Cybersecurity Awareness Month 2022

What is Cybersecurity Awareness Month?

Cybersecurity Awareness Month was founded in 2004 as a collaborative effort between the government and private industries to raise awareness about digital security and empower everyone to protect their personal information from digital forms of crime. It also aims to increase the resiliency of the country during a cyber threat.

Cybersecurity Awareness makes the community more aware to recognize, reject and report threats. Organizations can protect their users from being scammed and safeguard the organization.

When is Cybersecurity Awareness Month? 

October is known as National Cybersecurity awareness month. It's an international campaign.

What is the history behind Cybersecurity Awareness Month?

In 2004 the President of the United States and Congress declared October to be Cybersecurity Awareness Month, helping individuals protect themselves online as threats to technology and confidential data become more commonplace. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) lead a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally.

 Facts and figures

• 42% of schools have students or employees that circumvent cybersecurity protections (Impact My Biz)

• Nearly three-quarters (74%) of ransomware attacks on higher education institutions succeeded due to a lack of awareness (Inside Higher Ed)

• Ransomware attacks on U.S. schools and colleges cost $6.62b in 2020 (darkreading)

  • 95% of cybersecurity breaches are caused by human error. (World Economic Forum)

  • 69% of Companies’ Are Increasing Their Investments in Their Cybersecurity Budgets (Global digital Trust insights report

  • APWG (Anti Phishing Working Group) Reports That Website Phishing Attacks Have Tripled Since Early 2020

  • 88% of Businesses Experienced a Ransomware Attack

What are some examples of past Cyber-attacks?

The most recent well-known attack was the Colonial Pipeline (May 2021). The pipeline from Houston to the southeastern United States suffered a ransomware attack that took over key components of the computer software used to control the pipeline. This attack was singlehandedly the largest attack on oil and gas infrastructure in U.S. history. The attack led to panic buying of gasoline in the southeast, which caused shortages in some areas. Anthem (2015) a U.S. healthcare company, sustained what at the time was the biggest data breach in U.S. history. Hackers gained access to patient names, Social Security numbers, birthdays, addresses, emails, employment information and salary data.

The National Basketball Association (NBA) was hit with a cyberattack in 2021. In mid-April of 2021, the hacker group Babuk claimed to have stolen 500 GB of confidential data concerning the Houston Rockets. Babuk warned that these confidential documents, including financial info and contracts, would be made public if their demands were not met. As of this posting, no ransom payments have been made.

REvil, the same hacker group made headlines in July with an attack on Kaseya. Kaseya manages IT infrastructure for major companies worldwide. Similar to the attacks on Colonial Pipeline, this hack could potentially disrupt key areas of the economy on a large scale.

REvil carried out this attack by sending out a fake software update through Kaseya’s Virtual System Administrator, which infiltrated both Kaseya’s direct clients as well as their customers. According to REvil, one million systems were encrypted and held for ransom. Kayesa, stated that around 50 of their clients and around 1000 businesses were impacted. REvil demanded $70 million in bitcoin. To illustrate the impact of the cyber-attack, Coop, a Swedish supermarket chain, was forced to close 800 stores for a full week.

Soon after the attack, the FBI gained access to REvil’s servers and obtained the encryption keys to resolve the hack. Fortunately, no ransom was paid, and Kaseya could restore its clients' IT infrastructure. Although it started as one of the biggest ransomware attacks of the year, the situation was salvaged in the end.

 How should you and others stay safe?

·         Always use Antivirus

·         For younger kids use Parental Controls

·         Never download random files or software

·         When you can Use Two factor authentication

·         Keep your software up to date

·         Complex Passwords

·         Don’t click on any links or attachments in texts, emails, or social media posts

·         Don’t connect to unfamiliar Wi-Fi networks

·         Only visit secure websites (HTTPS)

·         Try not to overshare information (social media)

·         Use a VPN

10 Ransomware Prevention and Recovery Tips

The new head of the FBI’s San Antonio office stated that ransomware attacks in particular have skyrocketed as more of us work and go to school from home. And when it comes to ransomware, the FBI focuses on critical infrastructure: anything that involves national security or the economy.

“We don't advise companies to pay ransoms,” Rich says. “However, even if they do, we still ask them to let us know what's happening because if they report it to us, and report it to us early, we can help identify who the threat actor is.”

10 Ransomware Prevention and Recovery Tips 

Quick steps you can take now to PROTECT yourself from the threat of ransomware:

1. Use antivirus software at all times
Set your software to automatically scan emails and flash drives.

2. Keep your system patched and up to date 
Run scheduled checks to keep everything up-to-date.

3. Block access to the ransomware site
Use security products or services that block access to known ransomware sites.

4. Restrict Application
Configure operating systems or use third-party software to allow only authorized applications on computers.

5. Restrict personally owned devices on work networks
Organizations should restrict or prohibit access to official networks from personally-owned devices.

6. Restricting Administrative Privileges
Use standard user accounts vs. accounts with administrative privileges whenever possible.

7. Avoid using personal applications
Avoid using personal applications and websites – like email, chat, and social media – from work computers.

8.  Beware of Unknown sources 
Don't open files or click on links from unknown sources unless you first run an antivirus scan or look at links carefully.

Ransomware Readiness Recovery Tip

Steps you can take now to help you RECOVER from a future ransomware attack:

9. Have an Incident Response Plan

Develop and implement an incident recovery plan with defined roles and strategies for decision making. 2 Carefully plan, implement, and test a data backup and restoration strategy – and secure and isolate backups of important data. Have a team of incident response professionals on retainer to quickly respond in the event of a breach. 

10. Have Backup & Restore capability

Create a business continuity plan, and maintain an up-to-date list of internal and external contacts for ransomware attacks, including law enforcement.

• Recovery Strategies

• Business impact analysis

There is a lot more not covered in this article like incident response tabletop exercise, ransomware negotiation, and ransomware payment.

Hackers Continue to Exploit Apache Log4j Security Flaws

Hackers continue to exploit Apache Log4j Security Flaws which was discovered on December 17, 2021. CISA issued Emergency Directive (ED) 22-02: Mitigate Apache Log4j Vulnerability directing federal civilian executive branch agencies to address Log4j vulnerabilities—most notably, CVE-2021-44228. The Emergency Directive requires agencies to implement additional mitigation measures for vulnerable products where patches are not currently available and requires agencies to patch vulnerable internet-facing assets immediately, thereby superseding the broader deadline in BOD 22-01 for internet-facing technologies.

Hackers including Chinese state-backed groups have launched more than 840,000 attacks on companies globally since last Friday, according to researchers, through a previously unnoticed vulnerability in a widely used piece of open-source software called Log4J.

What is Log4j vulnerability?

Log4j is a piece of open-source code enabling system administrators to handle and record errors. However, a disastrous vulnerability in the protocol has made masses of systems susceptible to cyberattacks.

The zero-day vulnerability termed ‘Log4Shell’ takes advantage of Log4j’s allowing requests to arbitrary LDAP (Lightweight Directory Access Protocol) and JNDI (Java Naming and Directory Interface) servers, allowing attackers to execute arbitrary Java code on a server or other computer or leak sensitive information.

In other words, hackers can exploit Log4Shell to install malicious software or enable data theft. Because of Log4j’s omnipresence, the threat is global and massive. . Apache products that are affected by Log4j.

Hackers exploit Log4j Security Flaws New reported Hacks.

