TRENDING
IT BlogR
Category

Cybersecurity

Category
CCNA COMPTIA CEH
Cybersecurity

Data breaches and cyber attacks in June 2019 ­– 39.7 million records leaked

By

After a rampant start to the year for data breaches and cyber attacks, it’s about time we went one month without at least one massive security incident.

June 2019’s total of 39,713,046 breached records is the lowest since May last year – the month that the GDPR (General Data Protection Regulation) came into effect.

Is this the start of the long-awaited ‘GDPR bounce’? We doubt it, but it’s certainly a step in the right direction.

Here’s a full list of every incident in the month of June:

Cyber attacks

Ransomware

Data breaches

Financial information

Malicious insiders and miscellaneous incidents

In other news…

Source: IT Governance

by
Keep Reading
data breaches and cyber attacks in May 2019
Cybersecurity

List of data breaches and cyber attacks in May 2019 – 1.39 billion records leaked

By

The cyber security story for May 2019 is much the same as it was last month, with one mammoth breach raising the monthly total.

The offender this time is the First American Financial Corp., which breached sixteen years’ worth of insurance data. That incident accounted for more than 60% of all of May’s breached records.

In total, at least 1,389,463,242 records were compromised. That brings the annual running total to 7.28 billion and reduces the monthly average to 1.44 billion.

Cyber attacks

Ransomware

Data breaches

Financial information

Malicious insiders and miscellaneous incidents

In other news…

Source: IT Governance

by
Keep Reading
Data breaches and cyber attack: March 2019
Cybersecurity

List of data breaches and cyber attacks in April 2019 – 1.34 billion records leaked

By

We would’ve been talking about an extraordinarily low number of breached records this month if it hadn’t been for a string of incidents in India, another Facebook gaffe and a massive blunder in China, in which a series of companies exposed almost 600 million citizens’ CVs.

Still, April 2019 saw a not completely disastrous 1,334,488,724 breached records. That’s better than last month, bringing the annual total to 5.64 billion and reducing the monthly average to 1.46 billion.

Here’s the list in full:

Cyber attacks

Ransomware

Data breaches

Financial information

Malicious insiders and miscellaneous incidents

In other news…

Source: IT Governanace

by
Keep Reading
60 Must-Know Cybersecurity Statistics: 2019
Cybersecurity

60 Must-Know Cybersecurity Statistics for 2019

By

Cybersecurity issues are becoming a day-to-day struggle for businesses. Trends show a huge increase in hacked and breached data from sources that are increasingly common in the workplace, like mobile and IoT devices.

Additionally, recent research suggests that most companies have unprotected data and poor cybersecurity practices in place, making them vulnerable to data loss.

We’ve compiled 60 cybersecurity statistics to give you a better idea of the current state of overall security, and paint a picture of how potentially dire leaving your company unsecure can be.

Data Breaches by the Numbers

The increasing amount of large-scale, well-publicized breaches suggests that not only are the number of security breaches going up — they’re increasing in severity, as well.

  1. In 2016, 3 billion Yahoo accounts were hacked in one of the biggest breaches of all time. (Oath.com)
  2. In 2016, Uber reported that hackers stole the information of over 57 million riders and drivers. (Uber)
  3. In 2017, 412 million user accounts were stolen from Friendfinder’s sites. (LeakedSource)
  4. In 2017, 147.9 million consumers were affected by the Equifax Breach. (Equifax)
  5. According to 2017 statistics, there are over 130 large-scale, targeted breaches in the U.S. per year, and that number is growing by 27 percent per year. (Accenture)
  6. Thirty-one percent of organizations have experienced cyber attacks on operational technology infrastructure. (Cisco)
  7. 100,000 groups in at least 150 countries and more than 400,000 machines were infected by the Wannacry virus in 2017, at a total cost of around $4 billion. (Malware Tech Blog)
  8. Attacks involving cryptojacking increased by 8,500 percent in 2017. (Symantec)
  9. In 2017, 5.4 billion attacks by the WannaCry virus were blocked. (Symantec)
  10. There are around 24,000 malicious mobile apps blocked every day. (Symantec)
  11. In 2017, the average number of breached records by country was 24,089. The nation with the most breaches annually was India with over 33k files; the US had 28.5k. (Ponemon Institute’s 2017 Cost of Data Breach Study)
  12. In 2018, Under Armor reported that its “My Fitness Pal” was hacked, affecting 150 million users. (Under Armor)
  13. Between January 1, 2005 and April 18, 2018 there have been 8,854 recorded breaches. (ID Theft Resource Center)

Cybersecurity Costs

Average expenditures on cybercrime are increasing dramatically, and costs associated with these crimes can be crippling to companies who have not made cybersecurity part of their regular budget.

