SECURITY AUDIT AND COMPLIANCE
Article | January 21, 2021
There is a saying, ‘you can fool all the people some of the time and some of the people all the time.’ Given the fact that there is no such thing as 100% security and human nature being trusting, this has been the backbone of many cyber security scams over the past 20 years. Cyber-criminals know that they will always fool some of the people, so have been modifying and reusing tried and tested methods to get us to open malware ridden email attachments and click malicious web links, despite years of security awareness training.
If you search for historic security advice from pretty much any year since the internet became mainstream, you will find that most of it can be applied today. Use strong passwords, do not open attachments or click links from unknown sources. All really familiar advice. So, why are people still falling for modified versions of the same tricks and scams that have been running for over a decade or more? Then again, from the cyber-criminal’s perspective, if it isn’t broken, don’t fix it? Instead, they evolve, automate, collaborate and refine what works. Sound advice for any business!
It is possible though to be in a position where you can no longer fool people, even some of the time, because it is no longer their decision to make anymore. This can be achieved by letting technology decide whether or not to trust something, sitting in between the user and the internet. Trust becomes key, and many security improvements can be achieved by limiting what is trusted, or more importantly, defining what not to trust or the criteria of what is deemed untrustworthy.
This is nothing new, as we have been doing this for years as many systems will not trust anything that is classed as a program or executable, blocking access to exe or bat files. The list of files types that can act as a program in the Microsoft Windows operating system is quite extensive, if you don’t believe me try to memorize this list: app, arj, bas, bat, cgi, chm, cmd, com, cpl, dll, exe, hta, inf, ini, ins, iqy, jar, js, jse, lnk, mht, mhtm, mhtml, msh, msh1, msh2, msh1xml, msh2xml, msi, ocx, pcd, pif, pl, ps1, ps1xml, ps2, ps2xml, psc1, psc2, py, reg, scf, scr, sct, sh, shb, shs, url, vb, vbe, vbs, vbx, ws, wsc, wsf, and wsh. As you can see, it is beyond most people to remember, but easily blocked by technology.
We can filter and authenticate email based on domain settings, reputation scores, blacklists, DMARC (Domain-based Message Authentication Reporting and Conformance) or the components of DMARC, the SPF and DKIM protocols. Email can also be filtered at the content level based on keywords in the subject and body text, the presence of tracking pixels, links, attachments, and inappropriate images that are ‘Not Safe For Work’ (NSFW) such as sexually explicit, offensive and extremist content. More advanced systems add attachment virtual sandboxing, or look at the file integrity of attachments, removing additional content that is not part of the core of the document. Others like ‘Linkscan’ technology look at the documents at the end of a link, which may be hiding behind shortened links or multiple hops, following any links in those documents to the ultimate destination of the link and scan for malware.
Where we are let down though is in the area of compromised email accounts from people that we have a trust relationship and work with, like our suppliers. These emails easily pass through most email security and spam filters as they originate from a genuine legitimate email account (albeit one now also controlled by a cyber-criminal) and unless there is anything suspicious within the email in the form of a strange attachment or link, they go completely undetected as they are often on an allow list. This explains why Business Email Compromised (BEC) attacks are so incredibly successful, asking for payments for expected invoices to be made into a ‘new’ bank account, or urgent but plausible invoices that need to be paid ASAP. If the cyber-criminals do their homework and copy previous genuine invoice requests, and maybe add in context chat based on previous emails, there is nothing for most systems or people to pick up on. Only internal processes that flag up BACS payments, change of bank of details or alerts to verify or authenticate can help. Just remember to double-check the telephone number in the email signature before you call, in case you are just calling the criminal. Also, follow the process completely, even if the person you were just about to call has just conveniently sent you an SMS text message to confirm, as SMS can be spoofed.
Not all compromised email attacks are asking for money though, many are after user credentials, and contain phishing links or links to legitimate online file sharing services, containing files that then link to malicious websites or phishing links to grant permission to open the file. To give you an idea of the lengths cyber-criminals go to, I’ve received emails from a compromised account, containing a legitimate OneDrive link, containing a PDF with a link to an Azure hosted website, that then reached out to a phishing site. In fact, many compromised attacks are not even on email, as social media is increasingly targeted as well as messaging services or even the humble SMS text message via SIM swap fraud or spoofed mobile numbers. As a high percentage of these are received on mobile devices, many of the standard security defences are not in place, compared to desktop computers and laptops. What is available though are password managers as well as two-factor authentication (2FA) and multi-factor authentication (MFA) solutions which will help protect against phishing links, regardless of the device you use, so long as you train everyone in what to look out for and how they can be abused.
