Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Under Armour Says 150 Million MyFitnessPal Accounts Hacked

Under Armour Inc., joining a growing list of corporate victims of hacker attacks, said about 150 million user accounts tied to its MyFitnessPal nutrition-tracking app were breached earlier this year. An unauthorized party stole data from the accounts in late February, Under Armour said on Thursday. It became aware of the breach earlier this week and took steps to alert users about the incident, the company said. Read more…

Boeing hit and recovering from possible WannaCry attack

Aerospace manufacturer Boeing is reporting that the company has mitigated what may have been a small outbreak of WannaCry ransomware that hit one of its manufacturing facilities on March 28. Read more…

As Atlanta Seeks To Restore Services, Ransomware Attacks Are On The Rise

Atlanta city officials are not saying whether they were strong-armed into paying the $51,000 ransom to hackers holding many of the municipality's online services hostage, but they did announce progress in restoring networks on Thursday. Read more…

Facebook Could Be Fined Millions for Violating Consent Deal

Former Federal Trade Commission officials say that Facebook Inc. appears to have breached a 2011 consent agreement to safeguard users’ personal information and may be facing hundreds of millions of dollars in fines. The agency could fine Facebook up to $40,000 per violation per day -- which could add up quickly with millions of users involved -- if it finds the social media giant broke its earlier promises to protect user data, they say. Read more…

How Does the United States’ Approach to Security Compare to the Rest of the World?

- Alan Jamieson, BOHH VP of Business Development

Continual data breaches and the constant collection of personal information fuels debate on whether privacy is dead in the digital age. Regardless of who is winning this debate, privacy, security and trust—all increasingly at risk—are vital and must be interlinked in our data-driven society.

With the global focus to prevent cybersecurity threats or attacks, companies are investing in new strategies and even new roles, such as Chief Privacy Officer. CEO’s and their Boards say they are investing in cybersecurity to build trust with customers concerning the usage and storage of data, but is that enough?  As we have seen after many breaches, consumers will vote for responsible innovation and data use with their wallets.  In fact, we have seen a significant number of Fortune 500 companies who have lost significant earnings and customer retention because they have not adequately protected customer data as they embrace the digital times.

As security becomes more critical to the existence and growth of companies, some parts of the worlds are better prepared than others to combat these complex cyberattacks. Where does the US fit in?

The Global Cybersecurity Index (GCI) is a survey that measures the commitment of 193 Member States to cybersecurity in order to raise awareness.  In 2017, The United States was ranked 2nd globally in the Global Cybersecurity Index 2017, the first and third places were taken by Singapore and Malaysia respectively.  Europe’s best country was Estonia ranked 5th globally. 

• Singapore ranks number one as its started its cybersecurity strategy in 2005, so it has greater knowledge and experience than most other mature countries.  Singapore’s Internet Content Providers (ICPs) and Internet Access Service Providers (IASPs) are licensable under the Broadcasting Act and they are required to comply with the Internet Code of Practice to protect children online. Since 2012, all service providers have been legally obligated to offer filtering services with Internet subscriptions and to make this known to consumers when they subscribe or renew. The Info-communications Media Development Authority also symbolically blocks 100 pornographic, extremist or hate websites.  Malaysia is second in Asia and third globally, its Government is a strong advocate of cybersecurity which focuses on businesses and Government alike. Malaysia created the Information Security Certification Body (ISCB), a department of Cybersecurity Malaysia, which manages information security certification.

Leaders in the United States and European Union have recognized that the interconnected nature of information and communications systems and the global nature of the threats demand international cooperation.  Legalizations that are driving change and commonality of strategy between the US and European Union (EU) are:

• In the United States, the centerpiece is the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Framework) issued in 2014.  It’s now undergoing revision, coupled with state data breach notification laws and regulation of data security practices by various federal and state laws and agencies.
• At the European Union level, legislation that takes effect in 2018: the Network Information Security Directive (NIS Directive) and the General Data Protection Regulation (GDPR) effective May 25, 2108.

While there are certain differences between the US and EU legal processes, their approaches to cybersecurity are aligned in essential ways.

Cybersecurity is an ecosystem where laws, organizations, skills, cooperation and technical implementation needs to be in harmony to be most effective.  Cybersecurity is not just a concern of the Federal or Central Governments, but also needs commitment from the private sector and consumers which we are starting to see happening in the tumultuous cybersecurity climate. As such, it is critical to develop a cybersecurity culture where citizens are aware of the trade-off between risks and monitoring of personal data when using electronic networks for research, data storage and/or acquisition.

