STE WILLIAMS

You might not find these measurements on a standard cybersecurity department checklist. But they can help evaluate risks you haven’t even considered yet.

A regular audience with executive management and the board is part of the CISO role now. And security leaders know they need to bring measurable information to the conversation to explain and justify their performance and spending. Metrics are no longer optional in security management, and if risk leaders aren’t tracking elements such as mean time to detect and respond as well as attack frequency, they are leaving out a valuable aspect of a holistic security program.

But what else should we be measuring? Are there new, different, or emerging measurements that address other concerns?

Recently, we brought you the worst metrics used in security. This time, we’ve asked security professionals what they think are overlooked or newly emerging metrics that can help make the case for security in new ways. 

(Continued on next page)

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online. View Full Bio

Article source: https://www.darkreading.com/theedge/6-unique-infosec-metrics-cisos-should-track-in-2020/b/d-id/1336777?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The approach allowed researchers to use machine learning on encrypted data without first decrypting it.

Banco Bradesco, S.A., a prominent Brazilian financial institution, has for the past year been working with IBM Research to apply a technique called homomorphic encryption to banking data. The pilot showed it was possible to apply machine learning algorithms to encrypted data without decrypting it, creating a new level of privacy that could be applied to other industries.

Machine learning is often used in banking and finance to predict scenarios like transaction fraud or investment outcomes. This typically involves vast stores of data, much of which are sensitive but must be decrypted before processing, exposing sensitive data to exfiltration and leaks.

The idea behind homomorphic encryption (HE), now emerging in real-life applications like this one, is to keep data encrypted while it’s being processed. This type of cryptography was first proposed in the 1970s; it wasn’t until 2009 that IBM scientist Craig Gentry created the first fully homomorphic encryption system. HE is based on the mathematics of lattices and, researchers say, protects the confidentiality of data from complex attacks – even by quantum computers.

“In the past, we’ve used encryption for transmitting data,” says Flavio Bergamaschi, IBM researcher and lead author of this project. When you shop online and enter your credit card number, it’s encrypted to transfer but must be decrypted to do anything with it. The number is encrypted when stored on a disk, but it must be decrypted to act on it. 

Bergamaschi says HE protects information from what he calls the “honest but curious” threat model. An entity performing computation may be legitimate but at the same time curious about your information: When you ask a cloud service how long it takes to get to work, or where the nearest coffeeshop is, you reveal factors like where you are and where you’re going. The machine collecting this data can then create a graph of everyone whose data it holds.

With HE, these machines can perform computations while the data remains encrypted. As a result, the entity can act on data without gathering or storing any sensitive information. HE won’t prevent data breaches but will prevent data thieves from grabbing usable information. The technology has now reached an “inflection point” at which it’s ready for practical use.

During their pilot project with Banco Bradesco, the scientists’ goal was to look at an account holder’s banking activity over a window of time and using machine learning, predict with good accuracy whether that account holder would need a loan within the following three months.

The first step was to use HE to encrypt transaction data, as well as the machine learning-based prediction model. Financial analysts usually pinpoint factors in someone’s financial history to make these types of predictions, IBM explains in a blog post. Scientists showed they could make predictions using encrypted data with the same accuracy as with unencrypted data.

“Once we proved we could achieve the same level of accuracy, we looked at, ‘Can we now train or retrain the model using new transaction data that remains encrypted?'” says Bergamaschi of the process. “In doing so, we limited the chance of data exfiltration.” The team was able to train the model using encrypted data, demonstrating the use of HE to maintain data privacy and confidentiality while running algorithms on it.

Lessons Learned
The pilot, which ran from January through July 2019, taught a few key lessons. “It’s been very educational in the sense that we had to work with many groups that have different levels of understanding of the privacy, security, and mathematics behind everything,” Bergamaschi says. “Being able to interact with all of them, and trying to make all the mathematics and cryptography consumable, was interesting.”

