Friday, 11 June 2021

Why Freelancers Should Prioritise Cybersecurity

Article by Beau Peters

As a freelancer in any industry, you are likely more susceptible to hackers and cybercrime than many other professions. Not only are you pulling in a constant stream of customer data, but as a worker on the go, you likely work exclusively in the digital realm with all of your information in the online space. That means that you are basically presenting data on a silver platter for cybercriminals to find and use for malicious purposes.

If you take your business seriously, then cybersecurity needs to be your top priority, not only for your clients but also for the stability of your own enterprise. Luckily, you can stay out of the way of cybercriminals by implementing a few basic security features along with an understanding of common threats. We’ll explain both solutions below.

Protect Client Data
It is important to remember that just about any piece of client data can be used by cybercriminals to cause havoc. Credit card and social security numbers are especially dangerous, as they can be used to take out fraudulent loans and commit identity fraud that could lead to financial and emotional issues as your customers frantically try to get their life back together.

Keep in mind that it is not only the data you acquire from customers that need to be protected. As a freelancer, you are likely working on many different websites with many different companies, and the cookies and browsing breadcrumbs you leave behind are also loaded with customer data as well as your own. If you don’t protect your systems, that data can be easily extracted by hackers.

If you think you are safer because you have a smaller business, think again. Hackers tend to go after smaller targets often because they know that freelancers and new organizations often don’t have the resources or security procedures in place to protect their data, and even if the hackers only get away with a small amount of private customer data, that information is just as valuable to hackers and dangerous on the black market.

If you do have a client who becomes the victim of cybercrime and it is connected back to you, it could mean a hit to your reputation that you may not be able to come back from, and as a smaller business, you may not want that type of heat. Recent statistics show that the cost of a breach could be as much as £285k ($200k) in penalties and repairs, so if you don’t bring in that kind of money, caution is of the utmost importance.

Avoid Common Scams and Sketchy Characters
Since you are likely a one-person company that doesn’t have an IT team to detect issues and solve problems, you will need to be extra cautious of the companies and clients with which you interact. Part of that is being aware of common scams that could spell big trouble. Phishing emails are often sent by a hacker and they continue to be a constant threat. If you are contacted by a freelance client that seems too good to be true or asks for private information upfront, you may be dealing with a hacker.

You must complete your due diligence when it comes to finding and accepting freelance clients. Before you start sharing with them, get their contact information and look them up online to see if they have a digital footprint. A first step in determining if they are legitimate is by searching online with the keywords “company’s name + scam” or “company’s name + lawsuit,” and see what comes up. Also, use your network of writers and on LinkedIn to ask if your associates have heard of the company and if they have a good reputation.

Another common scam that you should be aware of has little to do with who you work with, but instead, where you do your work. The man-in-the-middle attack is when a hacker sets up a fake Wi-Fi network in a public place and tries to gain the victim’s attention by saying that it is free or by attempting to mimic the real Wi-Fi at the establishment. When you connect to this fake network, you are really connecting directly to the hacker’s computer, and from there, they can take any data they want from your machine. To avoid this scam, always take the time to ask the proprietor of the establishment for the correct Wi-Fi, so you know it is legitimate.

Securing Your Work at All Times
To have the best chance of avoiding these issues now and in the future, you will want to build your computer network like a fortress. Not only will taking the proper precautions keep you out of financial trouble, but you could also advertise in your job pitches how secure your business really is. Start with smart passwords. Every program you use should have a strong password that utilises a combination of letters, numbers, and special characters, and every password you use should be unique.

The next step in setting up your security fortress is installing software that will keep cybercriminals at bay. Start by installing antivirus software and use it to scan your system every week for malware and viruses. Always make it a point to update your antivirus software whenever a new version is available so you get the latest protection. On top of that, you should install a virtual private network (VPN), which will disguise your location and encrypt all of your precious information.

Along with keeping your data secure, you will also want to keep all-important personal and client data stored on a dependable backup server. This will come in handy if you ever lose your computer or if you are the target of ransomware, which is an attack where hackers try to take control of your system until you pay them money to release it. If you have a backup, you can recover the data without playing into the hacker’s game.

You’ve worked hard to create your freelance business, so you should do everything in your power to protect it. Try the solutions described above and your business will remain strong and secure.

Tuesday, 8 June 2021

Top Cyber Security Challenges Post Lockdown

By Sam Jones | Cyber Tec Security

Not too long ago things were looking bleak for the world, still under the dark cloud of the COVID pandemic, but with vaccine rollouts now taking place worldwide, there is finally a light at the end of the tunnel. It’s important to remember, however, as we slowly transition back into some semblance of normality, that there will be new challenges to face in all facets of life, and the Cyber Security sector is no exception.

The Rise in Cyber Threat
While the COVID pandemic loomed, the world was simultaneously dealing with a slightly different type of pandemic - a cyber one. The number of cyber attacks on businesses rose dramatically over the course of the last year, with estimated increases as high as 90%.

Organisations were forced to quickly adapt and move operations out of the office and into home environments, often bypassing best practices for a secure migration. Hackers took advantage of this confusion and chaos and focused on exploiting the vulnerabilities of those at home, who were working more independently and potentially on devices that did not align with critical security controls.

The pandemic offered new opportunities for cybercriminals to develop more sophisticated attacks, with the number of novel attack techniques rising to 35%, 15% greater than pre-pandemic. The good news is that the increase in cyber attacks has likely brought to light the importance of cyber security and implementing effective measures to protect against these threats.

Hybrid Working
The pandemic has proved that remote working is indeed possible and it is probable that not all businesses will return to the office post lockdown, at least not full time. There may be more leniency with employees wanting to work from home more frequently, but this new world of hybrid working could create challenges for cyber security.

