STE WILLIAMS

Italian firm appears to have developed spyware for lawful intercept purposes, Lookout says.

Researchers at mobile security firm Lookout have discovered iOS versions of a spyware tool that an Italian video surveillance company appears to have designed for so-called lawful intercept purposes by governments.

Non-profit white hat hacker collective Security Without Borders last month had reported discovering several Android versions of the same malware uploaded to Play Store, Google’s official mobile app store.

Google removed those apps—which were disguised as service apps from Italian mobile operators—after the company was notified of the problem. Security Without Borders has estimated the total number of infections to be in the high hundreds to potentially one thousand or more.

The iOS version of Exodus, as the malware is called, can steal a range of data from infected systems. Examples include contact information, audio recordings, photos, videos, GPS location information and any other data that can be accessed via an infected device’s iOS APIs, says Christoph Hebeisen, senior manager of security intelligence at Lookout. The malware is also capable of doing remote audio recording.

Even so, the iOS versions are not as sophisticated as the Android malware he says. “The iOS version can only exfiltrate a limited set of data as it is limited to data it can access via iOS APIs,” Hebeisen says. “In contrast, the Android version has full root access to the device.” So it is capable of accessing and exfiltrating screen shots, text messages, browser histories, call logs, data from third-party messaging apps such as WhatsApp and Telegram and other data as well. Exodus for Android is also designed to keep running even when the screen is switched off.

Both Security Without Borders and Lookout believe the software is the work of eSurv, an Italian firm ostensibly focused on video surveillance software and image recognition systems. According to Security Without Borders, eSurv has been developing the spyware since at least 2016.

Several aspects of eSurv’s operations suggest the company is well funded and has designed the software for use by law enforcement and other entities to conduct offensive surveillance on people, according to Lookout. Tell-tale signs include the use of certificate pinning and public key encryption for command-and-control purposes and the use of geo-restrictions to ensure the malware is used only in specific geographies.

This is the second instance in the past 18 months where an Italian software firm has been caught quietly distributing surveillance software.

In January 2018, security vendor Kaspersky Lab reported on another Italian firm using spoofed web pages to distribute “Skygofree,” an extremely sophisticated Android spying tool. Kasperksy Lab described the malware as a data-stealer capable of supporting up to 48 different remote commands and controllable via SMS messages, HTTP, and FireBaseCloudMessaging Services. Like Exodus, Skygofree too had a feature that allowed the app to keep running even when other apps are suspended—or put into battery-saving mode.

The iOS version of Exodus is being distributed via phishing sites. To make that possible, the operators of the spyware appear to have abused Apple’s Developer Enterprise Program, a provisioning mechanism that allows enterprises to distribute proprietary in-house iOS apps to employees without having to use Apple’s mobile app store.

“Apple’s Enterprise Developer program is not involved in the download,” Hebeisen notes. “eSurv was approved for the Apple Developer Enterprise program, which allowed them to sign the apps with a legitimate-looking enterprise certificate,” he notes. Apple has since revoked the certificates that eSurv was using to digitally sign its software.

There is no indication that eSurv ever attempted to upload the signed iOS malware to Apple’s app store. Instead they hosted the spyware on phishing sites that were designed to appear as mobile carrier sites. Hebeisen says Lookout is presently unsure what lures eSurv is using to direct victims to the phishing websites.

Exodus for iOS executes when a user downloads and launches the app. The malware sets up multiple timers for gathering and uploading specific data on a periodic basis. The data is then queued and transferred to the command-and-control server. The C2 infrastructure that eSurv is using for the iOS version of Exodus is the same as the one being used for the Android version.

Lookout says it does not know potentially how many iOS users might have downloaded Exodus on their systems. All of the telemetry that Lookout has gathered shows the attacks are focused purely on Italian IP addresses. So, the risk to US users is negligible, Hebeisen says.

It’s unclear whether eSurv was collecting, or planning to collect mobile data, on any entity’s behalf. But there are several companies vying for market share in what some say is a growing market for lawful intercept tools. A recent report from Allied Market Research estimated demand for such tools from governments and law enforcement agencies to top $3.3 billion by 2022. New rules and standards by governments seeking to fight technology-enabled crime are driving a lot of the demand, Allied Market Research said.

