The Epidemic of COVID-19 Phishing Emails Rages On. KnowBe4 customers using their Phish Alert Button (PAB) continue to share an ever-growing variety of emails from bad actors looking to capitalise on the crisis.
There are some rather unusual social engineering schemes. KnowBe4 are offering up a selection of those emails. IT administrators and users can then see for themselves what these scams look like.
The Tried & True
Spoofs of authoritative sources of information continue to be the most common malicious virus-themed emails. The top three spoofed organisations remain:
The CDC (Centers for Disease Control)…
The WHO (World Health Organisation)…
As with the earlier spoofs KnowBe4 reported, all three of these more recent emails lead to credentials phishes. The third (from HR) does take a bit of a novel approach. It instructs recipients to download an attachment billed as an informational poster/flyer for the walls. In reality, the alleged poster/flyer is just a standard credentials phish.
It’s also worth pointing out that the second email above (the WHO spoof) not only spoofs Docusign (a frequent target of malicious spoofs) as well as the World Health Organisation. It is also delivered through Sendgrid. Sendgrid is a well-known email service provider widely used by many companies.
Sadly, this isn’t the first time we’ve seen a malicious email campaign coming via what is almost certainly a compromised Sendgrid account. We also regularly encounter malicious emails phishing for Sendgrid account credentials. Indeed, malicious emails coming through Sendgrid are becoming more and more common. This is becoming a worrisome trend. Given that Sendgrid is likely whitelisted within many organisations, it’s worrying that emails are coming via that service to sail right through firewalls and email filtering straight into users’ inboxes.
The New & Novel
As we repeatedly advise, the bad guys are always innovating. They are always trying new approaches and experimenting with new social engineering schemes. Recently we’ve seen some rather striking and even unusual attempts to trick users into clicking through to malicious content. As we might expect, some of these newer social engineering schemes seem to work better than others.
As is currently being widely reported, malicious actors are now using a Coronavirus/COVID-19 dashboard. This is complete with a live map similar to the real thing built by folks at John Hopkins University. This is to lure users to sites that install malware of one sort or another.
This particular email spoofs HHS (the U.S. Department of Health & Human Services). It dangles a link to that malicious map application in front of users desperate for the latest information on the spread of the virus.
Although governmental agencies and organisations are the preferred targets for spoofing in virus-themed phishing emails, private companies are also targets as well.
In this malicious email the bad guys spoof the well-known health insurance giant Cigna. They hit users with a fake bill for “Coronavirus (COVID-19) insurance coverage.”
One might well wonder whether this is a viable approach. We don’t know at this point. Despite the fact the many users will recognise the improbability of Cigna signing them up for insurance coverage against a pandemic without even bothering to ask, there could well be plenty of freaked-out users who will immediately click that Big Blue Button to find out just what the heck is going on. Some may even find such (fake) news welcome and comforting.
The Utterly Bizarre
And then there is this spoof of Air Canada, which…well, maybe you’d just better take a look for yourself.
Well now. We’ve certainly seen Coronavirus survey emails before , both real and malicious (see KnowBe4’s second blog post from last week). This one, however, is off the charts. The malicious actors behind this spoof either: a) have an unusually warped and evil sense of humour; b) have it in for PR/Marketing at Air Canada (maybe the bad guys lost some frequent flyer points and weren’t too happy about it?); or, c) are just completely clueless and tone deaf.
Whatever the case, we wouldn’t expect many users to fall for this last phish. Then again, there’s one in every crowd.
Good information and education remain the best disinfectants for malicious online schemes trailing in the wake of the Coronavirus itself. Unlike toilet paper, hand sanitisers, and medical masks, good information is not in short supply and not subject to panic buying at your local grocery store.
Our hope is that by letting concerned users actually see the COVID-19-themed phishing emails that the media is widely reporting they can make better, more informed choices about how to navigate the flood of information landing in their inboxes at this stressful moment.
While your users are working from home, they are more likely to be phish-prone. Try this Free Phishing Test to see how vulnerable your business is.
The Coronavirus outbreak has caused a global panic. It has taken its toll on a number of major industries. Gily Netzer from Cymulate examines the impact it has left on the travel industry, supply chain and manufacturing, and on the world economy. She then advises how security testing comes into play. We need to make sure our security is ready.
Coronavirus Creating Worldwide Panic and Business Opportunities for Hackers
Amid the recent Coronavirus epidemic creating pandemonium worldwide, hackers have been exploiting the deadly outbreak to their advantage. They are disguising information about the virus in the form of malicious emails aimed at Japan courtesy of the notorious Emotet gang.
The new campaign distributes Emotet payloads through emails that warn of the Coronavirus infection. Once the attachment is opened, the unsuspecting victim will then be directed to the familiar Office 365 document. As a result, this will then allow the malware to install and infect the devices.
Another malicious email attack borrows the World
Health Organisation as a “trusted source”.
They are trying to dupe victims into installing the AgentTesla Keylogger
via a document attachment. This is in an
attempt to steal both personal and financial information.
Along with new phishing techniques comes other Coronavirus-related scams that have risen in the last couple of days amid the Coronavirus outbreak. One such scam recently circulating in the news was an online masks scam. Sadly this tricked 3,000 people in Hong Kong to purchase the masks but they never received them or heard back from the seller.
Unfortunately the demand for masks has beyond exceeded production, causing a frenzy among concerned people in China and all across the continent. Since February 2020, there have been a reported 7,500 coronavirus-related fraud cases in China totalling over 192 million Yuan or $28 million.
Coronavirus Impact on the Global Supply Chain
Global supply chains have been feeling the impact of the outbreak. Supplies and raw materials are becoming scarce as workers go into quarantine. As a result international businesses are having to rethink their supply chain strategy.
Furthermore, Chinese manufacturers are suffering immense financial setbacks as their PMI dropped to 35.7 in February from 50 in January. This is the lowest it has been since 2004. In addition, production has also come to a halt as more workers remain in quarantine.
Health guidelines and travel restrictions have caused manufacturers and international retailers to shift their methods of transportation. Consequently, they are having to consider alternative routes to move materials and reach customers abroad, potentially costing millions in the process.
Some of the biggest names in the industry have been hit hard too. Titans such as Apple, Starbucks, Nike, Home Depot, and Microsoft – have all begun cutting down on services and staff in China until the Coronavirus epidemic subsides.
