Category: Uncategorised

Ever since Facebook announced that it would be changing its name to ‘Meta’ and shifting its focus onto the wonderful world of the metaverse, it has become a hot topic in a wide variety of industries. Some have dubbed the metaverse “the future of the internet”, but what exactly is it?

Well, put simply, the metaverse is a 3D, immersive version of the world wide web that could be accessed via a VR headset or your browser. This is a world in which users can explore their surroundings via a digital avatar.

The metaverse has been around as an idea for a while now – the term was first coined by the science-fiction author Neal Stephenson, in his 1992 novel Snow Crash. The idea has regularly appeared in books and films since then, from The Matrix to Ready Player One, but in recent years, it’s become a reality. Last year saw over $120 billion (£97.7 billion) invested in the metaverse, and it’s set to keep growing. It clearly has the potential to transform our daily lives, but all that investment is likely to attract cyber criminals, so anyone looking to join the metaverse needs to take a closer look at their cyber defences.

The metaverse promises to be the next iteration of the internet. It could soon be the place we all go to do everything from working and shopping to hanging out with friends – all without leaving the house. When Mark Zuckerberg first announced that his company would become metaverse-first, he said that he believed it “will be mainstream in the next 5 to 10 years.”

Device Hacking – To get the most out of the metaverse, users will need new technology, from VR headsets and haptic gloves to AR (augmented reality) glasses. This dependence on hardware could be bad news for the organisations behind the metaverse – and for its users. Each piece of hardware is a potential entry point for hackers, and another way to access your network. AR and VR devices would also provide hackers with information on what users are doing in real time – far more than they’d get if they’d simply hacked into a social media account. Exploring the metaverse via company devices could put these devices, and the vital data they have access to, at significant risk. With many high-profile organisations already choosing to ban TikTok from company devices due to privacy concerns, it is extremely likely that metaverse activity will also be limited by many businesses in the near future.

Identity Theft – Identity theft is already a problem online, but the metaverse could take it to a whole new level. VR headsets could be integrated with facial recognition or biometric technology to help you log on quicker, and in the metaverse, everything you do online would likely be linked to your digital identity. Cyber criminals would be able to create a digital copy of anyone in the metaverse, then access everything from their finances to confidential files from their workplace. A scary thought for CISOs!

As well as biometric information, these wearable devices could also contain sensitive data that neither users nor their employers would want falling into the wrong hands – like detailed information on their health and wellbeing. Last year, a UAE-based healthcare company announced plans to launch the world’s first metaverse hospital , a hospital that users would be able to visit from anywhere in the world. Other virtual hospitals are likely to follow suit, and if they don’t strengthen their cyber defences, users’ medical records could be left vulnerable to attack.

Eavesdropping – One of the biggest dangers of the rising metaverse, and something that can be done relatively easily, is eavesdropping. As well as listening in on private calls and meetings through AR and VR headsets, attackers could also attempt invisible-avatar eavesdropping (also known as a ‘man in the room’ attack). By entering a meeting hosted on the metaverse with an invisible avatar, hackers can easily listen in to and even record the sharing of sensitive information without being detected by others in the virtual room. These kinds of attacks haven’t happened yet, but they could soon, as cyber criminals are known to be working on ways to remain undetectable in the metaverse. If they do, they’d be able to spy on workplace meetings metaverse-wide, opening up a whole new era of corporate espionage.

Preparing Your Cyber Security Strategy For The Rise Of The Metaverse: Our Advice

The metaverse is coming, so there’s no point in burying your head in the sand. Businesses and organisations need to start preparing their cybersecurity strategies for the metaverse now. Here are our top three tips to help you get started with your metaverse-first security strategy.

1 – Do your research – The best way to prepare for the rise of the metaverse is simply to understand it. Business leaders and cybersecurity professionals alike need to read up on it and all the cyber risks it entails, so they know where their vulnerabilities lie, and what they need to do to protect themselves. Take a look at your competitors, too, and see what preparations they’ve already made (if any!).

2 – Educate your employees – You already know that one of the best ways to reduce your risk of a cybersecurity attack is to ensure your employees understand the threats they’re under. So, why not add metaverse-specific best practices to your next cybersecurity session or internal communication?

3 – Identify all possible vulnerabilities – Before you or your business dip your toes in the metaverse, we recommend creating a detailed list of any vulnerabilities that could be exploited by cyber criminals once you’re in. Think about the vulnerabilities we explored earlier in this blog, alongside more conventional risks like phishing or malware attacks. Once the list has been created, you can address these issues one by one through a thorough metaverse security strategy. Then, create a schedule to regularly revisit the list and check up on your identified weaknesses.

