Category: Detect

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Apple is typically known for its minimal design, user-friendly UI, and hardware. But, the success of their products, especially iPhones, has long relied upon timely cybersecurity updates and their effectiveness. The prolonged support that they promise to their devices, in addition to hardware, also revolves around the OS and security updates.

That’s why you may still see security updates for older devices that aren’t upgradable to iOS 16 still being released. We’ll talk about a few latest security updates that have recently surfaced because of known and unknown vulnerabilities.

However, as a user, you may like to know how these updates are prioritized and why you should update your devices regularly.

Every vulnerability that has been detected gets ranked by a Common Vulnerability Scoring System (CVSS) and is denoted by a CVE serial number (CVE-Year-XXXXXX) that is used to track its status. For example, the log4j vulnerability, which impacted millions of systems worldwide, was ranked 10 out of 10. The updates are prioritized and released depending on that score. 

iOS 15.7.2 security update

The major security updates of iOS 15.7.2 are discussed below.

AppleAVD (Malicious Video File)

With a CVSS score of 7.8 and regarded as a high risk, AppleAVD vulnerability (CVE-2022-46694) increases the potential risk of a malicious video file writing out-of-bound and executing kernel code. Although user interaction is required for the vulnerability to be efficacious, risky downloaded videos may present issues with privacy and cybersecurity with this. The vulnerability was patched with improved input validation.  

AVEVideoEncoder (Kernel Privileges)

Like AppleAVD, AVEVideoEncoder vulnerability (CVE-2022-42848) also has a 7.8 CVSS score. However, the difference between these two is the AVEVideoEncoder vulnerability is related to an app that can access kernel privileges through user interaction and execute arbitrary code to jeopardize user security. The issue was fixed with improved checks.  

File System (Sandbox Issue)

In cybersecurity, sandbox defines a virtually isolated environment to run, observe, and analyze code. Typically, sandboxing is facilitated to imitate user interaction without involving active users. However, in complex operating systems like iOS, each app is caged in its own sandbox to limit its activity. The File System Vulnerability (CVE-2022-426861) revolves around malicious apps breaking out of the sandbox and executing kernel code. As it doesn’t require user interaction to act maliciously, it has a very high CVSS rating of 8.8. The issue was patched with improved checks. This vulnerability is one of the most critical reasons why you should stay updated with the latest iPhone releases.

Graphics Driver (Malicious Video File, System Termination)

With a medium CVSS rating of 5.5, the CVE-2022-42846 Graphics Driver vulnerability is capable of terminating systems through buffer overflow with malicious video files crafted for that particular purpose. Although user interaction is required, the impact of such attacks has severe implications on user experience and integrity. The issue was patched in the security update 15.7.2 with improved memory handling.

libxml2

libXML2 is generally used for parsing XML documents that transport text files containing structured data. This particular vulnerability with libxml2 (CVE-2022-40304) is assigned a CVSS base score of 7.8 and is capable of corrupting a hash table key—ultimately leading to logic errors—making the programs behave arbitrarily. This issue had occurred due to an integer overflow and was mitigated through improved input validation. 

WebKit (Processing Malicious Web Content)

Websites without security certifications and compliances often contain malicious codes that may lead to cybersecurity issues. As these malicious actors do their best to hide the fact, this particular WebKit issue (CVE-2022-46691) comes with a CVSS score of 8.8 and is considered a direct threat to the security of iPhones and iPads. This was patched in the latest update through improved memory handling.

iOS 16.2 security update

Most of the updates mentioned in the 15.7.2 update are also present in the 16.2 security patch released on 13th December 2022 for devices like the Apple iPhone 14 Plus. We won’t be discussing them again unless there is a major difference present in how the vulnerability was patched.

Accounts (Unauthorized User Access)

The CVE-2022-42843 vulnerability, AKA Accounts, is a 5.5-grade low-level issue that has been patched in the 16.2 security update. The issue mainly revolves around users viewing sensitive information of other users. While it has a high confidentiality impact, it doesn’t particularly affect the integrity of the apps or the database. The issue was fixed through improved data protection measures.

AppleMobileFileIntegrity (Bypass Privacy Preferences)

Privacy is considered paramount for iPhones. Although still a medium risk (5.5) vulnerability, the AppleMobileFileIntegrity issue (CVE-2022-42865) was prioritized in the recent updates due to apps using this to bypass privacy preferences and breach user confidentiality. This issue was fixed by enabling hardened runtime that prevents code injection, process memory tampering, and DLL hijacking.

CoreServices (Removal of Vulnerable Code)

Owing to the close nature of Apple, the CoreServices update (CVE-2022-42859) doesn’t specify any major changes that were made to the codes, but it promises to have removed a piece of vulnerable code that could enable an app to bypass privacy preferences to jeopardize confidentiality. The CVSS score is a medium 5.5 for this update.

GPU Drivers (Disclose Kernel Memory)

An issue with the GPU drivers in the CVE-2022-46702 vulnerability was detected for a malicious app to be able to disclose kernel memory. Kernel memory is strictly local memory loaded in the physical device's RAM. As user interaction is required for the app to act maliciously, a medium 5.5 CVSS score was given. The issue was fixed to better memory handling.

ImageIO (Arbitrary Code Execution)

Mostly related to iCloud, but also seen in iOS itself, ImageIO issue with CVE-2022-46693 was detected to empower malicious files to execute arbitrary code. It was given a high CVSS score of 7.8 due to the arbitrary nature of the vulnerability. However, it requires user interaction, like locating and downloading that file(s). This out-of-bound issue was mitigated through improved input validation.

The bottom line

As you may already have understood, these updates are critical for your device to function securely and keep you safe from identity thefts and literal monetary risks. As these vulnerabilities are often made public for development purposes, malicious criminals often try to target devices that are yet to be updated. Therefore, you shouldn’t wait even a single day to install them.

The post How do the latest iPhone updates address Cybersecurity issues? appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Has your organization suddenly been attacked by a ransomware virus? Take a deep breath and try to remain composed. It can be easy to panic or become overwhelmed in the face of an attack, but it is vital to remain calm and focused in order to make the best decisions for your organization.

The initial actions to take in the event of a ransomware attack

• Disconnect the affected devices from the network as soon as possible. This can help to prevent the ransomware from spreading to other computers or devices.
• Determine what data has been affected and assess the extent of the damage.
• Determine the specific type of ransomware virus that has infected your devices to understand how this malware operates and what steps you need to take to remove it.
• It is important to notify all employees about the ransomware attack and instruct them not to click on any suspicious links or open any suspicious attachments.
• Consider reporting the attack. This can help to increase awareness of the attack and may also help to prevent future attacks. Please note that in some regions, business owners are required by law to report an attack.

Do not rush into a decision. Take the time to carefully evaluate your options and the potential consequences of each of them before deciding whether to pay the ransom or explore other solutions.

Paying the ransom is not the only option. Consider exploring other solutions, such as restoring your data from backups. If you do not have backups, cybersecurity experts may be able to help you recover your data since many ransomware strains were decrypted and keys are publicly available.

Strategies cybercrooks employ to obtain funds from victims swiftly

Cyber extortionists use various tactics beyond just encrypting data. They also use post-exploitation blackmail methods to coerce victims into paying them. Very often, cybercriminals use several extortion tactics simultaneously. Some examples of these tactics include:

• Steal and disclose

Cyber extortionists not only encrypt victims' data but also often steal it. If the ransom is not paid, the stolen files may be made publicly available on special leak websites, which can cause severe damage to the victim's reputation and make them more likely to give in to the attackers' demands.

