Category: Security

Single Sign on Single Solution With Multiple

Posted on by admin

Ever heard of the term “Password fatigue”? It refers to a condition when people are forced to remember multiple passwords. In a 2014 survey by Intermedia, it was found that an organization provides access to a minimum of 15 applications to each of its employees on an average. This means that every employee of an organization needs to remember 15 different credentials every day. Not only does this create password fatigue for the employees but it also creates various challenges putting the network and organization’s data in a vulnerable position through this cumbersome process. Single Sign-On, referred to as SSO solves this problem effortlessly.

Single sign-on has not only solved the many problems faced by employees but has become an important part of the organization’s security program. It can be described as a software solution that gives users single access to various portals through one login and credentials. By decreasing the number and frequency of login attempts, the number of errors comes down, and eventually, network safety is increased. Along with good network safety, an SSO also brings with it several advantages. Let us get to know a few of them:

Benefits of SSO:

  • Healthy password practices:  The SSO reduces the risk of password fatigue and poor password practices as only a single login attempt are required instead of multiple login attempts. This actually enables users to come up with strong passwords as there is no cumbersome process involved with credentials.
  • Aids compliance process:  We all know that compliance and risk management go hand-in-hand. The SSO aids in maintaining compliance in the organization. There is constant monitoring of access management and it ensures compliance within the organization, thus aiding in better management of cyber risk.
  • Password, and beyond:  The SSO is not just about a single access point and credential management. The right SSO solution can even lead to the elimination of credentials totally, through new advancements like OTP-based login, biometric, etc. Organizations have the option to gain better network security by opting for various techniques like two-factor authentication (2FA), multi-factor authentication (MFA). Such techniques can prove to be a breakthrough to an organization’s cyber security practices.
  • Increased speed:  There is a need for highly efficient systems with high speed in industries such as defense, emergency services, hospitality, medicine, etc. due to the huge amount of operations and the quick nature of work involved. SSO not only saves time from repetitive tasks and prevents errors by providing single access to multiple platforms to a huge amount of employees at the same time, but it also increases the efficiency of their operations by preventing cyber-attacks and intrusions.
  • Increased productivity:  By using the SSO, the complexities of mundane routine tasks like remembering multiple credentials, multiple login attempts due to frequent session time-outs, waiting for support from the IT team, etc. are eliminated and in turn, the speed and productivity of employees increase.
  • Easy usage:  With SSO, there is no worry of having to memorize 10 different credentials for 10 different applications or having to log in 15 times again when a session times out. Users can enjoy real ease of use, which in turn induces better cyber safe practices and behavior.
  • Enabling cyber security in a timely manner:  We are well aware of the kind of sudden surge of pressure that the IT teams had to face during the onset of the COVID 19 pandemic. Due to the contingent nature of arrangements that they had to come up with in a short span of time, the burden on the IT team to provide support increased drastically.

Due to this kind of change in situation and expectations, many IT teams had to compromise on the quality of network security they could provide. It can be said that the importance and highlight on cyber security and data protection saw a sudden fall, especially in a time when it was required the most due to the fact that even day-to-day operations proved to be a herculean task to them with the many limitations the “work-from-home culture” brought in. This problem can be resolved with an SSO solution, as it eliminates most of the troubleshooting process and enables an easier diagnosis that can be taken up on a self-help basis. This way, day-to-day operations can be normalized and data security can be given the due importance it requires.

  • Preventing significant losses:  It is an evident fact that SSO improves network security and decreases the risk of data breaches. Organizations gain by avoiding financial and goodwill loss, which would otherwise be caused through cyber-attacks.
  • User account management:  Not only does it help at times of emergency, but also it maintains an orderly manner of credential management during the onboarding and exit of employees in a normal situation. With the SSO, managing user-profiles and accounts becomes hassle-free, thus breaking down complexities.
  • IT costs:  When the process of login and credential management is simplified, the need for troubleshooting in areas like credential management, help desk support, ticket resolutions, etc. reduces. This way, the organization can reduce IT costs.

Gaining the most of it:

While the SSO can prove to be one solution to multiple issues, an organization looking to implement an SSO must take a few extra steps in order to get the most of it. Let us take a look at what these extra steps are how these small steps can go a long way in extracting the best for the organization:

  • Enforcing strong passwords:  Although it is an SSO that makes the intrusion process difficult and provides better network security, the whole network would be compromised even if an intruder manages to crack one single user credential. This is why the management must always enforce extra-strong password practices for its employees to prevent endangering any user.
  • Caution while choosing an SSO solution:  Choosing the right SSO solution is very crucial as in an SSO, authentication, and access to all the applications or portals of the organization are singular. This means that if one portal is facing an issue, access to the rest of the applications will also be delayed. To avoid this, the SSO solution chosen by the organization must be highly reliable and contingency plans for business continuity must be placed properly.
  • Connected authentication, connected access, and connected risks:  A single intrusion not only means all users are endangered, it also means that all the applications connected through the SSO are also at risk open to the attacker. Just strong password practices are not sufficient to avoid this kind of classic failure situation, selecting a high-quality service provider with high-quality network security goes a long way.
  • Set-up process:  The set-up process for an SSO can be quite time and effort-consuming. The bigger the organization, the more complex the process. Caution must be taken while doing tasks like linking the identity provider to the service provider.