While, the US was ranked 2nd in 2017 for commitment to cybersecurity, as the cyber threat grows, so must the government’s capabilities to put forth strategies to keep its citizens and their information.

Up until now, a large amount of cybersecurity protection efforts have largely fallen on private sector institutions, but many government officials and security experts believe not enough is being done and more standard regulations are needed. Already we are seeing more states bring forth their own data breach notification laws, privacy laws, and even cloud regulations, but only time will tell if and when these get passed and what impact they might have. As the number of security breaches and threats continue to rise, it is time we start to take a closer look at the standards we are using and re-evaluate what tools are needed to keep information protected from. Cyber hacks have become more complex and it is time we figure out how to flip the switch on them as well. 

A Narrow, Four-Lane Internet Highway is Headed Our Way Under the Net Neutrality Rollback

Net Neutrality rules were put in place to ensure that the Internet stayed a public network and that users had open and equal access to all content on the Internet. With the 2017 ruling set to rollback the rules on governing our Internet, many are worried for the privatizing of the Internet and the future of a two-tiered pay-to-play service that offers a “fast lane” users can pay a fee for to get better service or a be stuck with a “slow lane.”

While I believe that we are headed to an Internet lane split with the rollback, I predict it will go even further than two lanes and we will see a multi-lane highway created. Because users are consuming the Internet in so many facts of our daily personla and work lives, I see two diverging paths of the Internet: one that is for individuals and one for corporate, which will be broken into various networks based on the Internet’s role. Below is a further breakdown on what this multi-lane Internet highway might look like.

Lane 1: The Streaming Generation’s Internet
There is a radical shift in how individuals, especially teens and millennials, are getting access to their content using Internet streaming services. This encompasses everything from TV shows and movies on services like Netflix, Hulu and Amazon Prime to music platforms like Spotify and Pandora. These are now the go-to services for consumers, but streaming is expensive. However, it’s not expensive for the streaming companies – only the Internet service providers, as they are the ones supplying the bandwidth infrastructure without getting any money from it. As such, I predict this will become a dedicated paid network lane where streaming services companies must pay the Internet companies, such as Comcast, a fee to support the streaming bandwidth for consumers. While the end user will most likely not see a direct upcharge to use this Internet lane, it will trickle down to the end user in increased account and subscription fees to continue accessing these streaming services.   

Lane 2: The Corporate Network
The Internet is now an essential tool in how businesses communicate among themselves and their customers. Having enterprise mobility and anytime, anywhere access to complete work is fully ingrained in how they operate. As such, the corporations are going to demand their own Internet network purely dedicated to accessing their applications like Office 365, Google Docs, Dropbox, etc., so there is no lag time or need to compete with other individuals streaming services or using the Internet. This will help increase efficiency for corporations and their employees.

Lane 3: eCommerce
How do you feel about all the advertising you currently see as you browse the Internet? If you say ugh too much, get ready because this will only be the beginning. There will be a pay-to-play eCommerce Internet channel coming that will direct users to companies and products without giving them options to search freely. While users themselves will not have to pay to use this Internet channel, companies will pay a fee to make their products show up first over their competitors. Unfortunately, this eCommerce channel will no longer focus on the consumer experience, but rather push sales for big corporations who can buy their way to the front.

Lane 4: Private Shopping
Since one Internet lane will now be dedicated to eCommerce companies and directing people to the stores they want users to buy from, there will be another private shopping Internet lane that people can pay for to search and shop freely without being pushed to the ads and dedicated stores/services the broadband customers want to direct you to. Unfortunately, this will become our sad reality that we will have to pay to use the Internet in the way we want to. Essentially, we will be paying for a private shopping portal fee, as if we would have to pay a fee to enter a mall, in order to not be forced into having choices being made for us.

While we have no way of knowing just how the Net Neutrality rollback will impact the Internet, one thing that will be clear is that those with economic self-interest like the broadband service providers and major corporations will be the ones who stand to benefit the most from the rollback.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Facebook Controversy: What to Know About Cambridge Analytica and Your Data

This week’s uproar over Facebook Inc. started years ago, with the mishandling of user data. Now that incident, and what followed, is at the center of a debate over how well the world’s largest social network protects its trove of user data. Read more…

Atlanta Ransomware Attack Freezes City Business

Ransomware that struck the city of Atlanta early Thursday morning froze internal and customer-facing applications, but officials say backups are in place and they expect to pay city employees on time next week. Read more…

Cryptocurrency mining malware uses five-year old vulnerability to mine Monero on Linux servers

Hackers are using a five-year-old security vulnerability to infect Linux servers with cryptocurrency-mining malware. The cryptojacking campaign exploits CVE-2013-2618, an old vulnerability in Cacti's Network Weathermap plug-in, an open source tool which is used by network administrators to visualise network activity. Read more…

House passes controversial legislation giving the US more access to overseas data

This week, the House of Representatives passed controversial legislation that would clarify and expand how data held overseas can be obtained by law enforcement in the United States. The change is part of the massive omnibus spending bill, and it incorporates measures first submitted earlier this year as the CLOUD Act. Read more…

The Security Blame Game: From the Past to Now, Who Takes Ownership When Things Go Wrong?

