Tag: Cyber Security

The reality is that penetration testing provides no guarantees of security and does not address the weaknesses in an organisation’s ability to detect and respond to a sophisticated attack; or its ability to manage a cyber crisis and take the timely decisions to enact cyber defence or system continuity plans. Consequently, there is a need for more sophisticated and technically based crisis exercises to identify causes of failure and to provide training, education and awareness.

To most firms, a real-world attack simulation is as much a ‘game changer’ as actually being targeted. In both cases, firms can expect to learn hard lessons, but the war game process ensures that the organisation is ready to absorb the lessons and identify the benefits without the pain or damage of an actual breach. This point cannot be underestimated. In a real event there is invariably a catalogue of human and management failures consistent with the inability to think clearly under pressure.

In reality, most lessons are only learnt after a real event, even when the overriding climate is negative or less orientated towards learning. A cyber attack war game, which simulates a prolonged attack, aims to provide lessons before a real event, and enables learning during an attack. In short, it can develop a firm’s ability to interpret and apply experience into real-time learning.

Cyber security war games derive significant learning across multiple levels of decision-makers, and can be structured specifically to bring together the C-suite, security leadership team, security operations centre and incident response, as well as the forensics, risk and crisis management teams. War gaming is an excellent and effective way for large organisations to identify the weaknesses in communications and coordination between these groups. In times of crisis, the cascading effects of an attack and the impacts are often exacerbated by the decisions taken, and the process of decision-making by these groups. Learning how these groups take certain decisions when faced with uncertainties, or adapt and enact response plans when tackling ‘unknowns’, is vital to a successful response and the successful building of cyber resilience within an organisation.

How do cyber attack war games work?

A well-crafted cyber security war game incorporates both a ‘fundamental surprise’ that the organisation had not anticipated and a number of ‘situational surprises’ – known cyber risks for which the organisation has little or no advanced warning. Much of the pre-exercise planning should aim at developing appropriate knowledge and intelligence in order to define the exercise in a manner that can be controlled and developed over time and tests the different capabilities.

The ‘storyline’ can commence with a technical event to kick off the assessment of initial implications, and the event would then be developed through situational feeds from the directorate. The initial objectives should be to test detection: by the systems; by the incident response team; and the analysis of the forensic team. More can then be provided by the directorate including intelligence, such as analysis of the threat community, IP information, and pieces of a malware. The exercise can then examine the fundamentals of communication and decision-making, specifically:

• who is taking decisions and on what basis?
• what is the process of taking alerts/indications and deriving useful information from then?
• how is information then transformed into knowledge throughout this first technical phase?

At this point, a major new technical event may be introduced, or the original event may be taken in a new direction to trigger a new cycle of detection and decision-making. Evaluation may focus more on how the new event affects the decisions previously taken, the need for additional resources, and whether a new risk assessment should take place. With a second-phase escalation of the attack, the evaluation can examine who is assessing the risk throughout the event, who is involved in the process, what indicators are in place, and how they conduct a timely assessment of the possible implications from the new event.

Using this approach will allow escalation towards the involvement of the crisis management team, and an examination of their team, what stage they were involved and how they receive the relevant information. The exercise can also test the team’s communication effectiveness, who precisely was involved and how they supported the whole process.

Building cyber resilience

The more significant element in the learning process is the incorporation of observation, decision-logging, and mentoring as part of the war game process, while a full debrief and post-exercise workshop should establish lessons learnt, capability gaps and the modifications required in technology and processes.

The ‘learning by doing’ opportunity that war games provide identifies failures in breach incident response as well as failures in security. This should ensure a balance between security and implementing the appropriate response, but also offer a list of immediate tactical priorities for remediation, as well as short-term changes. It can also pick up previously peripheral issues that had not been addressed or prioritised specifically because they may have been proven to be more critical to the overall security apparatus than previously recognised. Often these are ‘human’ aspects known to be weaknesses, though not recognised and addressed at an organisational level.

By establishing the right cyber attack war game framework, the learning objectives are set at the top of the agenda if the organisation is astute enough to accept that a breach will occur, and the success is measured by how it deals with this.