• Destroy keys if a negotiation company intervenes

Some ransomware authors have threatened to delete the private keys necessary for decrypting victims' data if they seek the help of a professional third party to negotiate on their behalf.

•  Launch a DDoS attack

Ransomware attackers often threaten to flood the victim's website with a large volume of traffic in an effort to put it down and intimidate the targeted company into paying the ransom faster.

• Cause printers to behave abnormally

Some hackers were able to take control of the printers and print ransom notes directly in front of partners and customers. This provides a high level of visibility for the attack, as it is difficult for people to ignore the ransom notes being printed.

• Use Facebook ads for malicious purposes

Criminals have been known to use advertising to gain attention for their attacks. In one instance, ransomware developers used Facebook ads to shame their victim by highlighting the organization's weak defenses.

• Stir up anxiety among customers

Ransomware authors may send intimidating emails to the customers of major companies whose data was compromised. The emails threaten to leak the recipients' data unless the affected organization pays the ransom. The attackers encourage the recipients to pressure the affected companies to make the payment quickly.

Do not try to handle the situation on your own

Although ransomware is a trend in the world of cyber-attacks, hackers are not always successful in obtaining the ransom. They constantly have to develop new methods to replenish their arsenal of extortion techniques.

To make life as difficult as possible for hackers, the main thing to do is not to try to act alone. There are well-established mechanisms to counter extortionists.

Do seek professional assistance from others, even if it means losing some or all of your data. There are plenty of organizations and resources that can provide professional assistance and guidance. Some potential options include:

• Cybersecurity experts: These professionals can provide specialized expertise and assistance with recovering your data, as well as advice on how to prevent future attacks.
• Computer emergency response teams: Many countries and regions have organizations known as CERTs that assist with responding to and recovering from cyber incidents, including ransomware attacks.
• Ransomware recovery services: Some companies specialize in helping organizations recover from ransomware attacks and can provide a range of services, including data recovery, threat assessment, and ransomware negotiation.
• Law enforcement: In many cases, it may be appropriate to involve law enforcement agencies. They can help with investigations, help recover data, identify and prosecute the attackers.

It is essential to carefully research and evaluate any resources or services you consider using. Seek advice from multiple sources to find the best way out.

Before negotiations

It is generally not recommended to negotiate with ransomware attackers or pay the ransom. Doing so can encourage further ransomware attacks. Paying the ransom not only supports the attackers' criminal activity but also puts your organization at risk of being targeted again.

Keep in mind that there is no guarantee that the attackers will actually provide the decryption key – even if you do pay the ransom. Therefore, it is important to weigh the risks and potential consequences carefully before deciding to pay.

Ransomware attacks and payments are often carried out anonymously, using encrypted communication channels and cryptocurrency. Hackers usually provide an encrypted chat or email service for communication. Try to negotiate additional channels and means of communication with the adversary. Try to establish a line of communication with the attackers that involves mutual trust (as much as possible in this situation.)

If you decide to negotiate with the attackers and pay the ransom, it is important to keep a record of all communications, including any instructions for paying the ransom. This information may be helpful for law enforcement and cybersecurity experts who are investigating the attack.

Ask the attackers to demonstrate the decryption key and show that it actually works by decrypting several random files. This can help you ensure that you are dealing with the actual attackers and not a third party.

Research the attackers and their past behavior. If the attackers have been known to negotiate or provide the decryption key after receiving payment in the past, this may help to increase your confidence in the negotiation and may also give you leverage to negotiate a lower amount.

Tips for negotiating with the attackers

If you have exhausted all other options and have determined that paying the ransom is the only way to recover your data, here are a few tips for negotiating with the hackers:

1. The attackers may try to pressure you by threatening to destroy or leak data, but it is important not to let this influence your decision. Do not show any signs of desperation or urgency. Remain calm and composed all the time.
2. Do not reveal whether or not you have cyber insurance.
3. Do not offer to pay the entire ransom upfront. Instead, consider offering to pay a small portion of the ransom upfront, with the remainder to be paid after the decryption key has been provided and you have successfully decrypted all data.
4. Consider offering to pay the ransom in a cryptocurrency that you already have and is less commonly used or even less easily traced. This can make it more difficult for the attackers to convert the ransom into actual money and may make them more willing to negotiate a lower amount.
5. Consider offering to publicize the attack and the ransom negotiation in order to put pressure on the attackers. This can make it more difficult for the attackers to extort other victims in the future and may make them more willing to negotiate a lower ransom amount.
6. If the attackers have already agreed to negotiate the ransom amount and have lowered the price, you may try to push for a further reduction by continuing to negotiate and offering a lower amount. However, keep in mind that the attackers are likely to have a minimum amount that they are willing to accept, and it may not be possible to push them to lower the price further.

Be prepared to walk away from the negotiation if the attackers are unwilling to compromise or if the terms they offer are unacceptable, even if it entails losing your data.

How to prevent ransomware attacks

It is always good to focus on preventative measures to avoid falling victim to ransomware in the first place. Here are some tips in this regard:

1. Implement a robust cybersecurity policy that includes regular software updates and the use of security software.
2. Educate your employees about the risks of ransomware and how to protect against it, such as not opening attachments or clicking on links from unfamiliar sources.
3. Take care of backups and implement a disaster recovery plan to ensure that you can restore your data if it becomes encrypted.
4. Use strong, unique passwords and employ MFA where possible.
5. Consider purchasing cybersecurity insurance to protect your company against financial losses resulting from a ransomware attack.

The post The dos and don’ts of ransomware negotiations appeared first on Cybersecurity Insiders.

Secured Access Service Edge (SASE) is an evolving cloud-focused architecture that was released by Gartner in 2019. SASE is designed to solve the problem of network performance and limited security visibility for distributed corporate business systems (infrastructure, platforms, and applications) in the cloud or in the corporate data center as well as the distributed workforce. SASE is complex and resource intensive but can be transformative and provide cost savings with the right partners, like AT&T Cybersecurity, to execute this type of strategic initiative. SASE benefits include the networking technology called Software Defined Wide Area Network (SD-WAN) and four security capabilities called the Secure Service Edge (SSE).

SD-WAN

SD-WAN operates on top (overlay) of an existing Internet circuit. Unlike a dedicated/private WAN circuit, SD-WAN can break out Internet destined traffic closer to where the distributed workforce is located. Internal traffic is backhauled through the SD-WAN network to the data center or cloud where the corporate business systems reside.

Components of the Secure Service Edge

Security Services Edge (SSE) incorporates four main security components used to protect business systems and workforce. These capabilities are cloud-based to support distributed systems and workforce. SSE capabilities include the following:

• Zero Trust Network Access (ZTNA) – Provides segmentation of business systems and users through access control policies. Read more on SASE vs. Zero Trust.
• Firewall as a Service (FWaaS) – Centralized security policy enforcement that can be applied across multiple business locations to give security greater visibility into the network traffic and provide consistent policy enforcement across business systems and users. Read more on SASE firewall.
• Secure Web Gateway (SWG) – Centralized web-based policy enforcement that blocks unapproved Internet traffic while protecting the distributed workforce.
• Cloud Access Security Broker (CASB) – Helps security understand where company data is stored (on-premise or in the cloud) and enforce the business data compliance policies.

How SASE security works

The traditional cybersecurity model operated by building security perimeters around the corporate office and data center where the workforce and applications reside. Security controls were located inside a DMZ between the corporate office and data center so that traffic could be efficiently monitored, managed, and inspected.

Today, business systems and users have moved out of the corporate office and data center into a distributed environment. This creates the following risks.