- Dr. Peter Courtney, BOHH Labs Director

Today security threats seem to be inescapable, with companies dodging attacks on an hourly basis and breaches being revealed daily. As such, the practices, technologies and management of security threats have seen a dramatic shift over the past couple of decades, especially in how breaches are accounted for and who takes ownership when things go wrong.

Before we can address where we are today, we first must look at the past and where we’ve come from. In the past, security flaws in a company amounted to losing a ledger-book, a cash box or a roller-deck. While the competitor might steal some customers if they obtained your roller-deck, the impact was modest compared to having an electronic customer file stolen, that might then be sold on, mined automatically or even put up on public display to embarrass the company, as is happening today. Additionally, the complexity of IT errors was much simpler in the past. For example, IT errors might have involved a functional code bug that only caused a problem under rare circumstances. In these instances, the impact on the company was relatively low, typically affecting a specific area of the company.  It was relatively easy to identify the culprit and move forward with a solution. Security breaches were dealt with in a similar manner to a project failing, the CEO would identify the accountable executive and either censure, discipline or fire them depending on the severity of the issue. Typically, the executive to blame was either the CIO or CSO, as security was their focus area and it was clear that they carried the accountability.

Today, more often than not, IT errors are deliberate attacks that target systems such as payments or CRM, they can invade the core processes of the company and may broadcast sensitive customer information to the public web. Unlike in the past, this means that the impact can stretch across the entire company, not just the area that is initially targeted.  The company can be damaged internally and potentially cause reputational and financial damage in the public domain. Because of this, the impact of the breach spreads across the company and accountability flows far beyond the IT/security department. It may be judged that the CFO, CSO, COO or even CEO should have exerted greater control over the company, its processes and its decisions. Today, it is much more difficult to clearly assign blame. Unlike in the past, the perpetrators of the breach may never be identified or the case proven with any hard evidence, making it difficult to hold any single person accountable. In addition many of the suppliers of systems and security are now external rather than having been developed in-house as was the norm.  Indeed, the external party may have been selected by a Board decision rather than simply the CIO or CSO, making it even more difficult to assign individual accountability.

Because the nature of security threats are becoming more complex and the impact a breach can have on the company is more widespread, the risk that accountability may not be contained to an expendable CIO or CSO is making security a priority for the whole executive and even non-executive Boards.  We are seeing more executives politically positioning themselves both in demanding scrutiny on security decisions in advance of them being made and also in positioning accountability away from themselves where that is possible.

The current IT world has been unable to prevent breaches from occurring and many institutions simply consider it a cost of doing business.  As we are seeing, if the threat is inescapable, then so too is the blame.  We now see companies spending huge sums on technology solutions that may not work but enable the company to say that they followed the process and did what they were supposed to do, so they should not be penalized. For now, companies are simply skirting around the accountability game when it comes to breaches, but if we are to move forward as an industry overall, we must come up with a better way. Surely it is time to find security solutions that actually fix the risks and solve the problems rather than waste political energy and money on avoiding blame when the inevitable breach occurs.

Web Development Tools You Should be Using to Protect Your Data

- Greg Gray, BOHH Senior Software Engineer

Someone recently asked me what web development tools I use to protect data. After some thought, I realized there that tools aren’t really the biggest part of the data security picture - data is protected by secure design practices and the processes that support them.

At the core is your server’s software. Keeping it up-to-date should be a primary concern. Bugs and security holes can quickly compromise your systems if you don’t keep the software patched with the latest fixes. If you are maintaining your own server network environment, you also need to pay attention to firmware updates for your network infrastructure, as exemplified by the recently revealed exploits (e.g., Slingshot) that can compromise your network routers.

Managing the configuration of your servers is also important. Restricting incoming traffic to just a few ports is a common practice, but it’s also important that other software, such as the database is also protected. Data breaches are regularly reported where the exploit is using the default root password on a system exposed to the Internet. Some database installation processes will suggest the changing of root passwords and will initially limit access to the network, but it’s up to you to ensure that these safeguards are maintained and not compromised for convenience. An even better practice is to not expose the database to the Internet at all, relying instead on application server access via internal network paths.

