Category Archives: News

4 years after data breach, Slack resets 100,000 users’ passwords

Roughly 100,000 Slack users are getting their password reset and will have to choose a new one. The reason? During the data breach the company suffered in 2015, the attackers have apparently not only accessed a database with user profile information and “irreversibly encrypted” passwords, but have also “inserted code that allowed them to capture plaintext passwords as they were entered by users at the time.” What happened in 2015? Unknown attackers gained access to … More

The post 4 years after data breach, Slack resets 100,000 users’ passwords appeared first on Help Net Security.

New infosec products of the week: July 19, 2019

Perimeter 81 ensures zero trust access to web applications without an agent Zero Trust Application Access is designed to meet the demands of today’s ever-expanding modern network and ensure fully secured, isolated and agentless access to an organization’s critical web applications, SSH, RDP, VNC and Telnet in an emulated, streamlined and seamless way, regardless of where employees connect. Privitar extends data-protection and safe data-analysis capabilities of its Publisher product With Privitar Publisher 3.0, companies can … More

The post New infosec products of the week: July 19, 2019 appeared first on Help Net Security.

NSS Labs test exposes weaknesses in NGFW products

Firewalls are the most widely deployed network security devices. Enterprises expect next generation firewalls (NGFWs) to prevent exploits and malware from infecting critical systems. NSS Labs 2019 NGFW Group Test NSS Labs announced the results of its 2019 NGFW Group Test. Twelve of the industry’s NGFW products were tested to compare NGFW product capabilities across multiple use cases. Products were assessed for security effectiveness, total cost of ownership (TCO), and performance. This is the ninth … More

The post NSS Labs test exposes weaknesses in NGFW products appeared first on Help Net Security.

New open source solution reduces the risks associated with cloud deployments

An open source user computer environment (UCE) for the Amazon Cloud, called Galahad, has been launched by the University of Texas at San Antonio (UTSA). The technology will fight to protect people using desktop applications running on digital platforms such as Amazon Web Services (AWS). Galahad will leverage nested virtualization, layered sensing and logging to mitigate cloud threats. These layers will allow individual users to host their applications seamlessly and securely within the cloud avoiding … More

The post New open source solution reduces the risks associated with cloud deployments appeared first on Help Net Security.

Business owners prioritise investment in technology over upskilling

Business owners say their strategy is to prioritize investing in technology (52%) over upskilling (24%) their workforce, according to Adecco. The research titled, People, Technology and the Future of Upskilling, which surveyed 500 managers, directors, and business owners at SMEs, found that this focus on investing in technology over upskilling is not necessarily shared across all roles in the business. Just 28% of middle managers and 33% of directors prioritize investment in technology over upskilling. … More

The post Business owners prioritise investment in technology over upskilling appeared first on Help Net Security.

Mobile ID schemes take the lead over digital identity cards

The number of people using government-issued digital identity credentials will grow by over 150% from an expected 1.7 billion in 2019 to over 5 billion in 2024, according to Juniper Research. Emerging economies in Asia and Africa are some of the biggest markets, as countries leapfrog analogue identities to benefit from the efficiencies digital registration and management bring. Emerging economies follow Estonia The report, Digital Identity: Technology Evolution, Regulatory Analysis & Forecasts 2019-2024, shows that … More

The post Mobile ID schemes take the lead over digital identity cards appeared first on Help Net Security.

Malicious Python packages found on PyPI

Researchers have uncovered another batch of malicious Python libraries hosted on Python Package Index (PyPI). The malicious packages PyPI is the official third-party software repository for Python and a great source of open source libraries and modules for implementing common functionalities. Unfortunately, if a malicious component ends up on it, chances are many developers will download and implement it before it is discovered and removed from the repository. This happened with libpeshnx, libpesh and libari, … More

The post Malicious Python packages found on PyPI appeared first on Help Net Security.

