KnowBe4 – Security Threats & Trends Report – October 2019

Tony MasonSecurity Awareness & Phishing

Executive Summary

The yearly, independent, KnowBe4 2019 Security Threats and Trends Survey polled 600 organisations worldwide mid-2019. They asked questions on the major security issues they will face in the next 12 to 18 months.

A majority of corporations – 86% – have proactively amplified security initiatives over the last year to combat the increase in cyber security attacks. Nearly 9 out of 10 businesses – 89% – say they’re currently better equipped to deal with security threats than they were in 2018.

However, organisations still face significant challenges when it comes to their security initiatives. Three quarters or 76% of organisations say the biggest and most persistent security threat comes from “the enemy from within” – careless end users. These end users regularly clicks on bad links, placing organisations at higher risk of falling victim to email phishing, ransomware, CEO fraud scams and various forms of malware. And 58% of organisations cite budgetary constraints as an ongoing challenge in upgrading security.

Of the 89% of respondents who say that their firms are more prepared to cope with security threats, 36% say they’re “much better equipped.” However, a 53% majority of those polled more cautiously characterise their companies as “somewhat more prepared,” than they were 12 to 18 months ago. They added the caveat that “we need to do more to secure our environment.” Only a 6% minority believed that their firms were less prepared to deal with security issues in 2019 than they were the same time a year ago.

Cyber Security Threats

KnowBe4’s latest survey results find that enterprises are well aware of the need to fortify security and safeguard data assets and intellectual property in light of various cyber security threats. These include but are not limited to: viruses and malware; sophisticated email phishing and CEO fraud scams—aka Business Email Compromise;— social engineering; password attacks; denial of service attacks; data leaks; open ports on servers and routers; targeted attacks by hackers; corporate espionage; attacks at the network edge; lost and stolen devices; and lack of security on employer and employee-owned bring your own devices (BYOD).

A near unanimous 96% of organisations say that email phishing scams pose the biggest security risk. This is followed by 76% who identify end user carelessness and 70% of respondents who cite social engineering as the biggest security threats facing their firms over the next 12 months (See Exhibit 1). And in a nod to the growing sophistication of the organised hacking community, nearly half or 46% of respondents fear their organisations may fall victim to a targeted attack. This is an increase of 11 percentage points from the 35% of organisations that perceived targeted hacks as a danger in KnowBe4’s 2014 Security Threats and Trends Survey.

Among the other survey highlights:

  • Despite the well-documented increase in cyber threats, 43% of KnowBe4 survey participants still don’t allocate a significant portion of their IT budgets towards security expenditures (See Exhibit 3). One-third or 30% of respondents don’t have a separate security budget and another 13% say the organisation’s security budget is less than $25,000 annually.
  • Only 14% of organisations say they’re concerned about insider attacks from internal employees.
  • Half – 50% – of participating companies report their security and IT staff are overworked. 40% say their organisations will face a shortage of skilled security professionals within the next 12 months.
  • An 82% majority of respondents say proactive security maintenance (e.g., installing upgrades and patches) is a top priority over the next 12 months. That was followed by 61% of organisations that cite the need to keep pace with the latest security threats. Plus 61% say updating and enforcing computer security policies is major concern for their organisation.
  • Some 27% of respondents identify their organisations’ inability to identify, quickly respond to and shut down hacks over the next 12 months as a top challenge and source of concern.
  • Only 18% of organisations calculate the hourly cost of downtime related to security hacks.
  • A 53% majority allow employees to access the corporate network and data using BYOD. However, only 39% of organisations currently have a plan to respond if a BYOD such as a laptop, tablet or smart phone is hacked, stolen or lost.

The KnowBe4 survey responses also underscore the importance of upgrading security and training internal security and IT administrators as well as end users. Hackers are continually upping their game. As Exhibit 1 below illustrates, organisations must contend with and defend their devices and networks against a wide array of security threats.

Exhibit 1. Organisations say phishing scams, end user carelessness and social engineering are top security threats

KnowBe4 Security Threats & Trends Report Oct 19

Source: KnowBe4 2019

This KnowBe4 2019 Security Threats and Trends Survey presents a comprehensive picture of organisations’ most pressing security issues and challenges over the next 12 to 18 months. It also offers actionable insights, via anecdotal essay comments and first-person interviews with C-level executives as well as IT and security administrators as to how organisations intend to proactively defend their data assets from hackers going forward.

Data and Analysis

The Survey results indicate that the overwhelming majority of organisations and their security and IT departments recognise the increasing danger posed by the growing number of cyber threats. And they are aggressively taking countermeasures to mitigate those threats.

The top three threats that respondents say pose the most danger are: email-based scams (e.g., phishing, ransomware and CEO fraud); end user carelessness and social engineering. This is not surprising because these three issues – along with BYOD and mobility – are inextricably intertwined by the common thread of the “human element.”

The KnowBe4 study delved into organisations’ most pressing security issues and challenges via essay comments and first-person interviews with C-level executives as well as IT and security administrators. Those conversations revealed that organisations of all sizes across a wide range of vertical markets are extremely concerned about budgetary constraints and the dearth of skilled IT administrators and resources necessary to secure their environments at a time when hacks are more targeted and pernicious.

The anecdotal data also suggests that IT and security administrators continue to find themselves caught in the crossfire between C-suite executives and end users. Security and IT departments must convince upper management to allocate the monies and resources to purchase security packages and security awareness training to safeguard their environments. At the same time, IT and security managers must police the organisation’s end users and instil a sense of urgency regarding the importance of being vigilant regarding security practices in the face of everyday threats such as phishing scams, malware, ransomware, sextortion emails and rogue code.