Business systems

• Lack of centralized visibility and control.
• Difficulty tracking and securing sensitive data.
• Additional costs for security solutions.
• Non-compliance with regulatory or industry requirements.
• Swivel-chair tasks between network and security to support the organization.
• Inefficient routing of network traffic.

Users

• Unknown (home/public Wi-Fi) networks accessing the corporate network.
• Employees accessing business systems from unmanaged devices.
• Inconsistent security profiles between office and VPN users.
• Difficult to enforce principle of least privilege.
• New training requirements for users.

SASE addresses these risks by moving security capabilities out of the data center and into the cloud while deploying an SD-WAN network that aligns with the distributed business environment. This approach provides better network performance, greater security visibility, and a better overall user experience.

How can my business benefit from a SASE model?

Companies that match the profile for SASE have distributed business systems (cloud-based infrastructure, platforms, and applications) and workforce. SASE is designed to solve the problem of network performance and limited security visibility into the company’s distributed environment while also providing these additional benefits.

Cost and support benefits

Reduced complexity – Lowering the number of individual solutions in favor of a single system that integrates multiple features together.

Increased scalability and faster deployment – Align with the dynamic needs of the company and its customers as the network and business systems move, expand, and contract to support the organization.

Outsource maintenance and administration overhead – As an extension of the security and IT team, support the continuous business operations and monitoring required.

Consolidated support contracts – Ensure faster response and recovery by consolidating the number of vendors and partners supporting the SASE environment.

Compatibility with existing business systems – Network and security tools should integrate with distributed businesses systems to control access and protect company data anywhere.

Real-time security prevention – Reduce risk at the WAN edge by gaining greater visibility into network traffic, centralizing security controls, and monitoring through the MSSP.

Optimization benefits

Enhanced user experience – The focus of success in SASE is measured by the improved user experience. These are measured in terms of ease of access and the speed and efficiency of using distributed business systems.

Centralized security controls management – Utilizing the cloud-based security features of Secured Service Edge (SSE) to create a centralized security policy that is applied across the entire organization and workforce.

Log collection and forwarding to anywhere – Logs need to be sent to the where the security tools are located (data center, cloud, MSSP, 3rd party) so that security teams can research and detect events and incidents.

Configuration management and backups – Disaster recovery capabilities that are consolidated, can be used to restore business systems quickly, and are maintained by the MSSP.

Integration with existing security controls – Better security through sharing and collaboration between the tools.

Improved performance and resiliency – Efficient routing of network traffic and the ability to redirect traffic on-demand.

Challenges implementing SASE

Because SASE is strategic, it must be treated as a program with multiple projects that are being performed by different groups including 3rd parties and partners. Companies should be aware of the following challenges so they can avoid prolonged delays in deployment and utilize as many security features as possible to protect the business.

• Maintain an up-to-date application inventory and document application traffic flows. This information is critical during the planning and design phase of the program to perform scaling and sizing estimates of the SASE environment.
• Legacy VPNs need to be inventoried and then analyzed to determine if they are absorbed into the SD-WAN network or need to be recreated in the new environment. This must be completed before the legacy systems hosting VPNs can be decommissioned.
• Organizations that do not have standard security policies, network architecture, and design models will extend the deployment timeline by either customizing SD-WAN per site or reconfiguring the site into a standard model.
• During planning, identify integration with existing security and network tools and plan the tool consolidation so there are no gaps with security capabilities that are being replaced.
• Cross-functional teaming within the organization and with partners is a requirement to successfully deploy a SASE environment. Organizations that have silos and waterfall methodologies will generally require significantly more time to complete the same activities.
• Understand the industry compliance and regulations that could impact how the SASE environment is deployed.
• Define which platforms provide which security features. Using the same security capabilities on two different platforms means double the configuration and twice as much time to troubleshoot when things go wrong.
• Over 95% of Internet traffic is encrypted which cannot be inspected by security capabilities without being decrypted. Build and deploy a public key infrastructure (PKI) and Certificate Authority (CA) program to support SSL/TLS inspection.
• Partner with a managed service provider (MSP) to provide 24/7/365 monitoring, support, visibility, and insight into the SASE environment.

SASE is suite of network and security capabilities that help companies adapt with today’s distributed business and workforce environment. It is complex, resource intensive, and takes time to complete a SASE transformation. Creating a strategy and bringing along the right partners, like AT&T Cybersecurity, who have experience planning, building, deploying, and operating SASE environments goes a long way to achieving success. Contact AT&T Cybersecurity to build your SASE roadmap and learn why we are trusted advisors for more than 7,000 organizations worldwide.

The post What is SASE appeared first on Cybersecurity Insiders.

Have you ever heard the saying that the greatest benefit of the cloud is that limitless resources can be spun-up with just a few clicks of the mouse?  If so, you would be best served by forgetting that saying altogether.  Just because cloud resources can be spun-up with a few clicks of the mouse does not mean that they should be.  Rather, prior to launching anything in the cloud, careful consideration and planning are a necessity.  Otherwise, your company or governmental entity might end up in the news for a security blunder that was easily avoidable. 

This blog series will focus on three Amazon Web Services (AWS) security steps that any entity can employ to immediately and dramatically improve their cybersecurity preparedness.  Specifically, we will discuss 1) setting up Identity and Access Management (IAM) properly, 2) avoiding direct Internet access to AWS resources, and 3) encryption for data in transit or at rest.  These steps can be followed for entities that are either new to AWS or existing customers.  Read on to find out if your organization is already following this easy guidance.

Step 1: Use IAM the correct way

According to AWS, IAM enables account administrators to “specify who or what can access services and resources in AWS, centrally manage fine-grained permissions, and analyze access to refine permissions across AWS.”  AWS IAM | Identity and Access Management | Amazon Web Services.  When entities first create an AWS account, the only user that exists is the root user.  This user has the proverbial “keys to the kingdom” and can literally launch cloud environments that would rival Fortune 500 companies in a short amount of time.  In turn, bills commensurate with a Fortune 500 can quickly be accrued, too.  Accordingly, as we will discuss below, protecting the root account is a crucial first step. 

Protect the root account

In addition to creating a sufficiently complex password, multifactor authentication (MFA) must be enabled.  MFA is achieved by using a third-party authentication mechanism.  Since usernames and passwords are stolen with alarming frequency, incorporating login credentials with MFA makes it much more difficult to compromise an account.  This is because the malicious user would need to know a user’s login name, password, and possess the user’s third-party authentication mechanism.  As long as the latter is securely protected, account compromise is nearly impossible (Note: sessions authenticated with MFA can still be compromised via cross-site scripting (XSS) attacks.  As we will learn later, AWS offers a defense against XSS).

AWS supports the following MFA mechanisms: Virtual MFA devices (e.g., Google Authenticator, Twilio Authy, etc.); FIDO security key (i.e., a USB device); and Hardware MFA device (i.e., a physical device that generates random numbers).  IAM – Multi-Factor Authentication (amazon.com).  Conveniently, Virtual MFA can literally be setup in minutes and has no cost associated with it. 

Additionally, if the AWS root account was created with programmatic access keys, they should be deleted immediately.  Even with MFA in place, if these keys fall into the wrong hands, they can be used to launch everything and anything.  These keys are akin to “God mode.”  Something as simple as accidentally posting the keys on a repo like GitHub is all an attacker would need to take over an account.  Hence, it is necessary to delete them and follow the principle of least privilege by divvying up permissions to IAM users, groups, and roles instead.  Let’s discuss how to securely create each of these IAM principals now.