Related Content:

• Kaspersky Lab Warns of Extremely Sophisticated Android Spyware Tool
• What Can We Learn from Counterterrorism and National Security Efforts?
• Whose Line Is It? When Voice Phishing Attacks Get Sneaky
• 2019 Attacker Playbook

 

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/exodus-ios-surveillance-software-masqueraded-as-legit-apps/d/d-id/1334370?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The Series B investment supports a company bringing risk assessment to businesses in business terms.

Risk is having a moment, and RiskLens, a company that quantifies risk according to the Factor Analysis of Informational Risk (FAIR) model, is showing that moment’s currency with a $20 million round of Series B funding announced today.

“[Investors] see boards of large companies in North America, but now beyond that, internationally as well, asking the same kind of questions, such as, ‘How much risk do we have related to cyberattacks?’ and, ‘Are we spending too much or too little to deal with the cybersecurity issues?'” says Nick Sanna, CEO of RiskLens.

To answer those questions, boards are seeking to understand risk assessment in language different than that used by most security and risk professionals, Sanna says.

“Board members are getting answers in terms of 20 red, 15 yellow, and a bunch of green, or they’re getting scores like a credit score, but what they want is how much risk we have in dollars and cents,” he says.

Many security professionals still aren’t discussing risk “in a quantitative, real-dollar point of view,” adds Bob Maley, CSO of NormShield, a company that assesses third-party risk. “What they do is take a qualitative view and assign dollars to big buckets to try to give an impression that they’re talking in real financial terms.”

These days companies are placing cyber-risk in context with all the risks they face, Sanna says. “At the corporate level, they’re looking at cyber as probably one of the major risks alongside other forms of operational risks, including weather, market risk, or credit risk categories,” he says.

The difference between cyber-risk and those other categories is how they’re assessed. Companies have traditionally “delegated the measurement and reporting on that risk to the cybersecurity function because they feel that this is a very technical discipline that a typical risk team is not equipped to assess,” Sanna explains.

This measurement of risk is both being driven by, and running ahead of, the cyber insurance industry, Sanna says. “While the insurance industry is doing a great job in raising the awareness of the need to consider some insurance, they have not equipped themselves yet with the means to assess cyber-risk in detail so that the buyers can buy the right product,” he says.

Risk assessment and reporting is moving forward, and moving quickly, Sanna believes. “An assessment of cyber-risk in financial terms is becoming the norm,” he says. “You can finally measure it in a way that makes sense of the business, and you can make good decisions.”

Related Content:

• The Matrix at 20: A Metaphor for Today’s Cybersecurity Challenges
• Airports Operational Technology: 4 Attack Scenarios
• In the Race Toward Mobile Banking, Don’t Forget Risk Management
• 6 Ways Effective CISOs Are Changing their Role
• Everything I Needed to Know About Third-Party Risk Management, I Learned from Meet the Parents

 

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/risk-management/$20-million-investment-round-shows-growth-of-risk-assessment-market/d/d-id/1334372?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A new inquiry aims to determine whether contracts between Microsoft and EU organizations violate GDPR.

An investigation by the European Union’s Data Protection Supervisor (EDPS) is analyzing Microsoft contracts with EU organizations following a discovery by the Dutch government that found Microsoft software violated the General Data Protection Regulation (GDPR).

The EDPS is an authority charged with monitoring EU institutions’ compliance with data protection rules. In December, new outsourcing guidelines gave contractors direct responsibility for ensuring compliance. If an organization uses a third party to provide services, it’s liable for data processing done on its behalf and must ensure its contracts abide by the new rules.

Microsoft products are under EDPS investigation following a Dutch government report that expressed concern about data collection in Microsoft Office ProPlus, which contains popular software like Word and Outlook. It claims to have found eight GDPR violations in Office ProPlus and Office 365. EDPS plans to look into which Microsoft tools and services are in use among EU institutions and whether their Microsoft contracts comply with the newest GDPR changes.

“Any EU institutions using the Microsoft applications investigated in this report are likely to face similar issues to those encountered by national public authorities, including increased risks to the rights and freedoms of individuals,” the EDPS explained in a press release on the news.