The Financial Impact of the Coronavirus
Wall Street has felt the impact of the Coronavirus with substantial losses unseen in over a decade. Many investors have even speculated a global recession. This could potentially be larger than the 2008 financial crisis which cost the U.S. economy trillions of dollars.
Fears of a widespread epidemic have left major market indexes such as
NASDAQ, the S&P 500, FTSE, and the Dow Jones plunging by over 200 points a
week ago down and hitting new record lows since the 2008 recession.
The financial toll may rise even further as investors continue to panic and manufacturers cease production, at least for the foreseeable future.
Coronavirus Impact on Travel
Not since 9/11 and the 2003 SARS outbreak has the travel industry been hit so hard. Cancelled flights and low tourism demand due to the Coronavirus outbreak could cost airlines over $30 billion as companies continue to limit business-related travel.
Companies such as Google and Salesforce have taken safety precautions by suspending non-essential travel. Others have been limiting on-site job interviews and asking employees not to bring any guests until things clear up.
Breach and Attack Simulation Runs Anywhere ….. 24/7.
Quarantined? Don’t stop optimising your security posture.
At a time when human interaction exposes us to infection and the world
faces a global epidemic and slows down, hackers don’t.
They don’t need to be at the office to do their job. At a time like
this, it’s good to know that continuous security testing can be performed
SaaS-based Breach and Attack Simulation can be done independently without the need to set up physical meetings or leave your house, if you are concerned about travelling. Even from the safety of your home, you can test and optimise your company’s network.
With just a few clicks, Cymulate challenges your security
controls by initiating thousands of attack simulations, showing you exactly
where you’re exposed and how to fix it—24/7 regardless of where you are.
Whether you’re working from the comfort of your living room, at a local café,
or even while relaxing on the beach.
Test it for yourself today with a 14-day free trial. Give us a call to hear about this new Breach & Attack Simulation from Cymulate and check how secure your security really is. Contact us here.
As everything is moving to the cloud, Rapid7 explain why modern SIEM is in the cloud and what benefits you can expect from a cloud SIEM.
Modern cloud SIEM solutions enable three new use cases
In the past,
SIEM has been most valuable around:
Correlation: Give me context, and help me investigate alarms triggered by my stack
Compliance: Help me prove that all access is logged, events are being tracked, and file integrity monitoring is in place
These use cases are foundationally valuable. However, getting to a successful deployment with traditional SIEMs requires a huge amount of up-front configuration, tuning, and ongoing maintenance. Historically, security teams had to spend more time tuning detection rules and filtering through the noise. Instead they could have been acting on the outputs and progressing their security posture.
Use case No. 1: Unify data (all of it!) with your cloud SIEM
Our networks now have important log and event sources sprawled across hundreds of log sources, endpoints, cloud services and hosting platforms. As a supporting visual, here’s Rapid7’s data architecture diagram:
Combined with alerts from your monitoring tools and prevention systems, all of this information should be able to flow into your SIEM for reporting and data visualisation. This is where many on-premises SIEM deployments led to challenges. That’s because hardware management, data parsing, and scaling requires continuous grooming and feeding to perform effectively.
Therefore, if you’re considering cloud SIEM, ensure that it has support for your critical data sources such as cloud hosting. Plus check it will actually relieve you from management and maintenance burdens as your business scales. You should be able to start sending data for analytics within minutes of starting a trial or POC. You shouldn’t be waiting for an appliance shipment or professional services.
Be wary of cloud SIEMs that still require on-premises tuning and maintenance.
More native ingestion support for cloud hosting providers (e.g., Azure, AWS, and Google Cloud). Greater support for telemetry gathering from the endpoint. This enables more nuanced detections, investigations, and threat hunting. Endpoint data such as parent/child processes is essential to our MDR SOCs. These data collection and hunt capabilities will become more accessible to security teams of all sizes.
Use case No. 2: Proactive threat detection with your cloud SIEM solutions
Year after year,
the Verizon Data
Breach Investigations Report shows that the same attack vectors
— phishing, malware, and stolen credentials — are being used successfully.
Let’s say you need to detect malware. To identify modern threats, you need
visibility into endpoint telemetry, such as PowerShell logs, which you may be
able to access from your SIEM.
However, to investigate root cause and identify lateral movement, that information alone isn’t enough. Authentication tracking and user behaviour data is also needed to catch account takeover and the use of stolen credentials.
Modern cloud-based SIEMs should not only give you access to this information. They should also apply security analytics to this data to proactively flag compromise. Accurate threat detection is a bold promise. However, as SIEM is the only technology with access to this disparate data, ensure the product has the analytics to expose the behaviours you want to see.
While many SIEM providers claim user behaviour analytics to detect anomalous behaviour, few have out-of-the-box content for known-bad attacker behaviours. Put them to the test by performing attack simulation or POCing around penetration tests.
Use case No. 3: Automate and respond with your cloud SIEM solutions
SIEM exists to give you the information and context you need in order to respond to and contain threats. This may involve booting an asset off the network, killing a process, or disabling a user account. User behaviour analytics (UBA) can reveal the relationships between IP address → asset → user accounts. Consequently, this allows you to make stronger decisions without hours of laborious investigation.
Cloud SIEM allows you to take investigation findings, such as machine-readable threat intelligence, and with security orchestration, automation and response (SOAR), apply that to your prevention and detection defences. By automating mundane and repetitive tasks, you can focus on high-value work such as threat hunting and attack simulation. As a result, you can make proactive changes to strengthen your network based on investigation findings.
Automated workflows will become commonplace. Teams with high alert volumes today are using SOAR for phishing triage, alert enrichment, and to automate communications (e.g., to ticketing systems and ChatOps). This will allow threats that target users, such as phishing or Office 365 brute forcing, to be better defeated at scale.
Rapid7’s approach to SIEM has been cloud-native since its inception as a user behaviour analytics tool in 2013. Part of the Rapid7 Insight Cloud, InsightIDR Cloud SIEM can help you unify, detect, and respond to threats across your environment within hours, not months.
Black Friday attracts crowds, crowds attract scammers, and that means you need to take extra care when shopping online over the Black Friday and Cyber Monday weekend. Check out these Fraud Alert Tips to stay safe online throughout the festive season.