Create IAM users

If all AWS users shared the same login credentials, accountability for individual actions would not be possible.  For example, if ten people have access to the root login account and the account was used to provision Bitcoin mining instances, it would be impossible to determine the culprit. 

Conveniently, AWS provides entities with the ability to provision individual user accounts via the AWS console (users can also be created in the AWS CLI and AWS API).  For each user created, AWS lets you specify what the user is authorized to do with AWS resources on a granular level.  For instance, if a user in the marketing department needs read only access to a specific folder within an S3 bucket, an IAM policy can created to enable this functionality.  By following the principle of least privilege, the user only gets access to what they need to perform their job.  By limiting what a user can do within AWS, it has the effect of reducing the blast radius of the damage that can be caused by a compromised account or disgruntled employee. 

Luckily, AWS has done a lot of the heavy lifting and has already created IAM policies that are unique to job duties.  Account administrators merely need to associate users with the policies that align with their role.  If customization of a policy is required, AWS provides tools that make this process relatively simple as well.  To learn more about creating IAM users, click here: Creating an IAM user in your AWS account – AWS Identity and Access Management (amazon.com). 

However, for business with hundreds or thousands of IAM users, manually associating policies with each user is not feasible.  Especially if job duties frequently change.  Thankfully, AWS has addressed this problem with IAM groups.

Create IAM groups

If employees perform the exact same job duties and need access to the same AWS resources, they should be placed in an IAM Group.  The IAM group has a policy (or policies) associated with it that provides access to specific AWS resources.  Therefore, every IAM user associated with the IAM group has access to the same resources and they are also bound by the same constraints.  Moreover, changes to the policy associated with the group are implemented with immediate effect.  Hence, IAM groups make end user management convenient and efficient.  To learn more about creating IAM groups, click here: Creating IAM user groups – AWS Identity and Access Management (amazon.com).

At this point, you may be wondering how AWS resources like EC2 instances can securely access other AWS resources, or how entities with active directory (AD) can avoid the creation of duplicate AWS user accounts?  The answer to these questions is IAM roles.

Create IAM roles

AWS resources like EC2 instances or Lambda functions can assume an IAM role with predetermined permissions to access, create, update, or terminate other AWS resources.  Likewise, users federated with a Web Identity Provider (e.g., Facebook, Google, etc.), corporate Active Directory, or another AWS account can assume an IAM role with the same functionality.  Like IAM policies associated with users and groups, an IAM role affords the same level of granular control regarding what an AWS resource or federated user can and cannot do. 

Thus, for AWS resources assuming a role, the security implications associated with hardcoding an IAM user’s credentials in an application can be avoided.  Furthermore, entities with AD or other Web Identity Providers will not require their users to create separate AWS login credentials.  To learn more about IAM roles, click here: IAM roles – AWS Identity and Access Management (amazon.com). 

Now that you know the basics and most important aspects of AWS IAM (in this author’s opinion), the next blog in the series will move on to the next step associated with securing your AWS account – limiting direct Internet access to your resources.

The post Three easy steps to dramatically improve your AWS security posture: Step 1, set up IAM properly appeared first on Cybersecurity Insiders.

Have you ever heard the saying that the greatest benefit of the cloud is that limitless resources can be spun-up with just a few clicks of the mouse?  If so, you would be best served by forgetting that saying altogether.  Just because cloud resources can be spun-up with a few clicks of the mouse does not mean that they should be.  Rather, prior to launching anything in the cloud, careful consideration and planning are a necessity.  Otherwise, your company or governmental entity might end up in the news for a security blunder that was easily avoidable. 

This blog series will focus on three Amazon Web Services (AWS) security steps that any entity can employ to immediately and dramatically improve their cybersecurity preparedness.  Specifically, we will discuss 1) setting up Identity and Access Management (IAM) properly, 2) avoiding direct Internet access to AWS resources, and 3) encryption for data in transit or at rest.  These steps can be followed for entities that are either new to AWS or existing customers.  Read on to find out if your organization is already following this easy guidance.

Step 1: Use IAM the correct way

According to AWS, IAM enables account administrators to “specify who or what can access services and resources in AWS, centrally manage fine-grained permissions, and analyze access to refine permissions across AWS.”  AWS IAM | Identity and Access Management | Amazon Web Services.  When entities first create an AWS account, the only user that exists is the root user.  This user has the proverbial “keys to the kingdom” and can literally launch cloud environments that would rival Fortune 500 companies in a short amount of time.  In turn, bills commensurate with a Fortune 500 can quickly be accrued, too.  Accordingly, as we will discuss below, protecting the root account is a crucial first step. 

Protect the root account

In addition to creating a sufficiently complex password, multifactor authentication (MFA) must be enabled.  MFA is achieved by using a third-party authentication mechanism.  Since usernames and passwords are stolen with alarming frequency, incorporating login credentials with MFA makes it much more difficult to compromise an account.  This is because the malicious user would need to know a user’s login name, password, and possess the user’s third-party authentication mechanism.  As long as the latter is securely protected, account compromise is nearly impossible (Note: sessions authenticated with MFA can still be compromised via cross-site scripting (XSS) attacks.  As we will learn later, AWS offers a defense against XSS).

AWS supports the following MFA mechanisms: Virtual MFA devices (e.g., Google Authenticator, Twilio Authy, etc.); FIDO security key (i.e., a USB device); and Hardware MFA device (i.e., a physical device that generates random numbers).  IAM – Multi-Factor Authentication (amazon.com).  Conveniently, Virtual MFA can literally be setup in minutes and has no cost associated with it. 

Additionally, if the AWS root account was created with programmatic access keys, they should be deleted immediately.  Even with MFA in place, if these keys fall into the wrong hands, they can be used to launch everything and anything.  These keys are akin to “God mode.”  Something as simple as accidentally posting the keys on a repo like GitHub is all an attacker would need to take over an account.  Hence, it is necessary to delete them and follow the principle of least privilege by divvying up permissions to IAM users, groups, and roles instead.  Let’s discuss how to securely create each of these IAM principals now.

Create IAM users

If all AWS users shared the same login credentials, accountability for individual actions would not be possible.  For example, if ten people have access to the root login account and the account was used to provision Bitcoin mining instances, it would be impossible to determine the culprit. 

Conveniently, AWS provides entities with the ability to provision individual user accounts via the AWS console (users can also be created in the AWS CLI and AWS API).  For each user created, AWS lets you specify what the user is authorized to do with AWS resources on a granular level.  For instance, if a user in the marketing department needs read only access to a specific folder within an S3 bucket, an IAM policy can created to enable this functionality.  By following the principle of least privilege, the user only gets access to what they need to perform their job.  By limiting what a user can do within AWS, it has the effect of reducing the blast radius of the damage that can be caused by a compromised account or disgruntled employee. 

Luckily, AWS has done a lot of the heavy lifting and has already created IAM policies that are unique to job duties.  Account administrators merely need to associate users with the policies that align with their role.  If customization of a policy is required, AWS provides tools that make this process relatively simple as well.  To learn more about creating IAM users, click here: Creating an IAM user in your AWS account – AWS Identity and Access Management (amazon.com). 

However, for business with hundreds or thousands of IAM users, manually associating policies with each user is not feasible.  Especially if job duties frequently change.  Thankfully, AWS has addressed this problem with IAM groups.

Create IAM groups

If employees perform the exact same job duties and need access to the same AWS resources, they should be placed in an IAM Group.  The IAM group has a policy (or policies) associated with it that provides access to specific AWS resources.  Therefore, every IAM user associated with the IAM group has access to the same resources and they are also bound by the same constraints.  Moreover, changes to the policy associated with the group are implemented with immediate effect.  Hence, IAM groups make end user management convenient and efficient.  To learn more about creating IAM groups, click here: Creating IAM user groups – AWS Identity and Access Management (amazon.com).