FaceApp privacy panic: Be careful which apps you use

The privacy panic over FaceApp, the selfie-editing mobile app that makes photo subjects younger, older or turns them into members of the opposite sex, has been overblown. The (overblown) issue FaceApp is an iOS and Android app developed by Russian company Wireless Lab and is not without past controversy (e.g., lightening skin color to make users “hot”). In this latest bout of massive popularity, the app makers were “accused” of siphoning pictures from users’ mobile … More

The post FaceApp privacy panic: Be careful which apps you use appeared first on Help Net Security.

True passwordless authentication is still quite a while away

The password has been one of the great inventions in the history of computing: a solution that allowed simple and effective identity and access management when the need arose for it. Unfortunately, as time passed, the downsides of using (just) passwords became apparent: they can be forgotten, guessed, cracked, stolen and, finally, misused. While we wait for the password to die… During the last decade or so, many IT and IT security professionals have foretold … More

The post True passwordless authentication is still quite a while away appeared first on Help Net Security.

Skills gap remains a top barrier to SD-WAN adoption

SD-WAN security drives selection, skills gaps remain a primary obstacle to adoption, and adoption continues to rise, according to Masergy. The survey, conducted in partnership with IDG Research, analyzed responses from IT decision makers in global enterprises across a variety of industries. This survey was also conducted in 2017 as a benchmark in order to measure SD-WAN trends over time. Optimizing the network to support cutting-edge technology stands out as the most prominent objective that … More

The post Skills gap remains a top barrier to SD-WAN adoption appeared first on Help Net Security.

The true potential of 5G for businesses

Technology is transforming our world beyond recognition and both public and private sector organizations are at a tipping point where they must embrace digital transformation or risk being left behind. Concepts which once seemed futuristic and out of reach – autonomous vehicles, remote surgery, and smart cities – are now within our sights and 5G is being touted as the key to unlocking the door to this digital future. Yet, with all the excitement and … More

The post The true potential of 5G for businesses appeared first on Help Net Security.

Adoption rates of basic cloud security tools and practices still far too low

As organizations migrate more of their data and operations to the cloud, they must maintain a robust cybersecurity posture, a Bitglass report reveals. Each year, Bitglass conducts research on the state of enterprise cloud security in order to identify key trends and common vulnerabilities. This year’s report found that 75 percent of organizations leverage multiple cloud solutions, but only 20 percent have visibility over cross-app anomalous behavior. With more and more organizations storing sensitive information … More

The post Adoption rates of basic cloud security tools and practices still far too low appeared first on Help Net Security.

Certificate-related outages impact the reputation of financial services organizations

Financial services organizations are more likely to have digital certificate-related outages than other industries, a Venafi study reveals. Over 100 CIOs in the financial services industry from the U.S., U.K., France, Germany and Australia participated in the study. In the last six months, 36 percent experienced an outage that impacted critical business applications or services. In addition, financial services CIOs are more concerned about the impact of certificate-related outages on their customers. “Organizations from every … More

The post Certificate-related outages impact the reputation of financial services organizations appeared first on Help Net Security.

Federal and SLED IT managers say AI will be a game changer

AI is not a concept of the future, a MeriTalk study confirms. A new study, underwritten by Arrow and NetApp, surveyed 300 Federal, state, local, and higher education (SLED) IT managers to explore where they think their agencies are with AI as a broader concept, and to understand their usage of foundational AI technologies like chatbots, intelligent analytics, high performance computing, and more. Between February’s executive order and the launch of AI.gov in March, AI … More

The post Federal and SLED IT managers say AI will be a game changer appeared first on Help Net Security.

Smarter Security’s new optical technology to prevent sidegating

Smarter Security, the intelligent entrance controls company, announced new optical technology that reduces the risk of “sidegating” when two people attempt unauthorized side-by-side entry through a turnstile. Sidegating is a growing security issue as changing regulations and customer demands for increased pedestrian and wheelchair user comfort dictate the need for wider turnstiles. If a lane is wide enough to comfortably fit a wheelchair, it is also wide enough to fit two pedestrians side-by-side. Until now, … More

The post Smarter Security’s new optical technology to prevent sidegating appeared first on Help Net Security.

