Zoom has brought former Facebook CSO Alex Stamos on board to bolster a new security push, as reports emerged that Google and the US Senate have told users to avoid the video conferencing platform.
As promised by CEO Eric Yuan last week, the firm has formally launched a CISO Council and Advisory Board comprising security leaders from across industries. The idea is that they’ll collaborate on new ideas to help improve security and privacy in the app.
CISOs and security leaders from HSBC, NTT Data, Procore, Ellie Mae, VMware, Netflix, Uber, Electronic Arts and others are already lined up.
Separately, former Facebook and Yahoo CSO, Alex Stamos, has joined Zoom as an outside adviser. Stamos had been vocal on Twitter about the challenges facing the firm and observed in a post announcing his move that Zoom has some very difficult problems to solve going forward.
“As I told the computer science students in my Trust and Safety Engineering course this last quarter (the last two weeks of which were taught over, yes, Zoom) coding flaws and cryptographic issues are important, but the vast majority of real technological harm to individuals comes from people using products in a technically correct but harmful manner,” he explained.
“Zoom has some important work to do in core application security, cryptographic design and infrastructure security, and I’m looking forward to working with Zoom’s engineering teams on those projects.”
In the meantime, several more big-name users have come out against the video conferencing app. Reports claim that Google is preventing its employees from using the Zoom desktop client over security concerns, whilst the US Senate is also urging members not to use it.
They join the likes of SpaceX, NASA, the UK’s Ministry of Defence, New York school districts and the Taiwanese government.
Zoom has been hit by a spate of incidents over recent weeks, including critical vulnerabilities discovered in its platform, encryption failings, poor default settings that exposed user meetings to disruption and eavesdropping, and privacy issues.
Yuan said he is instituting a “feature freeze” while all engineering resources are diverted to security and privacy.
Half of UK adults have been exposed to online misinformation about COVID-19, making access to credible news sources increasingly important, according to regulator Ofcom.
Ofcom is surveying 2000 adults each week to better understand how online users are receiving information during the current pandemic.
Its first report, covering the first week the country was on lockdown following government orders, revealed that 46% of respondents had come across false or misleading information online, rising to 58% among 18-24-year-olds.
Worryingly, 40% said they are finding it difficult to know what’s true or false online, rising again in younger people to 52%.
Younger respondents are also said to be less likely to follow official advice: while 65% of people said they were following advice on handwashing very closely, this fell to 43% for 18-24-year-olds.
Among the most common misinformation circulating online is that drinking more water can flush out the virus, and that it can be relieved by gargling with salt water or avoiding cold food and drink, seen by 35% and 24% of adults, respectively.
Despite the fake news circulating online, however, most Brits (55%) are ignoring false claims and turning to official media sources to get their news. The BBC is most popular, with 82% of respondents claiming they check it, followed by other broadcasters (56%), and official authorities like the WHO, government and NHS (52%).
However, 49% are getting information via social media, where fake news flourishes. A further 43% find COVID-19 info via newspapers and 42% from friends and family, who could simply be repeating misinformation.
“People are turning to public authorities and traditional broadcasters for trusted information about COVID-19, and the vast majority say they’re closely following official advice,” said Ofcom group director for strategy and research, Yih-Choung Teh.
“With so much false information circulating online, it’s never been more important that people can cut through the confusion and find accurate, trustworthy and credible sources of news and advice.”
The government was recently forced to launch a rapid response unit to combat online misinformation about the virus, while in China, government officials have actively been promoting conspiracy theories about the pandemic’s origins as a US military plot.
The Federal Bureau of Investigation (FBI) has issued a warning over cloud-based business email compromise (BEC) scams that have cost US companies more than $2bn.
A BEC is a sophisticated scam targeting businesses that perform electronic payments, such as wire transfers or automated clearing house transfers. Typically, the scam involves a threat actor breaching a legitimate business email account through social engineering or computer intrusion techniques.
After gaining access to a real email account, the threat actor can fraudulently acquire funds by emailing out phony invoices containing altered bank account details to a company's vendors and suppliers.
In a statement released on April 6, the FBI said: "Cyber criminals are targeting organizations that use popular cloud-based email services to conduct Business Email Compromise (BEC) scams. The scams are initiated through specifically developed phish kits designed to mimic the cloud-based email services in order to compromise business email accounts and request or misdirect transfers of funds."
