Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a round-up of the top stories happening now that you need to know.

1. New cybersecurity guidelines for medical devices tackle evolving threats

This week the FDA released recommendations for how medical device manufacturers should maintain the security of internet-connected devices. Read more…

2. Obama Issues Sanctions for Alleged Russian Hacking

In response to the Russian cyber attacks on the US, President Obama expelled 35 Russian intelligence operatives and sanctioned five Russian entities and four individuals for an alleged cyber assault during the 2016 presidential campaign. Read more…

3. Another Massive DDoS Closes Out 2016, But Mirai Not To Blame

As we round out 2016, there was another massive DDoS attack a few days before Christmas, and this one is one of the largest DDoS attacks on record.  What’s new with this attack is that it introduces a new malicious network called Leet Botnet. Read more…

4. Flight booking systems lack basic privacy safeguards, researchers say

This week it came out that researchers find flaws in many major travel booking systems that are lacking a proper way to authenticate air travelers, which makes it easy for hackers to alter flight details or steal sensitive personal data. Read more…

Do You Know Who Actually Owns Your Data in the Cloud?

As stories of breaches continue hitting the headlines, especially targeting cloud stores and user’s data, passwords, credit cards, and email addresses have become the prized target for cyber criminals all over the world.

In a lot of these cases the information was encrypted, as industry standards recommend. This doesn’t mean hashed, but truly encrypted, with keys that means unless a would-be thief also manages to access the key store then your information is safe. Or at least it should be!

However, when we take closer look in to the statement, “then your information is safe,” there are two parts we need to understand. The first is a relatively simple one. Safe from whom? If a thief, then yes. If your keys themselves are secured, then your information should be safe. However, a lot of hacks seem to come from an internal source to where the information is being held, such as from an unhappy employee, an ex employee who was recently let go, or even an employee who has an axe to grind. The disgruntled employee can use inside knowledge to share a virus, share documents with rivals or misuse company and personnel data. If this organization is a cloud store or service provider that also holds and owns your encryption keys, then in any one of these cases your information is far from safe.

For example, there have been many stories about the sharing of celebrity nude photos in the past couple of years that have made individuals and companies wonder about the security of data stored in the cloud and ask such questions as: Is the data encrypted at the server, while in transport? What level of encryption is used and how much authentication is performed? Because another employee could also have access to the keys to the cloud store your information is in, then your data is no longer encrypted. This is not as far-fetched as it may seem. This has been the case for many breaches over the past few years.

The above scenario is about data theft, when an individual or individuals go out to steal data for their own gain. But what about those scenarios when a government or legal authority decides that they need access to your corporate information? This is not necessarily theft, but it can be unwanted access despite being in the public interest. According to the US’s Communications Assistance for Law Enforcement Act (CALEA), a “communications provider” of any size must allow government agencies access to data. The service providers are not told why the data is needed, only that they must comply.

Government should have the right to do this, as this often has secured us all from many security threats. The question here though is one of accountability. If your supplier owns your security, then they are obliged to pass over not just the documents, but also the keys that allow this information to be decrypted. All of this is happening without your corporate knowledge! The issue is not that the government has access; the bigger threat is lack of knowledge about where corporate data is headed. That is why many tech companies are taking a strong stance on what user data they share with the government and it will continue to be heavily debated moving in to 2017. One possible solution would be if you, as an individual, had ownership of your security. Then the government department could come to you directly, giving you the opportunity to directly pass this information across with full knowledge and the accountability that goes with that.

In summary, if you pass your security to a third party, and they own and store your encryption keys, then you have lost control of your information. It is imperative that you own and store these separately from your cloud suppliers. If you do not, then your information can be stolen or subpoenaed without your knowledge.

Breaches Are Booming: Are Industry Cybersecurity Standards Enough?

As we round out 2016, looking back on the year, there was a record-breaking number of cyber-attacks. From attacks on huge companies to global banks and U.S. government breaches, no institution is immune whether public or privately run.

With new hacks happening on an almost daily basis, it is clear we are in a security revolution – one where hacking has evolved from being carried out by novices to organized and professional criminals. The sheer number of different tools to carry out an attack, their complex nature and evolving character have made them difficult for institutions to stay protected. There are some regulations in place like HIPAA, PCI DSS and ISO that offer standards for how to conduct security, and there are also industry best practices that have become accepted as proper procedures; however, these serve more as a guideline and there are still many ways for institutions to respond to their security approach. For example, many have adopted firewalls, encryption, multi-factor authentication, data access controls, and security patches as tools to protect against security attacks, but are these standards enough?