The Future of Cyber Security

The metaverse may be a few years from achieving its full potential, but today’s cyber security professionals can’t afford to wait around and see what happens. They need to prepare for the rise of the metaverse before it’s too late.

While it could change the way we live our lives for the better, the metaverse will also bring a whole host of new cyber risks that will need to be addressed.

Are you looking to take your first steps into the metaverse? Or just find out more about strengthening your cyber defences? You’re in luck! With a team of cyber security experts located across the globe and a range of services to suit any business, we can help you prepare for whatever the metaverse might throw at you.

Whether you’re looking for help assessing your organisation’s vulnerabilities, or the development and implementation of a full-blown cyber security strategy (with the ongoing support required to keep it going), we’ve got it all.

Get in touch with us to find out more or get started.

Web3 is a term that is surrounded by controversy. Some are crowning it “the evolution of the internet” while others have labelled it “a myth” and “a marketing buzzword.” Clearly, there’s no doubt that the concept of Web3 has got people talking.

Since Tim Berners-Lee invented the world wide web in 1989, its centralised approach has helped build and maintain the stable infrastructure we now expect. However, this has allowed large technology companies to make the majority of the decisions surrounding the web. This has created a monopoly that we are beginning to grow out of.

Rooted in the concept of decentralisation, Web3 is the answer to this monopoly. Built, operated and owned by its users, Web3 puts power in the hands of the many, rather than the few.

Web3 is the all-encompassing term used to describe the next evolution of the internet. It comes as the third generation of the world wide web and follows Web1 and Web2:

• Web1 (1990-2004) was a version of the world wide web that was entirely read-only. Users could view static websites owned by companies but could rarely interact with or produce content themselves.

• Web2 (2004 onwards) is the version of the world wide web we are familiar with today. Alongside organisations sharing content online, users can also generate their own content and interact with content shared by companies and other users. This version of the web also allowed brands to advertise online, creating monetisation opportunities for website and content owners.

• Web3 (TBC) is a version of the world wide web that utilises blockchains, cryptocurrencies and NFTs to allow users more ownership over the web. According to etherium, four key principles broadly define Web3 – it is decentralised, permissionless, trustless, and uses native payments through cryptocurrency.

Web3 brings with it many potential benefits over the version of the web we’re all used to (Web2). Here are just a few of them:

• With no single central point of control, it’s far more difficult for threat actors to gain access to or control over data and devices connected to the web. This will allow for increased security.

• With fewer intermediaries required and more open access to technology and information, Web3 may also reduce costs for both businesses and users.

• With encryption as the default for all communications, Web3 will likely mean increased privacy for its users.

• With fewer middlemen, users can benefit from greater control over the data and communications they share and receive.

• Decentralised, accessible and interoperable data will increase the amount and quality of data available to developers, allowing them to develop better models of Artificial Intelligence (AI) and Machine Learning (ML) – two hallmarks of today’s technological developments.

• Finally, using blockchain will enable developers to implement ‘smart contracts,’ which are automated processes that trigger actions when predetermined conditions are met. This could reduce the need for manual labour in a variety of areas, from marketing and advertising to cyber security.

In addition to the benefits that Web3 offers, several potential risks also accompany this new version of the web. These are highlighted below:

• With no central authority in control of the web, no one is accountable for its maintenance. If not addressed, this lack of accountability could lead to poor user privacy, a lack of data protection and insufficient integrity of information.

• The lack of centralised data associated with Web3 can make it difficult for organisations to make properly informed decisions. With data spread out across various locations, there is no single “source of truth.” This makes it harder for businesses to base their actions on accurate data, which complicates strategic analysis.

• Although many consider blockchain a much safer approach to storing and sharing data, some vulnerabilities come with its use. These vulnerabilities can lead to four key types of attack: 51% attacks, routing attacks, sybil attacks and the well-known phishing attacks.

Although web3 is not yet fully in operation, there is one thing for sure: it’s coming. With this knowledge in hand, the best thing to do is prepare ourselves (and our defences) for its arrival.

Whatever resources and/or capabilities you need, the Infosec K2K team are the perfect partner to bolster your ranks and ensure your organisation is as safe as can be in the advent of Web3.

Get in touch with us to find out more about how we can help you.

