Many years ago, the firewall was everything. Defense-in depth was a concept defined as layered defense with multiple firewalls on the path. Behind the firewall was a fortress. Organizations designed networks with strong perimeters and demilitarised zones to ensure the crown jewels were well-protected. Attackers had a difficult time trying to break into the firewalls. On the physical layer, Network Admission Control (NAC) technologies were implemented to prevent intruders from having direct access into the network by preventing them from plugging unauthorized devices into the network. Before a device was admitted, it had to meet a minimum requirement defined by the organization.
Those years are gone and maybe gone forever. Cloud computing, Bring Your Own Device (BYOD), Artificial Intelligence, Internet of Things (IoT), VPNs, and Remote Working Capabilities have dramatically changed the way businesses run. These technologies have introduced a level of innovation and disruption that were unimaginable only a few years ago. They have resulted in the collapse of the traditional network perimeter, thereby increasing the attack surface for cyber-attacks. Enterprise networks coverage is today being extended beyond our imagination – outside the traditional datacentres to smartphones, cloud platforms, mobile computers, and IoT interfaces without geographical boundaries. The bad guys now have a plethora of interfaces to launch their attacks on; they do not have to breach the network using traditional social engineering tactics physically. The recent changes in the work environment occasioned by the COVID-19 have further amplified the extension of network boundaries beyond the traditional datacentres. Employees work from home with devices and connections into the enterprise networks that were not originally designed for such. Improvised connections were made to allow functionality because the pandemic came without an announcement.
The danger this poses is that some of these end devices were not originally designed with security in mind. Even if security was a consideration, not so much for enterprise data protection. These devices are most of the time not hardened, and their owners may not understand the effects on the overall organizational security posture. A handful of these devices are installed with default passwords, and most times, these passwords are not changed during or after installation. So it is easy to guess the password by manual methods or using advanced dictionary or brute force attack methods. Another risk posed by these endpoints is the lack of security updates and patches. Because they are sometimes not seen to be part of the enterprise network, they are not included in the patch management program, and their presence introduces high-level vulnerabilities within the enterprise network. It then becomes easier to utilize malware that could tunnel through the firewall to breach the enterprise network, instead of spending months and years trying to break into the firewall or layers of firewalls. In recent years, large-scale attacks have been launched using malware by exploiting known vulnerabilities and security gaps on endpoints. For example, the WannaCry, Petya, and another variant of Petya, the NotPetya were employed to launch attacks on enterprise networks through vulnerable endpoints. Another danger with this trend is potential data leakage because these devices are used to either temporarily or permanently store organizational data.
There is also concern about device loss. If these devices are lost, there is a risk of exposing the organization’s data to unauthorized entities, and that could both result in financial and reputational damage. These dangers are also expanded by the impact of the COVID 19 pandemic, where organizations made ad hoc improvisions to support businesses while employees work from home. As commerce resumes, organizations are beginning to discover some capabilities to support their businesses remotely, and they are also rethinking their business continuity strategies. For some businesses, this is not just a temporal shift, but a change which has permanently altered the operational procedures of the organization.
Legacy cybersecurity strategies, techniques, and investments will not be enough to mitigate the rising cybersecurity concerns introduced by this new way of working. Protection has gone beyond throwing in uncoordinated technical solutions and efforts. Organizations need to rethink a new approach for the protection of their assets within the ever-growing complexity both to remain afloat and also to derive commensurate Returns On Security Investments (ROSI). A well-crafted strategy will ensure that cybersecurity efforts are coordinated within the enterprise, without duplication of efforts and resources, which will, in turn, drive down the cost of implementing cybersecurity initiatives.
To improve the security posture, organisations must do the following:
- Continuously monitor the devices, applications, and processes running on the network.
- Automate security monitoring and mitigation.
- Implement systems that are capable of automatic detection, isolation, and containment of threats within the network.
- Ensure that monitoring covers event data, session data, and historical data on endpoint usages, such as past processes, network connections, and other information.
