Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.
Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.
Five reasons why COVID-19 will bolster the cyber-security industry
https://www.scmagazine.com/home/security-news/news-archive/coronavirus/five-reasons-why-covid-19-will-bolster-the-cyber-security-industry/
Excerpt:
At the end of the day, more people will become even more dependent on the Internet and will unquestionably require safety of their data, privacy and a sense of control over their digital ecosystem. In light of the multidimensional digitalisation, cybersecurity companies now have a boundless opportunity to embody their innovations and leverage creativity for a sustainable benefit of the modern society.
==================================================================
https://www.wavesys.com/wave-alternative
The IT perimeter is gone
With tablets, smartphones, and cloud applications, your employees can access sensitive data anytime, from anywhere. Indeed, around 70 percent of security breaches and data thefts are inside jobs. Meanwhile, the hackers only get better: advanced persistent threats (APTs) appear as normal traffic, and malware can go unnoticed for weeks.
It’s a new world, one without borders. Yet most organizations are still trying to protect their data with the same old firewalls and antivirus software. It’s not working. We refer you to the headline-making breach of the week.
You have to start with the device
Wave has an alternative: security that’s built into each and every device.
We’re talking about hardware: self-encrypting drives (SEDs), which protect data when a device is stolen or lost, and trusted platform modules (TPMs), or embedded security chips. Both go in at the factory, and increasingly, both are standard. They make it possible for you to monitor and control each individual device and its data, no matter where it is. But you need software to turn on and manage your SEDs and TPMs. Wave makes that software.
We’ve been refining comprehensive, centralized management of hardware-based security longer than anyone else. More than that, we’ve shaped the field as a founding member of the Trusted Computing Group, the not-for-profit that develops and promotes industry standards for the hardware.
Security that’s confirmed, not assumed
With Wave, you’ll know that you’re secure. Because we start with the individual devices, you get a broad, deep view of your network. You can see exactly who’s on it, with what devices and what apps, at any given time. Just for example, if Bob goes home and tries to log onto Facebook with the company laptop, Wave can stop him.
A big piece of this heightened security is device authentication. Traditional two-factor authentication requires what amounts to two user IDs. But by using the TPMs inside your devices, Wave can confirm the identity of not only users, but also the devices they’re on. Combine that with fast, enforced encryption of sensitive data via your SEDs—all easily managed with Wave software—and your data is protected from the full range of modern risks: device theft, missent emails, flash drives, portable hot spots … even (and no one else can say this) hardware keyloggers. Not to mention Bob.
Do we need to say that with Wave, compliance is no problem?
Start closing your security gaps today, with what you’ve got
You might be surprised to hear that 90 percent or more of your computers probably already have TPMs. Mobile devices are catching up fast. SEDs are newer, but you probably have a bunch of those too. Machines that don’t have them can often be outfitted at little to no extra cost. So you’ve got some or all of the hardware. All you need to do is turn it on with Wave.
It’s almost as easy as it sounds. TPMs and SEDs are built to open, vendor-neutral industry standards, and so are Wave solutions. That means Wave works on your existing mix of hardware, across platforms, and will evolve with you. It’s part of what makes the Wave alternative not only more secure, but also simpler and cheaper. Total cost of ownership for Wave data protection can be almost half that of a traditional software-based system.
Questions? Read on, or contact our sales department.
==================================================================
See all the other features of Wave VSC 2.0 below. Wave can save corporations/organizations in many ways!!! Please pass along information that may be helpful to others.
==================================================================
https://www.wavesys.com/products/wave-virtual-smart-card
J.Crew says year-old breach exposed customer account info
https://www.scmagazine.com/home/security-news/j-crew-says-year-old-breach-exposed-customer-account-info/
J.Crew notified a group of customers that an unauthorized third-party accessed their accounts nearly a year ago using their login credentials and obtained personal information, including the last four digits of payment card numbers, expiration dates, card types and billing addresses as well as order numbers, shipping confirmation numbers and shipment status.
In a filing with the California Attorney General’s Office, J.Crew said it had disabled affected accounts and directed customers to contact the J. Crew Customer Care Center to reset their passwords. “We do not have reason to believe that the unauthorized party gained access to any additional information within your account,” the company said in the notification.
“For users, there is nothing good about the credential stuffing attack at J. Crew, but there are some useful lessons to be learned,” said Jonathan Knudsen, senior security strategist at Synopsis, calling for users to practice good cyber hygiene, including changing the password on other sites.
Because J.Crew didn’t reveal the attack publicly until almost a year after it occurred, Knudsen said hackers may have already used the information in other attacks.
“Businesses face an even higher risk when employee data appears as part of a credential dump or account sale, particularly if employees have used corporate addresses to sign up for personal services,” Emily Wilson, vice president of research at Terbium Labs, maintained. “Corporate contact details stand out starkly against consumer details in a big credential leak, putting that organization at an increased risk for phishing or direct account takeover, especially if employees are re-using passwords between corporate and professional accounts.”
She explained that “a set of corporate credentials in a third-party breach is an open invitation to walk straight into an employee account – and a corporate network by extension.” Businesses, she said, “need to know if and when their information appears online, regardless of the original source of the leak. Even if it’s not your breach, it’s still definitely going to be your problem.”
==================================================================
The third-party would need the computer (device-TPM) to access an employee's information and corporate network with Wave VSC 2.0!!!
ANOTHER situation where a company (J.Crew) COULD HAVE BENFITED IN A BIG WAY BY USING Wave VSC 2.0!!!
==================================================================
https://www.wavesys.com/
https://www.wavesys.com/products/wave-virtual-smart-card
https://www.wavesys.com/virtual-smart-card-2.0-from-wave
Ex-DHS inspector general indicted for allegedly stealing government software
https://www.cyberscoop.com/fomer-inspector-general-indicted-charles-edwards/
Federal prosecutors on Friday announced charges against the former acting inspector general of the Department of Homeland Security for allegedly stealing proprietary software from the watchdog and trying to profit from it.
Charles K. Edwards, who served as acting DHS inspector general from 2011 to 2013, and his former associate Murali Yamazula Venkata, are accused of aggravated identity theft, wire fraud, and conspiring to steal government property to defraud the United States.
The alleged scheme took place from 2014 to 2017, after Edwards had already left DHS’s inspector general (IG) office. But the head-turning indictment accuses Edwards of coordinating with Venkata, who still worked at the IG’s office, to steal the IG’s software. Edwards and Venkata also allegedly took “sensitive government databases” containing the personal identifiably information of DHS and U.S. Postal Service employees.
Edwards then allegedly used the stolen code to improve software made by his company, Delta Business Solutions, and tried to sell it to the Department of Agriculture’s inspector general office.
Edwards needed some IT support to finish the operation, prosecutors said. Venkata and other unnamed individuals allegedly helped Edwards reconfigure his laptop so he could upload the stolen software and databases. The IT hands built a test server at Edwards’ residence that contained the stolen PII, and Edwards enlisted software developers in India to help him commercialize the software, according to the indictment.
Neither Edwards, Venkata nor Delta Business Solutions could be immediately reached for comment Friday. The DHS’s IG office did not immediately respond to a request for comment.
An inspector general is supposed to be an independent check on federal waste and abuse. But a 2014 Senate investigation found that, as acting inspector general, Edwards had delayed and altered investigations at the behest of senior Obama administration officials.
==================================================================
https://www.wavesys.com/data-protection
Excerpts:
Security = data protection
When we talk about security, what we really mean is protecting data from theft and misuse. Proprietary information, R&D, corporate strategy, customer names and phone numbers, social security numbers, passwords … All have potential monetary value, and all are targets. Data theft is a growth industry. As an example, tens of thousands of new malware strains pop up daily. With online tools, even a non-technical person can create one in minutes.
The IT perimeter has vanished
Data protection is easy enough when your data is sitting in secure servers. But today, it’s not. The workforce is increasingly mobile. More than 60 percent of corporate data lives not on servers but on laptops, tablets, and other devices (and more and more of those devices are owned by employees). Data is dispersed, constantly moving, and constantly exposed to the Internet and all the malware, viruses, and hackers lurking there.
Wave’s solution: start with the device
The Wave approach to this challenge is to make the IT perimeter irrelevant. Wave turns on and manages the self-encrypting drives (SEDs) and trusted platform modules (TPMs), or security chips, that are already embedded in many of your devices. The upshot is that each and every device is equipped with its own data protection system—while being centrally managed. This gives you unprecedented yet straightforward control over exactly who has access to your data, with what devices, over what networks.
We cost less too. Wave works on your existing hardware, across platforms. That’s because our solutions are based on an open standard that’s already been implemented on 600 million–plus laptops and is now working its way onto mobile devices. Our software is all you need to reach a whole new level of data protection. It’s one of the big reasons why total cost of ownership can be almost half that of a traditional software-based system that doesn’t even work very well.
One in five SMBs use no endpoint security at all
https://www.helpnetsecurity.com/2020/02/27/smbs-breach-prepared/
An alarming number of SMBs (small to medium businesses) in the US and UK are not prepared for a potential cyber attack or breach, BullGuard warns.
One-third of companies with 50 or fewer employees report using free, consumer-grade cybersecurity, and one in five companies use no endpoint security whatsoever.
SMBs are not prepared for a breach
Additionally, worrisome, the BullGuard study found 43% of SMB owners have no cybersecurity defense plan in place at all – leaving their most sensitive financial, customer and business data, and ultimately their companies, at significant risk.
“Small businesses are not immune to cyber attacks and data breaches, and are often targeted specifically because they often fail to prioritize security,” said Paul Lipman, CEO of BullGuard.
“Caught between inadequate consumer solutions and overly complex enterprise software, many small business owners may be inclined to skip cybersecurity. It only takes one attack, however, to bring a business to its knees.”
SMB owners overly confident in the safety of their company and customer data
The study also revealed some glaring discrepancies between what SMB owners believe versus what is actually occurring in the market. Nearly 60% of SMB owners believe their business is unlikely to be targeted by cyber criminals, however the results revealed that 18.5% of SMB owners have suffered from a cyber attack or data breach within the past year.
Unfortunately, while securing data can be simple, remediation is not. Companies that fall victim to a cyber attack often experience significant downtime that seriously impacts productivity, data privacy, and even revenue.
Once breached, 25% of SMB owners stated they had to spend $10,000 or more to resolve the attack, which could be devastating for a small company. As for time lost, 50% of SMB owners said it took 24 hours or longer to recover from a breach or cyber attack, while 25% reported they lost business as a result, and almost 40% stated they lost crucial data.
Despite these numbers, many SMB owners are overly confident in the safety of their company and customer data. One in five SMB owners surveyed stated their organization has zero vulnerabilities, however 50% of SMB owners stated their employees do not receive any cybersecurity training.
A significant number, 65%, of SMB owners report managing their cybersecurity in-house, but less than 10% say they have a dedicated IT staff member. The right solution makes it simple and extremely cost-effective for SMBs to manage their own cybersecurity, ensuring their business is secure and protected.
=================================================================
Imagine if SMBs knew that only known and approved devices were accessing their networks!!!
==================================================================
https://www.wavesys.com/products/embassy%C2%AE-remote-administration-server-tpm-management
Excerpts:
Secure device & user authentication
Sometimes it feels like security is more effective at deterring your users than hackers. But you still have to protect your enterprise resources, and we’re here to help. We take pride in securing your network, data, and resources to an unprecedented level, without causing a revolt from either IT or your users. In fact, your users probably won’t even know we’re there.
Here’s how it works:
Trusted Platform Module (TPM) + Wave’s ERAS for TPM Management = hardware-secured, fully-managed authentication
Most of your devices already come with TPMs (check out our “What is a TPM?” brochure if you’re not sure why this is exciting). This security chip comes attached to the motherboard of most enterprise-class PCs. There’s nothing “add-on” about it. The TPM provides a verifiable, unique identity for each machine.
Wave’s ERAS for TPM Management gives IT remote, centralized management of all TPMs on enterprise computers and tablets.
With this control, IT can set policies and dictate which machines and users have authority to access which resources. IT can ensure that only known and approved devices are accessing your network. And what’s more, IT can prove it with detailed activity logs.
=================================================================
https://www.wavesys.com/products/wave-virtual-smart-card
https://www.wavesys.com/
https://www.wavesys.com/contact-information
Transmit Security, Authentication Company Used by Banks, Hacked
https://www.vice.com/en_us/article/wxepb4/transmit-security-authentication-banks-hacked
The breach impacted email addresses, passwords, phone numbers, and other sensitive information, according to a researcher mentioned in a breach notification obtained by Motherboard.
This week a cybersecurity company called Transmit Security, that focuses on providing corporate clients with tools to securely log users into different services, notified customers of a data breach at the firm. The breach impacted over a thousand email addresses, passwords, phone numbers, and other sensitive information, according to a researcher mentioned in Transmit Security's breach notification message. Transmit Security denied passwords were impacted in a follow-up email.
Transmit Security works with a number of large banks, including TD Bank and the First International Bank of Israel.
Please see link for the rest of the article
==================================================================
Wave Announces 5-Year Master License Agreement for Virtual Smart Card 2.0 with Leading Global Financial Services Company
Wins competitive evaluation against market leader in two-factor authentication tokens
https://www.wavesys.com/buzz/pr/wave-announces-5-year-master-license-agreement-virtual-smart-card-20-leading-global
Lee, MA -
December 17, 2015 -
Wave Systems Corp. (NASDAQ: WAVX) announces a five-year master licensing agreement (MLA) with a leading global corporation (as determined by the 2015 Fortune Global 500 List) for its Virtual Smart Card 2.0 solution. This MLA sets the terms and pricing for licenses and maintenance across the customer’s global organization and establishes it as their preferred two-factor authentication solution. Instead of one large license purchase for the entire organization, each of the customer’s subordinate divisions will make separate orders in accordance with the terms of this MLA.
The first purchase of 2,000 VSC 2.0 licenses under this agreement, when added to a previous purchase, completes the requirement for the customer’s global IT division. That division will now lead the internal effort to standardize the remaining 150,000+ endpoints within their organization with the new Wave VSC 2.0 solution. While there are no minimum order requirements under the agreement, discussions for additional orders are underway.
“Our five-year agreement with this customer is the first very large scale contract for VSC 2.0 and is an important milestone for Wave,” said Bill Solms, President and CEO of Wave Systems. “This customer is a major global financial services company and their standards for protecting their systems from unauthorized access and the integrity of their data are of the highest order. Wave had to pass a very rigorous technical and business review to win the competition. We believe that this client’s decision to choose Wave Virtual Smart Card 2.0 over their incumbent solution gives us tremendous credibility in the two-factor authentication market. We will remain engaged with this company in order to complete the additional sales and deployments in the months ahead.”
Wave Virtual Smart Card 2.0 is a tokenless, hardware-based, two-factor authentication solution that offers superior security at less than half the cost of comparable solutions. It is the industry’s only enterprise-grade virtual smart card management solution that works on Windows 7, 8 and 10. It also provides management support for the Microsoft Virtual Smart Card on Windows 8 and 10. Wave’s VSC solution emulates the functionality of physical smart cards or tokens, but offers greater convenience to users, significantly lower total cost of ownership, and a greatly reduced risk of unauthorized access.
Wave Virtual Smart Card 2.0 gives IT the ability to:
• Remotely create and delete virtual smart cards
• Provide help desk-assisted recovery
• Configure Passphrase and card policies
• View the status of virtual smart cards and enrolled certificates
• Generate reports for compliance
• Support virtual smart cards on laptops, tablets and desktops with both TPM 1.2 and TPM 2.0 security chips
==================================================================
Wave VSC 2.0, better security at less than half the cost!!!
https://www.wavesys.com/
https://www.wavesys.com/products/wave-virtual-smart-card
One in four Americans won’t do business with data-breached companies
https://www.zdnet.com/article/one-in-four-americans-wont-do-business-with-data-breached-companies/
With so many large-scale data breaches at major companies, is it possible for brands to regain consumer confidence again?
If you had an account with businesses such as Marriott, Under Armour, Panera Bread, T-Mobile, or Facebook, amongst others, there is a chance that you could be among the millions of people whose email addresses, passwords, passport number, credit card numbers, and billing address were exposed unlawfully.
In 2018, roughly five billion people had their information and sensitive data exposed due to hacks. But what do customers do when they've had their private information exposed by a corporation that's been breached via cyber attack?
