT world. Agencies are now far too reliant on the devices for<br />
mission-critical tasks. IoT must be embraced for its ability to create efficiencies and improve safety in<br />
federal missions, but government IT leaders must simultaneously employ frameworks that can secure<br />
these devices, the data on them and the critical functions they perform. C2C is this framework within the<br />
DoD and it will enable the Department to incorporate IoT innovation into its critical missions while ensuring<br />
they don’t introduce mission-impacting risk.<br />
About the Author<br />
Katherine Gronberg is Vice President of Government Affairs at Forescout<br />
Technologies, Inc., the leader in Enterprise of Things security. Prior to<br />
Forescout, she taught at Georgetown University’s Edmund A. Walsh<br />
School of Foreign Service and ran her own government affairs consulting<br />
firm. Prior to this, Katherine served as a Staff Director on the Senate<br />
Appropriations Committee, handling billions in annual appropriations for<br />
federal agencies such as the Departments of State and Commerce.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 125<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Nations—Not Individuals—Are After Your IP<br />
By Ryan Benner, Anexinet<br />
A recent Wall Street Journal article titled, Russian Hackers Have Targeted 200 Groups Tied to U.S.<br />
Election, has Microsoft stating that “Russian government hackers have targeted at least 200<br />
organizations tied to the <strong>2020</strong> U.S. election in recent weeks, including national and state political parties<br />
and political consultants working for both Republicans and Democrats.” The article goes on to point out<br />
that other bad actor nations such as China and Iran have also been identified by Microsoft as engaging<br />
in cyberattacks against “high-profile individuals” and “targeting personal accounts of people associated<br />
with President Trump’s campaign,” respectively. There is an understated cybersecurity progression to<br />
this piece: Ten to twenty years ago, bad actors were typically individuals or even small groups, often tied<br />
to organized crime, that were just looking for financial gain. Today we have the skills of a nation seeking<br />
to influence global politics.<br />
The phenomenon of nation-states as bad actors has significantly risen over the last decade. These<br />
nations are not just seeking to steal data for financial gain, they are also looking at acquiring information<br />
to be used for economic espionage such as tapping into power grids or monetary gain from copying<br />
proprietary products and systems such as IT device codes. It’s a wake-up call for any organization to<br />
carefully review its downstream business relationships and contracts. Are they linked in any way to<br />
government entities? Is your company manufacturing proprietary parts for a military vehicle that can be<br />
copied and reproduced cheaper in other parts of the world? If the answer is “yes,” you may be a target<br />
for very well-trained, deep-pocketed bad actors that are extremely persistent in their pursuit of your<br />
intellectual property.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 126<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
The following are documented cyberattacks performed by bad actor nations:<br />
Unpatched Systems<br />
One of the biggest issues constantly exploited by bad actors is an unpatched system. Over the last few<br />
years, we've seen a plethora of new attacks that leverage exploits that have not been published to the<br />
world yet. According to Security Boulevard, “cyberattacks increased 17% over the past year [2019] and<br />
their severity rose 27% compared to 2018.” The most notable result from the polling was that “60% of<br />
breaches were linked to a vulnerability where a patch was available, but not applied.”<br />
Organizations must realize that bad actor nations have the funding and the manpower to methodically<br />
dig into software and firmware and find these exploits before they would traditionally be found by the<br />
manufacturers themselves. And they leverage these exploits in ways that make it very difficult to find<br />
them because the attacker doesn’t want to just exploit a single system, they want to use the entry system<br />
as a jump-off point to exploit many areas of the network. While in stealth mode, many security tools are<br />
not capable of identifying their presence, because they don’t trip any wires or alarms. It’s their mission to<br />
stay hidden in the network and to take over as many parts of the infrastructure as possible.<br />
Spear-Phishing<br />
CSOonline states that phishing attacks account for more than 80% of reported security incidents and<br />
RiskIQ estimates that $17,700 is lost every minute due to phishing attacks. Why are these figures so<br />
high? Because the end-user is always the weakest link in the chain and by nature, most people are<br />
trusting individuals. That’s why when an email looks official, perhaps from their bank, or their company’s<br />
IT Help Desk, the target willingly hands over their credentials.<br />
Over the years, there has been considerable advancement with email security tools to help recognize<br />
spear-phishing and block it from getting to end-users. This protection includes web and DNS tools that<br />
block end-users’ attempts at clicking fraudulent email links. Ultimately, the responsibility resides with the<br />
end-user to look for oddities in the email such as misspellings or signs in the nomenclature that it’s not<br />
written by a native English speaker. When these emails are identified, end-users must be trained to report<br />
the incident to the IT security department immediately.<br />
Brute Force Attacks and Password Sprays<br />
Brute force leverages a computer system to break an encryption protocol or a password. With the everincreasing<br />