Let’s use some of 2016’s top breaches to take a deeper look.

In the wake of two major breaches, Yahoo has maintained that they have invested in security. “Over the course of our more than 20-year history, Yahoo has focused on and invested in security programs and talent to protect our users,” Yahoo said in a statement to Reuters. “We have invested more than $250 million in security initiatives across the company since 2012.” However, despite the fact they invested in security to protect their users, passwords and user information was still stolen.

Banking systems were hit hard this year. Hackers in 2016 stole equivalent to $31 million from accounts that banks keep at Russia’s central bank and hackers stole $101 million from Bangladesh’s central bank. They gained access to SWIFT and the bank robbers made five transfers out of Bangladesh Bank’s account at the Federal Reserve Bank of New York. Though they tried to steal $951 million, the Feds cut them off before completing their hack.

The banking industry has proposed rules regarding cyber risk management standards that go beyond existing requirements and best practices. They have protocols like firewalls and encryption standards in place as regulations required, yet it is clear hackers are still finding ways to penetrate their networks.

Also take the U.S. presidential election. Governments house a lot of sensitive information and we have all heard recently about the email systems, what can and can’t be sent from different servers and industry standard tools that keep them protected. Nevertheless, the U.S. elections and the DNC systems were hacked this year (and we are still figuing out the details around it months later).

All these breaches have one thing in common – they were all using security best practices that are industry accepted.

Cybersecurity protection efforts have largely fallen on private sector institutions, but many government officials and security experts believe not enough is being done and more standard regulations are needed. The current federal regulations in place don’t specify what cybersecurity measures must be implemented and require only a “reasonable” level of security, which leaves room for interpretation. However, as the number of security breaches and threats continue to rise, it is time we start to take a closer look at the standards we are using and re-evaluate what tools are needed to keep information protected from. Cyber hacks have become more complex and it is time we figure out how to flip the switch on them as well.

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a round-up of the top stories happening now that you need to know.

1. New York Rewriting Cybersecurity Rules After Banker Pushback
   New York’s Department of Financial Services is rethinking its controversial cybersecurity regulation just a weeks before it was to take effect. The department will be publishing revised rules on December 28. Read more….
2. Trump Threaten Electronic Rights, EFF Warns
   Moving into 2017 with a new leader in charge, the Electronic Frontier Foundation is worried that means more surveillance on activities and laws to curtail our electronic rights. As preparation, they are advising the tech sector to use end-to-end encryption for every transaction by default and to scrub logs. Read more…
3. This Android Malware Ties Russian Intelligence To The DNC Hacks
   New updates in the news surrounding belief of Russian influence in the U.S. presidential elections with mounting evidence. It came out this week that security researchers found a link in the Russian military and the DNC hack though a malware used in an Android app used on Ukraine’s military. Read more…
4. ‘Alice’ Malware Loots ATMs
   There is malware out that is designed to empty out cash from ATMs named Alice. It appears Alice has been around since October 2014. Researchers are still trying to figure out more about the malware and the extent of its reach. Stay tuned and read more…
5. Wells Fargo’s Failure to Authenticate Led to Sham Accounts
   More questions are coming up after the fraud scandal at Wells Fargo as points to a bigger problem going on. How were thousands of employees able to open bogus accounts, and in some cases transfer money out of real consumer accounts, all without the consumer being involved? Read more…

Practicing Safe Banking: How to Keep Your Money Better Protected

There’s no denying that today people interact with money in a much different way than even just 10 years ago. Credit cards, mobile phones and the Internet have become the primary tools people use to manage and monitor their finances. Customers have tasted what it’s like to have anywhere, anytime access and the simplicity of checking their account balances, depositing money, paying bills and so on with the click of a button. While this new era of mobile banking brings convenience for customers, it also opens up their accounts to security risks, fraud and personal information.

With customers embracing mobile banking, they may be unknowingly revealing — via the Internet — all their account information, personal information and easy access to all of their financial assets in an unprotected and insecure way when they use their own devices or Internet to handle their money.

Below are several tips people should think about when they are using the Internet or mobile devices to manage their finances.