In our fast-paced world of instant gratification, digital transformation is more than a way for a business to get ahead. It’s also an essential process to ensure its survival. By digitalising and automating manual processes, organisations can maintain the agility and productivity required to thrive in today’s competitive market.

But as with any business transformation, digitalisation comes with a plethora of potential risks. After all, the more data and processes a business has, the more potential vulnerabilities there are for criminals to exploit.

In today’s blog, we’re taking a look at the risks associated with digital transformation and the cloud, and the precautions you can take to protect your business from them.

1. Leaking Customer Data

One of the negative outcomes of a breach is the exfiltration of customer data. Once stolen, this is often sold on the dark web.

Consider where and how customer data comes into your organisation, where it’s stored, and how it’s used. Think about the kind of data you are collecting, too. Personal identifiable information (PII), banking details and payment information are of particular interest to threat actors. Therefore, this information needs to be protected at all costs.

Scan your data’s movements, from the minute it enters your organisation to the point it is permanently deleted, for any potential vulnerabilities that could lead to a leak. If you’re not sure how to carry out this kind of evaluation, consider bringing in a cyber security partner like Infosec K2K for a comprehensive security assessment.

2. Rushing Things

When it comes to organisational change, there can often be a great deal of pressure to move very quickly. However, when it comes to cyber security, it is important not to rush things.

Taking shortcuts to speed up your digital transformation process could greatly increase your security risks, exposing you to potential cyber threats.

Ensure there is a detailed “cyber security check” at each and every step of your transformation process, so you can complete the project knowing you’ve left no stone unturned when it comes to security.

3. Not Determining Your MVP

Those familiar with digital projects will also be very familiar with the term ‘minimum viable product’, or ‘MVP’. An MVP is essentially the bare minimum that you will accept as a “finished product” at the end of your project.

Usually, when taking an MVP approach, an organisation will complete the project with the MVP before launching follow-up projects designed to improve on and add more functionality to the solution.

It is important to determine the minimum security and privacy requirements you are willing to accept before launching your digital transformation project. These requirements might not include the most sophisticated cyber security solutions available, but they should still minimise the risk of a potential breach as much as possible.

We recommend considering introducing the concept of “Security By Design” in your business’ MVP. By making security a part of the process when a new product, platform or service is introduced in your business, you can prevent future attacks and streamline the cyber security process.

4. A Lack Of Accountability

Even if your organisation is fortunate enough to be armed with a full team of IT and cyber security officers, that doesn’t mean that the burden of cyber security sits solely with them.

All employees within your organisation have the potential to cause a cyber security breach, so they should all be accountable for preventing one.

Education is key here – ensure all employees within the organisation understand the risks of a breach, the potential damage it could cause to the business, and the ways they can prevent it. And, even more importantly, ensure they understand the value of the information they possess. Ask them to ask themselves “what could a threat actor with malicious intent do with the information that I’ve just been asked to share?”. Make it clear that every individual in the organisation is equally responsible for the safety of its data, programs and processes, and then ensure they are adequately trained to maintain that safety. Consider investing in an assessment of your employee’s current level of cyber security knowledge. Those that underperform should then undergo training and education to ensure they’re up to scratch.

5. Forgetting The Basics

When we’re developing cyber security solutions for complex business processes, it can be so easy to get caught up in the detail that we forget the basics.

Develop clear checklists and process requirements to ensure you’re up to speed with basic cyber hygiene, like best practices for password setting and multi-factor authentication, or even Zero Trust. That way, you can focus on the more complex tasks at hand without being let down by easily avoidable vulnerabilities!

5. Forgetting The Basics

Consulting a team of experts might seem like a big investment, particularly if you already have a cyber security team in-house, but it is not nearly as costly as a breach would be.

Businesses like Infosec K2K are equipped with teams of analysts that live and breathe cyber security. They spend each and every day swotting up on the latest threats, vulnerabilities and attack methods, and are always one step ahead of cyber criminals. By consulting with the experts when pulling together your digital transformation strategy, you can ensure you are prepared for whatever threat actors might throw at you.

Note: it is never too late to ask the experts. If your project is complete or almost complete, consider investing in a detailed security assessment. With a thorough review of your tech stack and processes, an assessment can look out for any vulnerabilities that might have been missed along the way.

Are you undergoing a digital transformation project and looking for support to ensure your organisation is safe from potential security vulnerabilities? From security assurances services to crisis response plans and ongoing managed services packages, the team at Infosec K2K have a range of services to suit your organisation’s needs. Whatever resources and/or capabilities you need, the Infosec K2K team are the perfect partner to bolster your ranks and ensure your organisation is as safe as can be.