At this point, you may be wondering how AWS resources like EC2 instances can securely access other AWS resources, or how entities with active directory (AD) can avoid the creation of duplicate AWS user accounts?  The answer to these questions is IAM roles.

Create IAM roles

AWS resources like EC2 instances or Lambda functions can assume an IAM role with predetermined permissions to access, create, update, or terminate other AWS resources.  Likewise, users federated with a Web Identity Provider (e.g., Facebook, Google, etc.), corporate Active Directory, or another AWS account can assume an IAM role with the same functionality.  Like IAM policies associated with users and groups, an IAM role affords the same level of granular control regarding what an AWS resource or federated user can and cannot do. 

Thus, for AWS resources assuming a role, the security implications associated with hardcoding an IAM user’s credentials in an application can be avoided.  Furthermore, entities with AD or other Web Identity Providers will not require their users to create separate AWS login credentials.  To learn more about IAM roles, click here: IAM roles – AWS Identity and Access Management (amazon.com). 

Now that you know the basics and most important aspects of AWS IAM (in this author’s opinion), the next blog in the series will move on to the next step associated with securing your AWS account – limiting direct Internet access to your resources.

The post Three easy steps to dramatically improve your AWS security posture: Step 1, set up IAM properly appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Identity and access management has emerged as an essential security element for organizations. A study reveals that 80% of global IT decision-makers have already adopted or are planning to adopt an IAM solution in the upcoming years.

IAM refers to business policies, processes, and technologies to control unauthorized data and digital systems access. Two IAM approaches are widely known, one for the cloud and the other for on-premises. The cloud based IAM practices are fast-growing because the demand for cloud adoption has increased over time.

With the right IAM solutions and techniques, IT managers and businesses control users' access to sensitive business data within their networks. In addition, these solutions help protect organizations from cyber-attacks; they become more efficient, reduce IT operational costs, and improve user experience.

Six best IAM practices that organizations must not neglect

The IAM framework means using the right solution to implement user authentication and privileges policies. In addition, with IAM, companies demonstrate that any data is not misused, and they comply with government regulations.

For all these characteristics, businesses are increasingly adopting IAM solutions, and their demand will undoubtedly be high in the upcoming time. It's also estimated that the IAM market will grow to $15.3 billion by 2025.

The organization needs to use the right IAM tools and practices to reap the most benefits from the IAM solution. The six best IAM practices that every business should incorporate into its security strategy are as follows:

Adopt passwordless authentication

Many data breaches occur because of weak or stolen credentials. Threat actors can use advanced tools and tactics to steal and break passwords.

Organizations need a secure identity management system to prevent bad actors from breaking in and stealing credentials that can result in breaches such as the Lapsus$ attack or the Colonial Pipeline ransomware attack. Organizations eliminate password issues by choosing passwordless authentication to protect vital business data and ensure that only authentic people access it.

Passwordless authentication enables users to authenticate their identity without entering a password. There are various benefits for organizations to become passwordless- it enhances the overall efficiency, saves time and productivity, and provides greater ease of access. But, most importantly, passwordless authentication allows IAM leaders and users to access the cloud environment safely and securely.

Implement a Zero-Trust approach

The zero-trust approach is not new but has gained popularity as the threat landscape is evolving. Organizations cannot have a robust IAM policy without a function zero-trust architecture. The average cost of a data breach is $4.24 million, but the zero-trust model helps reduce the cost of a data breach by $1.76 million. Moreover, Gartner also predicts that the ZTNA solutions will grow to $1.674 billion in 2025.

Zero-trust means continuously verifying authorized users as they move into the network and giving them the lowest privileges while accessing crucial documents and files. Zero trust within the cloud creates access measures to protect sensitive data and applications from unwarranted access.

The zero-trust architecture ensures that IAM policies are followed whenever the user accesses the organization's network and protects the cloud data. Successful zero-trust implementation for the cloud must begin with passive application observation. Companies must first monitor and determine the relationship between the apps and then enforce rules. In addition, enterprises consider using other technologies like MFA, endpoint protection, micro-segmentation, and visibility and analytics to execute zero-trust systems.

Ensure compliance

IAM is designed to control users and protect their data, which can be achieved by meeting standard compliance requirements. Businesses often have regulatory requirements connected to the data they store either in the data warehouse or cloud data warehouse. They must report on their data access and use processes while complying with specific laws and regulations.

They must face hefty fines, lawsuits, and penalties if they fail. For example, Twitter agreed to pay $150 million to settle allegations of its data privacy practices when the US alleged Twitter for collecting users' contact information to show targeted ads.

Organizations that haven't yet must strictly follow compliance regulations, including GDPR, SOX, HIPAA, and PCI-DSS, to ensure that data is not misused. Besides this, businesses must audit each user role and assign them to the appropriate data owner, to keep a check and balance on the following compliance. In this way, companies can ensure compliance regulations and surveillance of data access.

Use appropriate DevOps tools

A data breach occurs because of human error or when application flaws occur. Businesses also forget to maintain a record of unstructured or dark data, including files and documents downloaded and used for different purposes, credit cards, and social security numbers. Cyber-criminals take complete advantage of such vulnerabilities and data that can eventually result in a data breach.

Such events not only cause significant financial loss to the business but also result in loss of customers and brand reputation. DevOps teams and tools greatly help enterprises prevent data breaches and ensure no one can access sensitive data. By using various DevOps tools, businesses keep track of the unstructured data from the initial stage and boost the overall security level.

Deploy artificial intelligence

Cybercriminals have become more advanced and sophisticated than before. They are using new approaches and tactics to access the organizational network. Because of their progressive nature, even the security teams sometimes fail to recognize them. Hence, organizations have adopted Artificial Intelligence and Machine Learning technologies to implement IAM and reduce the threat vector effectively.

AI ensures improved security and maintains business integrity. Using AI technology like Robotic Process Automation (RPA) deeply monitors and reveals the abnormalities in user behavior. Though an organization produces trillions of primarily unstructured data, the ML system scans all the data efficiently and prevents data leaks and breaches. Moreover, the AI system constantly monitors all behavior and ensures that verifying workers' access to network resources is continuous.

If, by any chance, threat actors gain access to the network by any backdoor, the AI system sends a quick alert to the IT department so they can take appropriate measures. Also, the system denies the access request and ensures the complete safety of the business data.

Centralize the organization's systems

Another best practice businesses can adopt to improve IAM is centralizing all network systems. It is an effective approach that provides more visibility and allows the security teams to detect and respond to cyber threats by letting all the users sign into a single authentication provider, which then propagates identity access across the apps and resources within the organization.

Moreover, with the centralized management system, it is easier to enforce policies like using secure passwords or multi-factor authentication to access the resources.

Additional best practices

Apart from the practices mentioned above, listed below are some common IAM practices businesses should not ignore. These includes:

• Ensure new applications from all sources are securely developed and onboarded. For this purpose, deploy API access control (authentication and authorization of APIs) as it is a crucial part of API security.
• Authentication is vital for IAM; hence, use multi-factor authentication tools to authenticate the identity.
• Remove unnecessary users from the network to reduce the risks of unauthorized access.
• Regularly review and audit the IAM policies to ensure they are granted the least privilege.
• When an IAM account is not used, immediately de-provisioned it. This prevents any hackers from stealing and misusing those credentials.