Security company Security.org surveyed over 1,000 people in the US including over 300 data breach victims to learn more about their awareness of major data breaches.
This study included data breaches that occurred from Jan. 1, 2018, to Dec. 31, 2018, regardless of the public reporting date. Only breaches leaking over 500,000 consumer records that affected consumers on a national scale were included.
It found that most people were only loosely familiar with the total number of corporate breaches that occurred in 2018. Though the majority of people admitted to losing trust in corporations that experienced data breaches, most were unwilling to cut ties with these companies.
To counter this, most people made their account passwords harder to guess and were more selective with whom they gave their financial information after learning of a breach, even though one in three people who experienced a data breach ultimately weren't sure which information was targeted.
The findings showed that almost one in four Americans stop doing business with companies who have been hacked, and more than two in three people trust a company less after a data breach.
Almost all respondents (92%) agree that companies are financially liable to their customers after a breach and over one in five people are unwilling to give their financial information to a company who's been hacked
Breaches normally expose email addresses (49.5%) or full names (47.8%), but 13.8% of breaches expose credit card information and 11.8% of breaches expose debit card information.
Over two in five learned that they had been breached from the media, or from the breached company itself. Over one in 10 (12.7%) discovered after noticing a financial discrepancy on their records.
After learning of a data breach, almost three out of five (59.1%) made their passwords more difficult to guess, and almost half (44.6%) became more reluctant to enter financial information online. Almost one in six (13.6%) did nothing.
Fewer than one in 10 people (8.5%) will give a company their financial information within a month after they've been breached and over one in five (21.6%) would be unwilling to give any information to a company that has experienced a data breach.
Being in control of who has access to our information is important to us -- so why are we giving away this access with a simple click each day? Securing our accounts with unique passwords will help to minimize the breach, and being cautious when accessing accounts from public Wi-Fi, too.
Being ultra-cautious will help to keep you -- and your family -- safe online.
==================================================================
Wave VSC 2.0 could help with the problem in the above article. If marketing was done through the social media channels mentioning the transparency of logging into websites with Wave VSC 2.0, corporate users wouldn't have password problems. And also, with Wave ERAS preventing breaches by only using known and approved devices on the network, organizations could keep the bad guys from accessing sensitive data and these breaches would stop. Companies wouldn't then lose a quarter of their customers.
==================================================================
https://www.wavesys.com/
https://www.wavesys.com/products/wave-virtual-smart-card
https://www.wavesys.com/products/embassy%C2%AE-remote-administration-server-tpm-management
https://www.wavesys.com/contact-information
Android malware can steal Google Authenticator 2FA codes
https://www.zdnet.com/article/android-malware-can-steal-google-authenticator-2fa-codes/?ftag=COS-05-10aaa0g&taid=5e585f34f3794d0001183984&utm_campaign=trueAnthem%3A+Trending+Content&utm_medium=trueAnthem&utm_source=twitter
A new version of the "Cerberus" Android banking trojan will be able to steal one-time codes generated by the Google Authenticator app and bypass 2FA-protected accounts.
Security researchers say that an Android malware strain can now extract and steal one-time passcodes (OTP) generated through Google Authenticator, a mobile app that's used as a two-factor authentication (2FA) layer for many online accounts.
Google launched the Authenticator mobile app in 2010. The app works by generating six to eight-digits-long unique codes that users must enter in login forms while trying to access online accounts.
Google launched Authenticator as an alternative to SMS-based one-time passcodes. Because Google Authenticator codes are generated on a user's smartphone and never travel through insecure mobile networks, online accounts who use Authenticator codes as 2FA layers are considered more secure than those protected by SMS-based codes.
Cerberus gets Authenticator OTP-stealing capabilities
In a report published this week, security researchers from Dutch mobile security firm ThreatFabric say they've spotted an Authenticator OTP-stealing capability in recent samples of Cerberus, a relatively new Android banking trojan that launched in June 2019.
"Abusing the Accessibility privileges, the Trojan can now also steal 2FA codes from Google Authenticator application," the ThreatFabric team said.
"When the [Authenticator] app is running, the Trojan can get the content of the interface and can send it to the [command-and-control] server," they added.
ThreatFabric said this new feature is not yet live in the Cerberus version advertised and sold on hacking forums.
"We believe that this variant of Cerberus is still in the test phase but might be released soon," researchers said.
Feature developed for bypassing 2FA on banking accounts
All in all, the ThreadFabric team points out that current versions of the Cerberus banking trojan are very advanced. They say Cerberus now includes the same breadth of features usually found in remote access trojans (RATs), a superior class of malware.
These RAT features allow Cerberus operators to remotely connect to an infected device, use the owner's banking credentials to access an online banking account, and then use the Authenticator OTP-stealing feature to bypass 2FA protections on the account -- if present.
ThreatFabric researchers believe the Cerberus trojan will most likely use this feature to bypass Authenticator-based 2FA protections on online banking accounts, however, there's nothing stopping hackers from bypassing Authenticator-based 2FA on other types of accounts. This includes email inboxes, coding repositories, social media accounts, intranets, and others.
Historically, very few hacker groups and even fewer malware strains [1, 2] have ever had the ability to bypass multi-factor (MFA) authentication solutions.
If this feature will work as intended and will ship with Cerberus, this will put the banking trojan in an elite category of malware strains.
The new Cerberus capabilities are detailed in a ThreatFabric report that summarizes all the recent remote access-related upgrades detected in Android malware strains. The report contains additional insights about other Android malware operations, such as Gustuff, Hydra, Ginp, and Anubis.
==================================================================
One has to wonder whether any other 2FA products on smartphones have One Time Passwords (OTP) like Google Authenticator are susceptible to malware?? Below is a multi factor authentication solution that is based on hardware that is an international standard!! Customers Wave VSC 2.0 has been successfully tested amongst are the U.S. government, a global financial services company and others. Better security at less than half the cost!!!
==================================================================
https://www.wavesys.com/products/wave-virtual-smart-card
https://www.wavesys.com/
Samsung cops to data breach after unsolicited '1/1' Find my Mobile push notification
https://www.theregister.co.uk/2020/02/24/samsung_data_breach_find_my_mobile/
Tight-lipped chaebol still won't talk about the dodgy app, though
Samsung has admitted that what it calls a "small number" of users could indeed read other people's personal data following last week's unexplained Find my Mobile notification.
Several Register readers wrote in to tell us that, after last Thursday's mystery push notification, they found strangers' personal data displayed to them.
Many readers, assuming Samsung had been hacked, logged into its website to change their passwords. Now the company has admitted that a data breach did occur.
A spokeswoman told The Register: "A technical error resulted in a small number of users being able to access the details of another user. As soon as we became of aware of the incident, we removed the ability to log in to the store on our website until the issue was fixed."
She added: "We will be contacting those affected by the issue with further details."
From the not-insignificant number of emails El Reg received about the website snafu, it remains to be seen whether Samsung's definition of "small number" is the same as that of the rest of the world.
Of potentially greater concern is the mystery 1/1 push notification from Find my Mobile, a baked-in app on stock Samsung Android distributions. Although the firm brushed off the worldwide notification as something to do with unspecified internal testing, many of those who wrote to El Reg said they had disabled the app. Stock apps cannot be uninstalled unless one effectively wipes the phone and installs a new operating system – unlocking the bootloader and reformatting with a new third-party, customised ROM.
Samsung did not answer our questions as to how a "disabled" app was able to receive and display push notifications. Nor did it say what other functions this "disabled" app was capable of executing. ®
==================================================================
Wave Systems Signs 15-year License Agreement with Samsung
https://www.wavesys.com/buzz/news/wave-systems-signs-15-year-license-agreement-samsung
Author:
Mike Lennon
Security Week -
Wednesday, May 30, 2012 -
Wave Systems has signed a 15-year software license and distribution agreement with Samsung, enabling Samsung to bundle Wave’s EMBASSY Security Center (ESC) and TCG Software Stack (TSS) technology with devices that include a Trusted Platform Module (TPM), an industry standard security chip embedded in the motherboard of a computer or other electronic device.
In an SEC filing, Wave said it would receive a per-unit royalty based on Samsung’s sales of products that include its technology, but did not provide estimates in terms of expected revenue derived as a result.
Security Week has full article.
==================================================================
Samsung could prevent breaches from occurring by using the technology from its partner Wave Systems!!!! The TPM/TEE could be used as a secure container for sensitive information, and the TPM could be managed by Wave's software!! Just a reminder for those at Wave and Samsung that may be able to use information for a problem that showed itself.
MITRE Engenuity to Evaluate Cybersecurity Products Based on Carbanak and FIN7 Groups
https://www.businesswire.com/news/home/20200220005985/en/MITRE-Engenuity-Evaluate-Cybersecurity-Products-Based-Carbanak
==================================================================
Wave Integrating MITRE’s Attestation Technique into its Endpoint Monitor for Remediating Advanced Malware
MITRE Details Technique at Black Hat 2013
https://www.wavesys.com/buzz/pr/wave-integrating-mitre%E2%80%99s-attestation-technique-its-endpoint-monitor-remediating-advanced-mal
Lee, MA -
July 31, 2013 -
Wave Systems Corp. (NASDAQ:WAVX), the Trusted Computing Company, announced plans to integrate The MITRE Corporation’s new timing-based attestation technique into Wave Endpoint Monitor (WEM), the industry’s first solution to leverage industry standard hardware to detect and remediate malware that can surreptitiously mount attacks before the operating system loads. MITRE is a not-for-profit organization that provides systems engineering, research and development, and information technology support to the government.
With this enhancement, Wave will integrate MITRE’s technique that doubly verifies that the core BIOS hasn’t been corrupted. The BIOS is the first software run by the PC when powered-on and is responsible for initializing hardware and getting the operating system running. It also contains the “core root of trust measurement” (CRTM) software, the first software in the boot trust chain that ends in the assurance that the computer booted safely.
“MITRE has made a significant contribution to the body of research by identifying a scenario in which malicious code could be introduced to the BIOS that would cause it to provide a false reading and allow the malicious BIOS to indicate the system had not been corrupted,” said Dr. Robert Thibadeau, Wave’s Chief Scientist. “MITRE’s technique offers a second control for determining the CRTM does not lie about itself and any of the rest of the trust chain.”
Dr. Thibadeau added, “While BIOS attacks are still fairly rare today—less than one percent by many accounts—they represent a new and dangerous attack vector, and we’re bound to see more in future years as the more popular preboot targets are secured by our existing WEM technology.”
The management of CRTM detection will be incorporated in a module for WEM, which Wave expects will be production-ready in early 2014 to meet the expected increase of these attacks. Wave Endpoint Monitor captures verifiable PC health and security by utilizing information stored within the TPM. If anomalies are detected, the attack is controlled, and IT is alerted immediately with real-time analytics.
MITRE research presented at Black Hat 2013
MITRE researchers John Butterworth, Corey Kallenberg, and Xeno Kovah presented their research on this vulnerability and technique, “BIOS Chronomancy: Fixing the Core Root of Trust for Measurement,” at Black Hat 2013.
The team’s research highlights a vulnerability in which a firmware rootkit tricks an endpoint’s Trusted Platform Module (TPM) chip into reporting a clean BIOS firmware, when in fact it has been compromised. MITRE’s research shows the importance of using timing-based attestation systems, which can defend against attackers who obtain the same privilege levels as the defender. John Butterworth, a Senior Infosec Engineer at MITRE, adds, “additional complexities are imposed on an attacker who tries to conceal a rootkit in the presence of timing-based attestation; even concealing the modification of a single byte will trigger a measurable change.”
The team’s findings come as vendors work to implement BIOS protection specifications as outlined by the National Institute of Standards and Technology (NIST) special publication 800-155, published in 2011.
=================================================================
Wave worked with MITRE six years ago, and now companies are working with MITRE on malware testing. Results (of these tests) will be announced in early 2021. Why wait until 2021, go with a company (Wave) that could protect your company now with technology that has proven itself, and already has MITRE incorporated into it!!!
==================================================================
https://www.wavesys.com/malware-protection
https://www.wavesys.com/products/wave-endpoint-monitor
https://www.wavesys.com/
Fox Kitten APT campaign exploits VPN flaws hours after public disclosure
https://www.scmagazine.com/home/security-news/cybercrime/fox-kitten-apt-campaign-exploits-vpn-flaws-hours-after-public-disclosure/
Iranian APT actors have engaged in a long-running cyber espionage and data theft campaign that has victimized dozens of companies around the world, typically compromising them via virtual private network and Remote Desktop Protocol services, according to a new research report.
Vulnerable VPNs have been such a favorite attack vector of choice among these actors that they have become adept at exploiting VPN flaws within mere hours to weeks after they have been publicly disclosed, says the report, from ClearSky. This is too quick for most organizations to respond with patches.
The three-year-old campaign, dubbed Fox Kitten, has targeted companies and organizations operating in the IT, telecommunication, oil and gas, aviation, government, and security sectors, the report notes. IT service providers have been a particularly alluring target for the actors because through them they can get to thousands more potential victims.
VPNs exploited by the adversaries include Pulse Secure Connect, Global Protect by Palo Alto Networks, and Fortinet FortiOS, although ClearSky believes Citrix could eventually emerge as a candidate for exploit as well. In late 2019 and early 2020, VPNs have notably been exploited in a number of prominent ransomware attacks, and it is believed that Iranian state actors recently abused VPNs to execute attacks using the ZeroCleare and Dustman disk wipers against energy and industrial sector organizations.
“VPNs play an essential role in providing employees and especially third parties remote access to the network. Their two main functions are to create a data tunnel to between the third party and the corporate network – and to protect it. The latter is mainly achieved through encryption. Critical security breaches in VPN equipment from leading vendors is, therefore, something that organizations must understand and take action on,” said Noam Shany, product manager at CyberArk, in reaction to the repot. “In the last 12 months especially, flaws in how VPNs operate has led to many organizations examining other ways to provide remote vendors access to the most sensitive parts of the corporate network.
But infiltrating companies through VPNs is just one stage of a rather complex APT attack. After penetrating the network, the attackers attempt to establish a more permanent foothold through the installation of multiple backdoors.
“…[T]he attackers tried to maintain the access to the networks by opening a variety of communication tools, including opening RDP links over SSH tunneling, in order to camouflage and encrypt the communication with the targets,” the report states. “At the final stage, after successfully infiltrating the organization, the attackers have performed a routine process of identification, examination, and filtering of sensitive, valuable information from every targeted organization. The valuable information was sent back to the attackers for reconnaissance, espionage, or further infection of connected networks.”
The attackers’ tool set includes several of their proprietary creations, including POWSSHNET a backdoor malware program that opens RDP links over SSH tunneling, and STSRCheck, a database and open port mapping tool. They have combined these weapons with a series of customized open source and seemingly legitimate tools for the purposes of privilege escalation, persistence, command-and-control communications and data exfiltration.
Based on the adversaries, tools, techniques and overall infrastructure, ClearSky believes there is a “medium-high probability” that Fox Kitten is linked to the reputed Iranian APT group APT34 (aka OilRig and Helix Kitten) and a “medium” probability the campaign is linked to two additional APT groups widely believed to be sponsored by Iran, APT 33 (aka Elfin) and APT39 (aka Chafer).
ClearSky credited the industrial controls system security firm Dragos for initially reporting on aspects of this campaign in a separate report last month. In its report, Dragos called the campaign Parisite.
==================================================================
https://www.wavesys.com/products/wave-virtual-smart-card
Excerpt:
What can it be used for?
What do you use your smart card for today? With the exception of keying open the door at work, Wave Virtual Smart Card can perform any of the services or applications you rely on your smart card for today. Secure VPN, WiFi, remote desktop, cloud applications – it can all be done with a virtual smart card.
==================================================================
It sounds like there are dozens of organizations and many more that could use Wave VSC 2.0 and Wave Endpoint Monitor for added protection for situations like in the article above!!!
Better security at less than half the cost!!!
https://www.wavesys.com/
Booz Allen Awarded $113m SEC Contract
https://www.infosecurity-magazine.com/news/booz-allen-awarded-113m-sec?utm_source=twitterfeed&utm_medium=twitter
Consulting firm Booz Allen Hamilton has been awarded a new $113m contract to deliver modernized cyber-defense operations to the United States Securities and Exchange Commission (SEC).