It’s worth noting that Microsoft responded to the Dutch government’s concerns earlier this year, when it announced plans to introduce changes to ProPlus by the end of April 2019.

Read more details here.

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/risk/microsoft-products-under-eu-investigation-about-data-collection/d/d-id/1334367?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Small business face the same security challenges as large enterprises but with much smaller security teams. Here are 8 things to do to get the most from yours.

Big cybersecurity challenges aren’t limited to large organizations. Small and medium-sized organizations are subject to the same vulnerabilities, exploits, and attacks that plague multi-national enterprises. Unfortunately, these smaller organizations don’t have the same resources as the big companies to use to defend themselves. That’s why it’s critical that small organizations make the most of the cybersecurity resources they do have.

Constraints on small business security resources aren’t limited to finances. Small organizations also have smaller security teams or, in most cases, a team of IT generalists who deal with security as part of their responsibilities. And while technology can be part of maximizing that small team’s effectiveness, technology alone can’t turn a small team of generalists into a large team of specialists.

That doesn’t mean that the small business situation is hopeless. When technology is deployed in support of well-considered policies developed through a thoughtful process, then small businesses can achieve a practical level of security that is as effective as that of larger organizations. The question, then, is which processes and policies will have the greatest impact.

[Want to see how other small IT teams have handled their security challenges? Check out sessions like “No CISO, No SOC, No Problem: Blocking Bigger Threats with Smaller Teams” and “When (and When Not) to Use a Managed Security Service Provider” at Interop19 in Las Vegas, May 20-23.] 

The eight steps listed here aren’t meant to be taken one at a time like steps on a path. The first is a good place to start but after that they represent things that a small team should do — and can do — to get the most out of the security resources they have to work with. And these steps aren’t meant to be an exhaustive list of things to be done. We’d be interested to know which things you’ve found critical aren’t on our list — and whether there are any items on this list that you think are over-rated. Let us know in the comment section.

(Image: duncanandison VIA Adobe Stock)

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/8-steps-to-more-effective-small-business-security/d/d-id/1334361?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Somebody stuck their arm into the back of their backup cupboard, rummaged around, and dragged out a small (but perhaps important to someone) fraction of the 50 million Myspace songs that the social platform admitted to losing in a server migration.

The Internet Archive has published those retrieved tunes and put them up in a catalog of 490,000 mp3 files.

The source of the collection, it said, is an “anonymous academic study,” conducted between 2008 and 2010, that was analyzing music networks while Myspace was still active. During the research, those participating in the study downloaded 1.3 terabytes of music from the service. When the news of Myspace’s mega-fumble came to light, the researchers contacted the Internet Archive and offered to send over the files.

The rediscovered songs represent no more than 1% of the songs/videos that Myspace lost.

ANNOUNCING THE MYSPACE MUSIC DRAGON HOARD, a 450,000 song collection of mp3s from 2008-2010 on MySpace, gathered be… twitter.com/i/web/status/1…

—
Jason Scott (@textfiles) April 04, 2019

You can play the dusted-off music through an online interface that’s been designed to look like Myspace’s original player. Searching and playing is a bit unwieldy, but the Internet Archive says that the database’s search and playing mechanism, “Hobbit,” is still being optimized and will eventually be open-sourced.

Myspace and its “issue”

Myspace said, in February 2018, that there had been “an issue” with all songs/videos uploaded more than three years prior. Hang tight, should be a fix on the way, support said, though they weren’t exactly sure when that would be. Sorry for the inconvenience!

Then, 13 months later, Myspace said that the arrival date of the fix would be “never.”

As a result of a server migration project, any photos, videos, and audio files you uploaded more than three years ago may no longer be available on or from Myspace. We apologize for the inconvenience and suggest that you retain your back up copies.

We should retain our backup copies? How about you should make backups before you do a server migration, Myspace?!

Having said that, yes, fine, fine, we all should make and retain backups.

We should use dental floss, we should cover our mouths when we cough, we should always retain backups, and we should remember that when we store our stuff on the cloud, we’re storing it on other people’s computers, and it’s only as safe as they choose to make it.