Additionally, all web servers should be configured with SSL certificates. Sorry, but the days of worrying about the loss of the extra CPU cycles to process secure requests are over. HTTP (insecure) access should be limited to allowing a redirect to the HTTPS (secure) processes. Browsers will soon be warning users when they are accessing sites that aren’t protected by SSL certificates. Lock them down and keep the SSL software up-to-date.

Most of the responsibility for data security is in the hands of the developer. I am constantly amazed that there continues to be reports of SQL Injection exploits when the simple practice of parameterized queries can solve the problem. Many databases can now be encrypted or use custom encryption routines on specific tables and fields. Password fields need to be stored with one-way hashing functions, preferably using per-user salts.

But encrypted databases won’t protect against an application that has been compromised. The application will, by design, have the mechanisms or permissions to decrypt the data. The application should only be allowed to do the tasks on the database that are required. For example, most end-user applications probably don’t need to drop tables or create scripts. If they don’t need a permission, they shouldn’t have it. If the app can’t do a particular function on the data, neither can someone attacking the data via the app.

Almost everything running at the web browser has the potential to be compromised. Those wonderful browser-based user experiences come at a cost by delivering the software to the browser in a human-readable form, ready for exploitation. Make sure your code doesn’t contain account names and passwords, or any other information that can be used to compromise your back-end server.

Form input validation should take place at both the browser and the server. Browser-based validation speeds the response to the user (a convenience) but server-based validation is needed to ensure the browser’s process hasn’t be compromised (a necessity).

Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) exploits have many attack vectors but mitigation is possible with the appropriate server checks in place. XSS exploits can occur anywhere your web application uses input from a browser within the output it generates without validating or encoding it. You must validate and escape/encode all input that comes from the wild. CSRF prevention begins with checking standard headers to verify that the request is “same origin” and using CSRF tokens. Developers will often disable the “same origin” checks during testing, and sometimes they forget to turn them back on. See the Useful References from the Open Web Application Security Project (www.owasp.org) at the bottom of this post for an overview of XSS and CSRF.

At the end of the day, how do you know if your carefully crafted best practices are actually being used and providing full coverage? Code reviews by staff not involved in the project are one solution. External audits of common and uncommon exploits are another solution and might be best done by third party software and service companies. Some good examples of such services include: Netsparker, SecurityHeaders, and Xenotix.

Website security cannot be taken lightly. Breaches have operational and legal ramifications. Good security design practices and a little help from outside agents can ensure a healthy web experience for your customers and your business.

Useful References

XSS (Cross Site Scripting) Prevention Cheat Sheet https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Cybercriminals spotted hiding cryptocurrency mining malware in forked projects on GitHub

Cybercriminals have found another way to spread their malware: uploading cryptocurrency mining code to GitHub, according to security researchers. Developers 'fork' projects on GitHub, which means making a copy of someone else's project in order to build on it. In this case, the cybercriminals fork random projects and then hide malicious executables in the directory structure of these new projects. Read more…

Bitcoin stealing malware distributed on download.com for nearly a year

Bitcoin stealing malware that swaps user accounts with that of the attacker was found to be hosted on Download.com servers for nearly a year. Read more…

Vengeance by DDoS: No one is immune

In what may catch many by surprise, distributed denial of service (DDoS) attacks are being used against companies, organizations, and individuals as an act of vengeance or revenge. No one is immune; documented victims have included non-profit organizations, community colleges, courts and law enforcement entities. Read more…

Victims can sue Yahoo for massive breaches, federal judge says

Plaintiffs suing Yahoo for failing to protect all of the company’s 3 billion users can move forward with the majority of their case, a federal judge in California ruled on Friday. Read more…

Why Policing Network Traffic Is Not Enough & the Data Itself Must be Secured

- Ken Hawkins, BOHH CTO

With Point of Sale (POS) attacks becoming more common with each passing day, securing your network traffic and data inside the network has reached a paramount point in today’s digital age. Sadly, this is not a new attack on the rise, but instead just one that has been around for a while. The tools that have worked are still working effectively and many corporations are simply walking a tightrope of risk management and data security, putting end user’s data they hold at risk. What this signifies to the end user is that their potentially sensitive data transmitted to the business is only worth securing up to a monetary tipping point, and perhaps the damage done by exposing sensitive data might well be costlier for said business to protect than to reimburse the user for that damage if it happens. I believe this is not a nefarious act by an uncaring business, rather the reality in the complexity of securing data on a business’ network, especially those who employ some type of third party POS solution who arguably have twice as many network security issues to manage based on the deployment of those POS terminals that can be another doorway both into and out of your network. This statement might not ring true in its entirety because generally through some isolation methodologies you can manage the network traffic and there are some real wizards in the realm of network traffic marshalling.