With this new 10-year contract, the Virginia-based firm will become the SEC's leading provider of cybersecurity services. The contract was awarded on December 12, 2019, but was kept under wraps until yesterday.
According to a statement released February 20 on Booz Allen's website, the SEC picked the 106-year-old company for the job after being impressed by its ability to comprehend the commission's standing and aims.
The statement read: "Booz Allen was selected for its clear understanding of the agency’s mission and the firm’s reputation for building and operating modernized cyber defenses for federal and commercial clients that deliver rapid, durable improvements to security program maturity and effectiveness while generating cost savings."
Booz Allen pledged to employ the same tools, techniques, and mindsets as today’s most advanced threat actors to defend the SEC. The company said one element of its strategy would be to discover unknown vulnerabilities before they can be used for malicious purposes.
"Our team will provide the SEC with leading-edge, threat-centric, proactive cyber defense with the ability to detect and proactively address unknown threats, keep up with the rapid pace of change in the cyber industry and provide advanced cyber capabilities at scale," said Booz Allen's senior vice president, Mark Gamis.
Booz Allen is the largest provider of cybersecurity professional services in North America and the only company to hold all three of the federal government’s elite cybersecurity accreditations: NSA’s Cyber Incident Response Assistance (CIRA) accreditation, NSA’s Vulnerability Assessment Service (VAS) accreditation, and GSA’s Highly Adaptive Cybersecurity Services schedule.
Gamis said the company would draw on its existing knowledge and experience to protect the SEC from bad actors.
"The SEC is essential to the strong functioning of the U.S. and world economy, so we are proud the agency is entrusting Booz Allen to deliver cyber defense operations to protect its data and other critical assets from increasingly aggressive and destructive cyber-attacks," said Gamis.
"We will leverage our deep expertise and experience delivering cyber tradecraft across US Government and commercial clients and deploying groundbreaking cyber capabilities to protect mission-essential services and high-value assets."
==================================================================
It's interesting that Booz Allen is owned by PwC. And PwC used Wave's 2FA for protecting their network. I don't know if this was a complete success, but there appears to have been no complaints with Wave's technology. Shouldn't this experience and Wave's award with Wave VSC 2.0 be a great reason why the SEC should be using Wave solutions. Wave SED management I believe was part of the Wave/PwC experience. These two solutions which already previously did their job for a 200,000 employee company (PwC) could help the SEC and Booz Allen for years to come on their mission!!!
MGM Grand Breach Leaked Details of 10.6 Million Guests Last Summer
https://threatpost.com/mgm-grand-breach-leaked-details-of-10-6-million-guests-last-summer/153054/
This week a hacking forum posted data from the breach—which included personal and contact details for celebrities, tech CEOs, government officials and employees at large tech companies.
A hacking forum this week published details of more than 10.6 million guests who stayed at MGM Resorts, the result of a breach due to unauthorized access to a cloud server that occurred at the famous Las Vegas hotel and casino last summer.
The incident—revealed in a published report on ZDNet Wednesday–once again highlights the importance of securing data stored on the cloud as well as the ripple effect breaches can have for companies and victims even long after they’ve occurred.
Personal details found on the forum included full names, home addresses, phone numbers, emails and dates of birth for 10,683,188 guests who had previously stayed at the MGM Resorts, according to the report. Those guests included celebrities, tech CEOs, reporters, government officials, and employees at some of the world’s largest tech companies.
ZDNet worked with a security researcher at Under the Breach, a soon-to-be-launched data-breach monitoring service, to confirm the authenticity of the data on the forum, and then reached out to MGM Resorts and some of the people affected by the breach for further confirmation.
MGM almost immediately confirmed the breach to ZDNet, linking it to a security incident that happened last summer, according to the report. Following the breach, the company conducted an internal investigation using two cybersecurity forensics firms, officials said.
“Last summer, we discovered unauthorized access to a cloud server that contained a limited amount of information for certain previous guests of MGM Resorts,” MGM said, according to the report. “We are confident that no financial, payment card or password data was involved in this matter.”
MGM alerted all guests who were affected at the time, something that also appeared to be true in a comment made in August on a site called VegasMessageBoard by a community member who said he’d been notified that his data had been stolen at MGM Resorts in July.
Though the breach happened last summer, the guest details—which included personal info for celebrities as diverse as Twitter CEO Jack Dorsey and pop music star Justin Bieber — were mostly out of date, MGM officials said.
Those researching the breach said they also were able to confirm this is likely true by contacting some of those affected—including international business travelers, reporters attending tech conferences, CEOs attending business meetings, and government officials–who said they had not stayed at the hotel since at least 2017, according to the report.
The breach is no surprise to security experts, who noted that it’s easy for organizations who lack proper security expertise to make simple mistakes when deploying cloud-based solutions that can cost them later when the data is exposed by the cyberthieves who stole it.
These type of breaches are all too common. In October, a cloud misconfiguration allow hackers to steal an AWS administrative API key housed in a compute instance left exposed to the public internet, one of the many ways cloud deployments can go wrong from a security perspective, one expert noted.
“Configuration errors, malicious insiders, server hacks and client-side threats can cause data breaches,” Gad Bornstein, security evangelist with PerimeterX said in an email to Threatpost. “Data from breaches invariably make it to the dark web. Data from multiple breaches help bad actors execute bot-driven account takeover attacks with better success.”
Indeed, the fear with this type of breach is that threat actors will use the data to launch these or other types of attacks—such as phishing or email-based scams–long after a breach occurs, and when the company affected and the victims think they are out of harms’ way.
“This is a great example of how these breaches and their fallout can continue to haunt businesses for quite some time,” Adam Laub, CMO at STEALTHbits Technologies, said in an email to Threatpost. “It’s likely MGM thought this incident was far in the rear view, but the value of their particular dataset continues to have appeal, despite its age and the potential staleness in certain spots.”
=================================================================
Pentagon's tech agency reveals potential breach involving personal data
https://www.cyberscoop.com/disa-breach-pii/
The agency that secures the U.S. military’s IT infrastructure across the globe says sensitive personal data, including Social Security numbers, hosted on its network may have been compromised in a breach between May and July 2019.
The Defense Information Systems Agency notified potential victims of the breach in a letter this month, saying it had tightened protocols for protecting personally identification information (PII) because of the incident.
“We take this potential data compromise very seriously,” DISA Chief Information Officer Roger Greenwell said in the letter seen by CyberScoop.
There is no evidence that compromised PII has been used maliciously, he said, adding that potential victims will have access to free credit monitoring. Personal data about U.S. government personnel and contractors could be valuable to foreign intelligence agencies and financially-motivated criminals alike.
“DISA has conducted a thorough investigation of this incident and taken appropriate measures to secure the network,” an agency spokesperson said in a statement.
There have been multiple publicly reported breaches of Pentagon contractors in the last year. Miracle Systems, which provides IT services to the U.S. Air Force and Army, had one of its internal servers breached. In a separate incident revealed in October, a travel records system at the Department of Defense was breached in an incident that reportedly affected tens of thousands of department personnel.
Reuters was first to report on the DISA security incident.
==================================================================
It's startling to see the MGM breach and Pentagon 'incident', and that breaches continue to happen at the regularity that they do. Why is it that they still keep happening? Unfortunately, there are many organizations that don't know about Wave's better security at less than half the cost!!! If these organizations knew the capability of Wave's solutions breaches like MGM and the Pentagon wouldn't have happened!!!
==================================================================
https://www.wavesys.com/products/embassy%C2%AE-remote-administration-server-tpm-management
Excerpts:
Here’s how it works:
Trusted Platform Module (TPM) + Wave’s ERAS for TPM Management = hardware-secured, fully-managed authentication
Most of your devices already come with TPMs (check out our “What is a TPM?” brochure if you’re not sure why this is exciting). This security chip comes attached to the motherboard of most enterprise-class PCs. There’s nothing “add-on” about it. The TPM provides a verifiable, unique identity for each machine.
Wave’s ERAS for TPM Management gives IT remote, centralized management of all TPMs on enterprise computers and tablets.
With this control, IT can set policies and dictate which machines and users have authority to access which resources. IT can ensure that only known and approved devices are accessing your network. And what’s more, IT can prove it with detailed activity logs.
https://www.wavesys.com/
Dell Technologies sells RSA to Symphony Technology Group consortium for $2.075 billion
https://www.zdnet.com/article/dell-technologies-sells-rsa-to-symphony-technology-group-consortium-for-2-075-billion/?ftag=COS-05-10aaa0g&taid=5e4c62026e49630001bab5a4&utm_campaign=trueAnthem%3A+Trending+Content&utm_medium=trueAnthem&utm_source=twitter
The move simplifies Dell's portfolio of companies and allows RSA to focus on its core security mission.
Dell Technologies said it will sell RSA to a consortium led by Symphony Technology Group for $2.075 billion in a move to simplify its portfolio of businesses.
RSA provides security technologies for threat detection and response, identity and access management as well as fraud prevention. RSA has more than 12,500 customers.
According to Dell, the all-cash deal includes RSA Archer, RSA NetWitness Platform, RSA SecureID, RSA Fraud and Risk Intelligence, and the RSA Conference.
The Symphony Technology Group consortium includes the Ontario Teachers' Pension Plan Board (Ontario Teachers') and AlpInvest Partners (AlpInvest).
Dell's deal to sell RSA comes as Broadcom acquired Symantec Enterprise Security business for $10.7 billion and Symantec's consumer unit became NortonLifelock. McAfee, formerly part of Intel, is now independent with a new CEO.
Both RSA and Dell said that the focus will help their respective companies and customers. Jeff Clarke, chief operating officer of Dell, said the transaction "will further simplify our business and product portfolio." RSA can use private equity banking to grow its business.
=================================================================
Dell selling RSA should be a great opportunity for Wave!!! Below is a link to the link of Wave's White Paper on Wave Virtual Smart Card. Outlined in it is some of the advantages that Wave VSC 2.0 has over RSA Securid!!!
=================================================================
https://www.wavesys.com/
https://www.wavesys.com/virtual-smart-card-2.0-from-wave
$645 Billion Cyber Risk Could Trigger Liquidity Crisis, ECB’s Lagarde Warns
https://www.forbes.com/sites/daveywinder/2020/02/08/645-billion-cyber-risk-could-trigger-liquidity-crisis-ecbs-lagarde-warns/#5cd5c0287ca8
==================================================================
Wave Announces 5-Year Master License Agreement for Virtual Smart Card 2.0 with Leading Global Financial Services Company
Wins competitive evaluation against market leader in two-factor authentication tokens
https://www.wavesys.com/buzz/pr/wave-announces-5-year-master-license-agreement-virtual-smart-card-20-leading-global
==================================================================
Wave solutions could be the 'secret sauce' for a critical segment of the EU!!! There is too much at stake to not use better security (Wave)!!!!
https://www.wavesys.com/
IRS warns: Tax data thefts are spiking, so use 2FA
https://www.zdnet.com/article/irs-warns-tax-data-thefts-are-spiking-so-use-2fa/
US taxation agency urges professionals and the public to use multi-factor authentication for tax software.
As the US tax season kicks off, the Internal Revenue Service (IRS) has warned accountants and taxpayers to enable two-factor authentication (2FA) features available in tax-preparation software products.
Scammers, of course, know that the US tax season is ripe with opportunity, so the IRS has dispensed information security advice to protect taxpayers and accountants from the theft of tax information. Scammers can use tax data to file fraudulent tax claims enabled through phishing email and malware-laden attachments.
The IRS says it's received nearly two dozen reports from accountants about data theft in the past two months. So it's encouraging the use of multi-factor authentication as a "free and easy way" to protect clients and practitioners' officers from data theft, and it points out that tax software providers do offer free multi-factor options too.
Multi-factor authentication can help in the event a credential is compromised by requiring the person accessing an account to not only type in a username and password, but also have physical access to a second factor, like a token or a smartphone that receives a security code.
The IRS called out for multi-factor authentication with its Security Summit Partners, which includes state tax agencies, tax preparation firms, software developers, payroll processors, and banks.
The IRS Security Summit partners have been collaborating since 2015 to combat tax fraud with a focus on authentication, combating criminals' access to bank accounts, and raising awareness of cybersecurity issues.
"The IRS, state tax agencies and the private-sector tax industry have worked together as the Security Summit to make sure the multi-factor authentication feature is available to practitioners and taxpayers alike," said Kenneth Corbin, commissioner of the IRS wage and investment division.
"The multi-factor authentication feature is simple to set up and easy to use. Using it may just save you from the financial pain and frustration of identity theft."
Industry partners include Thomson Reuters, which offer multi-factor authentication for users of its CS Professional Suite accounts.
The IRS urges taxpayers and tax practitioners to always enable multi-factor authentication when it is available, for example on Gmail or Outlook accounts. But it says consumer should especially enable it for tax software products due to the sensitivity of the information held in the software or online accounts.
The agency also reminded tax software professionals to be cautious of phishing email, warning that scammers may claim to be a potential client, a cloud storage provider, a tax software provider or the IRS.
The main goal of tax-fraud scammers is tricking the tax professional into downloading attachments or opening links that lead to malware that can exfiltrate sensitive client data to a remote server.
=================================================================
The recommendation by the IRS should give a big lift to Wave VSC 2.0 for tax preparers and other industries!! Better security, easy to use, at less than half the cost; You need multi-factor authentication. Fast. You need Wave Virtual Smart Card!!! Other Wave solutions could help out tremendously here too!!
=================================================================
https://www.wavesys.com/
https://www.wavesys.com/products/wave-virtual-smart-card
https://www.wavesys.com/virtual-smart-card-2.0-from-wave
What is Trusted Platform Module?
https://www.embedded-computing.com/home-page/what-is-trusted-platform-module-2#
Great article...
==================================================================
https://www.wavesys.com/
https://www.wavesys.com/contact-information
==================================================================
If BODs, CEOs, CISOs and organizations read this article and the information on Wave's website and bought Wave solutions, the costs of cybercrime to the World economy would go down dramatically, and these organizations would know they were protected with better security!!!!
FBI: $3.5B Lost in 2019 to Known Cyberscams, Ransomware
https://threatpost.com/fbi-3-5b-lost-in-2019-to-known-cyberscams-ransomware/152815/
Cybercriminals double down on successful internet scams, with a focus on phishing, BEC and other defrauding schemes that have proven to work.
Cybercriminals are focusing on previously successful internet scams to defraud businesses and individuals in the United States out of more money than ever before, according to the FBI’s annual report on cybercrime. Meanwhile, ransomware continues to take a big financial toll on victims.
Businesses and individuals lost $3.5 billion to cybercriminals last year while reporting more incidents of internet crime to the FBI than any year previously, according to the bureau’s Internet Core Competency Certification (IC3) 2019 Internet Crime Report, which was released on Tuesday.
The results demonstrate that cybercrime is flourishing despite increased awareness of cyber-scams and improved security products. People reported 467,361 complaints of cybercrime to the FBI in 2019—an average of nearly 1,300 incidents every day, and more than 100,000 more than the year prior, according to the report.
The success of cybercriminals in 2019 may be the results of their doubling down their efforts on scams that have already proven successful rather than inventing new ones, said Donna Gregory, the chief of IC3, in a press statement. Phishing and similar ploys, non-payment/non-delivery scams and extortion were the top crime complaints reported to the FBI in 2019.
She said that rather than see instances of new types of fraud, instead the FBI saw cybercriminals honing their skills with scams they know work — improving their approaches to make it more difficult for victims to detect or defend against the crime.
“Criminals are getting so sophisticated,” she said. “It is getting harder and harder for victims to spot the red flags and tell real from fake.”
Indeed, just last week a new phishing scam surfaced that can deliver sophisticated malware called Anubis to Android mobile devices to steal user credentials, install a keylogger and even hold a device’s data for ransom.
However, the attacks that proved most costly to victims were different than those most-seen by the FBI last year, although these scams also are widely reported and proven to be effective. The 2019 report found that business email compromise (BEC), romance or confidence fraud, and spoofing (mimicking the account of someone known to the victim to gather personal or financial information) are the crimes that defraud people and businesses out of the most money, according to the report.
BEC or email account compromise alone cost people $1.7 billion in 2019, according to the report. The FBI received 23,775 reports of these scams—in which cybercriminals use social engineering or computer intrusion to transfer money from legitimate accounts to ones they can access. Indeed, security researchers also have reported a steady increase in the number of these type of attacks over the last several years.