Careless End Users, Lax Security Policies and Tight Budgets Fuel Cyber Crime Success Rates

The increasing frequency and high success rate of email-based cyber attacks have organisations understandably on edge. This trend has been evident in all of KnowBe4’s surveys since 2013. KnowBe4 survey respondents directly attribute the high degree of successful email cyber attacks into their organisations on the willingness of end users – including management – to click on bad links without thinking. Other culprits include weak computer security policies, lax enforcement and a lack of IT budget dedicated to purchasing security devices and software, hiring security professionals and getting security awareness training.

As Exhibit 2 illustrates, the results of KnowBe4’s 2019 Security Threats and Trends Survey show that email-based hacks are among the most prevalent and dreaded of cybercrimes. They are also among the most successful.

Exhibit 2. Email Phishing, CEO Fraud Scams Top Companies’ List of Security Threats

KnowBe4 Security Threats & Trends Reports - Concerns

Source: KnowBe4 2019

KnowBe4 survey respondents accept the reality that cyber threats are a fact of computing life in the digital age. They are nonetheless rightfully concerned that they have little knowledge about when and where the next threat will present itself. Most concede that it’s a matter of “when not if” their organisations will get hit.

The network administrator at a mid-sized law firm near Washington, D.C., that has nearly 100 servers, summed up the sentiments of many IT professionals.

“The whens and wheres of cyber attacks are unknowns, and I’m particularly worried about the next attack vector we don’t know about yet,” he says.

KnowBe4 survey participants gave extremely detailed and insightful responses regarding their security safeguards and preparedness. During interviews with KnowBe4 analysts, many security and IT administrators described how they’ve adopted a multi-layered approach that pays particular attention to what they typically regard as the weakest link in the network ecosystem: end users.

An IT staff member at a federal government agency in California that spends $1 million to $4.9 million annually on security says his organisation has developed a thorough security framework with “limited resources, but an unlimited procurement policy.”

Defence in Depth

“We’ve achieved this level of security with an approach that boils down to one overarching principle: Defence-in-Depth, from the network to the endpoint. We have firewalls, both external and internal. In addition, we have SIEMs, including Alienvault, Splunk and Qradar. We’ve deployed multiple anti-malware solutions, including ESET, MalwareBytes, and Cylance, on a number of our servers and endpoints. Plus we use real-time traffic monitoring tools that help us manage the infrastructure, and other tools to monitor data as it travels through the network.

We have spotted ransomware and stopped it in its tracks. In addition, we have MAC-level, 802.1x authentication on switches and APs. Plus, we run virtual environments on thin clients throughout 99% of our agency. Any compromised image gets eliminated from the virtual server and replaced with a fresh image. Each of those endpoints, in turn, run various levels of software-based endpoint protection; you can’t even plug a USB without us knowing about it. Policy wise, we require two-factor authentication to use internal resources.

We restrict access to social media and personal emails during work hours on our domain, but they have access on a separate external network, not connected to the main domain, that they’re free to use at their own risk. But all of this begins with the end user; arguably the most challenging part of securing an environment. Running KnowBe4 campaigns as part of our security framework has given us the ability to assess the risks associated with email attacks and act accordingly. Staff [members] who repeatedly click on emails undergo security awareness training. Thanks to this product [KnowBe4], our last campaign reported the lowest click rate since the start of our campaigns, nipping a notoriously weak link in the bud.”

Budgets

As Exhibit 3 illustrates below, security budgets remain tight for many organisations. Nearly one-third or 30% of respondents say that their organisations do not have a security budget that is separate from their annual IT capital expenditure budget. Some 13% indicate they allocate less than $25,000 on security spending and 12% spend $25,000 to $50,000 annually on security.

Fifty percent of the organisations polled dedicate less than or up to $50,000 a year to purchase security products, software or security awareness training despite the well-documented rise in all types of cyber attacks and cyber crimes.

Still, this marks an improvement in security spending over KnowBe4’s 2018 Security Awareness Training Deployment Trends Survey, which polled 1,100 organisations. That survey found that 34% of respondents did not have a separate security budget; 16% spent less than $25,000 on security and 13% of respondents allocated $25,000 to $50,000 on annual security spending.

Although the fact that 50% of organisations spend less than or up to $50,000 annually on security products and training, that’s still an improvement over the KnowBe4 2018 survey results that found 64% of organisations spent $50,000 or less every year on security.

Exhibit 3. Security Budgets Tight: 50% of Firms Spend Less than $50K Annually

KnowBe4 Security Threats & Trends Report - Security Budget

Source: KnowBe4 2019

Dedicated security spending or budgets are crucial as users detailed in their anecdotal essay comments and first-person interviews because they often make the difference between the IT department’s ability to be proactive versus reactive.

That is the situation for a systems administrator at an SMB financial services firm in the Southeastern U.S., who says his company has no separate security budget.

“Being a small company, sadly most everything we do here is reactive. We have virtually no IT budget. So no, I don’t think we have a good approach to security, other than running manual scans and patching what we can.”

An IT manager at a mid-sized retailer in California who spends less than $25,000 on security says his business is challenged by a lack of security funds.

“Security for our organisation continues to be challenging. A lack of specific skills and training in IT security requires us to rely on partnerships with vendors. We continue to hope they are keeping up their responsibility for keeping the organisation safe. We often think about a more formal relationship with an MSSP.”

Limited Resources

The IT manager at an Auckland, New Zealand government enterprise organisation that also has no separate security budget, expressed his concerns. He notes that the lack of funds contributes to his IT staff being overworked; his inability to hire skilled security personnel and inadequate funding for security awareness training.

“We run a three-year cycle of investment to uplift security technologies and have added another staff member to the team in the last nine months. We are in the process of motivating [upper management] to add a third member to the security team. Plus, we understand that we need technology, trained and skilled people, processes and awareness training to ensure that our organisation’s security improves over the next few years. It is a marathon not a sprint; as long as we focus our efforts on the most critical threats first.”

Most survey respondents though, fell in the middle of the spectrum. That is, although they weren’t awash in security funds, they were nonetheless very proactive and believed that their organisations had made progress in the last 12 to 18 months.