However, where I’d like to focus is on the data itself, both at rest and in transport. Both states of data are often managed via modern AES based encryption methodologies. These are strong but have one weakness that is continually exploited and is most easily described as “brute force type attacks,” which are generally defined as continually asking “can I have it?” or “Is this item correct?” Given how cheap today’s hardware is, coupled with great speed improvements in processing power, have made this questioning-based attack extraordinarily efficient on not only network attacks but also attacking blockchain-based systems like what bitcoin is based upon, but that is another discussion all together. Once we come to terms with this inherent weakness of AES we can start to effectively address the problem.

Given that a business will easily spend millions to protect access to data, it would only make sense to secure the data itself as well. But wait you say we do that, right? Well if you rely solely on the TLS/SSL transport, then you are not protecting data, rather you are attempting to hold the horde at the castle gate by monitoring access to potentially unencrypted data. Once inside, more often than not the network is wide open to the malicious code or individual and like a kid in a candy store data can be easily taken control of in some fashion and an unencrypted database can be a gold mine of information. In the enterprise business IT environment, TLS/SSL based securities can be as easily circumvented by an errant upgrade to expose data, which we have seen too many times. If that update has malicious code within it, that update could tear open a hole in it and at minimal siphon your businesses’ important documents, and worse, it could set up residence within the network. Once there, it can report back anything that happens on the network and/or machine it is on. Now of course this appears on face value to be a simple ok, just verify the updates and smart IT professionals would never, EVER blindly apply an update to a production facing server, right? Well it does happen and the majority of big breaches we hear about today are a product of that scenario. In our collective rush to “live update” hardware and software so we can develop at a faster pace and in theory adjust for attacks in real time, we forget that people make mistakes and one seemingly small mistake can destroy a company’s livelihood, not to mention the individuals who could also be affected based on the data stolen.

Once we ween ourselves off the blind reliance of secure TLS/SSL protocols to do policing of network traffic, the problem of securing data in the network is more easily addressable and ultimately your data is safer. I’m not knocking the router companies or the many permutations of lite security-based web servers and/or software-based managers. We have come a long way, and coupled with today’s learning networks, they can be effective when included with other methodologies involving elaborate routing and reporting systems and make a pretty good gate keeper against TCP layered attacks. However, most of those systems still rely on TLS/SSL as the core transport mechanism verifying the requestor, entering, exiting the network and accessing data.

In order to properly isolate data access and monitor intrusions, the IT professional today will have to take at minimal a three-pronged approach to securing the data.

1. Network traffic monitoring – Yes watch and react quickly to questionable external and internal network traffic.
2. Implement up to data access methodologies – This can be timed password rotation, hard locks on computers, etc.
3. Encrypt the data – Ensure all data on the system or systems is properly encrypted at all times.

Properly addressing these areas is no small challenge for any of us as individuals, however, for the IT professional it can seem practically impossible to always stay up to date and ahead of the hackers. Particularly addressing data encryption and access can be an ongoing battle as users want data to be secure but not have to have a complicated means of accessing it. Unfortunately, todays encryption methods use a password or some form of unique key/passphrase to encrypt data and we like to only use one password. This is a problem and always will be until we build a better mouse trap in regard to data encryption and access.

AI, NLP, Blockchain: Yes, We’re on The Buzzword Bandwagon but Here's Why

- Simon Bain, BOHH Labs CEO

Like every year, there are certain technologies that get more attention than others. Right now, some of the biggest ones making a good run include Artificial Intelligence (AI), Natural Language Processing (NLP) and Blockchain. Based on the number of companies or new products that have come out of the woodwork using these technologies, it’s clear people love to use buzzwords and tout they are using the hottest, most innovative technology on the market to gain competitive edge and create the illusion of being a forward-thinker. However, many companies jump on the buzzword bandwagon simply because it is something popular everyone is doing, and so they do it too. While this may just sound like a lame popularity contest giving you nightmares of your high school days, when this strategy is applied to something critical like data security, there can be serious ramifications for companies laying all their eggs in one basket and settling for solutions that are hot at the moment.