The FBI revealed that between January 2014 and October 2019, the Internet Crime Complaint Center (IC3) received complaints totaling more than $2.1bn in actual losses from BEC scams using two popular cloud-based email services.
BEC scams have been reported in all 50 states and in 177 countries. Losses from BEC scams overall have increased every year since IC3 began tracking this particular type of crime in 2013.
The FBI said the way in which cloud-based email services are configured when they are acquired by users could be making life easier for cyber-criminals looking to compromise a company's email account.
"While most cloud-based email services have security features that can help prevent BEC, many of these features must be manually configured and enabled. Users can better protect themselves from BEC by taking advantage of the full spectrum of protections that are available," said the FBI.
The cost of building and maintaining robust cybersecurity means that small and medium-sized organizations, or those with limited IT resources, are most vulnerable to BEC scams. And one compromised business can have dire consequences for a whole industry.
The FBI said: "Cyber-criminals frequently access the address books of compromised accounts as a means to identify new targets to send phishing emails. As a result, a successful email account compromise at one business can pivot to multiple victims within an industry."
It wasn't quick or simple, but researchers at Cisco Talos have managed to break into devices secured with biometric authentication.
New research published today by Paul Rascagneres and Vitor Ventura revealed that manufactured fingerprints, created using 3D printing technology and textile glue, can defeat fingerprint authentication on a variety of phones, laptops, and padlocks.
In a series of experiments, using different materials and restricted by differently sized budgets, researchers worked to trick capacitive, optical, and ultrasonic sensors.
"Our tests showed that—on average—we achieved an ~80 percent success rate while using the fake fingerprints, where the sensors were bypassed at least once," wrote researchers.
A 3D printer was used to create molds, then the fake fingerprints were cast onto materials that included silicon and fabric glue.
“It was not so easy," Rascagneres told Infosecurity Magazine. "It took me months and a liter of resin."
To carry out their experiments, the inventive researchers used the publicly available fingerprints of nefarious gangster Al Capone.
Craig Williams, director of Talos Outreach, told Infosecurity Magazine: “It was a bit surreal to realize the use of a technology that was around during the ‘Al Capone’ era still provides effective security for most users. It will be interesting to see as technologies evolve how things change.”
The fake fingerprints didn't work across all the devices tested. Researchers were unable to access the Samsung A70 phone, the Lexar Jumpdrive Fingerprint F35, or the Verbatim Fingerprint Secure USB-encrypted pen drive.
Researchers were able to crack into an iPhone 8, Samsung S10, Huawei P30 Lite, MacBook Pro 2018, iPad 5th Gen, Samsung Note 9, Honor 7X, and an AICase Padlock.
Given the expense, time, and effort it took to break into devices protected by fingerprint authentication, the researchers concluded that this security measure is adequate for the majority of the population.
They wrote: "For a regular user of fingerprint authentication, the advantages are obvious, and it should be used. However, if the user is a more high-profile or their device contains sensitive information, we recommend relying more on strong passwords and token two-factor authentication."
Accenture has acquired a privately held Philadelphia company specializing in enterprise cybersecurity for information technology and operational technology environments.
Revolutionary Security was founded in 2016 and is headquartered in Whitpain Township, Pennsylvania. The company employs 90 cybersecurity professionals throughout the United States and serves a variety of clients in the energy, manufacturing, healthcare, financial services, and communications industries.
“The acquisition of Revolutionary Security is another demonstration of our continued commitment to invest in areas to keep our clients safe from cyber-threats,” said Kelly Bissell, who leads Accenture Security globally.
“Revolutionary Security’s service offerings are a perfect complement to Accenture’s portfolio, and the acquisition furthers our mission of helping clients better protect and defend their organizations across their entire ecosystem.”
Jim Guinn II, who leads Accenture’s cybersecurity business for the energy, utilities, chemical, and mining industries, added that Revolutionary Security’s "extensive experience working with industrial companies and their specialized technical skill set will be incredibly valuable to our clients.”
Cybersecurity services offered by Revolutionary Security include assessment and testing, design and build of security programs and functions, and security operations across its clients’ IT and OT (operational technology) systems.
LiveFire—Revolutionary Security's breach and attack simulation testing service—utilizes real-world cyber-threats to identify gaps in security processes and monitoring, as well as staff operations and technologies.
President and CEO of Revolutionary Security Rich Mahler believes the acquisition will trigger growth.