On August 27, 2022, Iranian Hackers Exploits Unpatched Log4j 2 of an Israeli Organizations

"After gaining access, Mercury establishes persistence, dumps credentials, and moves laterally within the targeted organization using both custom and well-known hacking tools, as well as built-in operating system tools for its hands-on-keyboard attack,"

September 9, 2022, Lazarus Exploits Log4j 2 of Energy Companies in US, Canada, & Japan

Threat intelligence company Cisco Talos says the cybercriminals group targeted certain energy providers in the three countries between February and July 2022. Lazarus used the Log4j vulnerability — reported last year — to gain access to the servers and deployed Vsingle, Yamabot malware, alongside a new entrant — dubbed MagicRat — to establish a seamless connection.

The research published by Cisco Talos on Thursday states that the MagicRat malware attributed to Lazarus is a remote access trojan used for reconnaissance and stealing credentials.

Vsingle is used to execute arbitrary code from remote networks and can be used to download plugins. According to the researchers, Lazarus has been using it for reconnaissance, manual backdooring, and exfiltration. The other one, Yamabot, is a Golang-based malware that uses HTTP requests to communicate with command-and-control servers.

Log4j Remediation

Remediation is a critical step to ensure that attackers do not exploit vulnerable Log4 assets in your environment as most organizations have multiple Java-based applications in their environment. Most Java-based applications use Log4J; the scope of this problem is significant.

Wait for the Vendor to Release a Log4j Patch

Many of the applications installed in your environment are developed by vendors. As with any application, these third-party applications may be vulnerable to Log4Shell. Most vendors will test their application(s) to ensure that they are not weak for Log4Shell and, if they are, will release a patch to fix the vulnerability. The CyberSecOp Red team can help you identify Log4J vulnerabilities so you can plan effectively and we will working the vendors to remediate them.

During war time, critical vulnerabilities can arise out of nowhere. It can be stressful and time-consuming to deploy emergency patches, and security teams often lack the resources and visibility needed to quickly identify, triage, and resolve vulnerabilities in a timely manner.

NIST Practices in Cyber Supply Chain Risk Management

Company Overview

Through its products and solutions, CyberSecOp offers cyber security tools, such as network, email, and mobile security as well as forensic investigation following a breach. As stated by the business:

The landscape of cyber threats is quickly changing. Organized threat actors are laser-focused on hacking systems and stealing data using sophisticated attacks that are tailored to compromise a specific target and evade traditional signature-based defenses, a key component of what currently constitutes basic cyber hygiene, instead of the broad scattershot attacks of the past.

SolarWinds Supply Chain Against US Agencies

The recent SolarWinds attack made the entire world aware of the danger of a cyber supply chain attack, or an attack on or through the vendors or suppliers of your company. It is becoming increasingly apparent that your business and its data are only as secure as the weakest link among your suppliers, even if you take all the necessary precautions to secure your own computer systems. This risk includes potential computer system attacks as well as the possibility of a disruption to the operations of your suppliers.

Common Risks for Supply Chains

Many risks can cause supply chain disruption, and those threats can have severe consequences for your business. Some of the more common risks are:

Cybersecurity Risks

Hackers can enter your supply chain and then move throughout your firm. Cybersecurity breaches can also wreak havoc on your day-to-day operations. So information security should be at the forefront of your mind when considering new vendors.

Compliance Risks

You’ll need to make sure your vendor can meet any regulatory compliance requirements your company has, which will subsequently affect your supply chain. For example, suppose a vendor bribes foreign government officials on your behalf. In that case, your company will be charged with violating the U.S. Foreign Corrupt Practices Act and all the legal ramifications that it entails.

Financial Risks

When collaborating with other companies, the risk of financial loss is always present. For example, if your contractor goes bankrupt or faces its own supply issues, this could have significant economic consequences for you and your organization.

Reputational Risks

Reputational risk is the most unpredictable type of risk because incidents that affect your reputation might happen out of nowhere. Damage to your contractors’ reputations can also harm yours, so consider reputational risk when choosing providers.

Cyber Supply Chain Principles and Supply Chain Risks

NIST identifies primary principles to consider for successful C-SCRM. These considerations are comprehensive and broadly apply to critical infrastructure, business processes, and intellectual property.

Understand the Security Risks Posed by Your Supply Chain

Examine the specific dangers that each supplier exposes you to, the products or services they provide, and the value chain as a whole.

Supply chain risks come in a variety of shapes and sizes. A supplier, for example, may not have enough security, may have a hostile insider, or its employees may not correctly handle your information. Gather sufficient information to better evaluate these security concerns, such as an insider data collection report or risk assessment.

Develop Your Organizational Defenses With “Assume Breach” in Mind

Assuming a breach means an organization approaches its cybersecurity posture by anticipating that its networks, systems, and applications are already compromised. Treating an internal network as if it’s as open as the internet readies the system for various threats and compromises.

Set Minimum Security Requirements for Your Suppliers

You should establish minimum security requirements and metrics for suppliers that are justified, proportionate, and achievable. Make sure that these standards reflect not only your evaluation of security risks but also the maturity of your suppliers’ security arrangements and their capacity to achieve the requirements you’ve set.

Minimum requirements should be documented and standardized to streamline enforcement. This technique will help you lower your effort and prevent giving these parties unnecessary work.

Cybersecurity is a People, Process, and Technology Problem

People, processes, and technology are the triad of solving problems. Supply chain management also focuses on these three areas to enhance supply chain performance, make it more secure, and do more with less.

Look at the Entire Landscape

There are multiple security standards that interact with each other in a variety of cybersecurity frameworks and best practices. A few examples are the NIST Cybersecurity Framework (CSF), Center for Internet Security (CIS) Controls, and the International Organization for Standardization (ISO) series.

To be efficient and flexible, your C-SCRM should follow the guidelines established by your third-party risk management program. That is especially important today, where outsourcing is common. Always remember that your C-SCRM program is only as good as the data security provided by your least secure third- or fourth-party supplier.

Encourage the Continuous Improvement of Security within Your Supply Chain

Encourage your vendors to keep improving their security measures, emphasizing how this will help them compete for and win future contracts with you.

Advise and support your suppliers as they seek to make these improvements. Allow your suppliers time to achieve improvements but require them to provide you with timelines and project plans.

Listen to and act on any issues arising from performance monitoring, incidents, or bottom-up supplier reports that imply current approaches aren’t functioning as well as they should.

Best Practices for Cyber Supply Chain Risk Management

An organization can employ a variety of best practices in its C-SCRM program. Best practices improve the ability to identify and mitigate potential risks over time. In addition, these practices include remediation steps to apply if you experience a data breach.

Here is a list of some of the best practices to keep in mind as you set to work on your cyber supply chain risk management program:

• Security requirements need to be defined in requests for proposals (RFP). In addition, use security questionnaires to hone in on the current standards practiced by each bidder.

• An organization’s security team must assess all vendors, and you must remediate vulnerabilities before sharing information, data, or goods and services with them.

• Engineers must use secure software development programs and keep up-to-date on training.

• Software updates need to be available to patch systems for vulnerabilities, and they must be downloaded and installed in real time.

• Dedicated staff that is assigned to ongoing supply chain cybersecurity activities.

• Implement and enforce tight access controls to service vendors.

The new NIST guidance reflects the increased attention companies are paying to manage cyber supply chain risks. It is a useful resource for enterprises of all sizes, though some of the recommendations may be too burdensome or complex for smaller organizations to reasonably adopt. Small businesses may lack the sufficient purchasing power to require their suppliers to complete certifications or participate in contingency planning, as NIST suggests, and may not have the resources to create internal councils and intricate review procedures.

How to Become a Cybersecurity Consultant?

Why are cybersecurity consultants in demand?  