processing power, millions of password attempts can be performed per second. From a<br />
network policy perspective, it's all about ensuring the appropriate, complex passwords are being used<br />
and password lockout policies, such as after 5 bad attempts, are in place. Although brute force attacks<br />
are less successful, the attackers will often come back to test a company’s security policies to see if the<br />
latest protocols have been put into place.<br />
Similar to brute force attacks, password spraying is going after the end-users’ accounts. However, instead<br />
of focusing on one account and trying hundreds of thousands of password combinations, a password<br />
spray attempt will focus on going after a large number of accounts with a handful of commonly used<br />
passwords. This type of attack is effective because many individuals set the security credentials as their<br />
email address and “password 1-2-3,” or similar, simplistic easy-to-remember permutations. Over the last<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 127<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
few years, newer recommendations call for “phrase passwords” to be used, where the end-user selects<br />
a line from their favorite song, wedding vow, or quote; much easier to remember than a ten-character<br />
string.<br />
A Much Bigger Attack Surface<br />
Exacerbating the cyberattack problem is the fact that we now have an immense, remote workforce that<br />
has increased the attack surface exponentially. Now that a much larger percentage of workers and<br />
students are remote and using a lot of new collaboration style software, these bad actors have a much<br />
larger target to hit.<br />
Preventing a cyberattack is extremely difficult, but there are many ways to mitigate the risk. The first step<br />
is to become intimately familiar with every aspect of the network, including hardware, software, end<br />
devices as well as anything connected that could be considered an entry point e.g IoT devices, card<br />
readers, and even printers. From there it goes to ensuring the right policies are in place and building the<br />
right programs around these policies such as the aforementioned methods discussed in the documented<br />
attacks. Once those areas are taken care of, the right tools and software need to be utilized to ensure<br />
the adequate layers of defense are in place to detect and defend critical intellectual property (IP) assets.<br />
With all these checkpoints taken care of, the final step is to layer monitoring on top to ensure credible<br />
alerts are being escalated for proper attention.<br />
You Don’t Have to Go It Alone<br />
A Managed Security Provider (MSP) can help an organization create a customized security program<br />
leveraging premise and cloud-based security tools to protect users and IP assets. Layered on top of the<br />
security program is 24/7 monitoring from trained staff within a Security Operations Center (SOC). MSPs<br />
were created because it's very difficult and expensive for companies to have all the in-house talent—<br />
across all the various cybersecurity disciplines.<br />
From a hacker’s point-of-view, monetary gain seems like table stakes compared to effectively influencing<br />
a nation; and yet, this too may be a stepping stone to even more diabolical efforts. Mitigating risks with<br />
solid security policies, layering security tools, and cutting-edge monitoring systems that prompt<br />
immediate action is the best course of action to protect your organization’s private information and IP.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 128<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
About the Author<br />
Ryan Benner is Vice President of Presales at Anexinet – a 20-year<br />
digital business solutions provider offering customers a complete<br />
digital experience from engaging front-end interactions to<br />
dependable back-end solutions, all informed by data-driven<br />
insights. Ryan has expertise in building new revenue streams and<br />
significant growth in technology consulting companies. Prior to<br />
Anexinet, Ryan was VP Solutions & Services / VP Enterprise<br />
Infrastructure at Arraya Solutions, where he was instrumental in<br />
enabling the company to achieve 4X revenue growth and transform<br />
from a small VAR to a provider of strategic solutions. Ryan holds a<br />
Bachelor of Science degree in Information Systems from Penn<br />
State University. Anexinet can be found on LinkedIn and Twitter.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 129<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Video Intercom Systems Reinvent Building Security<br />
By Melvin Braide, Content Writer<br />
Intercom systems have been around for decades, but recently access control solutions have started to<br />
incorporate video functionality, surveillance, and two-way calling. In this piece, we discuss how video<br />
intercom is reinventing residential and commercial building security.<br />
An intercom system is an autonomous, internal communication system within a building or a collection of<br />
buildings that is not part of the public telephone network. It is a familiar presence in offices, multi-tenant<br />
buildings, and some homes. In its most primitive stage, it was nicknamed the "buzzer" – because of the<br />
sound it made when a guest pushed the button at the front door of a multi-tenant building – and letting a<br />
visitor into the building was "buzzing them in." Those systems linger in older facilities.<br />
The buzzer system offered adequate, if not clear, audio. Over time, the frailties of this technology became<br />
apparent. You could hear the guest's voice, but you couldn’t completely verify identification. Simply put,<br />
you couldn't visually assess who you are allowing onto your premises. That changed with video<br />
intercoms.<br />
What Is a Video Intercom System?<br />