Top 10 Fraud Alert Tips for Black Friday from KnowBe4.
Never click on links in emails. If you want to shop at a site, enter that site address in your browser. There are thousands of fake sites that look almost identical to the real thing. Don’t fall for evil-twin shopping sites.
Don’t open attachments with special offers. It’s a classic scam. The offer should be in the email and you should be able to see it right away.
Watch for malicious ads and popups. Do not click on ads that sound too good to be true, and ignore popups that might propose the “best deal ever”.
Beware of e-skimmers. This is a new one. Do you know that bad guys sometimes skim your credit card at petrol stations or ATMs? Well, there is a new flavour of that, the shopping website you order from might be infected with an “e-skimmer” and they steal your card data when you check out. You can prevent that by using PayPal or Amazon.
Use a credit card to buy stuff online if possible. NEVER use a debit card to make online purchases but use that debit card to take out cash only.
Do not shop over a public Wi-Fi. You simply do not know if it’s secure and who is listening. Only shop using a secure, trusted network. If you have no other way to shop, use a VPN which encrypts your traffic.
Be very careful when you see a free offer during the festive season. There is an explosion of all kinds of survey fraud and gift card scams.
Do not re-use any of your passwords. Instead, use a password manager to create hard-to-break passwords. Re-using any password is literally an invitation to get hacked.
Keep a close eye on your credit card and bank accounts. During this season, unexpected and strange charges might appear which could very well be the first sign your card or even your whole identity has been stolen. If you think you might have been scammed, stay calm and call your credit card company, cancel that card and get a new one.
Be especially suspicious of gift card scams. They can be a perfect Christmas gift, but gift card scams are skyrocketing. Only buy gift cards from trusted sources.
Check out KnowBe4’s security awareness advocate, Javvad Malik’s, insights to Forbes.
So, especially at this time of year, do not let the bad guys exploit your festive spirit and use it against you.
Rapid7 is named a leader, receiving the highest score possible in nine criteria for its InsightVM, vulnerability risk management tool.
Forrester cites 14 key areas buyers should consider when evaluating VRM solutions. Rapid7’s own customers tell us that the following 5 capabilities are especially critical…
5 Capabilities Your Vulnerability Risk Management Solution Needs:
1 Visibility of your complete IT environment
Identify all of your externally-facing, internet-connected assets. In addition include those that may be undiscoverable with other tools. This helps to get a complete view of your risk. InsightVM received the highest possible scores for this capability in the Digital Footprinting criteria.
2 Extensibility & integration
Your VRM solution must enable integration, orchestration, and automation of the tools and processes across your stack. InsightVM also received the highest possible scores for its extensibility and Partner Ecosystem.
3 Reporting for the progress that matters most
Tracking the goals and metrics most relevant and impactful to your team is critical. Similarly it is important to communicate those milestones to peers and leadership. InsightVM is designed to track your progress and drive alignment across the organisation.
4 Simple pricing
Pricing and budgeting should be simple. InsightVM makes this easier with a price per asset model – no fine print needed.
5 Prioritisation for your business
Identify and prioritise risk with complete coverage of your environment and the addition of business criticality to assets. InsightVM also received the highest possible score in the criteria of Vulnerability Enumeration and Risk-Based Prioritisation.
What Else Should You Expect from Your VRM Vendor?
In addition to the key areas covered by the Forrester Wave, we’ve rounded up some additional considerations for vendor selection. Here are some we’ve heard from Rapid7 customers:
A unified security platform
As well as offering our full vulnerability risk management feature set for all InsightVM users, the Rapid7 Insight Cloud supports you across the entire security life cycle. In other words, this covers from prevention to detection and response.
Visibility across the organisation
Identifying and prioritising risk is table stakes, but proving the effectiveness of your program is key. Your solution should help you work in tandem with IT operations. In addition it should also help you communicate how you’ve tangibly reduced risk for your organisation. This should be both within your team and to leadership.
Commitment to service and success
Rapid7 guarantee 99.95% uptime. On the off-chance the system availability drops, only Rapid7 offers up to a 100% service credit of the prorated monthly fee paid. Other vendors cap service credits at a mere 10% or less.
In an exclusive case study from Forrester, Rapid7 customers offer visibility into the ROI of their programs. This features a significant decrease in incidents and spend when switching to Rapid7 from another VRM vendor.
Cloud Security is becoming a top priority. Infrastructure as a Service (IaaS) is now the fastest growing area of the cloud. This is due to the speed, cost and reliability with which organisations can create and deploy applications, according to McAfee’s latest report –‘Cloud Native – Infrastructure as a Service Adoption & Risk Report’.
Unfortunately, the results of their survey show that 99% of IaaS misconfigurations go unnoticed. Similarly it shows that awareness around the most common entry point to new “Cloud-Native Breaches” (CNB) is extremely low.
Securing Data In The Cloud
The surge in adoption of cloud-based technologies and IaaS means many companies are overlooking the need for shared responsibility for the cloud. They are assuming that security is taken care of completely by the cloud provider. Above all companies need to remember that the security of what they put in the cloud, is their responsibility.
Rapid cloud adoption can be putting businesses and their sensitive data at risk. The speed of adoption means companies don’t yet have the correct tools in place nor the required visibility. Therefore, they need to add security tools that are cloud-native, and purpose built for cloud security. This will ensure they secure themselves against new Cloud Native Breaches. Too often security operations are taking a legacy approach to data security. This predates Cloud and often the web. As a result they are inadequate for securing your critical cloud data. We need to work on a more modern approach to security, designed from the ground up in order to protect cloud environments from the start.
Cloud-First Security Strategies
Fortunately in a recent survey by Enterprise Strategy Group (ESG), they reveal that ‘cloud-first’ strategies are becoming more common and they will need to become more so. 58% of respondents say they will have more than 40% of their data stored in the cloud within the next 2 years and 45% said that will include their sensitive data.
According to McAfee, IaaS-based data loss incidents triggered by data loss prevention (DLP) rules have increased by 248 percent year-over-year.
However, despite this, 81 % of
respondents still said their on-premises data security practices are more
mature than those they use to secure their data in the cloud. Worryingly, 50%
said their company had already lost data that they store in the cloud.