We are surrounded by a vast universe of information in this day and age of information technology. Most of this information is available in digital form over the internet, which is a global computer network accessible to all. As a result, security is a significant concern. Security of data available on the internet is known as cybersecurity worldwide. Today, cybersecurity is critical, especially in light of the numerous incidents of data theft that have occurred at large organizations such as Yahoo, Facebook, Google+, and Marriott International. Cyberattacks such as Spyware and Ransomware pose significant challenges. It should come as no surprise that large IT organizations worldwide are spending millions of dollars to ensure the safety and security of their systems and hire security consultants at a rapid pace to manage their systems and comply with new regulations.

What does a cybersecurity consultant do?

A cybersecurity consultant's job is to identify vulnerabilities in an organization's computer systems, network, and software, then design and implement the best security solutions for that company's needs. If a cyberattack occurs, your clients will seek your advice on how to respond and mitigate the damage.

The fastest what to become a cybersecurity consultant is by getting one or two of the following security certifications.

Certifications

Consider at least one of the following certifications to stay ahead of the competition and earn more revenue with better contracts:

• Certified Information Systems Security Professional (CISSP) CISSP certification covers the definition of IT architecture and the designing, building, and maintaining a secure business environment using globally approved security standards. This training also handles industry best practices ensuring you're prepared for the CISSP certification exam.

• Global Information Assurance Certification (GIAC) GIAC certification ensures that cybersecurity professionals meet and demonstrate specific levels of technical proficiency. You’ll get hands-on training in the latest cybersecurity skills across various roles, meaning you can put your certification expertise to work immediately.

• Certified Information Systems Auditor (CISA) is a certification and a globally recognized standard for appraising an IT auditor's knowledge, expertise, and skill in assessing vulnerabilities and instituting IT controls in an enterprise environment.

• Certified Information Security Manager (CISM) CISM certification is the globally accepted standard of achievement in this area. The uniquely management-focused CISM certification ensures holders understand business and know how to manage and adapt technology to their enterprise and industry. Since its inception in 2002, more than 30,000 professionals worldwide have earned the CISM to affirm their high level of technical competence and qualification for top-caliber leadership and management roles.

• CompTIA Security+  is the first security certification IT professionals should earn. It establishes the core knowledge required of any cybersecurity role and provides a springboard to intermediate-level cybersecurity jobs.

What is the Difference Between Computer Security and Cyber Security?

Cybersecurity and computer security are frequently confused as synonyms, according to the public. It's not accurate, though. Even though both of these phrases are commonly used when discussing how to safeguard and boost the effectiveness of the IT infrastructure, there are a few significant distinctions between them. 

Computer security deals with protecting endpoints, such as desktops, laptops, servers, virtual machines, and IaaS, from malware and other threats. Cybersecurity, however, deals with safeguarding data against unauthorized access, such as that from hackers. Read the full article about the differences.

What can a Cyber Security Consultant Do for Your Business?

It is critical to keep business assets safe from criminals. There is no excuse for leaving a company and its shareholders vulnerable to attack at a time when people are dedicated to breaking into IT systems for profit and malicious intent. Choosing the right IT security services provider can reduce risk, lower costs, and boost customer confidence. You must act quickly because the bad guys have already begun.

16 Microsoft Outlook Security & Optimization Tips

This article provides advice on how to increase Outlook productivity, improve security, and get the most out of this critical program. We can assist you in protecting your account if you receive a link in an email that appears to be from your bank but isn't fake notifications from social networking sites or malicious advertisements. We stay up to date on the latest scams, so you don't have to. Though we protect your account from a variety of threats, there are several steps you can take to keep your account and personal information safe.

Outlook Security Tips

1. Outlook user Email Security Tips

• If you see a yellow safety bar at the top of your message, then the message contains blocked attachments, pictures, or links to websites. Ensure you trust the sender before downloading any attachments or images or clicking any links. Emailing the sender to verify they intended to send you an attachment is also a good practice for any attachments you're not expecting.

• A red safety bar means that the message you received contains something that might be unsafe and has been blocked by Outlook.com. We recommend that you don't open those email messages and delete them from your inbox.

• When you add an address to your Outlook safe sender’s list, all messages you receive from that address go right to your inbox. Adding a sender to your blocked sender’s list sends messages from that address to your Junk email folder.

• If the URL that appears in the address bar when you sign in doesn't include login.microsoftonline.com or login.live.com, you could be on a phishing site. Don't enter your password. Try to restart your browser and navigate to login.microsoftonline.com or Outlook.com again. If the problem continues, check your computer for viruses.

2. Use multi-factor authentication.         

• Multi-factor authentication (MFA) also known as two-step verification, requires people to use a code or authentication app on their phone to sign into Outlook and Microsoft 365, and is a critical first step to protecting your business data. Using MFA can prevent hackers from taking over if they know your password.

3. Protect your administrator accounts.

• Administrator accounts (also called admins) have elevated privileges, making these accounts more susceptible to cyberattacks. You'll need to set up and manage the right number of admin and user accounts for your business. We also recommend adhering to the information security principle of least privilege, which means that users and applications should be granted access only to the data and operations they require to perform their jobs.

4. Use preset security policies.  

• Your subscription includes preset security policies that use recommended settings for anti-spam, anti-malware, and anti-phishing protection.

5. Protect all devices.    

• Every device is a possible attack avenue into your network and must be configured properly, even those devices that are personally owned but used for work.

  • Help users set up MFA on their devices

  • Protect unmanaged Windows and Mac computers

  • Set up managed devices (requires Microsoft 365 Business Premium or Microsoft Defender for Business)

6. Train everyone on email best practices.       

• Email can contain malicious attacks cloaked as harmless communications. Email systems are especially vulnerable because everyone in the organization handles email, and safety relies on humans making consistently good decisions with those communications. Train everyone to know what to watch for spam or junk mail, phishing attempts, spoofing, and malware in their email. 

7. Use Microsoft Teams for collaboration and sharing.

• The best way to collaborate and share securely is to use Microsoft Teams. With Microsoft Teams, all your files and communications are in a protected environment and aren't being stored in unsafe ways outside of it.

  •   Use Microsoft Teams for collaboration.

  • Set up meetings with Microsoft Teams

  •   Share files and videos in a safe environment 

8. Set sharing settings for SharePoint and OneDrive files and folders.

• Your default sharing levels for SharePoint and OneDrive might be set to a more permissive level than you should use. We recommend reviewing and if necessary, changing the default settings to better protect your business. Grant people only the access they need to do their jobs. 

9. Use Microsoft 365 Apps on devices. 

• Outlook and Microsoft 365 Apps (also referred to as Office apps) enable people to work productively and more securely across devices. Whether you're using the web or desktop version of an app, you can start a document on one device and pick it up later on another device. Instead of sending files as email attachments, you can share links to documents that are stored in SharePoint or OneDrive. 

10. Manage calendar sharing for your business.

• You can help people in your organization share their calendars appropriately for better collaboration. You can manage what level of detail they can share, such as by limiting the details that are shared to free/busy times only.

11. Maintain your environment.

• After your initial setup and configuration of Microsoft 365 for business is complete, your organization needs a maintenance and operations plan. As employees come and go, you'll need to add or remove users, reset passwords, and maybe even reset devices to factory settings. You'll also want to ensure people have only the access they need to do their jobs.

Top 10 Microsoft Outlook Tips to Boost Productivity

12. Create folders to organize your emails.

• This is the apparent first step if you want to simplify how you use email. However, it may also be the most difficult, particularly if your inbox is overloaded. Even so, it makes the most sense to organize your emails into a user-friendly folder system so that you won't have to spend hours sifting through hundreds of emails in search of the one you're looking for. An easy-to-use folder system will also encourage you to respond to each email as it comes in rather than putting it off till later all the time.

13. Utilize the simple email templates provided by Outlook.

• Save one of the emails as a template if you frequently write the same type of message so that you may conveniently access it in the future when you're ready to use that previously saved form. 