Organisations will have to be wary that employees may be moving from a secure office environment to vulnerable home environments where they could be operating with inadequate security measures in place. In the rush to home working, companies were forced into being less restrictive with security policies and plenty of staff were using their own personal devices and network. But with such little visibility and control, there was no way of knowing what vulnerabilities there may have been - devices may not have been patched, home networks were potentially insecure, and company policies and processes ignored.

This is all about understanding how we control an environment that is now a bigger risk because our network has increased from perhaps one or two locations to potentially hundreds.” CTO, Cyber Tec Security

If businesses are going to operate effectively in this hybrid working style, they will need to bear in mind certain security considerations. Many will find it beneficial to introduce a home working policy or alter other company security policies to reflect new vulnerabilities. While employees will still need to access company data at home, it is imperative that this is done securely, with data protection tools and policies put in place and the use of a VPN for secure communication channels. Companies might consider providing company hardware to remote employees, but if personal devices are used at home to access data, they will need to be securely set up and regularly audited.

Human error is still the number one cause of cyber attack and home working could make this even more prominent. In 2020, Verizon found that 67% of cyber attacks were down to phishing and Business Email Compromise. Phishing links are still clicked on and while this is likely due to poor cyber awareness, the situation could be worse in a home environment with greater dependence on email for work requests and less support and supervision.

Ultimately, organisations will need to cultivate a culture of security awareness and provide employees with relevant cyber training and resources to help minimise cyber risk and ensure individuals are fully equipped as they transition to this hybrid working style.

A Shift in Priorities
After a hard-hitting 12-14 months and a spike in cybercrime, businesses that may have not considered their cyber security before will now have it on their radar. Certain advancements can and should be made internally post-pandemic, such as developing new policies to incorporate home working and BYOD, and ensuring an incident response plan is in place.

Recent Supply Chain attacks like SolarWinds should also compel businesses to start looking at managing the security of their third parties, which are a common way for cybercriminals to gain access and cause disruption to multiple organisations in a supply chain.

Although some businesses will have the luxury of investing big money into more advanced security solutions and cyber insurance as a response to the pandemic, others will be facing budget limitations after a hard year. Regardless, no business can afford to ignore the cyber threat post-pandemic, but for most, it will be a case of identifying and prioritising risk reduction strategies to best fit your company’s funds and resources.

The pandemic has forged a new security landscape and businesses have been forced to see the importance of being able to quickly adapt to changes in our working styles and environments. Cybercrime is not going anywhere in the post-pandemic world but by being well prepared in the face of these new security challenges, businesses can stay secure and successfully protect against the cyber threat.

Tuesday, 1 June 2021

Cyber Security Roundup for June 2021

   

A roundup of UK focused Cyber and Information Security News, Blog Posts, Reports and general Threat Intelligence from the previous calendar month, May 2021.

UK Smarties Cities Cybersecurity Warning
The UK National Cyber Security Centre (NCSC) published its Smart Cities (connected places) guidance for UK local authorities. NCSC warned UK Smart Cities will be highly targeted by hackers, and as such, councils need to ensure they are properly prepared as they rollout increasingly connected and technology-reliant infrastructure. The NCSC said critical public services must be protected from disruption, while sensitive data also needs to be secured from being stolen in large volumes. Smart cities and connected rural environments promise a host of benefits for UK society, for instance, sensors will monitor pollution, real-time information on parking spaces, while cameras will track congestion and smartly manage traffic flow. However, another concern is the large volumes of personal information that will likely be collected by smart cities technology, which could erode privacy by allowing citizens to be tracked in greater detail than ever, or could be stolen by criminals or hostile states.

The NCSC's technical director, Dr Ian Levy, referred to Hollywood depictions of cyber-attacks on critical city infrastructure. He picked out the 1969 classic movie 'The Italian Job', where a computer professor switches magnetic storage tapes running traffic in the Italian city of Turin, which causes utter gridlock, enabling a haul of gold to be stolen by mini cars weaving through the traffic chaos. "A similar 'gridlock' attack on a 21st-century city would have catastrophic impacts on the people who live and work there, and criminals wouldn't likely need physical access to the traffic control system to do it" Dr Levy warns in a blog.

Is your Home Router a Security Risk?
Which? report claimed millions of UK people could be at risk of being hacked due to using outdated home routers. The consumer watchdog examined 13 router models provided to customers by internet-service companies such as EE, Sky and Virgin Media, and found more than two-thirds had security flaws.

Use of weak passwords was a common theme with the investigation, which concluded:
  • weak default passwords cyber-criminals could hack were found on most of the routers
  • a lack of firmware updates, important for security and performance
  • a network vulnerability with EE's Brightbox 2, which could give a hacker full control of the device
The routers found lacking in security updates included:
  • Sky SR101 and SR102
  • Virgin Media Super Hub and Super Hub 2
  • TalkTalk HG635, HG523a, and HG533
Which? computing editor Kate Bevan said that a proposed UK Smart Device legislation which would ban default passwords on routers "can't come soon enough. Internet service providers should be much clearer about how many customers are using outdated routers and encourage people to update devices that pose security risks".

Eight Arrested in UK Smishing Fraud Bust
Eight UK men were arrested in an investigation into scam text messages. These scam text messages are known as "smishing" within the security industry, where text messages entice victims with a web link to either malware or malicious website, in a bid to steal personal data or bank details or to have the victim make a bogus payment. The suspects, in this case, were allegedly involved in sending fake messages posing as the Royal Mail, asking people to pay a fee to retrieve a parcel.