Get in touch with us to find out more about how we can help you.

Ransomware is a specific type of malicious software (or ‘malware’), designed to block access to a network or system until a ransom (a sum of money, usually demanded via cryptocurrency to ensure the anonymity of the recipient) is paid.

The malware usually works by encrypting key files on a network, rendering all users (even network admins) unable to view them. The hackers will then contact the organisation requesting a ransom be paid in exchange for the decryption key. Sometimes, the ransomware will also have the functionality to exfiltrate data from the encrypted network, allowing the hackers to steal as much data as they can access. Essentially, these attackers put their victims in a position whereby the quickest, easiest and often cheapest way to regain access to their organisation’s data is to pay the ransom.

You can find out more about ransomware and the reasons for its rise in popularity here.

Thanks to its ability to spread quickly, impair systems and processes, and exfiltrate valuable data, ransomware is one of the most dangerous and costly forms of malware. And it’s growing fast, too. Roughly 37% of all organisations across the globe were victimised by a ransomware attack in 2021.

The most prominent ramification of a ransomware attack is the financial losses associated with it. According to an IBM Security report, the average total cost of a ransomware breach is somewhere around 4.62 million USD (£3.76 million).

It isn’t just about the money, either. Ransomware attacks can lead to:

– Loss of valuable company data
– Leaks of personal customer/employee information, which could lead to impersonation and/or personal financial losses
– A decrease in customer trust and brand loyalty
– Unexpected downtime for important business processes and/or systems
– An inability for the business to meet customer needs/requirements, potentially leading to a breach in contractual obligations and/or service agreements
– Dangers to customer safety (particularly in public infrastructure, public service and/or medical organisations)

The good news is there are ways to protect your organisation from ransomware attacks – but traditional anti-virus solutions won’t cut it. These dated solutions use signature patterns to identify and block known malware variants, but contemporary ransomware is too smart for this. The latest malware programs continuously morph, ensuring they can’t be detected using signature-based methods.

The best way to successfully defend your network against today’s ransomware threat is by taking a multi-layered, ‘defence-in-depth’ approach to security.

This approach should include the following:

– A combination of Identity and Access Management (IAM) capabilities (e.g. multi-factor authentication, or ‘MFA’)
– An Endpoint Privilege Management (EPM) program
– A Privileged Access Management (PAM) solution

Our partners at CyberArk are the masters when it comes to ransomware protection.

Identity and Access Management (IAM)

CyberArk Identity, CyberArk’s Identity and Access Management solution, allows organisations to quickly achieve their workforce identity security goals while enhancing operational efficiency. A SaaS-delivered solution, CyberArk Identity is designed for easy consumption and scalability, making it suitable for businesses of any size.

Find out more about the solution here.

Endpoint Privilege Management (EPM)

CyberArk Endpoint Privilege Manager is designed to remove local admin rights, enforce least-privilege security, defend against ransomware and cached credential compromise, and enable application control at the endpoint – thus helping to contain attackers at the point of entry, before they can traverse your network and inflict serious damage.

Find out more about the solution here.

Privileged Access Management (PAM)

CyberArk Privileged Access Manager is a solution designed to continuously discover and manage privileged accounts and credentials, isolate and monitor privileged sessions, and remediate risky activities across environments. With the option to purchase it as a SaaS or as a self-managed solution, CyberArk PAM can be implemented in organisations with or without experienced security teams.

Find out more about the solution here.

Are you looking for support implementing a CyberArk solution? You’re in the right place!

With a team packed with CyberArk experts (and even some past CyberArk employees!), there is no one more qualified to successfully implement and manage your CyberArk solution than Infosec K2K.

Get in touch with us to find out more about how we can help you.

There’s no doubt about it, Zero Trust is by far one of the hottest topics on the Cyber Security scene right now. And for good reason!

First popularized by Forrester Research analyst John Kindervag, the term ‘Zero Trust’ refers to a relatively new approach to cyber security. Rather than assuming that an identity can be trusted based on credentials or location, as with traditional perimeter-based security, zero trust presumes that no connections should be trusted. By trusting no one and nothing, zero-trust ensures that only devices and users with the correct authentication and authorization are able to access an organisation’s network.

Standing accounts with any considerable level of admin access or power can be incredibly dangerous. Misuse of this elevated access, whether intentional or not, can cause serious damage to your business’ network. What’s more, if a threat actor gains access to one of these privileged accounts, the threat is far, far greater.