If you care about your music, or any of your other digital stuff, we strongly recommend keeping your own backups: backups that are offline and out of the reach of hackers, ransomware, search engines and other network goblins. Encrypt your backup files, too, in case they get stolen.

The last line of defense when you practice defense in depth is your backups. So turn up the tunes, back up your files, and DANCE!

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/vNg96f0_geY/

Mozilla doesn’t yet know how to solve the problem of website push notification spam in the Firefox browser, but it wants you to know it’s working on it.

If you’re a sentient web user, the push notification phenomenon needs little explanation: visit a site and it almost immediately throws up a prompt that asks you whether you’re happy to “allow notifications.”

Unlike other annoying website pop-ups, push permissions are powerful because they can activate even when users are not on that website.

In extreme examples, they’re deployed by scam sites as a way of pushing fake extensions and rogue sites, unleashing today’s equivalent of the endless adware pop-ups that used to swarm browsers.

Push notifications have become so ubiquitous that Mozilla’s own telemetry suggests they are now by some distance the most frequently shown permission request, generating 18 million of them in the month to 25 January for a sample set of its users.

Only 3% of users accepted the prompts, while one in five caused visitors to leave the site immediately. This is at odds with other permission requests, as Mozilla’s Johann Hofmann explains:

This is in stark contrast to the camera/microphone prompt, which has an acceptance rate of about 85%!

It’s a bombardment that, at best, delays users and at worst drives them away from sites.

Why do websites over-use push notifications?

Because the web is cutthroat and sites think they need to employ all the attention-grabbing tricks to survive, even if that means annoying most users, most of the time.

It’s an example of what is known as ‘the tragedy of the commons’. While each site is behaving rationally in its own interests, if every site does the same thing, the outcome undermines their collective interest.

Firefox experiments

Push notifications were enabled in Firefox 44 in early 2016 via the same Notifications API that Chrome uses (other browsers use similar APIs).

But here’s the strange part of this story – Firefox already offers a way of controlling new push notification requests but users either don’t enable it or are confused by the setting.

In our experience, the global setting (Options Notifications Settings Block new requests asking to allow notifications) is too nested for people to notice it and often doesn’t seem to work.

That’s partly because the simplest option to block all notifications would be inconvenient, for example stopping Gmail users from being told that a new email has arrived. Or perhaps there are other settings in the API that allow sites to bypass Firefox’s blocking of new notifications.

From 1 April to 29 April Mozilla said Firefox Nightly for version 68 and Beta for version 67 will experiment with new settings.

During this time, notifications won’t display unless the user clicks or presses a key while on the website in a way that signals interaction. Sites won’t be able just to bombard casual visitors with notifications. Mozilla will also test two other settings:

In the first two weeks of this experiment, Firefox will not show any user-facing notifications when the restriction is applied to a website.

Then, in the second two weeks of the experiment:

Firefox will show an animated icon in the address bar (where our notification prompt normally would appear) when this restriction is applied. If the user clicks on the icon, they will be presented with the prompt at that time.

Mozilla admits it doesn’t yet have enough data to judge which approach is the best, or even whether a new one will be needed.

But the mere fact it is even trying is at least something to grab hold of for the millions of users slowly being driven crazy by sites’ desperate need for eyeballs.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/qvDZZsasN3o/

Windows users, you know those mandatory OS updates that sometimes break your computer and leave you steaming at the ears? Microsoft is making some big changes that will finally give you more control over them.

The company is changing the way that Windows Update downloads and installs releases, enabling users to delay them.

In older versions of Windows, users could choose which updates they wanted to install. Home editions of Windows 10 bucked that trend with a single ‘check for updates’ button that downloaded and installed everything. Not clicking the box wouldn’t save you from forced updates; the OS would eventually go and get them anyway.

Professional editions were at least able to delay updates using a ‘defer upgrades’ option. This allowed business users to wait until sacrificial guinea pigs using the home edition had been burned first.

This mandatory approach to updates caused some notable problems for users. Microsoft offers a mixture of updates for Windows 10. Monthly updates include security patches that keep Windows safer. Then, there are feature updates that serve as a larger upgrade to the system. There are two of those each year.