Colonial Pipeline DarkSide Ransomware Attack
A Russian cybercriminal group called DarkSide was said to be behind a devasting ransomware cyberattack that shut down a major fuel pipeline in the United States for several days. The cyberattack took down Colonial Pipeline's IT systems which manage a 5,500-mile pipeline network that moves some 2.5 million barrels of fuel a day from the Gulf of Mexico coast up through to New York state.  The cyberattack dominated media headlines in the United States, with US drivers warned not to panic buy petrol amid shortages in eastern states. DarkSide released a statement following the publicity, stated didn't intend to take the pipeline offline - "Our goal is to make money and not creating problems for society". CNN, the New York Times, Bloomberg and the Wall Street Journal all reported Colonial Pipeline paid $5 (£3.6) million in Bitcoin to Darkside

DarkSide is a ransomware-as-a-service platform, first seen advertised in August 2020 on Russian language hacking forums.  The service can be purchased by pre-vetted cybercriminals to deliver ransomware and to perform negotiations and accept payments from victims.  Following this attack, which garnered the focus of United States President Joe Biden and the FBIDarkSide promptly shut down its ransomware-as-service operations.

UK Foreign Secretary Dominic Raab also issued a warning to Russia on ransomware attacks, "Russia can't just wave their hands and say it's nothing to do with them", he said. "Even if it is not directly linked to the state they have a responsibility to prosecute those gangs and individuals." 

It was reported DarkSide had made at least $90m in ransom payments from about 47 other victims according to Bitcoin records. DarkSide is one of at least a dozen prolific ransomware gangs making vast profits from holding companies, schools, governments and hospitals to ransom.

Conti Ransomware takes down Ireland's Health Service
Ireland's national health service (Health Service Executive (HSE)) closed down its computer systems after reportedly being hit by the Conti ransomware group, with the cybercriminals initially asking for £14m ($20m) to restore IT systems. Ireland's Health Minister Stephen Donnelly said "the incident was having "a severe impact on health and social care services".   However, the ransomware group has since handed over software to release HSE systems for free, with the Irish government insists it did not, and would not, be paying the hackers.

Conti typically steals victims' files and encrypts the servers and workstations in an effort to force a ransom payment from the victim. If the ransom is not paid, the stolen data is sold or published to a public site controlled by the Conti actors.  The FBI issued a warning in the United States about the Conti gang targeting at least 16 healthcare networks there. More than 400 organisations have been targeted by Conti worldwide.

The BBC news website debated whether paying ransomware should be made illegal in the UK, given it is not currently explicitly illegal for UK firms, and their insurers, to pay ransoms out to cybercriminals.

More Big Data Breaches
At least 4.5 million individuals had their personal information compromised after Air India was subjected to a cyber attack. Stolen details including names, passport information and payment details stretching back 10 years were accessed by the cybercriminals.

Check Point researchers reported Amazon Web Services System Manager (SSM) misconfigurations led to the potential exposure of more than 5 million documents with personally identifiable information and credit card transactions on more than 3,000 SSM documents. Check Point said they have worked with AWS Security to provide customers with the necessary information to help them resolve any configuration issues with the SSMs. Developers did not adhere to the AWS best practices.

Check Point researchers also reported that in analysing Android apps on open databases they discovered serious cloud misconfigurations that led to the potential exposure of data belonging to more than 100 million users. Check Point explained how the misuse of a real-time database, notification managers, and storage exposed the personal data of users, leaving corporate resources vulnerable to bad threat actors.

Stay safe and secure.

BLOG

Friday, 28 May 2021

Keeping Phishing Simulations on Track


The West Midlands Train service has come under fire after workers discovered that an email promising them a bonus payment after running trains during the pandemic was actually a phishing simulation test.

Around 2,500 employees received a message which appeared to come from Julian Edwards, Managing Director of West Midlands Trains, thanking them for their hard work over the past year under COVID-19, and that they would get a one-off payment as a thank you.

However, those who clicked through on the link were then emailed back with a message telling them it was a company-designed ‘phishing simulation test’ and there was to be no bonus. The email warned: “This was a test designed by our IT team to entice you to click the link and used both the promise of thanks and financial reward.”

Since the test has been revealed, the train service has received media backlash for promising a fake financial reward to well-deserved teams. However, the modern threat landscape is constantly evolving, and it’s vital that businesses prepare their workforces against any type of threat. So was this a good test of resilience? Andrea Babbs, UK General Manager, VIPRE, explains.

Fight Fire with Fire
In order to be successful in the fight against cybercrime and protect the network, businesses should not be afraid to fight fire with fire and sometimes stoop as low as the phishers themselves – who have no morals. By using a powerful message and incentive such as the suggestion of a bonus provided by West Midlands Train Service, businesses can gain valuable insight into how their employees could be tricked into clicking on a phishing link, and why they need to ensure their staff are trained for any type of attack.

However, the test has clearly upset West Midlands’ employees and could have been done in a less dramatic way so that it wasn’t either ethically or morally questionable. Particularly during a pandemic where our frontline workers, like those in the transport industry, have continued to put themselves at risk over the last year. The idea of a bonus in the current challenging environment seems deserving as an act of recognition for their above and beyond service – but for this to be a test, rather than the promised reward, is particularly hard-hitting for those involved.

Finding the Balance
It is vital that organisations take the time to train and educate their staff so that they become an additional line of defence in an organisation’s cybersecurity strategy. However, IT teams also need to rely on users’ goodwill to encourage them along the cybersecurity journey. This test by West Midlands Train service may have damaged that goodwill and could disillusion some members of staff.

Rather than mentioning a bonus, the train service could have mentioned a change to pay, or the date of payroll. Both of these statements would have had the same instinctual reaction in employees, without having heightened emotions surrounding the letdown of a non-existent bonus.

Importance of Education
Regardless of the incentive behind the West Midlands phishing test, the fact that employees clicked on the link highlights the need for businesses to perform these types of tests in the first place.

Cybercriminals will stop at nothing to get users to click on a phishing link, download a malicious attachment or fill in their details on a forged website, and will use personal or professional information to lure them into doing this.

Therefore, employees need continuous training to identify and avoid these attacks. Going forward, businesses who are looking to deploy such phishing tests should try using less exciting topics to trick their users in order to avoid any bad will or backlash from their employees and the media.

One way to achieve this is to implement Security Awareness Training programmes that incorporate real-life situations, including phishing simulations - that are less emotive. This educational material will help organisations to fortify crucial cyber threat prevention messaging and educates workforces on how to protect both the business and themselves.