1. Don’t save personal information, bank account numbers and passwords on your phone or computers. Never click “remember me” when logging into your accounts, regardless of if you’re on a computer website, your phone’s web browser or even your banking app on your phone. By doing so, gives the site or application a cookie that is easily open to misappropriation.
2. Think about where you are banking from. For example, by using public Wi-Fi, it’s rather simple for someone to intercept your data in a man-in-the-middle attack. When accessing your bank account online, it is advisable to use your own Wi-Fi network that is setup with password protection. If you can’t do your banking at home, you can still check your account on the go, just make sure your device is using cellular data instead of Wi-Fi.
3. Be conscious of mobile apps you download. It is important to read the privacy policies and understand what type of personal information an app can access before you click download.
4. Check for encryption on bank websites. Look for a small lock icon somewhere on your browser, and URLs that begin with “https:” This means the site is secured and your data is encrypted.
5. Don’t respond to emails that claim to be from your bank (or any other company) requesting your account details. No bank is ever likely to approach you this way to ask for personal information
6. Make sure your security software is up-to-date, regardless of what if you are using a computer or mobile device. These updates come our for a reason, so they can help reduce the number of security holes in your systems.
7. Use strong passwords for all your accounts. Create passwords that can’t be easily guessed by a human or computer. This typically means a password with 8 or more characters, including letters, numbers and symbols. It is also advisable to use different user IDs and passwords for your financial accounts and for any other sites you use online.
8. Never use any of your Social Security number (or any other sensitive info, like a credit card number) as a password, user ID or personal identification number. This is one of the first things a hacker will try to use to get into your account if they somehow get access to this information.
9. Change your passwords and PIN number frequently. Though this may seem like overkill, changing your login details every couple of months helps you ensure your information stays better protected from hacks and makes you more of a moving target to get.
10. Be careful of what you post on social media. This may sound silly, but by posting personal information about yourself on your social tools can give criminals easy access to find more information about you and use it to their advantage.
11. Be aware when using ATM’s (yes, these still are a thing!) Scammers often target an ATM and place a card reader over the card slot so they can copy your card details. This isn’t as easy with chip cards, but they also can have a camera on the machine to access the details required to skim your card. Always check the slot to make sure it has not been tampered with.
12. Monitor your accounts. Regularly check in on your accounts to ensure all transactions are your own. If you find fraudulent or suspicious activity, immediately report it to your bank and they will put a hold on your card/take measures to secure your account and typically will cover your loss.
13. To take it one step further, set up notification alerts. Many banks offer text or email notifications to alert customers to certain activities on their account.
14. Sign out when you finish with online banking. This may sound easy, but you should always log out of your online banking session rather than let it expire. This will help reduce the chances of your session being hacked. Most banks will log you out automatically after you are idle for a couple of minutes, but logging out is still a good habit to get in to.

2017 Predictions – What’s Ahead?

Every year experts turn to their magic crystal ball and share their thoughts on predictions they have for the upcoming year. Will we see the same trends from 2016 repeat themselves or we will see new ones develop in 2017? Below our experts from BOHH Labs weigh in on the discussion and offer their predictions for what’s ahead next year.

1. People will start to take their own security seriously

Currently, we are seeing companies continuing to ignore security threats and taking a lazy, lip service approach to them. Moving in to 2017, we will see individuals starting to take their security online more seriously and demand that their organizations do so too when housing their data. People will start to realize their data is important and worth a lot of money for them, and they will start to demand that companies take better measures when housing their data and want it to be secure exactly in the way they look after their purses, wallets and tangible possession in the real world. However, only time will tell how companies will respond to this demand from their users.

2. More legislation calls for banks to tighten in-house procedures

In 2017 we will see an increase in government security regulations for banks. Up until now, cybersecurity protection efforts have largely fallen on private sector institutions, but many government officials and security experts believe not enough is being done and more standard regulations are needed, especially for banks. The current federal regulations in place don’t specify what cybersecurity measures must be implemented and require only a “reasonable” level of security, which leaves room for interpretation. However, as the number of security breaches and threats continue to rise, government will start making more concrete standards of regulations banks should have in place to keep their customers’ data safe.

3. We will find out the true state of security flaws in banks

Hacking of banks is booming. As the bank industry continues to be a target to hackers, we will start learning more about the true state of banks’ security flaws. Many banks have failed to adopt many of the industry accepted security standards that are not specifically enforced. Additionally, as banks are moving more operations to the cloud to meet customers’ mobile demands, we will start seeing what security standards they are lacking. For example, are they using two-factor authentication, encryption standards, etc.? As more breaches come out, we will find out just how much prevention measures banks have in place to keep their customers information safe.

