TweakTown NewsRefine News by Category:
If you've ever heard someone guarantee 100 percent security to you in cyberspace then you know you've got yourself a liar - and not a very good one. Of course, cyberspace will never be truly secure according to Martin Giles. This is why cyber security is becoming increasingly complex and as threats do as well. Huge compromises to data occur in rare events, but the biggest day-to-day threats come in the form of crooks attempting to steal financial data from businesses and individuals.
The hackers best at what they do are certainly making life more difficult for cyber security professionals. Simply put, however, the most common breaches of security are often the result of the most obvious mistakes. For example, an employee can physically write down a password on paper only to have it fall into the wrong hands, or customer information is available to those that have no business with such confidential information. Because of this, it appears that some businesses are not able to anticipate incoming cyber attacks.
In fact, there are reports that argue there is a great need to actually provide businesses with incentives to take cyber security more seriously than they already are. Here are some simple tips for prevention:
Manage your Internet connection appropriately
By managing your Internet connection, both businesses and customers are better off throughout the payment processing activity online. Internet providers have been prompted by corporations to better manage Internet connections by taking more responsibility in helping their clients identify and fix any potential cyber security problems that they may be experiencing. Example, infectious malware is a common issue that could be cleared up by the Internet service provider fairly easily.
A former employee with Morgan Stanley was canned after being accused of stealing and looking to sell personal information of 350,000 of the firm's clients.
Wealth Management clients are now being informed that the employee took partial client data - and there is no evidence of economic loss - but client information of up to 900 clients, including account names and numbers, were posted on the Internet.
"Morgan Stanley takes extremely seriously its responsibility to safeguard client data, and is working with the appropriate authorities to conduct and conclude a thorough investigation of this incident," the company said in a public statement.
CES 2015 - The annual Consumer Electronics Show (CES) is supposed to be all about announcing and launching new, innovative products, but it wasn't all fun for Sony. Kazuo Hirai, president and CEO of Sony, spoke out against the cyberattack that hit Sony Pictures, while applauding employees for their resolve.
The Guardians of Peace made it a rough end of the year for Sony Pictures, crippling the company, leaking embarassing emails, stealing data, and terrorizing former and current employees - and it remains a rather trying time for employees.
Both Sony, former employees and current employees were the victim of one of the most vicious and malicious cyberattacks in recent history," Hirai said. "I have to say that I'm very proud of all the employees, and certainly the partners who stood up against the extortionist efforts of criminals, and worked tirelessly, sometimes for days on end to bring you 'The Interview,'"
The bitcoin exchange BitStamp has suspended operation following a significant data breach in which 19,000 bitcoins - valued at more than $5 million - were stolen from the company. BitStamp has frozen user accounts, blocked deposits and suspended all trades as an investigation and security audit are reportedly underway.
The company has a public disclaimer informing customers of the breach on its website: "Upon learning of the breach, we immediately notified all customers that they should no longer make deposits to previously issued bitcoin deposit addresses," part of the message reads. "To repeat, customers should NOT make any deposits to previously issued bitcoin deposit addresses."
Bitcoins endured a turbulent growth period in 2014, with more consumers and businesses expanding adoption - but the currency remained volatile, and overall value has dipped. These type of incidents could be catastrophic for future growth of bitcoins, at a time when consumers already are skeptical of long-term potential.
There was a 50 percent decline in cyberattacks against U.S. retailers in 2014, but a whopping 61 million records were taken in the data breaches that did occur, according to a recent IBM Security report. In 2013, there were 4,200 recorded daily cyberattacks, and that number dropped to 3,043 in 2014.
Cybercriminals are perfecting their craft and using newer, more sophisticated techniques to compromise retailers. Despite increased concern that criminals would target Black Friday and Cyber Monday, but they instead waited it out and are carefully choosing how they launch attacks.
"The threat from organized cybercrime rings remains the largest security challenge for retailers," said Kris Lovejoy, GM of the IBM Security Services, in a press statement. "It is imperative that security leaders and CISOs in particular, use their growing influence to ensure they have the right people, processes and technology in place to take on these growing threats."