On the other hand, if only 1% of misconfigurations are being reported, this means that it is likely that many organisations worldwide are leaking data but are unaware of it. In total, 90% of McAfee’s respondents said they had come across security issues with IaaS. Unfortunately, only 26% said they were equipped to deal with misconfiguration audits. As a result, this lack of visibility into their cloud usage may be contributing to an increased data breach risk. 90% of respondents to the ESG report said they were worried about not having visibility into misconfigured cloud services, server workloads, network security or privileged accounts.
Even in the case of the 1%, it can take longer than 24 hours to correct reported misconfigurations. In some serious cases, it can take over a month to fix them.
IaaS breaches don’t look like a normal malware attack. They use native features of the cloud infrastructure to land an attack. Next they expand to other cloud instances and obtain your sensitive data. The majority of the time they manage to succeed by exploiting configuration errors in the way the cloud environment was initially set up.
Overall security has now become more complicated with the various platforms and 43% of those surveyed by ESG reported that maintaining consistency across the different infrastructures of a hybrid, multi-cloud environment where cloud-native apps are deployed as being the greatest challenge. 43% said that DevSecOps automation is the highest priority for cloud security. This could help address many of these concerns.
Full Visibility of the Risks
In summary what these research results show us is the need for security tools that help us keep up with IaaS-native issues, especially the ability to continuously audit IaaS deployments for initial misconfiguration and configuration drift over time.
Monthly scanning is no longer enough when modern networks change every minute. Rapid7 InsightVM is a tool that can help you with this process. It is built for your move into cloud, virtual, and containerised environments.
InsightVM gives you live visibility into your cloud, containerised, virtual,
and remote infrastructure, so you can confidently understand the risk of your
seen, containers, cloud services, and virtual devices are often spun up and
down without direct involvement from the security team. To avoid creating
unseen gaps in your defences, InsightVM integrates directly with dynamic
infrastructure to give full visibility into the risks posed by these
Liveboards are live dashboards that update as soon as InsightVM gets data,
letting you track your network and risk as it changes. The result? (It’s a
pretty important one.) You can be confident in keeping your network secure as
it expands into the cloud and beyond.
The yearly, independent, KnowBe4 2019 Security Threats and Trends Survey polled 600 organisations worldwide mid-2019. They asked questions on the major security issues they will face in the next 12 to 18 months.
A majority of corporations – 86% – have proactively amplified security initiatives over the last year to combat the increase in cyber security attacks. Nearly 9 out of 10 businesses – 89% – say they’re currently better equipped to deal with security threats than they were in 2018.
However, organisations still face significant challenges when it comes to their security initiatives. Three quarters or 76% of organisations say the biggest and most persistent security threat comes from “the enemy from within” – careless end users. These end users regularly clicks on bad links, placing organisations at higher risk of falling victim to email phishing, ransomware, CEO fraud scams and various forms of malware. And 58% of organisations cite budgetary constraints as an ongoing challenge in upgrading security.
Of the 89% of respondents who say that their firms are more prepared to cope with security threats, 36% say they’re “much better equipped.” However, a 53% majority of those polled more cautiously characterise their companies as “somewhat more prepared,” than they were 12 to 18 months ago. They added the caveat that “we need to do more to secure our environment.” Only a 6% minority believed that their firms were less prepared to deal with security issues in 2019 than they were the same time a year ago.
Cyber Security Threats
KnowBe4’s latest survey results find that enterprises are well aware of the need to fortify security and safeguard data assets and intellectual property in light of various cyber security threats. These include but are not limited to: viruses and malware; sophisticated email phishing and CEO fraud scams—aka Business Email Compromise;— social engineering; password attacks; denial of service attacks; data leaks; open ports on servers and routers; targeted attacks by hackers; corporate espionage; attacks at the network edge; lost and stolen devices; and lack of security on employer and employee-owned bring your own devices (BYOD).
A near unanimous 96% of organisations say that email phishing scams pose the biggest security risk. This is followed by 76% who identify end user carelessness and 70% of respondents who cite social engineering as the biggest security threats facing their firms over the next 12 months (See Exhibit 1). And in a nod to the growing sophistication of the organised hacking community, nearly half or 46% of respondents fear their organisations may fall victim to a targeted attack. This is an increase of 11 percentage points from the 35% of organisations that perceived targeted hacks as a danger in KnowBe4’s 2014 Security Threats and Trends Survey.
Among the other survey highlights:
Despite the well-documented increase in cyber threats, 43% of KnowBe4 survey participants still don’t allocate a significant portion of their IT budgets towards security expenditures (See Exhibit 3). One-third or 30% of respondents don’t have a separate security budget and another 13% say the organisation’s security budget is less than $25,000 annually.
Only 14% of organisations say they’re concerned about insider attacks from internal employees.
Half – 50% – of participating companies report their security and IT staff are overworked. 40% say their organisations will face a shortage of skilled security professionals within the next 12 months.
An 82% majority of respondents say proactive security maintenance (e.g., installing upgrades and patches) is a top priority over the next 12 months. That was followed by 61% of organisations that cite the need to keep pace with the latest security threats. Plus 61% say updating and enforcing computer security policies is major concern for their organisation.
Some 27% of respondents identify their organisations’ inability to identify, quickly respond to and shut down hacks over the next 12 months as a top challenge and source of concern.
Only 18% of organisations calculate the hourly cost of downtime related to security hacks.
A 53% majority allow employees to access the corporate network and data using BYOD. However, only 39% of organisations currently have a plan to respond if a BYOD such as a laptop, tablet or smart phone is hacked, stolen or lost.
The KnowBe4 survey responses also underscore the importance of upgrading security and training internal security and IT administrators as well as end users. Hackers are continually upping their game. As Exhibit 1 below illustrates, organisations must contend with and defend their devices and networks against a wide array of security threats.
Exhibit 1. Organisations say phishing scams, end user carelessness and social engineering are top security threats
Source: KnowBe4 2019
This KnowBe4 2019 Security Threats and Trends Survey presents a comprehensive picture of organisations’ most pressing security issues and challenges over the next 12 to 18 months. It also offers actionable insights, via anecdotal essay comments and first-person interviews with C-level executives as well as IT and security administrators as to how organisations intend to proactively defend their data assets from hackers going forward.
