New York’s cybersecurity regulations may seem burdensome, but they’re necessary

| December 16, 2016

article image
In recent years, more and more companies across a range of industries have fallen victim to cyber attacks, including Sony Pictures, Yahoo!, and LinkedIn; however, we have yet to see a successful large scale breach of a major U.S. financial institution. Given the vast influence that large banks hold over both an individual’s personal finances and the greater U.S. economy, there must be systems in place to help prevent cyber attacks, alert customers in the event of a breach, and allow institutions to recover following an attack. In September, New York Gov. Andrew Cuomo and New York’s top banking regulator wisely proposed new regulations that would require financial institutions, including banks and insurance companies, to follow a new set of cyber protection guidelines. (There are many exemptions for banks that have fewer than 1,000 customers in each of the last three calendar years, less than $5 million in gross annual revenue for each of the past three fiscal years, and less than $10 million in year-end total assets.)

Spotlight

we45

we45, Inc is an Application Security company with focused expertise in the areas of DevSecOps, Testing, Advisory and Training. We engage with our clients across market verticals in helping them implement and maintain a relevant and robust application security landscape. Our Application (Web/ Mobile) and Network security assessments have been widely lauded by global organizations. we45's DevSecOps and Security Automation Framework helps technology product companies induce security in the DevOps lifecycle, thereby enabling them increase throughput with reduced operational resources. Our custom security automation suite is specifically designed to enable organizations implement a seamless, repeatable and customized application penetration testing practice.

OTHER ARTICLES

How the IIoT can subdue cyber security challenges met by software adoption

Article | February 25, 2020

Matt Newton, senior portfolio marketing manager at AVEVA, discusses how IIoT can best cyber security challenges met through software adoption. According to Gartner’s 2019 Industrial IoT Platforms Magic Quadrant report, by 2023 30% of industrial enterprises will have full, on-premises deployments of IIoT platforms. IIoT platforms and software adoption is rapidly increasing – up 15% in 2019 – and this will undoubtedly continue to grow as we progress through the new decade. From enhancing operational performance to improved business processes, adopting new technology and software capabilities is vital for business success in today’s industrial sector. However, when it comes to adopting software and technology, integrating new systems with existing legacy systems in the industry can be a challenge.