Such is the case of a network architect at a K -12 school district in Iowa, who says he’s adopted a straightforward approach to security.

“We are a public school system and have very limited resources and a limited technical staff, so a simple plan works best. We train our users with KnowBe4. This has significantly cut down on users clicking on scam emails. We keep all hardware/software up to date no matter how difficult it becomes. Patching firmware and software is a security requirement, period. The last thing is monitoring using NGFW’s and rule-based monitoring of end user behaviour. This is our simple, easy to follow security process. Like the old saying goes, ‘keep it simple stupid.’”

Users’ Top Priorities: Daily Security and IT Vigilance

The KnowBe4 study results also reinforced the fact that vigilance in daily IT and security operations is crucial, particularly with respect to keeping pace with routine operational management and security tasks.

As Exhibit 4 indicates, security professionals and IT administrators are extremely concerned with the pragmatic issues that most directly impact their end users’ daily computing life and routine. Organisations’ top security priorities in the next 12 months are: performing proactive security upgrades and patches, cited by 83% of respondents; keeping pace with the latest security threats; and updating and enforcing security policies, both of which were cited by 60% of survey participants.

Exhibit 4. Upgrades, Enforcement and Training are Top Security Priorities

KnowBe4 Security Threats & Trends Report - Security Priorities

Source: KnowBe4 2019

Additionally, over half – 52% – of organisations say implementing security awareness training for IT departments and end users is high on their list of priorities.

4-in-10 organisations say that upgrading intrusion detection and authentication mechanisms is a top priority, followed closely by 37% of respondents who cite vulnerability testing as a key part of their security strategy in the next 12 months. 36% of organisations say that keeping up with technology hacks involving IoT, migrating to the cloud and upgrading security devices like firewalls are priorities.

Another 31% say correctly provisioning devices and applications is a priority and 26% referenced strengthening encryption/encrypting data. All-in-all, these types of tasks comprise much of a security and IT professional’s daily and weekly activities. And like everything security-related, these professionals must stay up to date to keep pace with the ever-evolving threat landscape.

Security Awareness Training

This explains why security awareness training initiatives have assumed a much more prominent and pivotal role in organisations’ security strategies in recent years, with 52% of survey participants saying it’s a priority for them. This is up from the 41% of respondents in KnowBe4’s 2013 survey who cited security awareness training education as crucial for their security operations.

Security awareness training makes sense on many levels. First and foremost, users are and likely will continue to be the weakest links in corporate security defences. Security awareness training also yields tangible results. The return on investment (ROI) is immediate according to the anecdotal data KnowBe4 received in essay comments and first-person customer interviews. Security and IT professionals were unanimous in stating that security awareness training greatly reduced the number of successful email-based cyber attacks like phishing, BEC, CEO fraud and ransomware hacks against their organisations.

The chief information security officer at a large government agency in Mississippi with 100-250 servers that spends $250,000 to $499,999 annually on security, just assumed her role in the last six months. She found that the organisation’s security was reactive and set about changing that by using a multi-faceted strategy.

From Reactive to Proactive

“I’m currently on a fast track to learn the security solutions we have and I’ve also been working on policies and compliance. In addition, I’m implementing an incident response plan and two-factor authentication. I want to take the organisation from reactive to proactive/prevention mode. We use the KnowBe4 security awareness training and it has helped us reduce our threats by 50% in the first year.”

The security administrator at a mid-sized healthcare organisation in the Midwest also takes a proactive approach to security to adhere to regulatory compliance laws and says that security awareness training plays a pivotal role in their security initiatives.

“We’re taking a much more proactive role in security now that our staff has grown, and we have more time to do so. We are subject to HIPAA for some of the data that we house so have always taken security very seriously. Now, we have confidence in our hardware and software regarding security and view employees as the weakest part of our security. We therefore employ KnowBe4 to train them and also send emails regarding current events in the security world. Our policies are ever-changing and evolving as the environment around them changes. Another challenge not listed above is keeping our office culture the same while improving security.”

Toughest Security Challenges: Reining in End Users; Getting More Budget and Hiring Skilled IT and Security Staff

The category of top security challenges in many ways mirrored the biggest security threats facing organisations and their security and IT departments over the next 12 months. Once again, the responses were similar. As Exhibit 5 illustrates below, the top three most challenging security issues in order are: end user carelessness (66%); cost/budget constraints (58%) and overworked security/IT staff (50%).

Interestingly, respondents were not as concerned about less pressing topics such as potential losses or litigation arising from security litigation or data theft (15%); too many entry points into the network (12%); failure to adhere to compliance regulations (11%) weak network edge (5%) and weak physical infrastructure security (5%).

Exhibit 5. Toughest Security Challenges: Careless Users, Tight Budgets and Overworked Security/IT Staff

KnowBe4 Security Threats & Trends Report 19 - Top Security Challenges

Source: KnowBe4 2019

The IT manager at a New Jersey-based mid-sized law firm that has no separate security budget says the paucity of funds places his company at higher risk of attack. He’s particularly worried about the threats posed by email, phishing scams and end user carelessness. The IT manager is also concerned by the potential for the corporate network to get infected when the law firm’s attorneys insert clients’ USB devices into the company’s computers. It took a brush with disaster to get management to loosen the purse strings.

“For years, I’ve been trying to educate management as to the need for user training in the way of cyber security. Money has never been made available and I had been reduced to developing ineffective in-house brochures and emails to address this need. However, that all changed when a user decided to use a third-party application in order to virtually install a program on his laptop to use.

Both the third-party app and the program were not approved by our organisation. Even though the user only had basic rights on his laptop, the application managed to launch a rogue program that corrupted over 60% of his system files. If it weren’t for our malware detection hardware from Carbon Black, our network could have been compromised. As it was, the infection was catalogued before he [the user] reconnected the laptop to the network.