One area I believe makes even greater strides in protecting users from phishing and malicious links is to implement technology that defines what not to trust based on the age of a web domain and whether it has been seen before and classified. It really does not matter how good a clone a phishing website is for Office 365 or PayPal if you are blocked from visiting it, because the domain is only hours old or has never been seen before. The choice is taken out of your hands, you still clicked on the link, but now you are taken to a holding page that explains why you are not allowed to access that particular web domain. The system I use called Censornet, does not allow my users to visit any links where the domain is less than 24 hours old, but also blocks access to any domains or subdomains that have not been classified because no one within the global ecosystem has attempted to visit them yet. False positives are automatically classified within 24 hours, or can be released by internal IT admins, so the number of incidents rapidly drops over a short period of time.
Many phishing or malicious links are created within hours of the emails being sent, so having an effective way of easily blocking them makes sense. There is also the trend for cyber-criminals to take over the website domain hosting cPanels of small businesses, often through phishing, adding new subdomains for phishing and exploit kits, rather than using spoofed domains. I’ve seen many phishing links over the years pointing to an established brand within the subdomain text of a small hotel. Either way, as these links and subdomains are by their very nature unclassified, the protection automatically covers this scenario too.
Other technological solutions at the Domain Name System (DNS) level can also help block IP addresses and domains based on global threat intelligence. Some of these are even free for business use, like Quad9.net and because they are at the DNS level, can be applied to routers and other systems that cannot accept third party security solutions. On mobile devices both Quad9 and Cloudflare offer free apps which involve adding a Virtual Private Network (VPN) profile to your device. Users of public Wi-Fi can be made secure via a VPN, though it’s preferable to have a premium VPN solution on all your user’s mobile devices, as these can be centrally managed and can offer DNS protection as well.
Further down the chain of events are solutions like privileged admin rights management and application allow lists. Here, malware is stopped once again because it is not on a trusted list, or allowed to have admin rights. There is also the added benefit that users do not need to know any admin account passwords, so as a result cannot be phished for something they do not know the answer to. Ideally, no users are working with full administrator rights in their everyday activities, as this introduces unnecessary security risks, but can often be overlooked due to work pressures and workarounds.
Let’s not forget patch management is also key, because it doesn’t matter how good your security solutions are if they can be bypassed because of a gaping hole via an exploit or vulnerability in another piece of software, whether at the operating system or firmware level, or via an individual application. Sure, no system is perfect and remember there is no such thing as 100% security, which is where the Endpoint Detection and Response (EDR) solutions and Security Information and Event Management (SIEM) solutions come into play. These can help minimize the damage through rapid discovery and remediation, hopefully before the cyber-criminals fully achieve their goals.
By harnessing the power of technology to protect us, layering solutions to cover the myriad of ways cyber-criminals constantly attempt to deceive us, we can be confident that emotional and psychological techniques and hooks will not affect technological decisions, as it is a binary choice, either yes or no. The more that we can filter out, makes it less likely that the cyber-criminals will still be able to fool some of the people all the time. This allows security awareness training to focus on threats that technology isn’t as good at stopping, like social engineering tricks and scams. The trick is to spend your budget wisely to cover all the bases and not leave any gaps, which is no easy feat in today’s rapidly changing world.
Article | January 21, 2021
For years, we have been told that cyber-attacks happen due to human-errors. Almost every person has stressed about training to prevent cyber-attacks from taking place. We have always been on the alert to dodge errant clicks or online downloads that might infect devices with security threats.
However, not all attacks need a user’s oversight to open the door. Although avoiding clicking on phishing emails is still significant but there is a cyber threat that does not need any human error and has been in the recent news. It is known as Zero-Click attack where some vulnerabilities can be misused by hackers to launch attacks even without interaction from the victim.
Rather than depending on the hardware or software flaws to get access to the victim’s device, zero-click attacks eliminate the human error equation. There is nothing a victim can do once coming into the limelight of the hacker. Also, with the flourishing use of smartphones around the world that entails all the personal information and data, this thread has expanded enormously.
How Zero-Click Attacks Occur?
The core condition for successfully pulling off a zero-click is creating a specially designed piece of data which is then sent to the targeted device over a wireless network connection including mobile internet or wifi. This then hit a scarcely documented vulnerability on the software or hardware level.