Cyber security is all about defense and Squid Game

Posted on by admin

An organization’s network system, attackers with risks awaiting to enter the network and the security team protecting the network. Sounds familiar? Well, it is all the same as the trending South Korean Netflix series “Squid Game”. The series is being widely described as grim, violent, cut-throat, and dystopian, but it can be said that it has been in the No.1 spot in the Top 10 shows in the US, right from September because it is highly relatable. So how is it relatable to today’s cyber security scenario and what are the key takeaways for organizations…?

Read through to find out.

Risk is always uncertain

The first and foremost takeaway from the series can be taken from the first condition the players are exposed to. Nobody amongst the players has an idea about what game they would be part of. They get into the game unaware of what their next game would be like, which denotes how risk is always uncertain. One cannot predict the type of attack they will face or when an attacker is going to try to hack the systems, this is why organizations must always be ready and completely equipped to face the risks.

The attacker is always at an advantage due to this uncertainty of the organization and by being prepared for all types of attacks, organizations can deny the attackers of this advantage.

Timely management of internal threats

The next takeaway can be taken from how internal threats like the police officer Hwang Jun-ho and an organ harvesting team were busted by the game host. We must understand that threats are not only uncertain but also of various types. An organization must tackle attackers with the methods and tools applicable for external threats and must use different strategies for handling internal threats. The network security team of an organization must always be on the lookout for abnormal activities.

Training must be provided to all employees about vulnerabilities like weak password protection, credential sharing, etc. to educate everyone about internal threats and possibilities of the data breaches. Staying fully aware of one’s situation and taking necessary precautions can prove to be useful in handling internal threats.

Being skillful and resourceful

It is to be keenly noted how the players in the Squid Game understand their position quickly and make a strategy for themselves. Right after their first game, they were aware that the sooner they got united the better they could save themselves from being shot dead. By forming a deal between themselves and staying united, they could save themselves from being killed by their peers in the “Midnight Fight”. “Unity is strength” is a time-tested proverb. On realizing that the offender is stronger than the player, the group of people unites and they begin using their skills, their experiences, and their strategies together. This way, they defeat a stronger team in the “Tug of War”.

The attacker always has an edge over the organization due to a wide variety of types of attacks to choose from and the uncertain nature of risks. This is why a network security team of an organization must comprise diverse individuals from various teams. Such a diverse team with diverse knowledge, experience, and point of view together will be able to handle any type of attack irrespective of the uncertainty.  Read more about this: A Go To Guide For Cybersecurity Technique

Opting for the right approach

Selecting the right approach to solving an issue always goes a long way. Consider the example of how a glass manufacturer spots the difference between normal and tempered glass with its reflective property. He further uses this approach to advance in the game with less risk.

Using the right approach has its advantage in dealing with an organization’s security. For each type of threat, a different approach needs to be followed like choosing behavior analysis for internal threats, etc. It is to be noted that once an approach is chosen and practiced and proves successful, documenting it is essential for future usage. Documentation of processes followed each time, creates a record of issues faced and successful methods implemented. This practice of documentation aids in forming company guidelines and that is how best practices evolve within the organization. This way, different approaches to solving an issue can be discovered and the organization becomes more efficient in security management.

Continuous technological improvement:

Just as how time-tested methods, practices, and approaches are important in risk management, being technologically updated and effective usage of tools is equally important. In the Squid Game, tools like knives, lighters throw some light into gaining an early insight into the uncertain and deadly games. This way a few players survive the game.

In cybersecurity, there is a compulsive need to always stay updated with technological tools. Thanks to the nature of risks today, organizations have been enabled to handle every risk through systems right from internal access management to risks associated with external data and its security, which can be evaluated through Vulnerability Assessment and Penetration Testing. The security management team of an organization must deeply reflect upon various factors such as time, cost, and manpower requirements and decide on the purchase of technological updates. If required, redundant or obsolete technology must be completely written off and new purchases must be made on time. To avoid a big gap between an organization’s vulnerabilities and the advantages of attackers, organizations must always stay up to date with their software and risk management tools.