Thus, we were able to isolate the laptop before any further damage was done. The laptop, however, required a complete rebuild. I used this opportunity to once again drive home to management the need to invest in a security awareness program to educate our users. Within 30 days, we purchased KnowBe4 and it is already yielding great results.”

Conclusions and Recommendations

In today’s interconnected digital age, it is imperative that proactive security measures be an integral part of the daily operations. No organisation can completely eliminate security threats and escape the attention of hackers – especially targeted hacks. However, the vigilance and knowledge gained by deploying security awareness training programs can thwart, identify and quickly isolate myriad security issues from social engineering hacks. The latest BEC and CEO frauds, phishing, ransomware and sextortion scams are increasingly sophisticated. They manage to dupe intelligent, experienced users and even government agencies into taking the bait and clicking.

To reiterate, there is no such thing as 100% foolproof security. But multi-layer security defences, bolstered by security awareness training can lessen the number of successful security penetrations and mitigate risk to an acceptable level.

Frequent security training also helps employees to recognise scams and “think before they click,” and potentially avoid an attack. In those instances where malicious/rogue code or other social engineering security threats do manage to gain entry into the network or devices, SAT can assist in early detection and quick removal before the cyber attack can cause serious damage.

The KnowBe4 2019 Security Threats and Trends Survey findings, anecdotal essay responses and first person customer interviews underscore the fact that organisations, security professionals and IT administrators recognise the value of SAT programs and actively deploy them, particularly as the first line of defence against email phishing scams, CEO and BEC frauds and ransomware attacks, that end users routinely and thoughtlessly click on, on a daily basis.

Methodology

The KnowBe4 2019 Security Threats and Trends Survey polled 600 organisations mid-year 2019.

The independent web-based survey included multiple-choice questions and essay responses. To supplement the survey data, KnowBe4 conducted over one dozen first-person phone and email interviews with security professionals, IT managers and C-level executives. The anecdotal data obtained from these customer interviews validates the survey responses and provides deeper insight around the security and the real-world business issues facing organisations. The subjects covered include topics like budgets and cost constraints, keeping pace with the latest security threats, finding the right products and tools for the business, educating end users and the challenges associated with finding skilled IT and security professionals to staff IT departments.

KnowBe4 did not accept any vendor sponsorship money for the online poll or the subsequent first-person interviews conducted in connection with this project. We also employed authentication and tracking mechanisms during the survey data collection to prevent tampering and to prohibit multiple responses by the same party.

Respondents were culled from 40 vertical market segments. The top five vertical market sectors in order were:

  • Financial
  • Manufacturing
  • Healthcare
  • IT/Services Provider
  • Non-Profit

Organisations of all sizes were represented. Some 44% of the participants were from SMB organisations with fewer than 200 employees; 26% came from midsize and smaller organisations with 201 to 500 end users and 30% of survey participants were from large enterprises with 500 to over 10,000 workers. Some 78% of respondents hailed from North America compared with 22% of international respondents. The countries represented by global respondents include: Australia, Belgium, Brazil, Canada, China, Denmark, Egypt, Germany, India, Ireland, Italy, Japan, Mexico, New Zealand, Netherlands, Poland, Spain and South Africa.

BEC Scams On The Increase

Tony MasonMicrosoft 365 Security, Security Awareness & Phishing

BEC Scams & CEO Fraud

During the Gartner Security & Risk Management Summit this week it was reported that 2019 projects should include Incident Response, BEC Scams and Container Security.

This was swiftly followed by the news that a European subsidiary of Toyota lost more than £30 million following a business email compromise (BEC) scam. 

BEC or CEO Fraud is a scam in which cyber criminals spoof company email accounts and impersonate executives. They try and fool an employee in accounting or HR into sending money or giving out confidential tax information. With Toyota, it’s almost inconceivable to imagine how so much money can have been involved from one company. Sadly BEC fraud is worth billions and has now overtaken ransomware and data breaches in EMEA cyber insurance claims.

The size of the Toyota scam is alarming in itself. However the consequences will be huge. Others will see how lucrative this type of scam can be. Cyber criminals will be increasing their BEC campaigns and new actors will be attracted into this lucrative field.

Staff Training & Processes

As a result, it’s becoming ever more important that organisations apply security measures to their business practices. They must train staff to ensure they get third party approval for any financial transactions. In addition, new payment procedures must be introduced into the company where several people sign off on a financial transaction.

Unfortunately, junior staff are in a position where they trust their managers and do as they are instructed. Processes must be put in place where staff can question the requests from colleagues, managers or even suppliers and in fact must question them.

Despite a multi-layered cyber security system, IT security tools are not infallible against human behaviour.  Staff must be trained to be aware of the potential attacks.  These can come in various forms; phone, email, or even social media and the attackers will find the weakness in any business.

Javvad Malik, security awareness advocate at KnowBe4 advises that BEC is fundamentally based on socially engineering the victim into making the money transfer.

“The first step should be raising awareness amongst staff of these attacks. In particular focus on those who work in finance or have the ability to set up new payments or amend existing ones.”

“Secondly, and perhaps more importantly, procedures need to be in place which prevent one user from being able to authorise or create a new payment. Rather, segregation of duties should be put in place whereby more than one user approval is needed to initiate payment. In addition, established and trusted mechanisms are required through which any requests can be queried.”

AI & DMARC

Other measures can also be put in place.  Barracuda, who offer Sentinel advise taking advantage of artificial intelligence. Look for AI that deploys technology that doesn’t simply rely on looking for malicious links or attachments, as attackers are increasingly bypassing these tactics. They also recommend implementing DMARC authentication and reporting into your organisation.  This can help stop domain spoofing and brand hijacking. Plus they suggest utilising multi-factor authentication in your organisation.  Passwords alone are no longer enough to keep cyber-attackers out.