Before I go on about how bad it is to jump on buzzword bandwagons, I first must address that at BOHH Labs we do apply the AI, NLP and Blockchain technology buzzwords taking the industry by storm. However, what makes our approach unique is that we do not rely on just one of these, but instead use them in an interconnected way that helps us ensure we can secure all user, applications and data access. So yes, we do fall in to the bucket of one of those companies using buzzwords, but we leverage the benefits that make each one of them unique in to a full-encompassing security solution. Below is a breakdown why and how we apply each of these technologies:

• Artificial Intelligence (AI):  AI uses a compound set of algorithms to detect patterns and predict outcomes from a large amount of data online, as such, the self-learning capabilities and ability to recognize patterns and anomalies within them, makes AI a great tool to detect cybersecurity threats within the network in real time. We use an AI engine to do threat analysis and to prevent intrusions. Our AI manages ports, interacts with and processes user requests, and maintains a secure connection by learning, identifying and removing any unwanted traffic before it is passed along and gets access to any of the backend applications or databases. 
• Natural Language Processing: NLP is a great tool to connect the gap between human and machines as technology continues to advance and will have many advantages to streamlining processes. Our NLP is critical to ensuring the BOHH solution works properly. It works like most human brains work. When a request comes in, it determines if it is a command or question, then it does entity recognition, looks and finds the answer from the correct database(s), performs any additional processing math, and then formats the response and passes it back. 
• In-Memory Distributed Blockchain Ledger: The underlying technology of blockchain offers great potential to bring more granularity to areas where you have an open network of millions of transactions. It offers the potential of an unchangeable, universally visible ledger that creates its own audit trail, decreasing the possibility of backdoor transactions. We use an encrypted In-Memory Distributed Blockchain Ledger. Unlike other standard databases, the ledger fields do not hold complete data. This means that the database service requires less memory and processing power, less management of resources for the database itself and controls field level access of data down to an individual or device level. The power of this is that you can have multiple devices accessing a single database and table, yet each can only access a single field managed by that database regardless of the SQL query that has been sent. 

There you have it. To sum up, I believe it is my role as a technologist to help companies understand why it is important to invest in security technologies that will make an impact on their solution, and not just apply something new that is hot now.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Equifax data breach affected 2.4 million more consumers

The 2017 Equifax data breach has expanded again, with the company announcing last week that another 2.4 million U.S. consumers had their information stolen. Read more…

Massive Coin-Mining Attempt Targets Nearly Half a Million PCs

Microsoft has averted a massive and widespread campaign that would have seen tens of thousands of machines impacted. The software giant reported that on March 6, "Windows Defender AV blocked more than 80,000 instances of several sophisticated Trojans that exhibited advanced cross-process injection techniques, persistence mechanisms and evasion methods." Read more…

DDoS Record Broken Again as Memcached Attack Hits 1.7 Tbps

Days after a massive 1.35 Tbps DDoS attack against GitHub, an even larger attack reported at 1.7 Tbps by Netscout Arbor emerges to become the largest DDoS yet. Read more…

Code for massive 'Memcrashed' DDoS attack made public

You, too, can now attempt a record-setting denial-of-service attack, as the tools used to launch the attacks were publicly posted to GitHub this week. Proof-of-concept code by Twitter user @037 combined with a list of 17,000 IP addresses of vulnerable memcached servers allows anyone to send forged UDP packets to memcached servers obtained from the Shodan.io computer search engine. Read more…

Why Data Security Must Be Treated as a Core Business Value

- Ted West, BOHH Labs Chairman

What makes a company successful? Ask almost any enterprise today and they will tell you that strong revenue, a loyal base of customers and forward-thinking are the keys to ensuring long-term success. However, in our digitally-driven, cloud and mobile-dispersed business world, security is becoming a top priority for more and more organizations, especially for the customer, operations and transactions data they hold. When companies are hit with a data breach or expose sensitive data to “bad actors”, the ramifications can be huge: loss in customers, reimbursement to customers, legal fines and data recovery fees, or perhaps even something worse – damage to reputation. All of these repercussions of a data breach can greatly impact the success and revenue stream of a business, yet data security is still largely viewed as a role of the CIO, CISOs or whomever is in charge of the company’s security strategy.

Most CIOs acknowledge that cybersecurity is a core expectation of their leadership, yet many believe that companies still view security and risk management as mere “compliance chores” and a “cost of doing business.” Industry analysts report that more companies are increasing spending on security investments. However, if companies are making investment decisions in security simply based on implementing what meets the minimum requirements of securing data, and they are not looking at how these investments directly impact business strategy and the bottom line, they will likely fall short of what is needed. 