Read More

Cybersecurity in Digital Marketing: Tips to Overcome Challenges

Article | August 9, 2021

No matter what business you run, digital marketing is crucial to reach out to people and generate leads today. Businesses of all sizes rely on digital marketing to take the business to the next level.Digital marketing in many forms, such as search engine optimization, social media marketing, email marketing, content marketing, and online advertisements, have been utilizing to bridge the gap between business and customers. Technology is evolving and is expected to be transformed further. As technology gets improved every second, online advertising and marketing opportunities are also getting amplified. However, the villain, cyber threats and attacks, can jeopardize your business dreams and opportunities. Yes, alarmingly, cybersecurity in digital marketing has become a serious concern today. The more the opportunity you have in digital marketing, the more you become vulnerable to cyber threats and attacks. Cybersecurity in Digital Marketing-Importance Cybersecurity is very significant as digital marketing heavily depends upon data and information, which are sensitive and confidential to your business. This confidentiality is to be maintained to retain your customers. If your business is affected by cyber-attacks, your customers lose trust in you and your business. That is because the customers think their data and information could be compromised or stolen. Therefore, you need a strong cybersecurity practice to save you and your customers from breaches and malware attacks. Apart from information loss, financial loss, loss of brand reputation, etc. too, can happen. Ultimately you may end up witnessing a crippling loss in your business. Thus cybersecurity in digital marketing is essential as threats and attacks are detrimental to your business. Cybersecurity in Digital Marketing- Challenges As all businesses are going digital now, cyber threats are expected to increase. As a result, according to Gartner, the information security market is projected to grow to US$170.4 billion in 2022. This warns businesses to be extra alert regarding the startling rate of cyberattacks. Organizations have to be ever ready with solutions. There are a lot of challenges faced by cybersecurity in digital marketing. Email marketing is an essential and powerful part of digital marketing. Email marketers face the challenges, such as phishing. Small businesses are the main targets of phishing activity as they are unaware of it. Hackers may send spam using your email accounts with virus-infected emails. Occurring continuously, the server may backlist or block your site, affecting your email campaign. Customers will lose trust in you. Content marketing is also vulnerable to cyber-attacks as hackers are well aware of content management systems (CMS) and how it works. Therefore, they can easily hack it and distribute malware. In addition, social media marketing is vulnerable to identity theft. In case a hacker cracks your password, he can do unimaginable damages to you and your business. The hacker can do unauthorized downloads, share your confidential data and information, and even exploit your customers. The above-mentioned are some of the cybersecurity challenges in digital marketing. In addition, e-commerce and customer relationship management (CRM) systems are also prone to cyberattacks and threats. Therefore, it is essential to take necessary cybersecurity measures to overcome becoming the prey of cybercriminals while performing digital marketing activities online. Overcoming Cybersecurity Challenges in Digital Marketing As businesses began to use digital marketing widely to reach out to customers successfully, organizations started getting exposed to cybersecurity threats. The consequences of breaches and malware attacks can be far-reaching. Therefore, it's high time for businesses to be ready to tackle these cybersecurity issues in digital marketing. The following tips may help companies to do it proactively. Training Your digital marketing executives are vulnerable to cyberattacks, especially those who are handling email marketing. To protect your campaigns, train all how to recognize a phishing email. Also, encourage them to use spam filters and strong passwords. SSL to Secure CRM Installing an SSL(Secure Sockets Layer) protocol on the website makes your data transfer secure and encrypted, eliminating the chances of hackers getting access. Also, your Customer Relationship Management (CRM) system should have strict data security policies. It helps you keep your data protected while your staff access sensitive data. Regular Data Backup Data loss can happen in many circumstances, such as ransomware attacks, hard drive damage or crash, or malware hijacking. These data losses will result in losing you a lot of money. Thus, encourage your staff to backup all data regularly in a different location other than your system. It will protect 100% of your data in case of cyber-attacks and system malfunction. Integrating Security Features As part of content marketing, businesses use Content Management Systems (CMS) to upload, edit easily, and publish different forms of content. However, as hackers are very familiar with CMS, they can damage your reputation by distributing malware if they hack your site. Thus, it is very much crucial to integrate security features in your CMS platform. In addition, many vulnerabilities could be closed off by installing security plug-ins. The following security measures also can be taken regarding your CMS. Use strong password Change the default admin login URL Do not use public Wi-Fi networks to access your CMS These cybersecurity measures in digital marketing are necessary as content marketing is part and parcel of the process. Regular audits Ensuring cybersecurity is a team effort and is a continuous process. The set-and-forget policy will not work with cybersecurity. Your company's measures taken regarding cybersecurity in digital marketing have to be audited regularly to ensure your cybersecurity goals are met correctly. The audit should be done at least once a quarter. Summing Up It is a time-consuming process to devise strategies to protect businesses from cyber-attacks and threats. However, unless you take necessary measures in time, your business can be jeopardized, losing clients, money, and reputation. Cybersecurity threats in digital marketing are expected to increase as technology is getting transformed every second. A stitch in time saves nine! Frequently Asked Questions Why is cybersecurity so important in digital marketing? Cybersecurity benefits your brand by protecting your website and each of your digital marketing activities. It saves all your data as well as the data of your clients. However, cyber-attacks can be detrimental to your business. What is the biggest problem in digital marketing? Apart from standing out from the competitors, the biggest problem in digital marketing is cyber-attacks and threats. Unfortunately, cyberattacks can jeopardize your business. { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{ "@type": "Question", "name": "Why is cybersecurity so important in digital marketing?", "acceptedAnswer": { "@type": "Answer", "text": "Cybersecurity benefits your brand by protecting your website and each of your digital marketing activities. It saves all your data as well as the data of your clients. However, cyber-attacks can be detrimental to your business." } },{ "@type": "Question", "name": "What is the biggest problem in digital marketing?", "acceptedAnswer": { "@type": "Answer", "text": "Apart from standing out from the competitors, the biggest problem in digital marketing is cyber-attacks and threats. Unfortunately, cyberattacks can jeopardize your business." } }] }