The last feature update was in October, and it broke so many PCs that Microsoft had to pause its rollout. Clearly a bit sore over the whole affair, it is shaking up the way that it handles updates.

In a blog post announcing the change, corporate VP of Windows Mike Fortin acknowledged that the mandatory update process isn’t every user’s cup of tea:

We have heard clear feedback that the Windows update process itself can be disruptive, particularly that Windows users would like more control over when updates happen.

Starting with the May 2019 update, the OS will treat feature updates differently from the monthly and security updates. It will include a ‘download and install now’ feature that tells users a feature update is available and recommended, but lets the user choose if and when to get it.

Users can also choose to delay monthly updates for up to 35 days in total. Windows will allow them to defer these for seven days at a time, for up to five times. After that, the update is mandatory.

Users can avoid feature updates altogether until the device they’re using nears the end of support, at which point Windows 10 will install it for them. Fortin explained:

When Windows 10 devices are at, or will soon reach, end of service, Windows update will continue to automatically initiate a feature update; keeping machines supported and receiving monthly updates is critical to device security and ecosystem health.

That gives users about 18 months (the support window for a feature release) before they have to install it on their systems. So feature updates aren’t completely optional, but this should at least minimize the chance of any more misery from unstable feature releases.

The company is taking some other measures to avoid more update agony for users. It will spend more time quality-checking its patches by increasing the amount of time that updates spend in the Release Preview phase, and will work more closely with relevant software and hardware partners to get feedback. It will also use more machine learning technology to automatically identify potential issues, Fortin said.

The OS will also provide a new option to automatically adjust its active hours setting. This feature lets users set a time range when Windows should disturb them with updates and rebuilds. Because users tend to leave the active hours setting to their 8am – 5pm default, they may miss its benefits if they are actually active outside those hours. Now, they can opt to let Windows check their usage patterns and adjust the active hours itself.

Windows will also coordinate Windows and Microsoft Store updates so that they occur when users are away from their devices, Fortin added.

So, when will all this happen?

Microsoft will provide the ‘download and install them’ option beginning in late May, but only to supported versions of Windows 10 on devices with no known compatibility issues.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/wt9EJfixNPU/

Last week, malicious code was slipped into Bootstrap for Sass, the free, open-source, very popular, and widely deployed front-end web framework.

The good news: the good guys stamped it into oblivion lickety-split.

According to the timeline provided by Snyk – a company that provides tools to find and fix known vulnerabilities in open source code – the malicious version of the package was published on the RubyGems repository for Ruby libraries on 26 March (but not on GitHub, where the library’s source code was being managed).

Malicious actors had rigged that bad package – version 3.2.0.3 – with a stealthy backdoor that would have allowed for remote code execution (RCE) in server-side Rails applications.

Later that same day, software developer Derek Barnes smelled a rat and opened a GitHub issue for what he thought was a suspicious snippet of code in the brand-new – what would turn out to be malicious – version 3.2.0.3 of bootstrap-sass. Just an hour later, the malicious version was yanked from the RubyGems repository, and the two developers responsible for maintaining the code had updated their credentials.

As of Wednesday, it hadn’t yet been confirmed how the attacker(s) had managed to publish the malicious RubyGem package, but the assumption was that they had gotten hold of a set of credentials.

So that’s the good news: it was actually spotted and dealt with very quickly, so kudos to Derek Barnes for spotting the problem and for everybody else who jumped on the fix so quickly.

A smatter of downloads

As far as impact goes, it could have been very bad indeed. The Boostrap for Sass package had been downloaded about 28 million times from the RubyGems portal as of Friday, according to official RubyGems stats. Before it was yanked, the backdoored version on RubyGems had only been downloaded 1,477 times… though, as Snyk points out, that number will increase “significantly” when counting its use in applications.

The “heads-up!” news: While this incident was spotted early and cleaned up quickly, it’s actually just one chapter in a much bigger story about how a vulnerable supply chain could threaten an entire software landscape. The story is also about how bad people are looking to exploit the way that code is written, and how much trust people place in third-party code.