4. More security startups will come out of the woodwork

It is quite obvious that cybersecurity has been the most talked about issue for the last couple of years and there is no end sight. As people are looking to ramp up their security strategies, this market is hot to make a lot of money. As such, we will see more and more startups continuing to enter the market to capitalize on these profits and selling “new” and “innovative” solutions. According to the Cybersecurity Market Report from Cybersecurity Ventures, projections show $1 trillion will be spent globally on cybersecurity from 2017-2021. With lots of money still flowing in this market, 2017 will bring even more security startups out of the woodwork trying to outcompete one another for the game-changing solution.

5. Yahoo will be sold in Q3 missing many zeros they were hoping for following the data breaches

Doubts of Verizon purchasing Yahoo have been circulating ever since news of Yahoo’s 2014 hack of 500 million users’ accounts. With a new hack revealed last week on Yahoo compromising 1 billion of its users, we predict Verizon will officially take its offer off the table. And that won’t be the only thing leaving Yahoo – we predict much of their advertising revenues will too. Due to the hacks, we predict Yahoo will move forward with getting bought by someone, but it will include a lot less zeros than Yahoo was looking for.

There you have it, our predictions on the trends for 2017. Let’s see how it all plays out.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a round-up of the top stories happening now that you need to know.

• Yahoo Says 1 Billion User Accounts Were Hacked

Security breach déjà vu for Yahoo. It came out this week that there was another hack on Yahoo in 2013 different from the 2014 hacking of 500 million user accounts. The newly revealed hacking compromised more than 1 billion user accounts. Read more…

• A Ton of Popular Netgear Routers Are Exposed – With No Easy Fix

A new vulnerability was found in eight of Netgear’s most popular routers that has gone unpatched for months. On Tuesday, the company released beta patches for some of the models but is this enough? Read more…

• Wells Fargo’s ‘Living Will’ Plan is Rejected Again by Regulators

For the second time this year, regulators didn’t pass Wells Fargo for a key regulatory test that was created after the 2008 financial crisis. Last April, regulators rejected the “living will” plans proposed by five major banks (including Wells Fargo). Wells Fargo is the only one of the five to fail its re-submission for their disaster-preparedness plan. Read more…

• U.S. Faces Tall Hurdles in Detaining or Deterring Russian Hackers

The insight on Russia’s involvement in the U.S. elections and its hacking efforts to influence the decision continue to be a hot topic this week. However, what do these events say about the future of government cybercrimes? Read more…

• Biggest Tech Failures and Successes of 2016

Great overview article on 2016 technology. It was a rough year for consumer technology, but on the bright side, there were some great improvements in several areas including Wi-Fi, encryption and virtual reality. Read more…

5 Ways to Better Control Your Data in an Online World

According to a new report from the United Nation’s International Telecommunications Union (ITU), 47% of the world’s population is online. However, as the number of internet users increases, so does the number of cyber criminals. It is safe to say that the number one concern of individual users and organizations alike on the online world is cyber safety. Most everything we do daily connects to the Internet. This convenience of being online has become so ingrained in our lives that we have become a bit contradictory in the way we think about the security of our information.

In our physical world, we keep a close eye on our purses, wallets and tangible possessions in the real world, so why don’t we do the same in our digital one? While we password-protect our PCs and apply codes to unlock our mobile phones, we prominently leave sticky notes with the computer passwords above our desks and rush to click “remember me” when logging on to our various accounts. What we forget with living in an online world is that our data, everything from personal to financial, lives online as well and is easily accessible to fall into the wrong hands. The time has come for us to take some responsibility for our data and better behaviors to keep it more secure. Below are some tips on help you get started.