Read More

New Cyber Threat Index Shows Industries Are Under Attack in Uncertain Times

Article | April 16, 2020

It has been more than a month since businesses around the world started to implement contingencies in response to the Coronavirus. The Cyber Threat Index Report by Imperva Research Labs tracks changes in traffic and attack trends across multiple industries and countries. This month’s edition looks at how COVID-19 is affecting all industries across the globe. Our researchers have found that while some sectors are experiencing a dip in the number of attacks, on the whole they remain consistent. As the chart below shows, certain sectors have experienced a significant increase in attacks over the past few months: attacks on gaming are up seven percent, food & beverages are up six percent, and financial services are up 3 percent.

Read More

Top Three Cybersecurity Threats You Should Mitigate Before It Is Too Late

Article | December 15, 2020

There are three significant and disruptive cybersecurity threats that are catching organizations of all types and sizes by surprise: Ransomware; Cloud misconfigurations; and Supply chain backdoors. Let me explain with recent examples and guide you on what you can do to avoid making other’s mistakes and falling victim to the threats. Let’s start with ransomware. It is one of the most disruptive risks facing your organization today. Why? Because it can literally bring your operations, no matter who you are, to a standstill and inflict significant cost, pain and suffering. Just look at the recent example of one organization. It was infected with ransomware, and IT systems were shut down for several weeks, bringing operations to a standstill. It had to gradually re-start systems over several more weeks. It estimates it will cost around $95 million from lost sales, recovery and remediation, impacting profitability. Also, it announced it will not be able to attain its growth plans for the year. Take another recent example. A three-hospital system was infected and IT systems were shut down and it could not accept any incoming patients for several days. It had to operate using paper, until gradually the IT systems were re-started over several days. Fortunately, in this case, the incoming patients turned away did not suffer any loss of life and were able to be diverted to other hospitals timely, but it could have been tragic. No organization is immune to ransomware and it can rear its ugly head anytime and inflict severe pain. There are many variants and each can be tweaked easily by the attackers to evade the defense. The Ryuk ransomware is an example of one that has already inflicted significant pain to hundreds of organizations this year in the U.S. and across the globe. Previously, the SamSam ransomware attacked a variety of organizations in the U.S. and Canada, and provided over $6 million in ransom payments and inflicted over $30 million in losses. Prior to that, NotPetya ransomware rapidly inflicted hundreds of organizations in various parts of the world, and caused over $10 billion in damages. The attackers are seeing that with ransomware it is quicker and easier to make the intrusion, and encrypt some of the data than try to exfiltrate all of it. They are asking themselves, why take all the time and trouble to look for all of the data and try to steal it, when only some critical systems and data can be locked up, until a ransom is paid? They are seeing that with ransomware there will be immediate adverse impact since the victim will not be able to access critical data and systems, and will not be able to operate. So, there is high probability the ransom will be paid to stop the pain and suffering, especially if the victim has cyber insurance in place. The organization is likely to use the insurance policy to pay the ransom, rather than continue to have its operations disrupted or shut down. They are also seeing that while most organizations have put in place various controls to prevent and detect data theft, they have not placed an equal weight to preventing and detecting ransomware. Most organizations have a lot of data and given all of the data thefts that have occurred and continue to occur and reported in the press, the bias has been to focus on data theft. But ransomware risk cannot be ignored or approached less seriously. Imagine that you are infected with ransomware and your people cannot access documents, files or systems, and operate. All critical files and systems are locked out from the ransomware encryption, and a ransom payment is demanded by the hacker for the keys to unlock the encryption. What if, it will take you days, weeks or months to recover? What impact would it have on your organization? You may think that you will be able to recover quickly from back up files and systems, but are you sure? The new ransomware variants are devised to hunt down and delete or encrypt backup files and systems also, and in some cases, first, before encrypting rest of the files and systems. The organization that was recently infected that estimates $95 million in financial impact from the ransomware thought it had the risk under control, until it was hit with the ransomware and realized it was not prepared to manage the risk. Now, let’s move to the threat from cloud misconfigurations. You are most probably in the cloud completely or partially. Whether you have completely outsourced your infrastructure and services to a cloud provider or are utilizing one partially, remember, ultimately, you own the