He said: “The opportunity to become part of Accenture Security will enable us to deliver more complete solutions to our clients and expand our services to even more clients globally. We’re excited to be joining a leading provider in cybersecurity services and look forward to working together to help clients solve their toughest challenges in IT and OT security.”
In March, Accenture agreed to acquire Context Information Security, which is the latest in a series of acquisitions—including those of Symantec’s Cyber Security Services, Deja vu Security, iDefense, Maglan, Redcore, Arismore, and FusionX—that the company says demonstrate Accenture Security’s "commitment to investing in and innovating advanced cybersecurity solutions."
Microsoft has warned that cyber-criminals are preying on people’s vulnerable psychological states during the COVID-19 pandemic to attack businesses. During a virtual press briefing, the multinational technology company provided data showing how home working and employee stress during this period has precipitated a huge amount of COVID-19-related attacks, particularly phishing scams.
Working from home at this time is very distracting for a lot of people, particularly if they are looking after children. Additionally, many individuals are in a stressful state with the extra pressures and worries as a result of COVID-19. This environment is providing new opportunities for cyber-criminals to operate.
“We’re seeing a significant increase in COVID-related phishing lures for our customers,” confirmed Ann Johnson, corporate vice-president, Microsoft. “We’re blocking roughly 24,000 bad emails a day with COVID-19 lures and we’ve also been able to see and block through our smart screen 18,000 malicious COVID-themed URLs and IP addresses on a single day, so the volume of attacks is quite high.”
Johnson therefore urged businesses to adapt and step up security practices in this environment. She noted that in the rush to get employees set up working from home productively, putting in place more stringent measures has been something of an afterthought for many businesses.
“It’s important to educate users and tell them to pause and think before they click on a link, and the second thing we’re telling organizations is that they need to enable multi-factor authentication for 100% of users, 100% of the time, because if their users are stressed, they are going to click on those links and potentially give away their credentials,” added Johnson.
In the briefing, Microsoft stated that the countries most targeted by COVID-19 attacks have been China, the US and Russia, followed by Japan and parts of Latin America. The global technology giant has also seen signs that the volume of attacks is beginning to normalize over the past few days.
A quarter of organizations have suffered a breach related to their application development process over the past year, with most of these coming via open source components, according to Sonatype.
The DevOps automation firm’s 2020 DevSecOps Community Survey is based on responses from 5045 software professionals around the world.
It revealed that 21% of the 24% of responding organizations that reported a breach over the past 12 months linked it to use of third-party components.
These are incredibly popular among DevOps practitioners as they help to speed the release of new products, although they can also contain vulnerabilities and sometimes malware.
Interestingly, the figure for reported open source component breaches rose to 28% for those organizations with mature DevOps practices that include keeping a Software Bill of Materials (SBOM) for all components.
This could be because of cultural differences associated with finding and reporting such issues, Sonatype claimed.
“DevOps practice and thought leaders continue to suggest that mature DevOps cultures supports scenarios where information is actively sought, new information is welcomed, and bridging functional groups is a rewarded behavior,” the report added.
“Failures are not silent in mature DevOps practices, but rewarded. For mature DevOps practices, awareness is one of the best agents for driving change.”
The report also suggested that happy developers are more likely to be good for overall cybersecurity: they are 3.6-times less likely to neglect security when it comes to code quality, 2.3-times more likely to have automated security tools in place and 1.3-times more likely to follow open source security policies.
Research from Sonatype last year revealed that there had been a 71% increase in open source-related breaches over the previous five years. UK firms on average downloaded 21,000 software components known to contain vulnerabilities.
Over 350,000 Exchange servers around the world are still exposed to a critical vulnerability patched by Microsoft in February and actively being exploited in the wild, according to Rapid7.
The security vendor deployed its Project Sonar scanning apparatus to find that over 82% of the 433,464 Exchange servers it detected were still vulnerable as of March 24.
Discovered by Trend Micro’s Zero Day Initiative, the vulnerability in question, CVE-2020-0688, allows for remote code execution on unpatched systems if the Exchange Control Panel (ECP) interface is accessible to the attacker and they have a working credential for it.
After Rapid7 itself released a Metasploit module related to the bug, security researchers at Volexity spotted “multiple APT actors” trying to exploit the vulnerability at the beginning of March.
“Many organizations employ two-factor authentication (2FA) to protect their VPN, e-mail, etc, limiting what an attacker can do with a compromised password,” the vendor explained.