Data and Analysis
The Survey results indicate that the overwhelming majority of organisations and their security and IT departments recognise the increasing danger posed by the growing number of cyber threats. And they are aggressively taking countermeasures to mitigate those threats.
The top three threats that respondents say pose the most danger are: email-based scams (e.g., phishing, ransomware and CEO fraud); end user carelessness and social engineering. This is not surprising because these three issues – along with BYOD and mobility – are inextricably intertwined by the common thread of the “human element.”
The KnowBe4 study delved into organisations’ most pressing security issues and challenges via essay comments and first-person interviews with C-level executives as well as IT and security administrators. Those conversations revealed that organisations of all sizes across a wide range of vertical markets are extremely concerned about budgetary constraints and the dearth of skilled IT administrators and resources necessary to secure their environments at a time when hacks are more targeted and pernicious.
The anecdotal data also suggests that IT and security administrators continue to find themselves caught in the crossfire between C-suite executives and end users. Security and IT departments must convince upper management to allocate the monies and resources to purchase security packages and security awareness training to safeguard their environments. At the same time, IT and security managers must police the organisation’s end users and instil a sense of urgency regarding the importance of being vigilant regarding security practices in the face of everyday threats such as phishing scams, malware, ransomware, sextortion emails and rogue code.
Careless End Users, Lax Security Policies and Tight Budgets Fuel Cyber Crime Success Rates
The increasing frequency and high success rate of email-based cyber attacks have organisations understandably on edge. This trend has been evident in all of KnowBe4’s surveys since 2013. KnowBe4 survey respondents directly attribute the high degree of successful email cyber attacks into their organisations on the willingness of end users – including management – to click on bad links without thinking. Other culprits include weak computer security policies, lax enforcement and a lack of IT budget dedicated to purchasing security devices and software, hiring security professionals and getting security awareness training.
As Exhibit 2 illustrates, the results of KnowBe4’s 2019 Security Threats and Trends Survey show that email-based hacks are among the most prevalent and dreaded of cybercrimes. They are also among the most successful.
Exhibit 2. Email Phishing, CEO Fraud Scams Top Companies’ List of Security Threats
Source: KnowBe4 2019
KnowBe4 survey respondents accept the reality that cyber threats are a fact of computing life in the digital age. They are nonetheless rightfully concerned that they have little knowledge about when and where the next threat will present itself. Most concede that it’s a matter of “when not if” their organisations will get hit.
The network administrator at a mid-sized law firm near Washington, D.C., that has nearly 100 servers, summed up the sentiments of many IT professionals.
“The whens and wheres of cyber attacks are unknowns, and I’m particularly worried about the next attack vector we don’t know about yet,” he says.
KnowBe4 survey participants gave extremely detailed and insightful responses regarding their security safeguards and preparedness. During interviews with KnowBe4 analysts, many security and IT administrators described how they’ve adopted a multi-layered approach that pays particular attention to what they typically regard as the weakest link in the network ecosystem: end users.
An IT staff member at a federal government agency in California that spends $1 million to $4.9 million annually on security says his organisation has developed a thorough security framework with “limited resources, but an unlimited procurement policy.”
Defence in Depth
“We’ve achieved this level of security with an approach that boils down to one overarching principle: Defence-in-Depth, from the network to the endpoint. We have firewalls, both external and internal. In addition, we have SIEMs, including Alienvault, Splunk and Qradar. We’ve deployed multiple anti-malware solutions, including ESET, MalwareBytes, and Cylance, on a number of our servers and endpoints. Plus we use real-time traffic monitoring tools that help us manage the infrastructure, and other tools to monitor data as it travels through the network.
We have spotted ransomware and stopped it in its tracks. In addition, we have MAC-level, 802.1x authentication on switches and APs. Plus, we run virtual environments on thin clients throughout 99% of our agency. Any compromised image gets eliminated from the virtual server and replaced with a fresh image. Each of those endpoints, in turn, run various levels of software-based endpoint protection; you can’t even plug a USB without us knowing about it. Policy wise, we require two-factor authentication to use internal resources.
We restrict access to social media and personal emails during work hours on our domain, but they have access on a separate external network, not connected to the main domain, that they’re free to use at their own risk. But all of this begins with the end user; arguably the most challenging part of securing an environment. Running KnowBe4 campaigns as part of our security framework has given us the ability to assess the risks associated with email attacks and act accordingly. Staff [members] who repeatedly click on emails undergo security awareness training. Thanks to this product [KnowBe4], our last campaign reported the lowest click rate since the start of our campaigns, nipping a notoriously weak link in the bud.”
As Exhibit 3 illustrates below, security budgets remain tight for many organisations. Nearly one-third or 30% of respondents say that their organisations do not have a security budget that is separate from their annual IT capital expenditure budget. Some 13% indicate they allocate less than $25,000 on security spending and 12% spend $25,000 to $50,000 annually on security.
Fifty percent of the organisations polled dedicate less than or up to $50,000 a year to purchase security products, software or security awareness training despite the well-documented rise in all types of cyber attacks and cyber crimes.
Still, this marks an improvement in security spending over KnowBe4’s 2018 Security Awareness Training Deployment Trends Survey, which polled 1,100 organisations. That survey found that 34% of respondents did not have a separate security budget; 16% spent less than $25,000 on security and 13% of respondents allocated $25,000 to $50,000 on annual security spending.
Although the fact that 50% of organisations spend less than or up to $50,000 annually on security products and training, that’s still an improvement over the KnowBe4 2018 survey results that found 64% of organisations spent $50,000 or less every year on security.
Exhibit 3. Security Budgets Tight: 50% of Firms Spend Less than $50K Annually
Source: KnowBe4 2019
Dedicated security spending or budgets are crucial as users detailed in their anecdotal essay comments and first-person interviews because they often make the difference between the IT department’s ability to be proactive versus reactive.
That is the situation for a systems administrator at an SMB financial services firm in the Southeastern U.S., who says his company has no separate security budget.
“Being a small company, sadly most everything we do here is reactive. We have virtually no IT budget. So no, I don’t think we have a good approach to security, other than running manual scans and patching what we can.”
An IT manager at a mid-sized retailer in California who spends less than $25,000 on security says his business is challenged by a lack of security funds.