Wednesday, 26 May 2021

How Hidden Vulnerabilities will Lead to Mobile Device Compromises

Your mobile device can be hacked very easily without your knowledge. Even if an attacker can’t get into your device they can attempt to gain access to the sensitive information instead that is stored inside such as your places visited, emails and contacts. It's not just consumers who are targeted by cybercriminals, the rise of smartphones and tablets in the workplace and the increase in remote working has resulted in hackers targeting businesses via their mobile device vulnerabilities.

Most individuals and organisations with very sensitive information, still do not take basic mobile security measures, even with the rising threats to our smartphones. According to a study by Intertrust on mobile security, the cost of mobile app hacks and violations will hit $1.5 billion by the end of 2021. Yet, network systems or even our desktop computers get more attention, with mobile device security continuing to be ignored by organisations across the globe every day.

Three Ways a Mobile Device can be Compromised
Unsecure Wi-Fi
When out and about, the free wifi sign is always something we’re looking out for, but it's best to ignore these networks the next time you come across a public Wi-Fi network that doesn't need a password. When using unsecured Wi-Fi networks, eavesdroppers will see all unencrypted traffic. Wi-Fi could be insecure in public places, such as cafes and airports, allowing malicious actors to visualise everything you do while connected.

Make sure you're connecting to websites using HTTPS. HTTPS ensures that correspondence to and from a specific website is encrypted, while a VPN service encrypts anything you send. Look at the address bar of your browser window to see if you're linked via HTTPS; you should see "HTTPS" at the start of the web address (or, on some web browsers there is a lock icon). Hackers have been able to obtain valid SSL certificates for sites with names that are slightly different from those of major financial institutions, as well as the HTTPS prefix.

Finally, using public Wi-Fi exposes you to session hijacking, which occurs when a hacker tracking your Wi-Fi traffic tries to hijack an open session you have with an online service (such as a social networking site or an email client) by stealing the browser cookies the service uses to identify who you are. Once hackers have your cookies, they can use it to impersonate you on these pages or even track you down.

Pay attention to the warning message your device is sending you to see if you're on an unsecured connection. An alert will pop up on iPhones saying that the identity of the server can not be checked and asking if you still want to connect. Before you can access Wi-Fi, you will be asked to press "continue". Despite this warning, 92% of users click continue on the screen. In fact, your phone has a lot of very good technology built in to alert you when you are going to make a bad security decision. Be vigilant when connecting to free Wi-Fi, and avoid exchanging personal information, to protect yourself.

Malicious Apps
There has been a rise of 54% of mobile users who have got attacked through malicious apps over the past year. Apps add mobile functionality, but also increase the risk of a data breach, particularly if they are downloaded from websites or tweets instead of a secure app store. Malicious code that allows hackers to steal data could be hidden within apps, even ones that work.

The mobile technology ecosystem is enormous. Neither Apple nor Google will look at every single app in their store and decide whether or not it is malicious. You should restrict the number of applications you install in order to protect yourself - MDM security solutions can include computer implementations that require workers to use a VPN or a private Wi-Fi hotspot to connect to public Wi-Fi networks. Due to the increasing number of sophisticated cybersecurity threats. MDM is the key to a healthy, effective, and reliable mobile workforce.

What we call the attack surface on your phone increases the more applications you have. What this suggests is that there are more code lines and thus there is a greater occurrence of a security-sensitive flaw in that amount of code.

Operating System Flaws
Vulnerabilities are identified as what lets attackers in, despite the best efforts of smartphone manufacturers. To protect users, device manufacturers release operating system updates frequently. All of those updates have very important security patches in them and people are concerned that maybe this will affect how they use their phone or if their phone will not be compatible with it.

As soon as the new updates are released, they need to enforce those changes. Hackers know about vulnerabilities after updates are issued and try to hack out-of-date devices. Nobody recovers from being hacked quickly. Although computers have always been vulnerable to attack, mobile devices are becoming a larger target for criminals to attack. Secure yourself by identifying the risks and making attempts to minimise them ahead of time.

Author
This article was provided by SaltDNA, a provider of secure mobile message and voice call communications. You can sign up for a free trial of SaltDNA or talk to a member of their team at info@saltdna.com or by visiting saltdna.com.

Wednesday, 19 May 2021

Cyber Security: Data ‘Re’-Assurance

How do you know company data is secure? 
How do organisations know their data is secure? And how can companies ensure that a network breach won’t result in a loss of sensitive data? The consequences of a data breach are potentially disastrous for any organisation, so companies need to be reassured that their data is secure at all times in line with any internal and external compliance needs - and that they have the tools and visibility to prove this, should a network breach occur.

With 78% of IT security leaders lacking confidence in their company’s cybersecurity posture, now is the time for organisations to focus on applying a ‘Zero Trust’ approach to their cybersecurity strategy. In doing so, security professionals acknowledge that they cannot trust the security of their underlying infrastructure and therefore implement controls from a data assurance perspective, placing emphasis on protecting their sensitive data, irrespective of where this data travels within the network. And for those CISO’s and CSO’s who are solely concerned with their network security, they need to reconsider and focus on their data security.

Security professionals should be taking a proactive approach to their organisation’s cybersecurity and should always be considering how they can better protect their most valuable asset - their data. With this in mind, Paul German, CEO, Certes Networks, outlines how data assurance is a mindset that security professionals need to adopt in order to be confident that their sensitive data is protected at all times.

Increasing Threats
Cyber attacks are increasing dramatically and by its very nature, sensitive data is an incredibly valuable asset and one that is frequently targeted. Last year, 37 billion data records were leaked at a staggering 140% increase year on year. Surely there are measures that companies can take to prevent this growing breach of data.

However, on average only 5% of company files are properly protected - a surprising statistic considering the vast implications of a cyber attack. Furthermore, malicious hackers are now attacking computers, networks and applications at a rate of one attack every 39 seconds.