Defensive measures against BEC scams

IC3 provides the following guidelines for employees containing both reactive measures and preventative strategies:

  • Use secondary channels or two-factor authentication to verify requests for changes in account information.
  • Ensure the URL in emails is associated with the business it claims to be from.
  • Be alert to hyperlinks that may contain misspellings of the actual domain name.
  • Refrain from supplying login credentials or PII in response to any emails.
  • Monitor their personal financial accounts on a regular basis for irregularities, such as missing deposits.
  • Keep all software patches on and all systems updated.
  • Verify the email address used to send emails, especially when using a mobile or handheld device by ensuring the senders’ address email address appears to match who it is coming from.
  • Ensure the settings the employees’ computer are enabled to allow full email extensions to be viewed.

BEC Fraud is on the increase because these highly lucrative attacks are succeeding and they will continue to attract more groups willing to attempt their methods. 

To add to this, KnowBe4 report that your email filters have a 10% failure rate.

Therefore you need a strong human firewall as your last line of defence.

KnowBe4 Recommend Eight Prevention Steps

Many steps must dovetail closely together as part of an effective prevention program:

  • Identify your high-risk users
  • Institute technical controls
  • Set a security policy
  • Develop standard procedures
  • Cyber-risk planning
  • Training for all users
  • Continuous simulated phishing
  • Stay aware of red flags

For more information see KnowBe4 Security Awareness Training

Traditional Vision Of Vulnerability Management Is Outdated

Tony MasonVulnerability Management & SIEM

Vulnerability Management
Vulnerability Management

A decade ago, most enterprises could get away with addressing vulnerability management in silos. One team would scan servers and desktop computers on the enterprise network. They would look for misconfigurations in systems and vulnerabilities in commercial software applications. When problems were discovered, they were thrown over the wall for system administrators and operations groups to fix. Application developers were responsible for policing internally-developed applications. Other specialists worried about the susceptibility of employees to social engineering attacks. Rarely was anyone responsible for analysing how different types of vulnerabilities might interact to expose critical data and intellectual property.

That vision of vulnerability management is too inefficient and expensive for today’s enterprise. Computing environ­ments are far more complex. IT and security groups must monitor a much larger attack surface. Infrastructures and applications can change on a daily, even hourly basis. Cyber criminals and hackers have learned how to exploit chains of weaknesses in systems, applications, and people. Therefore, traditional vulnerability management tools and practices are too limited, too siloed, and too slow to keep up with these challenges.

Time To Rethink Vulnerability Management

As a result, security organisations must rethink their vulnerability management programs. They need to monitor dynamic computing environments, respond in minutes, and address weaknesses in people as well as technology.

They also need to monitor complex, dynamic computing environments. Responses are required in minutes or hours when issues are discovered — not days or weeks. They must address weaknesses in people as well as technology. Also, security professionals must be able to think like attackers in order to understand which vulnerabilities pose the greatest risks to the enterprise.

Key Principles Of A Modern Approach

One of the key principles for a modern vulnerability management program and the overarching practice of SecOps is “complete ecosystem visibility.” That means integrating vulnerability assessment scanning solutions with virtual services as well as IaaS platforms and other cloud environments. Similarly security teams should be able to monitor more types of data on more types of endpoints without multiplying the number of agents and assessment solutions they use.

Integrating scanning tools with internal ticketing systems automates the handoff of vulnerability tasks to the IT operations team. As a result they have access to more data, faster, with less chance of losing information.  Teams also need to address web application vulnerabilities as rich web applications can be an Achilles heel.  Legacy tools are frequently unable to effectively test rich web applications. A modern vulnerability management program needs tools that can address these issues.

Security groups are also often hard-pressed to keep pace with the speed of change of production applications. These can be put into production on a weekly, daily, hourly, or even minute-by-minute basis.

One way to address these challenges is to work towards a DevSecOps approach. The concept is to adopt tools and processes that allow software developers, security staff, and the operations people who manage application deployment to work together. They should integrate security into every phase of the software development life cycle (SDLC).

Benefits

Above all, with a modern vulnerability management program formed through the SecOps mindset, organisations can:

  • Step up their game with network scanning to include complete ecosystem visibility, simplified assessment, and automated remediation workflows.
  • Better address web application vulnerabilities – by analysing more complex applications and by adopting DevSecOps practices. This will help them keep up with applications that can change daily or hourly.
  • Increase resilience to phishing and other social engineering attacks through education and simulations. As well as mitigating user risks by linking incident detection and response capabilities with vulnerability management.
  • Assess overall risk using customised risk scoring and pen testing to prioritise vulnerabilities based on their real risk to the specific enterprise.

Evolving towards such a program requires thinking through the value of each area and finding opportunities to integrate the different areas. However the rewards are dramatic, giving security groups the ability to:

  • Monitor today’s vastly expanded attack surface.
  • Keep up with quickly changing infrastructure and applications.
  • Work collaboratively with IT operations and application development groups to identify and remediate vulnerabilities of all kinds, faster.
  • Reduce the ability of attackers to exploit the largest attack vector in most organisations: the users.
  • Accurately determine which vulnerabilities pose the greatest risk to the enterprise. To make best use of remediate resources in the short term, and to focus on the most effective defences in over the long term.

Email us for more information and receive Rapid7 ‘s Whitepaper on The Four Pillars of Modern Vulnerability Management – a  comprehensive approach to reducing vulnerabilities across your ecosystem.

sales@s3-uk.com

www.s3-uk.com/vulnerability-management-siem

Are Your Compliance, Risk & Audit Projects Taking Too Much Of Your Time.

Tony MasonCompliance - GRC (Governance, Risk & Compliance)

GRC Compliance Management

Today, most organisations are required to follow some type of regulation.  Almost all of us need to comply with the Payment Card Industry Data Security Standard (PCI DSS). However, that is often combined with other regulations, such as the new ramifications of GDPR. Even if you are not required by law to comply with any regulations, you may be following an internal risk framework, internal policies & procedures, or an industry best practices framework such as NIST or ISO. You may even be applying for a Royal Warrant or taking additional security measures in following Cyber Essentials. Managing compliance for one regulation or framework is time consuming. Having multiple regulations sometimes means you have to create an entire and expensive compliance department.