cybersecurity and that you are responsible for security in the cloud, while the cloud provider is responsible for security of the cloud. While the cloud provider will provide perimeter security, you are responsible for security of your data, IP and other assets in the cloud, and are equally susceptible to attackers in the cloud as you are on the premises. Even if any of the “big six” cloud providers, such as Amazon Web Services or Microsoft Azure or others, provide the cybersecurity, attackers can exploit weak links in the chain, break in and steal data or cause other harm. A common weak link in the chain are misconfigurations of the various systems that the cloud provider makes available as part of its service. You are responsible for all of the configurations, not the cloud provider. So, if your team does not take the time to fully understand all of the configurations that are necessary and complete them timely, security holes will arise and remain open for the attackers to exploit. Just look at the recent example of an organization that fell victim where the data of over 100 million customers was stolen. This organization was using one of the “big six” cloud providers, but missed making all of the necessary configurations. A former employee of the cloud provider, who was familiar with the systems and configurations, discovered a misconfiguration in a web application firewall and exploited it to break in. The attacker then was able to query a metadata service to obtain keys and tokens, which allowed the attacker to query and copy storage object data and eventually exfiltrate it. This was a case where configuration errors in a web application firewall coupled with unrestricted metadata service access and other errors handed the attacker the keys to the kingdom for the theft of 100 million customers data. Other common cloud misconfigurations that create opportunities for attackers to exploit include: Unrestricted in bound access on uncommon ports Unrestricted outbound access Unrestricted access to non-http/https ports Unrestricted metadata service requests Inactivate monitoring of keys and tokens You may think that you do not have any misconfigurations in your cloud environment, but how do you know? The organization that recently lost 100 million customers data thought it had strong security in its cloud infrastructure, until it was hit with the data theft and realized it was not prepared to manage the risk. Now, let’s move to the threat from supply chain backdoors. No matter what type of organization you are or your size, you most probably have a supply chain, comprised of independent contractors, vendors or partners. Each of these could be the weakest link in the chain. In other words, the attackers may find that one of your suppliers may be easier to break into first because of weaker cybersecurity and may have privileged access to your organization, given their role and responsibilities. So why not first attack the weaker supplier, steal their privileged user credentials and use it to break into your organization and eventually attain the ultimate objective, steal data or commit other harm? Or they may find that one of your suppliers has part of your data in order to provide the outsourced service, so they can steal the data simply by breaking into the supplier with the weaker cybersecurity, so no need to attack you directly. There are many examples of supply chain risk, such as with a government agency, where the credentials of a background check vendor were first stolen to access the agency’s systems, then to move laterally and find other unprotected privileged users credentials to access databases and steal data of 21.5 million individuals, including fingerprints data of 5.6 million individuals. But just look at the recent example of an organization that had outsourced billing and collections to a supplier. This is a case where the attackers did not have to attack directly. In this case, attackers broke into the supplier and injected malicious code into the payments webpages managed by the supplier and stole credit card, banking, medical and other personal information, such as social security numbers, of 11.9 million consumers. The attackers had access to the supplier’s system for eight months, during which it skimmed the data being input by consumers on the payments webpages. So, while your cybersecurity may be in good shape, the weakest link in the chain may be one of your suppliers, who may unwittingly provide the attackers the backdoor into your organization or to your data or IP. So, ransomware, cloud misconfigurations and supply chain backdoors are three significant and disruptive threats facing your organization today that you should mitigate. What c

Read More

Spotlight

we45

we45, Inc is an Application Security company with focused expertise in the areas of DevSecOps, Testing, Advisory and Training. We engage with our clients across market verticals in helping them implement and maintain a relevant and robust application security landscape. Our Application (Web/ Mobile) and Network security assessments have been widely lauded by global organizations. we45's DevSecOps and Security Automation Framework helps technology product companies induce security in the DevOps lifecycle, thereby enabling them increase throughput with reduced operational resources. Our custom security automation suite is specifically designed to enable organizations implement a seamless, repeatable and customized application penetration testing practice.

Events