Clearly, cyber attacks and consequent data breaches are an epidemic and organisations need to put the appropriate measures in place in order to protect their data and their business. Ultimately, companies need to adopt a data assurance strategy aligned to business intent so they have the right tools and security posture in order to be in the best position when it comes to safeguarding their most valuable asset against cyber criminals.

The Consequences
When a cyber attack occurs and an organisation loses the sensitive data they have been trusted with, there are significant consequences. Of course, the obvious economic repercussions are enough to make any business concerned, with the average cost of a data breach being £2.73 million ($3.86m USD) as of 2020.

However, it is not just a data breach, but a breach of trust. Additionally, losing a client’s sensitive data damages a company’s reputation and organisations could even be facing legal action, especially if they breach regulations such as GDPR, HIPAA or CJIS. The fact is that businesses are fined for a loss of data because they are not compliant with specific laws over the use of sensitive information - not for a network breach.

By looking at cybersecurity from a data assurance perspective, security professionals have the capacity to bypass these damages by protecting their data from the outset, rather than waiting for an inevitable breach to happen before implementing data security measures. There is no reason for businesses to put themselves in a vulnerable position when they have the ability to effectively avoid the consequences of a data breach altogether.

Data Assurance
When businesses consider their cybersecurity strategy from a data assurance perspective, they are directly focusing on their data security and ensuring that they have the necessary outputs in place in order to prove at all times that their sensitive data is protected according to their business intent.

Through understanding their business intent, organisations adhere to specific objectives that they have defined in order to protect their data and mitigate associated risks. By adopting a Zero Trust approach to their cybersecurity posture, companies can achieve the separation of duties that cannot be met when security protocols are tied into the network infrastructure. With a secure overlay that is agnostic to the underlying network infrastructure, security teams can have total control of their security posture. This means that should an incident occur, the required controls are in place and functioning and security professionals can easily prove that their main priority, which is their sensitive data, is safe.

Additionally, with regulations over how organisations can handle data continuing to evolve and change, companies need the mechanisms in place to be able to proactively react to any developments in regulatory compliance requirements. By implementing policies that match evolving compliance requirements and by putting data at the forefront of any cybersecurity strategy, organisations can be secure in the knowledge they are observing these rules and regulations and won’t fall victim to their data being compromised.

Companies need to seriously consider implementing the right controls in order to make sure their data is protected and by focusing on their cyber security strategy from a data assurance perspective, they can ensure that they are emphasising the protection of their most valuable asset.

Thursday, 13 May 2021

How to Ensure Security when Buying a Refurbished or Second-Hand Smartphone


Last year, a Which? investigation found that 31% of resold smartphone models from three of the major used and refurbished handset stores are no longer receiving security updates. Phone manufacturers only schedule data updates for a certain period after the release of a model, so those looking for an additional bargain in older devices could be putting themselves at risk.

As well as security issues, second-hand smartphones that haven’t been wiped by their previous user can still contain sensitive data. Without following the proper steps, anybody considering selling their old phone on eBay or another marketplace could be exposed to fraud in numerous ways.

How to Ensure Security When Buying a Phone
Phone manufacturers often release information on their security updates, so checking your chosen model is still receiving these updates is essential to remain secure once you start using your new phone. The length of time phones are updated varies by manufacturer and by model.

For example, Apple offers security updates for several years and the next model to stop receiving these updates is the iPhone 6, released in 2015, which will no longer be updated at the end of 2021. However, the Huawei Mate 10 Pro, stopped being updated just 28 months after its release in 2017.

Apple also links its security updates with its general software updates, meaning if your device is no longer being updated, your apps and other functions will not work as well and can be exploited by hackers in other ways. For this reason, it’s best to shop around for more recent models.

For those who have chosen an old model, it’s important to take extra care when using the device and navigating online. Pay attention to app permissions, as some apps may take advantage of gaps in the phone’s security perimeter that can expose your personal data. Using smartphone security or antivirus software will also help prevent unauthorised access to your device or your data when using an older phone.

With any used or refurbished phone, carrying out a factory reset before using will ensure that any personal data that has been missed by the previous owner is deleted before you start using the device.

Consider Your Data before Selling Your Smartphone
Before selling a smartphone, the best course of action to prevent your data from being stolen or abused is to perform a complete factory reset of the device. Once you’ve saved everything you want to keep on an external backup, like your computer or the cloud, perform a factory reset by following the guidelines of your phone’s manufacturer. Some devices may ask if you want to keep personal data while performing the factory reset, make sure you don’t select this option as this will not fully clear the device.

Things to pay attention to are any apps where passwords are saved to your phone and apps that send SMS confirmations for security purposes. Before getting rid of your old device, make sure texts from online banking or other sites can be received on your new phone and be sure to save passwords somewhere secure to avoid being locked out once your phone has been reset.

The Used and Refurbished Phone Market
Used and refurbished smartphones make up only 14% of all smartphone sales, but their presence is essential in reducing the environmental impact of the smartphone industry by prolonging the life of every device. With numerous precious metals used in smartphones that will soon be too difficult to mine, manufacturers need to do more to keep old devices secure.

By arbitrarily limiting the length of time devices receive security updates, manufacturers are forcibly cutting the life of most devices short, contributing to the major e-waste problem faced by modern society.

In addition to manufacturers, second-hand phone vendors need to make their customers aware before they buy unsecured devices. Following the Which? survey, some second-hand retailers added information about the security strength of old devices, which helps inform consumers’ decisions and raise awareness of how they can secure these devices if they choose to still purchase them.

Conclusion
Overall, second-hand and refurbished smartphones are an essential facet of the smartphone industry and more needs to be done to improve the quality and security of these devices to combat the rapidly growing e-waste problem, as well as provide more opportunities for consumers to get their hands on smartphones at any price point.