Final thoughts

Making a business compliant with identity and access management requires an in-depth understanding of who can access the sensitive data and which data is necessary for the workers. Staying informed and updated about the latest technological trends and IAM practices will further help improve the IAM infrastructure.

The post Key to success while implementing IAM- Best practices that every company should implement appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Identity and access management has emerged as an essential security element for organizations. A study reveals that 80% of global IT decision-makers have already adopted or are planning to adopt an IAM solution in the upcoming years.

IAM refers to business policies, processes, and technologies to control unauthorized data and digital systems access. Two IAM approaches are widely known, one for the cloud and the other for on-premises. The cloud based IAM practices are fast-growing because the demand for cloud adoption has increased over time.

With the right IAM solutions and techniques, IT managers and businesses control users' access to sensitive business data within their networks. In addition, these solutions help protect organizations from cyber-attacks; they become more efficient, reduce IT operational costs, and improve user experience.

Six best IAM practices that organizations must not neglect

The IAM framework means using the right solution to implement user authentication and privileges policies. In addition, with IAM, companies demonstrate that any data is not misused, and they comply with government regulations.

For all these characteristics, businesses are increasingly adopting IAM solutions, and their demand will undoubtedly be high in the upcoming time. It's also estimated that the IAM market will grow to $15.3 billion by 2025.

The organization needs to use the right IAM tools and practices to reap the most benefits from the IAM solution. The six best IAM practices that every business should incorporate into its security strategy are as follows:

Adopt passwordless authentication

Many data breaches occur because of weak or stolen credentials. Threat actors can use advanced tools and tactics to steal and break passwords.

Organizations need a secure identity management system to prevent bad actors from breaking in and stealing credentials that can result in breaches such as the Lapsus$ attack or the Colonial Pipeline ransomware attack. Organizations eliminate password issues by choosing passwordless authentication to protect vital business data and ensure that only authentic people access it.

Passwordless authentication enables users to authenticate their identity without entering a password. There are various benefits for organizations to become passwordless- it enhances the overall efficiency, saves time and productivity, and provides greater ease of access. But, most importantly, passwordless authentication allows IAM leaders and users to access the cloud environment safely and securely.

Implement a Zero-Trust approach

The zero-trust approach is not new but has gained popularity as the threat landscape is evolving. Organizations cannot have a robust IAM policy without a function zero-trust architecture. The average cost of a data breach is $4.24 million, but the zero-trust model helps reduce the cost of a data breach by $1.76 million. Moreover, Gartner also predicts that the ZTNA solutions will grow to $1.674 billion in 2025.

Zero-trust means continuously verifying authorized users as they move into the network and giving them the lowest privileges while accessing crucial documents and files. Zero trust within the cloud creates access measures to protect sensitive data and applications from unwarranted access.

The zero-trust architecture ensures that IAM policies are followed whenever the user accesses the organization's network and protects the cloud data. Successful zero-trust implementation for the cloud must begin with passive application observation. Companies must first monitor and determine the relationship between the apps and then enforce rules. In addition, enterprises consider using other technologies like MFA, endpoint protection, micro-segmentation, and visibility and analytics to execute zero-trust systems.

Ensure compliance

IAM is designed to control users and protect their data, which can be achieved by meeting standard compliance requirements. Businesses often have regulatory requirements connected to the data they store either in the data warehouse or cloud data warehouse. They must report on their data access and use processes while complying with specific laws and regulations.

They must face hefty fines, lawsuits, and penalties if they fail. For example, Twitter agreed to pay $150 million to settle allegations of its data privacy practices when the US alleged Twitter for collecting users' contact information to show targeted ads.

Organizations that haven't yet must strictly follow compliance regulations, including GDPR, SOX, HIPAA, and PCI-DSS, to ensure that data is not misused. Besides this, businesses must audit each user role and assign them to the appropriate data owner, to keep a check and balance on the following compliance. In this way, companies can ensure compliance regulations and surveillance of data access.

Use appropriate DevOps tools

A data breach occurs because of human error or when application flaws occur. Businesses also forget to maintain a record of unstructured or dark data, including files and documents downloaded and used for different purposes, credit cards, and social security numbers. Cyber-criminals take complete advantage of such vulnerabilities and data that can eventually result in a data breach.

Such events not only cause significant financial loss to the business but also result in loss of customers and brand reputation. DevOps teams and tools greatly help enterprises prevent data breaches and ensure no one can access sensitive data. By using various DevOps tools, businesses keep track of the unstructured data from the initial stage and boost the overall security level.

Deploy artificial intelligence

Cybercriminals have become more advanced and sophisticated than before. They are using new approaches and tactics to access the organizational network. Because of their progressive nature, even the security teams sometimes fail to recognize them. Hence, organizations have adopted Artificial Intelligence and Machine Learning technologies to implement IAM and reduce the threat vector effectively.

AI ensures improved security and maintains business integrity. Using AI technology like Robotic Process Automation (RPA) deeply monitors and reveals the abnormalities in user behavior. Though an organization produces trillions of primarily unstructured data, the ML system scans all the data efficiently and prevents data leaks and breaches. Moreover, the AI system constantly monitors all behavior and ensures that verifying workers' access to network resources is continuous.

If, by any chance, threat actors gain access to the network by any backdoor, the AI system sends a quick alert to the IT department so they can take appropriate measures. Also, the system denies the access request and ensures the complete safety of the business data.

Centralize the organization's systems

Another best practice businesses can adopt to improve IAM is centralizing all network systems. It is an effective approach that provides more visibility and allows the security teams to detect and respond to cyber threats by letting all the users sign into a single authentication provider, which then propagates identity access across the apps and resources within the organization.

Moreover, with the centralized management system, it is easier to enforce policies like using secure passwords or multi-factor authentication to access the resources.

Additional best practices

Apart from the practices mentioned above, listed below are some common IAM practices businesses should not ignore. These includes:

• Ensure new applications from all sources are securely developed and onboarded. For this purpose, deploy API access control (authentication and authorization of APIs) as it is a crucial part of API security.
• Authentication is vital for IAM; hence, use multi-factor authentication tools to authenticate the identity.
• Remove unnecessary users from the network to reduce the risks of unauthorized access.
• Regularly review and audit the IAM policies to ensure they are granted the least privilege.
• When an IAM account is not used, immediately de-provisioned it. This prevents any hackers from stealing and misusing those credentials.

Final thoughts

Making a business compliant with identity and access management requires an in-depth understanding of who can access the sensitive data and which data is necessary for the workers. Staying informed and updated about the latest technological trends and IAM practices will further help improve the IAM infrastructure.

The post Key to success while implementing IAM- Best practices that every company should implement appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

The digital world is ever-expanding in scope and influence, both in personal and professional matters. In the last few years, business operations have become increasingly dependent on technology, and on employees to use that technology safely. While remote and mobile work have been necessary and useful, they also open the door for cybercriminals to take advantage of lax security measures and employees’ ignorance of best practices. 

So long as companies are carrying out some or all of their affairs in the digital realm, cybersecurity is easily as important as physical security. As one cybersecurity awareness training guide puts it: “if businesses are to thrive in the Fourth Industrial Revolution, security needs to be not only top of mind, but a fluent language.” Some of the most pressing reasons for cybersecurity training are detailed below. 

1. Compliance with regulations

There are many areas of business operations which are governed by legal or regulatory oversight to protect against various risks inherent to digital activities. These include HIPAA, which outlines rules regarding private health information, PCI SSC, which seeks to strengthen payment account security, and GDPR, which regulates general data privacy. Complying with these regulations is necessary for several reasons, although the dominant motivator for compliance is that the organizations can and will impose fines on businesses that fail to meet standards.

