Redscan Warns of an Influx of Cyberattacks When Businesses Return to the Office

Redscan | May 27, 2020

  • Cyber-criminals could be poised to trigger a wave of attacks on businesses when workers return to offices and reconnect to corporate networks.

  • Redscan provided other recommendations to companies to tackle this type of threat, including updating anti-virus signatures, connecting all devices.

  • The cybersecurity firm said organizations need to take action to defend themselves against potential hackers lying dormant on employee devices.


Cyber-criminals could be poised to trigger a wave of attacks on businesses when workers return to offices and reconnect to corporate networks, Redscan has warned. As many countries such as the UK prepare to ease COVID-19 lockdown restrictions and allow more people to return to physical workplaces, the cybersecurity firm said organizations need to take action to defend themselves against potential hackers lying dormant on employee devices. There has been a substantial rise in threat activity over recent months, with cyber-criminals looking to exploit the sudden rise in remote working during the pandemic and the resultant lack of protection.


In this period, Redscan has observed a surge in activity such as malspam, external scanning attempts to identify weaknesses in the use of remote access tools and account login attempts from unknown locations. It therefore believes there could be an influx of attacks when staff reconnect to company networks after returning to their workplaces, with attackers ready to launch attacks including ransomware across a company network. In order to prevent this situation occurring, Redscan said firms should sanitize all endpoints on the return to the office as well as closely monitor networks for evidence of compromises. Redscan provided other recommendations to companies to tackle this type of threat, including updating anti-virus signatures, connecting all devices to remote networks and educating staff about the latest risks.



Learn more: LEVERAGING GREATER SOCIAL ENGAGEMENT FOR IMPROVED CYBER HYGIENE .
 

“During the COVID-19 pandemic there has been a steady stream of organizations reporting cyber-attacks. However, this is only likely to be the tip of the iceberg. Many more organizations are certain to have been targeted without their knowledge.”

~ George Glass, head of threat intelligence Redscan


Cybercriminals are taking advantage of the difficult situation at hand. There’s been roughly 6,000 coronavirus or COVID-19 themed domains registered over the past few weeks. These domains are 50% MORE likely to be malicious than other domains. Essentially, cybercriminals register these domains and trick unsuspecting victims into visiting them to download malicious software. People are afraid and uncertain now more than ever, which means they’re easier to trick into downloading information, updates or relief packages.

“As employees return to work post-lockdown and connect directly to corporate networks, organizations need to be alert to the possibility that criminals could be lying dormant on employee devices. ”


Here are some of the most common ways cybercriminals are leveraging the COVID-19 pandemic to wreak havoc and drain bank accounts: Phishing attacks containing alerts about the virus, information about cases in your area, or details to sign up for local financial benefits – often claiming to be from the CDC, WHO, or other governmental agencies. Phony domains set up to appear as video conferencing software websites, governmental agency websites, and other news and/or information websites offering downloads that contain malware. Alerts via email or text claiming to be purchase orders for masks, sanitizer, and other safety materials and products that have been ordered by the organization the victim works for – requesting a wire transfer for payment. People are working from home with minimal time to prepare in terms of cybersecurity measures to stay safe. People are adopting remote access and cloud-based technologies at an incredible rate around the world.


There is currently a whole business around RDP on the underground market and the current situation has amplified this behavior. To stay protected, it is essential to follow best security practices, starting with the basics, such as using strong passwords and patching vulnerabilities. RDP ports are a vital means for many businesses to enable their employees to work from home, as they allow communication with a remote system. RDP ports are often exposed to the internet, which provides opportunities for attackers. With the sudden requirement to have large proportions of their staff working from home, McAfee believes it is likely that many organizations brought these systems online quickly with minimal security checks in place. This led to a growth in attacks against RDP ports as well as an increase in the volume of RDP credentials sold on underground markets.


Learn more: NEW CYBER THREAT INDEX SHOWS INDUSTRIES ARE UNDER ATTACK IN UNCERTAIN TIMES .
 

Spotlight

Learn about the IBM Security Services Cyber Security Intelligence Index. With the latest analysis of cyber security attack and incident data from IBM's worldwide security operations this is a paper to provide you with a unique perspective on the current threat landscape.


Other News
DATA SECURITY

HYAS Infosec Announces General Availability of Cybersecurity Solution for Production Environments

