Why Is BOHH Labs The Data Security Standout?

BOHH Labs is a company that believes security is paramount to success, but at the same time we think it should not get in the way of data access. After all, while data protection is invaluable to companies and users alike, it also serves no benefit to keep it protected if it is not accessible for anyone. Let’s be honest, users want to know their data is secure without worrying where it is coming from or impacting their usability and convenience. If they have issues accessing their data or the process means jumping through hoops to get to it, users are going to find a different way of getting it, and this is what opens the door to big security threats like we have seen weekly over the last several years.

We believe that it’s critical for us as technologists to look at what security tools are put in place currently and ask ourselves if we are doing it right and providing enough trust and security to enable organizations to allow their customers to use that data correctly. If we don’t put security in place, we are all going to lose our data.

That’s why at BOHH, our security solution is built on making data security a priority by taking the approach to weave the access to data with security from the start. What makes our approach unique is that we ensure a secure transport of data between all users, applications, and the end database services by validating access at each stage of the journey. Our process separates out every request from the requestor, and then using a combination of patented security IP of unique keyless end-to-end encryption, Artificial Intelligence (AI) technology, Natural Language Processing (NLP), and In-Memory Distributed Blockchain Ledger technology, the request gets checked at all points of vulnerability: the request, processing and backend data stores. This means every data request must be validated at each of these three points before moving forward, and data only interacts with the BOHH secure server, removing direct access to the backend system so anyone coming on to the system is not able to hack their way through.

This process enables our core focus to be on protecting the data itself, so this allows BOHH to protect data no matter where it is being stored, accessed or transacted from, such as on on-premise databases, cloud platforms, IoT devices, mobile services and more.

Not only does our technology solution protect data at the foundation level, but our AI and NLP technologies also give users the ability to securely, quickly, and easily convert real-world conversations into computer commands with voice-controlled access to the data needed in real-time. This enables BOHH to offer instant access to complex data, no matter where it is stored or accessed from, while making sure it is accessed through a secure process.

Data is increasingly a critical part of businesses and consumers’ lives; thus, it’s essential to protect it without hindering the ability to actually use it. At BOHH, we will continue to make data access and security of it a priority, and empower enterprise and users to securely interact with it, without opening them up to massive, widespread, and malicious security threats.

That is why BOHH Labs is the data security standout. If you would like more information on our adaptive security solution, then please visit  https://bohh.io/ or reach out to us at info@bohh.io.

End Users: Data Protection Is Your Responsibility Too

- Becca Bauer, Director of Marketing & PR at BOHH Labs

In a recent post we addressed how it is time for enterprises to take data security seriously and view it as a legal responsibility to their users and customers. While enterprises who interact with user data must have accountability and responsibility on how its protected, this is not a one-way street.

As an end user, you do have some control over security of your data, and more importantly, you should exert that control over both your data and within your relationship with your cloud provider. What does this mean?

On a corporate level, this means not allowing a cloud provider to hold encryption keys. If you pass your security to a third party, and they own and store your encryption keys, then you have lost control of your information. For example, let’s say an unhappy employee, an ex-employee who was recently sacked, or an employee who has an axe to grind uses inside knowledge to share a virus, share documents with rivals, or misuse company and personnel data. If this organization is a cloud store or service provider that also holds and owns your encryption keys, then in any one of these cases your information is far from safe.

While these scenarios may seem far-fetched, many breaches have occurred this way. As such, it is imperative that you own and store these separately from your cloud suppliers. If you do not, then your information can be stolen or even subpoenaed without your knowledge.

On a personal level, end user accountability means being careful about what information is placed in a cloud store or social media network, or about how you behave regarding services that interact with sensitive data, such as online banking or e-commerce.

The truth is not all enterprises and cloud services are the same, so you should not assume they all have the same stance and protocols on protecting your data. It is important to treat each company and/or service you share your information with on a case-by-case basis, especially depending on the sensitivity of the data.