The iterative process of this type of workshop can offer a forum for planning that integrates investment, and priorities between prevention, defence, and a shared understanding of the converged nature of cyber risk. This pre-emptive approach to developing effective cyber defence and identifying causes of future failure identifies priorities for response training, and the development of a response doctrine that can provide an organisation with agility and options.

Conduct a cyber war game

At ESA Risk, we can design and run a cyber war game specific to your business. If you would like to learn more about cyber security, war games and/or building cyber resilience within your organisation, please contact us.

Graeme McGowan, Cyber Risk & Security Consultant at ESA Risk, reveals the biggest cyber security threat posed to businesses in the UK.

It’s the leading cause of reported data security breaches, according to the Information Commissioner’s Office (ICO), and arguably the largest enabler of malware infections and cyber attacks.

He also outlines ways the risks posed by this threat can be minimised.

What is the biggest cyber security threat?

While many people might expect the answer to be the latest malware in circulation or an organised group of hackers, the actual answer is more simple and closer to home…

Human error is arguably the largest enabler of cyber attacks and malware infections. Many people are not aware of the tell-tale signs or preventative measures to take when it comes to cyber security.

The ICO has reported human error as the leading cause of reported data breaches, highlighting a need to amend this. In turn, it is now handing out fines to organisations following data breaches, as a reverse incentive to push companies to educate their staff and thereby avoid potential breaches in future.

Businesses are not fined if they have a sufficient protocol in place guarding against human error, but small companies are being particularly hit hard because of gross negligence and a lack of staff training leading to employee mistakes.

A simple example:

Firm X sent out personal data in respect of an individual and their family via email and post. A lack of security meant that unconnected third parties, who had no way of knowing the sensitivity of the content of the post and emails, then unintentionally had access to the sensitive personal data. The unconnected third parties were accidentally included on the email and therefore received the data, most likely by the fault of the sender who seemingly did not check the recipient/s they were sending the email to.

A complaint was made by the individual concerned following the unauthorised disclosures and an investigation into the incident revealed that repeated human error was to blame for the breach, resulting in a £10,000 fine being handed to the firm.

Why was the fine so large?

The ICO has noted that the fine is reflective of the firm’s disappointing response to the complaint and its failure to engage appropriately or show an understanding of the impact of the breach on the individual. The lesson here is that, in itself, a breach of data protection rules will not automatically incur a penalty. However, inadequate safeguarding measures followed by a delayed or obstructive (or even just negligent) response to a breach may lead to investigation and subsequent fines from the ICO.

Human error will always be a risk, but the response to that error is what is important both in terms of limiting any sanctions and maintaining a positive relationship between a business and the individuals with whom it deals.

Where does the risk lie?

Lack of understanding or awareness may mean:

• A subject access request goes unanswered or is delayed.
• Misuse of personal data, e.g. it is used to contact individuals without consent.
• Personal data is used for purposes outside of the purpose for collection of that data.
• Personal data is inadvertently provided to unconnected parties.
• Delayed or no action following a security breach.
• Failure to update records or delete records.

All of the above would be breaches of the General Data Protection Regulation (GDPR) and may require immediate action or even reporting, depending on the circumstances.

How do we prevent or minimise the ‘human error factor’?

In three words: training, education and awareness.

Compliance with GDPR cannot rely just on software systems and one data protection manager.

All individuals within organisations from the cleaner to the CEO need to be aware of how data protection compliance impacts on their role and what their responsibilities might be. In a few cases, there may legitimately be none, but it is important for the knowledge to be there and for staff to be alert and aware of cyber security protocol.

In order to combat this risk and employee lack of awareness, training should be provided to staff at induction and at regular intervals, especially if their role and responsibilities change. It is also crucial that staff know what to do if an error occurs and a cyber security threat appears. Communication at the earliest point is key in handling a breach, so creating a culture of trust is critical.

Once the training and understanding is in place, investment in the technology to support good data protection procedures will enhance those procedures and allow easy management of the various tasks and obligations.