Cybercriminals are finding new methods to compromise corporate and government networks, and are increasingly spending more time doing reconnaissance without being detected. These longer-lasting operations are difficult to prevent with many corporations focusing on perimeter-based cybersecurity defense, not considering the idea that criminals may already be inside.
Companies such as Sony Pictures, Home Depot, Target and other major corporations are first breached using spear-phishing attacks or stolen third-party user login credentials - and the problems only get worse from there. Cybersecurity experts recommend creating protocols so companies are able to identify who is accessing data, from where, and how they are interacting with the accessed data. If a cybersecurity audit is completed, then following through with recommended improvements should also be carried out as quickly as possible.
"We are beginning to realize in some cases that the situation is far worse than we realized," said Stephen Hulquist, chief evangelist at RedSeal Networks, in a statement published by Dark Reading. "In some cases attackers have been inside networks for months and even years without being discovered."
Malware threats garnered major media attention throughout 2014, but cybersecurity experts are concerned that casual users and business decision leaders aren't going to proactive enough to prevent breaches.
There will be more attention directed towards ransomware, which typically begin with a successful phishing attack. Ransomware demands monetary payments for criminals to turn over control of systems and data back to the victim, and evasion techniques used to deliver payloads are becoming increasingly sophisticated.
"In 2014 we saw a number of significant wins against malware with the dismantling of several major botnets. This type of takedown will be much harder in 2015 with malware becoming stealthier," said Andy Avanessian, VP of professional services at endpoint security company Avecto, in a statement published by Forbes. "In the coming months, we will see increased use of p2p, darknet and tor communications, forums selling malware and stolen data will also retreat further into hidden corners of the internet in an attempt to avoid infiltration."
Password length, complication and changes are something that many companies, news outlets and IT whizz-kids often drum into the general consumer. One of the best ways to prevent yourself falling victim to your 'general hacker' is to keep your passwords fresh, long and complicated.
iDict is a basic password-guesser that has just been pushed to GitHub. Containing a list of 500 passwords in its library, it will try to guess your accounts password based solely upon the list it has at hand. If your password looks anything like those of this list, we suggest you change them immediately for all services and never look back.
These types of simple passwords are often seen in the 'most popular password lists', with password1 or 12345 often ranking quite highly.
Remember how children these days are taught not to 'joke' about security when in an airport? The same should go for online mediums. Homeland Security blogger, David Garrett Jr., spent his new years day being questioned by the FBI - thanks to an apparent joke in which he 'threatened' CNN, posing as a GOP member and leading the FBI to believe the threats to be real.
Thankfully for Garrett, this was poised as a joke and he 'came clean' straight away. In a statement to Fusion, Garrett claimed that a FBI investigator wisely told him "in the future, it's a good idea not to pretend to be someone they're investigating."
In the end everyone has come out unharmed with the only cost being a waste of the FBI's time. Take note kids, sometimes the feds can press charges and make arrests even for what you might think is a joke - luckily in this case, Garrett was let go without prosecution.
Cybersecurity experts believe 2015 will be another busy year, as sophisticated attacks against users and businesses continue. Criminals will rely on working attacks to compromise victims, while also working to advance their weapons, making them harder to spot.
"Hackers are a diverse bunch, from lone wolves, to nation-state cyber warriors and organized cybercrime rings," said Joe Caruso, founder, CEO and CTO of the cybersecurity Global Digital Forensics (GDF) firm, in a press release. "But one thing they all have in common is they are more than willing to let it ride on a winning horse until it quits paying off. SO expect the favorites, phishing and spear-pshing, RATs (Remote Access Tools), ransomware, watering hole attacks and other third-party compromises, to keep getting ridden hard in 2015."
Numerous point-of-sale (POS) data breaches and the cyberattack against Sony Pictures should serve as painful reminders as to the importance of proper cybersecurity - but won't lead to decision makers acting urgently enough, many security specialists warn. As such, companies need to become proactive in conducting cybersecurity audits, and then following through to improve security protocols - in an attempt to make it more difficult for successful attacks to occur.