Cisco Annual Security Report (CASR)

NONE | April 26, 2016

article image
Paying the Price for Gaps Between Defenders' Intent and Action: Despite advances by the security industry, criminals continue to break through security defenses. And attackers now realize that bigger and bolder attacks are not always better. New threat intelligence and trend analyses reveal how attackers take advantage of the gaps between the defenders' intent and action. Such lapses leave attackers free to conceal malicious activity, evade detection, and accomplish their mission.

Spotlight

Secure Network Technologies, Inc.

Secure Network Technologies, Inc. is a full service information security firm based out of Syracuse, NY. Secure Network offers a wide range of security and investigative services including: network penetration testing, digital forensics, social engineering, application security assessments and physical security testing. Secure Network has been offering superior security services since 1997 to clients all over the United States and internationally.

OTHER ARTICLES

Noxious Zero-Click Attack: What Is It And How To Avoid It

Article | January 19, 2021

For years, we have been told that cyber-attacks happen due to human-errors. Almost every person has stressed about training to prevent cyber-attacks from taking place. We have always been on the alert to dodge errant clicks or online downloads that might infect devices with security threats. However, not all attacks need a user’s oversight to open the door. Although avoiding clicking on phishing emails is still significant but there is a cyber threat that does not need any human error and has been in the recent news. It is known as Zero-Click attack where some vulnerabilities can be misused by hackers to launch attacks even without interaction from the victim. Rather than depending on the hardware or software flaws to get access to the victim’s device, zero-click attacks eliminate the human error equation. There is nothing a victim can do once coming into the limelight of the hacker. Also, with the flourishing use of smartphones around the world that entails all the personal information and data, this thread has expanded enormously. How Zero-Click Attacks Occur? The core condition for successfully pulling off a zero-click is creating a specially designed piece of data which is then sent to the targeted device over a wireless network connection including mobile internet or wifi. This then hit a scarcely documented vulnerability on the software or hardware level. The vulnerability majorly affects the messaging or emailing apps. The attacks that have begun from Apple’s mail app on iPhone or iPad, have now moved ahead on Whatsapp and Samsung devices. In iOS 13, the vulnerability allowed zero-click when the mail runs in the background. It enables attackers to read, edit, delete, or leak the email inside the app. Later these attacks moved to Samsung’s android devices having version 4.4.4 or above. The successful attacks provide similar access to the hackers as an owner, entailing contacts, SMS, and call logs. In 2019, a breach on Whatsapp used the voice call functionality of the app to ring the victim’s phone. Even if the victim didn’t pick the call and later deleted it, the attacks still installed malicious data packets. These grants access to the hacker to take complete control of call logs, locations, data, camera, and even microphone of the device. Another similar attack had happened due to the frangibility in the chipset of WI-FI that is used in streaming, gaming, smart home devices, and laptops. The zero-click attack blooms on the increase of mobile devices as the number of smartphones have reached above 3 billion. How To Avoid Zero-Click Attacks? Most of the attacks of zero-click target certain victims including corporate executives, government officials, and journalists. But anyone using a smartphone is a possible target. These attacks cannot be spotted due to the lack of vulnerabilities. So the users have to keep the operating system along with the third-party software updated. Also, it is a must to give minimal permissions to apps that are being installed on the device. Moreover, if you own a business and are afraid of the zero-click attacks on your company’s app, you can always seek IT consultations from top-notch companies orhire developersthat will help in developing applications with hard-to-creep-into programming languages where detecting an attack is efficient.

Read More

CISOS PARTICIPATE IN CYBER WARGAMES TO HONE RANSOMWARE RESPONSE PLANS WITH EC-COUNCIL

Article | March 2, 2020

EC-Council, leading global information security certification body, conducted a table-top, cyber wargame among top cybersecurity executives in Tampa, Florida. The sold-out session, “CISO wargame,” included 27 senior executives from the largest managed IT service providers in the United States. The event presented the security experts with a simulated incident where an organization is hit by a ransomware attack. Participants had to work to contain the damage of the attack, which grew more complicated as the 4-hour exercise unfolded. Participants were tasked with deciding whether to pay a ransom and use ransom negotiators as well as to communicate with employees, stockholders, and the media about the breach.

Read More

Covid-19 cyber security threat to impact businesses

Article | April 1, 2020

With millions of employees having to work from home, companies are having to look at how to keep as many business-critical functions running as possible while at the same time maintaining adequate security. “In the last week alone, we have seen phishing emails go from 25,000 a day to 125,000 – a 500 per cent increase – which means the risk is real," explains Andrew Jackson, CEO of Intercity Technology. "Whilst firewalls included within domestic broadband routers are considered sufficient for personal use and occasional homeworking, they’re not necessarily capable of withstanding prolonged periods of remote working from a large proportion of the workforce, which is why we are seeing more businesses and their employees become the targets of malicious hackers. "Just because employees are now home based doesn’t mean that security and privacy regulations such as GDPR are null and void and therefore, working closely with a trusted IT security partner is vital to help mitigate against any potential risks.

Read More

Security by Sector: Medical IoT Gets Much Needed Dose of Cybersecurity

Article | February 20, 2020

The subject of how information security impacts different industry sectors is an intriguing one. For example, how does the finance industry fare in terms of information security compared to the health sector, or the entertainment business? Are there some sectors that face greater cyber-threats and risks than others? Do some do a better job of keeping data secure, and if so, how and why? Information security risks and challenges in the healthcare industry are well documented and much maligned. There are several reasons why the healthcare sector is particularly vulnerable, but one of the chief causations is the high amount of connected yet insecure devices commonly used within hospitals, clinics and medical centers. For example, a report from researchers at healthcare cybersecurity company CyberMDX discovered that connected medical devices are twice as likely to be vulnerable to the BlueKeep exploit compared to other devices on hospital networks.

Read More

Spotlight

Secure Network Technologies, Inc.

Secure Network Technologies, Inc. is a full service information security firm based out of Syracuse, NY. Secure Network offers a wide range of security and investigative services including: network penetration testing, digital forensics, social engineering, application security assessments and physical security testing. Secure Network has been offering superior security services since 1997 to clients all over the United States and internationally.

Events