  1. In 2017, cyber crime costs accelerated with organizations spending nearly 23 percent more than 2016 — on average about $11.7 million. (Accenture)
  2. The average cost of a malware attack on a company is $2.4 million. (Accenture)
  3. The average cost in time of a malware attack is 50 days. (Accenture)
  4. From 2016 to 2017 there was an 22.7 percentage increase in cybersecurity costs. (Accenture)
  5. The average global cost of cyber crime increased by over 27 percent in 2017. (Accenture)
  6. The most expensive component of a cyber attack is information loss, which represents 43 percent of costs. (Accenture)
  7. Ransomware damage costs exceed $5 billion in 2017, 15 times the cost in 2015. (CSO Online)
  8. The Equifax breach cost the company over $4 billion in total. (Time Magazine)
  9. The average cost per lost or stolen records per individual is $141 — but that cost varies per country. Breaches are most expensive in the United States ($225) and Canada ($190). (Ponemon Institute’s 2017 Cost of Data Breach Study)
  10. In companies with over 50k compromised records, the average cost of a data breach is $6.3 million. (Ponemon Institute’s 2017 Cost of Data Breach Study)
  11. Including turnover of customers, increased customer acquisition activities, reputation losses and diminished goodwill the cost of lost business globally was highest for U.S. companies at $4.13 million per company. (Ponemon Institute’s 2017 Cost of Data Breach Study)
  12. Damage related to cybercrime is projected to hit $6 trillion annually by 2021. (Cybersecurity Ventures)

Cybersecurity Facts and Figures

It’s crucial to have a grasp on the general landscape of metrics surrounding cybersecurity issues, including what the most common types of attacks are and where they come from.

  1. Ransomware detections have been more dominant in countries with higher numbers of internet-connected populations. The United States ranks highest with 18.2 percent of all ransomware attacks. (Symantec)
  2. Trojan horse virus Ramnit largely affected the financial sector in 2017, accounting for 53 percent of attacks. (Cisco)
  3. Most malicious domains, about 60 percent, are associated with spam campaigns. (Cisco)
  4. Seventy-four percent of companies have over 1,000 stale sensitive files. (Varonis)
  5. Malware and web-based attacks are the two most costly attack types — companies spent an average of US $2.4 million in defense. (Accenture)
  6. The financial services industry takes in the highest cost from cyber crime at an average of $18.3m per company surveyed. (Accenture)
  7. Microsoft Office formats such as Word, PowerPoint and Excel make up the most prevalent group of malicious file extensions at 38 percent of the total. (Cisco)
  8. About 20 percent of malicious domains are very new and used around 1 week after they are registered. (Cisco)
  9. Over 20 percent of cyber attacks in 2017 came from China, 11 percent from the US and 6 percent from the Russian Federation. (Symantec)
  10. The app categories with most cybersecurity issues are lifestyle apps, which account for 27 percent of malicious apps. Music and audio apps account for 20 percent. (Symantec)
  11. The information that apps most often leak are phone numbers (63 percent) and device location (37 percent). (Symantec)
  12. In 2017, spear-phishing emails were the most widely used infection vector, employed by 71 percent of those groups that staged cyber attacks. (Symantec)
  13. Between 2015 and 2017, the U.S. was the country most affected by targeted cyber attacks with 303 known large-scale attacks. (Symantec)
  14. In 2017, overall malware variants were up by 88 percent. (Symantec)
  15. Among the top 10 malware detections were Heur.AdvML.C 23,335,068 27.5 2 Heur.AdvML.B 10,408,782 12.3 3 and JS.Downloader 2,645,965 3.1 (Symantec)
  16. By 2020, the estimated number of passwords used by humans and machines worldwide will grow to 300 billion. (Cybersecurity Media)

Cybersecurity Risks

With new threats emerging every day, the risks of not securing files is more dangerous than ever, especially for companies.

