Business Advice

Connecting To Aiport Wi-Fi Puts Your Data At Risk

August 9, 2018 by Joseph Martin

File this away under things you already knew. Coronet recently released a report entitled “Attention All Passengers: Airport Networks Are Putting Your Devices & Cloud Apps At Severe Risk,” and the news is about what you’d expect.

The report was more than five months in the making. The analysts poured over oceans of data on device vulnerabilities and Wi-Fi network risks from more than a quarter of a million consumer and corporate endpoints that passed through the 45 busiest airports in the United States.

The bottom line is simply that airport Wi-Fi is woefully unsafe, especially as compared to most corporate networks, and anyone connecting to those networks is asking for trouble.

Some offenders proved to be worse than others. The report names the San Diego International Airport, John Wayne Airport – Orange County (CA), and the William P. Hobby International Airport (Houston, TX) as being among the least secure in the nation.

The risk is that while traveling, most people don’t think about what network they’re connecting to or how secure it might be. This is an incredible opportunity for hackers, because once an employee’s laptop or mobile device is infected, the integrity of the employers’ cloud-based work apps is jeopardized.

Coronet’s founder, Dror Liwer, had this to say about the findings:

“Far too many US airports have sacrificed the security of their Wi-Fi networks for consumer convenience. As a result, business travelers in particular put not just their devices, but their company’s entire digital infrastructure, at risk every time they connect to Wi-Fi that is unencrypted, unsecured, or improperly configured.

Until such time when airports take responsibility and improve their cybersecurity posture, the accountability is on each individual flyer to be aware of the risks and take the appropriate steps to minimize the danger.”

Be sure your employees are aware of the risks any time they travel. Your company’s future might depend on it.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

E-Mail Is A Big Threat To Your Organization

August 4, 2018 by Joseph Martin

Mimecast’s 2018 “State of Email Security” report is out, and although it’s contents are hardly a surprise, the news it contains is mostly bad.

For starters, it confirms what most IT professionals already know:

Email continues to be a big threat for organizations of all sizes.

Unfortunately, the C-Suite (CEO’s, CIO’s, CFO’s, and the like) are a major part of the problem, representing a significant weak link in Enterprise security. Not only are they a prime target for hackers, but according to the survey, 40 percent of respondents agreed that their organization’s CEO was a painfully “weak link” in their organization’s cyber-security operations.

Just as alarming, 31 percent of respondents said that C-level employees are very likely to have accidentally sent sensitive or proprietary information to the wrong person, a statistic up 9 percent from last year.

In addition to that, email is the primary means by which ransomware winds up getting inside company networks. This comes with a staggering 92 percent of successful ransomware attacks arriving via that channel, resulting in three or more days of downtime for the impacted companies.

Phishing attacks also continue to be a major issue, with 90 percent of respondents reporting an increase in the number of phishing attacks they were subjected to.

In light of these statistics, one would imagine that companies would be devoting significant resources to countering the threat. Unfortunately, that’s just not happening. Sure, money is being spent on infrastructure, but humans are the weakest link in this chain, and not just in the C-Suite. According to the survey, only 11 percent of organizations continuously train their employees on how to spot cyberattacks, and just over half (52 percent) perform training just once a year.

Matthew Gardiner, a cyber-resilience expert at Mimecast, summarizes it this way :

“Security awareness is an important part of any high-functioning security program. But like all security controls, there is no silver bullet solution. The best security programs seek a balance between technical controls, boosting their human firewalls, and having IT enabled business processes that are resilient to failures, whether man-made or caused by technology.”

Indeed.

Joseph Martin

New Report Shows 32 Percent Increase In Cyber Attacks

July 28, 2018 by Joseph Martin

Positive Technologies has just released a new report that paints a grim picture for IT professionals. If your sense is that the number of cyberattacks are increasing, you’re not wrong. In fact, it’s probably worse than you realize.

So far this year, we’ve seen a staggering 32 percent increase in the total number of cyberattacks in the first quarter of 2018, compared to the same period last year. Even worse, malware attacks have increased by a mind-bending 75 percent since the first quarter of 2017.

Individuals were far and away the most frequent target (28 percent), but government agencies came in a reasonably close second (16 percent), with business in the healthcare, finance, and IT sectors rounding out the top five (8 percent, 7 percent, and 5 percent, respectively).