HYAS | August 10, 2022

Leading security technology firm HYAS Infosec — whose proactive solutions ensure that businesses can keep moving full forward in our ever-changing world — today announced the general release of its newest product, HYAS Confront, a cybersecurity solution offering complete visibility into every corner of a production environment. HYAS will be demoing Confront at Black Hat USA in Las Vegas from August 8 to August 11. Production environments are increasingly becoming a target for bad actors, as they want their attacks to cause as much disruption as possible. Afterall, if a company’s production environment is rendered inoperable, its ability to generate income is shut down. HYAS Confront addresses this growing issue by giving DevSecOps teams complete visibility into their production environment. HYAS Confront finally gives them a definitive picture of which devices on their network are communicating with one another, which devices are sending traffic outside the network, and how often and to whom they are sending it. HYAS Confront also automatically identifies communication to known command and control servers as well as other risks and threats. “We have gotten an excellent response from our first customers, who began using the service during development and testing. “We are extremely proud of the solution we have brought to market and the vital role it fulfills in providing complete network visibility.” HYAS CEO David Ratner Most cybersecurity solutions on the market today focus on protecting the perimeter of your network, but unfortunately, regardless of the strength of your outward-facing security posture, you will be breached at some point. The numbers bear this out, with 97 percent of companies reporting having experienced a successful cybersecurity breach at some point. However, even if bad actors sneak past your perimeter security, they can’t hide from the foundational network monitoring provided by HYAS Confront. Once deployed, a process that usually takes less than 30 minutes, it establishes a baseline of normal, healthy network traffic. With this data, HYAS Confront can recognize aberrations from normal traffic patterns that could indicate a problem. When such an anomaly is discovered, Confront alerts administrators so they can take appropriate action. But the benefits of full production environment visibility doesn’t end with security. HYAS Confront can also reveal issues like misconfigurations, violations of policies or controls, and incomplete removal of malware after an attack. One of the most difficult aspects of incident response is ensuring that the environment is actually clean again, and HYAS Confront’s visibility can play a vital role in that process. It can also be a useful tool for understanding service assurance. This innovative solution integrates seamlessly with other network management and security infrastructure, working alongside them to enhance the value of these pre-existing investments. This improves overall network health, preventing problems down the road and giving businesses the confidence to move forward at full speed. “Production environments are so critical to a company’s ability to function, and unfortunately, no matter how strong your perimeter is, bad actors will eventually find a way in,” said Ratner. “HYAS Confront’s distinctive ability to detect anomalies within your production environment ensures that even in these cases, you can uncover the problem before it does damage, letting businesses operate confidently and without fear of costly interruptions.” About HYAS HYAS is a valued partner and world-leading authority on cyber adversary infrastructure and communication to that infrastructure. We help businesses see more, do more, and understand more about the nature of the threats they face — or don’t even realize they are facing — in real time. HYAS’s foundational cybersecurity solutions and personalized service provide the confidence and enhanced risk mitigation that today’s businesses need to move forward in an ever-changing data environment.

Read More

DATA SECURITY,PLATFORM SECURITY,WEB SECURITY TOOLS

ReasonLabs Launches Free Online Security Tool to Power Secure Web Experience For Millions of Global Users

ReasonLabs | August 24, 2022

ReasonLabs, a leading cybersecurity company providing enterprise-grade protection to users worldwide, has launched its newest product, Online Browser Security. The product provides real-time, 24/7 protection against malicious URLs, phishing, harmful extensions, suspicious downloads, intrusive cookies and trackers, unauthorized notifications, and pop-ups. It is currently available worldwide as a free download. Online Browser Security is seamlessly integrated with RAV Endpoint Protection, ReasonLabs' leading antivirus software built on a multilayered machine-learning engine, to keep personal data safe from security threats. Bringing all the elements of a next-generation antivirus solution to the web browser, the solution allows consumers to use the internet with confidence and peace of mind. Powered by an autonomous protection engine, users can choose their own protection settings and let the endpoint protection do the work for them. It comes complete with a dashboard to stay informed regarding any identified and blocked online threats. Scheduled and user-initiated scans are also available at the touch of a button. "Our mission at ReasonLabs is to provide every home user with the same degree of cybersecurity protection that large companies receive. "In our connected world, everyone deserves the highest level of protection, and today, we have added another solution that will safeguard users in real-time, 24/7. As an additional layer to our security platform, RAV Online Security offers next-generation protection for all next-generation cyber threats." Kobi Kalif, ReasonLabs CEO Key features of RAV Browser Security include a malicious URL blocker, the ability to disable harmful extensions, and the blocking of suspicious cookies and ad trackers. The product also monitors all file downloads and comes equipped with an advanced threat scanner, and has notification control. These features can be easily managed through the easy-to-use RAV Online Security dashboard. Optimizing users' online experience, Online Security is a key component of ReasonLabs' advanced breach prevention product suite, which also includes RAV EDR, RAV VPN, RAV Safer Web, and FamilyKeeper, its parental control solution. About ReasonLabs ReasonLabs is a global pioneer in cybersecurity detection and prevention. Powered by machine learning, ReasonLabs' cutting-edge technology is revolutionizing consumer-focused cybersecurity, bringing enterprise-grade protection into the homes of tens of millions of users worldwide. Its innovative engine scans over 2 billion files in 180 countries a day, delivering fast, comprehensive data while providing 24/7 real-time threat detection. Founded in 2016, ReasonLabs is based in New York and Tel Aviv.