Data is an asset

It’s clear data is an asset to businesses and holds a lot of weight to how successful a business can be. It’s no secret that most businesses today are happy to put investments in to analyzing data to increase sales and market shares, but those analytics are not useful if business can’t keep their data protected. Business leaders, starting from the Board of Directors and moving through the C-suite, must insist on their organizations adapting the most effective security measures in their IT platforms and workflows and processes today keep the data they hold secure. Their success depends on it. They have no choice, and they should expect nothing less. While this task is not always easy, there is a great opportunity for those businesses who do place importance on keeping data protected and treating it like a core business value to gain a competitive advantage and strengthen their ability to keep the “bad actors” from compromising their good data, their customers’ trust and loyalty, and their critical brands.

Data security is becoming existential, no longer circumstantial, for many organizations

With the current climate of breaches revealed daily and the number and scope of attacks on the rise, organization leaders must start asking themselves: Is fixing a security breach that exposes millions of client records and brings financial and brand damage merely a “compliance chore”, or is it more than that? Is the investment needed to prevent such a breach from happening again a simple “cost of doing business”, or is it more than that? Is fixing a breach, or guarding against it in the first place, a strategic issue impacting the trust and reputation of the organization and its position to grow and retain a loyal base of customers? We think so.

Mastering Digital Transformation with BOHH Labs For Simple, Secure Data Access

- Alan Jamieson, BOHH VP of Business Development

Today, data security and the ease of data access for customers and employees is at the forefront of enterprises minds, including which solutions to deploy and where they should fit in to the company and product roadmap design. However, one critical piece to mastering digital transformation is ensuring that there is a secure data platform behind the transformation, which is becoming vital in our increasingly regulated world. Plus, add to the fact that once data loss has occurred, customer ‘trust’ is broken and can impact business moving forward.

At BOHH, our philosophy is data privacy and securing applications without restricting data access. We believe it is critical to support customers and employees alike without sacrificing productivity for security or vice versa.  Coming from a secure federated search background, BOHH knows being unable to quickly and easily find information can result in the loss of customers and wasted employee time.  Now, we combine that with BOHH’s secure application gateway (often classified within the CASB domain) to ensure data is secure, plus accessible in encrypted and unencrypted format using keyboard and voice requests.

In order to provide a secure and enterprise solution, our gateway is built using our own technologies, including: Artificial Intelligence (AI), Natural Language Processing (NLP), chatbots, etc. to prevent the bad guys (unwanted intruders) from accessing corporate access.  Put simply, we prevent squatters from accessing your property to steal customer data, pricing information, intellectual property (IP), etc. Once they are inside, the damage is done, so prevention of unauthorized access is paramount.

Our security gateway is vendor agnostic, so it can support Cloud (public or private) or on prem deployments.

While we put a lot of focus on securing data, we also help users get simple access to their data using type-and-text keyboards or the increasingly popular voice-activated requests such as bots or Robotic Process Automation (RPA) capabilities. The use of mobiles, computers, tablets etc. is constantly changing, and the younger generation has become accustomed to using these tools to ask for data/information to complete their tasks, while the older generation is still more traditional and keyboard-centric. Additionally, the customers are embracing more of these innovations, especially voice-activated home devices to ask for information, place orders etc. As such, a solution is needed to secure these transactions, and more importantly, enable access to all enterprise systems to quickly find the answer to asked questions. 

This is where BOHH’s unique capabilities come in to help enterprises securely master digital transformation and seamless access to data:

Our AI engine is used to manage various components within our gateway such as dynamic ports, Denial of Service attacks, our keyless AES 256 encryption, entity mappings, and security attacks.

Our NLP engine has been designed to think as we humans do. We break down questions into contact and entities, which we then search within across the data platform. We access the answer, we use a probability engine and process additions (i.e. weight in Kg’s not stone) to deliver the most relevant answer to the question.  BOHH’s NLP enables data assets to be securely and quickly searched, as we find answers from within data assets and avoid the need to build an answers/Frequently Asked Questions (FAQ) database. This significantly reduces the time to deploy a voice-activated front end on to a RPA or chatbot application.

Our Block Ledger database is designed to support the increasing world of Internet of Things (IoT), especially the ability to access or isolate a specific robot in a manufacturing plant if an intrusion attack occurs.

In summary, BOHH’s security application gateway provides greater security and data access capabilities to existing technologies and offers enhanced and complementary capabilities to support the enterprise goal of secure data, but with easy data access. After all, what good is data if it can’t be accessed?