Cyber security services from ESA Risk

We’re here when you need us. We provide both passive and reactive support services, which are scalable and quick to deploy in crisis situations, giving you precious additional time at critical moments. Contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form to find out more.

Develop your cyber security knowledge with 1 of our cyber security courses, provided by the Global Cyber Academy.

Threats and risks continue to evolve as hackers come up with new ways to breach unsecured systems, posing a threat to the ecosystem itself. Let’s take a look at the leading threats and risks to the IoT and the associated vulnerabilities that must be secured.

What is the internet of things (IoT)?

The internet of things (IoT) is a network of intertwined devices, software, sensors and other ‘things’ which enable the world to be connected throughout physical space. This can include business software, smart home devices, care monitoring systems, mobile phones or driverless trucks, and can be as small as a thumb drive to the size of a train. All of these things communicate with each other without the need for human interaction. This web of connectivity is fascinating but poses serious danger to information security.

Exploring the IoT attack surface

A business’s attack surface is the sum of vulnerabilities that are currently present on their network, both physical and digital. This can be vulnerabilities from within their endpoint devices (computers, tablets) or from the software and hardware used to conduct business. While each device is typically protected through a security software, they are still apt to a series of added threats and vulnerabilities through their connection to the IoT. The Open Web Application Security Project (OWASP) provides a broad consensus of the current threats and vulnerabilities within the surfaces, condensed below.

IoT devices

Devices inevitably have vulnerabilities embedded within their memory systems, physical and web interface, network services, and firmware. This allows hackers to easily exploit systems within the devices’ outdated components and insecure default settings with update mechanisms. When managing vulnerabilities throughout your network’s devices, continuous monitoring is essential.

Communication channels

Attacks can originate from the channels that connect IoT devices. This presents serious threats to the security of the entire system and creates a potential for spoofing and denial of service attacks. These threats and attacks lay the foundation for an unstable network surface.

Applications and software

Each application and software presents risk, and many web applications and APIs do not protect sensitive data adequately. These data can be anything from financial intelligence to healthcare information. A breach of these types of information can result in identity theft, credit card fraud and exposure of confidential information, all because a web application isn’t properly secured or patched on a consistent basis.

7 IoT threats and vulnerabilities to be aware of

As long as the internet of things continues to expand, the number of threats will continue to increase. Being able to identify and understand the different types of threats and vulnerabilities associated with the IoT can significantly reduce the risk of a data breach at your organisation. Let’s explore the top IoT concerns:

1. Lack of physical hardening

The lack of physical hardening has always been a concern for devices within the internet of things. Since most IoT devices are remotely deployed, there is no way to properly secure devices that are constantly exposed to the broader physical attack surface. Devices without a secure location and the inability for continual surveillance allow potential attackers to gain valuable information about their network’s capabilities which can assist in future remote attacks or gaining control over the device. For example, hackers can facilitate the removal of a memory card to read its contents and access private data and information that may allow them to access other systems.

2. Insecure data storage and transfer

As more people utilise cloud-based communications and data storage, the cross-communication between smart devices and the IoT network increases. Any time data is transferred, received or stored through these networks, the potential for a breach or compromised data also increases. This is due to the lack of encryption and access controls before data is entered into the IoT ecosystem. For this reason, it is important to ensure the secure transfer and storage of data through robust network security management tools like firewalls and network access controls.

3. Lack of visibility and IoT device management

Many IoT devices remain unmonitored, untracked and improperly managed. As devices connect and disconnect from the IoT network, trying to monitor them can grow to be very difficult. Lack of device status visibility can prevent organisations from responding to, or even detecting, potential threats. These risks can become life-threatening when we look into the healthcare sector. IoT pacemakers and defibrillators have the potential to be tampered with, if not secured properly, and hackers can purposefully deplete batteries or administer incorrect pacing and shocks. Organisations need to implement device management systems to properly monitor internet of things (IoT) devices so all avenues for potential breaches are accounted for.