  1. 21 percent of all files are not protected in any way. (Varonis)
  2. 41 percent of companies have over 1,000 sensitive files including credit card numbers and health records left unprotected. (Varonis)
  3. 70 percent of organizations say that they believe their security risk increased significantly in 2017. (Ponemon Institute’s 2017 Cost of Data Breach Study)
  4. 69 percent of organizations don’t believe the threats they’re seeing can be blocked by their anti-virus software. (Ponemon Institute’s 2017 Cost of Data Breach Study)
  5. Nearly half of the security risk that organizations face stems from having multiple security vendors and products. (Cisco)
  6. 7 out of 10 organizations say their security risk increased significantly in 2017. (Ponemon Institute’s 2017 Cost of Data Breach Study)
  7. 65 percent of companies have over 500 users who never are never prompted to change their passwords. (Varonis)
  8. Ransomware attacks are growing more than 350 percent annually. (Cisco)
  9. IoT attacks were up 600 percent in 2017. (Symantec)
  10. The industry with the highest number of attacks by ransomware is the healthcare industry. Attacks will quadruple by 2020. (CSO Online)
  11. 61 percent of breach victims in 2017 were businesses with under 1,000 employees. (Verizon)
  12. Ransomware damage costs will rise to $11.5 billion in 2019 and a business will fall victim to a ransomware attack every 14 seconds at that time. (Cybersecurity Ventures)
  13. Variants of mobile malware increased by 54 percent in 2017. (Symantec)
  14. Today, 1 in 13 web requests lead to malware (Up 3 percent from 2016). (Symantec)
  15. 2017 represented an 80 percent increase in new malware on Mac computers. (Symantec)
  16. In 2017 there was a 13 percent overall increase in reported system vulnerabilities. (Symantec)
  17. 2017 brought a 29 percent Increase in industrial control system–related vulnerabilities. (Symantec)
  18. By 2020, we expect IT analysts covering cybersecurity will be predicting five-year spending forecasts (to 2025) at well over $1 trillion. (Cybersecurity Ventures)
  19. The United States and the Middle East spend the most on post-data breach response. Costs in the U.S. were $1.56 million and $1.43 million in the Middle East. (Ponemon Institute’s 2017 Cost of Data Breach Study)

There’s no question that the situation with cybercrime is dire. Luckily, by assessing your business’s cybersecurity risk, making with company-wide changes and improving overall security behavior, it’s possible to protect your business from most data breaches.

Make sure you’ve done everything you can do to avoid your company becoming a victim to an attack. The time to change the culture toward improved cybersecurity is now.

Source: Varonis

by
Keep Reading
5G and Cybersecurity
Cybersecurity

5G and the Future of Cybersecurity

By

Just as 4G networks led to the ubiquity of the smartphone and other smart devices, 5G networks will lead to the rise of billions of new devices connected to the Internet, all talking with one another at incredibly fast speeds with remarkably low latency. This will open up vast new possibilities for consumers, businesses and society as a whole – everything from self-driving cars on the road to the ability for doctors to conduct remote surgery from anyplace in the world.

Verizon 5G keynote at CES

At the 2019 CES in Las Vegas, for example, Verizon CEO Hans Vestberg laid out a compelling vision for 5G, noting that it would help to bring about “the Fourth Industrial Revolution.” There are many technologies today powering this Fourth Industrial Revolution – everything from artificial intelligence and robotics to the Internet of Things (IoT) and virtual reality – and all of them are being given a push forward by 5G. AI, for example, is making it possible to create self-driving cars, while the IoT is making it possible for smart devices to become ubiquitous, both in the home and within the enterprise.

To highlight the various ways that Verizon is already starting to make this 5G future a reality, Vestberg invited a number of key technology partners on stage with himself, including top executives from the New York Times, Walt Disney Studios, and drone company Skyward to showcase some of their best 5G projects. The New York Times, for example, is the middle of creating a new 5G journalism lab to support data-intensive technologies such as VR and AR, while Skyward is making it possible to control as many as one million drones from anywhere in the world. (And, indeed, during his CES keynote, Vestberg piloted a drone based in Los Angeles while on stage in Las Vegas)

Cybersecurity concerns in the 5G world

And, yet, this exciting new 5G world will encounter its own share of cybersecurity challenges. Hackers and cybercriminals in the world will still look for ways to access user data and profit from it. With billions of devices connected to the Internet, they will have an incredibly large attack surface in which it will be much easier to find the proverbial “weakest link” in the security chain. Geoffrey R. Morgan, Founding Partner at Fairchild Morgan Law, suggests that, “The exponential increase in speed, density and efficiency afforded by 5G technology will cause a dramatic rise in cybersecurity concerns, particularly by those industries that are among the first to utilize it.”