The vulnerability majorly affects the messaging or emailing apps. The attacks that have begun from Apple’s mail app on iPhone or iPad, have now moved ahead on Whatsapp and Samsung devices. In iOS 13, the vulnerability allowed zero-click when the mail runs in the background. It enables attackers to read, edit, delete, or leak the email inside the app.
Later these attacks moved to Samsung’s android devices having version 4.4.4 or above. The successful attacks provide similar access to the hackers as an owner, entailing contacts, SMS, and call logs.
In 2019, a breach on Whatsapp used the voice call functionality of the app to ring the victim’s phone. Even if the victim didn’t pick the call and later deleted it, the attacks still installed malicious data packets. These grants access to the hacker to take complete control of call logs, locations, data, camera, and even microphone of the device. Another similar attack had happened due to the frangibility in the chipset of WI-FI that is used in streaming, gaming, smart home devices, and laptops. The zero-click attack blooms on the increase of mobile devices as the number of smartphones have reached above 3 billion.
How To Avoid Zero-Click Attacks?
Most of the attacks of zero-click target certain victims including corporate executives, government officials, and journalists. But anyone using a smartphone is a possible target. These attacks cannot be spotted due to the lack of vulnerabilities. So the users have to keep the operating system along with the third-party software updated. Also, it is a must to give minimal permissions to apps that are being installed on the device.
Moreover, if you own a business and are afraid of the zero-click attacks on your company’s app, you can always seek IT consultations from top-notch companies orhire developersthat will help in developing applications with hard-to-creep-into programming languages where detecting an attack is efficient.
Article | January 21, 2021
People dealing in cybersecurity knows that it is a challenging market. A specifically designed business model is not there in cybersecurity on which you can market products and services. Over the past years, the B2B Cyber Security industry has witnessed immense growth and will continue in the future. The growth can be attributed to many aspects, including growing instances of cybercrime and the emergence of interconnected devices in the IoT revolution.
New security solutions are coming into the market every day. As a result, the demand for B2B digital marketersis also on the rise to keep with the unexpected growth in products, services, and competitors. To stand out from the competition, you need a sound cybersecurity product marketing strategy leveraging all digital channels.
You have to focus on various productive marketing tactics to reach, engage, and nurture all your potential clients as an ongoing process with all the relevant information about business and products. For example, the B2B cloud-security service provider,IBM Security, uses paid ad campaigns and webinars, which are excellent cybersecurity product marketing strategies. They could maketheir expertise and solutions stand out from the rest of the crowd with this excellent strategy.
Reading further will give you insights on how to market your cybersecurity products effectively to generate leads and boost profit.
Make your Marketing Effective with Unique Content
To demonstrate the effectiveness of your solutions and the significance of your cybersecurity, your company should ensure your content has real-world examples. This will make your content more influential. Apart from being data-driven and comprehensive, your content also should be unique. Credibility can be surly built up by revamping your content strategy.
You can create educational content that clearly shows how your product can help solve a real-life cybersecurity attack. Then, you may back it up with independent industry reviews,case studies, etc. Instead of reusing the same content, experiment with new content that describes and solves different cyber threats and relates it with your products and solutions.
The following types of content can be a practical part of your cybersecurity product marketing strategyat different points in the buyer’s journey:
In every stage of the cybersecurity buyer’s journey, blogs are great for attracting prospects. Developing some evergreen and universally relevant content will be highly useful. Describing topics about cybersecurity in your blogs, such as phishing, DNS encryption, will be a great thing for clients who have just started their research and want to learn more, starting from basics.
As CNI says, the mostcritical tactic for B2B companies iscase studies. These are exemplary and the best to engage leads who are already aware of their problems and know what solutions can solve them.
According to HubSpot, at least once a week, 75% of executives watch work-related videos on business websites. Additionally, 59% of executives prefer watching a video over reading text. So, it’s the best strategy to include videos in your cybersecurity product marketing efforts.
Explanatory videos will work the best to tell your potential cybersecurity product clients what your cybersecurity offerings are and why they could be the most valuable solution for their situations. Additionally, when you’re trying to target C-level executives, this can be a beneficial tactic. This is because they need more education regarding this.
You may also utilize various statistics on cyber-attacks, loss due to cyber-attacks, recovery expenses, and the value of cybersecurity solutions. Additionally, again, providing practical and real-life examples in your video will help you make the statistics more relevant and inject a sense of urgency into the minds of your potential clients.