There are many ways for users to take control of keeping their data better protected:

• Set data permissions: You ultimately have responsibility for your data. If your bank account is hacked, you may need to prove your password was protected and you did what was necessary to guard against a breach.  You must also be careful of the apps you download and if these apps do require a password, where else have you used the same one? Cognizant of this, we decide to pick a new password and check “Remember Me.”  This makes it easier for us but doing so gives the site or application a cookie that is open to misappropriation. 
• Less is more: Keep your most sensitive information on the fewest number of different computers or cloud-based tools as possible.  Having fewer copies of your most sensitive documents helps keep it more protected. While the cloud provides convenience and ability to access information from multiple devices, are you really going to need to access all your bills, bank accounts, investment statements from anywhere? Disable Remote Desktop (RDP) unless you require these features. Additionally, it is best not to enable remote connections to your PC unless needed at the time. Instead, enable the remote connections when needed, and disable them when you're finished.
• Be conscious of where you access your data: Online tools and mobile device give us anywhere, anytime accessibility, but far too often, we don’t think too much about where we are accessing our data from. For example, by using public Wi-Fi, it's rather simple for someone to intercept your data in a man-in-the-middle attack by first setting up a network and naming it "Free Wi-Fi;" Instead of simply connecting on, ask the restaurant or airport staff what the name of their network is. Better yet, learn how to tether your phone and turn it in to your personal hotspot to keep other prying people out.  Also keep in mind when traveling —if you sync your phone to rental car system, did you remember to wipe it before returning the car rather than trusting that the rental company will do it? 

What we forget with living in an online world is that our data, everything from personal to financial, lives online and we often hand it off to others without a second thought. As our world becomes increasingly mobile, is it time to re-evaluate the value our data holds and start taking accountability for the care of it, like we do of our physical things, and not just rely on the organizations we hand it off to to keep it protected.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Tesla investigates claims of crypto-currency hack

Tesla has confirmed that its cloud computing platform has been compromised by hackers. RedLock, the company that alerted it to the breach, believes the attackers may have done this to mine crypto-currency - an attack known as crypto-jacking. Read more…

Exposed Amazon cloud storage clients get tip-off alerts

Security researchers have posted "friendly warnings" to users of Amazon's cloud data storage service whose private content has been made public, the BBC has learned. The BBC found almost 50 warnings posted to the firm's servers. Many had more than one warning uploaded to them. Read more…

New email scam targeting accounts personnel at Fortune 500 companies

Criminals impersonate legitimate email accounts to initiate wire transfer fraud. Security researchers have uncovered an active Business Email Compromise (BEC) campaign targeting Accounts Payable personnel at Fortune 500. Read more…

Criminals Obtain Code-Signing Certificates Using Stolen Corporate IDs

The certificates are available on demand at prices ranging from $299 to $1,599, says Recorded Future. Malware authors have for some time been using code-signing certificates for their malicious payloads so they can sneak past enterprise anti-malware tools. Read more…

Why All Applications Should be Created as if They Were Security Applications

Before I go in to detail on this subject, let me make some statements clear:

1. I do not believe that organizations should stop purchasing specific security applications, CASB's, Firewalls, VPN's etc.
2. I believe that security is multi-faceted and that organizations must take different and layered approaches to protect their data and systems. 
3. I am not the devil in carnet. (Although this has yet to be proven outright!)

This has to be said up front, as I just spoke at a conference and addressed this subject and inevitably people told me how wrong I was and that an application's job should be to do what it says on the tin. This then leads on to them accusing me of not taking security seriously. (Not the case).

But while we are on it, let me also add in here that I am not a great lover of the current rush to use external libraries - API's into other applications yes, but not external libraries that we as developers have no insight into and no definitive way to make sure that they are programmed correctly and in a secure manner. Oh yes, there is Open Source. This does have a place, but the licensing can be restrictive on organizations, and also it not immune to massive security errors.