Compliance Management

Most organisations use spreadsheets, documents and collaboration portals, as well as email threats and individual calendars to manage their GRC (Governance, Risk & Compliance) initiatives. This is inefficient, error prone, costly, and a risk in itself. 

We all know that compliance is mainly a matter of “people and processes” and tools come second. However, old-school GRC offerings require many months of implementation and high consulting hours to stand up.

New GRC Platform

We are delighted to bring you the new product from KnowBe4, the KCM GRC Platform. It has a simple, intuitive user interface, easy to understand workflows, a short learning curve, and will be fully functional in a matter of days.  It was developed to save you the maximum amount of time getting GRC done.

KCM is a SaaS-based GRC platform that is surprisingly affordable and super easy to use. Now you can move beyond using spreadsheets and manual processes that are time consuming and unmanageable. With KCM, you can effectively and efficiently manage risk and compliance within your organisation and get insight into gaps within your security program.

The KCM GRC platform is offered in different packages to meet the needs of all organisations and is available with the following modules to choose from:

  • Compliance Management
  • Policy Management
  • Risk Management
  • Vendor Risk Management

KnowBe4’s Experts have created prebuilt requirements templates for the most widely used regulations and create new templates as regulations change or are updated. There is no need for you to monitor confusing changes in regulations anymore.  In addition, customers can build or import your own templates, using the super easy custom template feature.

Free trials are available so please get in touch to see how KCM could help you – sales@s3-uk.com.

See how you can get audits done in half the time at half the cost with KCM.

World Password Day

Tony MasonData Protection, Security Awareness & Phishing

World Password Day

World Password Day

Today is World Password Day which is a great occasion to be briefing our staff on the dangers of reusing passwords.

The National Cyber Security Centre (NCSC) have reported on the most commonly used passwords found that have been accessed by third parties in global cyber breaches.  Their breach analysis showed 23.2 million victim accounts worldwide used 123456 as a password. They have also listed the most used names, premier league football teams and even musicians and fictional characters.

A recent study in the UK by OnePoll found users manage an average of 14 online accounts (eg, emails, banking, bills, shopping, entertainment, etc.). They then have to remember around nine different passwords across these.  No wonder two in five (38%) users forget their passwords at least once a month.

Why weak passwords are a danger to your business

Reusing passwords is still a major risk for individuals and companies.  The NCSC report  has collated  a list of 100,000 most commonly re-occurring passwords that have been accessed by third parties in global cyber breaches.  The compromised passwords were obtained from global breaches that are already in the public domain having been sold or shared by hackers.

The list was created after breached usernames and passwords were collected and published on Have I Been Pwned by international web security expert Troy Hunt. The website Have I Been Pwned allows people to check if they have an account that has been compromised in a data breach.

The report shows that even being more creative with your password still runs the risk of a breach; ‘oreocookie’ was still seen over 3000 times.

Attackers use lists like these when attempting a cyber breach.  This can help them breach a perimeter or move within a less well defended network.

How password blacklists can help your users to make sensible password choices

Using this NCSC list can help users create safer passwords but don’t use it in isolation. However, for a start, if you see a password that you use on this list, you should immediately change it.

IT managers can now use this list to check whether their users have a weak password and can help them create new, safer passwords.  Recognising the passwords that are most likely to result in a successful account takeover is an important first step in IT security.

Password Guidance

  • Update your password policies
    • The NCSC give guidance on what to include to help users choose good passwords
    • Ensure employees can’t use known bad passwords
  • Use password blacklists
    • NIST recommend using password blacklists, such as this NCSC list or Have I Been Pwnd to ensure users don’t pick a password that is commonly found in data breaches. Then add these into your authentication flow
  • Use Password Managers
  • Choose a good, strong password
    • Choosing a password is hard. The NCSC urges using 3 random words to create a password. They also advise creating a hard-to-guess password, particularly to secure important data, such as personal or banking details.  Choose something creative & memorable to you but something others cannot guess (not your first name, football team or favourite band).
  • Choose different passwords for different accounts, especially your email account or financial accounts with sensitive data
    • 25% of employees use the same password for all logins
  • Use a modern approach to authentication (including multi-factor authentication)
  • Make your staff aware of how attackers use passwords obtained from beaches to make it relevant & ensure users adopt a good password policy

Read More at National Cyber Security Centre.

See how vulnerable you are. Find out now which users are using hacked passwords

Try KnowBe4’s free tool: New Breached Password Test (BPT) to see which of your users are currently using passwords that are in the publicly available breaches associated with your domain. BPT checks against your Active Directory and reports compromised passwords in use right now so you can take action immediately.

40% of Organisations Not Doing Enough to Protect Office 365 Data.

Tony MasonData Protection, Microsoft 365 Security

Microsoft Office 365 Security

Office 365 Data Security.

Companies could be putting themselves at risk by relying exclusively on Office 365 Data Security, according to Barracuda.

Barracuda’s latest report found that 40% of IT organisations surveyed don’t use third-party backup tools to protect Office 365 data. The report questioned more than 1,000 IT professionals, business executives, and backup administrators.

They explain why it is a big risk to ignore third party data back up tools and just trust Office 365 to deliver all the back up you need. This is particularly important as the amount of data being lost remains high. As we are using more devices and getting our data from more places each year, it becomes harder to ensure our data is secure.

Why Use Third Party Back Up?

Barracuda’s Director of Data Protection Platform Strategy, Greg Arnette, explains.  While Microsoft does offer a resilient SaaS infrastructure to guarantee availability, it doesn’t secure data for historical restoration for long.  Plus, its service-level agreements don’t ensure against user error, malicious intent, or other activity that can destroy data.