Effective Email Marketing Strategy
Education and awareness are significant barriers to selling your solutions. Due to these barriers, it can often take a reasonable amount of time for a potential lead to reach the point where they can contact a B2B sales representative or request a demo. Meanwhile, it is your time to have a tactic to nurture these leads to move them to the next level of the sales funnel. It can be an effective email marketing strategy. It is a strategic and effective way to connectto those potential leads who have not decided to purchase your products.
However, with many emails in your potential client's inboxes, they may unsubscribe or delete your email if they don’t find your email content valuable and worthwhile. So make sure to analyze often and monitor your email marketing campaigns. Content, subject lines, images, and copy in your email should be practical and attractive regarding open and click-through rates. Flooding your prospects’ inbox with emails about various cyber threats they face may result in losing their interest in your emails as they may have desensitization towards your emails.
Staying connected with your prospects through email marketing is an effective cybersecurityproduct marketing strategy. First, however, be mindful of how many emails you are sending to your prospects.
The tremendous interactive session you can have online today with your potential client is webinars. It is an excellent way for you in the cybersecurity domain to connect with your potential leads.
The interactive element is a vital part of a webinar. Q&A session at the end of each webinar makes it more interactive where the participants can ask you questions and raise queries about the topic and your services. Accumulating all those questions asked by the attendees can be an excellent starting point for creating new content to address your audience's challenges.
These attendees now are interested in learning more about your products and services and the threats it protects against. They also might have engaged in some research. This means they will do further in-depth research and be more engaged with your presentation topics.
Thus, it is a valuable opportunity to demonstrate other helpful content or have a CTA for demo sign-ups. You can respond to the queries of the participants in a follow-up, even if your webinar is a pre-recorded one. This effective cybersecurity product marketing tactic will help you accumulate many potential clients and take them to the next stage of the salesfunnel.
Two significant goals can be accomplished through B2B paid campaigns:
• They help you get prospects to arrive at your demo request landing page
• They amplify your content marketing efforts
Content marketing amplification is possible through paid campaigns. Most cybersecurity marketers think that you do not mix inbound marketing and paid campaigns. But the truth is when you combine both, you end up with a very effective and powerful campaign. Once you start a paid campaign with your content, you will notice more excellent and quick results and get the best out of your developed content.
Getting prospects to request a demo is a major goal for any B2B cybersecurity marketer. Cybersecuirty paid marketing campaigns, as a successful cybersecurity product marketing strategy, help the marketer to accelerate the process.
The cybersecurity landscape has recently undergone many changes. Over the next five years, global demand for cybersecurity products and solutions will reach $167.7 billion. So, it calls for a remodeling of your cybersecurity product marketing strategynow more than ever to target and attracts more prospects to your business.
Frequently asked questions
How to start with cybersecurity marketing?
The best way to start your cybersecurity marketing is by educating your prospects about the potential cyber threats they may face in their business. In addition, you can educate them about the latest news in the industry regarding cybersecurity.
Why is cybersecurity essential for marketers?
Neglecting cybersecurity or taking it for granted may cause privacy risks for you and your clients. In addition, cyber threats can be detrimental for businesses.
How can marketing help to improve cybersecurity products?
While marketing, you may understand the quality of your product, competing with your counterparts in the market. Also, you may get feedback from potential customers. It calls for the necessity of product improvement.
"name": "How to start with cybersecurity marketing?",
"text": "The best way to start your cybersecurity marketing is by educating your prospects about the potential cyber threats they may face in their business. In addition, you can educate them about the latest news in the industry regarding cybersecurity."
"name": "Why is cybersecurity essential for marketers?",
"text": "Neglecting cybersecurity or taking it for granted may cause privacy risks for you and your clients. In addition, cyber threats can be detrimental for businesses."
"name": "How can marketing help to improve cybersecurity products?",
"text": "While marketing, you may understand the quality of your product, competing with your counterparts in the market. Also, you may get feedback from potential customers. It calls for the necessity of product improvement."
Article | January 21, 2021
The subject of how information security impacts different industry sectors is an intriguing one. For example, how does the finance industry fare in terms of information security compared to the health sector, or the entertainment business? Are there some sectors that face greater cyber-threats and risks than others? Do some do a better job of keeping data secure, and if so, how and why?A new study of credit management professionals has revealed that improving the quality of data and decision-making will be a top priority for the credit industry in the next three years. The research, from Equifax Ingnite in collaboration with Coleman Parkes, takes a deep dive into the views of credit management pros across retail, banking, finance and debt management/recovery sectors.