14. Accept the web-based future of Outlook.

• Most of the email, calendar, and contact infrastructure is moved to a web-based view in Outlook Office 365, and other recent versions of the program so that it can be accessed on any device. Even sending brief notes amongst coworkers is straightforward with Microsoft's Send email software for cellphones, which also enters all the communications into your Microsoft Outlook history for convenient archiving and access.  

15. Adjust desktop notifications so that you only receive critical messages.

• If you get a notification every time a message arrives in your inbox, you'll be distracted. But you don't want to miss important emails, so disable desktop alerts in File > Options > Mail Options, then create a custom rule to only display alerts for messages sent to you by specific contacts. 

16. Make a folder for frequently used searches.

•  Looking for a specific folder among a hundred can be time-consuming if you still do so by typing words or phrases into the search field above the message list. You can, however, make the job easier by creating a "Search" folder for frequently searched terms.

  •  To make one, go to the "Folder" tab and right-click on "Search Folder.

What is the difference between Computer Security and Cyber Security?

What is the Difference Between Computer Security and Cyber Security?

Cybersecurity and computer security are frequently confused as synonyms, according to the public. It's not accurate, though. Even though both of these phrases are frequently used when discussing how to safeguard and boost the effectiveness of the IT infrastructure, there are a few significant distinctions between them.

Computer security deals with protecting endpoints, such as desktops, laptops, servers, virtual machines, and IaaS, from malware and other threats. Cybersecurity, however, deals with safeguarding data against unauthorized access, such as that from hackers.

The Difference Between Computer Security and Cyber Security

What computer security?

In terms of computer security, we're talking about the hardware and software security of a standalone computer. Maintaining stand-alone machines with the latest updates and proper patches is one of the most critical aspects of computer security.

Protecting your actual desktop and laptop computers as well as other hardware is the focus of computer security. Additionally, these systems need to be appropriately updated and patched. Yet by safeguarding the data kept on your networks, computers, printers, and other devices, cyber security can cover all of these operations. All connected digital devices are safe.

What is Cyber security?

Cybersecurity is the process of preventing unauthorized access to your company's sensitive data and systems through the incorporation of security protocols. Cyber threats must be reduced not only from a business standpoint but also to prevent fines related to data loss. Cyber security is intended to safeguard your digital footprint, to put it simply.

Your systems can be hacked by cybercriminals as well. If found to be insecure, they can easily mine and profit from selling your data on the dark web. For midsized businesses without a sizable PR and legal team at their disposal, a data breach can result in irreparable harm in the form of high regulatory fines, loss of reputation, and diminished customer trust, all of which are challenging to overcome. The size of a company has no bearing on a hacker's behavior. To see what they can catch, they want to cast the widest net they can.

Data is the most crucial element in either case. Your business has valuable consumer and proprietary data. The value of data is understood by cyber criminals. Threat actors are constantly looking for the most exposed systems. A lot of small businesses are simple targets. The use of mobile devices to access corporate data is growing, which increases security risks. Employees invite cybercriminals into the organization when they check their work email off the company network. When you collaborate with the CyberSecOp group that provides cyber security services, you will have professionals on your side to manage and mitigate advanced and persistent threats.

Information Security, Cybersecurity, IT Security, and Computer Security

The terms can frequently be used interchangeably. Computers handle data. Information technology includes the area of IT security, which typically relates to computers. As I said, computer security. Protecting systems from cyber threats is the definition of cybersecurity. Merriam-Webster describes "cyber" as "of, related to, or involving computers or computer networks."

Information security is what IT security is about information technology. Computer science is the parent of information technology. IT is the practical application of computer science, primarily for servers, PCs, supercomputers, data centers, and other endpoints. When referring to business, the terms information security, computer security, and cybersecurity can all be used interchangeably.

VirusTotal Malware Analysis Tool VS Joe Sandbox VS Any.Run Malware Analysis Tool

What is a sandbox, and why do you need one to analyze malware?

A sandbox is an isolated computer and network environment designed for analyzing software behavior. This environment is typically designed to run risky files and determine whether those files pose a malware threat. Some sandboxes are also designed to examine URLs to determine whether they are suspicious and could lead to malware infection. Modern sandboxes enable businesses and individuals to test any type of file, including Microsoft Office files, PDF files, and executable files.

VirusTotal Malware Analysis Tool 

Virus Total is an online service that uses antivirus engines and website scanners to analyze suspicious files and URLs in order to detect different types of malware and malicious content. It provides an API through which users can access the data generated by VirusTotal.

Cyber security and professionals use the free VirusTotal online service, but there is also a paid version that allows you to analyze files or URLs in order to identify malware detectable by antivirus engines, and it is one of the most popular in the community, so we decided to get a piece of that action.

Joe Sandbox Malware Analysis Tool

The free version of Joe Sandbox enables users to send files, browse a URL, download and execute a file or submit a command line. It works for Windows operating systems, macOS, Android, Linux, and iOS, making it a complete solution for customers with a large variety of operating systems in their IT infrastructure.

The only Windows systems accessible in the free version are a Windows 7 64-bit virtual machine and a Windows 10 64-bit physical machine. Other systems are available in the Cloud Pro service. Not many sandboxes offer the possibility of running files in a real physical system, which is one of the greatest features of Joe Sandbox.

ANY.RUN Malware Analysis Tool

ANY.RUN sandbox supports parsing public submissions. In this manner, an analyst can first search the database for any known indicator of compromise (IOC) and malware to see if it has already been publicly analyzed and then obtain the results. It contains millions of public submissions and is updated daily.

ANY.RUN's free version allows users to send files or URLs to a Windows 7 32-bit virtual machine, while the paid version allows users to send files to Windows Vista, Windows 8, and Windows 10.

The most powerful feature of ANY.RUN is the ability to interact in real-time with the virtual environment that runs the suspicious file or URL. Once a file is submitted, the user has 60 seconds to interact with the entire environment (or more on paid plans). This is a fantastic feature when analyzing malware that waits for specific user actions before running any payload. Consider malware that quietly waits for the user to launch a specific application (such as a browser) or to click on a dialog box. This is where the sandbox comes in handy.

What are some alternatives?

When comparing VirusTotal and Joe Sandbox, Any.Run you should also take into the following products.

• Cuckoo Sandbox - Cuckoo Sandbox provides a detailed analysis of any suspected malware to help protect you from online threats.

• Hybrid-Analysis.com - Hybrid-Analysis.com is a free malware analysis service powered by payload-security.com.

• Jotti - Jottis malware scan is a free online service that enables you to scan suspicious files with several...

• Metadefender - Metadefender, by OPSWAT, allows you to quickly multi-scan your files for malware using 43 antiviruses.

• Falcon Sandbox - Submit malware for analysis with Falcon Sandbox and Hybrid Analysis technology. CrowdStrike develops and licenses analysis tools to fight malware.

What is Malware Analysis? Malware analysis is the process of determining the behavior and intent of a suspicious file or URL. The analysis' output aids in the detection and mitigation of a potential threat. Reverse engineering, sometimes called back engineering, is a process in which software, machines, aircraft, architectural structures, and other products are deconstructed to extract design information from them. Often, reverse engineering involves deconstructing individual components of larger products. Reverse engineering malware involves disassembling (and sometimes decompiling) a software program. Through this process, binary instructions are converted to code mnemonics (or higher-level constructs) so that engineers can look at what the program does and what systems it impacts.

SEC Proposes New Cybersecurity Rules

The SEC proposed to add new Item 106 to Regulation S-K and updates to Forms 10-Q and 10-K that will require public companies to provide periodic updates about previously disclosed cybersecurity incidents when a material change, addition or update has occurred.

