“You don’t know what you don’t know.” It sounds trite, but it’s true. You probably don’t realize that a dormant crypto-locker malware file is sitting quietly, undetected, on a computer or server. All it needs is the right moment or the right command. Like Clint Eastwood’s Dirty Harry character said in the movie Magnum Force: “A man has got to know his limitations.” Organizations – no matter the size – need to determine their limitations from a security standpoint.
Organizations that have not checked their overall cybersecurity posture are effectively asking for trouble. Broader vulnerability assessments and more targeted penetration tests are effective starting points from which to shore up cyber defences. Besides ransomware, which hit new heights during the COVID-19 pandemic, a major problem facing organizations is data breaches. Data breaches often lead to irrecoverable financial losses, reputation hits, business losses, talent losses, and general stress and embarrassment. There are many more reasons, but this list focuses on six reasons an organization should assess its security (in no particular order).
1. Identifying Risk Within the Organization
This should be a common practice for your IT team. It easy to be lulled into a false sense of security just because nothing bad has happened yet. It is foolish at best, and negligent at worst to take immunity from cyber threats for granted. Conducting yearly or semi-annual security risk assessments either internally or through a trusted partner will provide an extra layer of security insights, which can be used to protect against data breaches. Many of the threats affecting small and medium businesses aren’t even targeted. Like Covid-19, attacks move from one person or organization to another. No organization is immune to a talented hacker who is determined to infiltrate your systems for fun or profit, hackers look for security gaps, and you should do the same. By understanding and knowing what gaps you have, you can make most of the necessary fixes and take the low hanging fruit out of harm’s way.
To put it simply, there are two methods to assess security risk. The first is called a Penetration Test – more commonly known as a Pen Test. Pen Tests are an active attempt to hack or access networks, websites, applications, conducted by an ethical hacker – one of the good guys. It is a real cyber-attack that targets a specific area, or it can be broad and open ended. From this test, IT managers or chief security officers will get a detailed look at how well the security systems, networks and applications in place are performing along with identifying vulnerabilities within the system. It also informs the organization of their strengths and whether they are adhering to current compliance and security policies, which is also quite valuable.
The second method is called a vulnerability scan, and these tests are meant to be fast, passive, high, and wide across the organization. This approach compares a current state to accepted minimum standards, leading to a grade of how good your security is. These assessments take into account the currency and completeness of patching, availability of easily exploitable ports, scanning for known malicious applications, and susceptibility to common attack methods like SQL injections.
2. Avoid Security Breaches
Data breaches are expensive. According to the annual Cost of a Data Breach Report, conducted by the Ponemon Institute and sponsored by IBM Security, the average total cost of a data breach is just under $4 million US. For an SMB business, this would sound the death-knell. For mid to large enterprises, it can lead to a severe disruption in business that could have lasting effects. But depending on the type of organization, it could be worse. Ponemon found that for healthcare providers, a data breach averages $6.45 million. The average data record size for data breaches is an outstanding 25,575 records per incident, which would lead to a massive hit on any organization’s reputation and brand.
By conducting a security risk assessment and following through with the recommendations, you can better protect data and avoid the costs associated with a hack. A security assessment will focus on malware analysis, reverse engineering, cryptography, exploit development, offensive and defensive security. A well-crafted assessment will lead to a report laying out clear, actionable insights coupled with effective remediation steps to help organizations lower risk and identify areas requiring improvement.
3. Protecting Your Reputation
According to the Harvard Business Review, an extra star in a restaurant’s Yelp rating increases business between five and nine percent. On the flip side, negative reviews keep customers away in droves. A hit to an organization’s reputation because of a data breach or hack will have a similar, lasting impact, especially if it becomes public. In most cases, companies have to legally announce the breach based on PIPEDA and GDPR laws and regulations. Many organizations aren’t aware that they are subject to laws based on where their customers reside, not just where their corporation is physically or legally registered. The bottom line is that customers will avoid you, or worse, leave you.
Rebuilding a tarnished brand is expensive. By foregoing annual security risk assessments, organizations are gambling with their own future, and more broadly, risking their stakeholders – staff, suppliers, business partners, and company shareholders. It isn’t unheard of for direct and indirect victims to take legal action seeking compensation for their own damages. The fallout continues to staff and the ability to find and retain talent – nobody wants to work for an organization that shows itself to be somewhere between incompetent and ignorant. Share prices have been known to take a hit, which only serves to prolong and aggravate the pain of the original hack. One security breach can put an organization into permanent “Damage Control” that can take years to overcome.