Scientists also had to consider every aspect of their workflow and how to protect data in different scenarios. Being able to manage encryption keys was one; another was ensuring secure environments when the researchers had results and wanted to decrypt them.

Banking isn’t the only industry where HE can be applied. “There are a plethora of use cases that we are just scratching the surface of,” Bergamaschi adds. Industries like government and healthcare, where data privacy is a top priority, could benefit from the use of HE. IBM Research will continue working with Banco Bradesco to apply HE on financial data, he says.

We may not know the extent of where and how HE can be used. “Imagine what you could do that you don’t do today, if you could do the computation on encrypted data,” Bergamaschi adds. Many of business activities require information sharing, but the sharing of information is only done on a need-to-know basis. “There are many things we don’t do because we are not prepared to share the information in its raw format,” he says.

Related Content:

• 6 Unique InfoSec Metrics CISOs Should Track in 2020
• Assessing Cybersecurity Risk in Today’s Enterprise
• 7 Free Tools for Better Visibility Into Your Network
• Rethinking Enterprise Data Defense

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “In App Development, Does No-Code Mean No Security?“

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/major-brazilian-bank-tests-homomorphic-encryption-on-financial-data/d/d-id/1336779?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Tinfoil Security’s dynamic application and API security testing capabilities will be added to Synopsys Software Integrity Group.

Software security testing firm Synopsys has acquired Tinfoil Security in a deal aimed at increasing its dynamic application security testing (DAST) capabilities, the company announced today.

In addition to providing additional capabilities to test dynamic applications, Tinfoil Security brings API testing to Synopsys. All of the capabilities of Tinfoil Security will become part of the Synopsys Software Integrity Group and its suite of automated testing applications.

Synopsys announced that the acquisition of Tinfoil Security is not material to Synopsys financials, and details of the deal are not being publicly disclosed.

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “In App Development, Does No-Code Mean No Security?“

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/synopsys-buys-tinfoil/d/d-id/1336781?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Right at the end of 2019, we wrote about the “decade-ending Y2K bug that wasn’t” in a serious article with a humorous side.

In that article, we described a perennial “gotcha” facing Java programmers faced with the simple task of printing out the year.

If you tell Java to treat the date as four digits by using the abbreviation YYYY, which is a very common way of denoting the year in all sorts of other apps, you will get the right answer most of the time…

…but in some years, the answer comes out exactly one year off for just a few days at the start or the end of the calendar year.

Memories of the Y2K bug!

Y2K, or the millennium bug, was where programs that tried to save memory by storing dates as “99” instead of “1999” got confused at the end of 1999, because the sum 99+1 rolls back to 00 when you only have two digits to play with.

But it turns out that the Java bug that people were comparing to Y2K was a completely different beast.

The bug in the Java case is that Java’s shorthand to denote the current year in four digits is yyyy, and not YYYY – it really matters whether you use capital letters or not.

Confusingly, and for many people, surprisingly, the text YYYY in a Java program denotes the year in which at least half of the current week lies, as used for things like payroll and weekly accounts.

So if there are an odd few days at the start or end of a year, they’re transferred to the previous or following year when you count in weeks to do your accounts.

Phew.

Because, when you think about it, the idea of a Y2K-style bug resurfacing at the end of 2019 seems pretty unlikely.

Programs that only used two digits for the year instead of four would surely have been found out on New Year’s Day 2000, and would have been off by 100 years ever since, and would therefore quickly have been patched or replaced?

Perhaps not.

Because one way to patch the Y2K problem was to move it, rather than actually to fix it.

In other words, instead of reworking your program so it could correctly calculate that 1999+1 = 2000 (and so on for any four-digit year), you could take a shortcut and just tell your program to treat the 00 as AD 2000, instead of AD 1900, thus giving you an extra year to deal with the problem properly.

There was a downside there, namely that you no longer had any way of denoting the year 1900, but that was often much less of a problem than not being able to recognise 2000 – you accepted the risk of very occasional bugs that might never show up, instead of facing certain disaster at the stroke of midnight on New Year’s Day in Y2K.