Cohesity Runbook enables enterprises to systematically move workloads to the cloud

Cohesity announced a new application called Cohesity Runbook. Cohesity Runbook provides organizations with a new automation design canvas that makes it incredibly simple and formulaic for enterprises to move workloads systematically between on-premises data centers and the public cloud – a critical need as more and more organizations rely on the cloud for everything from dev/test to security to disaster recovery. The Cohesity Runbook application, available through the Cohesity Marketplace, automates the process of moving … More

The post Cohesity Runbook enables enterprises to systematically move workloads to the cloud appeared first on Help Net Security.

Flaw in Iomega, LenovoEMC NAS devices exposes millions of files on the Internet

A vulnerability in legacy Iomega and LenovoEMC network-attached storage (NAS) devices has led to many terabytes of potentially sensitive data being accessible to anyone via the Internet. About Iomega and LenovoEMC Iomega Corporation was acquired in 2008 by EMC. In 2013, Iomega became LenovoEMC – a joint venture between Lenovo and EMC Corporation – and Iomega’s products were rebranded under the new name. Iomega’s and LenovoEMC’s storage products were aimed at small and medium-sized businesses. … More

The post Flaw in Iomega, LenovoEMC NAS devices exposes millions of files on the Internet appeared first on Help Net Security.

Over 80% of network teams play a role in security efforts

More than 4 in 5 IT teams are involved in security efforts, and a majority of them report an increase of at least 25 percent in time spent on these efforts over the past 12 months, according to Viavi. The most striking conclusion is that network-based conversation wire data has become the top data source for security incidents, with its use tripling, demonstrating that threat levels have driven enterprises to seek the most reliable forensic … More

The post Over 80% of network teams play a role in security efforts appeared first on Help Net Security.

The importance of hardening firmware security

It’s no secret that attackers traditionally go after low-hanging fruit when hacking a system. Historically, this has meant targeting user applications, and, for deeper persistence, the operating system (OS) kernel to gain control. But, as OS security has advanced, it’s become more difficult to compromise an OS with any kind of persistent kernel rootkit. As a result, hackers (and researchers) have moved below the OS level and are now targeting firmware – most notably the … More

The post The importance of hardening firmware security appeared first on Help Net Security.

Enterprises catching up with the explosion of cloud use and shadow IT in the workplace

Businesses worldwide are gaining control of previously unmonitored and unsupported cloud applications and devices, known as shadow IT, that lurk in their IT environments, according to the 2019 Duo Trusted Access Report. The average number of organizations protecting cloud apps with Duo surged 189 percent year-over-year, indicating that enterprises are catching up with the explosion of cloud use and shadow IT in the workplace. In addition, the frequency of out-of-date devices has dropped precipitously, hardening … More

The post Enterprises catching up with the explosion of cloud use and shadow IT in the workplace appeared first on Help Net Security.

Companies still don’t understand the importance of DMARC adoption

By implementing DMARC, brands lower the odds of their domains being spoofed and used for phishing attacks on recipients. Still, 79.7% of all domains analyzed have no DMARC policy in place, according to 250ok. The result of a domain not implementing any form of DMARC policy is exposing its recipients to possible phishing attacks and, unsurprisingly, 91% of all cyber attacks begin with a phishing email. Phishing and spoofing attacks against consumers are likely to … More

The post Companies still don’t understand the importance of DMARC adoption appeared first on Help Net Security.

As cyber attacks increase, the cloud-based database security market grows

The cloud-based database security market is expected to register a CAGR of 19.5% over the forecast period 2019-2024, according to ResearchAndMarkets. With the increasing adoption of Big Data platforms and relational databases becoming the prime target for data thieves, the demand for cloud-based database security is expected to gain traction. Key highlights There has been increasing volumes of data being generated from information-escalated applications like storage and mining of huge or commercial data. These applications … More

The post As cyber attacks increase, the cloud-based database security market grows appeared first on Help Net Security.