Moreover, the ability of hackers to cause harm and destruction will also mount exponentially. In today’s 4G world, a huge botnet formed by hacking into user devices in the home could be used to mount large-scale DDOS attacks on websites; in tomorrow’s 5G world, that same botnet could be used to take out an entire network of self-driving cars in a single city, leading to mayhem on the roads.

Obviously, then, cybersecurity is just as much a concern in the 5G world as it is in the 4G world – and perhaps more so. Vast amounts of remote sensors and smart devices hooked up to global supply chains, for example, will radically increase the complexity of securing corporate networks from intruders and cyber criminals. And the sheer amount of data being created by 5G networks will make it much more difficult to spot anomalies in user behavior resulting from hackers. According to one estimate, for example, the data output of a single autonomous vehicle in one day will equal the daily output of 3,000 people.

The 8 currencies of 5G

The good news is that 5G is still so new that there is time to make security a priority. That, says Verizon CEO Hans Vestberg, is one reason why the company has come up with the idea of 8 “currencies” for 5G. These currencies – peak data rate, mobile data volume, mobility, connected devices, energy efficiency, service deployment, reliability and latency – all represent key features of the Verizon 5G network that make it completely unlike anything we’ve seen before. For example, “peak data rate” refers to the ability to generate speeds of up to 10 Gbps, while “mobility” refers to the ability to stay connected while moving at speeds of up to 500 km/hour.

In the 3G and 4G world, the way that companies thought about their networks was in terms of two simple currencies: speed and throughput. In other words, how fast can you make uploads and downloads, and how much volume can your network handle at any point in time? But in a 5G world, companies need to expand their thinking from two currencies to eight currencies. Doctors and healthcare professionals, for example, place a tremendous value on “latency”: when they are doing remote surgeries, it is absolutely critical that end-to-end latency is as close to zero as possible. And, given the challenges posed by climate change, enterprises are much more aware of the value of the “energy efficiency” currency when it comes to 5G networks.

Using the 8 currencies of 5G to power future cybersecurity innovations

By taking this big picture view, it is possible to consider how the 8 currencies of 5G will have a positive impact on how we address cybersecurity issues in the future. Since 5G is not simply a faster version of 4G, but rather, an entirely new network architecture, it opens the door to entirely new security models for user privacy, identity management, and threat detection. For example, Hed Kovetz, CEO & Co-founder at Silverfort, notes that, “The 5G system incorporates secure identity management for identifying and authenticating users to ensure that only the genuine user can access services. Its new authentication framework enables mobile operators to choose authentication credentials, identifier formats and authentication methods for users and IoT devices.”

Moreover, the “mobility” currency, or the ability to stay connected while traveling at very fast speeds, means that it might be possible to create virtual security environments that travel with us as we move from point to point, regardless of which device we use, through the use of virtualization and cloud technologies. In fact, Robert Arandjelovic, Director of Product Marketing (Americas) at Symantec, suggests that, “A transition to 5G could lead to the complete obsolescence of the network perimeter. With the growth in cloud services and applications, the erosion of that perimeter has already begun… In a hyper-connected, non-perimeter world, the cloud and the endpoint become the new place where security technologies can be deployed to keep people safe.”

The “mobile data volume” currency means that emerging technologies that rely on vast amounts of data – such as machine learning and artificial intelligence – can now be deployed to create new AI-powered cybersecurity solutions. One idea that is gaining traction, for example, is using AI to spot anomalies in user and system behavior. This acts as a form of automated threat detection and mitigation, and helps to reduce the current dependence of 4G networks on user names and passwords as a way to keep users safe.

In many ways, AI cybersecurity solutions would benefit greatly from 5G. Aaron Bugal, Global Solutions Engineer at Sophos, notes that, “5G connectivity could help the way in which information integral to making a security decision is transported to the automated processes and people who need it. An example of this would be the ongoing benefit to artificial intelligence platforms that will only work best when they have as much information as possible to digest and learn from. Especially when they’re tasked with identifying unusual behavior across an organization, most of these platforms feed off data local to them, with devices that are remote or mobile unable to properly feed (upload) to these systems and typically exposing a short fall in awareness. 5G could unlock more data to get to an AI security platform in a shorter time and allow for best understanding of the organization and faster and accurate prediction of a security event.”