Modern apps and web projects tend to have a lot of dependencies. Typically, developers rely heavily on third-party code: either by including it in their projects directly, or by including it in the toolchain used to build that project.

Both types of third-party code are managed by package managers that download the code you need for your project (and whatever code that code needs, and whatever code that code needs, and so on…) from sundry code repositories like GitHub or, in this case, because the code was a Ruby Gem, from the RubyGems repository.

Break or infect a small but useful piece of third-party code in a repository somewhere, and your code could silently poison thousands of projects and millions of users.

Not the first poisoned repository

We’ve seen similar issues with other package manager/repository combos:

An update to the ubiquitous Node Package Manager (NPM) changed critical Linux filesystem permissions, causing it to interfere with the operating system… breaking, well, everything.

The PHP ecosystem (PHP is the number one programming language for server-side web development) dodged a bullet in 2018 when a trivially exploitable vulnerability was found in its Packagist service.

As Naked Security’s Paul Ducklin said back in February 2018,

If Packagist were to be hacked and a rotten apple uploaded in a well-chosen place, a truly enormous barrel would end up poisoned.

Then, in October 2018, Python software developers could have found themselves hemorrhaging bitcoins thanks to a wily typosquatting attack. The malicious code, named with a misspelling of an innocent and popular software library, was uploaded to the PyPI repository. It was one of 12 such attacks spotted on that platform, in that month.

What to do?

Bootstrap-Sass v3.2.0.4 was also released on Thursday, on both RubyGems and GitHub, to remove any backdoor residue.

Both the 3.2.0.2 and 3.2.0.3 versions have been removed, and the project maintainers say that users need to upgrade.

As far as anybody has been able to discern, version 3.2.0.2 wasn’t actually malicious and had been pulled by the malicious actors in order to force users to upgrade to 3.2.0.3, which they published next. The clean version, 3.2.0.4, published on Wednesday, is identical to 3.2.0.2, which should make it an easy upgrade to a safe version.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/mPsteMG542Q/

Attacks from insiders often go undiscovered for months or years, so the potential impact can be huge. These 11 countermeasures can mitigate the damage.

The fear of cyber breaches looms heavy for many businesses, large and small. However, many companies are so busy looking for bad actors throughout the world that they ignore the threat from within their own walls.

According to Verizon’s Insider Threat Report — which analyzes cases involving bad actors from the 2018 Data Breach Investigation Report — 20% of cybersecurity incidents and 15% of the data breaches investigated within the Verizon 2018 DBIR originated from people within the organization.

What’s scarier, these attacks, which exploit internal data and system access privileges, are often only found months or years after they take place, making their potential impact on a business significant.

However, many organizations often treat insider threats as a taboo subject. Companies are too often hesitant to recognize, report, or take action against employees who have become a threat to their organization. It’s as though the insider threat is a black mark on their management processes and their name.

The Verizon Insider Threat Report aims to change this perception by offering organizations a data-driven view on how to identify pockets of risk within the employee base, real-life case scenarios, and countermeasure strategies to consider when developing a comprehensive insider threat program.

In no small part, the first step is to understand the types of insider threats than an organization can face. The Insider Threat Report profiles five distinct insider personalities.

1. The Careless Worker: These are employees or partners who misappropriate resources, break acceptable use policies, mishandle data, install unauthorized applications, and use unapproved workarounds. Their actions are inappropriate as opposed to malicious, many of which fall within the world of “shadow IT” (i.e., outside of IT knowledge and management).
2. The Inside Agent: Insiders recruited, solicited, or bribed by external parties to exfiltrate data.
3. The Disgruntled Employee: Insiders who seek to harm their organization via destruction of data or disruption of business activity.
4. The Malicious Insider: Employees or partners with access to corporate assets who use existing privileges to access information for personal gain.
5. The Feckless Third Party: Business partners who compromise security through negligence, misuse, or malicious access to or use of an asset.

So, how do you build countermeasures against inside actors?

There are several practical countermeasures to help organizations deploy a comprehensive insider threat program, which should involve close co-ordination across all departments from IT security, legal, and HR to incident response and digital forensics investigators.