Building a strong defense :

Cyber security is all about defense and it is almost evident at this point how the Squid Game and an organization’s cyber security can be analyzed. Cyber security of an organization must possess a strong defensive approach at all times. In addition to a strong defensive approach, it must also possess a high precautionary approach.

Risk is always better mitigated than managed. Through sufficient precautionary measures, an organization makes it difficult for an attacker to reach the target. When an organization looks sufficiently guarded in the eyes of an attacker, it is less attractive as a target. When an organization is less prospective as a target, an attacker would not choose to intrude on the security of that organization.

This is the crux of the idea behind building a strong defense in cyber security management. We at QRC, provide solutions such as an Enterprise security framework and much more for protecting your organization’s cyber security. Unlike the series, winning the Squid Game will never be a struggle for you.

Cybersecurity For The Hospitality Industry

Posted on by admin

The hospitality industry has been under the continual target of cybercriminals. The compromised reservation system of The Marriott Hotel chain owing to internal security opened gates for threat actors back in 2018. The root cause and the attack point were found to be the systems of an acquired company, Starwood hotels whose computer systems were still not migrated to that of Marriotts due to many internal reasons. An easy spot to attack and that is exactly what happened.

A cyber-attack like this can pose major losses to the organization like loss of revenue due to lawsuits, penalties, and customers being compensated. Not to mention the indirect costs of customers leaving the company and loss of goodwill, decline in brand value, dropping share values, huge financial ramifications.

So what does it take to realize the importance of cyber security, to be aware of the kinds of attacks and prevent this kind of a massive cyber-attack in a highly vulnerable industry like hospitality? Let us read through to find out:

Significance of Cybersecurity in hospitality :

It is critical to realize the importance of cyber security in an industry like hospitality as the vulnerabilities are high. Below are a  few reasons why it is high time to give Cyber security the highlight it deserves:

  • 1. Increasing awareness on cyber security with increasing cyber-attacks in the industry:  With several attacks around the world like the Marriott Hotel case being in news constantly, cyber security in hotels has achieved a new spot in the limelight. The examination of the internal security of the hospitality industry in the eyes of the consumers, legal system, and regulating bodies has been extreme. Several terms like exclusive IT and security programs, annual data security audit, post-incident examination have become common after 2015 when the industry faced several data threats and breaches. Apart from this, the consumers of this industry have been given an adequate amount of counseling on the amount of caution to be practiced during traveling.
  • With this kind of situation, it can be said that mere compliance is barely sufficient anymore and a well-planned cyber risk management strategy has become a prerequisite. Thus, if you have been thinking of upscaling your Cyber risk management and giving it a bit more importance than it deserves, this is the right moment.
  • 2. Conserving brand health and consumer trust:  It can be said that goodwill, trust of customers and patrons are part of crucial resources for the hospitality industry. In hospitality, trust and confidence are brand health, and not safeguarding it is a sure-shot way for downfall. Due to changes in the nature and value of data, the security or privacy breach may not be immediately apparent or its effects felt explicit. Most often, the harm is hidden until it is too late. This leads to legal risks and regulatory risks in addition to affecting brand health and loss on patrons.
     
  • 3. Significant Regulatory complications:  In the event of a cyber-attack in the hospitality industry, multiple class-action lawsuits are filed immediately as the attack is not just on the internal system of the hotel but a huge amount of personal data of the customers is compromised. Penalties under many acts are incurred including under GDPR. It cannot be stressed enough that legal and regulatory problems bring their own complications and issues. The penalties are bound to be heavy. Several countries in the world have passed legal Acts like GDPR, PIPEDA, etc. for the protection of data and privacy.
     
  • 4. Gaining a perception towards data security and privacy:  Data security and data privacy goes a long way from just data risk management and compliance. It can be said that data security and privacy come with a whole new world of possibilities that could aid in the business objectives of the hotel. Factors like personalized services, economic interests can be strategized and developed into well-defined business goals. Such planning must be done with the joint consent of the top management and the internal compliance authorities of the hotel. Data security and privacy must be viewed as a major aspect of the management of the hotel so as to gain different perspectives and put to optimum usage.

Types of Attacks and top ways to prevent i t:

1. Phishing attacks:

The challenge:  Phishing is one of the oldest types of cyber-attack, but still the most used technique. Phishing attacks can enable the aimed victim to do the activity desired by the attacker, from sharing information to authorizing transactions. The term phishing means sending or receiving spoofed emails which aim at tricking the victim and enabling them to reveal sensitive information. In most cases, this sensitive information is passwords or financial information and in the hospitality industry, it is aimed at the most authoritative personnel.