Cybersecurity and Verizon’s “Built on 5G” challenge

To help innovators come up with new 5G cybersecurity solutions, Verizon has launched a “Built on 5G Challenge” that offers a $1 million prize for a truly unique idea that builds on top of the 8 currencies of 5G. The “Built on 5G Challenge” will begin accepting submissions in April, with the winning team announced during Mobile World Congress Americas in October. For security researchers around the world, this could become a unique opportunity to make cybersecurity an enabling technology, rather than simply a “tax” on innovation. If the New York Times and Walt Disney Studios are creating their own showcase 5G labs, why can’t cybersecurity researchers also create their own 5G labs and launch innovative new products that use 5G?

Clearly, there is enormous potential for 5G to change how we address cybersecurity issues in the future. Many of the best technologies today – especially artificial intelligence – can be fully leveraged on these super-fast, low-latency 5G networks. As Verizon CEO Hans Vestberg noted at CES, “5G will change everything.” And that, of course, includes cybersecurity.

Thank you to Verizon Wireless for sponsoring this post

Sign up to see when 5G is coming to you!
Source: CPO Magazine

by
Keep Reading
Data breaches and cyber attack: March 2019
Cybersecurity

Data breaches and cyber attack in March 2019 – Over 2 billion records leaked

By

There’s a new compiler at the helm of our monthly list of data breaches, following the departure of IT Governance stalwart Lewis Morgan, who leaves me with some mighty big shoes to fill.

Fortunately – or, rather, unfortunately ­– the new regime has a familiar ring to it, with another mammoth list of data breaches. By our count, there were at least 2,100,480,045 records compromised in March.

That brings the 2019 running total to 4.53 billion, and raises the monthly average to 1.52 billion.

Here’s the list in full:

Cyber attacks

Ransomware

*Not included in the total number of records, as they are part of the 1.2 million records affected in the already-reported Wolverine Solutions incident.

Data breaches

Financial information

Malicious insiders and miscellaneous incidents

In other news…

Source: IT Governance

by
Keep Reading
Apple Iphone bug
Cybersecurity

Iphone Bug Lets Callers Snoop On You Without Permission

By

A serious Apple iOS bug has been discovered that allows FaceTime users to access the microphone and front facing camera of who they are calling even if the person does not answer the call.

To use this bug, a caller would FaceTime another person who has an iOS device and before the recipient answers, add themselves as an additional contact to Group FaceTime. This will cause the microphone of the person you are calling to turn on and allow the caller to listen to what is happening in the room. Even worse, if the person that is being called presses the power button to mute the FaceTime call, the front facing caSecuritymera would turn on as well.

What this means, is if someone is calling you on FaceTime, they could be listening and seeing what you are doing without you even knowing.

BleepingComputer has tested and confirmed that this bug works in iOS 12.1.2 and we were able to hear and see the person. When testing it against an Apple Watch, though, we were not able to get the audio portion of the bug to work.

While it is not known who first discovered this bug, numerous people have been posting about it on social media and making video demonstrations as shown below.

Embedded video

Benji Mobb™@BmManskiNow you can answer for yourself on FaceTime even if they don’t answer  explain this..

2:24 PM – Jan 28, 2019

When 9to5Mac first reported on the bug, they were only able to get the microphone snooping working. Later, BuzzFeed reported that they could also access the front facing camera and that Apple stated that they are “aware of this issue and we have identified a fix that will be released in a software update later this week.

Natalie Silvanovich, a Google Project Zero security researcher who has discovered numerous FaceTime issues in the past, has a theory as to how this could be happening.

Natalie Silvanovich@natashenka

Theory: FaceTime stores call participants in a list that doesn’t allow duplicates, and uses the indexes for signalling. When the caller is added a second time, the entry at index 1 is set to answered, with the expectation that it is the caller …https://9to5mac.com/2019/01/28/facetime-bug-hear-audio/ …

For those who are rightfully concerned about this bug, my suggestion is that you disable FaceTime immediately until Apple releases a patch. Otherwise, people can not only listen in on what you are doing, but in some cases also see what you are doing. This could allow people to take compromising videos and audio without your knowledge.