This article was written by Damon Culbert from Repair Outlet, smartphone parts and refurbished device retailer.

Tuesday, 11 May 2021

10 Things You Might Not Know About Cyber Essentials

 
IASME delivers Cyber Essentials on behalf of UK NCSC
By Sam Jones | Cyber Tec Security and Dave Whitelegg

What is 
Cyber Essentials? If you are just hearing about the Cyber Essentials scheme, read on as we unpack 10 things you might not know about Cyber Essentials.

1. UK Gov Launched Cyber Essentials in 2014
The UK Government National Cyber Security Centre (NCSC) published its ‘10 Steps to Cyber Security in 2012', after the UK Government agencies recognised small-medium sized UK businesses require further cybersecurity guidance and support in order to protect the British digital dependant economy. 

This led to the development of five critical 'cyber essentials' technical security controls which provides a minimum level of cybersecurity protection. Assurance of the adoption of these five security controls by an organisation provides a good degree of confidence an organisation is protected against the most common cyber threats, thus the UK Cyber Essentials certification scheme was born.

2. IASME is the Sole Partner of the NCSC in delivering the Cyber Essentials Scheme
As of April 2020, Information Assurance for Small and Medium Enterprises Consortium (IASME) won the contract to become the sole partner of the Cyber Essentials scheme on behalf of the NCSC. Prior to this, there were five different accreditation bodies operating under different methodologies. So to reduce confusion around the scheme and to streamlined the certification process, the NCSC decided to go with a single accreditation body - IASME.

IASME now oversees a large number of Certification Bodies based around the UK, all of which have qualified assessors able to certify businesses looking to achieve the certification.

3. Cyber Essentials is the only UK Government Cybersecurity Standard
Although there are other cyber certifications available, Cyber Essentials is the only scheme designed and backed by the UK Government. Holding the certification is a mandatory requirement for any business bidding on UK Central and Local Government, and Ministry of Defence (MOD) contracts. 

Although a UK standard, business outside of the UK can and are Cyber Essentials certified.

4. There are Two Levels to the Cyber Essentials Scheme
The scheme is designed with small-medium sized businesses in mind, offering a low cost and straightforward way to start their cybersecurity journey, protecting UK businesses from the most common cyber threats. 

To make the scheme more flexible, the are two levels, Cyber Essentials and Cyber Essentials Plus
  • Cyber Essentials requires the five basic security controls to be assessed and recorded on an IASME provided secure web portal, with a qualified assessor verifies the information provided. This simple self-certification costs around £300. 
  • Cyber Essential Plus (CE+) provides a higher level of assurance than the regular Cyber Essentials, so suites business striving to further demonstrate their cybersecurity posture to clients. Some clients may even require CE+ certification for their security assurance via a contractual clause.  The CE+ assessment process requires an external assessor to evidence and verify the five Cyber Essentials controls and requirements. The cost of a CE+ assessment will depend on the size and complexity of your business' IT network.
5. Cyber Essentials has to be Renewed every 12 months
Cyber Essentials certifications must be
 renewed every year, to demonstrate the business is still aligned with the standard requirements. However, despite certification requiring passing a point-in-time security assessment, it is important that the cyber essentials security requirements are continually met. This is comparable to taking in your car for an MOT, your car may be deemed road-safe on the day it passed all the MOT checks, but if the car becomes no longer road worthy a couple of weeks later, then the MOT certificate provides no protection for your car being both safe and legal to use on UK roads. Therefore, with Cyber Essentials, you must constantly verify compliance with the security requirements outside of the annual certification process, else your business will not benefit from the protection the security controls provides.

6. Achieving Cyber Essentials is Often Quick
Too many businesses put cybersecurity on the backburner because they lack the understanding and the time to properly assess their cyber controls and risks.  Achieving Cyber Essentials certification does not take weeks to complete. The Cyber Essentials assessment approach provides guidance to help identify and remediate any security shortcomings found, so you can ultimately obtain a Cyber Essentials state of operation and certification which can be used to prove your business compliance with the scheme to others parties.

Of course, the time to complete a Cyber Essentials certification will depend on the extent of the remediation work required, however, you do not need to be a security expert to fix the typical issues, as expert security guidance is provided through the online assessment process. Some businesses without security issues have managed to complete a Cyber Essentials assessment and then receive their IASME Cyber Essentials certification within 24 hours.

7. Cyber Essentials reduces the risk of ICO Financial Penalties
The UK Information Commissioner’s Office (ICO) regulates privacy rights and data protection compliance with the UK Data Protection Act (DPA\GDPR), for any organisation which processes and/or stores UK citizen personal information.  Failure to safeguard UK personal data from cyber-attacks can result in the ICO issuing of eye-water monetary penalties. The maximum amount is the higher value between £17.5 million and 4% of your annual turnover (based on the previous financial year). Recent penalties have involved Ticketmaster UK, Marriott International, and British Airways, the latter of which was fined £20m.

Adopting the Cyber Essentials controls helps to protect personal data. The ICO works closely with the NCSC and is said to look favourably on organisations that have obtained Cyber Essentials certification and are breached, which may reduce the chance of higher regulatory fines being imposed.

8. Cyber Essentials is for Big and Small UK Organisations
The Cyber Essentials certification has been adopted by many big names, including the likes of Vodafone, Deloitte, Accenture, BP and Barclays Bank. However, the scheme was very much developed with UK SME cybersecurity in mind. Adopting Cyber Essentials is a crucial first step for SMEs in taking their cybersecurity obligations more seriously, with a certification demonstrating security assurance both to customers and suppliers.

Small businesses are highly prone and are the hardest hit by cyber-attacks, although it doesn't seem that way given it's the large bluechip companies that tend to dominate the media headlines when comes to cyberattacks and data breach reporting. While larger companies can afford to incur the often heavy cost of a cyberattack, it tends to be a different story for small businesses, where a serious cyberattack can lead to the business permanently closing.