Meanwhile, cybercriminals are continuing their raids on companies and government agencies with ransomware. The FBI’s Internet Crime Report reveals while the number of ransomware attacks decreased last year, the amount of loses increased and ransomware is now spiking back up.
“It’s interesting to see this trend gaining momentum regardless of the ever-increasing investment in cybersecurity solutions that should have stopped ransomware from infecting user devices and causing damage,” said Tal Zamir, Founder and CTO of Hysolate, via email. “Typical anti-ransomware solutions use endpoint security agents that are embedded in the operating system and try to protect it from malicious software. However, this approach is bound to fail as the underlying operating systems are bloated monolithic operating systems written decades ago and have hundreds of millions of potentially vulnerable lines of code. The current cat-and-mouse approach to fighting ransomware will not solve the problem — enterprises and individuals seeking to protect themselves against ransomware should consider fully segregating/isolating their sensitive resources, both local files and access to sensitive cloud resources.”
The FBI’s IC3 began reporting on cybercrime complaints in 2015, and there has been an uptick every year in the number of crimes reported—part of which could be attributed to more awareness over the years that the reporting program exists.
Losses, too, have steadily increased over the six years of reporting. In 2018, $2.7 billion in losses were reported to the FBI, which was a sharp increase over the prior year, when people reported $1.4 billion in cybercrime losses. Since reporting began, more than 1.7 million complaints have been logged by the bureau, resulting in $10.2 billion in losses.
While both companies and individuals get caught up in internet crime, companies that conduct their businesses online take the biggest hit for online scams — because they have to pay twice, noted one internet fraud expert.
“When stolen payment card info or login credentials are used to make purchases, e-tailers are left ‘holding the bag’ and are left responsible for not only refunding defrauded customers, but also for paying chargeback fees from the payment provider,” Kevin Lee, trust and safety architect at Sift, said in an email to Threatpost.
==================================================================
https://www.wavesys.com/
https://www.wavesys.com/contact-information
==================================================================
Just think what the statistics since 2015 (when FBI started recording them) would have been like if all of these businesses were using Wave solutions. Since Wave offers better security, these statistics could have been much improved!!! Continuing with the status quo could increase the Billions in losses!!! This doesn't include what is not reported to the FBI!!! Better security at less than half the cost!!!
Phishing Campaign Targets Mobile Banking Users
https://www.darkreading.com/mobile/phishing-campaign-targets-mobile-banking-users/d/d-id/1337066
Consumers in dozens of countries were targeted, Lookout says.
A recent phishing campaign involving the use of SMS messages to lure potential victims into disclosing their bank-account access credentials is the latest evidence of growing attacker interest in users of mobile apps.
Lookout, which tracked the threat, Friday described it as impacting mobile users in dozens of countries, including the US. Among those targeted were customers of Chase, HSBC, TD, Scotiabank, and CIBC banks. The campaign appears to have started in June 2019 but is currently offline.
The mobile security vendor said it detected at least 4,000 unique IP addresses belonging to mobile users who appear to have fallen for the scam. Lookout said it is not sure how the victims were impacted financially because of a lack of visibility into how the attackers might have actually used the compromised credentials.
But campaigns like these are a clear warning for mobile users, says Apurva Kumar, staff security intelligence engineer at Lookout. "Mobile phishing is on the rise," Kumar says. "The attack was entirely mobile-focused, from delivering messages via SMS to rendering the phishing sites as mobile banking logins."
For bad actors, mobile phishing is an attractive attack vector because it is often easier to obfuscate details of a scam on the mobile form factor, she says. With the increased use of multifactor authentication for signing into many apps, consumers have grown accustomed to banks communicating with them via SMS and therefore are less likely to scrutinize the messages as carefully as they should.
Mobile devices are also attractive targets because of the amount of sensitive data they hold, Kumar says. "Many end users are still unaware that mobile phishing exists or is even a risk, even though they may be wary of email phishing attacks," she says.
Malicious mobile apps posing as legitimate apps are another growing problem for consumers, especially for those using Android devices. In a recent report, Upstream said it had identified some 98,000 malicious Android apps and some 43 million infected Android smartphone and tablets in 2019. In most cases, the malicious mobile apps were being used to perpetuate ad fraud on a massive and global scale. And troublingly, Upstream found that 32% of the most active malicious apps it blocked last year were available through Google's official mobile app store.
Spray-and-Pray Attack
According to Lookout, the SMS messages used in the recent phishing campaign spoofed the login pages of various banks in an effort to capture credentials and other sensitive information, such as answers to security questions for verifying the user's identity.
The threat actors used an automated off-the-shelf SMS tool to create unique phishing messages for customers of different banks and then sent the message out in mass volume. Lookout said it identified over 200 phishing pages imitating bank login pages that were used in the campaign.
"This is a phishing-by-the-numbers attack, blasting out as many messages as possible in an effort to get even a 1% response," Kumar says. It was a mass sending of untargeted text messages to mobile users with hopes of convincing a small percent of the recipients to enter their credentials, she notes.
Lookout hasn't been able to identify the threat actor behind the campaign, but there's nothing to suggest it was necessarily a sophisticated group considering it was launched from an off-the-shelf phishing kit. "It could be literally anyone, anywhere, which represents the risk from these kits being sold on the web," Kumar says.
=================================================================
Please read the article below for more information on Wave Knowd.
Wave Knowd Introduces New Model for Internet Authentication Without Passwords
Knowd ‘Trust Score’ Assures User Identity when Accessing Web Services
https://www.wavesys.com/buzz/pr/wave-knowd-introduces-new-model-internet-authentication-without-passwords
=================================================================
Wave did testing under NSTIC with Broadridge Financial!!! Wave Knowd could protect the banks' customers and banks in the article above and for other banks as well!!
Organizations struggling to find skilled security staff, leaving 82% of security teams understaffed
https://www.helpnetsecurity.com/2020/02/11/find-skilled-security-staff/
83% of IT security professionals feel more overworked going into 2020 than they were at the beginning of 2019, and 82% said their teams were understaffed, according to a Tripwire survey.
Hard to find skilled security staff
The strain on cybersecurity teams is exacerbated by the inability to find experienced staff, and 85% acknowledged it has become more difficult over the past few years to hire skilled security professionals.
“It’s getting harder and harder for organizations to fill open positions on their security teams,” said Tim Erlin, vice president of product management and strategy at Tripwire.
“Larger organizations, which you might assume have more resources, are experiencing the skills gap issue even more acutely than smaller organizations. It’s a challenge to hire the right skill sets – they keep changing along with security, which is always evolving.
“Nearly all of those we surveyed said the skills required to be a great security professional have changed over the past few years.”
In recent years, cybersecurity conferences and online communities have been emphasizing the need to manage work stress and increase focus on mental health. While 93% expressed interest in understanding wellness issues, only 19% of companies provide resources for managing the stress associated with the specific issues of IT security.
Addressing the skills gap
In assessing the various ways organizations address the skills gap and strain on their teams, the survey found the following:
•A large majority (85%) believe managed services are a good option for addressing security skills gaps.
•Nearly half (46%) said they plan to use more managed services in 2020.
•Half (50%) said they will invest more heavily in training existing staff.
CISO involvement
The survey also explored views on chief information security officer (CISO) involvement. Of the 85% that said they have CISOs in their organizations, 40% said their CISOs are not involved enough in day-to-day operations, while 10% believed their CISOs are already too involved.
Erlin added: “CISOs should be focusing on high-level strategy, but because their teams are understaffed and have an overwhelming volume of work on their desks, they may have to get involved in daily operations, if they haven’t already. To solve the problems caused by skills gap issues, training and managed services are both good approaches.
“By partnering with providers, organizations can free themselves from operational work and gain insights that will help inform decisions. And because recruiting and training isn’t always possible, managed services provide businesses a way to augment their teams.”
==================================================================
I post the Wave Alternative below since it can explain why Wave solutions would help the cybersecurity resource situation as mentioned in the above article!!! And with Wave's better security, CISOs and cybersecurity teams could function at a much higher level with less stress and greater efficiency!!!
==================================================================
https://www.wavesys.com/wave-alternative
The IT perimeter is gone
With tablets, smartphones, and cloud applications, your employees can access sensitive data anytime, from anywhere. Indeed, around 70 percent of security breaches and data thefts are inside jobs. Meanwhile, the hackers only get better: advanced persistent threats (APTs) appear as normal traffic, and malware can go unnoticed for weeks.
It’s a new world, one without borders. Yet most organizations are still trying to protect their data with the same old firewalls and antivirus software. It’s not working. We refer you to the headline-making breach of the week.
You have to start with the device
Wave has an alternative: security that’s built into each and every device.
We’re talking about hardware: self-encrypting drives (SEDs), which protect data when a device is stolen or lost, and trusted platform modules (TPMs), or embedded security chips. Both go in at the factory, and increasingly, both are standard. They make it possible for you to monitor and control each individual device and its data, no matter where it is. But you need software to turn on and manage your SEDs and TPMs. Wave makes that software.
We’ve been refining comprehensive, centralized management of hardware-based security longer than anyone else. More than that, we’ve shaped the field as a founding member of the Trusted Computing Group, the not-for-profit that develops and promotes industry standards for the hardware.
Security that’s confirmed, not assumed
With Wave, you’ll know that you’re secure. Because we start with the individual devices, you get a broad, deep view of your network. You can see exactly who’s on it, with what devices and what apps, at any given time. Just for example, if Bob goes home and tries to log onto Facebook with the company laptop, Wave can stop him.
A big piece of this heightened security is device authentication. Traditional two-factor authentication requires what amounts to two user IDs. But by using the TPMs inside your devices, Wave can confirm the identity of not only users, but also the devices they’re on. Combine that with fast, enforced encryption of sensitive data via your SEDs—all easily managed with Wave software—and your data is protected from the full range of modern risks: device theft, missent emails, flash drives, portable hot spots … even (and no one else can say this) hardware keyloggers. Not to mention Bob.
Do we need to say that with Wave, compliance is no problem?
Start closing your security gaps today, with what you’ve got
You might be surprised to hear that 90 percent or more of your computers probably already have TPMs. Mobile devices are catching up fast. SEDs are newer, but you probably have a bunch of those too. Machines that don’t have them can often be outfitted at little to no extra cost. So you’ve got some or all of the hardware. All you need to do is turn it on with Wave.
It’s almost as easy as it sounds. TPMs and SEDs are built to open, vendor-neutral industry standards, and so are Wave solutions. That means Wave works on your existing mix of hardware, across platforms, and will evolve with you. It’s part of what makes the Wave alternative not only more secure, but also simpler and cheaper. Total cost of ownership for Wave data protection can be almost half that of a traditional software-based system.
Questions? Read on, or contact our sales department.
Beauty and the Breach: Estée Lauder Exposes 440 Million Records in Unprotected Database
https://www.securityweek.com/beauty-and-breach-est%C3%A9e-lauder-exposes-440-million-records-unprotected-database
Cosmetic company Estée Lauder exposed 440 million records to the Internet in a database that was left accessible without proper protection, a security researcher says.
Headquartered in New York, Estée Lauder sells products in more than 135 countries and territories. The Estée Lauder Companies owns multiple internationally renowned brands.
The exposed database was discovered on January 30 by Security Discovery security researcher Jeremiah Fowler, who attempted to contact Estée Lauder immediately after identifying user email addresses in the database.
In total, 440,336,852 records were inadvertently exposed to the Internet, including audit logs containing a large number of email addresses in each document.
The exposed data, Fowler says, included user email addresses in plain text. Internal email addresses from the @estee.com domain were also present in the database.
Additionally, there were production, audit, error, CMS, and middleware logs left widely accessible to anyone with an Internet connection. References to reports and other internal documents were also found in the database.
Details such as IP addresses, ports, pathways, and storage details were exposed as well, potentially providing cybercriminals with access deeper into the company’s network.
The security researcher notes that the database contained “millions of records pertaining to middleware” that Estée Lauder is using.
Software that provides services and capabilities outside of what the operating system has to offer, middleware commonly handles data management, application services, messaging, authentication, and API management, Fowler explains.
“Another danger of this exposure is the fact that middleware can create a secondary path for malware, through which applications and data can be compromised. In this instance anyone with an internet connection could see what versions or builds are being used, the paths, and other information that could serve as a backdoor into the network,” the researcher says.
Fowler, who says that the database was secured before he could investigate further, believes that no payment data or sensitive employee information was stored in the database.
What the researcher could not determine was the number of user email addresses exposed in the database and for how long the data was exposed to the Internet. It’s also unclear whether the data was accessed by threat actors or not.
SecurityWeek has contacted Estée Lauder for additional information on the exposure and will update the article when a response arrives.
==================================================================
Protect Content in the Cloud with Scrambls for Files
Scrambls Brings Privacy & Control to Social File Sharing with Instant Encryption
https://www.wavesys.com/buzz/pr/protect-content-cloud-scrambls-files
==================================================================
Estee Lauder is just one example of many where threat actors could be able to expose sensitive information, and this keeps happening over and over. Scrambls and Wave VSC 2.0 could help prevent problems such as the one in the above article!!!
==================================================================
https://www.wavesys.com/
Discrepancies between data sanitization policy creation and execution put data at risk
https://www.helpnetsecurity.com/2020/02/07/data-sanitization-policy/
Although 96 percent of the 1,850 senior leaders within large organizations have a data sanitization policy in place, 31 percent have yet to communicate it across the business, according to a Blancco survey.
Twenty percent of respondents also don’t believe their organization’s policies are finished being defined. Overall, over half of organizations (56 percent) do not have a data sanitization policy in place that’s being effectively communicated across the full company on a regular basis. This is increasing the risks of potential data breaches.
Not taking direct responsibility for IT asset erasure – 22 percent of employees are responsible for the management and control of their own end-of-life IT equipment when they leave the organization. Another 22 percent place this responsibility with their line manager.
If data sanitization policies haven’t been communicated to either party effectively, the chances of sensitive information being leaked as a consequence of insufficient erasure increase dramatically.
Leaving equipment languishing in storage areas
87 percent of global enterprises admitted not sanitizing assets as soon as they reach end-of-life, while 31 percent reported taking more than a month to sanitize these devices. This puts companies at risk of equipment loss, theft, and data breaches.
Performing offsite erasure
34 percent of enterprise organizations are sanitizing PCs and laptops offsite at end-of-life. Working with a third-party provider to sanitize equipment offsite isn’t necessarily a bad thing, but it does present certain risks, particularly if organizations don’t have complete visibility into the chain of custody for their IT assets and have no way to prove that the data on their assets wasn’t compromised during the transportation process.
Any external contractor needs to provide detailed audit trails for the entire chain of custody and certified erasure at end-of-life for these assets.
Lacking clear ownership of data sanitization policies
Although 68 percent of respondents felt that ownership of data sanitization policies is clearly communicated within their organization, when asked who was responsible for their implementation, 18 percent of enterprises stated the DPO, 18 percent the Head of Operations, 17 percent the Head of IT Operations and 11 percent the CISO.
This lack of clear ownership could suggest enterprises consider data sanitization to be a “‘checkmark”’ exercise that must be done to satisfy compliance or operational requirements and that they are not taking data risks seriously.
“The lack of robust data sanitization policies across global enterprises is alarming,” said Fredrik Forslund, Vice President, Enterprise and Cloud Erasure Solutions at Blancco.
“If they fail to formulate and communicate these policies effectively, at every stage of the data lifecycle, they risk putting significant amounts of potentially sensitive data at risk. It is vital they put processes in place, with clear ownership, and auditability for control, assigned to their senior leadership team to mitigate these risks.”
Flexible workers least likely to comply with data sanitization policies
A third of the enterprises surveyed also felt that flexible workers were the least likely to comply with data sanitization policies, while 40 percent believed contractors or freelancers were the least likely to understand or comply with their data sanitization policy.
There is not only a lack of clear ownership around the implementation of data sanitization policies but also a lack of accountability regarding how enterprises are complying with them.
The responsibility is spread across different job roles including the Head of Compliance (30 percent), Head of IT Operations (15 percent), Head of Operations (14 percent), Head of Legal (11 percent) and DPO (9 percent), leaving enterprises open to compliance breakdown and fines.