Read More

ENTERPRISE IDENTITY,PLATFORM SECURITY,SOFTWARE SECURITY

Safe Security Introduces Free Assessments to Provide Trusted Financial Risk Calculations for Cyber Attacks and Cyber Insurance Discussions

Safe Security | August 17, 2022

Safe Security, a global leader in cybersecurity risk quantification and management, today announced two industry-first assessment tools to empower organizations to make holistic financial decisions based on their actual cyber risk. At no cost, organizations can access Safe Security’s Interactive Cost Calculator, as well as the Cyberinsurance Assessment, which are designed to enable data-driven discussions about risk and coverage requirements. “Executive leadership from the CEO and board members, to CISOs, risk teams, and CFOs are asking questions like, ‘how much will a cyber attack cost us?’ Or, ‘how much should our cyber insurance cost?’ Today, those leaders either do not have a financial figure at all or possess a financial figure from a ‘black-box’ approach that they can’t explain or trust,” said Saket Modi, co-founder and CEO of Safe Security. “Based on our research, Safe Security is offering organizations the opportunity to understand the financial impact of a cyber attack with full visibility into how the assessment is calculated so you can trust and explain the numbers. Knowledge is power, and our mission is to arm you with an unbiased assessment that can be used for risk discussions and insurance negotiations.” Interactive Cost Calculator for Cyber Attacks Safe Security’s Interactive Cost Calculator for cyber attacks is a free, tunable calculator that enables organizations to understand their potential financial risk due to a cyber attack, such as ransomware. The easy-to-use assessment gathers specific inputs about the company, and provides a cost estimate based on Safe Security’s cost model that takes into account cost drivers associated with security incidents. The output can be customized to the parameters of an organization to further refine the estimate. Inside-Out Cyberinsurance Assessment Safe Security’s Inside-Out Cyberinsurance Assessment helps companies better understand their cyber health and reduce premiums. Cyber insurance premiums keep rising despite increasing cybersecurity investments. Companies can gain specific guidance on how their cybersecurity risk posture compares to others in the same industry, how much coverage they need, and the top actions they should take to ensure a successful cyber insurance renewal. The SAFE platform runs a cyber risk assessment based on the following data points: API feeds from the organization’s internal technology environment Maturity of the organization’s cybersecurity policies and products About Safe Security Safe Security is a leader in cybersecurity and digital business risk quantification management, with a mission to build a safer digital future. Safe’s cyber risk quantification and management (CRQM) platform enables organizations to manage cyber risks in real-time. Its platform automatically collects signals from inside and outside a company’s environment to give the company-specific cyber risk rating, or SAFE Score, the financial impact of a potential breach, and an action plan. This enables organizations to have a common language across teams - from the board all the way down to an analyst - to align with a consistent risk metric. Other benefits include justifying investments in cybersecurity and purchase of cyber insurance for the organization.

Read More

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

PlainID, The Authorization Company™, Announces thought leadership collaboration with The Cyber Hut

PlainID | September 05, 2022

PlainID, the Authorization Company™, announces today the release of "Build vs Buy: Guide to Evaluating Authorization" in collaboration with Simon Moffatt, founder and analyst of The Cyber Hut. The increase in remote work and digital commerce has created a proliferation of digital identities which demand secure, frictionless access to applications and the underlying data. The guide is designed to address and inform on key criteria when considering whether to build and maintain authorization policies "inside" an application vs leveraging the benefits of an external authorization engine. The need for functionally rich applications capable of operating in a digitally optimized computing architecture has motivated enterprises to consider migrating their legacy, internally developed policies to an Authorization Platform such as PlainID. "Externalized Authorization is now an essential part of the security arsenal - foundational for agile business operations - allowing the modern enterprise to share data, assets and applications to a range of new stakeholders," said Simon Moffatt. "This guide aims to empower the buyer on a range of topics associated with next generation authorization. It will hopefully be a great asset to the security executive and practitioner alike." Numerous industry analysts are recommending externalizing authorization and authentication as a means to increase an enterprise's security resilience and a prerequisite to creating a Zero Trust architecture. "PlainID is more than delighted to collaborate with Simon and The Cyber Hut. We strongly believe in the virtue of thought leadership and the importance of this subject matter. The power and broad value of authorization are just beginning to be realized, and our hope is that this guide helps firms make informed decisions." Tom Ammirati, PlainID's Chief Revenue Officer PlainID helps businesses advance and modernize by simply and securely connecting identities of all types with the digital assets they need to do their jobs, accomplish tasks at scale, and conduct digital commerce. By making authorization decisions simple, smart, granular, and contextual, PlainID helps enterprises achieve a positive and measurable impact on user experience, enterprise security, and data privacy. Powered by policy-based access control (PBAC), leading-edge features include PlainID's Centralized Management Dashboard, which provides users the ability to create and manage enterprise-wide authorization policies from a central point while maintaining distributed enforcement capabilities. The Platform provides out-of-the-box PlainID Authorizers™ that address common authorization patterns for API gateways, microservices, data, and applications. About PlainID PlainID Inc. The Authorization Company™, is the recognized leader in Authorization as a Service powered by Policy Based Access Control (PBAC). PlainID's simple, straightforward solution to authorization management enables organizations to create, manage and enforce authorization policies across an enterprise. By securely connecting identities to digital assets via PlainID Authorizers, firms can meet the digital demands of user journeys, enable zero trust architectures and provide data security. The PlainID Authorization Platform enables rapid business growth by connecting new and legacy technologies with the latest and most advanced authorization features.

Read More