Of course, this trick could be used to give you more than one extra year – at the end of 2000, for example, if you still hadn’t managed to fix your software with four-digit years, you could push the cutover point to the end of 2001 instead – you’d lose 1900 and 1901 but gain 2000 and 2001 instead.

You can guess where this is going, namely that what works for one or two years can work for 10 years…

…or for 20 years.

The Y2.02K bug?

We’ve seen numerous stories in the media recently alleging that various computer systems around the world seem to have done just that, effectively putting Y2K off until 2020 by deferring the flipover point until 2019-12-31.

A notable case is that of parking meters in New York, where, according to the New York City’s Department of Transport:

[T]he credit card payment system software was configured to end on January 1, 2020, and officials say […] the company that makes the meters, never changed the date. Card payments stopped working last Thursday, January 2, 2020.

Behold – a Y2.02K bug!

Actually, we don’t know whether this was a bug of the Y2K sort, or just an operational issue with a different cause.

After all, if the devices suffered a 100-year calculation error at the transition from 2019 to 2020, then you might reasonably expect the system to have failed on New Year’s Day, rather than on the second day of the month.

But the moral of the story is simple, and it goes well beyond just getting the year right.

If there’s any sort of this-stops-working-abruptly-for-some-reason setting in your software – and there are many good reasons for building one in, whether it’s to force the retirement of long-superseded code, or to comply with regulatory terms, or for some other purpose – then don’t let it take you by surprise.

One last thing

By the way, Windows 7 support, including the publication of security updates and patches, ends next week after 2020-01-14.

Don’t let it take you by surprise!

Although Windows 7 won’t abruptly stop working, there are probably many IT managers and staff who secretly wish it would.

That would at least bring all those unknown and unreported Windows 7 computers out of the shadows and turn them into the devil you know, rather that the devil you don’t…

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/FNT2KPwUrzM/

A Londoner who hacked the National Lottery using Sentry MBA and made off with just £5 will spend up to nine months in prison for his crimes.

Anwar Batson, 29, of Lancaster Road in London’s Notting Hill, was part of a group of miscreants who hacked into the National Lottery website in 2016.

Batson, Crown prosecutor Suki Dhadda told Southwark Crown Court this morning, downloaded Sentry MBA and joined a chat group discussing and swapping configuration files for the software.

The Londoner, a father of one, “counselled others on how to hack” and “enabled them to successfully use Sentry MBA to hack others’ accounts,” said Dhadda.

A brute-forcing tool, Sentry MBA relies on website-specific configuration files to automate the testing of user credentials gathered, or stolen, from elsewhere.

Anwar Batson

Using the chat handle “Rosegold”, Batson discussed with others, including Idris Akinwunmi and Daniel Thompson, the details of those config files and how to deploy Sentry MBA against the Lottery website. Akinwunmi was caught after police traced one of the IP addresses used in attacks against the website back to Aston University, where he was quickly identified.

Under interrogation and after examination of his computers yielded chat logs, Akinwunmi said he had learned how to use Sentry MBA from “Rosegold”.

Received £5 from fellow hacker

“He could follow the instructions of Rosegold and agreed to split the proceeds with Rosegold,” Dhadda told His Honour Judge Jeffrey Pegden QC. Defending Batson, barrister Daniel Kersh added: “They made an arrangement. Mr Batson would send him the Sentry MBA and that whatever Mr Akinwunmi did with it, he would get a cut. That in essence was his involvement.”

So it was that Dr Ian Bentley, a National Lottery player, suffered the loss of £13 from his account – its entire contents. Akinwunmi sent £5 of the stolen sum to Batson via the bank account of an intermediary, named in court as Edwin Salter.

On 10 May 2017, Batson was arrested at his Notting Hill home. Initially he denied he had anything to do with the National Lottery hacks, claiming he “was the victim of online trolling” and that his devices “had been trolled or hacked and other people had access to his laptop.” He eventually pleaded guilty in December, having not been asked to enter a plea at his first hearing before Westminster Magistrates’ Court.