So here go my thoughts on it:

Systems are inundated with bad actors every hour of the day - all 24 of them and every single day of our seven-day week. We have had the current security practices for over a decade now, and while they have definitely worked in some cases, there are other well documented ones where they have blatantly not. This alone tells me that we need to re-evaluate how we are protecting our systems and data. One of these places must be within the applications that are used. If I create an application that connects and retrieves data from a database in a data center far far away, is it not incumbent on me to make sure that:

1. I check for SQL Injection Attacks
2. I make sure that there are ZERO login credentials held in plain text that my application uses.
• This means, no scripts
• No uncompiled code
• No ini files
• No conf files and
• No txt file

Or, to put it another way, there is no mechanism for a bad actor to read a file that held on the system and take from it details that will compromise the data.

I do not see this as being controversial or special, just good practice!

In addition to the basic points above, I also believe that the software developers job is to:
Create an application that does what it says on the tin, making it as simple to use as possible, while maintaining security to a degree that makes it incredibly hard for any non-authorized actor to access anything that the application has been designed for, without, compromising the usability.

And then this last point is vital. As soon as usability is compromised, the users will find a work around and then security is forgotten about, as a user’s primary role is to complete the task at hand, and they will just assume security.

This leads me nicely on to my next rant. Security of data is down to us as technologists. We are the ones who should know how to secure up a database. A bank's role is to secure my money and make it available for me. My role is to make all the transactions in between secure. I have more knowledge than they do on that, and I hope they have more knowledge than I on the markets, so they and in turn I do not go broke!

These are all great words and statements, but in practice how does a developer create an application that does what it is designed to and separately keeps the data secure?

This is where I lose the few friends I have within the industry, but here it goes:

When programming, STOP relying on external libraries that you have zero insight into. Programming is an art form. We create an application from a blank screen, it appears before us. I have never heard anyone say, "Wow Simon that painting by numbers book you have completed has really made a difference and it is truly unique." I am not saying that all libraries are bad, of course they are not, but let us not rely on them. Start looking within and creating your own. This allows you to know they are written as securely as they can be, and that you have full control of the source code. Otherwise, how do you know that your application is secure? The library may have security flaws in It, or worse, it may be calling out sending usage and other data to the publisher. Security starts from the basis of 'I do not trust you.'

Then there is the programming itself. I am not the world's best. I create an application, a library for our applications or a routine to go in to one of our applications, and that then goes to the engineering department who scrutinize, scream, fix and generally work on my code. Once they are complete, it comes back to me for review where I invariantly will have a lot of changes and once more send it to engineering. This process goes on until we are happy. Then a code review happens with myself, my CTO and our chief developer. We look at the code and check for security holes. Once this is done we go to Beta. During the whole process, we are continuously testing and pushing the code to its limits and in some cases sending it out for review and testing.

To sum up. I see my job as a technologist to help with security and make sure that the applications I have control of can be a part of an organizations security defenses, no matter what the application is designed to do.

BOHH Labs CEO to Address Secure Innovation at SAP Startup Focus Fintech Event in New York

This week our CEO Simon Bain will serve as a panel expert for the SAP Startup Focus Fintechs & Banking: 2018 Beyond event in New York, February 21, 2018. Simon will share insights on how to accelerate the financial services market without sacrificing security.

He will join Falk Rieker, SAP, GVP, Global Head of IBU Banking and Mayank Mishra, Citi Treasury and Trade Solutions, Managing Director, Global Head Channel Services on the panel to address how to help financial services players keep pace with innovation transforming the industry.

The SAP Startup Focus Fintechs & Banking: 2018 Beyond event brings together top technology experts to address how enterprises and startups can collaborate to address the future state of the fintech market. The event highlights the increased disruption the financial services industry has seen – from banking to payments and wealth management, and how conventional financial services players can embrace these new opportunities.