A true Zero Trust model involves a “least privilege” approach – i.e. a user is only given the absolute minimum privileges required and every privilege is only granted at the exact time it is needed and for the exact duration it is needed.

No matter how secure the user attempts to make their passwords, they are intrinsically insecure. The well-known and often-used practice of IT teams forcing business users to pick complex passwords and change them once a quarter is simply not enough anymore.

Instead, opt for a combination of authentication methods, often known as multi-factor authentication (MFA). Alongside password authentication, these methods could include:

Certificate-based authentication
Biometric authentication
Token-based authentication
Voice authentication

When making the move to cloud-based systems, many organisations choose to leverage their existing on-permises processes for administration in the cloud, so they simply make on-premises administrative accounts into hybrid accounts.

This approach is incredibly unsafe, as it allows attackers to take advantage of the complex legacy nature of the accounts to attack systems and access data in the cloud. In fact, it has already led to some serious attacks on cloud infrastructure.

Our tip? Keep cloud privileged roles cloud-only!

Are you looking for support implementing or improving your Zero Trust solution? You’re in the right place!

Having carried out multiple Zero Trust projects to date, the team at Infosec K2K are the experts when it comes to building a solution that truly sticks to all the principles of zero trust security, keeping your organisation safe and secure from potential cyber threats.

Get in touch with us to find out more about how we can help you.

There’s no doubt about it, 2022 has been the biggest year yet for the cyber security industry. With more attacks and a greater cost per breach than ever before, the ever-changing cyber landscape can be difficult to keep track of.

To help you prepare for whatever the world of cyber crime has to throw at you, the experts at Infosec K2K have pulled together 6 key cybersecurity trends to keep an eye on over the next 12 months.

The Problem: As threat actors find new emerging tactics, techniques and procedures (TTPs) to exploit every day, and new vulnerabilities are constantly emerging, the threat landscape is evolving at a rate that is almost impossible to keep pace with.

How You Can Prepare For It: If you want to avoid a devastating security breach, ensuring your organisation is on top of the latest threats is a non-negotiable. We recommend putting in place a thorough crisis response plan, which can then be evaluated and evolved each time a new threat is dealt with. To see if your business is adequately prepared for the cyber threats of today and tomorrow, why not consider a security assessment? This meticulous procedure will look at every possible area of weakness in your organisation, evaluating the level of risk and providing detailed recommendations to help plug any gaps in your existing defenses.

The Problem: One of the oldest but often most successful cyber threats, phishing continues to be one of the most popular methods of attack for threat actors worldwide. According to Security Magazine, businesses were hit by more than 255 million phishing attacks in the first 10 months of 2022 alone, a 61% increase on the same figures in 2021.

How You Can Prepare For It: Whilst spam filters and phishing tools can be effective in minimising the number of messages that make it through to your employees, the odd phishing attempt is bound to find its way into someone’s inbox sooner or later. The best way to prevent a successful phishing attempt is to educate your teams on the signs of a scam. Every employee in your business should know these three key things:
– How to spot a phishing email, call or message
– Who to report a phishing attempt and how
– What previous phishing attempts at your organisation have looked like

At Infosec K2K, we offer comprehensive cyber security training designed to help your employees to become more cyber-savvy, minimising the likelihood of a successful phishing attempt.

The Problem: As it spreads its way through our homes, offices and other shared spaces, Internet of Things (IoT) is quickly becoming an integral part of our everyday life. However, connecting a large number of devices to one seamless network brings with it a number of risks. Primarily, it only takes one device being hacked for a threat actor to gain access to the entire network of devices and the cloud network connecting them.

How You Can Prepare For It: We recommend taking great care when integrating IoT to your business and devices. Ensure that you have a strategy for built-in security and controls that can be applied to all IoT devices before you begin connecting them. When purchasing any devices, evaluate the potential vulnerabilities of each device and plug them before the device is introduced to your business, minimising the risk of a breach. Confirm that all devices are password protected (using secure and varied passwords) and that passwords are not stored unencrypted anywhere online.

The Problem: Without an understanding of the cyber security basics, many web and app developers unknowingly create vulnerabilities in the development process. This was brought to light way back in 2021, when the critical Log4shell vulnerability surfaced, yet it is still a concern.