4. Maintaining IT Budgets
Any good CFO should easily conclude that the cost associated with Pen Tests or Vulnerability Scans are a drop in the bucket compared to the wide-ranging losses stemming from a data breach. For example, Canadian businesses are now mandated to reveal if they have succumbed to a data breach if determined that the data under the control of the organization has the potential to fall into the wrong hands. A failure to report these breaches, even seemingly innocent violations, can lead to fines of up to $100,000 under the Personal Information Protection and Electronic Documents Act (PIPEDA). The majority of organizations do not budget for PIPEDA fines and the such. Potential lawsuits are also a factor and recovering data also eats into the budget. While some might be tempted to think that cyber security insurance will pick up the tab, think again. Merck & Co found out the hard way when their insurance company turned down their claim for $1.5 billion. By scheduling a security assessment, you can build that into your budget and avoid surprises. Your organization’s budget and cash flow are more at risk if you don’t invest in proactive systems and programs like; security monitoring, security identification and event management system (SIEM), or Layer 7 firewalls, and often most overlooked, user education.
5. Avoid Violating Privacy and Data Laws
As in the previous reason, six-figure fines can be avoided by an annual security risk assessment. The PIPEDA fine is a six-figure sum, and penalties from other compliance/privacy acts are not cheaper. Violators of the GDPR (General Data Protection Regulation for the European Union) can risk fines of up to 20 Million Euros. Then there’s SOX (Sarbanes-Oxley Act), HIPAA (the US Health Insurance Portability and Accountability Act), and there are even state-run laws such as CCPA (California Consumer Privacy Act). Then, there is the LGPD, a new act that comes into effect next month from Brazil. LGPD stands for Lei Geral de Protecao de Dados Pessoais) or Brazil’s General Data Protection Law. LGPD, like the EU’s GDP protects Brazilians’ data, no matter where that data is stored. Think about a Brazilian tourist shopping at a store using a credit card, then the store being hacked leading to credit card fraud against the tourist. In theory, the store is liable for those damages. The efficacy and implementation of these laws remain to be seen, but there are other punitive measures countries can take against offenders such as blocking their websites at a country level.
6. Increase Productivity Levels
Finally, if your organization is infected with a virus or hit with ransomware your employees’ overall performance and productivity will suffer. Take a minute to think about how effective your business is during a power or internet outage. Now multiply that by the number of days and add some indirect costs and future losses for good measure. By doing a security assessment and implementing up-to-date security protocols, you ensure productivity levels, while reducing risks. According to a Ponemon, the most significant impact of an attack may be in end-user productivity losses because the IT systems are not functioning. As organizations embrace digital transformation and cloud-based systems along with the rise of the remote worker because of the COVID-19 pandemic, this risk only increases. SaaS models mean businesses are now subject to multiple sources of failure in their operations and activities. Imagine if a cloud hosted accounting suite were taken offline by hackers – no invoices, no cash tracking and much more.
Jolera has a variety of assessment options available to help identify possible weaknesses and exploits and determine possible real-life outcomes of a successful attack. If you’re interested in learning more contact usfor more information.
The curve may not be flat, but at many levels of government both in Canada and around the world, discussions about restarting the economy and reopening businesses are beginning. Strategies are starting to develop that will see people eventually get back to the office, stores, factories and other workplace locations they are used to going to for work.
As the new guidelines are developing, expect to see social or physical distancing and other forms of protective measures becoming a significant part of any get-back-to-work program.
What will these types of programs look like for organizations?
How can an individual who has spent the better part of March and all of April indoors begin to ready themselves for a return? Some clues can be found in the way other countries are dealing with the aftermath of COVID-19 lockdown.
In Austria, the aim was to start small and build from there. The European country only had small shops of 400 square meters open at first. These openings were under guard for security. Masks were mandated in these shops and on public transport. If the Austrian restart went well, then the country would look to open hotels, shopping malls and restaurants in two weeks.
Meanwhile, in Denmark, that country embarked on a more conservative staggered approach. What they wanted to do was avoid overcrowding in public areas and on public transit. The staggered approach also means people will be going back to work slowly and in different sections of the economy. Again, this is to avoid any mass gatherings.
The province of Ontario recently released its guide called “A Framework for Reopening the Province.” In this guide, the Government of Ontario’s goals are slightly different than those of Austria and Denmark. The Government of Ontario framework has the same overall priority, which is to protect the health and well-being of all its citizens. Ontario will have a focus on supporting healthcare workers, essential workers and businesses who have been working throughout the lockdown. Ontario will also have a staggered reopening approach, which will have three phases and between a two-to-four week evaluation period for each. You can read more about Ontario’s plan to reopen the province by clicking here.
Here are some tips to get yourself ready
Physically going back to work should start with you. Do your self-assessment to see if you are well enough to venture back to the office, shop or factory floor. If you are sick or not at 100 percent, inform your manager or company human resources professional and stay at home. Chances are you have not been tested for the Coronavirus. And, more than likely do not have the virus, but coming in with the sniffles will not lead to co-worker confidence in that the workplace is safe. Do your self-check, and don’t take any chances.