Simon will leverage his experience working with Abbey National (Santander) on its online banking platform, as well as other banks including Co-operative where he helped them with the SWIFT banking schema, to share secure, yet user-friendly solutions to accelerate innovation. He will also touch on BOHH Labs’ unique approach to data security that ensures the secure transport of data between all users, applications, and the end database services, and how it can be combined with new technology services being embraced by the fintech industry without opening them up to massive, widespread, and malicious security threats.

The best part? There is still time for you to register and attend the event. For a free ticket to attend and to learn more, visit: https://www.eventbrite.com/e/fintechs-banking-2018-and-beyond-tickets-42102247957.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Equifax breach worsens, additional consumer data exposed

The Equifax breach compromised even more consumer data, including tax identification numbers, than originally reported. But the credit rating agency didn't disclose the update. Read more…

FedEx customer information exposed in data breach

An unsecured FedEx server was breached, exposing thousands of customers' personal information, a prominent security research firm discovered earlier this month. An unsecured Amazon S3 server was holding more than 100,000 scanned documents including passports, drivers licenses, and security IDs. Read more…

Criminals Hide 'Billions' in Cryptocurrency, Europol Warns

The value of a bitcoin has fallen from a high of around $20,000 last December, hovering on Thursday around the $10,000 mark. But despite bitcoin's volatility, cryptocurrencies remain a valuable tool for money laundering, law enforcement agencies warn. Read more…

Banks preparing for heightened New York cybersecurity laws to take effect

This week, senior executives from more than 3,000 banks, insurers and other financial services companies doing business in New York will have to personally certify that their computer networks are protected by a cybersecurity program appropriate for their organization’s risk profile. Read more…

Listen Up Enterprises: Data Security Isn’t a Priority, It’s YOUR Legal Responsibility

Today, hacking and data breaches, where groups or individuals have forced their way into an organization’s computer systems and stolen user information from these systems, are a daily standard. Let’s not get in to the rights or wrongs of those hacking these systems, as some could make a case that they are doing it to show a lack of importance given to the security of information. Whatever the reasons, hacking and the stealing of private individuals’ and corporate information happens – even expected now – and most organizations still seem to have a laissez-faire attitude to it.

Cybersecurity protection efforts have largely fallen on private sector institutions, but many government officials and security experts believe not enough is being done and more standard and legal regulations are needed. To be fair, there are some regulations in place like HIPAA, PCI DSS, and ISO that offer standards for organizations to understand how to conduct security, and there are also industry best practices that have become accepted as proper procedures; however, many of the current federal regulations don’t specify what cybersecurity measures must be implemented and require only a “reasonable” level of security, which leaves room for interpretation and loopholes for companies to rely upon. 

This is unsustainable. The information that is taken is often personal information: email addresses, telephone numbers, physical addresses, login details, and so on. This is all information that should never be available on a web server, a web server connected database, or on any computer that has a web connection. This is all information that is highly sensitive and often can’t even have a maximum monetary value put on it; nevertheless, when a breach happens, most organizations simply downplay the impact to those affected or merely offer an apology and say they will “evaluate” their current policies and then simply move on to business as normal. This lack of respect for confidential information highlights how deeply the security industry is broken.

Let’s just look at the fallout from the 2017 Equifax breach that affected over 145 million customers. It has been more than half a year since the breach was first revealed, and the company has been under legal investigation for months now, yet just a mere week ago more details on the depth of the breach came out. The company revealed that attackers may have also stolen very sensitive information including tax identification numbers, additional driver’s license and credit card details, in addition to phone numbers and email addresses. This is all highly personal information that hackers can leverage to impersonate people, yet Equifax has not been forthcoming with details and tried to cover up how deep the breach went. Yes, the company has already incurred financial loss from the breach and will most likely receive a large fine, but this has not seemed to deter them from trying to downplay the situation even today.

This is unacceptable. When will enterprises start taking data security seriously?