“This vulnerability gives attackers the ability to gain access to a significant asset within an organization with a simple user credential or old service account. This issue further underscores why changing passwords periodically is a good best practice, regardless of security measures like 2FA.”
Rapid7 Labs manager Tom Sellers urged affected organizations to update Exchange immediately and check for compromise.
However, Project Sonar also revealed more widespread security deficiencies. It found over 31,000 Exchange 2010 servers around the world that have not been updated since 2012, while almost 800 Exchange 2010 servers have never been updated.
“In addition to the high numbers of servers that are missing multiple updates, there is a concerning number of Exchange 2007 and 2010 servers,” Sellers added.
“Exchange 2007 transitioned to End of Support (EoS) status nearly three years ago on April 11 2017. No security updates, bug fixes, timezone updates, etc., are provided after that date. Exchange 2007 does not have the vulnerability described by CVE-2020-0688 but if it did, it would not have been fixed.”
Europe’s data protection tsar has called for a pan-EU COVID-19 health tracking app to avoid fragmented member state approaches which may not follow privacy-by-design principles.
European data protection supervisor (EDPS), Wojciech Wiewiórowski, said his team is already cooperating with other EU institutions to create a joined-up approach in line with GDPR.
He argued that even the strict EU data protection regulation makes some allowances for use of personal data in exceptional circumstances like the current pandemic.
“GDPR states that the right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality,” explained Wiewiórowski.
“Legality of processing the personal data – even so called sensitive data like data about health – can be achieved when processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued.”
To that end, even if specific data processing during the crisis may interfere with privacy rights, it may be necessary. However, an EU-wide approach as advocated by the EDPS will ensure any measures are temporary, and limited in purpose and data access.
There must also be a clear “way back to normality” – i.e. organizations must know what they will do with any data collected after the crisis is over, said Wiewiórowski.
“The EDPS is aware that a number of EU member states have or are in the process of developing mobile applications that use different approaches to protect public health, involving the processing of personal data in different ways. The use of temporary broadcast identifiers and Bluetooth technology for contact tracing seems to be a useful path to achieve privacy and personal data protection effectively,” he added.
“Given these divergences, the EDPS calls for a pan-European model ‘COVID-19 mobile application,’ coordinated at EU level. Ideally, coordination with the World Health Organisation should also take place, to ensure data protection by design globally from the start.”
The statement should go some way to assuaging the fears of global rights groups, which signed an open letter last week warning that efforts to contain the virus mustn’t be used as cover to usher in a new era of online surveillance.
They claimed that telecoms-based tracking is already underway in 23 countries, while 14 have deployed tracking apps.
Tracking infection rates and movement across the populace is seen as an essential step to helping prevent the spread of the pandemic and a key pillar of any lockdown exit strategy.
The internet is proving to be the most valuable resource at the moment, and opportunities will await those who adapt and are more prepared.
Speaking as part of the Akamai Edge conference, delivered as a virtual summit, Andy Ellis, CSO and senior vice-president at Akamai, said that where once the internet was disruptive, it is now enabling us to teach our children and talk to family members during the COVID-19 crisis.
“Maybe we’re at conferences that are recorded in people’s basements, living rooms and potentially on their back porch, and we didn’t have to travel to them,” he said. “Maybe we’re having meetings with staff no longer focused on who is in the headquarters.”
Ellis called these “opportunities for us to seize” and we can wait and “return to the world we used to be in” when COVID-19 pandemic is over, but the digital landscape is now different now. “People have tasted the opportunity where we have meetings on video rather than in person,” and support staff who can work wherever they want to be, as long as they have an internet connection.
“The world we are going to come out of this in, will be one in which the internet becomes a more crucial component of everything we do,” he said. This could be exercise, banking, work or school; “the opportunities are bound for us and those who anticipate and seize them and are prepared to adapt will come out of this more prepared for the world we will be in,” he said.
“Those who merely sit on their hands and wait, and are not prepared for the changes of the digital landscape, will be the followers. Which do you choose to be? My preference is to seize the opportunity.”
Asked by Infosecurity if he felt that threats were consistent or if they are taking advantage of a more dispersed and remote workforce and potentially vulnerable staff, Ellis followed Tom Leighton’s earlier point that attackers may have more time on their hands, but what has really happened is the environment has changed. “Businesses that were ill-prepared for the moment that we’re in are probably finding it a little more challenging to operate as where they are today isn’t where they were, and isn’t what their security was set up for,” he explained.