Searches of his devices, including two memory sticks, revealed a copy of the same chat that investigators found on Akinwunmi’s machines as well as evidence that Batson had accessed Dr Bentley’s account using Sentry MBA.

Mitigating his client’s crimes, Kersh took the judge to a character reference given to the court by Batson’s employer. Peering at it as the barrister spoke about his client’s past, HHJ Pegden asked: “Has he told his employer about these proceedings? In the last paragraph, seems to be a reference for him applying for some position: ‘I would recommend Anwar Batson to whatever position he might be applying for.’ Doesn’t seem addressed to the court.”

Kersh turned to Batson, locked in the glass-walled dock, who nodded. “He has told his employer,” confirmed the barrister.

A statement from lottery operator Camelot’s CISO David Boda, which was read to the court, said the lottery operator had spent £230,000 responding to the hacks, saying that 250 customers had closed their accounts as a result of post-hack publicity – and also counting £40,000 for a staff training event that had to be postponed so all hands were available to stave off the hacks. Security staff spotted a large number of IP addresses accessing user accounts, the first indication that Batson, Akinwunmi and others were at their illicit work.

Targeted a charity

Passing sentence, HHJ Pegden said: “In my view the gravity of your offending does not lie in the loss occasioned by the hacking and by the fraud. That indeed was low. But it does lie in the fact that you targeted a large charitable organisation, namely the National Lottery, which gives something like £30m per week to chosen charities.”

The judge continued:

You pleaded guilty to the four computer misuse act offences on the 10th December of last year at the plea and trial preparation hearing. There had been no indication of any guilty pleas beforehand. Indeed, when you were questioned by police you denied any involvement in these offences… In my judgment the aggravating and mitigating factors in fact cancel each other out. Therefore the correct sentence before credit for pleas is one of 12 months’ custody.

Kersh, defending Batson, had described how the hacker’s mother had died at the age of 45, six months before his crimes, while his grandmother had also died not long afterwards. Describing the aggravating and mitigating circumstances as cancelling each other out, but referring to Batson’s guily pleas, HHJ Pegden said: “The law is quite clear about this, the reduction should be and must be 25 per cent.”

Anwar Batson pleaded guilty to four counts under the Computer Misuse Act 1990 and a late count of fraud added at the start of his sentencing hearing. He was sentenced to nine months’ imprisonment concurrently on all counts. His laptop and two memory sticks, one of which contained a folder titled “Sentry MBA” with a “working and active” copy of the software were ordered to be forfeit and destroyed. He must pay £250 towards prosecution costs and repay £5 compensation to Dr Bentley, as well as the statutory victim surcharge tax.

Three other charges will lie on file.

Wearing a plain white shirt and blue jeans, and carrying a black holdall of goods for his prison sentence, Batson nodded as sentence was passed and walked down to the cells when dismissed by the judge. ®

Bootnote

In another Computer Misuse Act hacking case before Christmas, the guilty hacker, who deliberately tried to delete all accounts on airline Jet2’s Active Directory domain, was sentenced to 15 months – but will only serve five. ®

Updated at 15:19 GMT on 10 January 2020 to add

Lottery operator Camelot got in touch to say: “We take player protection very seriously. If we believe unlawful activity has taken place, we will not hesitate to report it to the appropriate enforcement body and assist it in any investigation. We’re pleased that this case dating back to 2016 has now come to a conclusion and welcome the sentence imposed.”

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/10/national_lottery_hacker_anwar_batson_jailed_5_pounds/

Despite ranking at the top of respondents’ concerns, organizations still show gaps in acting on cybersecurity, Society for Information Management (SIM) report finds.

Organizations obviously are aware of the need to address security and privacy needs, but many seem to be only moderately ready on this front. That is one of the takeaways from the Society for Information Management’s (SIM) recently released IT Issues and Trends Study for 2019. The results show what organizations and IT managers are concerned about, where they focus their attention, and some of the disparity in their interests.