To disable FaceTime you can follow these steps:

  1. Go into Settings
  2. Tap FaceTime
  3. Now toggle the FaceTime switch so that it is disabled and your screens looks like the following.FaceTime Disabled

Now that FaceTime is disabled, callers will be unable to utilize this bug to listen and watch you without your permission through FaceTime.

Source: Bleeping Computer

by
Keep Reading
CCNA COMPTIA CEH
Cybersecurity

How To Find Out If Your Password Has Been Stolen

By

What just happened?

Yesterday, it emerged that more than a billion unique email address and password combinations had been posted to a hacking forum for anyone to see in a mega-breach dubbed Collection #1.

The breach was revealed by security researcher Troy Hunt, who runs the service allowing users to see if they’ve been hacked called Have I been Pwned. He has now loaded the unique email addresses totalling 772,904,991 onto the site.

The data includes more than a billion unique email and password combinations – which hackers can use over a range of sites to compromise your services. They will do so by utilizing so-called credential stuffing attacks, seeing bots automatically testing millions of email and password combinations on a whole range of website login pages.

The data originally appeared briefly on cloud service MEGA and was later posted to a popular hacking forum. The Collection #1 folder is comprised of more than 12,000 files weighing in at 87 gigabytes.

Most concerningly, the protective hashing of the stolen passwords had been cracked. This means they are easy to use because they are available in plain text rather than being cryptographically hashed as they often are when sites are breached.

Should I be worried?

In a word: Yes. It’s a massive concern, not least because scale of this breach is huge: Yahoo’s breaches saw 1 billion and 3 billion users affected but the stolen data hasn’t actually resurfaced yet.

And unlike other huge hacks such as Yahoo and Equifax, this breach cannot be tied down to one site. Instead it appears to comprise multiple breaches across a number of services including 2,000 databases.

Hunt says there are many legitimate breaches in the directory listing, but he cannot yet verify this further. “This number makes it the single largest breach ever to be loaded into HIBP,” he adds in a blog.

What’s more, his own personal data is in there “and it’s accurate”, he says. “Right email address and a password I used many years ago. Like many of you reading this, I’ve been in multiple data breaches before which have resulted in my email addresses and yes, my passwords, circulating in public.”

Finding out if you’re affected

If you are one of the 2.2 million people that already use the Have I Been Pwned site, you should have received a notification: Nearly half of the site’s users – or 768,000 – are caught up in this breach.

If you aren’t already a member, you need to visit Have I Been Pwned now. Once on the site, you simply need to type in your email address and search, then scroll down to the bottom of the page. The site will let you know if your email address is affected by this breach – and while you are there, you can see if your details were stolen in any others too.

To find out if your password has been compromised, you separately need to check Pwned Passwords– a feature built into the site recently. This feature also helps you to use strong passwords: if yours is on there, it’s safe to assume others are using it and your accounts could be easily breached.

What if my details are there?

Hunt says in his blog: “Whilst I can’t tell you precisely what password was against your own record in the breach, I can tell you if any password you’re interested in has appeared in previous breaches Pwned Passwords has indexed. If one of yours shows up there, you really want to stop using it on any service you care about.”

If you have a bunch of passwords, checking all of them could be time-consuming. In this case, Hunt suggests 1Password’s Watchtower feature which can take all your stored passwords and check them against Pwned Passwords in one go.

Most importantly, if your password is on the list, do not ignore it as it can be used in credential stuffing attacks mentioned earlier. Hunt says: “People take lists like these that contain our email addresses and passwords then they attempt to see where else they work. The success of this approach is predicated on the fact that people reuse the same credentials on multiple services.”

More generally, as the number of breaches and their sheer scale increases, it’s time to clean up your password practices. In addition to using two-factor authentication, passwords should be complex – such as a phrase from a favourite book or a line from a song. At the same time, security experts don’t rule out analogue books containing your password – as long as these are not stored on your device or with it.

If you take these measures into account you should be able to avoid using the same password across multiple sites. Ideally, start using a password manager to ensure you can remember these.

