STE WILLIAMS

Arby’s Restaurant Group has acknowledged a payment card breach at its corporate-owned restaurants in the US and said it did not immediately go public with the information at the behest of the FBI, says KrebsOnSecurity. An alert by credit union body PSCU to member banks says the incident occurred between October 25, 2016, and January 19, 2017, and compromised more than 355,000 credit and debit cards.

The sandwich chain has more than 3,300 stores in the US, of which one-third are corporate-owned. Not all corporate outlets were affected by the breach. Franchises, which make up the remaining two-thirds of the count, were unaffected. Arby’s says that once alerted, it took immediate steps to fully eradicate the malware on point-of-sale systems. The investigation is ongoing.

KrebsOnSecurity says the Arby’s attack has brought back painful memories of last year’s Wendy’s breach, which caused banks and credit unions to re-issue payment cards multiple times as the malware could not be fully removed and customers were repeatedly compromised.

Read full story here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/arbys-acknowledges-payment-card-breach-at-us-corporate-stores/d/d-id/1328106?_mc=RSS_DR_EDT

Nearly 80% of professionals work remotely at least one day a week, and 1.55 billion others are expected to work outside the boundaries of the corporate office by 2020, according to Frost Sullivan research. This shift to a mobile workforce is causing technology disruption because remote workers require different solutions and infrastructure, which can increase vulnerabilities. 

The security challenges aren’t only the result of more employees working outside of the corporate office, but also the number of devices used by each individual. The same Frost Sullivan report forecasts that more than 80 billion connected devices will be in use globally by 2025 — a staggering figure! Work has shifted from a place people go to daily to something people do, and as such, businesses need to be flexible, but not so flexible that their data and devices become security risks.

Cyberattacks have shifted as well, becoming less detectable by exploiting encryption and commonly used files. Malicious traffic is sent through encrypted HTTPS protocols, and malware increasingly uses transport layer security. Offices that don’t upgrade their security tools and perform deep packet inspection on corporate Internet traffic will become a handy target for stealthy attacks. New attack methods are becoming progressively more common — such as pharming, in which links redirect users to fraudulent sites; vishing, the collection of personal information during a call; and smishing, where users receive texts with fraudulent links.

3 Areas to Focus Security Efforts
To properly secure the distributed workforce, it’s best to focus on multiple areas. This allows organizations to place requirements around devices, applications, and network.

1. Devices are more than just laptops. Keeping employees efficient means the use of multiple devices — up to four tools each day, including cellphones, laptops, and wearables. And the rise of wearables opens a new enterprise security frontier. IT must secure these newer devices, especially because analysts predict that smart glasses and smart watches will see a high rate of enterprise adoption in the coming years. For these newer gadgets, IT can look to dynamic technologies, such as biometrics and GPS, and the type of information being accessed to authenticate the user rather than relying on static passwords.

Additionally, “bring your own device” (BYOD) policies continue to be a problem when it comes to data leaks. A well-designed BYOD plan that includes wireless LAN controllers and access points, a lightweight security mobility client, and robust identity services will help minimize device risks. Today’s lightweight agile identity technologies use sophisticated cryptographic algorithms to locate security threats. As these solutions evolve to include geolocation and geosensing programs, identity management will become an important part of the security framework.

2. Newer generations demand flexibility. Generation X and millennial employees grew up with mobility solutions such as broadband, Wi-Fi, laptops, social media, and smartphones. They expect instant access to information from anywhere. The result is a new corporate structure rooted in flexibility and a dispersed workforce that demands collaboration software solutions and secure network connections.

The problem arises as remote access across unsecured wireless or LTE networks opens companies up to man-in-the-middle attacks, malicious apps, corporate espionage, and more. Even traditional applications such as Word and PDF documents create havoc when malicious codes are scripted into these files and then downloaded by unsuspecting users, ultimately launching a ransomware virus.

Cloud-based applications provide flexibility for mobile workers but also create issues because cyberattackers can hack in to steal user credentials, intercept data in transmission to the cloud, or access unencrypted files. An ideal way to protect against these threats is to extend security to the DNS through a cloud-delivered network security service. Predictive cybersecurity intelligence with live graphs of global DNS requests, along with other relevant information, can protect enterprises from attacks and assist in predicting future threats. This type of protection should also cover any off-VPN device and block the additional threat of malware, phishing, and other cyberthreats. Implementing cybersecurity operation centers for real-time monitoring of threats and security solutions can be useful, especially for remote workers.