Another measure organizations should take is reducing complexities. The extension of the network boundaries has not stopped organizations from using existing network solutions to protect the enterprise network. However, in a bid to ensure the protection of the on-premise infrastructure and the ones beyond the organizational traditional network boundaries, organizations combine existing technologies with new solutions and the resultant effect is an increase in complexity. To effectively manage security, organizations should put measures in place to ensure a reduction in complexity and enhancing visibility. This can be achieved by unifying all efforts and technologies for managing both on-premise and off-premise infrastructure in a single platform. Beyond technical controls, organizations should develop procedures, standards, and policies for acceptable use of organizational resources.
Over the years, PCL. has supported organizations in developing tested cybersecurity and business continuity strategies to ensure that organizations can protect their assets. We provide managed security and assurance functions to ensure that operationally, organizations are well protected against destructive cybersecurity incidents. Contact us today, send an email to [email protected] to start the engagement.
Apple head of security accused of offering iPads as bribes for concealed gun permits
A California grand jury has indicted Apple’s head of global security on charges that he tried to bribe Santa Clara County officials to procure firearms (CCW) licenses, according to a news release. Santa Clara district attorney Jeff Rosen alleges that Thomas Moyer offered 200 iPads — worth about $70,000 — to Capt. James Jensen and Undersheriff Rick Sung in the Santa Clara County sheriff’s office, in exchange for four concealed firearms licenses for Apple employees.
The charges came after a two-year investigation. “In the case of four CCW licenses withheld from Apple employees, Undersheriff Sung and Cpt. Jensen managed to extract from Thomas Moyer a promise that Apple would donate iPads to the Sheriff’s Office,” Rosen said in the news release. The iPads were never delivered, according to Rosen’s office, because Sung and Moyer became aware in 2019 that the district attorney was executing a search warrant for the sheriff department’s CCW records.
Moyer’s attorney, Ed Swanson, said in a statement emailed to The Verge that his client is innocent of the charges filed against him, adding he believed Moyer was “collateral damage” in a dispute between the Santa Clara sheriff and district attorneys’ offices. “He did nothing wrong and has acted with the highest integrity throughout his career,” Swanson said. “We have no doubt he will be acquitted at trial.”
“We expect all of our employees to conduct themselves with integrity,” an Apple spokesperson said in a statement to Ars Technica. “After learning of the allegations, we conducted a thorough internal investigation and found no wrongdoing.”
According to Bloomberg News, Moyer has been at Apple for about 15 years and has been its head of global security since November 2018. He wrote a memo in 2018 warning Apple employees about the potential consequences of leaking information to the media, which he wrote “can become part of your personal and professional identity forever.”
Be Very Sparing in Allowing Site Notifications
An increasing number of websites are asking visitors to approve “notifications,” browser modifications that periodically display messages on the user’s mobile or desktop device. In many cases these notifications are benign, but several dodgy firms are paying site owners to install their notification scripts and then selling that communications pathway to scammers and online hucksters.
When a website you visit asks permission to send notifications and you approve the request, the resulting messages that pop up appear outside of the browser. For example, on Microsoft Windows systems they typically show up in the bottom right corner of the screen — just above the system clock. These so-called “push notifications” rely on an Internet standard designed to work similarly across different operating systems and web browsers.
But many users may not fully grasp what they are consenting to when they approve notifications, or how to tell the difference between a notification sent by a website and one made to appear like an alert from the operating system or another program that’s already installed on the device.
This is evident by the apparent scale of the infrastructure behind a relatively new company based in Montenegro called PushWelcome, which advertises the ability for site owners to monetize traffic from their visitors. The company’s site currently is ranked by Alexa.com as among the top 2,000 sites in terms of Internet traffic globally.
Website publishers who sign up with PushWelcome are asked to include a small script on their page which prompts visitors to approve notifications. In many cases, the notification approval requests themselves are deceptive — disguised as prompts to click “OK” to view video material, or as “CAPTCHA” requests designed to distinguish automated bot traffic from real visitors.