How You Can Prepare For It: Consider how you can integrate cyber security into your development process as early as possible. How can your cyber security / IT and development teams work together? Can you move the security steps in your development pipeline right to the beginning, embedding them into the design principles, rather than seeing them as a final hurdle to jump over before go-live? Then think, how can you upskill your design and development teams to ensure a better understanding of the potential vulnerabilities they could be building into their work? If you don’t have the capacity or budget for an in-house cyber security team, don’t worry! Why not consider outsourcing to a cyber security partner, like Infosec K2K, to work in tandem with your developers?

The Problem: As flexible working becomes the norm and teams become more geographically fragmented, cloud adoption continues to accelerate. However, the move to the cloud can come with significant cyber security risks – particularly if security is not a key aspect of your adoption plan.

How You Can Prepare For It: If you are in the process of moving to the cloud, make cyber security part of your strategy for digital transformation and adopt a vulnerability management process (delivered either internally or externally) to keep an eye on it on an ongoing basis. If you have already moved to the cloud, consider a cyber security assessment to identify any potential vulnerabilities in your existing cloud environment.

The Problem:It is a common misconception that identity theft is only a concern for the consumer, but it is also incredibly common in businesses. If enough information about your employee can be accessed online, even the least sophisticated cyber criminal can easily attempt to impersonate their professional profile and gain access to your business network.

How You Can Prepare For It: We recommend digitising as many of your processes as possible (e.g. using electronic signatures to sign important documents) and ensuring your employees understand the dangers of making their personal information available and accessible online. Something as simple as a post about a pet on a public social media profile could lead to a threat actor cracking an employee’s network password, so it is important that your employees are being careful when sharing information online.

Want to stay on top of the latest cybersecurity threats, hacks and trends? Subscribe to our weekly Cyber Newsletter here.

Are you a CISO, IT or Cyber Security professional looking for support from a reliable cyber security partner? Look no further!

Get in touch with us to find out more about how we can help you.

The global zero trust market is growing fast – so fast, in fact, that it is projected to reach an astonishing $52 billion by 2026. And, given the ever-increasing threat posed by cyber criminals, it is hardly surprising (and a bit of a relief!) that organisations are stepping up.

Today, we’re exploring precisely what zero trust means, alongside the reasons and potential implications of its growth in the cyber security market.

First popularised by Forrester Research analyst John Kindervag, the term ‘Zero Trust’ refers to an approach to cyber security that presumes that no connections to corporate networks and systems should be trusted. Rather than assuming trust, as perimeter-based security has done for many years. By trusting no one and nothing, zero-trust ensures that only devices and users with the correct authentication and authorisation are able to access an organisation’s network.

With the number of cyber attacks on the rise, there is increasing pressure from regulatory bodies for organisations to improve their data protection and information security solutions.

These attacks commonly take advantage of vulnerabilities at endpoints and in cloud-based applications used by teams working remotely. So, as a solution with a greater level of security both at endpoints and for networks without a physical perimeter, zero trust is the obvious solution to reduce their frequency. According to a report published by Microsoft in 2021, 76% of organisations have at least started implementing a zero-trust strategy, while 35% believe they have fully implemented it.

When it comes to real-world applications, there are two primary use cases for zero trust security. These are:

1. For globally distributed teams

Organisations requiring international, or even national, access to the same central business network rely on cloud-based applications, alongside remote access to sensitive company data and documentation. Some companies force remote employees to reach resources through a virtual private network, but this solution is inefficient and carries many risks and complications. In contrast, zero trust does not require users to connect to the entire corporate network before accessing cloud applications or resources, alleviating many of the issues associated with VPN access.

2. For third-party network access

When allowing third parties to access an organisation’s resources, alternative solutions to zero trust tend to provide access to the entire network, creating a hefty and unnecessary security risk. With zero trust and a least privilege approach, users are only allowed access if authorised and, when authorised, are only allowed access to the bare minimum of assets and applications.

Are you looking for support implementing or improving your Zero Trust solution? You’re in the right place!

Get in touch with us to find out more about how we can help you.

Learn more about the most common cause of cyber security breaches worldwide and how you can protect your business from it.

In 2021, a company was hit by a ransomware attack approximately every 11 seconds.

As the necessary programs have become more and more accessible to potential hackers, ransomware attacks have been on a sharp rise over the past couple of years. But even those in the cyber security space don’t necessarily have the depth of knowledge to fully understand what a ransomware attack is, how they are carried out and/or the exact vulnerabilities they exploit.

This Cyber Security Awareness Month, we asked our cyber experts for a definitive answer to the question “what is ransomware?” and provide their advice on how to protect your business from an attack.