Source: Forbes

by
Keep Reading
Cybersecurity

Top 5 Cybersecurity Predictions for 2019

By
In the cybersecurity world today, with cybercriminals operating like a penetration tester in the way they scope out the network looking for vulnerabilities and weak entry points, those responsible for IT security will once again need to adjust their strategy and defenses. The Sophos 2019 Threat Report detailed how criminals are now “staking out” victims, moving laterally throughout the network, manipulating internal controls to reach their objectives with stealth. As endpoint protection has improved, so criminals are on the lookout for the next weak entry point. The focus can no longer be on protection and detection, but also intelligent and automated response that provides lateral movement protection to isolate an attack moving through the network. Sophos CISO Ross McKercher outlines the Top 5 Cybersecurity Predictions for 2019.
With cyber criminals constantly on the lookout for weak entry points, the cybersecurity focus needs to shift from protection and detection to intelligent and automated responses that isolate a cyberattack.

  1. Security teams will need more development and engineering skills

Security teams used to focus on firewalls and endpoints and many security professionals cut their teeth as system and network administrators. Nowadays infrastructure is defined by code, breaches are increasingly caused by weak applications and automation is essential for under-staffed teams. This is changing the skillset required by security pros. We now also need to have a deep understanding of applications and an ability to build automation into our tools and processes.

  1. Organisations will up their focus on software supply chains

Everyone relies a huge amount nowadays on Open-source libraries that are often maintained very informally by loose-knit communities that are easy to infiltrate. This used to be the domain of nation states but the criminals are getting in on the action.

  1. AppSec will continue to grow

We are getting better at protecting Endpoints and attackers are shifting their focus. Legacy applications will continue to be a fertile hunting ground!

  1. Threat Hunting really will be driven by ML

Bit of a cliché but ML will no longer be something that you just buy. Tools & techniques that were previously the domain of data science experts are getting easier to use. Won’t be long before larger SOC teams are using the tools directly rather than via models that are embedded in products.

  1. Zero-trust starts to become achievable

The tools, knowledge and technologies for achieving a true Zero-trust architecture are rapidly maturing. Maybe like nuclear fusion – 15 years away and always will be but 14 years after the Jericho forum declared the end of the network perimeter we are getting close the point where many enterprises have a realistic chance of keeping their clients off “trusted” networks, particularly non-technical employees.

Source: DataQuest

by
Keep Reading
Getting your First Job as a Hacker
Cybersecurity

How to Get Your First Job as a Hacker

By

Let me guess. From a young age, you were attracted to spy movies. You are someone who wasn’t necessarily interested in school subjects, but probably did okay regardless. You learn concepts easily and quickly compared to others. You had a natural affinity for computers at a young age. Something about you is excited by the subversive blackhat hacking community, but actually, you’re a good person who doesn’t like the idea of ruining people’s lives or spending your life doing chin-ups with your morally questionable mate “Steve” in a high security prison.

So what’s the solution? Become an ethical hacker, so that you can do these illegal things without risk of jailtime, and get paid for it!

I should start with a disclaimer — I’m not an expert. I’ve only ever landed one hacking job, which is my current one — and I haven’t even been here long! But I did spend a lot of time in other sectors of IT wishing I was in security. As a result, I’ve read a lot of stuff and spoken to a lot of people. Basically, it all boils down to this:

There is no one-size-fits-all approach to getting your first infosec role. There was a recent Twitter hashtag that did the rounds, #MyWeirdPathToInfosec, where a whole bunch of infosec professionals revealed the paths they took to an eventual infosec role. They varied widely, some spent time in federal prison (not recommended), some were musicians, some scored an infosec role straight out of college, some were offered jobs after illegally hacking a company and then telling the company how they did it (also not recommended). This technique may have worked for some people in the 90s, now it will probably land you in jail.

The point is, don’t have tunnel-vision. Career opportunities often arise where you least expect.

A Little About My Path to Infosec

I remember my first experience with “hacking.” I was about 10 years old, and I discovered the ability to save webpages locally. I headed straight to Google, downloaded the home page, and edited my local copy in notepad.exe to contain the words “Luke was ‘ere!”. When I opened up the edited page, my stomach dropped. I thought I had defaced Google. How long until the FBI kick in my door? Should I tell my parents before they find out?