4. Botnets

Botnets are a series of internet-connected devices that are created to steal data, compromise networks or send spam. Botnets contain malware that allows the attacker to access an IoT device and its connection to infiltrate an organisation’s network, becoming one of the top threats for businesses. They are most prominent in appliances that were not initially manufactured securely (smart fridges, for example). These devices are continuously morphing and adapting. Therefore, monitoring their changes and threat practices is necessary to avoid attacks.

5. Weak passcodes

Although intricate passcodes can prove to be secure for most IoT devices, one weak passcode is all it takes to open the gateway to your organisation’s network. Inconsistent management of passcodes throughout the workplace enables hackers to compromise your entire business network. If just one employee does not adhere to advanced password management policies, the potential for a password-oriented attack increases. Practising good password hygiene is essential to ensure your business is covering all bases within standard security practices.

6. Insecure ecosystem interfaces

Application programming interfaces (APIs) are software intermediaries that allow 2 applications to talk to each other. With the connection of the 2 servers, APIs can introduce a new entrance for attackers to access a business’s IoT devices and breach a network’s router, web interface, server, etc. It is crucial to understand the intricacies and security policies of each device in the ecosystem before connecting them to ensure complete network security.

7. AI-based attacks

While AI attacks have been around since 2007, the threats they present within IoT are becoming increasingly more prominent. Hackers now can build AI-powered tools that are faster, easier to scale and more efficient than humans to carry out their attacks. This poses a serious threat within the IoT ecosystem. While the tactics and elements of traditional IoT threats presented by cyber attackers will look the same, the magnitude, automation and customisation of AI-powered attacks will make them increasingly hard to battle.

ESA Risk and IoT cyber security

For more advice on cyber security – including internet of things (IoT) cyber security – contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

For many, Black Friday 2021 marks the official start to the Christmas shopping season and, excitingly, many retailers announce time-limited sales that promise huge savings to consumers. But it’s also the prime time for cyber criminals to cash in, too.

Some digital threats to watch out for on Black Friday 2021

Phishing attacks

While consumers rush to grab themselves a bargain, they may get caught out in a phishing scandal. Phishing links commonly lead to fake login pages, prompting victims to authenticate themselves on their web account. For instance, victims may think they are logging into their favourite retailer account, when, really, they are handing their username and password over to an attacker, who can use it to their advantage later. Although this affects users directly, it also negatively impacts the retailer’s reputation, which can be difficult to recover.

Malware  

Malware (as the portmanteau suggests) refers to any malicious software designed to harm a computer system by tracking user activity, hijacking functionality or stealing, deleting or encrypting data. Most malware enters your systems via email (96% of it in 2020, say CSO). According to research by Deep Instinct, malware saw a year-on-year increase of 358% in 2020. There’s no indication of that proliferation slowing, so this should be seen as a high-risk Black Friday cyber threat.

Formjacking

Formjacking is a form of ‘Magecart’ where malicious code is injected into the checkout forms of a website and can go undetected for a long time. Cyber criminals then hijack web forms to steal personal and payment information from shoppers.

Ransomware  

Ransomware encrypts files, so they are made inaccessible to the owner. The cyber criminal then demands a ransom payment in return for releasing the locked files. Ransomware occurs when legitimate ads are hacked (‘malvertising’), or through phishing emails and exploit kits. This will have consequential impact on consumers and retailers/businesses.

Not being prepared enough for cyber threats is a threat

A staggering 3 in 4 IT leaders expressed a lack of confidence in their company’s IT security posture and saw room for improvement. Despite this, just 57% of companies conducted a data security risk assessment in 2020 and businesses need to up their cyber security efforts to reduce these risks and minimise the impact of an attack.

How can you reduce the risk of cyber threats on Black Friday 2021? 

The above attacks take place daily and are not specific to the holiday season or large events like Black Friday, but the volume and frequency of these attacks significantly increase during these times, as more consumers make purchases online.

Being aware of these threats is a step closer to preventing cyber attacks on Black Friday 2021 and during the holiday season to come. Businesses should balance their investments in security awareness training for employees and putting robust security measures in place that can help to scan their systems for suspicious activity. Similarly, consumers need to be better educated and made aware of potential threats.