SMEs are commonly in the supply chain of larger organisations, as such are targetted by cybercriminals seeking to gain access to those organisations, given IT security is often a lot weaker at SMEs than the attacker's target. Once SME systems are compromised by an attacker, it can be a simple process to hop through the supply chain network to the target organisation.

9. Cyber Essentials is still needed if other Security Certifications like ISO27001 are in place
ISO27001 is a popular internationally recognised information security business management certification. Holding ISO27001 certification does not mean Cyber Essentials is an unnecessary additional certification, although the two standards complement each other well.

Cyber Essential provides a prescriptive set of security requirements which in turn provides confidence of a fundamental and a standard set of industry recognised good practice technical controls are in place and effective. This one of the reasons why Cyber Essentials is increasingly used to assure the security of supply chains through due diligence.

10. USA are Big Supporters of the Cyber Essentials scheme
Thanks to the Cyber Essentials scheme’s early success, the United States of America Cybersecurity and Infrastructure Security Agency (CISA) introduced Cyber Essentials and the culture of cyber readiness to small businesses and government agencies to guide them on their cybersecurity journey.

In line with other international security standards like the NIST framework, Cyber Essentials is a fantastic approach for those wanting to better understand their organisation’s cybersecurity defenses and the best practices for improving it.

Friday, 7 May 2021

Achieving PCI DSS Compliant Firewalls within a Small Business

The most important and integral part of any data security begins with having firewalls installed in the environment. Not just that, installing firewalls is an essential requirement of the Payment Card Industry Data Security Standard (PCI DSS). However, simply installing a firewall on the network perimeter will not make your organization PCI DSS compliant.

PCI DSS draws out specific requirements pertinent to firewalls under requirement 1 and its sub-requirements on how firewalls should be installed, updated, maintained along with other firewall rules. Elaborating more on this, we have explained in this article basic PCI DSS firewall requirements, and the need for small businesses to install firewalls. But before getting into the details of it, let us first understand the meaning of a PCI DSS compliant firewall.

What is a PCI DSS Compliant Firewall?
Firewalls are used to segment or isolate networks and are an essential component to limit cyber threats and protect internal networks from the internet and untrusted networksIn a merchant’s point-of-sale environments (POS), a firewall's purpose to restrict only specific permitted network traffic into and out of the POS network environment.

However, if misconfigured and unmaintained, a firewall could fail to adequately protect
 networks and IT systems that process payment cards. The PCI Security Standards Council have provided requirements and guidance for firewalls to ensure the merchants and service providers, correctly deploy and maintain firewalls.

PCI Firewall Requirements
The PCI DSS firewall requirements cover both technical specifications and physical access controls requirements within PCI DSS requirements 1 & 9.  This includes planning for future updates, reconfiguration, limiting only relevant inbound network traffic, etc. The physical access requirements are more about ensuring that companies limit physical access to the Cardholder Data Environment (CDE). This would include inspecting card reading devices for identifying any tampering of devices, installing monitoring devices, the requirement of unique IDs for authorized access, and visitor logs to name a few. 

To understand the technical requirements, let understand the PCI DSS firewall requirements summarised below for your better understanding.

Ref.

Requirements

Description

1

Protect cardholder data with a firewall.

Firewalls are a key protection mechanism for securing the network and Cardholder Data Environment.

1.1

Establish and implement firewall and router configuration standards.

Ensure establishing firewall and router configuration standards and other documentation to verify that standards are complete and implemented.

1.1.1

Establish a formal process to validate and test all network connections, changes to firewall and router configurations.

Established documented procedures to verify there is a formal process for testing and approving network connections, changes to firewall and router configurations. This would even include interviewing responsible personnel and examining records periodically to verify that, network connections and a sample of actual changes made to firewall and router configurations are approved and tested.

1.1.2

Establish a network diagram to identify all connections between the cardholder data environment and other networks, including any wireless networks

Create network diagrams that describe how networks are configured, and identify the location of all network devices. This prevents the possibility of any area being overlooked and unknowingly left out of the security controls implemented for PCI DSS and vulnerable to compromise

1.1.3

Establish a data flow diagram that shows all cardholder data flows across systems and networks.

Create a data-flow diagram to identify the location of all cardholder data in the environment. This will help you in understanding and tracking the flow of the data in the environment across systems and networks. Further, the data flow must be kept up to date as needed depending on the changes to the environment.

1.1.4

Establish firewalls at each Internet connection between the DMZ and the local network.

The firewall on every Internet connection coming into the network, and between any DMZ and the internal network, allows the organization to monitor and control access. This further minimizes the chances of malicious unauthorized access to the internal network via an unprotected connection.

1.1.5

Create descriptions of groups, roles, and responsibilities for managing network components.

Establish roles and responsibilities for the management of network components. This is to ensure that personnel is aware of their roles and responsibilities pertaining to the security of all network components. This helps facilitates better accountability for the security of the CDE.

1.1.6

Document the security measures implemented and protocols considered unsafe and the business rationale for using all services, protocols, and ports allowed.

 

Implementing documentation of services, protocols, and ports that are necessary for business can prevent a compromise that is otherwise caused due to the unused or insecure service and ports. Further, the use of any necessary protocol and ports should be justified, and the security features that allow these protocols to be used securely should be documented and implemented.

1.1.7

Review firewall and router rules at least every six months

 

Organizations must periodically review firewall and router rules at least every six months to clearly unwanted outdated, or incorrect rules and ensure establishment rule that allows only authorized services and ports that match the documented business justifications.

1.2

Restrict connections between untrusted networks and all system components in the cardholder data environment with firewall and router configurations

Install network protection between the internal, trusted network and any untrusted network that is external and/or out of one's ability to control or manage. This is to limit traffic and prevent any kind of vulnerability and unauthorized access by malicious individuals or software.

1.2.1

Restrict inbound and outbound traffic to only that is necessary for the cardholder data environment, and limit all other traffic.