These days cyber-attacks are common across all industries and sectors, however, the finance industry inclusive of fintech seems to be one of the most targeted by cyber-attackers and cyber criminals. In 2021, according to Statista, the finance industry was ranked as the second largest target for cyber-attacks being targeted four times more than healthcare and almost nine times more than government. Although most organizations in the finance industry have built formidable security programs, the inbound threats have also become much more frequent and sophisticated. As cyber-attacks constantly grow in number and sophistication, we see organizations being breached every day. According to J Makas at ThinkAdvisor.com, by 2023 an estimated 33 billion accounts will be affected by cyberattacks targeting the financial sector.

SEC in response to rising threats

The Securities and Exchange Commission (SEC), in response to these rising threats and as a result of concerns voiced surrounding the lack of preparedness across the industry to advanced cyber-threats, has proposed new rules with a focus on standardizing and increasing cyber-reporting across the finance industry and public companies. The new rules proposed on March 9th of 2022 would require public companies to make prescribed cybersecurity disclosures. This proposal is an attempt to protect investors and strengthen their ability to evaluate public companies’ cybersecurity practices and incident reporting. cover IT risk management, cyber incident reporting, and cyber risk disclosure. The proposed rules would make cybersecurity a large part of the overall enterprise risk management

The proposed rules are an expansion on SEC’s previous guidance from 2011 and 2018 and would make material cybersecurity incident reporting, including updates about previously reported incidents as well as ongoing disclosures on companies' governance, risk management, and strategy with respect to cybersecurity risks, including board cybersecurity expertise and board oversight of cybersecurity risks, all mandatory.

            In specific, the new rules would add cybersecurity incidents on Form8-K requiring organizations to disclose all cybersecurity incidents and identified risks. The information required on the Form 8-K would cover (a) the timing of cyber-incidents and whether they are resolved or ongoing, (b) required brief details on the nature of the incident, (c) a report on any affected data even if the data was not exfiltrated, d) effects of every cyber incident on the organization’s operations, and e) information on remediation activity. One interesting item of note is that the actual date the cyber-incident began will be required and not just the date it was discovered.

Require companies to disclose

Also, the new rule would require companies to disclose the following in form 10-K:

·         Does the company have a cybersecurity risk assessment program and if so, provide a description of such program;

·         Does the company engage assessors, consultants, auditors or other third parties in connection with any cybersecurity risk assessment program;

·         Does the company have policies and procedures to oversee and identify the cybersecurity risks associated with its use of any third-party service provider (including, but not limited to, those providers that have access to the company's customer and employee data), including whether and how cybersecurity considerations affect the selection and oversight of these providers and contractual and other mechanisms the company uses to mitigate cybersecurity risks related to these providers;

·         Does the company undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents;

·         Does the company have business continuity, contingency and recovery plans in the event of a cybersecurity incident;

·         Have previous cybersecurity incidents have informed changes in its governance, policies, procedures, and technologies;

·         How and whether cybersecurity-related risks and incidents have affected or are reasonably likely to affect its results of operations or financial condition and if so, how; and

·         Cybersecurity risks are considered a vital part of its business strategy, financial planning, and capital allocation and if so, how.

requires cyber risk management to be identified in the organization's 10-K form

The proposed rules will also require information on the company’s cybersecurity governance, board oversight of the cybersecurity risks, and how cybersecurity risks are managed and assessed to be present in the company’s form 10-K as well as in annual reports. Companies will also be required to identify any members of the board with expertise in cybersecurity including their names and a full description of the nature of their expertise. Besides these requirements, there will also be disclosure requirements to tag any data that at any point was considered to be affected in any way by a cyber-incident. Lastly, foreign private issuers ("FPI") will also have mandatory incident disclosures to make.

These rules proposed by the SEC are meant to provide more visibility to investors as well as the federal government, thereby protecting investors as well as standardizing the level of cybersecurity and IT risk management programs across public companies and the finance industry. It is likely that Congress as well as entities such as the SEC will not stop here and will continue to propose further cybersecurity and IT risk management related regulation.

What are Cyber Security Services?

What is cyber security?

Cybersecurity refers to the practices and technologies used to protect computers, networks, and devices from cyber-attacks and threats. Cybersecurity is critical because it helps to ensure the confidentiality, integrity, and availability of information and systems. Cyber attacks can come in many forms, such as malware, ransomware, phishing, and Denial of Service (DoS) attacks. They can have serious consequences, including the theft of sensitive data, the disruption of business operations, and the loss of money. To protect against these threats, organizations, and individuals can use a variety of cybersecurity measures, such as firewalls, antivirus software, and strong passwords. It is also essential to educate users about how to recognize and avoid cyber threats and to keep software and systems up to date with the latest security patches.

What are Cyber Security Services?

There are many different types of cybersecurity services that organizations and individuals can use to protect themselves against cyber threats. Some examples of cybersecurity services include:

1. Managed security services: These services provide ongoing monitoring and protection of an organization's networks and systems by a team of cybersecurity experts.

2. Network security: This type of service protects an organization's networks from external threats, such as hackers and malware.

3. Cloud security: This service helps to secure an organization's data and applications that are hosted in the cloud.

4. Email security: This service helps to protect against threats that are transmitted through email, such as phishing attacks and spam.

5. Endpoint security: This service helps to protect the devices that are used to access an organization's networks and systems, such as laptops and smartphones.

6. Web security: This service helps to protect an organization's website and web-based applications from threats such as malware and hacking.

7. Identity and access management (IAM): This service helps to ensure that only authorized users have access to an organization's systems and data.

8. Compliance and risk management: This service helps organizations to comply with relevant laws and regulations and to manage their cybersecurity risks.

9. Incident response: This service helps organizations to respond to and recover from cybersecurity incidents, such as data breaches and cyber attacks.

What is security compliance?

Security compliance refers to the process of following rules, guidelines, and standards that are designed to protect an organization's information and systems from cyber threats. These rules and standards may be mandated by laws and regulations, or they may be voluntary industry standards. Some examples of security compliance frameworks and standards include:

1. The Payment Card Industry Data Security Standard (PCI DSS): This standard applies to organizations that accept, process, or store credit card payments and is designed to protect against the theft of cardholder data.

2. The Health Insurance Portability and Accountability Act (HIPAA): This law applies to organizations in the healthcare industry and sets standards for protecting patient health information.

3. The General Data Protection Regulation (GDPR): This law applies to organizations that process the personal data of individuals in the European Union (EU) and sets standards for data protection and privacy.

4. The National Institute of Standards and Technology (NIST) Cybersecurity Framework: This framework guides organizations on how to manage and reduce their cybersecurity risks.

5. The International Organization for Standardization (ISO) 27001: This standard provides a framework for an organization's information security management system (ISMS).

Following security compliance standards can help organizations to protect their information and systems from cyber threats and avoid fines and other penalties for non-compliance. It is important for organizations to assess their compliance with relevant standards regularly and to implement measures to address any gaps.

Managed security service providers (MSSPs)

Managed security service providers (MSSPs) are companies that offer a range of cybersecurity services to organizations on a subscription basis. These services may include ongoing monitoring and protection of an organization's networks and systems, incident response, and compliance assistance. MSSPs can help organizations to improve their cybersecurity posture and reduce the risk of cyber attacks in several ways:

1. Expertise: MSSPs typically have teams of cybersecurity experts with the knowledge and experience to identify and mitigate potential threats.

2. Continuous monitoring: MSSPs can provide continuous monitoring of an organization's networks and systems, which can help to identify and respond to threats in real time.

3. Time and cost savings: Outsourcing cybersecurity to an MSSP can save an organization time and resources that would otherwise be spent on in-house cybersecurity efforts.