He added that too many businesses worked in a siloed model, and now everyone is remote “and what worked when 5% of the workforce [worked remotely] doesn’t work when 100% of the workforce is distributed, especially when they are seizing new technologies to enable them with their work which will expose you to hazards.”
In the latest sorry COVID-19 scam, fraudsters are impersonating financial institutions to steal from Americans expecting stimulus checks from the US federal government.
Following the outbreak of the novel coronavirus, many Americans have been furloughed, fired, or had their hours or workload reduced as businesses across the country closed and lockdown measures were implemented.
To soften the economic blow dealt by the deadly virus, the US Senate approved a $2tn stimulus package on March 25.
Knowing that people all across America are now waiting to receive a government check, threat actors have swooped in to exploit the situation.
Researchers at Abnormal Security have detected an attack in which scammers impersonating a major financial institution are asking victims to verify their financial details before their stimulus funds can be released.
"These attackers created a convincing email and landing page that appeared to come from a major financial institution," wrote researchers.
"The email sent by the attackers claims that this financial institution has placed the funds on hold until the user can sign in and 'verify account ownership' so they can be released."
The email contains a link to a fake website that appears to be from a legitimate financial institution.
"The URL is masked with a link, and the real URL takes victims to a site hosted at 'https://theruncoach.icu/home.php,' which attackers likely control and will use to steal the login credentials for this financial institution from victims," wrote researchers.
Should recipients of the email fall victim to this attack, the login information for their banking account will become compromised.
In a bid to appear authentic, the attackers also inserted other genuine links into the email, including one that took users to the impersonated financial institution's real privacy statement.
"The landing page was similarly elaborate, appearing almost exactly like the true bank landing page," wrote researchers.
"Recipients would be hard-pressed to understand that this was, in fact, a site designed specifically to steal their credentials."
Researchers would not name which financial institution the scammers they observed were pretending to be associated with.
"Please keep in mind that, although these attackers were impersonating one specific financial institution for this attack, they have already launched attacks impersonating many other financial institutions," said the researchers.
New research has found that the Linux platform has been under attack from Chinese threat groups for a decade.
The "Decade of the RATs Research Report," published today by BlackBerry, reveals how five Chinese APT groups targeted Linux servers, Windows systems, and mobile devices running Android in a prolonged cross-platform attack.
Researchers said that they are confident that the APT groups "are likely comprised of civilian contractors working in the interest of the Chinese government who readily share tools, techniques, infrastructure, and targeting information with one another and their government counterparts."
Historically, the Linux platform has been overlooked from a security perspective.
"One of the main reasons there aren’t many security tools for Linux is because there are relatively few Linux machines in the world (roughly 2%), therefore it’s a tough way for companies to make money,” Eric Cornelius, chief product architect at BlackBerry, told Infosecurity Magazine.
"Security products and services are not as widely deployed for Linux platforms as they are for the more popular Windows and Mac platforms."
Cornelius added that a prevailing assumption that Linux is more secure because it is open source "is just not the case."
Asked what currently overlooked platforms could become "the Linux of the future" from a cybersecurity perspective, Cornelius said: “The most obvious one is mobile. As the 'Mobile Malware' report that we released this past fall points out, security vendors have only recently started deploying products to address a problem that governments and government-backed groups have been getting away with for a decade or more, with relative impunity.
“Attitudes about adware are the source of another area of concern, as more and more APT groups disguise their malware as adware, thinking that it can fly under the radar and receive low priority if caught. We’ve also seen an uptick in the abuse of legitimate cloud service providers whose infrastructure is being co-opted by attackers to carry out their operations.”
By exposing a threat that has emerged from the past, the new research is bad news for security professionals, already stretched by dealing with current and predicted threats.
Asked how professionals should split their attention when it comes to countering attacks, Cornelius said: “It's a process, not an exact science. But too often, the security industry and network defenders fixate on the next and the newest and forget to look back to see how past threats have evolved. As the old adage goes, 'Those who cannot remember the past are condemned to repeat it.'”
Police in the Philippines have charged 32 people with disseminating false information regarding the COVID-19 health crisis.
The Philippine National Police Anti-Cybercrime Group (PNP-ACG) said that 8 of those arrested allegedly spread fake rumors about the novel coronavirus orally around their local neighborhoods. The remaining 24 suspects are accused of using social media platforms to circulate falsehoods about the deadly virus.