Solution:  Phishing has been prevalent for many years now. Although several comprehensive security awareness training programmes have been developed across industries, the training regime for the hospitality industry requires exclusive methodology. Instead of opting for only audio-video training material, going a step ahead and providing real life scenario training proves to be more effective. To give a glimpse of how it is to be on the scene of an attack or at the receiving end of an attack helps.

2. Ransomware Attacks

The challenge:  Research suggests that the hospitality industry has incurred huge losses due to Ransomware attacks like “WannaCry”, with each hotel losing close to  $17,000. The intention behind a ransomware attack is usually to gain financial profit in return for letting the victim have a ransomware-free system.

Solution:  When it comes to Ransomware attacks, safe surfing is the key. And when it comes to safe surfing, it is to be taken seriously by all parties in focus from the internal staff to the travelers. Mere training does not help as ransomware requires constant practice of caution, hence adequate awareness must be constantly present in the hotel property. Steps like checking the security of the websites visited before providing credentials, pop-up disabling, verifying the security of the applications downloaded in personal devices must be practiced.

3.DDoS

The challenge:  DDoS refers to Distributed Denial of Service attack. DDoS is a prevalent form of attack used across the world in the hospitality industry. It aims at attacking the various internal systems used by a hotel. It is not restricted to just the computer systems or databases present in the property, but any internal system from the automated sprinkler system or cleaning system to the security cameras in the surveillance system. DDoS can gain access to the complete system in the hotel through these access points and crash down the whole system.

Solution:  An intrusion detection system is an immediate solution to block access. An intrusion detection system does a dynamic analysis of all probabilities towards attacks, suspicious activities, and breaches in the internal systems by identifying existing system errors, availability, and confidentiality of data.

4. PoS Attacks

The challenge:  PoS refers to a Point-of-Sales attack. This type of attack poses the highest intensity of threat to the hospitality industry as it attacks the vendor in case, instead of attacking the hotel alone. This majorly occurs due to human error or unidentified weak spots in the systems. Media exposure becomes unavoidable in such attacks as it involves a probable financial loss for customers.

Solution:  Physical security of systems must be taken seriously. All the equipment in the hotel property must be kept updated and networks must be secured with high-level restriction in access. Staff must practice hygienic cyber behaviour. This must reflect in day-to-day routine activities like password sharing, maintaining an orderly work-desk, filing and securing sensitive documents in safe systems, handling customer identification documents.

5. Dark Hotel hacking method

The challenge:  This type of attack was first reported in 2007. Here the attacker targets the networks which can provide access to guest information, like a Wi-Fi network. The hotel server is first hacked with a code that provokes the guest network to download software.

Solution:  Investing in high-quality cyber security software and firewall can prove effective in battling Dark Hotel attacks. A firewall system tracks all hardware and software devices, the traffic levels and identifies malware and viruses.

6. Data and identity theft:

The challenge:  One of the biggest challenges against data theft is protecting customer information. Stealing and spoofing of identity like credit card information, financial information is a prevalent form of cyber-attack.

Solution:  Installing a Biometric system and restricting access. Biometric systems focus on authorization and processes data by storing specific data at the time of usage. Biometric systems use tools like fingerprint recognition, voice recognition, face and retina recognition for identification. This ensures access limitation and protection of the entire system.

Strengthening information security towards cyber resilience

One needs to build a rigid cybersecurity posture on two fronts while combating cybersecurity in the hospitality domain

  • 1. Inherent risks and security risks
  • 2. Financial and Legal risks

Inherent risks and security risks

  1. Attain all the necessary baseline requirements:  Being your best with the basics is always the key. These include implementing security controls for data and services, secure internet and network connections, anti-virus, and malware tools.
  2. Preparedness:  Data breach attempts are inevitable. Too many critical factors and digital entry points and security awareness is too little. We need an adequate incident response. Regular systems audits and checks can help in timely action and corrections in the defenses.
  3. Awareness:  Cyber threatscape is ever-evolving. Hence, we need to be updated on the latest incidents, malware, and a thorough cyber awareness session is to be conducted for all employees. Cyber security is not just the responsibility of the IT department but of every employee dealing with data and information.

Financial and legal risks

  1. Advisory services:  A strong legal department or consultant also helps in gaining knowledge of the legislation in place and improving employees’ awareness.
  2. Insurance:  Insuring against revenue loss and for compensation to be paid can help companies deal with the financial ramifications of successful attacks.

Cyber resilience will ensure the good health of the company. There may come a time in the near future when customers and patrons check the cyber security policy of a company and then choose to be associated with it. Research suggests that cyber security should be made mandatory as a regulation.