If you find yourself the victim of a cyber incident, ESA Risk can help you with your response to the attack and to make you cyber-secure in the future, through the design and execution of a strong cyber security plan. Reach out to us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form to find out more.

 

Download: ESA Risk Special Report: The Cyber Threat Landscape 2022

However, increases in organisational mobility typically result in a higher number of mobile devices that are accessing your systems from a remote location. For your cyber security teams, this means a growing variety of endpoints and threats they need to secure to protect your organisation from a data breach.

Mobile malware has long been a common problem. As a result, businesses and individuals are usually aware of the potential threat and how to deal with it. However, as Verizon’s Mobile Security Index Report shows, new threats are constantly appearing and organisations need to consider these, as well, in order to ensure they’re protected.

Below are the most common and critical mobile security threats that organisations currently face.

4 different types of mobile phone security threats

Mobile phone security threats are commonly thought of as a single, all-encompassing threat. But, the truth is, there are 4 different types of threat that organisations need to take steps to protect themselves from:

Mobile application security threats

Application-based threats are present when people download apps that look legitimate but skim data from their device. Examples are spyware and malware that steal personal and business information without people realising it’s happening.

Web-based mobile security threats

Web-based threats are subtle and tend to go unnoticed. They happen when people visit affected sites that appear to be fine on the face of it, but automatically download malicious content onto devices.

Mobile network security threats

Network-based threats are especially common and risky because cyber criminals can steal unencrypted data while people use public Wi-Fi networks in places such as transport hubs and cafes.

Mobile device security threats

Physical threats to mobile phone security and other mobile devices most commonly refer to the loss or theft of a device. Because hackers have direct access to the hardware where private data is stored, this threat is especially dangerous to enterprises.

Mobile cyber security threat examples

Below are the most common examples of these threats, as well as steps organisations can take to protect themselves from them.

Social engineering

Social engineering attacks are when bad actors send fake emails (phishing attacks) or text messages (smishing attacks) to your employees in an effort to trick them into handing over private information like their passwords or downloading malware onto their devices. The best defence for phishing and other social engineering attacks is to teach employees how to spot phishing emails and SMS messages that look suspicious and avoid falling prey to them altogether.

Reducing the number of people who have access to sensitive data or systems can also help protect your organisation against social engineering attacks because it reduces the number of access points attackers have to gain access to critical systems or information.

Data leakage via malicious apps

Enterprises face a far greater threat from the millions of generally available apps on their employees’ devices than from mobile malware, because 85% of mobile apps today are largely unsecured.

Hackers can easily find an unprotected mobile app and use that to design larger attacks or steal data, digital wallets, backend details and other information directly from the app.

For example, when your employees visit Google Play or the App Store to download apps that look innocent enough, the apps ask for a list of permissions before people are allowed to download them. These permissions generally require access to files or folders on the mobile device, and most people just glance at the list of permissions and agree without reviewing them in detail.

However, this lack of scrutiny can leave devices and enterprises vulnerable. Even if the app works the way it’s supposed to, it still has the potential to mine corporate data and send it to a third party, such as a competitor, and expose sensitive product or business information.

The best way to protect your organisation against data leakage through malicious or unsecured applications is by using mobile application management (MAM) tools. These tools allow IT admins to manage corporate apps (wipe or control access permissions) on their employees’ devices without disrupting employees’ personal apps or data.

Unsecured public Wi-Fi

Public Wi-Fi networks are generally less secure than private networks because there’s no way to know who set the network up, how (or if) it’s secured with encryption, or who is currently accessing the network or monitoring it.

As more companies offer remote work options, the increasing number of public Wi-Fi networks your employees use to access your servers (e.g. from coffee shops or cafes) could present a risk to your organisation. Cyber criminals often set up Wi-Fi networks that look authentic (by ‘cloning’ them), but are actually a front to capture data that passes through their system (a ‘man in the middle’ attack).

The best way for you to protect your organisation against threats over public Wi-Fi networks is by requiring employees to use a VPN to access company systems or files. This will ensure that their session stays private and secure, even if they use a public network to access your systems.