Two factors hold the key to this success: knowing what your assets are and who has access to them.

Ways to Fight Back
These 11 countermeasures can help reduce risks and enhance incident response efforts:

• Integrate security strategies and policies: Integrating the other 10 countermeasures listed below, or, better yet, having a comprehensive insider threat program with other existing strategies (such as a risk management framework, human resources management, and intellectual property management) can help strengthen efficiency, cohesion, and timeliness in addressing insider threats.
• Conduct threat-hunting activities: Refine threat-hunting capabilities such as threat intelligence, Dark Web monitoring, behavioral analysis, and endpoint detection and response (EDR) solutions to search, monitor, detect, and investigate suspicious user and user account activities, both inside and outside the enterprise.
• Perform vulnerability scanning and penetration scanning: Leverage vulnerability assessments and penetration tests to identify gaps within a security strategy, including potential ways for insider threats to maneuver within the enterprise environment.
• Implement personnel security measures: Human resource controls (such as employee exit processes), security access principles, and security awareness training can mitigate the number of cybersecurity incidents associated with unauthorized access to enterprise systems.
• Employ physical security measures: Physical methods to limit access such as identity badges and security doors should coincide with digital access methods such as card swipes, motion detectors, and cameras.
• Implement network security solutions: Implement network perimeter and segment security solutions, such as firewalls, intrusion detection/prevention systems, gateway devices, and data loss prevention solutions in order to detect, collect, and analyze suspicious traffic potentially associated with insider threat activities. This will help highlight any unusual out-of-hours activity, volumes of outbound activity, and the use of remote connections.
• Employ endpoint security solutions: Use established endpoint security solutions, such as critical asset inventories, removable media policies, device encryption and file integrity monitoring tools in order to deter, monitor, track, collect, and analyze user-related activity.
• Apply data security measures: Apply data ownership, classification and protection as well as data disposal measures in order to manage the data life cycle and maintain confidentiality, integrity and availability with insider threats in mind.
• Employ identity and access management measures: Employ identity, access and authentication management measures to manage limit and protect access into the enterprise environment. This can be taken to the next level by employing a privileged access management solution for privileged access.
• Establish incident management capabilities: Establishing an incident management process to include an insider threat playbook with trained and capable incident handlers will make cybersecurity response activities more efficient and more effective in addressing insider threat activities.
• Retain digital forensics services: Have an investigative response retained resource available which is capable of conducting a full spectrum of deep-dive investigations ranging from the analysis of logs, files, endpoint, and network traffic, in often delicate and human-related (or user-account-related) cybersecurity incidents.

Related Content:

• 6 Ways to Tell an Insider Has Gone Rogue
• Ex-NSA Director Rogers: Insider Threat Prevention a ‘Contract’
• The Insider Threat: It’s More Common Than You Think
• Identifying, Understanding Combating Insider Threats
• Insider Threats Insider Objections

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

As head of Verizon Global Security Services, Bryan Sartin keeps pace with the leading and bleeding edges of innovation in the security market, while maintaining the highest quality of service in delivery operations. He manages the proactive and reactive span of Verizon’s … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/insider-threats/ignore-the-insider-threat-at-your-peril-/a/d-id/1334299?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Roundup This week had an Apple engineer fighting the government, an Apache update release, and a security scare at Mar-a-Lago.

While that was going on, here are a few more bits of news that broke.

NAS-ty hole spotted in iSCSI boxes

Another day, another massive data exposure from devices erroneously left wide open to the public internet.

This time, it’s a collection of some 13,500 iSCSI storage devices that were left open to be crawled by Shodan. Researcher “A Shadow” revealed, via a report to ZDnet, that the local storage clusters had been exposed and could have potentially been compromised.

Not all of the devices were left entirely unprotected, however. The report notes that a number of the boxes at least had some password protection.

Now is a good time to check all your attached devices and make sure nothing is left open. We are getting so tired of having to cover these stories.

Albany rocked by ransomware

The city of Albany, best known as the place nobody believes is actually the capital of New York state, has become the latest metropolis to fall victim to a massive ransomware infection.

Earlier this week, city officials reported that nearly all of its services were back online following a ransomware outage that had hit its network.