Holistic safety and security in today's post-COVID society includes cybersecurity, physical security, and<br />
environmental health and safety. An ideal system would address security on all three fronts. Video<br />
intercom is one such tool. So what is it?<br />
A video intercom is an advanced intercom system with a video component that supports two-way<br />
video calls. The video component allows you to assess anyone at the front door before granting<br />
access. High-end video intercoms combine with cloud-based systems to connect mobile devices<br />
for remote visitor management and access control.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 130<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
How Is Video Intercom Being Used in Commercial and Residential Buildings??<br />
Video intercom systems are increasingly employed to strengthen security and improve visitor<br />
management. The versatility of video intercom systems makes them suitable for both residential and<br />
commercial facilities. But there are subtle differences in how they are used in different situations.<br />
●<br />
●<br />
●<br />
Office intercom systems: Intercom systems for businesses are used for more extensive<br />
purposes than just granting access to visitors. Office video intercom systems serve as an internal<br />
communication system between offices in the same building and different locations.<br />
Video intercom systems for multi-tenant commercial buildings: High-rise multi-tenant<br />
buildings use video intercom primarily to verify a visitor's identity. In this sense, a visitor also<br />
includes couriers, maintenance personnel, and employees missing their access credentials.<br />
Residential video intercom: For apartment complexes and condominium communities, the<br />
primary concern is to protect against theft, break-ins, and vandalism and monitor access to the<br />
building when you’re not home.<br />
Regardless of the utility, it’s important to choose the right video intercom system. Video intercom systems<br />
come with a variety of features that serve various purposes. You can opt for a wireless video intercom<br />
and connect via WIFI, or you can choose a wired system that connects with ethernet.<br />
Benefits of Video Intercom Solutions<br />
Visitor identification via video increases security<br />
Video intercom adds an extra layer of protection to your residential or office security system. Its standout<br />
feature is the two-way video call that allows you to verify who you are talking to and whether they are<br />
alone. Some video intercoms use up to a 7MP high-resolution camera capable of capturing the tiny<br />
inscriptions on an ID card for verification.<br />
Touchless/hands-free solutions<br />
A video intercom with access control capabilities increases physical health in this COVID world.<br />
Integrated system capabilities can be connected to any electronic door unlock system preinstalled in your<br />
building. With that in place, after confirming the identity of the person at the front door, you can grant<br />
access remotely to align with current social distancing guidelines. It’s completely contactless; hence, no<br />
health fears.<br />
Cloud-based solutions<br />
We come in contact with cloud-based solutions every day. Cloud capabilities have long surpassed<br />
networks for many reasons. The benefits of cloud-based access control mirror the secure and resilient<br />
nature that make the solution so attractive. COVID-19 has exacerbated the utility of on-premise systems,<br />
so the security industry is shifting to put systems management back into the hands of the experts.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 131<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Remote access control and visitor management<br />
With remote visitor management, it’s possible to remain a healthy distance away from others while<br />
granting or denying access from anywhere. Many times, especially in today’s environment, it’s not<br />
possible to physically welcome a visitor. So, remote capabilities are now becoming an essential feature<br />
when it comes to building a sound facility operation.<br />
Accountability<br />
Accountability has been a security component, but never has it been so pronounced as it is today.<br />
Advanced visitor management systems have the ability to capture data that hasn’t been possible before.<br />
With the help of video intercom, it’s possible to review who is in the building, for what reason, and for<br />
whom. This is incredibly useful in the event of an emergency or should an incident occur within the facility,<br />
where the facility manager is the one held accountable.<br />
About the Author<br />
Melvin Braide, Content Writer<br />
Melvin Braide is a professional content writer and copywriter at Swiftlane, with<br />
a degree in Mechanical Engineering and years of experience writing across<br />
various niches. Melvin focuses on providing valuable and educational content<br />
for Swiftlane’s growing audience in the areas of access control, visitor<br />
management, and security.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 132<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 133<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 134<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 135<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 136<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 137<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 138<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 139<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 140<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Meet Our Publisher: Gary S. Miliefsky, CISSP, fmDHS<br />
“Amazing Keynote”<br />
“Best Speaker on the Hacking Stage”<br />
“Most Entertaining and Engaging”<br />
Gary has been keynoting cyber security events throughout the year. He’s also been a<br />