Automotive Cybersecurity : Driving Risk Management

Posted on by admin

There is almost no aspect in today’s developed world that does not have technological interference in its design. Dependence on technology is such that it is required in every aspect of our lives and automobiles are no exception. The Automobile industry is one of the first industries which brought software aspects into its design to provide state-of-the-art facilities to people. From being just a mode of transportation from one place to another, they have taken the experience of traveling to another level with the help of technological advancements. But along with the advantages of technologically savvy features comes the risks too. The need for cyber security compliance is high here as the risk associated with each and every code installed into these automobiles is also high.

When it comes to cyber risk in automobiles, it might seem like it is associated with just the vehicle but the actual threat is to the user. This kind of threat is more when the automotive vehicle is an autonomous or connected car.

So how serious are these threats, how important is cyber security for the automobile industry, and what are the quick fixes and long-term solutions to the cyber risk present in evolving automobile technology? Read through to find out…

Role of Cyber security in the automotive industry

As already mentioned, major advancements in the automobile industry have been contributions from the field of technology. According to recent research, the E/E component market in the automobile industry is expected to grow USD 469 billion in the next 10 years. This simply means that the cyber risks associated with this industry are also expected to grow. Let us consider the possible kinds of cyber threats that can arise from these advancements:

  • 1.  Risks associated with connected cars: Tools like Bluetooth and Wi-Fi are major contributors to communication devices and automobiles have adapted to equipping these features. Hackers are on the constant lookout for cloud networks when to gain access to the chain of vehicles connected to cloud networks through these tools. There are various technologies like vehicle to vehicle, vehicle to cloud, etc. for enabling this threat.
  • 2.  Risk associated with autonomous vehicles: Autonomous vehicles need sensors within for functioning and they are dependent on data networks present around them like GPS. Any attack potentially can harm their functioning and lead to accidents. Although these seem straight out of fiction, without proper cyber security they will not be safe to function.
  • 3.  Risks associated with electric vehicles: Electric vehicles need charging stations for consistent functioning. Any cyber-attacks on the charging stations or infrastructure can collapse the vehicle and lead to a power accident. This is a major concern when the cyber security of the vehicle is considered.

Types of Cyber-attacks on vehicles

Now that we are aware of what kinds of vulnerabilities exist in these automobiles, let us know further about how these vulnerabilities are used by hackers to attack:

1.  Direct physical attacks. This type of attack is not possible without physical access to a vehicle. Also, the usage of physical devices like ports or connectors is required for this kind of attack. With the help of such devices, hardware is installed during the repair or renewal process of the vehicle and later the vehicle is controlled by the hacker when the normal usage process is resumed.

2.  Indirect vulnerabilities in a physical attack: This is also a type of physical attack where a device with infected malware is installed into the physical vehicle. An example of this type of attack would be attacked using SD cards, USB devices, or music players.

3.  Threats in a wireless attack: It involves all types of attacks that involve Bluetooth, Wi-Fi, GPS or cellular mechanisms, etc. For this type of attack, no physical access is required.

4.  Attacks using sensor fooling methods: There are ways in which sensors can be taken advantage of. Although these kinds of attacks are not very prevalent, the days are not far from where we will be dealing with these attacks if proper cyber security measures are not taken.

Below are the few types of attacks widely prevalent and used by hackers:

DOS- A DOS attack can be used to harm the user of the vehicle. It does not give any external access to the hacker but it makes the internal system of the automotive system fail. Although a hacker cannot intrude into the data or the cloud if the intention of the hacker is to harm the user, a DOS attack surely solves the purpose by making the vehicle collapse through methods like disabling the brake system.

MitM attacks-If the hacker wants to steal data from the server or intrude between the automotive and its server, the MitM attack serves the purpose. Through this type of attack, the hacker can gain access to the server.

Command injection data corruption-This type of attack is very hazardous as it uses software coding as a tool to gain access into the data stored and corrupt it.

Common steps for better cyber security in automobiles

Although cybersecurity measures must be followed all throughout the life cycle of an automotive component, below are few measures that can be followed to aid in better management of risks:

  • 1.  OTA refers to Over-The-Air update. Caution must be kept with interfaces such as OTA, OBD, Ethernet, and Bluetooth, basically all outside the world.
  • 2.  Secure all gateways related to safety and must be kept isolated or separate.
  • 3.  HSM refers to Hardware Security Module. It plays a significant role in delivering security services and is a major step in cyber security measures other than software-related measures.
  • 4.  The requirements prescribed in ISO 21434 must be followed throughout the supply-chain by all the parties across.
  • 5.  Cyber security framework must be followed while developing protocol stacks like  UDS,  SOME/IP,  Flex Ray,  DoIP. These must-have firewalls as an in-built function.
  • 6.  The ECU entry points must be deleted including all the services completely as it is a vulnerability when considered for hackers.