New satellite constellations aim to improve IoT connectivity options

By 2024, there will be 24 million IoT connections made via satellite, ABI Research reveals. A new report unveils the long-term opportunity within the satellite space for the growth of IoT deployments, particularly in application verticals, such as agriculture and asset tracking, that are dealing with the unreliability of terrestrial infrastructures. “Terrestrial cellular networks only cover 20% of the Earth’s surface, while satellite networks can cover the entire surface of the globe, from pole to … More

The post New satellite constellations aim to improve IoT connectivity options appeared first on Help Net Security.

Researcher releases PoC code for critical Atlassian Crowd RCE flaw

A researcher has released proof-of-concept code for a critical code execution vulnerability (CVE-2019-11580) in Atlassian Crowd, a centralized identity management solution providing single sign-on and user identity. Atlassian plugged the hole in late May, but administrators that failed to implement it should consider doing so now, as full-fledged exploits are likely to pop up soon. About the vulnerability (CVE-2019-11580) Atlassian Crowd allows enterprise admins to manage users from Active Directory, LDAP, OpenLDAP or Microsoft Azure … More

The post Researcher releases PoC code for critical Atlassian Crowd RCE flaw appeared first on Help Net Security.

Avoiding a biometric dystopia

In part one of our two-part series, we explored how biometric authentication methods are being defeated. In the second part, we’ll explore how manipulating biometrics can alter society, and what can be done to avoid a biometric dystopia. Biometric authentication secures access to most consumer phones, many laptops and PCs, and even physical access to homes and offices. Many of the consequences of defeating biometric authentication are no different than those of defeating other forms … More

The post Avoiding a biometric dystopia appeared first on Help Net Security.

IIoT risks of relying heavily on edge computing

The sheer volume of data created by the Internet of Things (IoT) is increasing dramatically as the world is becoming progressively more connected. There is projected to be a mind-boggling 75 billion IoT devices in the world by 2025. Meanwhile, edge computing is set to be adopted into the mainstream by as early as 2020. This means that increasingly vast amounts of IoT data will be stored, processed and analyzed on the edge. While edge … More

The post IIoT risks of relying heavily on edge computing appeared first on Help Net Security.

The importance of IT asset management within digital transformation processes

In this Help Net Security podcast, Marco Rottigni, Chief Technical Security Officer for Qualys across EMEA, talks about the importance of IT asset management within digital transformation processes. He illustrates why it’s crucially important to understand what you have, and how to build security in versus bolting it on. Here’s a transcript of the podcast for your convenience. Hello, my name is Marco Rottigni and I work for Qualys as a Chief Technical Security Officer … More

The post The importance of IT asset management within digital transformation processes appeared first on Help Net Security.

Yearly hidden costs of managing vendor risk? $3.8 million per healthcare provider

The inability to adequately assess and understand the risks that vendors pose is becoming incredibly costly to healthcare providers, according to a new report by Censinet and the Ponemon Institute. According to the research, the yearly hidden costs of managing vendor risk is $3.8 million per healthcare provider, far surpassing the $2.9 million that each data breach costs providers. The cost across the healthcare industry is $23.7 billion per year. The research also indicates that … More

The post Yearly hidden costs of managing vendor risk? $3.8 million per healthcare provider appeared first on Help Net Security.

How can attackers abuse artificial intelligence?

Artificial intelligence (AI) is rapidly finding applications in nearly every walk of life. Self-driving cars, social media networks, cybersecurity companies, and everything in between uses it. But a new report published by the SHERPA consortium – an EU project studying the impact of AI on ethics and human rights – finds that while human attackers have access to machine learning techniques, they currently focus most of their efforts on manipulating existing AI systems for malicious … More

The post How can attackers abuse artificial intelligence? appeared first on Help Net Security.

The rise of digital platforms is empowering the military, but challenges remain

Digital technologies such as cloud computing, big data, data analytics, IoT, artificial intelligence, augmented reality, and blockchain are gradually being leveraged in the defense industry at both agency and operational levels as change enablers, according to Frost & Sullivan’s latest analysis. The deployment of digital technologies improves legacy processes and enhances operation and mission efficiencies, which will, in turn, produce cost savings. “The rise of digital platforms is empowering the military, enabling better continuity of … More

The post The rise of digital platforms is empowering the military, but challenges remain appeared first on Help Net Security.