2. Spacious and clean work areas
Social distancing will continue in the workplace. Expect to be two metres or six feet from the next person. This will impact the lunchrooms and company lounges across the country. Don’t be surprised if they are closed off entirely. Expect to get staggered lunchtimes for employees and capacity levels, similar to what supermarkets are doing today. If you are in operations, it might be a good idea to review the current floor plan. Also, don’t be surprised to see shift cycles of being at home and work in workplaces with limited space. This means you might be working in the office on Monday but at home Tuesday. And, you will be asked to clean your area before you leave for the day thoroughly. And, if you keep a photo of your kids at your workstation, you may be asked to remove it. Overall work environment cleaning will increase dramatically and may occur during the workday.
3. Call ahead in-person meetings
Many great ideas got started around the water-cooler. Water cooler collaboration will not return immediately. And, the water-cooler may not even be available when you return. At least not right away. If you have a thought that you want to share with a co-worker, you’ll be asked to give that person a heads up electronically either via email or some other collaboration app before you walk over to that other person’s work area to brainstorm if allowed at all.
4. Workplace shifts
Government-imposed mandates on limiting the number of people in groups will have its place in any return to work policy. Get ready to have more Teams, Zoom, and WebEx sessions, while you are at the office. Do not be alarmed if your favourite co-worker is not at work when you arrive. There might be a return to work order where you will be placed in a shift. There will be several situations that arise where an individual will feel unsure of themselves returning to work after the COVID-19 restrictions are lifted. Employers will have very little choice but to accommodate them, especially early on.
5. Conference room capacity
Meeting rooms will have capacity limits. Those limits will be posted on the door. You may be asked to join a meeting inside your own office via a Teams, Zoom or WebEx session. If you do use the room, you will be asked to clean the room and wipe it down immediately afterwards. This will pose a unique challenge to in-person meetings with guests, and you may need to co-ordinate more online sessions. What could lead to an awkward situation is having guests go through a temperature scanner before they enter the boardroom. If your company or organization currently does not have any video conference technology, you may have to invest in a solution to have the use of meeting rooms.
6. Proper hand hygiene
Don’t be surprised to see several hand sanitization stations throughout your workplace, especially at entrances. Also, your organization will ask you to sanitize your hands before entering any area of the office, factory floor or retail space. Currently, people are wearing gloves to go to the supermarket. Gloves may not be appropriate for your working environment, but you can envision a situation where you may have to ask patrons or guests of your workplace to sanitize their hands before entering.
As you prepare yourself for a physical return to your previous workplace, do not expect the old norm, we’ll have to adjust to a new norm. As with all these decisions, organizations must take, they must be cautious and well thought out to protect the health and safety of their employees. Here at Jolera, we’re here to help with any concerns about organizing your company’s return to work. You can contact us anytime, and we hope you are staying safe and healthy.
With remote workers reaching unprecedented levels during the COVID-19 pandemic, strengthening Wi-Fi access points and the devices that access them is becoming a necessity. Unfortunately, very little thought has been given to Wi-Fi in the security landscape leaving many people vulnerable to hackers. Before the onset of the COVID-19 pandemic, people were using public Wi-Fi for collaborating with co-workers, outside suppliers and customers, along with friends. What made public Wi-Fi so useful was that it was widely available and, more importantly, free. As of last year, there were a total of 362 million public Wi-Fi hotspots available around the globe.
Know the types of Wi-Fi attacks to watch out for.
The most often used attack for WIFI is called Man-in-the-middle. Hackers use Man-in-the-middle to intercept data packets as they travel from the person’s computer to the WIFI network. Think of this as cyber-eaves dropping. The hacker has access to your files and can view your messages. For a man-in-the-middle attack to work, the hacker needs to be in the range of an unencrypted WIFI access point. Or has set up a rogue WIFI access point that the unsuspecting person signs in on.
Do you ever go into a Starbucks to work? You check for free WIFI, and you see two Starbucks access points available. You don’t give it a second thought and click on the wrong one. Well, that’s an Evil Twin situation, were the access point that looks legitimate, but isn’t.
One of the more famous Evil Twin attacks happened during the 2016 Republican National Convention, where 1,200 attendees connected to the IVOTETRUMP! Hotspot.
AirCrack, Passive Sniffing, Cowpathy and many more…
To prevent remote workers from these types of attack methods, what’s needed is to look at security more holistically. Many people, especially during this unique time, are unaware of the risks of using unsecured Wi-Fi. The organizations that these people work for also fail to take the proper precautions to protect remote workers wherever they are located and the data they access.