ISO SAE/DIS 21434
The ISO/SAE DIS 21434 is a standard jointly published by the ISO and SAE with the objective of providing a framework to organizations. The ISO 21434 is the standard when it comes to compliance for automotive cybersecurity. The ISO 21434 is for automotive cyber security as to how the ISO 26262 is for functional safety for road vehicles.

Let us get to know this standard concisely:

Cybersecurity Management:  As the name suggests, this deals with the management of cyber security. It defines the aim, scope, objectives of setting the tone for cyber security through various strategies, etc.

Risk Management methods:  Risk assessment is the first step in the risk management framework. Various methods to assess existing risks are explained and an analysis is conducted on existing vulnerabilities.

Concept Phase:  This is the time when goals are redefined according to the extent of various automotive components exposed to risk. This aids in reducing the risks.

Product Development:  This stage refers to hardware, software, and system development and the cyber security framework exclusively to be followed at this stage.

Supporting Processes:  The CLAL is introduced into the activities at this stage. CLAL stands for Cybersecurity Assurance Level. CLAL in the ISO 21434 is the same as ASIL is for the ISO 26262. It is a measure which states how aggressive cybersecurity must be for a particular component.

Compliance process explained

The process of obtaining compliance for ISO 21434 consists of three steps, which are :-

  1. Assessment:  The first step in the compliance process is risk assessment. The status and scope of risk are evaluated and a guideline is provided in a framework to be followed as a format. Before prescribing the guidelines, the compatibility to the evaluated result is thoroughly analyzed.
  2. Implementation:  After assessment comes to the implementation stage. This process includes defining the processes and procedures and roles of all the people involved in the implementation of the framework. This implementation is done keeping the ISO 21434 and its requirements in focus.
  3. Operations:  The final step towards compliance is operations, which is a continuous process. It includes controlling, assessing which would lead finally to the launch of the CSMS.

Web skimmer on the rise amidst the Covid-19 crisis

Posted on by admin

Consumers today have ramped up their online usage and with brick and mortar stores out of reach temporarily, ecommerce has become more of a lifeline. These shifts to digital platforms for payment have widened the playfield for cyber criminals and digital skimming of credit cards is on the rise.

In times of this pandemic, PCI SSC and the US Chamber of Commerce shared guidance and information on protection against digital skimmers. Understanding the evolved threatscape, PCI SSC council shared guidance and information for protecting against the rising online skimming attacks. The following segments outline the key points :

COVID-19 Crisis : Newly evolved threats online

We have seen a drastic rise in the online activity due to the lockdown. With people spending hours on social and ecommerce sites, it has provided widened access for cybercriminals.  There has been an increase in the number of online phishing and scamming incidents with evolved sophistication and volume.

What and Why’s of Digital Skimming

Digital skimmers are online threat players, involved in injecting malicious code (JS sniffers) into legitimate websites to grab payment data. Once the website is infected, the payment card information is skimmed during the transaction without the merchant or consumer being aware.

It is being counted as under the  Magecart  Umberlla, a term popular with cyber professionals and researchers to summarise all the threat groups responsible for online skimming.

“Ecommerce crime spikes whenever there is an event that forces or entices people to perform more online transactions,” Yonathan Klijnsma, Head of Threat Research, RiskIQ

How does Digital Skimming Attacks work ?

Hackers exploit the vulnerable plugins, credential stuffing and undertake phishing and other social engineering techniques to gain access to third party softwares libraries or ecommerce websites to inject the malicious code. Service providers are not aware of the risk they create if they don’t focus on the security and potential threats.

Third party applications and services that are used involve : Live chat function, advertising scripts, customer rating features etc. Since third party functions are more widely used by ecommerce websites, exploit of one function opens doors for multiple websites through mass distribution of malicious Javascript.

Code is executed when a victim submits his payment details during checkout. Cybercriminals involved gather different details as per their target like billing address, names, email, phone number, credit card details, username and password.  The code running logs the data either locally or remotely to a computer controlled by the threat agent.

How severely does this affect small merchants and business ?

Small merchants and service providers do not have sufficient security controls in place and hence at the most risk of these attaches. In times of these crises, small businesses have hassly moved online to remain operational relying on attimes unevaluated technologies. With reduced staff at work and unavailability of large IT infrastructure, they are more susceptible to suck attacks.

It’s evident  from previous Data breach reports that small businesses are  a major chunk of organizations affected by cyber attacks, In the dire time of this pandemic, the sales of COVID-19 domains have increased dramatically which are also used as platforms to launch phishing campaigns and spread malware.

Digital Skimming : Who’s most vulnerable ?