The report gathered responses from 1,033 IT executives who hail from 618 organizations. On the surface, the results show unilateral concern for keeping data and infrastructure secure. A deeper look at the charts and tables shows, among other trends, some lethargy, according to Leon Kappelman, lead author of the report and professor of information systems at University of North Texas.

In a way, the report shows that organizations might be aware of a need but do not always act immediately. Historical results from the annual study show an evolution in focus among organizations. Cybersecurity moved from No. 9 in 2009 among organizations’ top ten most important IT management issues to No. 1 as of 2017 onward. Yet, the increased concern about security does not lead automatically to sweeping changes.

Read the full article here on InformationWeek.

 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/study-points-to-lax-focus-on-cybersecurity/d/d-id/1336757?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The carpentry maxim “measure twice, cut once” underscores the importance of timely, accurate, and regular metrics to inform security leaders’ risk decisions.

When designed appropriately and measured objectively, metrics are an indispensable part of a mature security program. Solid metrics can help an organization measure and track risk and performance as well as make educated adjustments and decisions as required. While most security professionals recognize and understand this, in practice, only a few organizations actually realize significant benefits from security metrics. There are many approaches to building an effective security metrics program. In this piece, I’d like to share some thoughts on a framework that has worked well for me.

Tip 1: Know your audience. Years ago, when I took a presentation seminar, I was given some very good advice: Know your audience. This advice applies to many areas, including metrics. The first step toward building a strong metrics framework is to understand who you’re building it for, even if there are multiple audiences. The metrics reported to the board and executives will be different than those you use to make operational improvements and tactical adjustments. The metrics provided to customers showing that their data is protected will be different than the metrics for security management to make well-informed decisions. A good metrics framework provides the right metrics to the appropriate audiences, even when there are multiple audiences.

Tip 2: Aggregate: One great way to provide the right metrics to the appropriate audiences is to aggregate strategically. Each tier is more detailed than the tier above it, and more granular metrics roll up into broader, more strategic metrics as you move up through the tiers. As an example, consider four tiers of aggregation that I have found helpful in building out a sound security metrics framework:

�œ Group: The highest-level aggregate is the group. Each group should be a broad area within security made up of different functional areas. Some examples of groups might include “Compliance,” “Vulnerability Management,” and “Security Monitoring,” among others.

�œ Area: The next-level aggregate is the area. Each area should be a specific function within security that contains one or more risks that need to be measured. Areas might be “Application Risk Assessment,” “Vendor Risk Assessment,” and “Training and Awareness,” among others.

�œ Key risk: The next level aggregate is the key risk. Each key risk should represent an area of concern and focus for the business where security is expected to measure, monitor, manage, and mitigate that specific risk. Each key risk should measure whether or not the organization has incurred an unacceptable risk. Within each key risk are one or more metrics that can help shine light onto whether or not controls are effective.

�œ Metric: The metric level is the lowest level — and, in fact, isn’t really an aggregate at all. Metrics should be as granular, scientific, and objective as possible, while allowing the security team to measure specific risks. Each metric should be mapped to a control and should help to measure whether or not the control is mitigating risk appropriately.

Tip 3: Map to controls. Ultimately, a good metric will help assess whether or not a control is effective at reducing risk. This has many benefits, including allowing the security organization to gain an understanding of where gaps may exist or where controls may need to be either designed or implemented differently. Of course, these benefits are only attainable when metrics are mapped to controls. It is a bit of a time investment to do so, though it is well worth it.

Tip 4: Designate acceptable values and objective ranges. If you’ve ever had your home or car inspected, you know that there are acceptable levels for radon in a home or emissions from a car. It isn’t black or white or on or off. There is a range of levels within which the home or car passes the test, and outside of which, it fails. The same should be true for metrics. Once you have a solid set of metrics, define acceptable values for those metrics together with ranges that define different levels of risk (for example, low/medium/high, green/amber/red, or any other set of groupings that suits your organization). That will allow you to more objectively calculate risk levels for each metric, different aggregates of metrics, and in total across the organization.