4. Compliance assistance: MSSPs can help organizations to ensure compliance with relevant security standards and regulations.

By working with an MSSP, organizations can benefit from the expertise and resources of a dedicated cybersecurity team, which can help to improve their overall security posture and reduce the risk of cyber attacks.

Gartner Recognizes CyberSecOp - Ranked 2nd for Security Consulting Worldwide.

CyberSecOp receives the highest overall score on Gartner Peer Insights for Security Consulting Services, Worldwide in 2022.  

June 8, 2022 - CyberSecOp today announced that its Security Consulting Services received a 4.9 out of 5 overall rating from Gartner Peer Insights, placing CyberSecOp in the top two on Gartner’s Security Consulting Services Worldwide category.

"Peer reviews are extremely valuable for evaluating any purchase decision," said Josh Bauer, Executive Director at Loxo Oncology/Lilly.  “CyberSecOp appears to actively and continuously listen to us as a customer to ensure they deliver innovative solutions and a valuable user experience."

“CyberSecOp is honored to receive our current ranking status and client feedback, and we will continue to prioritize customer satisfaction across the board."  Vincent LaRocca, CEO & Co-Founder.

2022 Gartner Peer Insight

Gartner Peer Insights is the firm's platform for rating and reviewing enterprise technology solutions by end-user professionals for end-user professionals. Through user-contributed reviews from people who have actually used the services, the rating system combines expert opinions and peer insights. Peer Insights User Reviews offers a suite of interactive features for technology buyers, including the ability to customize evaluation criteria to create a quadrant view tailored to the user's goals and priorities. The platform employs rigorous methodologies, processes, and quality standards to deliver unbiased research and authentic peer reviews.

What is Gartner’s research?

Gartner research: Trusted insight for executives and their teams

Gartner research, which includes in-depth proprietary studies, peer and industry best practices, trend analysis, and quantitative modeling, enables us to offer innovative approaches that can help you drive stronger, more sustainable business performance.

Gartner research is unique, thanks to: 

Independence and objectivity

Our independence as a research firm enables our experts to provide unbiased advice you can trust.

Actionable insights

Gartner’s research is unbiased, containing vital takeaways and recommendations for impactful next steps.

 Proprietary methodologies

Our research practices and procedures distill large volumes of data into clear, precise recommendations.

What is Cybersecurity & Security Risk Assessment?

CYBERSECURITY & SECURITY RISK ASSESSMENT

Cybersecurity encompasses the functions, actions, processes, tools, and resources utilized in securing one’s digital presence and cyber network of connected systems, data, and devices. It aims to reduce risk to an organization or entity continuously. It is a complex endeavor where the effort is constant, the dangers are abundant, and visibility is key. Visibility is knowledge, its power, and it can be the difference between staying in business or going out of business. It is the difference between making your customers and clients live better or unintentionally much worse, providing for your employees with a good living or adding to unemployment, and focusing on growing your organization or worrying about how to pay regulatory fines. Yes, visibility is all that and more.  

Cybersecurity & Security Risk Assessment Benefits  

Now that we’ve established that visibility is essential, let’s look at what it means in the cyber-realm. Visibility is to cyber what doors, windows, locks, roofs, basements, weapons, and fighting or defensive resources are to a zombie attack. Imagine this: you’re in a big house with many rooms, doors, windows, etc., and you are under a zombie attack. You run and close the garage door, lock the front and back doors, shut the windows, and believe you are safe. But you had no idea the roof is only an inch thick and caves in with the slightest weight or some room somewhere in the house had an extra window, and it’s wide open. Think about how all the effort you put into closing all those other doors and windows just went to waste because you missed one and how important it would have been to have known all of that. Game over, right?! That is the power of visibility. Gain knowledge of every weakness and strength and all factors that can potentially become routes to attack or provide defenses.  

Cyber Attacks Prevention

 In the efforts of ensuring data and systems are protected from cyber-attacks and the plethora of federal, state, and international regulations are met, one of the most powerful tools that provide the needed visibility is a Security Risk Assessment. A Security Risk Assessment conducted by an experienced third party is absolutely key to providing vital visibility into the entire organization’s strengths and weaknesses. But that’s not where a Security Risk Assessment ends. When correctly done, Security Risk Assessments go much further and provide detailed roadmaps to close the identified gaps and maximize the recognized strengths. Security Risk Assessments also hold an organization’s hand and walk them through which gaps pose the most significant risk; and which ones will cost the most or the least. This provides precise risk analysis, ranking all the gaps and risks in detail.   

When a third-party Security Risk Assessment is completed and presented, it should provide comprehensive guidance. The guidance offers complete visibility into all you didn’t know, confirmation of what you may have known, and precise advice on achieving a better and more mature security posture inclusive of all the proactive and reactive measures needed. 

It's no wonder every Security Framework, international, federal, and state regulation involving IT risk management and cybersecurity emphasizes Security Risk Assessments as a must-have. Don’t be blind to potentially devastating gaps in your organization. Contact us and get your Security Risk Assessment. Cyber-attackers are not waiting, and neither should you. 

Author: Carlos Neto

Healthcare is a Top 3 Cyber Target

 Attacks on the healthcare industry are on the rise as noted in a recent article published in CYBERSECOP.  Healthcare providers of all sizes are subject to attack and in this case, CHRISTUS Health learned of “unauthorized access” likely similar to 254 ransomware incidents targeting patient care facilities between June 2020 and April 2022 worldwide.  Patients are at risk, both their health and their PII where threat actors can alter and/or add to patient billings with no notice of impropriety.  The true impact will be hard to discern until more time and data are collected but we know one thing for sure, the healthcare industry needs to take cybersecurity as seriously as they do patient care and follow their own advice; Plan, Prevent, Protect and Respond.

Plan – Get a Risk Assessment to identify and understand your cybersecurity vulnerabilities is one of the most critical steps as the awareness will lead to a prioritized remediation plan.  Even a chink in the armor will have your patients, employees, and community concerned as a cyber-attack will likely affect critical operations because the prize is financial data, patient, and employee Personally Identifiable Information (PII).

Prevent - After an assessment is completed, you need a trusted and reliable security cyber organization to assist in leveraging the right framework and controls to be measured by such as HITURST, HITECH, HIPAA and PCI.  These guidelines assist in defining the appropriate critical security controls for effective cyber defense.  These efforts can be awareness training, policy creation & enforcement, and security controls as well as incident response readiness and governance.  It’s a journey, not a sprint.

Protect – Within most remediation plans include investments in endpoint protection dark web monitoring and focusing on digital trust goals to ensure the technology investments already made as well as those in the future work in harmony.  Like a Rubik’s cube, the goal is to have every facet of your organization in order, not just celebrating a single win.  It is important to have a managed security partner to protect your patients, employees, devices, and data with monitored protection systems along with managed & encrypted backups with a Security Operations Center staffed with certified security professionals watching and engaging on your behalf 24x7x365.

Respond – Did you know that a threat actor will live in your ecosystem for an average of 121 days mining sensitive data, passwords, organization charts, and behaviors before acting?  Nearly 95% of ransomware attacks are preventable so what starts as a threat becomes a technology issue, then a business risk issue, and eventually decision-making and communications issue at the board level.  Do you pay the ransomware or not?  Are we able to recover our data?  Has the threat actor accessed our PII?  And equally important is how do you keep from reaching this point again.  Having an incident response assessment and plan might be the one thing you do if you don’t buy into everything else.  You should receive an IT assessment of “how capable are we to thwart an attack?” and “how able are we to recover if breached?”  Buying cyber insurance is not the silver bullet it used to be so having an incident partner who is proactively focused on your company’s sensitive data and reputation is paramount.