Of the malware deployed against targets this year, spyware was by far the most common, with stealth cryptocurrency mining software not far behind.

Leigh-Anne Galloway, the cyber security resilience lead at Positive Technologies explains in more detail:

“Our research shows that 63 percent of attacks included use of malware. Spyware, in particular, is used most often because it allows obtaining not only personal information and corporate secrets, but credentials for the services and systems needed to attack internal corporate infrastructure.”

Long story short, the prevalence of spyware seen in this report is likely to have cast-off effects in the future. Hackers will gain a sufficient level of access and information, courtesy of their successful spyware attacks, to launch even more harmful attacks against both individuals and government/corporate institutions in the future.

Positive Technologies warns that the number of attacks is likely to continue to escalate, and that there’s no clear end in sight.

The report is dark news if you’re in the digital security business. If your business hasn’t been hit yet, it seems that it’s just a matter of time.

Joseph Martin

Majority Of Web Apps Found To Have Security Vulnerabilities

June 29, 2018 by Joseph Martin

How many web apps do you have on your phone? Probably a ton. Here’s something you likely didn’t know. Based on the latest research from Positive Technologies, nearly half of them (48 percent) are vulnerable to unauthorized access.

As bad as that is, it’s just the tip of the proverbial iceberg.

Here are some additional disturbing stats from their report :

44 percent of the apps with vulnerabilities place the user’s personal data at risk

70 percent are prone to leak critical information stored on the device

96 percent of them contain flaws that would allow any malicious actor to exploit them to launch an attack on the target device

Of those, one in six (17 percent) has a flaw severe enough that it would allow an attacker to assume complete control over the app, and from there, the device itself

The majority of these flaws (some 65 percent) are the result of simple coding errors, with improper configuration of web servers being the most common of these.

There is one bright spot in the otherwise dismal report, though. The percentage of apps with critical vulnerabilities has declined slightly, down from 52 percent last year, and 59 percent the year before. So the numbers, while frustratingly large, are trending in the right direction.

Ed Keary, the CEO of Edgescan had this to say on the topic:

“DevSecOps needs to be embraced such that security is throughout the development pipeline. Application component security management (software components used by developers) is still not commonplace in terms of supporting frameworks and software components and is a common source of vulnerability.”

If your firm designs such applications, pay special attention to this report and review your code base at the earliest opportunity. Even if you don’t, it pays to be mindful of the percentages, because odds are that your employees have several at-risk apps on the devices they’re connecting to your network.

Joseph Martin

New InvisiMole Malware Turns Your System Into A Video Camera

June 22, 2018 by Joseph Martin

Another week, another new threat. This time, in the form of a new strain of malware that researchers are calling InvisiMole. The new threat was discovered by researchers at ESET, who found it on a number of hacked computers in Russia and the Ukraine.

While the researchers have yet to trace the software back to the group that developed it, based on the available evidence, the campaign appears to be tightly targeted and highly selective. Only a few dozen computers have been found to be infected, although all impacted systems are both high-profile and high-value.

As for the software itself, it’s a nasty piece of business capable of quietly taking control over an infected system’s video camera and capture audio. This allows them to both see and hear anything going on in the vicinity of the system. Essentially then, InvisiMole turns your computer into a compromised Amazon Echo.

Based on the sophisticated design of the software and the fact that the researchers have yet to be able to trace it back to the source, it’s believed that it has been developed by (or at least in partnership with) an unknown state actor. Although the current campaign is small and highly targeted, given its capabilities, InvisiMole could easily become a much more serious threat.

Even worse, it’s entirely possible that the original developers could lose control of the code, or that some other hacker group could reverse engineer it, causing it to spread far and wide.

Research into the software is still ongoing, and at this point ESET can’t say with certainty how the malicious payload is being delivered to target machines. Of course, at present, there is no antivirus software defense against it. Stay on your guard. You never know who might be watching.

Joseph Martin

Study Shows Employee Satisfaction Is Higher With Technology Improvements

June 18, 2018 by Joseph Martin

A new study recently published by HPE Aruba called “The Right Technologies Unlock The Potential Of The Digital Workplace,” reveals some interesting details about technology in the workplace that’s worth paying attention to.