Tip 5: Measure and report regularly. The carpentry proverb, “measure twice, cut once” can help us understand the importance of timely, accurate, and regular metrics. Metrics should be living and dynamic, rather than snapshotted and static. Just as accurate measurements inform the carpenter’s cutting decisions, accurate security metrics inform the security leader’s risk decisions. It’s important to remember that the value of a given metric represents an accurate measurement only in the moment it is measured. Because of this, it’s important to measure frequently and report metrics regularly. This allows the security organization to trend over time, spot abnormalities early on, and prevent additional risk from entering the organization unnecessarily.

Related Content:

• Assessing Cybersecurity Risk in Today’s Enterprise
• Lessons Learned from 7 Big Breaches in 2019
• 5 Tips for Keeping Your Security Team on Target

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “In App Development, Does No-Code Mean No Security?“

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO – Emerging Technologies at FireEye and as Chief Security Officer for … View Full Bio

Article source: https://www.darkreading.com/risk/5-tips-on-how-to-build-a-strong-security-metrics-framework-/a/d-id/1336703?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The India-based call centers scammed US victims out of millions of dollars between 2013 and 2016.

Indian national Hitesh Madhubhai Patel has pleaded guilty for his role in operating and funding a network of India-based call centers through which local callers and US conspirators scammed US victims out of millions from 2013 to 2016, the Department of Justice reported this week.

Patel was extradited to the United States from Singapore in April 2019 to face charges for this crime. The indictment, unsealed in October 2016, charged Patel and 60 other individuals and entities with general conspiracy, wire fraud conspiracy, and money laundering conspiracy.

According to admissions made in his plea, Patel and co-conspirators developed a scheme in which employees of call centers in Ahmedabad, India, impersonated officials from the IRS and US Citizenship and Immigration Services (USCIS). They threatened to arrest, imprison, fine, or deport victims if they didn’t pay alleged fees owed to the government. Victims who fell for the scam were told how to pay, usually via general-purpose reloadable cards or wiring money.

Patel admitted to operating and funding several of these call centers, including the HGLOBAL call center. He communicated with co-conspirators via email and WhatsApp to exchange credit card numbers, telephone scam scripts, deposit slips, payment data, call center operations information and instructions, and bank account details. Scripts included impersonation of the IRS, USCIS, Canada Revenue Agency, and Australian Tax Office officials, as well as payday loan fraud, US government grant fraud, and debt collection fraud.

This week, Patel pleaded guilty to wire fraud conspiracy and general conspiracy to commit identification fraud, access device fraud, money laundering, and impersonation of a federal officer or employee. At the time of his April 3 sentencing, Patel faces up to 20 years in prison for wire fraud conspiracy and five years for general conspiracy. Both counts bring the possibility of a fine up to $250,000, or twice the gross gain or loss from his offense.

Read more details here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “In App Development, Does No-Code Mean No Security?“

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/indian-national-pleads-guilty-to-multimillion-dollar-call-center-scam/d/d-id/1336776?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

You guys are hosting a thriving marketplace for shills, charlatans and sockpuppets, the UK’s watchdog told Facebook and eBay in June 2019, after finding over 100 eBay listings selling fake reviews and 26 Facebook groups offering to buy or sell them.

We’re on it, the two platforms said in response to the poke from the Competition and Markets Authority (CMA). On Wednesday, the CMA announced that both tech behemoths have pledged to fight the trade in fake/misleading reviews and that they’ve both already made good on that pledge.

Specifically, Facebook has booted 188 groups and yanked 24 user accounts, while eBay has permanently banned 140 users.

Both of the US companies have also agreed to institute measures to help prevent faux reviews, or the buying/selling of them, from appearing in the future. For its part, Facebook says it plans to introduce more robust systems to detect and remove such content, while eBay says it’s beefed up its existing filters to better identify and block listings for the sale or trade of bunk.