3. Social media security education needed. LinkedIn, Twitter, Facebook, and other social media sites are very popular, especially among younger employees. And these platforms are also popular among cyberattackers. All employees need to be educated regarding personal information, such as birthdates, email addresses, and company names, that should and shouldn’t be divulged online. Cyberattackers troll these sites to collect data and create targeted phishing attacks or use it to stalk or bully victims.

The best line of defense against cyberattacks for the mobile workforce is to take a more predictive stance. For instance, enterprises can create a “red team” — a group that challenges organizations to become more effective — to proactively hunt cyberthreats, improve security strategy, and train analysts with regular cyberdrills. And when was the last time your company ran a vulnerability assessment on its larger network and VPN,or a penetration test across its cloud solutions? Both evaluations can be used to identify critical gaps in the IT and operational technology environments. Finally, educating the mobile workforce about the dangers of unsecured wireless networks, social media hacking, and device usage will be the best line of defense for all companies.

Related Content:

• Fixing Critical Infrastructure Means Securing The IT Systems That Support It
• Mobile App Security: 4 Critical Issues
• A Moving Target: Tackling Cloud Security As A Data Issue

Matthew Gyde is a group executive for the security business unit at Dimension Data, an ICT solutions and services provider. He joined Dimension Data in 2005, having been in the security industry for the previous 10 years in various roles across clients and service providers. … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/keep-employees-secure-wherever-they-are/a/d-id/1328086?_mc=RSS_DR_EDT

A 14-year-old American boy has been linked to the unsuccessful cyberattack on Brussels airport shortly after the alleged ISIS suicide bombings on March 22, 2016, which killed 32 people, BBC News reports, quoting Belgian prosecutors. No terrorist motives were discovered during preliminary investigations.

The minor from Pittsburgh was questioned by the FBI at the request of Belgian authorities. He reportedly confessed to attempting to hack Zaventem airport’s website and computer system on March 22-23.

“From the investigation and the first analyses of the seized hardware it appeared that there were no terrorist motives,” the prosecutors stated.

Read details on BBC News.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/us-teen-admits-to-brussels-airport-cyberattack-/d/d-id/1328107?_mc=RSS_DR_EDT

Microsoft is making a series of announcements at next week’s RSA Conference as part of its broader enterprise security strategy.

It has been more than a year since Microsoft announced plans to invest $1B in an integrated security strategy across products and services including Windows, Azure, and Office. Initiatives have driven progress in identity protection, data management, and staying ahead of attackers.

Now Microsoft is expanding on its security efforts with updates related to Windows 10, Surface hardware, Windows Defender Advanced Threat Protection (WDATP), Windows Hello, and Windows Analytics.

Surface is getting extra protection at the hardware layer with Surface Enterprise Management Mode (SEMM). This is geared towards heavily regulated industries that need physical protection; for example, the option to disable cameras or microphones in classified areas.

SEMM lets businesses control hardware configuration and OS processes within device firmware. Configuration can be applied to specific times of day, WiFi networks, Ethernet, Bluetooth, app access, and certificates that can be launched via initial deployments or pushed to cloud.

“In some of the most secure and locked-down environments, customers want to know how software is deployed and whether it’s in policy,” says Rob Lefferts, Microsoft’s director of program management for Windows Enterprise and Security.

Admins must have physical possession of the device, and unique certificate signatures, to make any changes. This Surface security update can be deployed on Surface Pro 4, Surface Book, or Surface Studio.

Microsoft is also broadening device management in Windows 10 by bringing security configurations in Security Baseline Policies to MDM solutions. Previously, these settings were limited to Group Policy. It’s also shipping the MDM Migration Analytics Tool to help report on Group Policy settings and configure policies for Windows 10 MDM managed devices.

WDATP, first announced at last year’s RSA Conference, is getting a few adjustments. Users will be able to add customize detection rules and use “time travel” detections to look back through the previous six months of data and find undiscovered attacks.

Microsoft is also integrating security alerts from across the Windows security stack. Users can view malware reports, state of antivirus, and other advanced threats in one place.

In a one-year update following the $1B security investment, Microsoft CVP and CISO Bret Arsenault said one of his goals was to completely eliminate passwords within the next two years.

It’s getting one step closer with new adjustments to Windows Hello, which is being expanded to all organizations with on-prem Active Directory-only environments. Previously, it was only available to devices with Windows 10.

“We want to make sure as many customers as possible can take advantage of new security features,” says Lefferts of the news.

Windows Hello is also being updated with Dynamic Lock, which automatically locks down a device when the user walks away. Bluetooth signals determine the distance between the user’s mobile phone and Windows 10 device, and can help block unauthorized device access.

Microsoft is working with Intel on an initiative called Project EVO, which will integrate Windows Hello with Intel’s Authentice tech. The idea is to bring the hardware-based authentication of Intel’s tool to protect Hello users from more advanced threats.