Key U.S. and Canada findings
Thirty-three percent of respondents in the U.S. and Canada also believe that flexible workers, who work at home or remotely, are the least likely to comply with data sanitization policies – implying that they may pose a security risk.
Thirty-two percent of employees in enterprises in the U.S. and Canada are responsible for the management and control of their own end-of-life IT equipment when they leave the organization. Nineteen percent place this responsibility with their line manager.
More than a third (32 percent) of enterprises in the U.S. and Canada also stated that they are placing their Head of Compliance in charge of complying with their data sanitization policies which is encouraging. However, only nine percent are giving this responsibility to their DPO.
Key U.K. findings
Despite 97 percent of U.K. companies having a data sanitization policy in place, more than a third (37 percent) have yet to communicate it across the business. Overall, nearly half of companies (42 percent) do not have a data sanitization policy in place that’s being effectively and regularly communicated across the organization.
20 percent of employees in U.K. companies are responsible for the management and control of their own end-of-life IT equipment when they leave the organization. 35 percent place this responsibility with their line manager.
Worryingly, 58 percent of U.K. enterprises also reported not being aware of when their organization’s IT security policy was last updated and 56 percent aren’t clear about what it contains, the highest percentage points from all the countries surveyed.
==================================================================
https://www.wavesys.com/products/wave-self-encrypting-drive-management
Excerpt:
Enterprises choose Wave to manage SEDs
Why? From our single console, you can manage all your organization’s self-encrypting drives (SEDs) easily and remotely, whether they number in the hundreds, or hundreds of thousands.
SEDs are the most secure, best-performing and most transparent encryption option for protecting data on laptops. These drives automatically encrypt all data written to the drive, so you don’t have to decide what’s important enough to encrypt. They also perform this encryption in the hardware of the drive, so you don’t end up with the performance issues software full-disk encryption is infamous for. SEDs are available as HDD or SSD, and are sold by most major drive manufacturers.
Wave’s management solution delivers remote drive initialization, user management, drive locking, user recovery and crypto-erase for all Opal-based, proprietary and solid-state SEDs.
==================================================================
Crypto erase remotely could help with the sanitization needs for an organization, and make them easier and more efficient when using Wave SED management when computers reach their end of life!! Knowing that an organization's data at rest is protected, this is another Wave solution that could ease the level of stress for organizations and organizations' CISOs!!
Impact of Stress and Burnout Worsens for CISOs
https://www.infosecurity-magazine.com/news-features/impacts-stress-burnout-cisos?utm_source=twitterfeed&utm_medium=twitter
The role of the CISO is one rife with challenges. Ultimately responsible for protecting an organization’s data, they must overcome issues such as an ever-evolving threat landscape, a widening attack surface, resources management and business alignment. It goes without saying that, whilst a CISO’s job can prove exciting and rewarding, it can come with high levels of stress and feelings of burnout.
Evidence of high stress levels in CISO/security leadership roles has been plentiful. In April 2019, research from Symantec revealed that 82% of IT security leaders across Europe were suffering from mental and physical burnout, with nearly two-thirds thinking about leaving their job (64%) or quitting the industry altogether (63%) as a result.
Earlier in the year, a report from Nominet discovered that 27% of CISOs felt stress was impacting their mental or physical health, with 23% saying the role was damaging their personal relationships. What’s more, 17% admitted they had turned to medication or alcohol to deal with workplace stress.
In fact, Infosecurity explored the issue of dealing with stress in information security job roles as far back as 2015.
What’s clear is that stress and burnout within security leadership occupations has been prevalent for some time, but new research from Nominet has revealed that the problem is continuing to intensify.
The firm surveyed 400 CISOs and 400 C-suite executives in the UK and US on the challenges of the CISO role and compiled it’s findings into The CISO Stress Report: Life Inside the Perimeter, One Year On. This research expanded on Nominet’s report from a year earlier and looked deeper into the causes and impact of stress on CISOs.
The research found that the vast majority of CISOs (88%) remain moderately or tremendously stressed, and although this marked a slight decrease from 91% in 2019, stress appears to be taking a greater toll on CISOs’ lives.
For example, 48% of CISOs said work stress has had a detrimental impact on their mental health, almost twice as high as last year, whilst 31% reported that stress had impacted their physical health. What’s more, 40% of CISOs admitted that stress levels had affected their relationships with their families, with just under a third (32%) stating it had repercussions on their marriage, romantic relationships and personal friendships (up from 23%). In terms of coping mechanisms, the number of CISOs turning to mediation or alcohol as a result of stress has increased to 23%.
Almost three-quarters (71%) of CISOs said their work-life balance was heavily weighted towards work, with 95% working more than their weekly contracted hours (something that 87% of CISOs felt compelled to do by their organization). As many as 83% of CISOs admitted to spending half their evenings and weekends thinking about work, with just 2% always able to switch off from work outside of the office. Interestingly, almost all surveyed CISOs (90%) would opt for a pay cut if it improved their work-life balance.
However, it’s not just CISOs themselves suffering more from stress. Nominet’s report also discovered that 31% of CISOs (a 2% increase on last year) feel the impact of stress has affected their ability to do their job. This could be having negative impacts on organizations as a whole, not to mention exacerbating the fact that the average tenure of a CISO is just over two years.
Speaking to Infosecurity, Stuart Reed, VP of cyber at Nominet, said that there are inescapable elements of a CISO’s job that, by nature, make it a high-pressured role.
“In many cases, the pressures of the CISO role are being exacerbated into stress by internal organizational factors. On top of their day-to-day job, CISOs are facing poor work-life balances, they are missing family events and milestones, they fear losing their jobs and, in almost 100% of cases, the board is expecting them to deliver more. While the remit of the CISO will remain a constant, these factors could be controlled better.”
Dr Dimitrios Tsivrikos, lecturer in Consumer and Business Psychology, University College London, concurred: “While there have been positive steps in mental health and stress-related issues, the essence of tackling these issues has not received as much attention as needed. We do anticipate that stress levels will continue to rise until we address the issue of stress, mental health and wellbeing at work.”
So what must be done to do exactly that? For Reed, the responsibility for and ability to reduce the stress load on CISOs lies largely with the board.
“One of the key findings of the report was that, while boards were cognizant of the stress faced by their security teams, they were doing little to address the issue. If boards want their organization to be effectively protected, they need to reduce the stress being placed on the CISO – otherwise they risk it leading to burnout. Urgent red flag issues that need to be addressed are CISOs being expected to work overtime, CISOs feeling like their job is on the line in the case of a security breach and, most importantly, a lack of support for mental health problems. The board can address all of these areas. Doing so will significantly reduce the internal pressures on the CISO and foster a healthier working environment.”
Reed also told Infosecurity that, to help CISOs recognize and gauge their stress levels, Nominet has (today) launched the CISO Stress Calculator, or ‘Stressulator.’
“We created the CISO Stressulator off the back of the dedicated research report,” he explained. “We used the key findings from the report to identify areas where CISOs felt particularly stressed. While it is not a scientific assessment of how stressed a CISO might be, it should give an indication as to where they sit on the scale. Our aim with the CISO Stessulator is to generate awareness around the issue of CISO stress.”
By raising the issue of CISO stress, Reed concluded, “we hope that wellbeing will be taken more seriously.”
Infosecurity will be exploring strategies for combatting burnout and stress in security leadership roles in a live session as part of its next Online Summit, taking place on March 25 and 26 2020. Find out more and register for the event here.
=================================================================
https://www.wavesys.com/products/embassy%C2%AE-remote-administration-server-tpm-management
Secure device & user authentication
Sometimes it feels like security is more effective at deterring your users than hackers. But you still have to protect your enterprise resources, and we’re here to help. We take pride in securing your network, data, and resources to an unprecedented level, without causing a revolt from either IT or your users. In fact, your users probably won’t even know we’re there.
Here’s how it works:
Trusted Platform Module (TPM) + Wave’s ERAS for TPM Management = hardware-secured, fully-managed authentication
Most of your devices already come with TPMs (check out our “What is a TPM?” brochure if you’re not sure why this is exciting). This security chip comes attached to the motherboard of most enterprise-class PCs. There’s nothing “add-on” about it. The TPM provides a verifiable, unique identity for each machine.
Wave’s ERAS for TPM Management gives IT remote, centralized management of all TPMs on enterprise computers and tablets.
With this control, IT can set policies and dictate which machines and users have authority to access which resources. IT can ensure that only known and approved devices are accessing your network. And what’s more, IT can prove it with detailed activity logs.
==================================================================
https://www.wavesys.com/wave-alternative
The IT perimeter is gone
With tablets, smartphones, and cloud applications, your employees can access sensitive data anytime, from anywhere. Indeed, around 70 percent of security breaches and data thefts are inside jobs. Meanwhile, the hackers only get better: advanced persistent threats (APTs) appear as normal traffic, and malware can go unnoticed for weeks.
It’s a new world, one without borders. Yet most organizations are still trying to protect their data with the same old firewalls and antivirus software. It’s not working. We refer you to the headline-making breach of the week.
You have to start with the device
Wave has an alternative: security that’s built into each and every device.
We’re talking about hardware: self-encrypting drives (SEDs), which protect data when a device is stolen or lost, and trusted platform modules (TPMs), or embedded security chips. Both go in at the factory, and increasingly, both are standard. They make it possible for you to monitor and control each individual device and its data, no matter where it is. But you need software to turn on and manage your SEDs and TPMs. Wave makes that software.
We’ve been refining comprehensive, centralized management of hardware-based security longer than anyone else. More than that, we’ve shaped the field as a founding member of the Trusted Computing Group, the not-for-profit that develops and promotes industry standards for the hardware.
Security that’s confirmed, not assumed
With Wave, you’ll know that you’re secure. Because we start with the individual devices, you get a broad, deep view of your network. You can see exactly who’s on it, with what devices and what apps, at any given time. Just for example, if Bob goes home and tries to log onto Facebook with the company laptop, Wave can stop him.
A big piece of this heightened security is device authentication. Traditional two-factor authentication requires what amounts to two user IDs. But by using the TPMs inside your devices, Wave can confirm the identity of not only users, but also the devices they’re on. Combine that with fast, enforced encryption of sensitive data via your SEDs—all easily managed with Wave software—and your data is protected from the full range of modern risks: device theft, missent emails, flash drives, portable hot spots … even (and no one else can say this) hardware keyloggers. Not to mention Bob.
Do we need to say that with Wave, compliance is no problem?
Start closing your security gaps today, with what you’ve got
You might be surprised to hear that 90 percent or more of your computers probably already have TPMs. Mobile devices are catching up fast. SEDs are newer, but you probably have a bunch of those too. Machines that don’t have them can often be outfitted at little to no extra cost. So you’ve got some or all of the hardware. All you need to do is turn it on with Wave.
It’s almost as easy as it sounds. TPMs and SEDs are built to open, vendor-neutral industry standards, and so are Wave solutions. That means Wave works on your existing mix of hardware, across platforms, and will evolve with you. It’s part of what makes the Wave alternative not only more secure, but also simpler and cheaper. Total cost of ownership for Wave data protection can be almost half that of a traditional software-based system.
Questions? Read on, or contact our sales department.
=================================================================
If CISOs read the data in the two links above, they could have a much better stress level to deal with in the future if they then used Wave solutions!!! Wave solutions could also dramatically impact organizations' stress levels for the better!!!
500,000 victims pummeled in multi-stage BitBucket malware scheme
https://www.cyberscoop.com/bitbucket-multi-stage-malware-campaign-cybereason/
An ongoing campaign from an unidentified threat actor has been deploying seven different kinds of malware — including ransomware — at once against an estimated 500,000 targets over the past couple of months to steal as much money as possible, according to new research from Cybereason.
The different kinds of malware deployed from just this one actor — which allows them to steal sensitive browser data, cookies, system information, two-factor authentication token information to bypass 2FA, and cryptocurrency from digital wallets — is “unprecedented,” Lior Rochberger, a security analyst at Cybereason, and Assaf Dahan, the head of threat research at Cybereason. The two released their findings on Wednesday.
“The combination of so many different types of malware exfiltrating so many different types of data can leave organizations unworkable,” Rochberger and Dahan write. “This threat is able to compromise system security, violate user privacy, harm machine performance, and cause great damage to individuals and corporations by stealing and spreading sensitive information, all before infecting them with ransomware.”
The attackers make their scheme work by exploiting code repository platform BitBucket to store and disperse the malware, according to Cybereason.
“[It’s] an ongoing trend with cybercriminals where they abuse legitimate online storage platforms like Github, Dropbox, Google Drive, and BitBucket to distribute commodity malware,” Rochberger and Dahan write in the blog post.
The campaign is relatively new — it popped up on Cybereason’s telemetry in December of last year, Dahan told CyberScoop. But the ultimate goal of the effort appears to be for money.
“The attackers aren’t satisfied with one payload, they want to use multiple to maximize their revenue,” the researchers write.
The attackers are running their scheme by targeting people scouring the internet for free commercial products, such as Adobe Photoshop. The threat actors will package them with multiple strains of malware, such as Azorult, which steals information and deletes its binary to erase traces of an infection.
“Legitimate applications are an easy, trusted way for attackers to gain entry and spread malware within an organization,” the researchers write.
Shortly after Azorult starts pilfering off information, Predator the Thief malware steals passwords from browsers, takes pictures and screenshots of the victims’ machines, and steals cryptocurrency out of digital wallets. The Thief malware can then connect with BitBucket to download more payloads, including STOP Ransomware, a Monero miner, and Vidar, which can steal web browser history, digital wallets, two-factor authentication tokens, and screenshots.
And although the researchers have ascertained what malware the attackers are using, Dahan told CyberScoop it’s not entirely clear who is behind the thievery.
“It’s hard to estimate who is the threat actor behind this campaign, because all the malware observed in the campaign fall under what we call ‘commodity’ malware. That means that almost anyone can buy them in the underground communities,” Dahan said.
=================================================================
This article reveals quite astoundingly that organizations should be using Wave solutions such as Wave VSC 2.0 and Wave Endpoint Monitor in a very beneficial way rather than ineffectively using 2FA tokens and antivirus software!!!
==================================================================
https://www.wavesys.com/
https://www.wavesys.com/products/wave-virtual-smart-card
https://www.wavesys.com/malware-protection
https://www.wavesys.com/products/wave-endpoint-monitor
Reading what is in these links can help one see the great advantages in owning these solutions!!! The White Paper for Wave VSC 2.0 is also quite interesting!!!
=================================================================
https://www.wavesys.com/contact-information
GSA Wants More Ideas To Stop Fake Commenters From Flooding Rulemaking Process
https://www.nextgov.com/it-modernization/2020/01/gsa-wants-more-ideas-stop-fake-commenters-flooding-rulemaking-process/162786/
The General Services Administration took over management of the eRulemaking portal last year with a mandate to crack down on fraudulent commenting.
Federal agencies—particularly regulatory agencies—want and are often required to solicit feedback from the public when issuing new rules. Most often, these comments are submitted through a web portal such as the General Services Administration-run eRulemaking site.
However, with technology often comes unforeseen consequences. When it comes to commenting on rules, the ease of commenting through a website has led to a rise in fake comments posted by trolls, bots and other insincere operators.
GSA took over management in October of the eRulemaking program from the Environmental Protection Agency, which had run the website since 2002. With the change in agency management, GSA established the eRulemaking Program Management Office and began steps to upgrade the commenting portal. As they do so, the agency wants to hear some of the best ideas for preventing the flood of fake comments.
For example, in 2017, the Federal Communications Commission asked for public feedback on its Net Neutrality regulation. The call received some 22 million comments, though half of those were later determined to be fraudulent.
“What’s the big deal about fraudulent comments? Why should anyone care about these to begin with, given that we have a gating mechanism downstream from our agencies, they can resolve it?” Sanith Wijesinghe, an innovation area lead at the federally-funded MITRE group, asked during a public meeting Thursday held by GSA. “These identities were stolen from citizens at large, high-profile senators, celebrities. Elvis was supposed to be commenting on a couple of those. You now have, on the public record, a statement attributed to someone without their consent. It takes quite a lot of effort to correct that. And not everyone has the resources to do that.”
Wijesinghe noted this follows similar patterns to identity theft in other criminal activities, including the use of deceased individuals.
“Their next of kin are on the hook to try to resolve those issues,” he said.
There is a cost for federal agencies, as well, he added.