Ransomware is a specific type of malware (malicious software) designed to block access to a network or system until a ransom (usually a sum of money) is paid.

The malware usually works by encrypting key files on a network, rendering all users (even network admins) unable to view them. The hackers will then contact the organisation requesting a ransom be paid for the decryption key. Sometimes, the ransomware will also have the functionality to exfiltrate data from the encrypted network, allowing the hackers to steal as much data as they can access. Essentially, these attackers put their victims in a position where the quickest, easiest and often cheapest way to regain access to their organisation’s data is to pay the ransom. That’s why, in 2021, 32% of victims paid a ransom demand when hit by a ransomware attack.

The trend towards ransomware began back in May 2017, with the famous WannaCry ransomware attack. The WannaCry attack was a global epidemic caused by the spread of ransomware through computers operating Microsoft Windows. Cybercriminals took advantage of a weakness in the Windows operating system to encrypt users’ files and demand $300 in Bitcoin or their files would be deleted. That ransom was later upped to $600, as the attack became more widespread. The problem was, according to many sources, not a single victim got their files back (regardless of whether they paid the ransom or not).

Since then, ransomware has become more and more popular. Ransomware-as-a-service (or ‘Raas’) has even emerged – a business model through which cyber criminals license out their ransomware to people looking to perform a cyber attack themselves, but without the cyber know-how to create their own malware. As it has become the easiest and most accessible option to potential cyber criminals (even those that aren’t particularly good hackers), the popularity of ransomware has skyrocketed.

The COVID-19 pandemic and the rapid adaptation of organisations to remote working have also exacerbated the problem, as cloud implementations and the use of multiple remote devices have created vulnerabilities in cyber defences. In Q3 2020, as businesses were forced to adapt to remote working, ransomware attacks rose by 50% compared to Q1 of the same year.

1. Training and Education – The best way to protect your business from any type of cyber attack is to ensure cyber security best practices are second nature to your teams. Teach your employees to identify phishing emails, keep all their systems and applications updated and perform regular cyber security checks on their devices.

2. Data Backups – If you are hit with a ransomware attack, but you have recently backed up the data they have encrypted, you won’t need to pay the ransom and can go about your business without much worry. This also applies to many other types of attacks, whereby data is deleted, corrupted or edited, as well as general malfunctions that might damage or delete your data.

3. Patching – Regularly update your systems and applications with new cyber security patches. As these patches are usually released by developers to cover vulnerabilities they have found in their own applications, cybercriminals often look to these patches to uncover said vulnerabilities and exploit them through the systems of users yet to download the patch. If your employees aren’t quick enough to download recommended updates, they could fall victim to this kind of attack.

4. Privileged Access Management (PAM) – PAM is the term used to describe a number of cyber security strategies designed to control the access and permissions for users and accounts gaining access to systems, applications and files on an organisation’s network. By ensuring that access is only granted to those that absolutely need it, and with the lowest possible level of permissions, PAM strategies limit the risk to a network. After all, if everyone has access to everything, there are lots more potential entry routes for cybercriminals to exploit.

4. Privileged Access Management (PAM) – PAM is the term used to describe a number of cyber security strategies designed to control the access and permissions for users and accounts gaining access to systems, applications and files on an organisation’s network. By ensuring that access is only granted to those that absolutely need it, and with the lowest possible level of permissions, PAM strategies limit the risk to a network. After all, if everyone has access to everything, there are lots more potential entry routes for cybercriminals to exploit.

5. Endpoint Privilege Management (EPM) – EPM eliminates risks on the endpoint of your network (i.e. your employee’s devices) by using a combination of least privilege access (allowing users only the access they absolutely need) and application control (restricting or blocking any unauthorized applications or updates). Our go-to solution is CyberArk’s Endpoint Privilege Manager, an endpoint control solution that allows organisations to remove local admin rights, enforce a “least privilege” strategy and implement foundational endpoint security controls across all Windows, macOS and Linux endpoints, including hybrid and cloud environments.

6. Anti-Malware – Anti-malware software can protect your business against thousands of the most common types of ransomware. This software works by identifying and notifying you of a potential threat before it can execute an attack. They use artificial intelligence and machine learning to alert system administrators of suspicious or unusual activity on a network, helping your IT and/or cyber security teams to resolve an attack before data is encrypted, exported, edited or destroyed.

Looking for support assessing, improving or implementing your cyber security solutions to minimise the risk of a ransomware attack? You’re in the right place.

Get in touch with us to find out more about how we can help you.