Approving notifications from a site that uses PushWelcome allows any of the company’s advertising partners to display whatever messages they choose, whenever they wish to, and in real-time. And almost invariably, those messages include misleading notifications about security risks on the user’s system, prompts to install other software, ads for dating sites, erectile disfunction medications, and dubious investment opportunities.
That’s according to a deep analysis of the PushWelcome network compiled by Indelible LLC, a cybersecurity firm based in Portland, Ore. Frank Angiolelli, vice president of security at Indelible, said rogue notifications can be abused for credential phishing, as well as foisting malware and other unwanted applications on users.
“This method is currently being used to deliver something akin to adware or click fraud type activity,” Angiolelli said. “The concerning aspect of this is that it is so very undetected by endpoint security programs, and there is a real risk this activity can be used for much more nefarious purposes.”
Angiolelli said the external Internet addresses, browser user agents and other telemetry tied to people who’ve accepted notifications is known to PushWelcome, which could give them the ability to target individual organizations and users with any number of fake system prompts.
Indelible also found browser modifications enabled by PushWelcome are poorly detected by antivirus and security products, although he noted Malwarebytes reliably flags as dangerous publisher sites that are associated with the notifications.
Indeed, Malwarebytes’ Pieter Arntz warned about malicious browser push notifications in a January 2019 blog post. That post includes detailed instructions on how to tell which sites you’ve allowed to send notifications, and how to remove them.
KrebsOnSecurity installed PushWelcome’s notifications on a brand new Windows test machine, and found that very soon after the system was peppered with alerts about malware threats supposedly found on the system. One notification was an ad for Norton antivirus; the other was for McAfee. Clicking either ultimately led to “buy now” pages at either Norton.com or McAfee.com.
It seems likely that PushWelcome and/or some of its advertisers are trying to generate commissions for referring customers to purchase antivirus products at these companies. McAfee has not yet responded to requests for comment. Norton issued the following statement:
“We do not believe this actor to be an affiliate of NortonLifeLock. We are continuing to investigate this matter. NortonLifeLock takes affiliate fraud and abuse seriously and monitors ongoing compliance. When an affiliate partner abuses its responsibilities and violates our agreements, we take necessary action to remove these affiliate partners from the program and swiftly terminate our relationships. Additionally, any potential commissions earned as a result of abuse are not paid. Furthermore, NortonLifeLock sends notification to all of our affiliate partner networks about the affiliate’s abuse to ensure the affiliate is not eligible to participate in any NortonLifeLock programs in the future.”
Requests for comment sent to PushWelcome via email were returned as undeliverable. Requests submitted through the contact form on the company’s website also failed to send.
While scammy notifications may not be the most urgent threat facing Internet users today, most people are probably unaware of how this communications pathway can be abused.
What’s more, dodgy notification networks could be used for less conspicuous and sneakier purposes, including spreading fake news and malware masquerading as update notices from the user’s operating system. I hope it’s clear that regardless of which browser, device or operating system you use, it’s a good idea to be judicious about which sites you allow to serve notifications.
If you’d like to prevent sites from ever presenting notification requests, check out this guide, which has instructions for disabling notification prompts in Chrome, Firefox and Safari. Doing this for any devices you manage on behalf of friends, colleagues or family members might end up saving everyone a lot of headache down the road.
How to Secure IoT Devices–Right Now
IoT devices are not going away any time soon. The estimates vary widely as to how many devices are currently in use, and how many devices will be deployed in the next few years, but the one thing that everybody seems to agree on is that IoT adoption is on the rise. The other thing people seem to agree on is that it is critical to secure IoT devices–using long-term and short-term strategies.
Early on, many IoT vendors rushed their products to market with seemingly no concern about security. Things seem to be getting better, but IoT’s reputation for being insecure has been firmly cemented. That makes IoT devices a big target, so it makes sense to consider what you can do–right now–to keep secure IoT devices.