“Given that we now have the Evidence-Based Policymaking Act, the overhead associated with tracking down all of the assertions made in these comments is a non-trivial effort,” he said. “We really need to make sure our policies are truly evidence-based and not fake-evidence based.”
One potential solution is the use of CAPTCHA widgets, which asks the user to perform a task ill-suited to bots, such as identifying pictures with certain features or copying a string of characters that is blurred or otherwise obscured.
“Some of the ideas out there right now, including things like CATPCHA, raise the bar in terms of taking out some of those … not-so-smart kind of bots. But it’s only going to get worse,” Wijesinghe said, expressing concern over an impending arms race in this space.
He suggested restructuring the commenting process through eRulemaking to be more structured and less of a “free for all.”
“A more directed comment process where you can actually map comments to particular provisions” is one option he offered. While bots could still attack such a process, “It does increase the cost and potentially streamline the process downstream for our agencies.”
Michael Fitzpatrick, head of global regulatory affairs at Google, echoed Wijesinghe’s suggestion to use CAPTCHA technology, though the traditional use of that technology has its own problems.
“That adds a lot of friction to the process,” he noted. “That is the great balance for agencies and for the rulemaking process: We want to protect against bad actors but we don’t want to add a level of friction that deters democratic participation in the process.”
However, newer versions of the CAPTCHA technology can be made invisible to the user.
“The enterprise will undertake to screen every single interaction with the website using an individual token for that particular interaction,” Fitzpatrick explained. “Everybody is treated as a first-time user. There are sophisticated collections of data—not personal data—data around how the submission is being made. Click speeds, click patterns, the nature of the comment that is actually being filed. Using machine learning, you can draw a risk score between one and 10 that is predictive of whether or not that is a suspect, bot-driven submission.”
Once that algorithm is in place, agencies can then set a threshold for allowing comments, with scores that fall below that level flagged for further review.
“That can be two-factor authentication, it can be a phone call, it could be the dreaded reCAPTCHA widget,” he said. “That will substantially shut down the bot activity and will have very little to no disruption for legitimate users.”
Thursday’s public meeting also dealt with mass comments, in which a large number of respondents comment with the exact same content. While there are issues associated with this trend as well, mass comments are not illegitimate comments, according to several panelists, though at times agencies might want a larger number of individual, substantive comments.
Tobias Schroeder, director of GSA’s eRulemaking Program Management Office, said the agency does not have a specific timeline on changes or new technology upgrades, but said his office plans to move as quickly as possible.
A second public meeting is set for March 25 to get additional public comments, and GSA has a standing docket open for public comments until April 30.
Editor's Note: This story has been updated to correct the timeline for GSA taking over management of the eRulemaking program.
=================================================================
Requiring a TPM that is turned on could serve as an identifier to those devices/users who want to make public comments. That way any TPMs or unidentified devices that are there for nefarious purposes could be kicked off the network. And since TPMs are ubiquitous, most business users have them in their devices. This would be more simple and secure than CAPTCHAs!!! There are over 1 billion TPMs in existence. Using them for this and many other instances makes a lot of sense!!
=================================================================
https://www.wavesys.com/
CERN drops Facebook’s Slack competitor, citing privacy issues and low usage
https://www.cnbc.com/2020/01/31/cern-cuts-workplace-by-facebook-blasts-privacy-issues-low-usage.html
CERN, the European Organization for Nuclear Research, on Friday ended its use of Workplace by Facebook, the company’s communications tool for companies.
The organization disclosed its decision to stop using the enterprise Facebook tool on Tuesday, citing a lack of usage by CERN members and concern about data privacy.
CERN, the European Organization for Nuclear Research, on Friday ended its use of Workplace by Facebook, the company’s communications tool for companies.
The organization disclosed its decision to stop using the enterprise Facebook tool in a press release on Tuesday, citing a lack of usage by CERN members and concerns about data privacy.
“Many people preferred not to use a tool from a company that they did not trust in terms of data privacy,” CERN said in its release. “To date, about 1000 members of the CERN community have created a Workplace account and there are roughly 150 active users of the platform per week.”
Please see the link above for the rest of the article.
==================================================================
Just think what Wave could do for Facebook by providing both Scrambls and Knowd for Facebook Workplace!!!
==================================================================
Protect Corporate Use of Social Media and Cloud Services with Scrambls for Enterprise
Encrypt Postings and Shared Files to Ensure Privacy and Compliance
https://www.wavesys.com/buzz/pr/protect-corporate-use-social-media-and-cloud-services-scrambls-enterprise
==================================================================
Wave Knowd Introduces New Model for Internet Authentication Without Passwords
Knowd ‘Trust Score’ Assures User Identity when Accessing Web Services
https://investorshub.advfn.com/secure/post_new.aspx?board_id=17
SEC Urges Better Cybersecurity Practices at Financial Firms
https://www.wsj.com/articles/sec-urges-better-cybersecurity-practices-at-financial-firms-11580207402
==================================================================
Wave Announces 5-Year Master License Agreement for Virtual Smart Card 2.0 with Leading Global Financial Services Company
https://www.wavesys.com/buzz/pr/wave-announces-5-year-master-license-agreement-virtual-smart-card-20-leading-global
Wins competitive evaluation against market leader in two-factor authentication tokens
Lee, MA -
December 17, 2015 -
Wave Systems Corp. (NASDAQ: WAVX) announces a five-year master licensing agreement (MLA) with a leading global corporation (as determined by the 2015 Fortune Global 500 List) for its Virtual Smart Card 2.0 solution. This MLA sets the terms and pricing for licenses and maintenance across the customer’s global organization and establishes it as their preferred two-factor authentication solution. Instead of one large license purchase for the entire organization, each of the customer’s subordinate divisions will make separate orders in accordance with the terms of this MLA.
The first purchase of 2,000 VSC 2.0 licenses under this agreement, when added to a previous purchase, completes the requirement for the customer’s global IT division. That division will now lead the internal effort to standardize the remaining 150,000+ endpoints within their organization with the new Wave VSC 2.0 solution. While there are no minimum order requirements under the agreement, discussions for additional orders are underway.
“Our five-year agreement with this customer is the first very large scale contract for VSC 2.0 and is an important milestone for Wave,” said Bill Solms, President and CEO of Wave Systems. “This customer is a major global financial services company and their standards for protecting their systems from unauthorized access and the integrity of their data are of the highest order. Wave had to pass a very rigorous technical and business review to win the competition. We believe that this client’s decision to choose Wave Virtual Smart Card 2.0 over their incumbent solution gives us tremendous credibility in the two-factor authentication market. We will remain engaged with this company in order to complete the additional sales and deployments in the months ahead.”
Wave Virtual Smart Card 2.0 is a tokenless, hardware-based, two-factor authentication solution that offers superior security at less than half the cost of comparable solutions. It is the industry’s only enterprise-grade virtual smart card management solution that works on Windows 7, 8 and 10. It also provides management support for the Microsoft Virtual Smart Card on Windows 8 and 10. Wave’s VSC solution emulates the functionality of physical smart cards or tokens, but offers greater convenience to users, significantly lower total cost of ownership, and a greatly reduced risk of unauthorized access.
Wave Virtual Smart Card 2.0 gives IT the ability to:
• Remotely create and delete virtual smart cards
• Provide help desk-assisted recovery
• Configure Passphrase and card policies
• View the status of virtual smart cards and enrolled certificates
• Generate reports for compliance
• Support virtual smart cards on laptops, tablets and desktops with both TPM 1.2 and TPM 2.0 security chips
=================================================================
If the SEC is going to urge practices like multi factor authentication, organizations should help prevent breaches with better security by using Wave VSC 2.0!!! 160,000 breaches in the last 18 months show how well existing 2FA enterprise products are helping prevent breaches.
==================================================================
The first link below has Wave's solutions which could make a huge positive impact in the cybersecurity market!! The second link has more great details about Wave VSC 2.0 that aren't covered in the article above. The third link contains very interesting information in the Wave VSC 2.0 White Paper!
https://www.wavesys.com/
https://www.wavesys.com/products/wave-virtual-smart-card
https://www.wavesys.com/virtual-smart-card-2.0-from-wave
Government tightens law around IoT cyber security
https://www.computerweekly.com/news/252477375/Government-tightens-law-around-IoT-cyber-security
Excerpt:
It will mean robust security standards are built in from the design stage and not bolted on as a afterthought.
==================================================================
It sounds like the new law should also have an activated TPM as law in corporate cybersecurity. With 160,000 breaches in the last 18 months, activated TPMs turned on with Wave software could transform these breach statistics for the better!!! Unknown devices (bad guys) would be kept off the network, and having TPMs in the network would only allow the good guys on the network. Use the built in protection in corporate devices (TPMs) to help organizations actually take advantage of much better cybersecurity!! Software only is not working as well as hardware (TPM) and software!!!
==================================================================
https://www.wavesys.com/
Wyden calls on NSA to examine White House cybersecurity following Bezos hack
https://thehill.com/policy/cybersecurity/479797-wyden-pressures-nsa-to-examine-white-house-cybersecurity-following-bezos
==================================================================
This could end up being a really interesting article!!
==================================================================
Wave can be very, very helpful in so many cybersecurity (Trusted Computing) ways!!
https://www.wavesys.com/
Mitsubishi Electric Blames Anti-Virus Bug for Data Breach
https://www.bankinfosecurity.com/mitsubishi-electric-blames-antivirus-bug-for-data-breach-a-13628
Hackers Exploited AV Software Zero-Day Vulnerability Before Vendor Patched Flaw
Mitsubishi Electric says hackers exploited a zero-day vulnerability in its anti-virus software, prior to the vendor patching the flaw, and potentially stole trade secrets and employee data.
The Japanese multinational firm's Monday announcement arrives more than six months after the company says it first detected the breach on June 28, 2019.
"We have confirmed that trade secrets may have been leaked to the outside," Mitsubishi Electric says in a statement. "To date, no damage or impact related to this case has been confirmed."
There's irony, of course, in a company falling victim to a data breach because attackers exploited its security software. But security researchers have continually warned that security software is like any other software, in that it can contain unknown vulnerabilities that hackers can sometimes exploit to their own advantage (see: Devastating Flaw Found in Microsoft's AV Engine).
Mitsubishi Electric is one of Japan's largest companies, making a broad range of products, including turbines and nuclear power and satellite equipment. It also has a considerable consumer product line, including air conditioners and LCD televisions.
Hackers Erased Log Files
The Japanese firm says that after it detected unauthorized access, it restricted external access to its systems. But the resulting investigation was hampered by a lack of log files, which the company says "were erased by the hackers."
Mitsubishi Electric says data it believes was exposed during the attack includes records belonging to 1,987 job applicants, employee data for 4,566 new graduate recruitment applicants, information on 1,569 retired employees, as well as corporate-confidential technical and sales materials.
The company says it started notifying breach victims via email and postal mail on Monday.
Left unanswered by Mitsubishi Electric is the question of what anti-virus software the company uses, the timeline of the attack, or how long it took the company to detect the intrusion after it happened. Mitsubishi Electric didn't respond to a query from Information Security Media Group.
But a case study from 2015 published by Trend Micro says that Mitsubishi Electric Information Systems Corp., which oversees IT for Mitsubishi Electric Group, used some of its products. Trend Micro didn't respond to a request for comment.
As with every type of software, flaws sometimes crop up in Trend Micro products that require patching. In January 2016, for example, the company patched a flaw in one of its consumer products that it said attackers could have exploited to run any code on a user's machine (see: Yes Virginia, Even Security Software Has Flaws).
Mitsubishi Electric Has Used Trend Micro
According to the 2015 case study, products used by Mitsubishi Electric Information Systems Corp. included OfficeScan, which is endpoint detection software that uses multiple techniques - including machine learning, reputation analysis and behavioral analysis - to detect malware. The company also used Trend's Deep Discovery Email Inspector, which aims to detect targeted attacks, including those using malicious compressed files.
The case study describes Mitsubishi Electric's problem before using Trend Micro's software as having "difficulty defending against sophisticated email attacks disguised zero-day malware as legitimate traffic from customers and suppliers."
The age of the case study, however, means that Mitsubishi Electric may have long moved on from using Trend Micro's products. Also, large companies tend to use a variety of security products, so the problem could lie elsewhere.
Japanese national newspaper Asahi Shimbun reports that Mitsubishi Electric believes that the gang behind the attack is affiliated with a Chinese advanced persistent threat group called "Tick."
In November 2019, Trend Micro published a detailed report on Tick, aka Bronzebutler or Rebaldknight. The report describes a campaign that Trend Micro dubbed Endtrade, which ran throughout last year.
"Tick targets companies in defense, aerospace and satellite industries, specifically those with head offices in Japan and subsidiaries in China," Trend writes.
The group regularly practices spear phishing, meaning it often steals email account credentials and then uses the compromised accounts to send malware. Trend Micro notes that the group's emails are often written in correct Japanese, and also that the attackers have developed "new malware families capable of detection evasion for initial intrusion."
In addition, Tick appears to have devoted time and resources to finding ways to bypass Trend Micro software defenses. "They have also incorporated techniques and mechanisms for detecting specific cybersecurity products and processes, as well as attempt to terminate a Trend Micro product's process," according to the security firm's report.
Not a Timely Breach Notification
Mitsubishi Electric's data breach notification arrives more than six months after the company says it detected the intrusion.
Legally, however, it appears to be in the clear. Law firm DLA Piper says Japanese organizations aren't required to report data breaches to the country's Personal Information Protection Commission or to victims. But the PPC does recommend that organizations do so, and DLA Piper writes that it is standard market practice to do so.
In April 2018, furthermore, Mitsubishi Electric pledged to follow "timely and appropriate information disclosure" in regards to data breaches.
"In the unlikely event that valuable information or confidential corporate information entrusted to us by others were to leak, this would not only cost the trust and confidence invested in the company," it says. "The improper use of this information could also threaten national, societal and individual security."
At some point, Mitsubishi Electric did inform the Japanese government about the breach, Japan Times reports. According to the publication, Chief Cabinet Secretary Yoshihide Suga said the company has "confirmed there is no leak of sensitive information regarding defense equipment and electricity."
Mitsubishi Electric has made recent moves to strengthen its information security practices. In April 2019, the company created a Product Security Incident Response Team, which handles security issues with its products and services, according to its Information Security Report, which was published in July 2019. The company's PSIRT also runs a 24/7 security operations center.
==================================================================
Well renowned organizations have successfully used Wave solutions. Those solutions could have protected Mitsubishi Electric and many other organizations (160,000 in the last 18 months)!! Why continue with the stress and large loss of money, buy better security at less than half the cost!!!
==================================================================
https://www.wavesys.com/
LastPass is in the midst of a major outage
LastPass issue appears to impact users with accounts dating back to 2014 and earlier.
https://www.zdnet.com/article/lastpass-is-in-the-midst-of-a-major-outage/?ftag=COS-05-10aaa0g&taid=5e25a4920a3ab60001228d28&utm_campaign=trueAnthem%3A+Trending+Content&utm_medium=trueAnthem&utm_source=twitter
Password management service LastPass is currently going through a major outage as users are reporting being unable to log into their accounts and autofill passwords, with some users reporting issues going back for days.
User reports about login issues have been flooding Twitter, but also the company's forum, Reddit, and DownDetector. Users are reporting receiving the following error when trying to log in: "An error has occurred while contacting the LastPass server. Please try again later." Both home and enterprise users are impacted.
According to reports, LastPass' support staff has been either non-responsive, or denying reports of any technical issue happening at all. Despite issues being reported as far back as three days, the company has not updated its status page to reflect the incident, nor do they provided any type of explanation or useful help to their userbase.
"The fact that LastPass is denying on twitter that there is any outage when multiple people are reporting auth server issues and are locked out with no support response means that I have to walk," said one user on Reddit. "The worst part is not the outtage itself but their (lack of ) response. You gotta be able to trust your password manager and now I can't."
@LastPassHelp I can't login, I have these errors:
On your site: "An error has occurred while contacting the LastPass server. Please try again later."
On the chrome extension, no error but I can't log in.
On Windows, see the screenshot pic.twitter.com/UtXOguANx0
— Fako (@Fakochair) January 19, 2020
pic.twitter.com/n2ggS5DWuS
Please see more at the link above.
==================================================================
Can users afford outages like this? Changing to a more reliable and secure solution like Wave VSC 2.0 could save a lot of unnecessary stress and lost productivity on the part of LastPass business users.