Not unlike a hospital, there are two main ways to address cyber security by coming through the Emergency Room or the front door proactively for testing; I recommend the latter.  A proactive health check is the best step to understanding your ability to fight off an attack like a stress test.  The results may drive adjustments in behavior and readiness, such as point endpoint detection, policy creation & enforcement, and security training.  If you enter the ER, then don’t panic because you read this blog and signed up a reputable security partner to react & respond, including quarantining affected systems to prevent the ransom spread, resetting all passwords, checking your backups, activating your existing crisis/DR plans and negotiate with the threat actor if that is the best business decision communicating carefully along the way with detailed documentation.  The moral of this story is that hope is not a strategy, so know your security scorecard and realize cyber readiness is a journey, not a sprint.

Author: Christopher Yula

Don't let a cyber security breach damage your reputation

Cybersecurity breaches have cost many organizations some of their largest clients. While most organizations quickly hire legal experts, public relations teams, and a cyber security firm like CyberSecOp, the reputation damages have already begun. For example, your client may not have access to your services for hours before you realize that your system was affected.

Prime attack time

Attackers are strategic with time selection to minimize their activities being seen by employees.  Most attackers operate on weekends or at night, knowing that most organizations’ employees do not access or monitor systems at this time.

When does reputation damage begin?

Reputation issues may begin long before the organization knows about an attacker. Some attackers disclose information on social media so that the organization will act quickly to their demands. Most cybercriminals spend an average of three months on clients’ systems before they act, but by this point, they may have already sold your data on the dark web or to your competitor.

Disclosing sensitive information violates privacy policies and requirements such as CCPA, GDPR, and some states’ and countries’ data protection regulations or requirements. The data disclosed may also include clients and your client’s customer information, putting your clients at risk. They, too, need to report the breach to their customers and provide the necessary protection to protect their customer’s credit and identity.

Reputation damage extends to your client.

 At this point, not only is your organization’s reputation is in jeopardy, but also the reputation of your client and your client’s customers. All of these expenditures may be a liability to your organization if the breach is on your side, especially if there is evidence that you didn’t take due care regarding your organization’s security posture.  

Conclusion

Defense-in-depth security program

Having a defense-in-depth security program such as those offered by CyberSecOp, cannot only save your business money but can also help you compete against other companies that have not implemented a security program.  Most organizations have implemented a vendor management program to mitigate their threat against a third-party risk. A security program that includes third-party risk management is critical to identifying and remediating internal and external threats.

Sanctions Leave US Ransomware Victims with No Way Out

The US Treasury Department's Office of Foreign Assets Control ("OFAC") imposed multiple sanctions against a Russian-operated virtual currency exchange involved in ransomware payments. It issued an updated advisory on the sanction risks associated with ransomware payments.

Victimized organizations balance the risk and cost of stalled operations and encrypted data with federal watchdogs ready to act. Response and recovery are never going to be an easy process. Ransomware exists because organizations and cyber insurance companies are paying the perpetrators.   

Ransomware attacks, in most cases, cause complete shutdowns of mission-critical functions. This has the same effect as business continuity events. As a result, business continuity planning is one of the best ways to prepare for the increasing likelihood that an organization will eventually fall victim to a ransomware attack. Without a solid business continuity plan, organizations are forced to pay threat actors and may face stiff sanctions or fines in the future.

A ransom payment is a negligible portion of the costs incurred by an organization following a ransomware attack. Added to the risk of reputation loss, fines, sanctions, downtime, and recovery expenses, organizations, and cyber insurance firms face uncertainty without clear direction on identifying threat actors for proper OFAC due diligence.

Biden-Harris Administration Warns

 In response to the unprecedented economic sanctions imposed by the United States, the Biden-Harris Administration has repeatedly warned about the possibility of Russia engaging in malicious cyber activity against the United States. There is now growing evidence that Russia is considering cyberattack options.

The United States Government will continue to work to provide resources and tools to the private sector, including through CISA's Shields-Up campaign. While we will do everything possible to defend the Nation and respond to cyber-attacks, the private sector owns and operates much of the nation's critical infrastructure. Therefore, the private sector must act to protect the vital services on which all Americans rely.

 Biden-Harris Administration and CISA Urge Companies To

Below you will find a list of guidance provided by the Biden-Harris Administration and CISA. CyberSecOp has assisted with the following list, along with other security frameworks found below.

Biden-Harris Administration and CISA List

1. Mandate the use of multi-factor authentication on your systems to make it harder for attackers to get onto your system.

2. Deploy modern security tools on your computers and devices to continuously look for and mitigate threats.

3. Check with your cybersecurity professionals to make sure that your systems are patched and protected against all known vulnerabilities and change passwords across your networks so that previously stolen credentials are useless to malicious actors.

4. Back up your data and ensure you have offline backups beyond the reach of malicious actors.

5. Run exercises and drill your emergency plans so that you are prepared to respond quickly to minimize the impact of any attack.

6. Encrypt your data so it cannot be used if it is stolen.

7. Educate your employees about common tactics that attackers will use over email or through websites and encourage them to report if their computers or phones have shown unusual behavior, such as uncommon crashes or operating very slowly.

8. Engage proactively with your local FBI field office or CISA Regional Office to establish relationships before cyber incidents. Please encourage your IT and Security leadership to visit the websites of CISA and the FBI, to find technical information and other valuable resources.

 Bolstering America’s cybersecurity over the long term

We also must focus on bolstering America’s cybersecurity over the long term. We encourage technology and software companies to:

1. Build security into your products from the ground up - “bake it in, don’t bolt it on” - protect your intellectual property and your customers’ privacy.

2. Develop software only on a highly secure system and accessible only to those working on a particular project. This will make it much harder for an intruder to jump from system to system, compromise a product, or steal your intellectual property.

3. Use modern tools to check for known and potential vulnerabilities. Developers can fix most software vulnerabilities — if they know about them. There are automated tools that can review code and find most coding errors before software ships, and a malicious actor takes advantage of them.

4. Software developers are responsible for all code used in their products, including open-source code. Most software is built using many different components and libraries, which are open source. Make sure developers know the provenance (i.e., origin) of components they are using and have a “software bill of materials” in case one of those components is later found to have a vulnerability so you can rapidly correct it.

5. Implement the security practices mandated in the President’s Executive Order, Improving our Nation’s Cybersecurity. Under that EO, all software the U.S. government purchases are now required to meet security standards in how it is built and deployed.

CyberSecOp Cybersecurity Services & Information Security Compliance assists organizations in developing mature cyber security, risk, and compliance programs according to PCI, HIPAA, SOC, GLBA, FISMA, ISO, NYDFS, NIST, and other security compliance mandates.

Protecting Against Ransomware: Zero Trust Security

Zero trust isn't a silver bullet for ransomware, but if implemented well, it can help create a much more robust security defense.

 Did you know only 26% of companies have a specific incident response plan for ransomware? With ransomware attacks constantly on the rise, your organization needs to be prepared and take every possible precaution.

Reduce your organization’s risk with CyberSecOp Zero Trust Program. With the help of a single-source platform for your compliance program, you can protect against vulnerabilities while reducing incident response time by as much as 60%.  

Ransomware victims paid more than $600 million to cybercriminals in 2021. According to blockchain analysis firm, Chainalysis, more than $600 million in cryptocurrency could be tied to ransomware payments in 2021, with the Conti ransomware gang accounting for nearly one-third of those payments.  

HOW CAN CYBERSECOP HELP YOUR ORGANIZATION BE CYBER READY?

CyberSecOp provides cyber risk and advisory programs that identify security gaps and build strategies using Zero Trust or other security frameworks. The zero-trust model is an effective defense mechanism for preventing ransomware. Adoption of zero-trust architecture, the modern alternative to perimeter-based security, is one of the most effective ways to prevent ransomware attacks.