Among the services that were offline temporarily were orders for marriage certificates as well as birth and death certificates. Fortunately, it appears that the city is recovering well from the incident and no personal information was compromised or data permanently lost.

Should a company fall victim to ransomware, experts recommend that rather than try to pay the demand (which often does not result in full recovery anyway) they look to restore systems from backups, which should be done regularly as a matter of precaution anyway.

Teens in hot water for school WiFi hack

What ever happened to just playing sick?

A pair of teenagers from New Jersey are facing serious criminal charges after they were caught taking down the school’s Wi-Fi network to get out of a test.

The pair of students from Seacaucus High School have been tagged with counts of computer criminal activity and conspiracy after they were found to be responsible for repeated outages of the Wi-Fi network. The reason? Well, according to WBRZ, Seacaucus High relies on an internet-based curriculum for some of its classes, meaning without the WFi network, students could not complete assignments or take tests.

Because of this, the two students found they could effectively get out of tests (and help out other students who asked them for help) by DDoSing the school’s Wi-Fi network.

Unfortunately, the school did not find the scheme so funny, and the pair of unnamed juveniles now face a court date.

Researchers pry open JavaScript card sniffers

For those wondering what is behind the rash of sites compromised by card-sniffing JavaScript code, security firm Group-IB has delivered a deep-dive look into the inner workings of the infections.

The report explores the market for malware that, rather than try to pull details stored on a machine, instead sits on a server and harvests card numbers as they are entered into a company’s payment pages.

Group-IB contends that this market has not been given its due by security researchers and, as a result, criminals have been able to capitalize with massive card heists.

“The threat posed by JS‑sniffers was long under the radar of malware analysts, who deemed it insignificant and unworthy of an in-depth research,” the Moscow-based security house writes.

“However, several incidents have shown the opposite to be true, including: 380,000 victims of a JS‑sniffer that infected the British Airways website and mobile app, the compromise of Ticketmaster users’ payment data, and the recent incident involving the UK website of the international sporting goods giant Fila, which could have led to the theft of payment details of at least 5,600 customers.”

FireEye says FIN6 hack group changing course with new attacks

A cybercrime crew previously only thought to be targeting payment cards has now moved into ransomware.

This from researchers with US threat intel firm FireEye, who made the discovery while responding to an attack on an engineering firm. The researchers eventually were able to attribute the attack to cybercrime operation FIN6, but were puzzled as to why a group that had previously just focused on retail was now going after other business sectors.

“FIN6 has traditionally conducted intrusions targeting payment card data from Point-of-Sale (POS) or eCommerce systems. This incident’s targeting of the engineering industry would be inconsistent with that objective,” FireEye explained.

“However, we have recently identified multiple targeted Ryuk and LockerGoga ransomware incidents showing ties to FIN6, through both Mandiant incident response investigations and FireEye Intelligence research into threats impacting other organizations.”

Just what is causing this pivot isn’t immediately known, though FireEye suggests it may simply be a matter of individual group members carrying out ransom attacks on the side, or that the group as a whole may have decided that ransomware attacks were a more lucrative use of their time than sitting around passively slurping card numbers.

FBI taken to task for slow notifications

The system the FBI uses to let Americans known when they are the victims of cybercrime is falling woefully short of its goals.

This according to a report (PDF) from the DOJ’s Inspector General, whole compiled an audit on the effectiveness of the FBI’s Cyber Guardian notification system.

The investigation noted that among the failings of the program were an epidemic of typographical errors that prevented notices from being sent out, slow and unclear plans for notifying victims and a lack of cooperation with other agencies in compiling and sending out notices.

“The FBI established Cyber Guardian for tracking thee production, dissemination, and disposition of cyber vlctim notifications which can help victims mitigate the damage caused by cyber Intrusions and Iease the potential for Intelligence collection by the FBI,” the report noted. “However, we found that the data In Cyber Guardian was incomplete and unreliable, making the FBI unable to determine whether all victims are being notified.”

Fortunately, the Cyber Guardian program won’t be around much longer. The FBI plans to launch a new, and hopefully more effective, system later this year. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/04/06/security_roundup_050419/