What’s up next: Instagram fluff.

The CMA says that after sussing out Facebook and eBay fake reviews, the watchdog went on to discover a trade in bogusness on Instagram. Parent company Facebook has committed to looking into the issue, and the CMA says it will be looking for a commitment from Facebook to do something about these things as they arise in the future.

On Wednesday, the CMA reiterated what it said in June: that it doesn’t think the companies are intentionally letting the content appear on their platforms. It’s also mighty pleased that they’re taking this seriously.

Here’s a statement from Andrea Coscelli, chief executive of CMA:

Fake reviews are really damaging to shoppers and businesses alike. Millions of people base their shopping decisions on reviews, and if these are misleading or untrue, then shoppers could end up being misled into buying something that isn’t right for them – leaving businesses who play by the rules missing out.

We’re pleased that Facebook and eBay are doing the right thing by committing to tackle this problem and helping to keep their sites free from posts selling fake reviews.

Oh, and by the way? You better strap on your seatbelts, review sites: part of the CMA’s task at hand is to suss you out, too.

That will surprise absolutely nobody, given the exasperation that’s been expressed over say, TripAdvisor, for one. Remember the #noreceiptnoreview campaign from 2015? The one where people asked the mega-popular review site to insist on screenshots of receipts before approving new reviews?

That campaign was started by a restauranteur. Sure, people care about reviews, but businesses live or die on them. There have been a bunch of studies looking at how big a difference those little stars can make: According to one from Harvard Business School, a one-point improvement in a restaurant’s score on Yelp could boost its revenue by as much as 5-9%… while a one-star decrease could lead to a 5% revenue sag.

How to sniff out BS, shills, sockpuppets and charlatans

Hyperventilating, marketing-speak, multiple copy-paste reviews that are all exactly the same: those are only some of a long list of “this is dross!” give-aways. Here are a few actual reviews spotted in the wild and posted by Consumerist on its dated-but-still-useful list of 30 telltale signs:

Guacamole like my grandmother in Mexico used to make! Sure it was a little pricey, but worth every penny due to the large portion sizes and excellent service!

I had so much fun at happy hour, so many beautiful ladies! Spilled my margarita all over my shirt, and a gorgeous bartender dabbed it up for me and gave me a fresh one, on the house. I’m going back next week to see her again!

So positive! So detailed! So written by the same email address, one right after another, along with 10-12 others, as revealed by a site glitch!

As we’ve said before, watch out for extreme language, excess jargon straight out of a marketing or technical manual, or lack of detail about exactly why something’s uber fabulous or ultra lame. Also, if you’re looking for a hotel, in particular, you can run reviews through Review Skeptic: it’s an analyzer based on Cornell University research that uses machine learning to identify fake hotel reviews with nearly 90% accuracy.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/7xU4phR6tX8/

We’ve got some bad ransomware news, and we’ve got some good, cyberattack-THWARTED! news.

First, the bad: over the holiday break, crooks who are so morally bankrupt that they target the organizations that serve children pounced on schools in the US city of Pittsburg, California.

On Monday, the superintendent of Pittsburg Unified School District, Janet Schulze, put up a message about the ransomware attack on the district’s Facebook page.

She said that any and all affected and potentially affected servers had been taken offline, leaving the district’s school system without email or internet access. Phones were working, though, and the plan was to forge ahead and open school on Tuesday.

Twenty-eight minutes later, Schulze put up an update, saying that the show would indeed go on, but old-school style: sans laptops, sans internet.

We are all set for school tomorrow! We will be teaching and learning like ‘back in the day’🙂…without laptops and internet. Our schools have access to student information and our phones are working. We still are not able to receive email, so please call your child’s school if needed.

As of Monday, the district was working with two external IT firms and attorneys who, Schulze said, are all specialists in this kind of e-misery. She also said that the district had notified law enforcement and that the investigation and repair work were still underway.