1. Set data permissions:  Learn how to set up permissions on your data to keep others out of it.You ultimately have responsibility for your data. If your bank account is hacked, you may need to prove your password was protected and you did what was necessary to guard against a breach.  You must also be careful of the apps you download and if these apps do require a password, where else have you used the same one? Cognizant of this, we decide to pick a new password and check “Remember Me.”  This makes it easier for us, but doing so gives the site or application a cookie that is open to misappropriation.
2. Less is more: Keep your most sensitive information on the fewest number of different computers or cloud-based tools as possible. Having fewer copies of your most sensitive documents helps keep it more protected. While the cloud provides convenience and ability to access information from multiple devices, are you really going to need to access all your bills, bank accounts, investment statements from anywhere? Disable Remote Desktop (RDP) unless you require these features. Additionally, it is best not to enable remote connections to your PC unless needed at the time. Instead, enable the remote connections when needed, and disable them when you’re finished
3. Be conscious of where you access your data: Online tools and mobile device give us anywhere, anytime accessibility, but far too often, we don’t think too much about where we are accessing our data from. For example, by using public Wi-Fi, it’s rather simple for someone to intercept your data in a man-in-the-middle attack by first setting up a network and naming it “Free Wi-Fi;” Instead of simply connecting on, ask the restaurant or airport staff what the name of their network is. Better yet, learn how to tether your phone and turn it in to your personal hotspot to keep other prying people out.  Also keep in mind when traveling —if you sync your phone to rental car system, did you remember to wipe it before returning the car rather than trusting that the rental company will do it?
4. Do you know your network?: Think about who you share your data with.  Be conscious of who is on your same network and what you share. An email sent to your HR person with personal information can easily be shared whether intentionally or accidentally—we’ve all done reply all when we only meant to reply to the sender.
5. Encrypt your data: Add an extra level of security to your sensitive data. In our mobile world, this will especially help as your data goes back and forth in the cloud. While encrypting files can be a little difficult, it’s like anything else —practice makes perfect, and once it becomes a habit, it is easy.  Better yet, automatic authentication frees us from even thinking about it. Full data encryption solutions encrypt the entire hard drive from the operating system to all applications and data stored on it.  As information is read from the disk, it is decrypted and then any information written to the disk is encrypted in turn.  Without the encryption key, the data stored on the disk remains inaccessible.

While the Internet opens up endless possibilities to make our lives more convenient, it also can bring unwanted attention from others. Hopefully the above tips will help you fight off some of the tricks many cyber criminals use and enable you to take measures to keep your personal data protected.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a round-up of the top stories happening now that you need to know.

• ‘Millions of Dailymotion account details taken’
  More than 85 million users of Dailymotion, the video sharing site, have been hacked. Read more…
• ‘Crime as a Service’ a Top Cyber Threat for 2017
  Steve Durbin of Information Security Forum, an independent, not-for-profit organization cites a growing concern for ‘Crime as a Service’ moving into next year. Read more…
• IBM to use AI to help banks with cybersecurity
  This week, IBM launched its IBM Watson for cybersecurity program in beta to help banks address cybersecurity. The beta program is aiming to solve the lack of accessible information on past cyberattacks. Read more…
• Hacks at Russian central bank have cost 2 billion rubles
  Equivalent to $31 million, hackers stole 2 billion rubles in 2016 from accounts that banks keep at Russia’s central bank. Read more…

5 Ways to Stay Cyber Safe this Holiday Season

We have all heard the stories: People losing money in a cyber scam, a bankcard that has had to be replaced because it has been compromised, and many other ways that simply swiping our cards this holiday season put our finances at risk.

So, with the holidays right around the corner, what does it mean to be cyber safe and how can we all be more careful during this holiday shopping season? Being cyber safe means making sure that you are in control of your bankcards, not just online but also in the bricks and mortar worlds. Debit cards are not just stolen from a cloud!

Here are a few steps to protect yourself while you are out shopping for your near and dear:

1. Make sure that when you purchase online you know the seller. If it is your first purchase from them, check other users feedback. It’s not necessary to get 100%, but two or three bad reviews over poor customer service or non-delivery should raise an alarm.
2. Whenever you use your card online, do so on a secure network. This means that you should never input your card details if you are on a public Wi-Fi connection. These are NOT secure.
3. When withdrawing cash at ATM’s (remember the days when it was used for everything?), security is not just about looking over your shoulder. Scammers often target an ATM and place a card reader over the card slot so that they can copy your card details. This is not as easy with a chip card, but they also can have a camera on the machine to access the details required to skim your card. Always check the slot to make sure it has not been tampered with.
4. Passwords (yawn). Boring maybe. A necessity? Definitely. Also, the biggest hole in your security? Probably. Use different passwords for every site so that when one is hacked and your details are stolen, only that site is compromised, not all of them.
5. Finally, and probably most importantly, remember security first. We use this every day in the real world even without thinking. We do not leave a credit card on a counter (well not often). We also do not go up to a stranger and give them our cards so that they can steal or copy them. We take responsibility for their care and the care of our money. Add this level of care to your Cloud life also. That way you stay in control and can minimize the risk to your information.

Doing these simple tasks can never guarantee your cyber safeness, but they can certainly mitigate the risks and enable you to have a more worry-free and enjoyable holiday season. Happy Shopping!