Among the suspects is public school teacher Juliet Espinoza, who wrote on Facebook on March 27 that food supplies in General Santos City were running low. According to Philstar Global, Espinoza allegedly urged the public to seize food that was being stored in a gym.
Another suspect, Vicente Cañonera, posted a list of people he said had contracted COVID-19 on Facebook to help in contact tracing.
The 32 accused hail from Quezon City, Eastern Visayas, Calabarzon, Mimaropa, Western Visayas, Zamboanga peninsula, and Caraga. The crimes they are charged with allegedly took place from March 9 to April 5.
Police have charged the suspects with the unlawful use of means of publication and unlawful utterance under Article 154 of the Revised Penal Code and with violation of Republic Act 10175 or the Anti-Cybercrime Prevention Act.
ACG director Brig. Gen. Dennis Agustin asked the public not to share or post on social media any fake information about the COVID-19 outbreak that might create panic and confusion.
“The ACG will be relentless in taking countermeasures on misinformation and spread of fake reports by conducting cyber patrol operations on social media and other online platforms,” Agustin said.
As of Monday, coronavirus had claimed the lives of 163 people in the Philippines, according to Bloomberg. The total number of people with a confirmed case of COVID-19 in the country was 3,660.
On April 5, Al Jazeera reported that a 63-year-old man had been shot dead by police in the Philippines after threatening police and village officials at a coronavirus checkpoint with a scythe. The man, who was allegedly under the influence of alcohol, became violent after being cautioned by a village health worker to wear a face mask.
Earlier today, Philippines president Rodrigo Duterte opted to continue the lockdown currently in place on the republic's main island of Luzon until April 30.
Internet traffic saw a major spike in March, but it will scale in the face of increased user demand.
Speaking as part of the Akamai Edge conference, delivered as a virtual summit, Tom Leighton, CEO and co-founder of Akamai, said that COVID-19 is creating major changes in lifestyles, as the internet was intended to make our lives manageable.
“We are operating at a larger scale,” Leighton said, acknowledging that questions exist about whether the internet is ready to scale such demands “and handle applications that we rely on today.”
Leighton said that over the last four weeks global traffic has grown by 30%, whilst a normal growth would be 3%. “If we go back to 2019 and the same period, it declined by 1%, and this growth is in one month where there were no big sporting events,” he said. “We’re doing everything online now and there's been growth in a short period of time.
Leighton also said that there had been a peak in traffic of 167 Tbps, compared to 82 Tbps in March 2019.
Looking at the current state of security for remote working employees, Leighton explained that the “bad guys have been working remotely for years and know we’re vulnerable, they know we have got a lot on our minds and are taking advantage of it.”
He identified the four best defense strategies against attacks to be:
- Protect against DDoS attacks where there is resource exhaustion and sites are taken down
- Use application security and bot management, to stop your content from being corrupted and stop your site being taken over
- With people working at home, consider a zero trust approach as users working remotely is a major issue for access
- Consider page integrity and data being stolen from users, such as in the Magecart attacks
Asked if the internet will scale under current demand, Leighton said it would, but he warned it is under pressure “and especially in core data centers and that is where we help to deliver content into the network and at the edge where there is more bandwidth.”
UK businesses could save up to £8.3bn by purchasing cybersecurity products and services from a more diverse range of suppliers, according to a study by Cynapse. It suggests that shopping around for cybersecurity services, thereby democratizing the market, would be hugely beneficial to UK companies.
Currently, businesses tend to turn to big firms for their cybersecurity needs. It is estimated that 76% of the UK cybersecurity market is controlled by just 10% of companies, equating to £6.3bn out of an overall £8.3bn. However, the market is changing rapidly, now encompassing over 1200 companies with a new startup joining the industry every week.
In a new study, Cynapse has found that smaller companies offer similar products and services at lower costs, in some instances saving businesses up to 40%. If firms utilize smaller cybersecurity suppliers in this way, it could potentially save them up to £8.3bn, according to Cynapse.
Cynapse is a London-based cybersecurity startup that offers companies free access to cyber-experts to better understand what their requirements are. It therefore believes it has a key role in unlocking the market, enabling businesses to find better value for money for their cybersecurity services.
The company stated: “Cynapse launched in March 2020 with the goal of providing a wider view of the cybersecurity market, tailored to individual customers’ needs.”