Any e commerce service provider or implementation that doesn’t have sufficient controls in place, provides their platforms as a playfield for digital skimmers. The insecure third party service providers,  and API developers to be used with the website are at a major risk. The hackers keep evolving their attacks and customize their code based on the susceptibility of their target.

The security checks and controls needs to be persistent as the threats are. The Magecard infected stores have been reported to be re-infected in a short while after being assessed. Hence, it is essential that the systems are cleaned and the vulnerabilities are patched or mitigated.

Best practices : How can we remain secure ?

Detection and prevention of these threats are the only ways to remain secure . Few detection methods are as listed below :

Prevention of Digital Skimming :

  • Implement malware protection and keep up to date
  • Restrict access to payment data and supporting environments to only what is necessary and deny all other access by default
  • Ensure responsibilities with third-parties are well understood
  • Use strong authentication for all access to system components

ATM Switch Application Provider with Cybersecurity

Posted on by admin

Over the past years, India’s economy is exponentially growing giving rise to unceasing advancement in the banking industry. Various aspects of banking as such Checking accounts, Savings accounts, Debit and credit cards, Merchant services (credit card processing, reconciliation and reporting, check collection), Treasury services, loans etc are diversifying in a multitude manner. Also, forease of customers and to avoid overcrowding at the banks, there is an outrageous increase in number of ATM’s. According to RBI’s report of September 2019 there are 206,589 ATM’s in all over India including on site and off site as well.

Without any doubt the ATM’s do serve the purpose of enhancing the customer experience but also give rise to complications as such card skimming, ATM jack potting, black box ATM attacks and so on.This brings us to the rising issue of ATM frauds that are being reported consecutively across the country. A recent Economic Times news report stated that as many as 61 ATM frauds have been reported, mostly from Jadavpur area of Kolkata, where fraudsters used two ATM machines of Punjab National Bank to dupe customers. Fraudsters have withdrawn nearly Rs 14 lakh in several transactions made between November 28 and December 4.

Another event to highlight would be selling of payment card data on Joker’s Stash. Over 1.3 million payment card details – 98% of them being Indian banks’ cards were put up for sale. Out of which 550,000 of these cards belonged to one single Indian bank. The data was being sold at $100 per card, and was likely obtained by using skimming devices installed on ATMs and Point of Sales systems.

These concerning issues and the risks associated along with it led RBI to take a counter-active action. The Reserve Bank of India (RBI) on 5 Dec,2019announced that all RBI-regulated entities entering into a contract with third-party automated teller machine (ATM) switch application service providers (ASPs) need to comply with cybersecurity controls prescribed by the central bank.

Since these service providers also have exposure to the payment system landscape and are, therefore, exposed to the associated cyber threats, the RBI decided that certain baseline cybersecurity controls shall be mandated by the regulated entities in their contractual agreements with these service providers.

In view of this, the RBI regulated entities shall make sure that the contract agreement signed between them and third party ATM switch application service provider shall necessarily mandate the third party ATM switch ASP to comply with cybersecurity controls and also provide access to RBI for onsite/off site supervision. A considerable thing to keep in mind would be that the RBI-regulated entities have to amend their contracts at the earliest or at the time of renewal, in any case not later than March 31, 2020.

How to Measure your Enterprise Risk Management

Posted on by admin

One of the most common questions asked in our industry is ‘How can we accurately measure your enterprise risk management effectiveness’?

Heard it too? Well, we are not surprised. It is one of the simplest questions to be asked and let us tell you, there is no simple answer. When you have so many different beams at work within and external to the company that determines the organisation’s goals – how would one plan to measure the success of  enterprise risk management? At the end of the day, does it not depend upon the decisions the company’s management takes? Would such a risk management have a meaningful difference? Here are ways you can measure its effectiveness –

  1. Follow the right metrics:  To understand the success of such a management system, you need to first note down the goals and then look at the right metrics to know if they’re being met. What could an objective be? Well, reducing performance variability to a level which aligns to the company’s reputations and the goals. An even better metric would be to update risk management capabilities continuously in the surrounding business environment. Keep a goal to achieve based to track an ‘early mover’ advantage and then look at the specific implantation to rate success.
  2. How would your business react to an unforeseen event? :  It is one of the most common misses in the industry today. We tend to look at all that is green that we forget a potential risk. In case your company was to lose its biggest revenue source – a strategic perspective applied to operation risks focuses towards the entire value chain. The organisation’s readiness to such an event needs to be checked and focussed on at all times. The success measure would be to navigate through the unexpected loss and the routes to overcome it.
  3. Is ERM integrated in your core processes? :  Unless it is integrated in your business, you’re not going to get great differences. A keen look at the company’s strategy setting, annual planning, budgeting or capital expenditure with ERM would be a must. Not only would it bring in more engagement from the right people, it would also intensify the success parameters and goals.
  4. Identify the risks at the right time:  If your ERM is focussed on noticing the possible risks at the right stage and inform the key stakeholders about it – it would be the right to be followed and implemented. The way to measure success would be to look at the steps taken to rectify or address the risk detected. Early warning systems would use data analytics, stress testing and scenario analysis to monitor risks and assess the impact on performance.
  5. Improving the shareholder value:  The most important goal for the board and rightly so too. A firm with an effective ERM should be able to acknowledge the capabilities and highlight them the right way. In case your company’s reputation grows because of the risk management – you should be able to show higher share valuations.