On the analytics front, Microsoft is broadening its Windows Analytics portfolio to include Update Compliance. The idea behind this is to give a broad view of Windows 10 update compliance for both monthly and feature updates. Businesses can use it to watch deployment progress, pinpoint problems, and maintain a broader view of their patched environment.

Update Compliance will be free; it’s in public preview starting today.

Finally, Microsoft is announcing that the National Security Agency (NSA) is adding Surface devices (Pro 3, Pro 4, and Surface Book) to its list of Commercial Solutions for Classified Programs (CSfC).

“The cybersecurity landscape is in a situation of ever-increasing threats,” says Lefferts. “As the world becomes more connected, the opportunities keep coming up for bad guys to do bag things, and profit from it.”

Related Content:

• Threat Hunting Becoming Top Of Mind Issue For SOCs
• InfoSec Teams Share Keys To CISO Success
• 4 Signs You, Your Users, Tech Peers C-Suite All Have ‘Security Fatigue’

Kelly is an associate editor for InformationWeek. She most recently reported on financial tech for Insurance Technology, before which she was a staff writer for InformationWeek and InformationWeek Education. When she’s not catching up on the latest in tech, Kelly enjoys … View Full Bio

Article source: http://www.darkreading.com/threat-intelligence/microsoft-beefs-up-enterprise-security-in-windows-10-surface/d/d-id/1328108?_mc=RSS_DR_EDT

Law enforcement authorities in Los Angeles have arrested a Russian-born individual on charges that he stole money from thousands of U.S. bank accounts in a cybercrime career dating back to at least 2008.

In court papers filed in connection with the February 1 arrest, prosecuting attorneys described Alexander Tverdokhlebov as a well-connected member of several elite Russian-speaking cybercrime forums engaged in extensive money laundering services, selling stolen personal data, and malware tools.

The four-count indictment against Tverdokhlebov charges him of using a botnet of around 10,000 infected computers to steal passwords and login credentials to online bank accounts which he and an accomplice, Vadim Polyakov, then used to make fraudulent purchases and illegal withdrawals.

The charges in the indictment pertain specifically to wire fraud that the pair is alleged to have engaged in between May 2008 and February 2010. Court papers indicate that the government believes Tverdokhlebov was actively engaged in cybercrime activities at least untill very recently before his arrest. But the indictment itself makes no mention of what those activities might have been.

Polyakov was arrested while vacationing in Spain in 2015 and extradited to the U.S.  In 2016, he pled guilty to running a scam that fleeced StubHub of over $1 million and was sentenced by a New York court to between four and 12 years in state prison.

After his February 1 arrest, Tverdokhlebov made an initial appearance before U.S. Magistrate Court Judge Patrick Walsh who ordered him released on bond, but the judge stayed the order at the government’s request.

The U.S. Attorney’s Office for the Eastern District of Virginia, to where the case has been transferred, this week argued against Tverdokhlebov’s pretrial release citing serious flight risk concerns.

They noted how during a search of Tverdokhlebov’s residence, law enforcement officials found keys to three bank safe deposit boxes that contained approximately $172,000 in $100 notes. One of Tverdokhlebevo’s partners described the boxes as something that he kept aside for a ‘bad day.’

“Defendant is an extremely sophisticated and well-connected cybercriminal,” prosecutors said in court papers arguing against Tverdokhlebov’s release on bond.

As a member of several influential cybercriminal forums, Tverdokhlebov has access to co-conspirators with the ability and the resources to abet his flight. “Indeed, a review of Defendant’s affiliations revealed contacts with some of the world’s most notorious cybercriminals,” the government said in its motion.

Though Tverdokhlebov is a U.S citizen, he apparently has little to tie him to the country. He married a U.S. citizen in 2009 and then divorced her shortly thereafter after transferring a large amount of money to her. Most of Tverdokhlebov’s family is still based in Russia, and the only significant tie he has in the U.S. is a relationship with a Russian-born woman based here.

Prosecutors also believe that Tverdokhlebov has access to significant amounts of additional funds, and that he has carefully laid out plans to evade law enforcement. In conversations that he had over ICQ with others, Tverdokhlebov talked about contingency plans in case he ever gets caught, according to prosecutors. 

Related Content: 

• Russian Hackers Run Record-Breaking Online Ad-Fraud Operation
• The Interconnected Nature Of International Cybercrime
• Russia Arrests 50 In Rare Cybercrime Crackdown

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/alleged-russian-hacker-with-ties-to-notorious-cybercriminals-arrested-in-la/d/d-id/1328121?_mc=RSS_DR_EDT