“Microsoft will protect your data for an outage in a data centre environment, but they will not detect threats such as account takeovers and ransomware. Those kind of attacks will look like the actions of a typical end user. The backup vendors are now doing more detection using cloud-based APIs to keep track of what changes over time.”

The report explains deleted emails are not backed up on Office 365 in the traditional sense. Instead, they are placed in a recycle bin for up to 93 days before being completely deleted forever. For SharePoint and OneDrive, deleted data is held for a maximum of 14 days by Microsoft.  Plus you need to open a support ticket to retrieve it. SharePoint and OneDrive can’t even retrieve single items/files; they have to restore an entire instance. It’s actually doubtful that these short term retention policies would even meet most of today’s compliance requirements.

Cloud Back Up

Many think that if data is in Saas, then it will automatically be backed up.  However this isn’t the case. Just because it is ‘held in the cloud’, doesn’t mean that it will be backed up.

The Barracuda report also discovered that while 64% of companies worldwide state that they back up data to the cloud, 36% still don’t. Although the report didn’t show clearly why this was, it is likely that there are still major security concerns over storing in the Cloud.  This is despite the benefits of being able to retrieve everything if hit by a disaster such as fire or flood.

Companies need to realise that they are responsible for their data: protecting, archiving and being able to recover it, especially email.

See the whole story at Dark Reading.

Barracuda Essentials offers all-in-one Cloud Based Email Security, Backup, Archiving & eDiscovery for Office 365.

Take a look here for more information.

Ensure you are backed up. The alternative isn’t worth thinking about.

 

 

Phishing Attacks Now More Common Than Malware

Tony MasonSecurity Awareness & Phishing

Phishing Attacks

Phishing Attacks More Common Than Malware

The latest annual Microsoft Security Intelligence Report (SIR) has just been issued and indicates that phishing attacks are now by far the most frequent cyber threat.  Since their last report, phishing attacks have increased 250%.

Microsoft’s security team are in a great position to analyse trends in cyber security threats.  Their figures are based on their internal scans of O365 email addresses and their latest report is based on over 470 billion messages.  The results show that not only are the phishing attacks more often, but in a short space of time have become significantly sophisticated.

Technology is getting better at detecting phishing attacks, with machine learning improvements automatically blocking phishing emails.  However, unfortunately, phishing continues to be a threat due to the human nature of it.  Cyber criminals focus on human fear, panic, brand trust, or ignorance.  They continue to use this method of attack due to the success they have with it.

The Rise of Phishing Attacks

The report shows that not only are phishing attacks increasing, but they are becoming the criminals’ preferred attack method.  Attackers are often able to convincingly impersonate users and domains.  They bait victims with fake cloud storage links, engage in social engineering and create attachments that look similar to those commonly used in the organisation.

As we reported last week on Ransomware-as-a-service, cyber hacking services are now available to any aspiring cyber criminal in an ‘out-of-the-box’ format. Phishing attacks are also now available in kit form.  These Phishing Kits clone popular websites and operate from temporary servers.  They can be purchased from the Dark Web at reasonable prices.

Avoiding Phishing

On analysing the SIR, KnowBe4 note that simple diligence can defeat just about all the phishing attacks listed.

Most phishing messages succeed through social engineering tactics, leveraging blind trust, impulsiveness and lack of awareness. Proper organisation-wide security awareness training that focuses on recognising common phishing attacks and request response policies can drive down the phish-prone percentage of users dramatically.

Vendor Supply Chain

Both Microsoft and KnowBe4 also highlight that while companies must train their staff and internal users, they must also ensure that their vendors are doing the same.  Supply chain attacks are another new area of focus for cyber criminals. These attacks tend to deliver malware that installs crypto-currency coin miners. Therefore, any outside vendor with access to your systems is a potential point of compromise.

The best defence is a layered approach to security that involves employee training & collaboration with digital supply chain partners.

See the whole story here.

Ransomware-as-a-Service

Tony MasonData Protection, Endpoint Security, Enterprise Security, Security Awareness & Phishing

Ransomware-as-a-Service available on the Dark Web

The Dark Web and Ransomware-as-a-Service

This month our partner, Vipre, reported on Ransomware-as-a-Service and the impacts this could have on the industry.  Jason Norton advised, ‘Ransomware is a form of malware that encrypts, or locks a user out of and away from their critical data. Typically, the attacker demands monetary payment in exchange for a decryption key that promises to unlock the hijacked data’.

Reports this week are claiming that more companies are paying the demands, as their insurance companies are paying the bill.   This definitely makes for a lucrative market for potential cyber criminals to focus on. However, this may not result in you getting your data back.

Ransomware-as-a-Service

Jason explains how Ransomware-as-a-Service (RaaS) is slightly different to normal ransomware. ‘Unlike traditional ransomware, RaaS doesn’t require the attacker to be necessarily skilled at writing computer code to launch attacks. That is because the RaaS delivery model is similar to a monthly subscription service. This type of affiliate program creates a win-win situation for both the malware author and the subscription buyer. There is usually some type of profit sharing or split between the two parties which is normally agreed upon up front. In the end, the only loser is the victim who pays the demanded monetary ransom in the hope of safely getting their valuable data back’.

For a monthly subscription fee, cyber criminals can provide access to easy-to-use malware and ransomware, packaged for immediate distribution to the buyer. These RaaS packages are found and sold on the Dark Web.

The interesting & most concerning point Jason makes about the advent of RaaS is that it removes a large barrier to bad actors’ entry into this field.

To become a hacker, you used to need to have the ability to code. With this new RaaS service, that need has now been taken away.  The problem that creates is, there is no guarantee you will get your data back.  There used to be an unwritten rule in the world of ransomware that once you had paid the ransom, you would receive your data back.  Sadly, the new hackers using RaaS don’t have the skill set to retrieve this for you.