==================================================================
https://www.wavesys.com/products/embassy%C2%AE-remote-administration-server-tpm-management
Token-free, password-free user authentication
We know you’ve dreamt about shredding your list of passwords. Go on and do it.
Because you are starting the authentication process in the device’s hardware, the user doesn’t have to interact with it. All users see is their usual Windows log-in screen – no more additional passwords to access the VPN or other resources. They just sign in once, and the secure credentials in their TPMs securely and quickly connect them to everything they need. Say goodbye to user frustration and slow OS performance.
==================================================================
For all of Wave's great solutions and articles, please visit the link below:
https://www.wavesys.com/
Paypal confirms users may have been affected by security breach
https://consumerandsociety.com/2020/01/14/paypal-confirms-users-may-have-been-affected-by-security-breach/
According to a report by a security analyst, Alex Birsan, PayPal has put user passwords at risk to hackers. PayPal has confirmed the claims and admitted that weaknesses in its security could have put users at risk in early December 2019.
The issue was disclosed last week, and Birsan, the researcher, reportedly, was awarded $15,300 for discovering the issue. He said that he discovered the flaw in the site’s security when looking at the main authentication flow on the website itself.
He noticed that the JavaScript file on the website didn’t look right and contained what seemed like a cross-site request forgery (CSRF) token and a session ID. He noted that this means that revealing session data within a JavaScript file “usually allows it to be retrieved by attackers.”
In a public disclosure, he said that “This is the story of a high-severity bug affecting what is probably one of PayPal’s most visited pages.” Brisan says that there was a work-around to PayPal’s security measures that was easy to discover by hackers.
PayPal has since carried out its own investigations into the concerns. It says that “sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation,”
When using the site, in some cases, users are required to authenticate the page by solving a CAPTCHA challenge. If there are a number of failed attempts to log in, users may not be required to carry out the authentication challenge.
PayPal added that, in order for the security flaw to happen, users would have to follow a link from a malicious site and then be tricked into giving their login details and password. If they did this, hackers could obtain the information and complete the security test.
The company said in a statement, “This exposure only occurred if a user followed a login link from a malicious site, similar to a phishing page.”
==================================================================
5 reasons why Wave Knowd would be a great authentication solution for Paypal and its customers:
1. Wave and PayPal tested under NSTIC.
2. Wave Knowd would be simple to use and secure for PayPal and its customers.
3. CAPTCHAs would be a thing of the past.
4. PayPal would be uniquely and be better protected vs. other 2FA products.
5. Occurrences like in the article above wouldn't happen if Wave Knowd became available.
Please see previous post for more information on Wave Knowd!!
German Researchers Accessed Service Members’ Sensitive Medical Data—and One Lawmaker Wants Answers
https://www.nextgov.com/cybersecurity/2020/01/german-researchers-accessed-service-members-sensitive-medical-dataand-one-lawmaker-wants-answers/162497/
Sen. Mark Warner wants to know what the Defense Health Agency is doing to secure “a significant number” of medical images.
A Democratic lawmaker wants answers and actions taken to address unsecured servers at three military medical facilities that he said are putting service members’ personal information at risk.
Sen. Mark Warner, D-Va., penned a letter to the Defense Health Agency Thursday pressing it to eliminate the exposure of sensitive medical data belonging to military personnel that he said remains vulnerable due to risky practices at Fort Belvoir Medical Center, Ireland Army Health Clinic and the Womack Army Medical Center.
“The exposure of this information is an outrageous violation of privacy and represents a grave national security vulnerability that could be exploited by state actors or others,” Warner wrote.
DICOM is the standard format for medical images, and Warner—who co-chairs the bipartisan Senate Cybersecurity Caucus—recently learned that anyone with a DICOM web viewer can access service members’ personally identifiable and sensitive medical information from the three entities, due to unsecured Picture and Archiving Servers, or PACs. Last September, Warner wrote to health care entities that controlled the PACs after a comprehensive investigation detailed how the servers were leaving millions of Americans’ medical images up for grabs on the internet without their consent.
Following the first letter, the images were removed—but Warner said records belonging to 6 million Americans were still accessible online. In November, the lawmaker wrote to the Health and Human Services Department’s Office of Civil Rights about the information that remained exposed. Since then, the senator said 16 systems, 31 million images and 1.5 million exam records were removed from the internet.
“However, I recently learned that a significant number of medical records belonging to servicemembers remain online,” Warner wrote in the latest correspondence. That information, he noted, was discovered by German researchers who accessed the information using German IP addresses.
“This itself should have triggered alarms by the hospital information security systems,” he wrote.
In Thursday’s letter, the lawmaker presses the agency to remove the vulnerable PACs from open access to the internet and immediately mitigate the security issues. To understand the severity of exposure, Warner also asks officials to answer a series of questions regarding information security management practices at military medical hospitals. He asks whether full-disk encryption and authentication for PACs are required by the agency and whether hospitals are directed to hire chief information security officers, among other questions. Warner also added that he expects a response within two weeks due to the issue’s gravity.
“As a matter of national security, the sensitive medical information of our men and women of the armed services is particularly vulnerable and should be, at a minimum, protected by robust security controls and routine scans,” he wrote.
=================================================================
Facebook users will be notified when their credentials are used for third-party app logins
https://www.helpnetsecurity.com/2020/01/16/facebook-login-third-party-apps/
Facebook will (finally!) explicitly tell users who use Facebook Login to log into third-party apps what information those apps are harvesting from their FB account.
At the same time, users will be able to react quickly if someone managed to compromise their Facebook accounts and is using their credentials to access other apps and websites.
Login Notifications
The new feature, called Login Notifications, will deliver notifications to users via the Facebook app and user’s associated email.
The sending of those notifications will be triggered every time a user (or attacker):
•Logs into a third-party app with Facebook Login and grants the app access to their information
•Re-uses Facebook Login to log into a third-party app after an app’s access to information has expired.
As you can see in the image above, each notification will include a list of the information the app/website pulls from the Facebook account to personalize the user’s experience, as well as offer a direct link to Facebook Settings > Apps and Websites, so users can limit the information shared with the app/service or remove the app altogether.
Privacy push
“The design and content of the Login Notifications remind users that they have full control over the information they share with 3rd party apps, with a clear path to edit those settings,” Puxuan Qi, a software engineer at Facebook, explained.
“We will continue to test additional user control features in early 2020, including bringing permissions to the forefront of the user experience when logging into a 3rd party app with Facebook Login.”
This new feature is part of Facebook’s broader attempt to show they care about user privacy and minimize the fallout of incidents such as the massive 2018 Facebook data breach (when attackers managed to steal access tokens of at least 50 million users, potentially allowing them to take over victims’ Facebook accounts and log into accounts the victims opened on third-party websites and apps by using Facebook Login) and the Cambridge Analytica scandal (CA used information collected through third-party apps without users agreeing to their data being used to fuel election campaigns or even knowing about it).
==================================================================
Wouldn't it be so much easier, more secure and better for the customer if government and Facebook and its customers were able to use 'Wave Knowd' for better authentication?!!!
==================================================================
Wave Knowd Introduces New Model for Internet Authentication Without Passwords
Knowd ‘Trust Score’ Assures User Identity when Accessing Web Services
https://www.wavesys.com/buzz/pr/wave-knowd-introduces-new-model-internet-authentication-without-passwords
Lee, MA -
May 9, 2013 -
Wave Systems Corp. (NASDAQ: WAVX), the Trusted Computing Company, today announced Wave Knowd, a new web service available for preview that significantly reduces the vulnerability and use of passwords by leveraging the unique identity of computing devices. With a simple integration of Wave Knowd, any website can establish reliable and consistent identity relationships with the devices its customers use most often for Internet services. Wave Knowd, which signifies “Known Devices,” is being tested by partners to provide the backbone for general purpose machine identity.
“The maturation of the web mandates a change in how we, and our computing devices, connect to the web,” said Steven Sprague, Wave CEO. “With cable television, satellite radio, bank kiosks and mobile phones, the service relationship is tied to the endpoint device. The web needs the security and simplicity of this same model, where our computing devices themselves play an added role in authentication. I access dozens of web services every day from the computer in my home office, and want those sites to know and trust my PC so they’ll stop continually asking me to log in. Wave Knowd enables that trust.”
To make web authentication stronger and simpler, Wave Knowd provides a new approach to signing on and accessing Cloud and Internet services. From online banking to business services and even consumer gaming, passwords are failing to provide a level of security that either service providers or users can trust. Knowd is built upon the concept that only known devices should ever access a protected network. Knowd incorporates all of your access and identity solutions together to establish a relationship of trust between users’ computing devices, and the web services they access.
“We interact online using so many devices now, but from a security perspective those devices aren’t all equal. Accessing medical records or confidential business files from my kid’s smartphone is certainly not as trustworthy as connecting from my business PC with an encrypted drive,” continued Mr. Sprague. “Wave Knowd is all about making the Web simpler and safer, and that new foundation of trust begins with known devices, and known capabilities.”
Once machine identity is established, any web site—from gaming, social networking or shopping; to banking, business and financial services—can use Wave Knowd to create a reliable and persistent identity for the connecting device. Knowd allows Web sites to streamline access for users who repeatedly log on from trusted devices, while bolstering security. Initial authentication creates a unique and anonymous relationship between each computing device and each web service accessed, and then the level of trust between the two grows over time. Knowing the device can also help the site prevent fraud and phishing, or simply provide quicker no-password access. Wave is the partner helping to create and manage these relationships.
“Wave Systems was the obvious choice to provide ID Dataweb’s attribute exchange with device identity services,” said David Coxe, CEO at ID Dataweb. “In Knowd, Wave has provided a system that is rooted in state of the art device security technologies such as the Trusted Platform Module and other secure elements, while also offering a simple web based integration. It’s easy to identify if a connecting device is highly trusted, or whether it requires added screening and security.”
ID Dataweb uses Wave’s Knowd solution as part of the Identity Ecosystem supported through a grant from the U.S. Department of Commerce’s National Institute of Standards and Technology’s NSTIC initiative (National Strategy for Trusted Identities in Cyberspace). ID Dataweb has created a standards-based platform to simplify online identity verification using OpenID credentials.
Providing the Tools to Manage Trust in the Cloud: What’s Your Trust Score?
Wave Knowd is a powerful enhancement for any website. The endpoint identity service links an individual users’ unique device identity, with the Internet services that are typically protected only by username and password access. Users are prompted by their cloud service provider to register their primary computing devices to create a unique and persistent device identity relationship with their Internet services and service providers. No personal ID information is obtained by Wave, as Knowd works purely as a machine identity service. Furthermore, registered devices are given a unique ID for every service provider, establishing a separate trust relationship with each service.
Wave Knowd asserts a Trust Score that helps both consumers and cloud services or relying parties to determine the level of trust granted to each specific computing device. For example, a home PC that is used regularly for banking will quickly build a high Trust Score. Users can achieve a higher Trust Score by installing a small software application (Wave Knowd currently supports Windows 7 and 8, with Apple and Android to follow later this year). Business-class PCs containing a standard Trusted Platform Module (TPM) can establish even greater trust by leveraging the TPM security chip to create and securely store a unique device ID.
Knowd provides a web service with a new capability to enable or disable features based on the device that the user is actively using, providing a new security option for the end user. Perhaps an account password can only be reset from the user’s registered home computer and not from anywhere in the world, thereby linking in all of the user’s investment in the security of their home, from their alarm system to the doorman. Every web service can benefit from integrating Wave Knowd as part of the user’s experience.
Trump says US 'better at cyber than anyone in the world’
https://www.fifthdomain.com/dod/2020/01/13/trump-says-us-better-at-cyber-than-anyone-in-the-world/
President Donald Trump said the United States “is better at cyber than anyone else in the world” in a Jan. 9 interview with a Toledo television station, marking one of the rare times during his administration he appears to be speaking about military cybersecurity operations.
Trump spoke about a possible cyberattack from Iran with 13ABC’s Lee Conklin while in Ohio for a rally. Conklin asked the president what the White House was doing to protect the nation’s computer systems from an attack.
“Cyber is a whole thing. It’s a whole new field. We have some tremendous people. We’re better at cyber than anybody else in the world," he said. "But we weren’t really using that power, that intellect, on cyber. We weren’t doing it. And now we are. And we have – I have – incredible people in charge of cyber. If we ever get hit, we’ll hit very hard. We’ll be able to hit very hard. But it’s a new form of war – warfare – and I think we have it very well under control.”
Trump appears to be referring to the White House’s new, more aggressive cybersecurity strategy and a revamped philosophy on cyber operations with the Department of Defense. In 2018, the Department of Defense began following a new philosophy for cyber operations to better protect U.S. networks and infrastructure. Known as “defend forward,” the approach allows U.S. cyber forces to be active in foreign network outside the United States to either act against adversaries or warn allies of impending cyber activity that they’ve observed on foreign networks.
Gen. Paul Nakasone is the head of U.S. Cyber Command. In recent years, Cyber Command appears to have conducted at least three operations according to reporting from the Washington Post, Yahoo News and Reuters. This includes disrupting internet access at a Russian troll factory to protect the integrity of U.S. elections and operations against Iran. On Jan. 11, the New York Times reported that earlier this year American officials considered conducting a cyberattack to “partly disable Iran’s oil and gas sector.”
==================================================================
https://www.wavesys.com/products/embassy%C2%AE-remote-administration-server-tpm-management
Secure device & user authentication
Sometimes it feels like security is more effective at deterring your users than hackers. But you still have to protect your enterprise resources, and we’re here to help. We take pride in securing your network, data, and resources to an unprecedented level, without causing a revolt from either IT or your users. In fact, your users probably won’t even know we’re there.
Here’s how it works:
Trusted Platform Module (TPM) + Wave’s ERAS for TPM Management = hardware-secured, fully-managed authentication
Most of your devices already come with TPMs (check out our “What is a TPM?” brochure if you’re not sure why this is exciting). This security chip comes attached to the motherboard of most enterprise-class PCs. There’s nothing “add-on” about it. The TPM provides a verifiable, unique identity for each machine.
Wave’s ERAS for TPM Management gives IT remote, centralized management of all TPMs on enterprise computers and tablets.
With this control, IT can set policies and dictate which machines and users have authority to access which resources. IT can ensure that only known and approved devices are accessing your network. And what’s more, IT can prove it with detailed activity logs.
==================================================================
https://www.wavesys.com/wave-alternative
The IT perimeter is gone
With tablets, smartphones, and cloud applications, your employees can access sensitive data anytime, from anywhere. Indeed, around 70 percent of security breaches and data thefts are inside jobs. Meanwhile, the hackers only get better: advanced persistent threats (APTs) appear as normal traffic, and malware can go unnoticed for weeks.
It’s a new world, one without borders. Yet most organizations are still trying to protect their data with the same old firewalls and antivirus software. It’s not working. We refer you to the headline-making breach of the week.
You have to start with the device
Wave has an alternative: security that’s built into each and every device.
We’re talking about hardware: self-encrypting drives (SEDs), which protect data when a device is stolen or lost, and trusted platform modules (TPMs), or embedded security chips. Both go in at the factory, and increasingly, both are standard. They make it possible for you to monitor and control each individual device and its data, no matter where it is. But you need software to turn on and manage your SEDs and TPMs. Wave makes that software.
We’ve been refining comprehensive, centralized management of hardware-based security longer than anyone else. More than that, we’ve shaped the field as a founding member of the Trusted Computing Group, the not-for-profit that develops and promotes industry standards for the hardware.
Security that’s confirmed, not assumed
With Wave, you’ll know that you’re secure. Because we start with the individual devices, you get a broad, deep view of your network. You can see exactly who’s on it, with what devices and what apps, at any given time. Just for example, if Bob goes home and tries to log onto Facebook with the company laptop, Wave can stop him.
A big piece of this heightened security is device authentication. Traditional two-factor authentication requires what amounts to two user IDs. But by using the TPMs inside your devices, Wave can confirm the identity of not only users, but also the devices they’re on. Combine that with fast, enforced encryption of sensitive data via your SEDs—all easily managed with Wave software—and your data is protected from the full range of modern risks: device theft, missent emails, flash drives, portable hot spots … even (and no one else can say this) hardware keyloggers. Not to mention Bob.