“Security for our organisation continues to be challenging. A lack of specific skills and training in IT security requires us to rely on partnerships with vendors. We continue to hope they are keeping up their responsibility for keeping the organisation safe. We often think about a more formal relationship with an MSSP.”
The IT manager at an Auckland, New Zealand government enterprise organisation that also has no separate security budget, expressed his concerns. He notes that the lack of funds contributes to his IT staff being overworked; his inability to hire skilled security personnel and inadequate funding for security awareness training.
“We run a three-year cycle of investment to uplift security technologies and have added another staff member to the team in the last nine months. We are in the process of motivating [upper management] to add a third member to the security team. Plus, we understand that we need technology, trained and skilled people, processes and awareness training to ensure that our organisation’s security improves over the next few years. It is a marathon not a sprint; as long as we focus our efforts on the most critical threats first.”
Most survey respondents though, fell in the middle of the spectrum. That is, although they weren’t awash in security funds, they were nonetheless very proactive and believed that their organisations had made progress in the last 12 to 18 months.
Such is the case of a network architect at a K -12 school district in Iowa, who says he’s adopted a straightforward approach to security.
“We are a public school system and have very limited resources and a limited technical staff, so a simple plan works best. We train our users with KnowBe4. This has significantly cut down on users clicking on scam emails. We keep all hardware/software up to date no matter how difficult it becomes. Patching firmware and software is a security requirement, period. The last thing is monitoring using NGFW’s and rule-based monitoring of end user behaviour. This is our simple, easy to follow security process. Like the old saying goes, ‘keep it simple stupid.’”
Users’ Top Priorities: Daily Security and IT Vigilance
The KnowBe4 study results also reinforced the fact that vigilance in daily IT and security operations is crucial, particularly with respect to keeping pace with routine operational management and security tasks.
As Exhibit 4 indicates, security professionals and IT administrators are extremely concerned with the pragmatic issues that most directly impact their end users’ daily computing life and routine. Organisations’ top security priorities in the next 12 months are: performing proactive security upgrades and patches, cited by 83% of respondents; keeping pace with the latest security threats; and updating and enforcing security policies, both of which were cited by 60% of survey participants.
Exhibit 4. Upgrades, Enforcement and Training are Top Security Priorities
Source: KnowBe4 2019
Additionally, over half – 52% – of organisations say implementing security awareness training for IT departments and end users is high on their list of priorities.
4-in-10 organisations say that upgrading intrusion detection and authentication mechanisms is a top priority, followed closely by 37% of respondents who cite vulnerability testing as a key part of their security strategy in the next 12 months. 36% of organisations say that keeping up with technology hacks involving IoT, migrating to the cloud and upgrading security devices like firewalls are priorities.
Another 31% say correctly provisioning devices and applications is a priority and 26% referenced strengthening encryption/encrypting data. All-in-all, these types of tasks comprise much of a security and IT professional’s daily and weekly activities. And like everything security-related, these professionals must stay up to date to keep pace with the ever-evolving threat landscape.
Security Awareness Training
This explains why security awareness training initiatives have assumed a much more prominent and pivotal role in organisations’ security strategies in recent years, with 52% of survey participants saying it’s a priority for them. This is up from the 41% of respondents in KnowBe4’s 2013 survey who cited security awareness training education as crucial for their security operations.
Security awareness training makes sense on many levels. First and foremost, users are and likely will continue to be the weakest links in corporate security defences. Security awareness training also yields tangible results. The return on investment (ROI) is immediate according to the anecdotal data KnowBe4 received in essay comments and first-person customer interviews. Security and IT professionals were unanimous in stating that security awareness training greatly reduced the number of successful email-based cyber attacks like phishing, BEC, CEO fraud and ransomware hacks against their organisations.
The chief information security officer at a large government agency in Mississippi with 100-250 servers that spends $250,000 to $499,999 annually on security, just assumed her role in the last six months. She found that the organisation’s security was reactive and set about changing that by using a multi-faceted strategy.
From Reactive to Proactive
“I’m currently on a fast track to learn the security solutions we have and I’ve also been working on policies and compliance. In addition, I’m implementing an incident response plan and two-factor authentication. I want to take the organisation from reactive to proactive/prevention mode. We use the KnowBe4 security awareness training and it has helped us reduce our threats by 50% in the first year.”
The security administrator at a mid-sized healthcare organisation in the Midwest also takes a proactive approach to security to adhere to regulatory compliance laws and says that security awareness training plays a pivotal role in their security initiatives.
“We’re taking a much more proactive role in security now that our staff has grown, and we have more time to do so. We are subject to HIPAA for some of the data that we house so have always taken security very seriously. Now, we have confidence in our hardware and software regarding security and view employees as the weakest part of our security. We therefore employ KnowBe4 to train them and also send emails regarding current events in the security world. Our policies are ever-changing and evolving as the environment around them changes. Another challenge not listed above is keeping our office culture the same while improving security.”
Toughest Security Challenges: Reining in End Users; Getting More Budget and Hiring Skilled IT and Security Staff
The category of top security challenges in many ways mirrored the biggest security threats facing organisations and their security and IT departments over the next 12 months. Once again, the responses were similar. As Exhibit 5 illustrates below, the top three most challenging security issues in order are: end user carelessness (66%); cost/budget constraints (58%) and overworked security/IT staff (50%).
Interestingly, respondents were not as concerned about less pressing topics such as potential losses or litigation arising from security litigation or data theft (15%); too many entry points into the network (12%); failure to adhere to compliance regulations (11%) weak network edge (5%) and weak physical infrastructure security (5%).
The IT manager at a New Jersey-based mid-sized law firm that has no separate security budget says the paucity of funds places his company at higher risk of attack. He’s particularly worried about the threats posed by email, phishing scams and end user carelessness. The IT manager is also concerned by the potential for the corporate network to get infected when the law firm’s attorneys insert clients’ USB devices into the company’s computers. It took a brush with disaster to get management to loosen the purse strings.
“For years, I’ve been trying to educate management as to the need for user training in the way of cyber security. Money has never been made available and I had been reduced to developing ineffective in-house brochures and emails to address this need. However, that all changed when a user decided to use a third-party application in order to virtually install a program on his laptop to use.