Examine all inbound and outbound connections and set restrictions of traffic based on the source and/or destination address. This helps filter out unnecessary traffic and prevents malicious individuals from accessing the network via unauthorized IP addresses or from using services, protocols, or ports in an unauthorized manner.

1.2.3

Install perimeter firewalls between all wireless networks and the cardholder data environment and configure these firewalls to filter only the authorized traffic for business purposes.

Firewalls must be installed between all wireless networks and the CDE, which may include, but is not limited to, corporate networks, retail stores, guest networks, warehouse environments, etc. Installing firewalls at the network perimeter works as a filter to limit only authorized traffic. This restricts malicious individuals from gaining unauthorized access to the wireless network and the CDE to compromise account information.

1.3

Prohibit direct public access between the internet and any system components in the cardholder data environment.

 

Firewalls must be installed to manage and control all connections between public systems and internal systems, especially those that store, process or transmit cardholder data. This prevents bypassing and compromise of system components and card data.

1.3.1

 1.3.2

Create a demilitarized zone (DMZ) to limit incoming traffic to system components that only provide publicly accessible authorized services, protocols, and ports.

Implementing DMZ prevents malicious individuals from accessing the organization's internal network from the Internet, or from using services, protocols, or ports in an unauthorized manner.

1.3.3

Implement anti-spoofing measures to detect and prevent fraudulent source IP addresses from entering the network.

Implement anti-spoofing measures to filter forged IP addresses entering the internal network and causing compromise.

1.3.4

Do not allow unauthorized traffic from the cardholder data environment to the internet.

Evaluate all traffic outbound from the cardholder data environment to the internet to ensure that it follows established, authorized rules and restricts traffic to only authorized communications.

1.3.5

Allow only established connections to the network.

Examine the firewall and router configurations to verify that the firewall permits only established connections into the internal network and blocks any inbound connections not associated with a previously established session. This prevents malicious traffic from trying to trick the firewall into allowing the connection.

1.4

Install personal firewall software on all portable computing devices connected to the internet and access the CDE while off the network.

Installing personal firewall software or equivalent functionality on any portable computing device protect devices from Internet-based attacks, that use the device to gain access to the organization's systems and data once the device is reconnected to the network.

1.5

Ensure that security policy and operational procedures for the management of firewalls are documented in use and are known to all parties concerned.

Ensure that the security policies and operational procedures for managing firewalls are documented, in use, and personnel responsible are aware of it. This is to manage and prevent unauthorized access to the network.


Why does a small business need to have PCI Compliant Firewall?
Poor firewall implementation and maintenance is a common factor in cyber attacks and payment card data thefts within small businesses, which is often due to poor IT security understanding and suitable resources by IT and business management. All business connectivity with the internet poses the greatest risk to safeguard with a firewall. PCI DSS requirement all
internet connectivity to be protected with a firewall, which effectively creates a ‘buffer zone’ between the business's IT network or systems, and untrust external networks and systems. Other reasons why firewalls are essential for small business include:

Access Controls
The firewall operates at the network layer, filtering all incoming requests based on IP address and the service being accessed such as web or email or some customised ports. So, installing firewalls to a great extent restricts unauthorized access and prevents entry of any malicious individuals gaining unauthorised access to the network and compromise any data.

Cloud Security

Connectivity with third parties and cloud service providers can also be controlled through a firewall policy, to safeguard from supply chain threats and protect sensitive data from exposure.

Malware Protection
Firewalls are much more than just filtering network traffic based on IP addresses. 'Next Generation firewalls provide security controls beyond the traditional firewall controls of IP address and port filtering. Such as providing VPNs, web filtering capabilities, anti-malware screening of incoming traffic, and intrusion detection/prevention which is another PCI DSS requirement. 

Application and Database Protection
Some firewalls have web application screening capability and are known as Web Application Firewalls (WAF). A correctly configured WAF provides protection from application-layer threats such as web-based attacks like SQL injections, where an attacker manipulates a web application to expose the back-end database. PCI DSS requirement 6.6 requires installing an automated technical solution that detects and prevents web-based attacks (e.g., a web application firewall) as one of two ways to address vulnerabilities to public-facing web applications.

Monitoring and Responding to Malicious Activity
Firewalls monitor and report suspicious attacks, with the support of a 'Security Information and Event Management' (SIEM) tool, the business is able to detect and quickly respond to cyber-attacks, which is covered by PCI DSS requirement 10.

Conclusion
Smaller businesses are considered easy prey by hackers, due to the tendency of such firms not having sufficiently robust IT security controls in place. Small businesses which process payment cards are specifically targeted by cybercriminals, as they can quickly turnaround stolen credit card data into cash via the dark web. Installing and maintain a firewall is a fundamental and basic IT security pillar that should never be neglected and underestimated in its importance, along with configuring IT systems to be secure, implementing access control, deploying anti-virus, and keeping all software up-to-date. PCI DSS provides a highly descriptive set of security industry good practice IT controls, which if completely adhered to on a continual 24/7/365 basis, is sufficient to protect your business from payment card compromises by cybercriminals.

Author Bio
Narendra Sahoo
(PCI QSA, PCI QPA, CISSP, CISA, and CRISC) is the Founder and Director of VISTA InfoSec, a global Information Security Consulting firm, based in the US, Singapore & India. Mr. Sahoo holds more than 25 years of experience in the IT Industry, with expertise in Information Risk Consulting, Assessment, & Compliance services. VISTA InfoSec specializes in Information Security audit, consulting and certification services which include GDPR, HIPAA, CCPA, NESA, MAS-TRM, PCI DSS Compliance & Audit, PCI PIN, SOC2, PDPA, PDPB to name a few. The company has for years (since 2004) worked with organizations across the globe to address the Regulatory and Information Security challenges in their industry. VISTA InfoSec has been instrumental in helping top multinational companies achieve compliance and secure their IT infrastructure.