Do we need to say that with Wave, compliance is no problem?
Start closing your security gaps today, with what you’ve got
You might be surprised to hear that 90 percent or more of your computers probably already have TPMs. Mobile devices are catching up fast. SEDs are newer, but you probably have a bunch of those too. Machines that don’t have them can often be outfitted at little to no extra cost. So you’ve got some or all of the hardware. All you need to do is turn it on with Wave.
It’s almost as easy as it sounds. TPMs and SEDs are built to open, vendor-neutral industry standards, and so are Wave solutions. That means Wave works on your existing mix of hardware, across platforms, and will evolve with you. It’s part of what makes the Wave alternative not only more secure, but also simpler and cheaper. Total cost of ownership for Wave data protection can be almost half that of a traditional software-based system.
Questions? Read on, or contact our sales department.
=================================================================
Wave solutions could be a game-changer for cyber defense!!!
Android Trojan Steals Your Money to Fund International SMS Attacks
https://www.bleepingcomputer.com/news/security/android-trojan-steals-your-money-to-fund-international-sms-attacks/
==================================================================
Wave Endpoint Monitor would stop a Trojan such as the one in the article. Wave Knowd could better authenticate users to the banking sites!!! Both Wave solutions could provide better security to users in this article unlike many solutions!! Wave has many great solutions, and unfortunately some are not being used. Wave could be like a BIG WAVE since it really has been ahead of its time, and needs the collective energy and creativity of its current and former employees!
==================================================================
https://www.wavesys.com/malware-protection
https://www.wavesys.com/products/wave-endpoint-monitor
Wave Knowd Introduces New Model for Internet Authentication Without Passwords
Knowd ‘Trust Score’ Assures User Identity when Accessing Web Services
https://www.wavesys.com/buzz/pr/wave-knowd-introduces-new-model-internet-authentication-without-passwords
https://www.wavesys.com/
Microsoft contractors in China listened to Skype recordings with woefully bad levels of cybersecurity, report reveals
https://www.businessinsider.com/microsoft-contractors-listened-to-recordings-with-minimal-security-2020-1
==================================================================
WidePoint Partners with KoolSpan to Offer End-to-End Encryption for Phone Calls and Text Messages
https://www.widepoint.com/widepoint-partners-with-koolspan-to-offer-end-to-end-encryption-for-phone-calls-and-text-messages/
==================================================================
On Monday May 12, 2014, WidePoint Corporation (WYY) announced a collaboration with Wave Systems Corp. (WAVX) that will enable WidePoint to utilize Wave’s security software technology to secure digital certificates within a trusted platform module (TPM) chip on customer devices. The solution strongly binds certificates to an identity and protects the certificate private key within the TPM hardware module
https://www.wavesys.com/widepoint-collaborates-wave-secure-digital-certificates
The importance of cybersecurity: Protecting against cyber-attacks
https://www.openaccessgovernment.org/timportance-of-cybersecurity-against-cyber-attacks/80457/
Thorsten Stremlau, Trusted Computing Group’s Marketing Work Group Co-Chair, highlights the importance of cybersecurity, as well as the risks of cyber-attacks and how best to protect against them
The number of high-value breaches for companies is increasing every year, making cybersecurity a top priority for C-level executives. According to a Cisco study, there has been a 350% increase in ransomware attacks annually and the Ponemon Institute predicts that the average cost of a data breach is $4 million. Yet, around 80% of breaches are caused by bad system configurations and passwords which means that human error continues to be the biggest security threat for organisations. Further to this, up to 87% of senior managers have admitted to accidentally leaking business data. Cybersecurity needs to be a corporate priority, from senior executives throughout the rest of the company and implemented into everyday operational activities.
The Onion Skin model
The key to maximum cybersecurity protection is to take a multi-layered approach with security embedded into every layer. With several levels of defence in place, organisations can be fully prepared for the wide variety of security breaches that are possible, as well as being future-proofed as attacks become more advanced in the future. Protecting against human error and accidental leaks is also an integral part of this multi-layered approach.
At the core of the Onion Skin model is hardware; hardening the core of your cybersecurity is imperative to building a good cybersecurity model. Standards organisations such as the Trusted Computing Group (TCG) have set out to address the challenges that cybersecurity brings at every level. Every additional layer of cybersecurity is built on top of a strong hardware core to provide comprehensive cybersecurity that is able to defend against a multitude of attacks.
A critical solution that is currently available across the industry to ensure data and device protection is the Trusted Platform Module (TPM) – a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. The TPM is an international standard for a secure cryptoprocessor which allows computer programmes to authenticate devices, since each TPM chip has a unique and secret RSA key burned in as it is produced. Pushing the security down to the hardware level provides more protection than a software-only solution.
TPMs can be used in computing devices other than PCs, such as mobile phones or network equipment and have been built into billions of devices worldwide. As a go-to solution for those looking to protect their embedded systems, a core feature of the TPM is the root of trust measurement. This means that a device can verify its own integrity and health by checking if any modifications have been made while it is off or not in use.
In addition to the root of trust measurement, encryption forms another layer of the onion skin model and it is absolutely vital for devices to have self-encrypting memory and storage abilities.
A new research report on “Trusted Computing” published by Aberdeen Group, a Harte-Hanks Company (NYSE:HHS), reveals that organisations that have deployed applications based on trusted computing infrastructure exhibit superior capabilities in security governance, risk management and compliance compared to other respondents. The term “trusted computing” refers to applications that leverage hardware-based “roots of trust” at the edge of the network and at the endpoints – sometimes referred to as “hardware anchors in a sea of untrusted software” – for higher assurance.
TPMs are a basic building block used in most other specifications, for providing an anchor of trust. They can be used for validating basic boot properties before allowing network access (TNC), or for storing platform measurements (PC Client), or for providing self-measurement to provide anchors of trust to hypervisors (Virtualization).
The four principles of cybersecurity
For optimised protection against a cybersecurity attack, organisations should aim to achieve the following four principles by building a strong Onion Skin model:
• Confidentiality: The data is seen or used only by people who are authorised to access it.
• Integrity: Any changes to the data by an unauthorised user are either blocked or detected and changes by authorised users are tracked.
• Availability: The platform must be available to authorised users when needed.
• Non-repudiation: The source of the data can be validated and verified.
Alongside these key principles, it is crucial that executives address the fact that they are responsible for driving the applications that this cybersecurity is built upon; without thorough cybersecurity education and policies, these extensive measures can be easily left irrelevant. Employees need to be made aware that they are responsible for their own data security and must take the necessary steps to ensure cybersecurity.
==================================================================
Great article!!!!
https://www.wavesys.com/
US Govt Says Iran's Cyberattacks Can Disrupt Critical Infrastructure
https://www.bleepingcomputer.com/news/security/us-govt-says-irans-cyberattacks-can-disrupt-critical-infrastructure/
==================================================================
With North Korea, China, Russia and Iran, it would appear that with these big potential problems, the use of Trusted Computing and Wave would be solutions that mitigate these problems like no other cybersecurity products. Given the potential problems from these four countries, isn't it time for Trusted Computing and Wave especially for critical infrastructure?! Using other cybersecurity products that aren't built in by design within computers has shown to not be as secure. But the TPM has to be turned on to get this strong security!! Wave with its solutions and the ability to turn on TPMs could solve a lot of problems for organizations!!! The support of Trusted Computing by the Trump Administration could save sensitive data from being stolen, data from being wiped, data from being leaked, and save lives!!!
Iranian hackers deploy new ZeroCleare data-wiping malware
https://www.zdnet.com/article/iranian-hackers-deploy-new-zerocleare-data-wiping-malware/
==================================================================
Wave Endpoint Monitor can catch customized malware unlike traditional anti-virus software. Should organizations rely on anti-virus software when their data could be wiped? Back ups provide protection, but wouldn't it be better to stop the malware at the front end before having to depend on back ups?! Wave's links to malware protection and Wave Endpoint Monitor, I believe are truly awesome descriptions of what malware protection should be and the Wave alternative is a great summary.
==================================================================
https://www.wavesys.com/
https://www.wavesys.com/malware-protection
Excerpts:
Software can’t always detect malware
The big problem with malware is that antivirus software doesn’t always detect it. Anti-malware software is based on signatures of known bad software. However, there always needs to be a patient 0 that discovers he is infected, for the rest of the world to benefit from it. In the case of APTs (Advanced Persistent Threats), your organization may be the only target for the specific strand of malware. In that case, the signature detection process will not protect you. Modern anti-malware and other software packages that promise cyber security or protection from APTs would use various heuristics and "AI" (Artificial Intelligence) to detect malware based on a predefined set of behavioral parameters. A sophisticated attacker is able to fine tune the behavior of the malware he is writing against various known anti-malware software solutions, so that it can evade detection for long periods of time.
A further challenge for anti-malware software is that it commonly works at the OS level. It isn’t very good at seeing deeper into the system, where some malware lives. Malware can hide from anti-malware by feeding it false results as it lies lower in the stack.
Wave’s solution: start with the device
If antivirus software doesn’t work, what does? The Wave alternative relies not on superficial layers of software but on standards-based hardware: self-encrypting drives (SEDs) and Trusted Platform Modules (TPMs), or security chips, that are already embedded in many of your computers and mobile devices. This hardware provides you with secure storage. When you turn the SED and TPM on and manage them with Wave, you suddenly have a broad, deep view into your network. Among other things, you’ll know immediately whether any one of your devices—computers, laptops, tablets, smartphones—has been tampered with. But Wave is proactive too: you can block the kinds of behaviors that invite malware in. Wave's Endpoint Monitor provides early detection for these low-lying sneaky attacks.
==================================================================
https://www.wavesys.com/products/wave-endpoint-monitor
Cyberwar with Iran: How vulnerable is America?
https://www.usatoday.com/story/tech/2020/01/03/how-much-damage-could-iran-cyber-attacks-do/2803599001/
Excerpt:
"It is known that the United States is not as cyber secure as it should be," said Adam Levin founder of the cybersecurity platform CyberScout. "We haven't made the investments that we need to make or the training that we need to. We are sitting ducks."
==================================================================
Why did the computer industry spend billions of dollars on built-in computer security (TPMs)?!! TPMs can be used in a myriad of ways and when TURNED ON they help provide better protection than software alone!! With Wave's software to turn on and manage these TPMs with their solutions, the U.S. doesn't have to be 'sitting ducks'!!! Approximately, 120 companies are behind the Trusted Computing movement (Trusted Computing Group) of which Wave was a founding member!! Here is an opportunity to protect America!! An activated TPM should be a standard in government and at least in critical industries!!!
==================================================================
https://www.wavesys.com/
When Malware Returns: Beating the Silent System Killer
https://www.infosecurity-magazine.com/opinions/malware-returns-silent-system/?utm_source=dlvr.it&utm_medium=twitter
Ransomware is the hacker “gift” that just keeps on giving, it seems. A 2017 study shows that more than half of ransomware victims got hit a second (or more) time, often with the same malware – and with ransomware attacks growing significantly since then, it's likely that many more organizations are getting hit multiple times.
It's a problem that especially affects enterprises. Half the companies in the study had 1,000 or more employees, a third had up to 10,000 employees, and 19% had more than 10,000. Enterprises are arguably in the best position to protect themselves from ransomware – they have the scale and resources to deploy the most advanced solutions – and yet they keep getting attacked – in “reruns,” to add insult to injury.
Why is that? Often it's because the companies that are attacked haven't hardened their systems sufficiently to keep hackers out altogether. While they may have remediated the weakness that enabled hackers to break through defense systems for the first attack, there are often other weaknesses that they can take advantage of for additional attacks. There are many paths into a system, and guarding all of them is a major challenge, to say the least.
Maybe there's another reason; if a hacker dispatches their malware in the form of a trojan that bides its time before attacking, it's very possible that the malware that attacked got recorded in a company backup – and when that backup is unrolled after a ransomware attack, it re-enters the system, and gives a return performance.
Is this feasible – or even possible? The answer to both those questions is - yes. With the plethora of malware that systems are subjected to daily, it’s unlikely that anti-virus software, firewalls, filters, and the like will catch everything. According to German software firm GData, a new piece of malware was released into the wild every 3.2 seconds during the first part of 2017; that's a figure that has likely grown. According to Malwarebytes, the use of trojans – malware that hides and bides its time before getting activated – has shot up in 2019.
Taking these two trends together, it's fair to say that the likelihood of malware hiding in a system and copied to a backup is rather high. When the backup is rolled out– because the working system got compromised by hackers – the same malware that brought the system down in the first place could be rolled out as well, enabling hackers to start in a “second act,” and enabling them to continue stealing data, extorting ransom, or causing losses for their victims.
The trick, then, is to ensure that malware doesn’t get into the backup - that they are “hygienic,” and are not infected with hidden security issues. To do that, organizations need to unleash the full force of anti-malware tools at their disposal.
Running these tools on the production data that gets backed up as well as on the backup themselves enables organizations to be as thorough as possible; because these are backups and not production systems, organizations can run a wide range of anti-malware tools without harming production performance.
Throughout the computer era, the mantra has been “back everything up” - or face significant losses because of missing data. Now, backups themselves could be the cause of losses. This is the kind of thing that could wreak havoc in the IT industry; if you can't trust your backup, then how can you trust the data in it, when that data may contain the seeds that will cause losses?
Too many organizations blindly rely on their backups, believing that backups are their insurance policy against a malware or ransomware attack. Indeed, a backup could, and should, provide that kind of insurance – but to ensure that the policy is active, organizations need to ensure that their backups are protected and malware-free.
==================================================================
Before the Trojan (malware) even gets to the back up, why not use Wave Endpoint Monitor to take care of the problem from the start. WEM spots that sneaky malware so this could stop the ransomware from happening in the first place!!! From post #245885 - Only Half of Malware Caught by Signature AV. Maybe Wave should charge $100 per year for Wave Endpoint Monitor since it adds tremendous value and is so great!!! (Please see the links below)
==================================================================
https://www.wavesys.com/malware-protection
Excerpts:
What is malware?
Malware is a general name for software that installs on your organization's computers and creates damage. It includes computer viruses, worms, Trojans, spyware, adware, rootkits, Advanced Persistent Threats and more. These malicious programs could be created by a tenacious adversary, or by financially motivated criminals and inserted into your organization's computers. They may lie there undetected for months or secretly do things like log your keystrokes, steal your passwords, harvest your address book, observe where you go on the Internet, report sensitive data to distant servers, or even wipe or encrypt your data. Recent high profile malware attacks on utilities and countries, even, introduced contaminated software reported to alter the working of physical devices, like uranium enrichment centrifuges, oil rig equipment and water pumps. Malware can be introduced through a web download, an email attachment or even a USB external device for networks that are not connected to the internet.
Software can’t always detect malware
The big problem with malware is that antivirus software doesn’t always detect it. Anti-malware software is based on signatures of known bad software. However, there always needs to be a patient 0 that discovers he is infected, for the rest of the world to benefit from it. In the case of APTs (Advanced Persistent Threats), your organization may be the only target for the specific strand of malware. In that case, the signature detection process will not protect you. Modern anti-malware and other software packages that promise cyber security or protection from APTs would use various heuristics and "AI" (Artificial Intelligence) to detect malware based on a predefined set of behavioral parameters. A sophisticated attacker is able to fine tune the behavior of the malware he is writing against various known anti-malware software solutions, so that it can evade detection for long periods of time.
A further challenge for anti-malware software is that it commonly works at the OS level. It isn’t very good at seeing deeper into the system, where some malware lives. Malware can hide from anti-malware by feeding it false results as it lies lower in the stack.
=================================================================
https://www.wavesys.com/products/wave-endpoint-monitor
Excerpts:
Detect attacks before it’s too late
Malware can do its work for weeks or months before you ever know it’s there. But with Wave Endpoint Monitor, you can spot malware before it has a chance to cause damage.
Antivirus software can’t detect rootkits and other malware; it works at the level of the OS and isn’t very good at seeing deeper into the system. For example, it can’t tell whether the boot record is lying. The Wave alternative is to work with the Trusted Platform Modules (TPMs), or security chips, embedded in your devices. By using the TPM to attest to the security of the device each time that device boots, Wave looks below the operating system and can help detect threats lurking there. Every time a device boots up, Wave Endpoint Monitor makes a comparison against previous boot values, and if anything deviates from the norm, it alerts you immediately.