Security researchers from the software manufacturer Symantec have found unencrypted AWS access keys in almost 1,900 smartphone apps in the public domain.

Security researchers at Symantec found almost 1,900 publicly available smartphone apps (including mobile banking applications) with easily accessible unencrypted access keys, allowing them to access backend app data and private customer data. Within the 1,859 publicly available apps – 98% of them for iOS – the team of researchers found access tokens for amazon Web Services (AWS), which enabled access to a plethora of Amazon cloud data. Files belonging to 15,000 medium and large enterprises were discovered, alongside 300,000 biometric fingerprints.

Developers using AWS had put access tokens in clear text (entirely unencrypted) in source code, allowing anyone with the right knowledge and understanding of access keys to use them to access backend data on Amazon cloud. Not only this, but access to this data or the Amazon cloud was in many of those cases not restricted by any access management system or user identification process, meaning the researchers weren’t just able to access the data easily, but they could also modify and delete it, throwing into question the integrity of all data stored within the affected apps and institutions.

Although the access keys in this case were explicitly found within mobile applications, they could all be used to access data stored in AWS. The question is, if you’re currently hosting with AWS, how do you ensure you aren’t falling foul of the same mistakes these developers made?

Well thankfully, if you do want to secure your AWS or any other public cloud hosting, there are lots of solutions on the market that can help you do that. Below are a few of the solutions you can adopt to keep your data safe…

– Firstly, you could use the CyberArk Cloud Entitlements Manager to gain an overall view of your permissions and access. This would help you to remove any excess permissions that are no longer required right across your cloud footprint.

– Secondly, you should secure your access keys. This step doesn’t necessarily require a program, but it does require you to ensure that they are not stored in source code in clear text! If you must store your access keys in source code, ensure they are encrypted.

– If you are an app developer hosting through AWS, a possible solution to secure any secrets in your CI/CD pipelines could be CyberArk’s new Secrets Hub. The recently launched “Secrets Hub for AWS Secrets Manager” removes secrets from your application and replaces them with API’s, simplifying the developer experience and ensuring one centralised security policy can be carried out across the entire enterprise.

– Finally, you also need to think about access management. If a hacker does manage to decrypt your access keys, how do you ensure that they do not have the permissions required to access and/or modify your data? Identity and access management are hot topics in the cyber security space right now and, at Infosec K2K, it is one of our core specialities. Find out more about how we can help you to control user access to your data here.

Looking for support assessing, improving or implementing your cyber security solutions? You’re in the right place.

Get in touch with us to find out more about how we can help you.

The world’s number 1 taxi app was hit by a rather serious cyber security attack recently. But what really happened and what can we learn from the Uber hack?

Last week, it was revealed that Mobility as a Service provider Uber was hit with a high-profile cyber attack that has left the company’s reputation at serious risk. In today’s blog we’re exploring exactly how the attack took place, how it could have been avoided, and what we (as IT teams, cyber security experts and business owners) can learn from it.

Allegedly, a young hacker was able to download HackerOne vulnerability reports and view and screenshot almost all of the company’s internal systems (including emails, Slack messages, the company’s security software and Windows domain).

The hacker is said to have breached Uber through a social engineering attack (an attack that utilises psychological manipulation to coerce a user into performing certain actions or divulging confidential information) on an employee. They launched what is known as an MFA Fatigue attack – whereby a hacker almost has access to a user’s account but is blocked by multi-factor authentication. The attacker then spams the employee with multi-factor authentication requests until they become tired of seeing them and accept them. In this case, they completed the process by contacting the employee, claiming to be Uber IT and asking that they accept the request. The employee did as they were told, providing the hacker with access to the company’s intranet.

Once on the intranet, the hacker claims to have found a PowerShell script containing plain text admin credentials for the company’s Thycotic privileged access management (PAM) platform.

This was then used to access logins for the company’s other internal services, including app sourcecode and databases.

Well, in this case, the lessons are fairly simple.

1. Even if your business has a PAM solution in place, you will still require secure program enforcement to ensure all attack vectors are closed (even those that arise due to the introduction of a PAM solution, such as the one used to exploit Uber).

and

2. Never ever store your (privileged) credentials anywhere in clear text, especially not in automation scripts. Use encryption and/or dedicated solutions for secrets management, instead.

You’ve worked far too hard to let your business (or the business you work for) fall victim to a cyber attack such as the recent Uber hack.

At Infosec K2K, we know what it takes to keep your business safe from the threats of today and those of the future.

Get in touch with us to find out more about how we can help you.