In its breakdown of the UK cybersecurity market, Cynapse showed that there are 122 large firms compared to 1099 medium, small and micro companies. The 122 large companies generate an estimated annual revenue of £6.3bn compared to £2bn among the rest. There are a total of 42,855 people employed in the UK cybersecurity sector, of which 27,746 work for the larger companies.
A new report from the Ponemon Institute has revealed that just 24% of organizations focus on optimizing cyber-attack prevention capabilities, despite 70% of security professionals believing that the ability to effectively prevent attacks strengthens security posture.
The research report, The Economic Value of Prevention in the Cybersecurity Lifecycle, sponsored by Deep Instinct, compiled survey responses from over 600 IT and IT security practitioners within organizations and revealed that a large percentage of companies prioritize cyber-attack detection and containment over prevention methods.
For example, according to respondents, whilst 79% of security budgets are being allocated to detection, containment, recovery and remediation activities, just 21% gets dedicated to prevention, even with 80% of those polled stating that prevention is the most difficult thing to achieve in the cybersecurity lifecycle.
The study determined that effective adoption of a preventative solution, when compared to the current spending of security departments and the cost of attacks, would result in significant cost reductions and require lower overall investment.
“This study shows that the majority of companies are more effective at containing cyber-attacks after they happen because it is perceived to be more accountable. This explains why cybersecurity budgets focus on containing attacks rather than preventing them, as well as the increased rate of breaches despite investments in cybersecurity solutions,” said Dr Larry Ponemon, the Chairman and founder of the Ponemon Institute.
“Prevention of cyber-attacks is perceived to be too difficult, but as companies continue to suffer revenue losses due to cyber-breaches, we expect budgets to start allocating increased resources to preventative solutions.”
Guy Caspi, CEO and co-founder of Deep Instinct, added that most companies still operate under a policy of ‘assume breach,’ believing that it is more pragmatic to contain a cyber-attack after penetration.
“This is no longer an economically viable long-term strategy,” he said. “The value of prevention is clear – for any type of attack, prevention saves significant time and money.”
Rising threat levels and remote working challenges stemming from the COVID-19 pandemic are putting increased pressure on IT security professionals, according to new data from Check Point.
The vendor polled over 400 respondents from global organizations with over 500 employees to better understand the current challenges facing security teams.
It revealed that 71% of security professionals had reported an increase in security threats or attacks since the start of the virus outbreak. Phishing (55%), malicious websites (32%), malware (28%) and ransomware (19%) were cited as the top threats.
These have been exacerbated by home working challenges, with 95% of respondents claiming to be under new pressures.
Top among these was providing secure remote access for employees (56%) and scalable remote access solutions (55%). However, nearly half (47%) of respondents complained that home workers using shadow IT solutions represented a major problem.
These challenges are only going to grow, according to the research.
Some 61% of security pros said they are concerned about the cyber-risks involved in making rapid changes to enable remote working, and over half (55%) felt remote access security needed to be improved. A further 49% said they’re concerned about the need to scale-up endpoint security for home workers.
“Cyber-criminals will always seek to capitalize on the latest trends to try and boost the success rates of attacks, and the coronavirus pandemic has created a perfect storm of a global news event together with dramatic changes in working practices and the technologies used by organizations,” argued Rafi Kretchmer, head of product marketing at Check Point.
“This has meant a significant increase in the attack surface of many organizations, which is compromising their security postures.”
According to recent figures, the volume of detected online threats jumped 37% month-on-month in March, while one vendor observed a 600% increase in phishing attacks from the end of February to the end of March.
The SANS Institute last month released a Security Awareness Work-from-Home Deployment Kit to help organizations support secure home working.
INTERPOL has been forced to issue an alert to global police about the heightened risk of ransomware attacks on hospitals and other front-line organizations as they battle the COVID-19 pandemic.
The law enforcement organization said it issued a Purple Notice to all 194 member countries, highlighting the scale of the threat. Its Cybercrime Threat Response team claimed to have detected a “significant increase” in attempted ransomware attacks.
“As hospitals and medical organizations around the world are working non-stop to preserve the well-being of individuals stricken with the coronavirus, they have become targets for ruthless cyber-criminals who are looking to make a profit at the expense of sick patients,” said Interpol secretary general Jürgen Stock.
“Locking hospitals out of their critical systems will not only delay the swift medical response required during these unprecedented times, it could directly lead to deaths. INTERPOL continues to stand by its member countries and provide any assistance necessary to ensure our vital healthcare systems remain untouched and the criminals targeting them held accountable.”