The study was conducted by collecting feedback from more than seven thousand companies of various sizes around the globe. These were broken broadly into two groups: “Digital Revolutionaries,” which made more and better use of cutting edge technology, and “Digital Laggards” which were slower to adopt the latest and greatest technologies.

The headline statistic is that 51 percent of employees working in companies employing more technology reported greater job satisfaction, and an impressive 72 percent of employees in these companies reported a greater ability to adopt new work-related skills.

Other intriguing statistics include:

31 percent of respondents in the “Digital Laggard” category indicated that tech aided their professional development, compared with 65 percent in the “Digital Revolutionary” category

92 percent of respondents said that more technology would improve the workplace overall

69 percent of respondents indicated a desire to see fully automated equipment in more widespread use in the workplace

Joseph White, the Director of Workplace Strategy, Design and Management at Herman Miller said in a press release:

“No matter the industry, we’re seeing a move toward human-centric places as enterprises strive to meet rapidly changing expectations of how people want to work. This depends upon combining advances in technology -which includes furnishings- with the cognitive sciences to help people engage with work in new ways. This will not only mean singular, premium experiences for individuals, but also the opportunity for organizations to attract and retain the best talent.”

The study notes, however, that cyber security issues remain as challenging as ever. Survey respondents reported lower than average cyber security awareness, which could lead to greater risks and exposure as workplaces become increasingly digitized.

While a small majority (52 percent) of respondents reported thinking about cybersecurity often (daily), fully a quarter have connected to unsecured WiFi and one in five reported using the same passwords across multiple web properties. These are the two most dangerous cybersecurity-related behaviors.

Clearly, increased technology has its risks.

Joseph Martin

No Spectre Fix For Certain Intel Processors

April 24, 2018 by Joseph Martin

The bad news just doesn’t seem to stop where Intel and the Speectre vulnerability are concerned. The latest bit of news comes directly from Intel, as the company admits that it’s just not possible to address the Spectre vulnerability in some of its older hardware. This means that nine families of chips and more than 230 models of computers (mostly manufactured between 2007 and 2011) will remain vulnerable to Spectre forever.

The company has stopped Spectre mitigation development on the following families of chips:

Bloomfield

Clarksfield

Gulftown

Harpertown Xeon

Jasper Forest

Penryn

SoFIA 3GR

Wolfdale

Yorkfield

A company spokesman had this to say about the recent announcement:

“We’ve now completed the release of microcode updates for Intel microprocessor products launched in the last 9+ years that required protection against the side-channel vulnerabilities discovered by Google. However, as indicated in our latest microcode revision guidance, we will not be providing updated microcode for a select number of older platforms for several reasons, including limited ecosystem support and customer feedback.”

It’s unfortunate, but not entirely unexpected. If you have any older Intel equipment still in service at your company, have your IT group check the processor family. If it’s one of the above, it’s well worth marking those systems high priorities for upgrades, and limiting their use until you can.

Spectre is a devastating flaw, and it’s just not worth the risk to leave exposed systems connected to your network and in service. This is especially true now that it’s official that no help is coming for certain older systems.

Even worse, AMD chips, which are not impacted by Spectre and Meltdown, have since been found to have their own critical security flaws. While not as bad or as pervasive as the two Intel is facing, they will nonetheless require the company to issue its own microcode updates, which they are currently scrambling to do.

The long and the short of it is that there really are no safe harbors anymore.

Joseph Martin

Does Your Business Have A Cybersecurity Incident Response Plan?

March 30, 2018 by Joseph Martin

If your company has an incident response plan that you can rely on in the face of a cyber attack, then you’re ahead of most of the world, according to research recently conducted by the Ponemon Institute. Shockingly, more than 75 percent of survey respondents from around the world admitted that they have no formal incident response plan. Even worse, half of the companies that indicated they had an incident response plan said that it was informal.

Curiously, given these statistics, 72 percent of organizations indicated that they were more resilient today than they were the year before. They also indicated a high level of confidence in their staff to respond appropriately to any problem that arose.

Given the stark reality and the ever-increasing number of attacks, that comes off more like bravado than genuine confidence. Ted Julian, the Vice President of product management of IBM Resilient (sponsor of the Ponemon Institute’s research) had this to say:

“Having the right staff in place is critical, but arming them with the most modern tools to augment their work is equally important. A response plan that orchestrates human intelligence with machine intelligence is the only way security teams are going to get ahead of the threat and improve overall cyber-resilience.”