Both the third-party app and the program were not approved by our organisation. Even though the user only had basic rights on his laptop, the application managed to launch a rogue program that corrupted over 60% of his system files. If it weren’t for our malware detection hardware from Carbon Black, our network could have been compromised. As it was, the infection was catalogued before he [the user] reconnected the laptop to the network.
Thus, we were able to isolate the laptop before any further damage was done. The laptop, however, required a complete rebuild. I used this opportunity to once again drive home to management the need to invest in a security awareness program to educate our users. Within 30 days, we purchased KnowBe4 and it is already yielding great results.”
Conclusions and Recommendations
In today’s interconnected digital age, it is imperative that proactive security measures be an integral part of the daily operations. No organisation can completely eliminate security threats and escape the attention of hackers – especially targeted hacks. However, the vigilance and knowledge gained by deploying security awareness training programs can thwart, identify and quickly isolate myriad security issues from social engineering hacks. The latest BEC and CEO frauds, phishing, ransomware and sextortion scams are increasingly sophisticated. They manage to dupe intelligent, experienced users and even government agencies into taking the bait and clicking.
To reiterate, there is no such thing as 100% foolproof security. But multi-layer security defences, bolstered by security awareness training can lessen the number of successful security penetrations and mitigate risk to an acceptable level.
Frequent security training also helps employees to recognise scams and “think before they click,” and potentially avoid an attack. In those instances where malicious/rogue code or other social engineering security threats do manage to gain entry into the network or devices, SAT can assist in early detection and quick removal before the cyber attack can cause serious damage.
The KnowBe4 2019 Security Threats and Trends Survey findings, anecdotal essay responses and first person customer interviews underscore the fact that organisations, security professionals and IT administrators recognise the value of SAT programs and actively deploy them, particularly as the first line of defence against email phishing scams, CEO and BEC frauds and ransomware attacks, that end users routinely and thoughtlessly click on, on a daily basis.
The KnowBe4 2019 Security Threats and Trends Survey polled 600 organisations mid-year 2019.
The independent web-based survey included multiple-choice questions and essay responses. To supplement the survey data, KnowBe4 conducted over one dozen first-person phone and email interviews with security professionals, IT managers and C-level executives. The anecdotal data obtained from these customer interviews validates the survey responses and provides deeper insight around the security and the real-world business issues facing organisations. The subjects covered include topics like budgets and cost constraints, keeping pace with the latest security threats, finding the right products and tools for the business, educating end users and the challenges associated with finding skilled IT and security professionals to staff IT departments.
KnowBe4 did not accept any vendor sponsorship money for the online poll or the subsequent first-person interviews conducted in connection with this project. We also employed authentication and tracking mechanisms during the survey data collection to prevent tampering and to prohibit multiple responses by the same party.
Respondents were culled from 40 vertical market segments. The top five vertical market sectors in order were:
Organisations of all sizes were represented. Some 44% of the participants were from SMB organisations with fewer than 200 employees; 26% came from midsize and smaller organisations with 201 to 500 end users and 30% of survey participants were from large enterprises with 500 to over 10,000 workers. Some 78% of respondents hailed from North America compared with 22% of international respondents. The countries represented by global respondents include: Australia, Belgium, Brazil, Canada, China, Denmark, Egypt, Germany, India, Ireland, Italy, Japan, Mexico, New Zealand, Netherlands, Poland, Spain and South Africa.
During the Gartner Security & Risk Management Summit this week it was reported that 2019 projects should include Incident Response, BEC Scams and Container Security.
This was swiftly followed by the news that a European subsidiary of Toyota lost more than £30 million following a business email compromise (BEC) scam.
BEC or CEO Fraud is a scam in which cyber criminals spoof company email accounts and impersonate executives. They try and fool an employee in accounting or HR into sending money or giving out confidential tax information. With Toyota, it’s almost inconceivable to imagine how so much money can have been involved from one company. Sadly BEC fraud is worth billions and has now overtaken ransomware and data breaches in EMEA cyber insurance claims.
The size of the Toyota scam is alarming in itself. However the consequences will be huge. Others will see how lucrative this type of scam can be. Cyber criminals will be increasing their BEC campaigns and new actors will be attracted into this lucrative field.
Staff Training & Processes
As a result, it’s becoming ever more important that organisations apply security measures to their business practices. They must train staff to ensure they get third party approval for any financial transactions. In addition, new payment procedures must be introduced into the company where several people sign off on a financial transaction.
Unfortunately, junior staff are in a position where they trust
their managers and do as they are instructed. Processes must be put in place
where staff can question the requests from colleagues, managers or even
suppliers and in fact must question them.
a multi-layered cyber security system, IT security tools are not infallible
against human behaviour. Staff must be
trained to be aware of the potential attacks.
These can come in various forms; phone, email, or even social media and
the attackers will find the weakness in any business.
Javvad Malik, security awareness advocate at KnowBe4 advises that BEC is fundamentally based on socially engineering the victim into making the money transfer.
“The first step should be raising awareness amongst staff of these attacks. In particular focus on those who work in finance or have the ability to set up new payments or amend existing ones.”
“Secondly, and perhaps more importantly, procedures need to be in place which prevent one user from being able to authorise or create a new payment. Rather, segregation of duties should be put in place whereby more than one user approval is needed to initiate payment. In addition, established and trusted mechanisms are required through which any requests can be queried.”
AI & DMARC
Other measures can also be put in place. Barracuda, who offer Sentinel advise taking advantage of artificial intelligence. Look for AI that deploys technology that doesn’t simply rely on looking for malicious links or attachments, as attackers are increasingly bypassing these tactics. They also recommend implementing DMARC authentication and reporting into your organisation. This can help stop domain spoofing and brand hijacking. Plus they suggest utilising multi-factor authentication in your organisation. Passwords alone are no longer enough to keep cyber-attackers out.
measures against BEC scams
IC3 provides the following guidelines for employees containing both reactive measures and preventative strategies:
Use secondary channels or two-factor authentication to verify requests for changes in account information.
Ensure the URL in emails is associated with the business it claims to be from.
Be alert to hyperlinks that may contain misspellings of the actual domain name.
Refrain from supplying login credentials or PII in response to any emails.
Monitor their personal financial accounts on a regular basis for irregularities, such as missing deposits.
Keep all software patches on and all systems updated.