With these parameters, you should be able to determine if your  enterprise risk management  is effective and driven the right way. If you have been thinking of implementing such a management in your company or even check the effectiveness – we’d be happy to guide and help you achieve your goal.

 

Why Invest In Vulnerability Assessment Penetration

Posted on by admin

When we make a checklist of all the risks that may cause turbulence to our business, we often forget the damage that can be caused by a cyber-attack! Not just that, most companies even ignore the fact that it is a constant investment too – leading to them not improving their security processes each year. The common problem that most companies have is to understand the risks that may be present. How do you do that? With a  vulnerability assessment  of your business!

A test of this kind would show the kind of weaknesses that exist in your company and how they can be exploited. These weaknesses could be because of ignorance, mistakes or just plain lack of attention.

To understand if the internet security is acceptable or stable for usage, a malicious attack is usually self generated or simulated. This is called penetration testing. Either of these methods can be used on a wired or wireless network which the program to penetrate could even be a mobile application. Of course both these testing processes would require a meaningful investment and here is why –

  • Understanding the errors in programming that maybe a possible risk towards cyber attacks.
  • Implementing these standards would secure your IT networks from attacks both internally and externally.
  • Create and implement a methodical approach towards risk management in the company.
  • Keep your entire business logic away from IT networks
  • Indentifying opportunities for ROI on IT security investments
  • Keep your business away from financial or reputational downfalls.

Why would your business be vulnerable?

Wrong programming practices would the first and sole reason and the second reason would be configurations errors of these programming practices. If you have your routers, switches or servers that are not configured right or have gaps in security – it would be extremely for a break into your internal system.

How can a vulnerability assessment help?

With a vulnerability assessment, you would be using a technical approach to find the gaps that lie in your network or software security system. This is completely a process of repeated searches for errors. Upon a single process, you would be able to see the vulnerabilities and the severity level for each of the problems. How would you explore and exploit a vulnerability in your system though?

Penetration testing to assess the damage

Penetration testing  would help you go deeper into the vulnerabilities that were highlighted. You would be sure of the vulnerability and know what damage can be caused to your application or network. Do keep in mind though that this process is very intrusive and can cause a lot of damage to your systems – hence you need to be very cautious and plan it out perfectly.

How do you choose between both?

The answer to this question is quite simple – you need both. You need to analyse the risks that are present first and then figure out the level of damage that can be done with keep such risks at hand. They both go hand in hand towards a more secure system and as per ISO 27001 you need to prevent the exploitations of any technical vulnerabilities that may lie on your system. Simply put, the need of the hour is to have both techniques on your system to ensure there are no gaps.

Cyber Attacks at Cosmos Bank in the India

Posted on by admin

Cosmos Bank Pune main branch server has been hacked.  Hackers carried out transactions worth Rs 94.42 crore in Hong Kong and India. The incident occurred on 11th August’18. An amount of around 78 crores is transferred out of the country via various transactions.

Transaction worth Rs. 2.5 crore was done through National Payments Corporation of India (NCPI) and VISA.

This did not stop here, the server was hacked again on 13thAugust’18 and the amount of Rs.14 crore

through Swift Transaction was transferred to the account of ALM trading limited at Hang Seng Bank in Hong Kong.

A complaint has been registered against ALM Trading Limited and unknown persons in Pune.

Earlier this year, in the month of Feb’18, India’s City Union Bank lost $2m via SWIFT Cyber Attack. In past three years, this was the fourth time that SWIFT has been hacked.

Secure Business from the Cyber Attacks

With the growing number of cyberattacks in the financial sector, many small and large enterprises are getting affected.   Multiple cases where public, private enterprises and even individuals who lost critical data due to the ransomware infection have been reported.

Overall, organizations may adapt the five-step approach mentioned below to safeguard themselves from the cyber security attacks,

PREVENT:Conduct regular monitoring, review of

DETECT:

RESPOND:

INVESTIGATE:

ADAPT:

Chief Technology Officer Troy Leach.