To help out, INTERPOL said it is providing technical support and advice on how to protect key medical infrastructure.
The primary threat vector appears to be phishing emails spoofed to appear as if sent from trusted government sources, it said.
The news comes just days after Microsoft warned several dozen hospitals in a “first-of-its-kind notification” that their gateway and VPN appliances are vulnerable to ransomware groups scanning for exposed endpoints.
A study from the Vanderbilt University and the University of Central Florida published last year warned that data breaches at hospitals led to 36 additional deaths per 10,000 heart attacks per year.
It added that ransomware outages “might have an even stronger short-term negative relationship with patient outcomes than the long-term remediation efforts studied here.”
Huge GDPR fines set to be levied by the UK regulator against British Airways and Marriott International have been delayed again as it considers representations from the multi-nationals.
BA owner the International Airlines Group (IAG) claimed in its Annual Report for last year that it has made “extensive representations” to the Information Commissioner’s Office (ICO) following its notice of intent to fine last July.
“As part of its procedures, the ICO will seek the views of other EU data protection authorities,” it continued.
“The ICO initially had six months from issuing the Notice of Intent to British Airways within which it could issue a penalty notice, which has been extended through to May 18 2020, to allow the ICO to fully consider the representations and information provided by British Airways.”
Unsurprisingly, the airline’s directors believe any fine should be “considerably lower” than the original £183.4m.
Meanwhile, a statement issued by Marriott cited by a leading data protection lawyer revealed: “We mutually agreed with the ICO to an extension of the regulatory process until June 1 2020.”
The hotel group was due to be fined £99m after a breach of 339 million customer records first notified in November 2018, while BA was on the hook for a Magecart attack which compromised 500,000 customers’ financial information.
The same legal expert, Mischon de Reya data protection advisor Jon Baines, argued that the current COVID-19 crisis may mean those fines never now materialize, given that the ICO’s own guidance is for an erring company's “ability to pay” to be considered when calculating a fine.
“As a public authority, the ICO has a general public law duty to take into account relevant factors when arriving at decisions. It is strongly arguable that if it failed to take into account the current effect, and the likely future effect, of COVID-19 on BA’s and Marriott’s finances, then any decision to issue a fine would be vulnerable to appeal or a successful application for judicial review,” he added.
“When the ICO announced its intent to serve these fines last year, some commentators questioned whether they would ever be served in the amount proposed, given the huge sums involved and the likelihood that the controllers would make strong representations against. No one could have predicted, however, that a public heath pandemic would come to be a major factor in deciding the issue.”
A COVID-19 app officially approved by the government of Colombia has been found to contain vulnerabilities.
On March 9, Colombia's president, Ivan Duque, announced the launch of the CoronApp-Colombia app as a way for Colombians to send health updates and receive coronavirus news. Researchers found that the app, which has over 100,000 users, exposes user data.
"The CoronApp-Colombia app had a vulnerability where it was sending Personal Health Information (PHI) and Personally Identifiable Information (PII) data in plaintext," said Zack Allen, director of threat intelligence at ZeroFOX.
"This includes passport numbers, passwords, and self-disclosed health information."
Researchers found another app in use in Italy, released in beta testing mode, was recompiled with a backdoor and was "actively infecting victims."
Asked if governments, instead of setting up new apps, should look to partner with existing apps to get the word out quickly and more safely, Allen said: "This is a fantastic demonstration of private and public industry working together, and I think it would be a great approach, granted the people trust these apps. It all depends on who wants to inherit the risk.
"Many social media sites, for example, have COVID-19 splash pages and notifications for information, but having a large tech company hold all your data may have the same effects as government-sanctioned apps."
Unwilling to rely on TV and radio alone to communicate with citizens during the current health crisis, governments across the world have rushed out COVID-19 apps.
"Mobile app usage is one of the faster ways to get information to citizens, but it comes at a cost," said Allen. "Governments inherit the risk of deploying code quickly and efficiently, and citizens have to trust that their privacy and protection are top of mind.
"In my personal opinion, I'd like to see informational sources such as websites be used with a mobile-friendly website view. I would not install apps that use Bluetooth for tracking myself and others."
Asked if he personally uses any COVID-19 apps, Allen said: "I am primarily visiting the WHO and CDC websites on a daily basis. After reviewing about 30 of these apps, I would be hesitant to install them at this time."