It has often been said that a business is only as strong as its weakest link, and nowhere is this truer than in the world of data security. Any one employee can be a liability when it comes to the practices that an enterprise puts in place to protect consumer data as well as their own. When compliance is mandated and the threat of fines is looming, companies must ensure that all of their employees are properly trained and informed on the regulations in place.

2. Protecting enterprise assets

Aside from wanting to avoid fines, however, businesses should still attempt to meet these regulatory standards for their own good. While meeting the bare minimum of compliance standards will keep a company out of hot water with regulatory boards, it will not necessarily protect the company itself. According to one report from IBM, the average cost of a data breach is 4.35 million USD. Ensuring that employees are trained in cybersecurity awareness greatly decreases the risk of a data breach occurring, as well as ensuring that employees know how to respond in the event that there is an attack targeting the company’s data. 

3. Protecting consumer data

Ostensibly protected by the aforementioned regulatory standards, consumer data is still at a huge risk of being obtained, stolen, or leveraged by cybercriminals. An attack that only targets a company’s internal data is dangerous to the company, but an attack that targets consumer data can have far-reaching consequences that affect thousands or millions of people.

The responsibility for password complexity and variation, device and website privacy settings, and the amount of data shared can be at least partially placed upon the consumer’s shoulders. But the company must have its own measures in place as well to protect against attacks on customer data. 

Thorough and effective cybersecurity awareness training will reduce the chances of employee error leading to customer data being breached. When customer data is safe and protected, it establishes trust between the consumer and the business, and protects both from the liabilities that enterprises with weak security practices are subject to.

4. Establishing skill sets

In addition to protecting both the consumers and the business at large, cybersecurity awareness training can instill knowledge in employees that they will carry with them outside of work hours and use to their benefit, possibly even spreading it to their friends and family. Employees who learn how to detect and mitigate threats such as phishing, ransomware, spoofing, and deepfakes will be able to prevent those types of attacks not only on the company or its customers, but on their own personal data. They may even be more computer-literate in general and more receptive to technological advances that bring about change within the company, rather than being resistant and hesitant to learn. 

5. Constantly changing landscape

Even a company with a highly trained workforce must still make cybersecurity awareness training a priority going forward. The world of computers and data security is constantly shifting and growing, and threats adapt along with it. It is vital to refresh employees’ training and update it to account for significant changes that come about on a frequent basis. No cybersecurity training is effective if it is treated as a “one-and-done” affair, because no training can predict and guard against future advances on both the company’s end and the attackers’ end. 

Conclusion

At the end of the day, a company must be responsible for protecting its own data as well as any data that consumers choose to share with it. All employees have the potential to put this data in danger, so all employees need to undergo cybersecurity awareness training to mitigate that risk. A training program combined with other effective security measures will make sure that employees are prepared to recognize risks, guard against threats, and recognize and react to attacks if and when they do occur. Cybersecurity awareness training programs come in many flavors to meet the varying needs of businesses everywhere, and it is not only advisable but crucial to establish some kind of training for employees.

The post Five reasons why Cybersecurity training is important in 2023 appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

With the explosive growth of technology, businesses are more vulnerable than ever to malicious cyber attacks. And as cybercriminals become more sophisticated, new methods of attack are popping up left and right.

To add fuel to the fire, the average cost of a data breach increased from $3.86 million to $4.24 million in 2021. That's costly enough to put most SMBs into the red. Not to mention the reputational damage it can cause for your brand.

Avoid this dreaded fate by protecting yourself against the latest cybersecurity developments — like Malware-as-a-Service (MaaS) — to protect your networks, data, systems, and business reputation.

If you've never heard of Malware-as-a-Service (MaaS) before, don't fret. This article is for you.

We'll teach you everything you need to know about Malware-as-a-Service and wrap it up by sharing some best practices for protecting your proprietary company data from potential threats.

Let's dive in.

What is Malware-as-a-Service (Maas)?

Malware-as-a-Service (MaaS) is a type of cyber attack in which criminals offer malware and deployment services to other hackers or malicious actors on the internet.

These services typically are available on the dark web. When purchased, a bad actor can carry out various malicious activities, such as stealing sensitive information, disrupting computer systems, or encrypting data and demanding a ransom to unlock it.

Some of the most common types of malware include the following:

• Viruses: Programs that can replicate themselves and spread to other computers. They can cause various problems, such as disrupting computer operations, stealing information, or damaging files.
• Trojan horses: These programs masquerade themselves as legitimate software but can carry out malicious activities, such as stealing data or giving attackers unauthorized access to a computer.
• Worms: A self-replicating program that can spread across networks, disrupting computer operations and consuming network resources.
• Adware: Software that displays unwanted advertisements on a computer. It can be intrusive and annoying and sometimes track a user's online activities.
• Ransomware: Encryption of a victim's data with the demand for a ransom payment to unlock it. It can devastate businesses, resulting in losing important data and files.
• Spyware: Software designed to collect information about a user's online activities without their knowledge or consent to steal sensitive information (like financial statements and passwords).
• Bots: Often used in conjunction with other types of malware, such as viruses or worms. For example, a virus could infect a computer and then download and install a bot, which could carry out malicious activities on that computer or other computers on the network.

MaaS makes it easier for cybercriminals to launch attacks, as they can purchase and use pre-made malware without developing it themselves. This distinction can make it harder for law enforcement, cybersecurity experts, and IT teams to track down the people responsible for the attacks.

And sadly, cyber-attacks are industry agnostic. For example, in the transportation industry, cybercriminals exploit vulnerabilities of electronic logging devices and steal valuable information from cloud-connected trucks.

MaaS is also a significant threat to online job boards like Salarship, Indeed, UpWork, or any other platform where job applications are stored. Attackers can easily access the personal data of thousands or millions of people by targeting these sites.

The bottom line: As a business with priority company data, it's essential to be aware of the different types of malware and take the necessary precautionary steps to protect against these heinous services.

Ransomware-as-a-Service (RaaS) vs. Malware-as-a-Service (MaaS)

Ransomware falls under the umbrella of malware. But what's the difference between Ransomware-as-a-Service (RaaS) and Malware-as-a-Service (MaaS)?

The main difference between MaaS and RaaS is the specific type of malware offered as a service. MaaS involves the development and deployment of any malware, while RaaS specifically consists of the development and deployment of ransomware.

Ransomware is a type of malware that restricts access to the infected computer system or its data and demands a ransom payment to regain access. It typically spreads through phishing emails, malicious websites, and targeted exploits.

MaaS and RaaS are online services on the dark web that make it easy for anyone with no experience or knowledge to launch an attack.

In some RaaS cases, the attackers may steal the victim's data and hold it for ransom, demanding payment to return it to the victim. Or the attackers may encrypt the victim's data and demand payment to unlock it without stealing it.

Regardless, the goal of ransomware is to make money by extorting the victim.

How to protect your business against MaaS

As malware becomes more sophisticated and accessible, it's imperative to have some defense programs in place that can offer your extra business protection against bad actors.

According to a recent study, 64% of Americans would blame the company, not the hacker, for losing personal data.

Thankfully, there are ways to lessen the impact. ​​A report from Cisco states that adhering to General Data Protection Regulations (GDPR) has been shown to minimize the effects of a data breach.

Why? Because if a company complies with the GDPR, attackers might not find any data to exploit. And with the help of a privacy policy generator, your business can be GDPR-compliant with the click of a button.