1. Perform a password audit.
The very first thing I recommend doing to secure IoT devices is to perform a password audit against all of your IoT devices. While it is important to determine whether any of your devices are using weak passwords, it is far more important to test for default password use. Remember, nearly every device manufacturer posts its manuals online, and these manuals almost always list the default password for the device. Anyone can get access to this information, and default passwords are often a starting point for those who seek to compromise IoT devices.
Ideally, each of your IoT devices should be equipped with a random, but complex password. After all, if all of your devices share a common password, an attacker could conceivably acquire that password and take control of all of the devices. This is especially troubling since there are stories of attackers who have managed to get IoT devices to function as botnets.
2. Review the end user agreement.
One of the things that I never hear anyone talk about with regard to IoT security is the importance of reviewing the end user agreement. That’s the agreement that the manufacturer displays on screen when you initially configure the device. If you simply click OK to accept the agreement without reading it–so you can finish the deployment and get on with your day–you really don’t know what you have just agreed to. Given the extent to which devices have become known for spying, it may be worth taking the time to review the end user agreement for your devices and make sure that the device is not compromising sensitive information. If you’re not comfortable with something in the end user agreement, it may be worth adopting a competing vendor’s product.
3. Keep firmware up to date.
Just as software vendors routinely release patches for their products, reputable IoT vendors will occasionally release firmware updates to secure IoT devices. It is important to download, test and deploy these firmware updates just as you would any other patch.
4. Disable unnecessary features.
In some cases, you can enhance your security by disabling unnecessary features. To determine what’s really necessary and what’s not, spend time reviewing the feature sets of the IoT devices that you use.
Obviously, some devices are far more feature-rich than others. An IP-enabled industrial sensor, for instance, probably has few, if any, ancillary features. On the other hand, devices that are oriented more toward the end user tend to be feature-rich. In some cases, disabling even a single feature can significantly improve the device’s overall security.
For example, like many other people, I have a Wi-Fi enabled, smart thermostat in my home. This thermostat has a remote access feature that lets me remotely monitor the temperature in my home and make adjustments if necessary. I have disabled the thermostat’s remote access feature–not because I’m worried about a hacker setting the air conditioner to run at full blast, but because an attacker who gains access to the thermostat could conceivably use it as a platform for launching an attack against other devices on the network.
5. Put segmentation to use.
My goal for this blog post was to focus on immediate actions that can be taken in an effort to secure IoT devices. Even so, I just couldn’t conclude the post without mentioning segmentation. Segmentation takes some planning, so it doesn’t really qualify as something that you can do right now. Even so, segmentation is one of the most important things that you can do to keep your IoT devices secure, so I wanted to be sure to mention it.
When possible, place your IoT devices on isolated network segments. The smart thermostat I mentioned is connected to a dedicated Wi-Fi network that services only the connected devices in my home. Using this dedicated network prevents IoT devices from accessing sensitive data such as the files stored on my laptop.
Even if you cannot completely isolate a device, you may be able to use firewall and routing policies to restrict a device’s communications. For example, if a particular device communicates with a backend SQL Server, you should look for ways to prevent the device from ever communicating with anything else (with the possible exception of a management PC). This can go a long way toward keeping the device secure while also preventing data leakage.
The Motivator5 days ago
RecordCast | Free Computer Screen Recorder Online
Tech News4 days ago
Shola Akinlade: Paystack’s maturity relied on a community of hard and smart workers
The Motivator4 days ago
GOOGLE’S TASK MATE WILL ALLOW YOU TO EARN MONEY BY DOING “SIMPLE” THINGS!
Systems4 days ago
Next Galaxy Z Flip to sport 120Hz display and narrower frame says leakster
The Future4 days ago
Xbox App May Come to Smart TVs in the Next 12 Months: Phil Spencer
The Motivator3 days ago
Monster Hunter: The Movie content is coming to Monster Hunter: The Game
Security3 days ago
Apple head of security accused of offering iPads as bribes for concealed gun permits
Research4 days ago
Part human, part machine: is Apple turning us all into cyborgs?