The cybersecurity teams that are helping the school system to get back on its feet hadn’t detected any compromise of personal data as of Monday.

Cut off from the internet and email, the district’s secondary schools were given an extension – until Monday 13 January – to enter first-semester grades into the grading system. A slice of good news: the cafeteria wasn’t affected and could therefore be counted on to dish up meals for the hungry students.

Schulze didn’t give any indication as to what ransom the crooks are demanding, nor whether or not the district plans to fork anything over.

Should Pittsburg pay? That’s the burning question for scads of government agencies that are under siege these days. But there’s one thing to keep in mind when mulling the pay/don’t pay question: paying the ransom guarantees nothing.

According to one study, more than 17% of organizations that chose to pay a ransom never regained access to their encrypted data or infected systems.

We wish Pittsburg’s schools the best of luck when it comes to pulling out of the attackers’ clutches without paying them.

So that’s the story with Pittsburg. To counterbalance those woes, here’s a dose of good news: on Tuesday, Las Vegas avoided – by the skin of its teeth – a cyberattack that it says could have been “devastating.”

Were the odds in the city’s favor?

On Tuesday, the city said that it had been hit by what it referred to only as a “cyber compromise” in the early morning. As soon as its IT staff became aware that something was up, they leapt to protect the data systems. It’s an impressive response, particularly considering that the attack came in the wee hours, around 4:30 a.m.

We experienced a cyber compromise at 4:30 a.m. Tuesday. Our IT team is assessing the extent of the compromise. When… twitter.com/i/web/status/1…

—
City of Las Vegas (@CityOfLasVegas) January 08, 2020

The city responded by taking several services offline, including its public website. The site was back up as of Wednesday, when the city confirmed that it had “resumed full operations with all data systems functioning as normal.”

Kudos, IT staff!

Following yesterday’s cyber compromise, we have resumed full operations with all data systems functioning as normal… twitter.com/i/web/status/1…

—
City of Las Vegas (@CityOfLasVegas) January 08, 2020

It doesn’t look like any data was lost, nor had any personal data been compromised, Las Vegas City said. City officials don’t know who was behind the attack, but they’ll keep looking:

We do not believe any data was lost from our systems and no personal data was taken. We are unclear as to who was… twitter.com/i/web/status/1…

—
City of Las Vegas (@CityOfLasVegas) January 08, 2020

Las Vegas City spokesman David Riggleman told the Las Vegas Review-Journal that attacks on several other cities in recent years have made city officials particularly vigilant.

As it is, Riggleman said, the city’s network systems get bombarded with an average of two million emails every month – about 279,000 of which are attempts to breach its systems.

[There are] a lot of people out there […] trying to open that cyber door.

Were the odds in Las Vegas’s favor? Did it just get lucky? Or did its IT staff have some special sauce that repels attackers and helps it win at the ransomware/cyberattack roulette wheel?

We don’t know. But there are certainly some things you can do to…

Protect yourself from ransomware

• Pick strong passwords. And don’t re-use passwords, ever.
• Make regular backups. They could be your last line of defense against a six-figure ransom demand. Be sure to keep them offsite where attackers can’t find them.
• Patch early, patch often. Ransomware like WannaCry and NotPetya relied on unpatched vulnerabilities to spread around the globe.
• Lock down RDP. Criminal gangs exploit weak RDP credentials to launch targeted ransomware attacks. Turn off Remote Desktop Protocol (RDP) if you don’t need it, and use rate limiting, two-factor authentication (2FA) or a virtual private network (VPN) if you do.
• Use anti-ransomware protection. Sophos Intercept X and XG Firewall are designed to work hand in hand to combat ransomware and its effects. Individuals can protect themselves with Sophos Home.

For information about how targeted ransomware attacks work and how to defeat them, check out the SophosLabs 2019 Threat Report.

For more advice, please check out our END OF RANSOMWARE page.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ZYdKmx-4lMo/