Back in myyy daaaay, there were no hacking challenge sites. In fact, there was barely any information out there, at least that I could find. My first resource was a website by Carolyn Meinel, titled “The Guides to (mostly) Harmless Hacking.” The guides were written in Comic Sans, the token font of that bad design genre that can only be found in the 90s and early 00s. These guides included such classics as “Telnet: the Number One Hacking Tool” and “How to Hack with Windows XP part I: The Magic of DOS.” They can still be found here.

Upon finishing school I scored my first job in IT and started a computer science degree, almost finished, dropped out, got made redundant, moved out of home, acquired Bachelor of Music, became a full-time musician, spent a couple of years performing on cruise ships, met my wife, lived in the UK, got married, moved back to Australia, and started working as a full-time web developer.

Throughout all this, my passion for hacking never really subsided, and development was never something I loved. I had a wonderful job with great people, but the actual tasks of my job weren’t sparking me. As it turns out, I was on a project which involved e-commerce and sensitive data, so my boss offered for me to take a security related course. I emailed the CEO of a local penetration testing firm and asked what the best security course was, and he recommended OSCP. So I did it!

Completing my OSCP was a turning point for me. I spent every spare moment of those 60 days learning as much as possible about the art of hacking. Even when I was exhausted, I had trouble sleeping because my brain wouldn’t stop thinking about the challenge boxes in the labs. That’s how I knew it should probably be my job, instead of development, which I had grown tired of. (I wrote a three-part blog series about the OSCP too, if you’re into that.)

Only a month or two after completing OSCP, I landed my first penetration testing job through a great infosec recruiter after solving a hacking challenge they posted online. You can read more about that story here.

Enough about me! Finally, we are at the bit you all came here to read. Some actionable tips on how to get your first job as a hacker:

Get Active in the White Hat Community

Contribute to open source tools, write your own, blog, start a podcast, go to hacker cons, connect with people on Twitter. You will learn a lot and it will introduce you to a whole network of lovely people who can help you. The infosec community on the whole are a friendly, tight-knit pack of smart, passionate people. If you’re reading this, there’s a good chance you will feel at home.

Email People You Respect

Are there people out there in your dream role? Email them and ask about your career path. The worst that will happen is that they don’t reply, the best that can happen is that you gain a mentor and some life-changing advice.

Be Trustworthy

You can have every hacking certification under the sun, but if you walk into the interview gloating about some illegal stunt you pulled, nobody will risk hiring you. The white hat community often deal with highly sensitive data — your employer and your clients need to be able to trust you.

On that note, when you’re in an interview and you don’t know the answer to a technical question, it’s better to say “sorry, I don’t know, but I will be sure to research that later!” than to try to bluff your way through an answer. The person interviewing you will be able to tell, and they are probably more interested in you being honest and genuine than correct. At this point in time, experienced security professionals are rare, so many companies are hiring less experienced staff with the right mindset and attitude, then putting them through training to learn the technical skills.

Get Certifications

Frankly, many certifications in this field aren’t a good indicator of someone’s technical ability. Having said that — you’re more likely to get a job if you have them. It shows that you’re invested in the craft, you have spent time/money skilling up, and you are interested. There are a few great certifications out there, and some that aren’t so good. If you’re not sure which ones are good, ask someone who knows!

Bug Bounties, CTFs and Challenge Sites

Have you been in a HackerOne/BugCrowd hall of fame? Found a RCE in a bug bounty? Did you do well in a CTF at a hacking conference? Are you highly ranked on hackthebox.eu? Put it on your CV! These things might seem like games, but they’re also proof that you’re passionate about the craft, and have some skills.

Don’t Be Afraid of Recruiters

Recruiters get a bad name for relentlessly calling you and using dodgy tactics to get the right contacts, but they’re not all like that. Finding a quality recruiter with good connections can make all the difference. When you are looking for a recruiter for a hacking gig, find one that specialises in infosec. A standard IT recruiter probably won’t know the right people.

Make Your Current Role a Security Role

Are you a developer? Find a bug in the application you develop, show it to your boss, ask permission to conduct more in depth security testing. Are you a sysadmin? Find a security hole in your network (you probably already know where to look), communicate the risk to your boss and ask for permission to conduct further testing. Whatever role you’re in — there’s a good chance you can make a name for yourself as the in-house security expert.

Now in your infosec interview/CV, you can say you were the in-house security expert, even though your official title was just “developer.” You can also fill out the “responsibilities” section of your role with some security related tasks.

Source: Medium

by
Keep Reading