Additionally, the volume of attacks may rise as it becomes easier for new entrants to come in to the market.  Jason relates this to pyramid selling schemes, where, in this instance, the ransomware authors stand to make a lot of money by maximising the number of hackers using their service.

Key ways to counter Ransomware

  • Use a Next-Gen Endpoint Security Solution, such as Vipre
  • Train Your Users: using simulated phishing of latest scams, together with engaging & interactive training, such as KnowBe4
  • Regularly Back Up Your Data

 

Check here for Vipre’s full report.

Phishers Shift Efforts To Attack SaaS and Webmail Services

Tony MasonSecurity Awareness & Phishing

A new report out today provides us with some good news and some bad for the beginning of 2019. According to Help Net Security ‘the good news is that the total number of conventional, spam-based phishing campaigns declined as 2018 came to a close.  The bad news is that users of software-as-a-service (SaaS) systems and webmail services are being increasingly targeted.’

APWG have just issued their Q4 2018 Phishing Activity Trends Report and it shows the number of confirmed phishing sites declined towards the end of 2018.  They report 138,328 in Q4,versus 151,014 in Q3, 233,040 in Q2, and 263,538 in Q1. Although, overall phishing sites grew 220% over the course of the year and phishing attacks increased 36%.

Phishing Sites

This new decline in the number of phishing campaigns may have been down to anti-phishing efforts. It may also be because criminals are moving to more specialised and lucrative forms of e-crime than pure mass-market phishing.  However, there is also a growing concern that the decline may actually be down to the fact they are going undetected. It is suggested that techniques are becoming ever more sophisticated.  Detection and documentation of some phishing URLs has been complicated by phishers obfuscating phishing URLs with techniques such as Web-spider deflection schemes. Also attackers are creating multiple redirects in spam-based phishing campaigns.  They take users (and automated detectors) from an email, through multiple URLs on multiple domains before finally depositing the potential victim at the actual phishing site.

New Preferred Targets

Phishing targeting SaaS and Webmail services increased from 20.1% of all attacks in Q3 to almost 30% in Q4. Attacks against cloud storage and file hosting sites continued to decrease, falling from 11.3% of all attacks in Q1 2018 to only 4% in Q4 2018.

 

Phishing Attacks Hosted on HTTPS & SSL

 

Phishing Attacks Hosted on HTTPS

Interestingly, researchers at APWG member Phish Labs noted that in Q4 2018, the number of phishing attacks hosted on websites that have HTTPS and SSL certificates declined for the first time in history. However, 47% of phishing attacks are still hosted on sites that use digital certificates to make attacks look legitimate, fooling users into thinking they are secure, and to avoid any browser warnings.

So whatever the shift in trends, we still need to remain vigilant and aware of the developments and increased sophistication of the attackers at large.

Black Friday Scam

Tony MasonSecurity Awareness & PhishingLeave a Comment

Black Friday Scam

Black Friday & Cyber Monday Scam

Black Friday & Cyber Monday Scams

This week sees the return of the phenomena of Black Friday and Cyber Monday. These marketing events are significantly driving up the increase in online sales in the run up to Christmas.  2017’s Cyber Monday was the largest online shopping day in history and was mobile’s first $2 billion day.

This weekend has become an unbridled online spending extravaganza, but threat actors have taken notice. It’s Holiday Season for these bad guys too, but not the way you might think. They go into scam-overdrive mode.

Black Friday and Cyber Monday are the busiest on-line shopping days and they are out to get rich with your money

With their latest report, the team at RiskIQ summarised it well:

“Ever the opportunists, threat actors set up their operations where the money is; and in the case of the Black Friday and Cyber Monday phenomena, it’s e-commerce. According to Adobe Digital Index, in 2017, online shoppers stuffed e-commerce cash registers with more than $19.6 billion in sales through the Black Friday weekend—a more than 15 percent increase over 2016.

“With more people than ever poised to partake in this year’s November shopping frenzy, attackers will capitalise by using the brand names of leading e-tailers to exploit users looking for Black Friday deals and coupons by creating fake mobile apps and landing pages to fool consumers into downloading malware, using compromised sites, or giving up their login credentials and credit card information.”

Sales this weekend are forecast to be up 19.4% on last year with $7.8 billion expected in e-commerce on Cyber Monday.

What starts out as a search for Christmas presents at bargain prices can turn into a financial nightmare. For brands, what starts as a marketing campaign to boost sales can turn into a security fiasco that not only affects them financially but can destroy trust with their customers.

This year, Magecart, which is made up of several groups of digital credit card-skimming actors with ties to Russia, adds a serious new layer of threat. They are responsible for large-scale breaches that stole thousands of customer credit cards.  Only put your details in a secure shopping portal, not on sites for coupons and competitions and be restrictive with your personal data.

It’s worth sending an email to staff over this weekend and the Christmas season reminding them to be vigilant.  It is crucial to pay attention to detail while shopping online.

So what to look out for?  At the moment, there are literally thousands of fake sites, looking just like the real thing. Don’t fall for it.

Key Things to Consider:

  1. Make sure the site you go to is the real one, including subsequent link addresses.
  2. Type in the address or use your bookmark.
  3. Do not click on links in emails with special offers.
  4. Be aware of permissions the site is requesting, is it relevant to what’s required?
  5. Watch out for alerts via email or text that you just received a package from FedEx, UPS or DPD, and then asks you for some personal information.  Don’t enter anything.
  6. Don’t download fake mobile apps that promise big shopping savings.
  7. Be very wary of online discount coupons. Don’t input your details unless you trust the site’s official web address & be restrictive with your data.
  8. Ensure the site is ‘https’, security protected.
  9. Only use Credit Cards online, instead of Debit Cards & if possible, only use credit card information saved in your online shopping account to avoid being intercepted by Magecart.

Think Before You Click! 

KnowBe4 Security Awareness Training