Organizations need to think of the whole picture instead of letting their deployed devices out in the wild. Data should be protected behind a Firewall, the devices accessing the data should be monitored and protected with endpoint protection. Instead of installing an access point and walking away, think of WIFI-as-a-Service, that includes a wireless access point but does much more such as advanced security information and event analysis, real live threat detection and remediation.
Each step taken builds upon your organization’s security posture and keeps both your users and your data safe and secure.
Avoiding malware like CoViper should begin with user training and awareness; employees must know how to identify suspicious emails and attachments, as this is a likely mechanism for delivering malware of this kind. Organizations may sign up for automated programs such as Secure IT – User Defence to train their employees.
The emulator that loads the low-level antivirus engine was found to run unsandboxed, thus potentially exposing systems to attackers.
Avast has since patched the vulnerability, and it is suggested all users update to the latest version to ensure their devices are secure.
Netwalker is ransomware formerly called Mailto that has become active recently. The new phishing campaign is using an attachment that contains an embedded Netwalker Ransomware executable. Once executed, the ransomware will encrypt the files on the computer and append a random extension to encrypted file names.
CVE-2020-6819 and CVE-2020-6820 allowed unauthenticated attackers to trick potential victims into visiting a maliciously crafted website to be able to execute arbitrary code on devices running unpatched versions of Firefox.
All users who use Firefox should install the latest version of Firefox 74.01, which has been patched. Mozilla released Firefox 74.0.1 and Firefox ESR 68.6.1 earlier to address these two critical vulnerabilities that were actively used by threat actors against vulnerable machines.
The Search Meter plugin for WordPress through the latest version 2.13.2 allows user input within the search bar to become a formula. The attacker can achieve remote code execution via this method.
This plugin hasn’t been updated for the last three major releases of WordPress, and it is advised you deactivate the plugin right away and look for alternative solutions.
Fake Zoom installers
Threat actors have distributed several different versions of Zoom client installers, which look legitimate, however, now officially from Zoom. These clients are bundled with malware such as Coinminers, Remote Access Trojans, and Adware Bundles.
You should always install software from the vendor directly to prevent accidentally using fake installers. If a fake installer is downloaded, ensure your computer is protected with endpoint protection, for example, Secure IT – Endpoint.
When it comes to remote working, who’s responsible for security? According to research from Capita, approximately 90 per cent of employees believe it’s their employer’s responsibility to ensure IT security when working remotely. While organizations must ensure they are implementing proper security controls for their users, employees must also be accountable for their actions and how they contribute to an organization’s security. A combination of security tools and user awareness is necessary for organizations to increase their security posture. With an organization’s workforce so spread out, employees need to be more engaged with security. Implementing a people-centric security strategy will empower employees and make them feel more involved.
An effective security strategy has clearly defined policies and procedures and outlines roles and responsibilities for members of an organization. A people centric approach acknowledges the role employees play in an organization’s overall security posture and creates a culture of cybersecurity designed to change employee behaviour and encourage employees to think with a security mindset.
3 Ways to Adopt a People-Centric Security Strategy
1. Asses User Risk
Start by establishing a baseline of user risk. This can be done by testing employees with simulated phishing tests. Simulated phishing tests enable users to experience real life phishing attacks in a safe environment. It records users who click on phishing links and sends them to remedial training to strengthen their responses. Simulated phishing tests give organizations an idea of how many users are susceptible to these kinds of attacks and can help them determine their vulnerability level so they can implement better security controls moving forward.
Exposing users to phishing attacks reminds them to inspect their emails more carefully and teaches them how to spot these kinds of attacks. Simulated phishing tests should be done more than once so that organizations can track user progress over time. With phishing being the most common type of cyber attack, it’s important that users strengthen user reactions to these kinds of attacks.
2. Hold Users Accountable
Employees must be willing to be accountable and take personal responsibility for their actions. To encourage accountability, organizations should implement an end user security policy that employees must read and sign-off on.
Your end user security policy should review security best practices you expect every employee to follow. Such actions can include locking screens, using strong passwords and implementing multi factor authentication. You should explicitly outline consequences of misuse and hold users responsible if they violate the policy. Ensure your policy is simple and easy to read so that employees understand your security policy.
3. Provide Access to Resources
Motivate and engage users to take responsibility for security by providing them access to high quality resources like security awareness training. Online security awareness training is a great way for users to learn about various cybersecurity topics at their own pace. New methods of online training like gamification and online quizzes make training more fun for users and helps them be more attentive in retaining information.
Access to other online resources like infographics, cyber tips or news articles gives employees tools they can use to refer to and refresh their memory. If users understand how cyber threats like phishing and social engineering affect their lives both at work and at home, they will feel more connected to the issue.
Jolera’s Secure IT User Defence solution is designed to empower your employees to be the first line of defence. The solution includes simulated phishing tests, online cyber awareness training and credential monitoring. For more information on how Jolera can protect your organization, contact us today.