This year, most of the provisions of a new piece of legislation, GDPR (General Data Protection Regulations) come into effect, and companies that don’t have a formal incident response plan by then could pay a hefty price. Even if that weren’t the case, the research concluded that the overall cost of a data breach was nearly a million dollars lower on average when companies were able to deal with the breach decisively and contain it within thirty days.

The bottom line is, if you don’t have one yet, now is the time.

Joseph Martin

Attacks on Health Organizations Increasing At Alarming Rate

March 26, 2018 by Joseph Martin

It used to be the case that credit card companies and retail outlets were the primary targets of hackers around the world. Make no mistake, they still get attacked with regularity, but the hackers have found a new and even more lucrative target: Health Organizations.

According to a new report jointly produced by the Ponemon Institute and Merlin International, the medical/healthcare industry suffered nearly a quarter (23 percent) of all the data breaches that occurred in 2017. It gets worse. Those breaches exposed PHI and PII of more than five million individuals.

The reason for the shift away from credit card data to medical records comes down to profits. PHI and PII can often be sold on the Dark Web for ten times the amount that credit card information will bring. The hackers are simply obeying the laws of economics and going where the money is.

Brian Wells, the Director of Healthcare Strategy at Merlin International had this to say about the report:

“In an increasingly connected, digitally centric world, hackers have more opportunities and incentive than ever to target healthcare data, and the problem will only increase in scope over time.

Healthcare organizations must get even more serious about cyber security to protect themselves and their patients from losing access or control of the proprietary and personal information and systems the industry depends on to provide essential care.”

Worst of all, a shocking percentage of medical/healthcare companies don’t seem to be serious about cyber security at all. Although the average cost of a medical data breach is approximately four million dollars, a staggering 49 percent of companies in the industry don’t have an incident response plan of any kind. There’s no process in place to properly respond to an attack, or to mitigate the fallout if a breach occurs. These companies are sitting ducks.

Used with permission from Article Aggregator

Joseph Martin

Google Will Get Tougher On Websites Not Using HTTPS

February 27, 2018 by Joseph Martin

Google is poised to make an important change to its Chrome browser beginning in July 2018.

Here’s the summary from Emily Schechter, the Google Chrome Security Product Manager:

“For the past several years, we’ve moved toward a more secure web by strongly advocating that sites adopt HTTPS encryption, and within the last year, we’ve also helped users understand that HTTP sites are not secure by gradually marking a larger subset of HTTP pages as ‘not secure.’ Beginning in July 2018 with the release of Chrome 68, Chrome will mark all HTTP sites as ‘not secure.'”

All the major browsers already have plug-ins that alert users anytime they’re visiting a non-secure (HTTP) website, but Google’s planned move will likely prompt them to incorporate the notification into their core product as well.

According to Google’s statistics, 81 of the top 100 sites (as ranked by traffic volume) already use HTTPS. In addition to that, Google reports that 68 percent of Chrome users are finding HTTPS when using Android and Windows, and 78 percent of the time when using Mac OS X, iOS, and Chrome OS. Those figures are markedly higher than they were in 2010, when an estimated 40 percent of websites were using the secure socket layer.

If your company’s website hasn’t already made the switch, the time to do so is now. The writing is clearly on the wall, and it’s not hard to imagine that after Google begins “shaming” non-secure sites with the notification, they’ll also start implementing penalties that will hurt their position on search results pages. Even if they don’t, the persistent non-secure warnings will be enough to keep many users away, so it doesn’t matter how well optimized or SEO-friendly your site is, an increasing percentage of users may simply opt out if it’s not secure.

Joseph Martin

Connecting To Aiport Wi-Fi Puts Your Data At Risk

E-Mail Is A Big Threat To Your Organization

New Report Shows 32 Percent Increase In Cyber Attacks

Majority Of Web Apps Found To Have Security Vulnerabilities

New InvisiMole Malware Turns Your System Into A Video Camera

Study Shows Employee Satisfaction Is Higher With Technology Improvements

No Spectre Fix For Certain Intel Processors

Does Your Business Have A Cybersecurity Incident Response Plan?

Attacks on Health Organizations Increasing At Alarming Rate

Google Will Get Tougher On Websites Not Using HTTPS

Contact Info

Navigation