Do you have what it takes to be a hardware hacker?

If you ask Yago Hansen, a hacker specialized in Wi-Fi and RF security, curiosity and a willingness to learn and improve your skills are the two things that you absolutely must have to embark on a (white hat) hacking career. A love for money, on the other hand, is not. “In my mind, hackers are security researchers who spend a lot of their life in testing, learning and getting better at what they do because … More

The post Do you have what it takes to be a hardware hacker? appeared first on Help Net Security.

Organizations expect to boost their cybersecurity investments by 34%

Annual losses from cyberattacks averaged $4.7 million in the last fiscal year — with more than one in 10 firms losing over $10 million —according to a new report from ESI ThoughtLab in conjunction with Willis Towers Watson and other organizations specialized in cybersecurity and risk management. The study covered 467 firms across multiple industries in 17 countries revealing that companies worldwide expect to boost their cybersecurity investments by 34% in the next fiscal year, … More

The post Organizations expect to boost their cybersecurity investments by 34% appeared first on Help Net Security.

Multi-stage attack techniques are making network defense difficult

IT managers are inundated with cyberattacks coming from all directions and are struggling to keep up due to a lack of security expertise, budget and up to date technology, according to Sophos. The survey polled 3,100 IT decision makers from mid-sized businesses in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa. Cybercriminals use multiple attack methods and payloads for maximum impact The Sophos survey shows how attack techniques … More

The post Multi-stage attack techniques are making network defense difficult appeared first on Help Net Security.

How well are healthcare organizations protecting patient information?

Healthcare organizations have high levels of confidence in their cybersecurity preparedness despite most of them using only basic user authentication methods in the face of an increasing number of patient identity theft and fraud instances in the marketplace, according to LexisNexis Risk Solutions. Key survey findings Specifically, the survey results showed: 58% believe that the cybersecurity of their patient portal is above average or superior when compared to other patient portals 65% report that their … More

The post How well are healthcare organizations protecting patient information? appeared first on Help Net Security.

CVSS 3.1: Refined and updated for easier adoption by the security community

The Forum of Incident Response and Security Teams (FIRST) has published an update of its internationally recognized Common Vulnerability Scoring System (CVSS). CVSS is a common scoring system designed to provide open and universally standard severity ratings of software vulnerabilities for the security community. Used by organizations worldwide, version 3.1 documentation is now available on the FIRST website for members and non-members to reference. The goal of CVSS 3.1 is to simplify and improve upon … More

The post CVSS 3.1: Refined and updated for easier adoption by the security community appeared first on Help Net Security.

Only 25% of organizations using AI have an enterprise-wide AI strategy

Only 25% of global organizations that are already using artificial intelligence (AI) solutions, have developed an enterprise-wide AI strategy, according to IDC. At the same time, half the organizations surveyed see AI as a priority and two thirds are emphasizing an “AI First” culture. “Organizations that embrace AI will drive better customer engagements and have accelerated rates of innovation, higher competitiveness, higher margins, and productive employees. “Organizations worldwide must evaluate their vision and transform their … More

The post Only 25% of organizations using AI have an enterprise-wide AI strategy appeared first on Help Net Security.

BH Consulting in the media: supply chain security still a concern

The Huawei controversy has raised fundamental questions around supply chain security, Brian Honan has told Infosecurity Magazine. In a video interview recorded at Infosecurity Europe 2019 conference in London, BH Consulting’s CEO said the issue of technology containing alleged backdoors to enable spying has led to “interesting conversations” in the security community.

The question boils down to whether it’s possible to build secure systems if there’s no trust in the technology platform they’re built upon, Brian said. “Unless we actually build something ourselves from absolute scratch, we are relying on third parties, and how much trust can we give to those third parties? So the bigger issue becomes: how you secure your supply chain?”