Verify the email address used to send emails, especially when using a mobile or handheld device by ensuring the senders’ address email address appears to match who it is coming from.
Ensure the settings the employees’ computer are enabled to allow full email extensions to be viewed.
BEC Fraud is on the increase because these highly lucrative attacks are succeeding and they will continue to attract more groups willing to attempt their methods.
To add to this, KnowBe4 report that your email filters have a 10% failure rate.
Therefore you need a strong human firewall as your last line of defence.
KnowBe4 Recommend Eight Prevention Steps
steps must dovetail closely together as part of an effective prevention
A decade ago, most enterprises could get away with addressing vulnerability management in silos. One team would scan servers and desktop computers on the enterprise network. They would look for misconfigurations in systems and vulnerabilities in commercial software applications. When problems were discovered, they were thrown over the wall for system administrators and operations groups to fix. Application developers were responsible for policing internally-developed applications. Other specialists worried about the susceptibility of employees to social engineering attacks. Rarely was anyone responsible for analysing how different types of vulnerabilities might interact to expose critical data and intellectual property.
That vision of vulnerability management is too inefficient and expensive for today’s enterprise. Computing environments are far more complex. IT and security groups must monitor a much larger attack surface. Infrastructures and applications can change on a daily, even hourly basis. Cyber criminals and hackers have learned how to exploit chains of weaknesses in systems, applications, and people. Therefore, traditional vulnerability management tools and practices are too limited, too siloed, and too slow to keep up with these challenges.
Time To Rethink Vulnerability Management
As a result, security organisations must rethink their vulnerability management programs. They need to monitor dynamic computing environments, respond in minutes, and address weaknesses in people as well as technology.
They also need to monitor complex, dynamic computing environments. Responses are required in minutes or hours when issues are discovered — not days or weeks. They must address weaknesses in people as well as technology. Also, security professionals must be able to think like attackers in order to understand which vulnerabilities pose the greatest risks to the enterprise.
Key Principles Of A Modern Approach
One of the key principles for a modern vulnerability management program and the overarching practice of SecOps is “complete ecosystem visibility.” That means integrating vulnerability assessment scanning solutions with virtual services as well as IaaS platforms and other cloud environments. Similarly security teams should be able to monitor more types of data on more types of endpoints without multiplying the number of agents and assessment solutions they use.
Integrating scanning tools with internal ticketing systems automates the handoff of vulnerability tasks to the IT operations team. As a result they have access to more data, faster, with less chance of losing information. Teams also need to address web application vulnerabilities as rich web applications can be an Achilles heel. Legacy tools are frequently unable to effectively test rich web applications. A modern vulnerability management program needs tools that can address these issues.
Security groups are also often hard-pressed to keep pace with the speed of change of production applications. These can be put into production on a weekly, daily, hourly, or even minute-by-minute basis.
One way to address these challenges is to work towards a DevSecOps approach. The concept is to adopt tools and processes that allow software developers, security staff, and the operations people who manage application deployment to work together. They should integrate security into every phase of the software development life cycle (SDLC).
Above all, with a modern vulnerability management program formed through the SecOps mindset, organisations can:
Step up their game with network scanning to include complete ecosystem visibility,simplified assessment, and automated remediation workflows.
Better address web application vulnerabilities – by analysing more complex applications and by adopting DevSecOps practices. This will help them keep up with applications that can change daily or hourly.
Increase resilience to phishing and other social engineering attacks through education and simulations. As well as mitigating user risks by linking incident detection and response capabilities with vulnerability management.
Assess overall risk using customised risk scoring and pen testing to prioritise vulnerabilities based on their real risk to the specific enterprise.
Evolving towards such a program requires thinking through the value of each area and finding opportunities to integrate the different areas. However the rewards are dramatic, giving security groups the ability to:
Monitor today’s vastly expanded attack surface.
Keep up with quickly changing infrastructure and applications.
Work collaboratively with IT operations and application development groups to identify and remediate vulnerabilities of all kinds, faster.
Reduce the ability of attackers to exploit the largest attack vector in most organisations: the users.
Accurately determine which vulnerabilities pose the greatest risk to the enterprise. To make best use of remediate resources in the short term, and to focus on the most effective defences in over the long term.
Email us for more information and receive Rapid7 ‘s Whitepaper on The Four Pillars of Modern Vulnerability Management – a comprehensive approach to reducing vulnerabilities across your ecosystem.
Today, most organisations are required to follow some type of regulation. Almost all of us need to comply with the Payment Card Industry Data Security Standard (PCI DSS). However, that is often combined with other regulations, such as the new ramifications of GDPR. Even if you are not required by law to comply with any regulations, you may be following an internal risk framework, internal policies & procedures, or an industry best practices framework such as NIST orISO. You may even be applying for a Royal Warrant or taking additional security measures in following Cyber Essentials. Managing compliance for one regulation or framework is time consuming. Having multiple regulations sometimes means you have to create an entire and expensive compliance department.
Most organisations use spreadsheets, documents and collaboration portals, as well as email threats and individual calendars to manage their GRC (Governance, Risk & Compliance) initiatives. This is inefficient, error prone, costly, and a risk in itself.
We all know that
compliance is mainly a matter of “people and processes” and tools come second.
However, old-school GRC offerings require many months of implementation and
high consulting hours to stand up.
New GRC Platform
We are delighted to bring you the new product from KnowBe4, the KCM GRC Platform. It has a simple, intuitive user interface, easy to understand workflows, a short learning curve, and will be fully functional in a matter of days. It was developed to save you the maximum amount of time getting GRC done.
KCM is a
SaaS-based GRC platform that is surprisingly affordable and super easy to use.
Now you can move beyond using spreadsheets and manual processes that are time
consuming and unmanageable. With KCM, you can effectively and efficiently
manage risk and compliance within your organisation and get insight into gaps
within your security program.
The KCM GRC
platform is offered in different packages to meet the needs of all organisations
and is available with the following modules to choose from:
Vendor Risk Management
KnowBe4’s Experts have created prebuilt requirements templates for the most widely used regulations and create new templates as regulations change or are updated. There is no need for you to monitor confusing changes in regulations anymore.In addition, customers can build or import your own templates, using the super easy custom template feature.
Free trials are available so please get in touch to see how KCM could help you – firstname.lastname@example.org.