Don't Forget the Fundamentals on World Backup Day 2022

March 31st is apparently world backup day! Who knew? In honor of that it seemed like a good time for a quick post extolling the virtues of backups. According to the “WorldBackupDay” website, 21% of people have never taken a backup and 30% of computers are already infected with malware. While these stats are related to individuals and not necessarily businesses the stats sound about right.

Take Backups!

Regardless of whether you are a small business or a global Fortune 500 company, backups are an essential part of your organization's risk management plan.  It’s easy to be lulled into complacency.  Just the other day I was working with an organization in the mechanical service delivery industry who’s entire “IT Infrastructure” was a single 2017 iMac.  They never bothered with any additional machines, backups and other such items because they had been told that Mac’s were “bulletproof” and not susceptible to the common maladies of the humble PC.  Unfortunately, their Mac was susceptible to good old fashioned old age and corrupt updates.  As a result they found themselves in a position where they had a large proposal for a job due the next day and the only place it existed was on this one broken Mac.  Now fortunately for them, we were able to recover the system and restore their data, but what if we hadn’t been able to?  It is absolutely critical, regardless of the size of your organization that you have a backup solution in place tailored to your specific needs.  Stay tuned for some suggestions on backup providers we love at the end of this article!

Test your Backups!

This might seem like a no-brainer, but in addition to taking backups, it's critically important that you TEST your backups.  Having a plan and procedure in place for how to recover your data in the event of a disaster is just as important as taking the backup in the first place!  In my last example of the company with a single iMac.  What if they had set up icloud and automatically configured their file to sync there.  If I had asked the owner of the business if he had the password for the icloud account or even knew what account icloud was associated with, I wonder if he would have known?  Having a documented plan that outlines where your backups go, what authentication is used to access them, how frequently they are taken, and how to restore them to a device is critical. If you are a larger organization you probably want to start having conversations about RTO and RPO at this point as well and ensuring your backup solution can meet those goals. (Recovery Time Objective, Recovery Point Objective.)  Essentially, how long will it take to recover my data and how much time passes between backups, or put more simply, how much data can I afford to lose?  1 Day’s Worth? 1 Weeks worth?  Less? More? Make sure your backup solution can meet your specific needs and goals!  

Protect your Backups!

Finally, congrats if you're taking and testing your backups!  Are you also protecting your backups?  You’re probably thinking, protecting my backups?! What’s this guy going on about now?  Consider this, you backup your information every night and test it regularly.  You sleep easy at night knowing that you can recover should the worst happen.  However, what you don’t know, is that earlier last month one of your employee’s laptops was infected with a virus.  This virus replicated across your organization but stayed dormant, collecting information about your company and environment but not taking any malicious actions yet.  The threat actor discovers that your backups run nightly and are stored for 4 months on a network share.  The virus then deletes all of your backups and begins encrypting your files.  When you return to work the next day and find all of your computers and files encrypted, you attempt to recover from backup only to find your backups have been deleted!  This is an oversimplification of the process but this is essentially what the bad guys are doing.  There are many ways to prevent this sort of attack including storing backups in offline or immutable data stores, encrypting your backups and storing multiple copies of every backup in different locations.  At this point you might be thinking “I can simply copy files to an external drive of some sort on a regular basis right?” , but what if something happens to that drive?  As the old timer’s say, “two is one and one is none”.  The idea is that if you only have one, something could happen to it and then you have none.  Have a backup plan for your backup plan!

Conclusion

Now that you’re completely terrified know that there are solutions out there for all of these problems.  Proper backup planning is a key component of every organization's Disaster Recovery, Business Continuity and Incident Response Planning.  If you are looking for assistance with any of those plans, make sure you give us at CyberSecOp a call, we would love to help you with this.

In the meantime if you're looking for somewhere to start with backup’s here are some of our favorites. 

Author: Timothy Burger

Chrome and Edge Should Be Updated Due to a Zero-Day Vulnerability

Google and Edge has released an update to remediate a critical zero-day chrome exploit. The zero-day is a weakness in Edge and Chrome's JavaScript engine that can be used by hackers to inject their code into your browser. Google explains for zero-day exploit CVE-2022-1096, first reported to the company by an anonymous tip on March 23. As part of our commitment to continuous support in security monitoring and enhancement we advise all clients to update to Chrome version 99.0.4844.84 and Microsoft Edge 99.0.1150.55 of as soon as possible.

DETAILS AND REMEDY FOR MICROSOFT AND GOOGLE

At this time Microsoft and Google won't provide much more information other than admitting there have already been attacks leveraging this zero-day weakness and keeping some information away from the public as a safety measure, stating that full details on how the exploit worked won't be made public until most users have the fix. Fortunately, this time Microsoft and Google was apparently able to issue a patch before the exploit became widely known.

Normally Chrome updates happen in the background when you close and reopen your computer's browser.

Microsoft issued its own notice and said the issue was fixed in Edge.

Please follow the steps below to ensure you have the latest version of Chrome.

Remediation Efforts

On your computer, open Chrome.

Author: Tanvir Ahmed

ADVISORY: Reports of possible digital breach

ADVISORY: Reports of possible digital breach

 Okta investigating reports of possible digital breach

Lapsus$, a cyber extortion gang, has announced that they have breached Microsoft and Okta.

The gang has leaked torrents containing source code for Bing, Bing Maps, and Microsoft Cortana, as well as a screenshot of an internal Microsoft Azure DevOps account. They also claim to have had “Superuser/Admin” access to Okta’s systems for two months, and said its focus was “only on Okta customers.”

Both Microsoft and OKTA  have started an investigation to confirm or disprove they’ve been breached. 

Recommended Actions: 

These attacks are a striking reminder of the supply chain’s cyber risks - Real risks brought to organizations by use of softwares and systems like OKTA, Microsoft, as well as many others.

Please work with your vCISO or Risk Manager to ensure the proper Vendor Security controls and processes are in place as well as other vital security controls that will drastically reduce the possibility of these dangerous hacks spilling into your network and systems.

Author: Michael Sardari

CISA's 'Shields Up' Alert Highlights Foreign Cyberthreats

Cyberwarfare is the battlefield of today. Increased geopolitical tensions stemming from Russia's unprovoked attack on Ukraine has led to CISA (the Cybersecurity & Infrastructure Security Agency) issuing a "Shields Up" bulletin.  Every organization must be prepared to respond to disruptive cyber activity, especially those in critical infrastructure fields.

 Here are some tips to help you keep your organization safe in these trying times.

Reduce the likelihood of a damaging cyber intrusion

• Use MFA or Multi-Factor-Authentication everywhere.

• Ensure all Systems are patched and up to date.

• Consider increasing patch frequency if not already real-time.

Take steps to quickly detect a potential intrusion

• Run, update and monitor a strong Endpoint Protection Program.

• Consider increasing Spam and Phishing filter sensitivity.

• Disable any non-essential ports and protocols, specifically through external gateways.

Ensure that the organization is prepared to respond if an intrusion occurs

• Review your incident response plan and ensure it is up to date and all parties are clear on their roles.

Maximize your organization's resilience to a destructive cyber incident

• Ensure that you are taking regular backups and that your backups are encrypted and immutable.

• Test your backup and recovery procedures.

• Communicate with your users, the best and strongest defense is a well-educated and well-prepared workforce.

If you are a CyberSecOp customer today in either our vCISO or vSOC program your risk manager will be reaching out shortly to ensure this guidance is being implemented to the extent possible within your organization. 

If you are not currently enrolled in one of our plans and need assistance assessing your posture and capabilities, please feel free to reach out.