More industry push is coming to create better legal parameters for how vendors protect customer data such as the GDPR regulations. These are a first step to bring more responsibility to enterprises, but despite almost a two-year transition period, research suggests that a majority of companies are still not ready for enforceable compliance starting in late May 2018. More importantly, this is a European law that is merely affecting many US companies, not a US law looking to hold US companies responsible for their data security policies.

When you think about the value of the information customers and users are submitting to organizations that is highly sought after by hackers to capitalize on and sell to the black market, it surely is not too much to ask that organizations have a responsibility in protecting this data. After all, customers are generally paying organizations for a service or product. Shouldn’t part of that payment be for the safe keeping of their information? As the number of security breaches and threats continue to rise, it is time vendors start taking data protection more seriously and viewing it as a legal responsibility, not just a suggested industry policy or even a priority. Enterprises must take a closer look at the security protocols they are using, how and where they store data, and re-evaluate what tools are needed to keep user information protected from hackers ready to access and steal their information and use it how they wish.

BOHH Breakdown Part 22: Inside Cryptojacking - What Is It and Why It's So Popular

In our last post, we talked about the hot topic of cryptocurrency and how to better protect your investments. This week we will continue the cryptocurrency topic and take a closer look at one type of attack – cryptojacking (what it is and why it is becoming so popular).

To understand the concept of cryptojacking, we first must address how it’s possible. Cryptocurrencies such as the popular Bitcoin and Ethereum are not created by a central bank like regular money, but are instead created or mined by distributed computing resources solving complex equations. This means a big cost of mining new coins is electricity. As such, cryptojacking has become popular to avoid this issue and involves passing the electricity cost off of mining to an unsuspecting user. It works by slipping a mining component without the knowledge of users on to devices or websites and harvesting power off of those to steal cryptocurrency digital cash.

What are the methods?

The most popular methods to carry out a cryptojacking attack include in-browser cryptojacking where a JavaScript code lives in the browser. When a user visits a page where the JavaScript code is already embedded, it is then activated in the background and consuming resources without the user knowing; The other is server access to install a attack. This is where an attacker finds and exploits an existing vulnerability and deploys a full-scale cryptocurrency miner on a system.

Why Is This a Cybersecurity Risk?

What makes cryptojacking so tricky is that you’re paying for electricity and stress on your hardware without realizing it, without approving it. Because it’s clandestine, you don’t know whether cryptojacking stops when you leave the website or whether they’ve placed a cookie that will carry on once you’ve navigated away.

While there is no immediate way to tell if a website page you are using or device has a hidden mining component on it, there are some ad blockers and website plugins coming out. However, if you want to keep yourself fully protected, the best way to prevent it at the moment is pulling the plug on your network and turning off your computer. The risk is yours!

Today was the last BOHH Breakdown, but not the last blog. We will continue our blogging on a weekly basis and will have a diverse set of thought pieces coming from our team of experts. Thank you for coming back each week to read our BOHH Breakdown and we look forward to continuing to deliver interesting thought pieces for our readers.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Over 19 Million Californian Voter Records Held for Ransom Again

A database containing the voter records of over 19.5 million Californians was exposed to the public internet before being locked down and held for ransom by cyber-criminals, just months after a similar incident, according to reports. Read more…

Cisco: Severe bug in our security appliances is now under attack

Cisco's Adaptive Security Appliance (ASA) flaw with a CVSS score of 10 is now being exploited by attacks. Cisco has updated its advisory for vulnerability CVE-2018-0101 for the second time since warning customers of the critical flaw on January 29. The bug affects its ASA and Firepower security appliances. Read more…

New POS Malware Steals Data via DNS Traffic

Researchers have discovered new point-of-sale (POS) malware disguised as a LogMeIn service pack that is designed to steal data from the magnetic stripe on the back of payment cards. Read more…

Bitcoin's Reign on the Dark Web May Be Waning
For online scams and schemes, bitcoin changed the landscape. It became possible to obtain quick and secure payment in virtual currency for extortion schemes without touching conventional banking systems or wire transfer services. But, it may be losing its rein. As wider use of Litecoin, Monero and Dash signals a cryptocurrency shift. Read more…

BOHH Breakdown Part 21: How to Better Protect your Cryptocurrency Investments

In our last post, we addressed how to support digital innovations without sacrificing security. Today, we are talking about the hot topic of cryptocurrency and how to better protect your investments.