End-to-end encryption gaps

An encryption gap is like a water pipe with a hole in it. While the point where the water enters the pipe (your users’ mobile devices) and the point where the water exits the pipe (your systems) might be secure, the hole in the middle lets bad actors access the water flow in between. Unencrypted public Wi-Fi networks are one of the most common examples of an encryption gap (and it’s why they’re a huge risk to organisations). Since the network isn’t secured, it leaves an opening in the connection for cyber criminals to access the information your employees are sharing between their devices and your systems.

However, Wi-Fi networks aren’t the only thing that pose a threat – any application or service that’s unencrypted could potentially provide cyber criminals with access to sensitive company information. For example, any unencrypted mobile messaging apps your employees use to discuss work information could present an access point for a bad actor.

For any sensitive work information, end-to-end encryption is a must. This includes ensuring any service providers you work with encrypt their services to prevent unauthorised access, as well as ensuring your users’ devices and your systems are encrypted, as well.

Internet of Things (IoT) devices

The types of digital device that access your organisation’s systems are branching out from laptops, mobile phones and tablets to include wearable tech (like the Apple Watch) and physical devices (like Google Home or Amazon’s Alexa). And since many of the latest IoT mobile devices have IP addresses, it means bad actors can use them to gain access to your organisation’s network over the internet, if those devices are connected to your systems.

Spyware

Spyware is used to survey or collect data and is most commonly installed on a mobile device when users click on a malicious advertisement or through scams that trick users into downloading it unintentionally. Whether your employees have an iOS or Android device, their devices are targets ripe for data mining with spyware, which could include your private corporate data, if that device is connected to your systems.

Dedicated mobile security apps can help your employees detect and eliminate spyware that might be installed on their devices and be used to access company data. Ensuring your employees keep their device operating systems (and applications) up to date also helps ensure that their devices and your data are protected against the latest spyware threats.

Poor password habits

The 20 most common passwords in 2020, according to NordPass.

Position	Password	Time to crack	Times exposed
1	123456	Less than a second	23,597,311
2	123456789	Less than a second	7,870,694
3	picture1 (new entry on 2020’s list)	3 hours	11,190
4	password	Less than a second	3,759,315
5	12345678	Less than a second	2,944,615
6	111111	Less than a second	3,124,368
7	123123	Less than a second	2,238,694
8	12345	Less than a second	2,389,787
9	1234567890	Less than a second	2,264,884
10	senha (new entry)	10 seconds	8,213
11	1234567	Less than a second	2,516,606
12	qwerty	Less than a second	3,946,737
13	abc123	Less than a second	2,877,689
14	Million 2 (new entry)	3 hours	162,609
15	000000	Less than a second	1,959,780
16	1234	Less than a second	1,296,186
17	iloveyou	Less than a second	1,645,337
18	aaron431 (new entry)	3 hours	30,576
19	password1	Less than a second	2,418,984
20	qqww1122 (new entry)	52 minutes	122,481

There’s not much more to say on this topic. These bad password habits present a threat to organisations whose employees use their personal devices to access company systems. Since both personal and work accounts are often accessible from the same device with the same password, it simplifies the work a bad actor has to do in order to breach your systems.

If you use any of the passwords in this list, I strongly suggest you change them now.

Lost or stolen mobile devices

Lost and stolen devices aren’t a new threat for organisations. But with more people working from home or in public places like cafes or coffee shops and accessing your systems with a wider range of devices, lost and stolen devices pose a growing risk. First and foremost, you’ll want to ensure employees know what steps to take if they lose their device. Since most devices come with remote access to delete or transfer information, that should include asking employees to make sure those services are activated.

Out-of-date operating systems

Like other operating systems, mobile security requires continuous work to find and patch vulnerabilities that bad actors use to gain unauthorised access to your systems and data. Companies like Apple and Google address a lot of these vulnerabilities with operating system updates, so updating/patching is critical.

Cyber security support from ESA Risk

For advice and support to secure your business against cyber threats – including mobile phone security – look no further than ESA Risk. From staff training to software and process recommendations, we’ll work with you to meet your cyber security needs.

Contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.