Here are a few additional steps that your business can take to protect itself from MaaS:

• Implement strong network security measures, such as a web application firewall, intrusion detection, and secure passwords.
• Regularly update and patch all software and operating systems to fix known vulnerabilities.
• Educate employees about Malware-as-a-Service risks and how to avoid them, such as not opening suspicious email attachments or visiting untrusted websites.
• Use reputable anti-virus and anti-malware software and regularly scan the network for signs of infection.
• Back up any necessary data regularly so your business can quickly restore its operations if anything goes south.

One of your company's most significant assets is its data privacy and reputation, which directly affects how much your business is worth. So it's critical to protect it against MaaS with a strong and well-implemented cybersecurity plan.

Wrapping up

Cybercriminals no longer need a strong technical background to pull off a malicious hack. The MaaS model has made it possible for anyone to become a cybercriminal.

But that doesn't mean you have to avoid the internet forever — which is pretty challenging to do in today's day and age.

With preventative measures and a robust cybersecurity strategy, you can sleep soundly at night, knowing your company data is safe from a MaaS attack.

For more advice on staying secure online, check out the AT&T Cybersecurity blog for additional insight.

The post Understanding Malware-as-a-Service (MaaS): The future Of cyber attack accessibility appeared first on Cybersecurity Insiders.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Data continues to be a valuable asset for an organization and plays a crucial role in making operational and strategic business decisions. With the growth of hybrid, private, and multi-cloud models, much of the data is stored on these platforms and becomes vulnerable to malicious activities and potential data leaks.

Amid the vast volume of data, some of the data remains unknown, untapped, and unused with an organization's architecture. This dark data is generated by users' daily online interactions between several devices and systems.

Dark data might seem like a scary term, but it isn't, though it poses some risks. Since its percentage of data is rising more quickly than organizational data, business organizations are getting concerned about it. Hence, to grasp what dark data is and what issues it signifies, it's essential to understand it from a broader perspective.

What Is dark data?

Dark data is the type of organizational data whose value is not identified; hence, it can be crucial business data or useless data. A research report published by BigID reveals that 84% of organizations are seriously concerned about dark data. This data consists of the additional information collected and stored during daily business activities. But perhaps to your surprise, the organization may be unaware of the dark data and typically doesn't use it.

Dark data tends to be unstructured data that contains sensitive and unclassified information. The research report further reveals that eight out of ten organizations consider unstructured data the most critical to handle and secure. Dark data can be classified as follows:

• Emails, images, audio, video, and social media posts.
• Application trials including API caches and encryption keys such as VPN or SSH support.
• Data stored in overlooked virtual images activated or installed in local or cloud infrastructure.
• Forgotten unstructured data created on various database engines a long time ago.
• Customers and the company's employees own data on the desktop and mobile devices.
• The hidden data file in a file system can be in the form of old pictures, scanned documents, pdf forms, notes on MS Word documents, and signed files.

Dark data might seem benign, but it holds most of the organization's information. Thus, it can pose significant security risks if it falls into the wrong hands, like leaking a company's sensitive data and damaging its industry reputation. This is particularly alarming for organisations that do not use a reliable VPN or any other security tools to ensure data privacy and safety.

How can you utilize dark data to help your business?

Dark data seems challenging to handle and involves lengthy manual processes, but companies need to automate these processes. Technological advancements such as the use of AI have made it easier for companies to explore and process unstructured data.

Another important use of dark data is its role in boosting AI-powered solutions. As more and more data exists, the information that AI can analyse to produce even deeper insights. Alongside Artificial Intelligence, you can also use Machine Learning technology to discover untapped and unused data and insights. These insights might help organizations make more informed decisions regarding incoming data. Also, it guides them toward taking practical steps in response to their data.

Implementing AI and ML systems needs internal structural changes for businesses, costing organizations a great deal of time and money. However, the benefits will be a high return on investment, so do invest in it.

Besides this, organizations can use dark data to create management strategies around IoT technology to provide long- and short-term trend analyses to show possible results to managers and senior leadership.

Another way dark data can prove helpful is by developing new and productive business strategies. This helps enterprises analyse which department owns what type of data different employees and management hold. Moreover, it can help improve the quality assurance processes that detect and correct errors. Also, it looks for potential privacy loopholes, vulnerabilities, and compliance violations.

Dark data can improve business by creating revenue, streamlining processes, and reducing costs. It is capable of understanding the relationships between unrelated pieces of information.

Thus, analysing information like server log files can give insight into user behaviour, customer call records, geolocation data, and preferences that can reveal traffic patterns and help in further improving and expanding their business.

Hidden dark data cybersecurity risks

Dark data isn't going away anytime soon; hence, organizations should consider it a big challenge and poses significant cybersecurity risks. Here are some of the issues that dark data brings along it:

Compliance violations

There are greater chances that the organization's dark data might violate the data privacy compliance mandates and regulations like the GDPR, PCI DSS, or HIPAA. The organization itself has no idea about this violation unless a breach occurs. In such a situation, the regulators and the clients become extremely angry for not protecting the data. Also, the organization might face lawsuits, sanctions, and hefty fines.

Unused business security intelligence

Another drawback of dark data stored within your organization is that enterprises fail to utilize all security intelligence. For instance, the dark data assets also include system log files that can be used to create more accurate threat and anomaly detection or cyber risk assessment models. But when it goes overlooked, enterprises might experience a hacking or data breaching incident, and they regret it later because they have a way to secure themselves but ignore it.

Increased risk of cyber-attacks

As you store more and more business data on local servers and within the cloud environment, it becomes more challenging to discover, reuse, or retrieve user data – which may increase the risk of a data breach.

When people within an organization don't know what information each data set contains, it can result in confusion about who can access it and who is unauthorized. Moreover, the poorly categorized data even lead to significant permission challenges. Any unauthorized person accessing sensitive information simply puts your business on the verge of a possible data breach or leaks of critical business data. If the wrong individuals are accessing sensitive information, you're putting your business at risk of a data breach.

Besides this, dark data also causes opportunity costs to an organization. If a company decides not to invest in the evaluation and processing of dark data, but its competitors do so, they likely fall behind. Hence, the organization pays the cost of lost opportunities.

How to handle dark data?

Despite using dark data constructively, there are some other ways that you can adopt to handle dark data more efficiently and in a well-organized manner. Here are some of these ways:

• Use strong encryption standards for your business data to prevent data security issues and add an extra security layer to your online data. Organizations need to apply this practice to in-house servers and data shifting in the cloud environment. Using a reliable VPN provider can provide a top-notch level of encryption and online security.
• Organizations must implement data retention policies and remain compliant with the data protection regulation. This allows them to store users' data for a limited time and helps prevent lawsuits or fines. Also, good data retention policies retain valuable data for later use.
• You need to perform regular audits of the database. It includes classifying and structuring data and gives an idea of where what kind of data is stored. Later if you need the data, you can find it easily in an organized database instead of an unorganized form.
• Organizations need to take control of dark data with an appropriate data governance plan. Companies can improve compliance and overall productivity with a robust plan in function.

Final thoughts

An organization produces lots of data every day. In an era where cyberattacks are increasing at an unprecedented rate, protecting and governing different data types is an uphill task. Dark data is one of the data types that's tough to handle and secure. It brings multiple cybersecurity risks like legal and regulatory issues, intelligence risks, and increased attack surface.

However, if you know the appropriate strategies, you can make good use of the dark data as discussed above. If used constructively, dark data can bring increased success to your business; if not, it can cause havoc, so now the choice is yours.

The post Dark Data: What is it? How can you best utilize it? appeared first on Cybersecurity Insiders.