moderator, a panelist and has numerous upcoming events throughout the year.<br />
If you are looking for a cybersecurity expert who can make the difference from a nice event to<br />
a stellar conference, look no further email marketing@cyberdefensemagazine.com<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 141<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
You asked, and it’s finally here…we’ve launched <strong>Cyber</strong><strong>Defense</strong>.TV<br />
At least a dozen exceptional interviews rolling out each month starting this summer…<br />
Market leaders, innovators, CEO hot seat interviews and much more.<br />
A new division of <strong>Cyber</strong> <strong>Defense</strong> Media Group and sister to <strong>Cyber</strong> <strong>Defense</strong> Magazine.<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 142<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
FREE MONTHLY CYBER DEFENSE EMAGAZINE VIA EMAIL<br />
ENJOY OUR MONTHLY ELECTRONIC EDITIONS OF OUR MAGAZINES FOR FREE.<br />
This magazine is by and for ethical information security professionals with a twist on innovative consumer<br />
products and privacy issues on top of best practices for IT security and Regulatory Compliance. Our<br />
mission is to share cutting edge knowledge, real world stories and independent lab reviews on the best<br />
ideas, products and services in the information technology industry. Our monthly <strong>Cyber</strong> <strong>Defense</strong> e-<br />
Magazines will also keep you up to speed on what’s happening in the cyber-crime and cyber warfare<br />
arena plus we’ll inform you as next generation and innovative technology vendors have news worthy of<br />
sharing with you – so enjoy. You get all of this for FREE, always, for our electronic editions. Click here<br />
to sign up today and within moments, you’ll receive your first email from us with an archive of our<br />
newsletters along with this month’s newsletter.<br />
By signing up, you’ll always be in the loop with CDM.<br />
Copyright (C) <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine, a division of CYBER DEFENSE MEDIA GROUP (STEVEN G.<br />
SAMUELS LLC. d/b/a) 276 Fifth Avenue, Suite 704, New York, NY 10001, Toll Free (USA): 1-833-844-9468 d/b/a<br />
<strong>Cyber</strong><strong>Defense</strong>Awards.com, <strong>Cyber</strong><strong>Defense</strong>Magazine.com, <strong>Cyber</strong><strong>Defense</strong>Newswire.com,<br />
<strong>Cyber</strong><strong>Defense</strong>Professionals.com, <strong>Cyber</strong><strong>Defense</strong>Radio.com and <strong>Cyber</strong><strong>Defense</strong>TV.com, is a Limited Liability<br />
Corporation (LLC) originally incorporated in the United States of America. Our Tax ID (EIN) is: 45-4188465,<br />
<strong>Cyber</strong> <strong>Defense</strong> Magazine® is a registered trademark of <strong>Cyber</strong> <strong>Defense</strong> Media Group. EIN: 454-18-8465, DUNS#<br />
078358935. All rights reserved worldwide. marketing@cyberdefensemagazine.com<br />
All rights reserved worldwide. Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved. No part of this<br />
newsletter may be used or reproduced by any means, graphic, electronic, or mechanical, including photocopying,<br />
recording, taping or by any information storage retrieval system without the written permission of the publisher<br />
except in the case of brief quotations embodied in critical articles and reviews. Because of the dynamic nature of<br />
the Internet, any Web addresses or links contained in this newsletter may have changed since publication and may<br />
no longer be valid. The views expressed in this work are solely those of the author and do not necessarily reflect<br />
the views of the publisher, and the publisher hereby disclaims any responsibility for them. Send us great content<br />
and we’ll post it in the magazine for free, subject to editorial approval and layout. Email us at<br />
marketing@cyberdefensemagazine.com<br />
<strong>Cyber</strong> <strong>Defense</strong> Magazine<br />
276 Fifth Avenue, Suite 704, New York, NY 1000<br />
EIN: 454-18-8465, DUNS# 078358935.<br />
All rights reserved worldwide.<br />
marketing@cyberdefensemagazine.com<br />
www.cyberdefensemagazine.com<br />
NEW YORK (US HQ), LONDON (UK/EU), HONG KONG (ASIA)<br />
<strong>Cyber</strong> <strong>Defense</strong> Magazine - <strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> rev. date: 11/02/<strong>2020</strong><br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 143<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
TRILLIONS ARE AT STAKE<br />
No 1 INTERNATIONAL BESTSELLER IN FOUR CATEGORIES<br />
Released:<br />
https://www.amazon.com/Cryptoconomy-Bitcoins-Blockchains-Bad-Guys-ebook/dp/B07KPNS9NH<br />
In Development:<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 144<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
Nearly 9 Years in The Making…<br />
Thank You to our Loyal Subscribers!<br />
We've Completely Rebuilt <strong>Cyber</strong><strong>Defense</strong>Magazine.com - Please Let Us Know<br />
What You Think. It's mobile and tablet friendly and superfast. We hope you<br />
like it. In addition, we're shooting for 7x24x365 uptime as we continue to<br />
scale with improved Web App Firewalls, Content Deliver Networks (CDNs)<br />
around the Globe, Faster and More Secure DNS<br />
and <strong>Cyber</strong><strong>Defense</strong>Magazine.com up and running as an array of live mirror<br />
sites. Millions of monthly readers and new platforms coming…<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 145<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 146<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 147<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 148<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 149<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2020</strong> <strong>Edition</strong> 150<br />
Copyright © <strong>2020</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.