For more information, please go to www.bohh.io

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

23,000 HTTPS certificates axed after CEO emails private keys

A major dust-up on an Internet discussion forum is touching off troubling questions about the security of some browser-trusted HTTPS certificates when it revealed the CEO of a certificate reseller emailed a partner the sensitive private keys for 23,000 TLS certificates. Read more…

Equifax Discloses 2.4 Million More Mega-Breach Victims

Equifax says it identified 2.4 million U.S. consumers whose names and snippets of their driver's license numbers were stolen, adding to what is one of the largest and most sensitive data breaches on record. Read more…

Big banks want to weaken the internet’s underlying security protocol

The tech and financial industries are butting heads over the latter’s push to intentionally weaken a security protocol that underlies how the public securely accesses the vast majority of the internet. Critics are charging that the financial industry is pushing for a weakness in the new version of the Transport Layer Security (TLS) protocol, all for the sake of avoiding the time, effort and resources needed to adapt to the new standard. Read more…

Another massive DDoS internet blackout could be coming your way

A massive internet blackout similar to the Dyn DNS outage in 2016 could easily happen again, despite relatively low-cost countermeasures, according to a new study. The DDoS attack on Dyn took many major web sites offline for most of a day, including Twitter, PayPal, Reddit, Amazon, and Netflix. Millions of compromised IoT devices, belonging to the Mirai botnet, flooded Dyn's DNS service with up to 1.2 TBps of bogus traffic, making it impossible to respond to genuine DNS requests for their customers' websites. Read more…

Confessions of a Marketer: Data Is Everything, But I Won’t Share Mine Until I know It’s Securely Protected

You might think that as a marketing professional, I would be fascinated by loyalty programs and their power to grow revenue by creating repeat sales and building customer relationships. (I am!) So logically you might expect me to sign up for every loyalty program possible where I regularly spend $, to both experience it as a marketer, as well as reap the benefits of being a member. (Free makeup samples at Sephora! Special discounts at Rite Aid! Birthday bonuses from Anthropogie!) The truth? I avoid Loyalty Programs like a middle seat on a 6-hour flight.

I avoid all manner of giving away personal info to companies, even ones where I regularly spend my cash. My privacy is worth more to me than free mascara samples and 20% off coupons. I know how valuable my personal details are to the marketing team at a company, but its security is far more valuable to me than any incentive a company has ever dangled in front of me. I’m not giving it away just for a discount on a new spring skirt or some cute espadrilles. I’d rather spend the extra $ and keep my personal info secure. Why?  For one, it is clear by the breaches that happen almost daily now, that companies are struggling to protect customers’ data. Just look at some of the more recent breaches from top-name companies: Equifax – exposed data of 143 million customers; Uber – over 56 million customers affected by a data breach, and there is still aftermath from the Yahoo data breach that happened years ago with it being revealed last year that the number of people affected jumped from 1 billion to 3 billion. Secondly, working in the security industry, I just know too much know about data security to feel confident my data will be secure. The risk of accidental or intentional exposure of my data is far too high in today’s world.

There is not always a lot of control users have when it comes to data breaches, but one small line of defense I can take is to control how much of my information I share with the companies and services I am using.

As a customer, I would never sell my personal info and my purchase history for some free samples or a birthday discount because I don’t think we fully understand the implication of privacy breaches in our data driven economy yet, other than of course the direct impact of our credit card being stolen or our social security number being compromised. I don’t think I’ll ever participate in loyalty programs unless laws are enacted to protect our privacy, but beyond that, I would need to know how companies protect my privacy.

As a user, before giving away my personal information to a company, I want to know how that company will keep my data protected and give me secure access to my data. Currently, I believe there is too much focus from companies on figuring out how to collect and analyze customer data to apply toward marketing and audience targeting strategies and not enough focus on keeping that customer data they interact with safe. At BOHH Labs, we believe that data is invaluable and we are focused on re-evaluating how customers can have access to their data, yet keep it safe when sharing it with companies and services.

We believe that the parties at the two ends of a data message – the sender and requester – should be the only ones to have access to that data message. As such, our security approach focuses on ensuring a secure transport of data between all users, applications, and the end database services. We use a powerful combination of keyless encryption that keeps data protected both in transit and at rest and Artificial Intelligence technology, Natural Language Processing, and In-Memory Distributed Blockchain Ledger to ensure that your data stays protected, no matter where it is stored or accessed from. And until I know that the companies I do business with protect my data with the same care, I guess I’ll be paying more for my moisturizer and melatonin. But I wont be losing sleep over who has access to my private info.