Many of the major cryptocurrency exchanges have seen a major drop in price over the last few days. Bitcoin, one of the most popular cryptocurrency exchanges is reported to have had a major downfall from its highest value of almost $20,000 to now trading below $7,500 as of Monday according to an article from Ars Technica. 

Does this mean we are headed for the burst of the cryptocurrency bubble? Only time will tell if this will be the start of the end or if this is just a natural dip in the market adjusting to mainstream adoption. One thing is for sure though, with over 1,000 cryptocurrencies on the market and many celebrities jumping in on the cryptocurrency craze, there are still many people excited to jump on the cryptocurrency bandwagon.

Because cyber criminals are starting to capitalize on the money being put in to cryptocurrency trading, it’s important for users to know proper security measures to take to help keep their cryptocurrency wallets more protected. Below are several tips people should think about when they are investing in cryptocurrencies.

• Use Multi-factor authentication: this will add extra security layers for hackers to get through while trying to empty your wallet.
• Don’t store all your passwords in the same place: make sure to have your wallets and passwords stored in different places so both are not compromised in a hack.
• Use different passwords: don’t use a password that you have used before and make sure the password you choose is unique. Here is a past blog we have featured on the do’s and don’ts of picking a good password.
• Don’t save your passwords on your phone or computers. 
• Think about where you are transacting from. For example, by using public Wi-Fi, it makes you more vulnerable for someone to intercept your data in a man-in-the-middle attack. It is advisable to use your own Wi-Fi network that is setup with password protection to your cryptocurrency trading.
• Be careful of what you post on social media. This may sound silly, but by posting personal information about yourself and the cryptocurrency exchanges you are using on your social tools can give criminals easy access to find more information about you and use it to their advantage.
• Have a dedicated email for each of your cryptocurrency exchange. Never use the same one for different exchanges.
• Spread your cryptocurrencies among several wallets, so if one gets hacked, not all of them are compromised.

While these are not full-proof plans to ensure your cryptocurrency exchanges are not hacked, it does help add more layers of protection. Hopefully these tips offer some insight in security measures to take before investing in cryptocurrency exchanges. 

Come back next week and we will continue focusing on the cryptocurrency topic and look specifically at one type of attack – cryptojacking and how to protect against it.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

New Service, Same Old Equifax: Credit Locking App Freezes Up

More problems with Equifax. The company introduced a free consumer service this week that allows people to lock access to their credit files from a mobile phone. It didn’t work. Read more…

Cisco VPN remote code execution flaw rated 10 out of 10 for severity

It came out this week that there is a major Cisco VPN flaw that needs immediate patching now: There's a remote code execution and denial of service bug in Cisco VPNs. And it's as bad as it gets -- rated 10 out of 10 for severity. Read more…

Cryptocurrency Traders Lose $115 Billion in 24 Hours as Bitcoin Bloodbath Continues

Bitcoin fell below $7,600 in some trades as its heavy slide continued into Friday. Ethereum fell more than 32%, Ripple was down 38%, and Bitcoin Cash was down over 27%. All in all, that’s $115 billion off cryptocurrency market caps in one day. Read more…

Medical supply giant Fresenius Medical Care fined $3.5 million for five data breaches

Medical supplies giant Fresenius Medical Care North America (FMCNA) agreed to pay $3.5 million to U.S. federal regulators after five separate data breaches in 2012. Read more…