For security professionals, securing their company’s supply chain needs a more rigorous due diligence process than asking vendors whether they have antivirus software on their PCs. It’s about “asking the right questions into the right levels, and digging deep into the technology, depending on what your requirements are,” Brian said.

Huawei to the danger zone

Noting the accusations that Huawei technology has security bugs, Brian said that the same is true of products from many other places including the US, UK or Europe. “There’s no such thing as 100% secure systems. Take the Intel chips that we have in all our servers: they have security bugs in them,” he said.

Emphasising that he wasn’t trying to defend Huawei, Brian said: “A lot of what we’re reading in the press and the media, there’s nothing to substantiate the claims behind it.” The larger question about whether any bugs are accidental, or deliberately placed backdoors that allow Government-level spying, is “outside the remit of our industry,” he said.

The chain

Even if a security professional decided not to use a certain brand of equipment in their network, there’s a question of what happens when their information travels elsewhere within their company’s external supply chain, or through its internet service provider. Instead, infosec professionals should focus on protecting information at rest or in transit, since the early internet engineers designed it to share information, not keep it secret. “We have been trying to build security on top of a very unsafe foundation. We need to look at ways of how we keep our data safe, no matter where it goes or how far it travels,” Brian said.

As for what’s next in security, Brian said regulations will stay at the forefront over the next year. “GDPR isn’t over. GDPR is the evolution of data protection laws that we had already… the regulations are still being enforced. We still have to continue looking after GDPR.”  Some of the earliest court cases relating to GDPR are due to conclude soon, with potentially large fines for offenders. He also said Brexit is “the elephant in the room”, given how it could affect the way that European companies deal with UK businesses, and vice versa.

Toys in the attic

The ePrivacy Regulation (ePR) will have a huge say in how companies embed cookies on their websites and how they communicate and market to customers. Regulations like the EU Cybersecurity Act look set to impose rules on IoT or ‘smart’ devices. Their security – or lack of it – has long been a thorny issue. Brian recently commented on this issue in an article for the Irish Times about smart toys and we’ve also blogged about it before on Security Watch.

Summing up the likely short-term developments in security, Brian said: “A lot of things in the next 12-24 months are going to have a big impact on our industry, and it’s where the regulators are going to play catch-up on the technology. It’s going to be interesting to see how those two worlds collide.” You can watch the 15-minute video here (free, but sign-in required).

Panel discussion at Infosecurity Europe 2019. From left: Peter Brown, Group Manager Technology Policy, UK ICO; Steve Wright, GDPR & CISO Advisor, Bank of England; Titta Tajwe, CISO, News UK; Deborah Haworth, Penguin Random House UK; and panel moderator Brian Honan, CEO of BH Consulting

Regulate

Also during Infosecurity Europe, Brian moderated a debate on dealing with complex regulations while ensuring privacy, security and compliance. It featured with data protection and security practitioners from the Bank of England, Penguin Random House UK, News UK and the UK Information Commissioner’s Office. Bank Info Security has a good writeup of some of the talking points. Its report noted that Brian focused the discussion on the broader regulatory landscape, including the updated EU ePrivacy Directive, while panellists and audience questions kept returning to GDPR.

The article noted how the panelists broadly agreed that regulations, including GDPR, helped to improve their organisation’s security posture. It quoted Titta Tajwe, CISO of News UK, who said: “With the EU GDPR, it really helped for executives to understand what needs to happen to protect the data of your customers. So it did allow the CISOs to get the budget they needed to do the work they’d already been asking for, for a long, long time.”

Photos used with kind permission of Mathew Schwartz.

The post BH Consulting in the media: supply chain security still a concern appeared first on BH Consulting.

Apple News+ Is A Rip-Off, There Are Free Alternatives

Apple announced this week their new expansion of their News app a paid subscription model called News+. News+ will allow users to get access to digital magazines as well as special access to Wall Street Journal and LA Times newspapers among others. On the surface this looks like a game changer but this is an […]

The post Apple News+ Is A Rip-Off, There Are Free Alternatives appeared first on Security In Five.