Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

23,000 HTTPS certificates axed after CEO emails private keys

A major dust-up on an Internet discussion forum is touching off troubling questions about the security of some browser-trusted HTTPS certificates when it revealed the CEO of a certificate reseller emailed a partner the sensitive private keys for 23,000 TLS certificates. Read more…

Equifax Discloses 2.4 Million More Mega-Breach Victims

Equifax says it identified 2.4 million U.S. consumers whose names and snippets of their driver's license numbers were stolen, adding to what is one of the largest and most sensitive data breaches on record. Read more…

Big banks want to weaken the internet’s underlying security protocol

The tech and financial industries are butting heads over the latter’s push to intentionally weaken a security protocol that underlies how the public securely accesses the vast majority of the internet. Critics are charging that the financial industry is pushing for a weakness in the new version of the Transport Layer Security (TLS) protocol, all for the sake of avoiding the time, effort and resources needed to adapt to the new standard. Read more…

Another massive DDoS internet blackout could be coming your way

A massive internet blackout similar to the Dyn DNS outage in 2016 could easily happen again, despite relatively low-cost countermeasures, according to a new study. The DDoS attack on Dyn took many major web sites offline for most of a day, including Twitter, PayPal, Reddit, Amazon, and Netflix. Millions of compromised IoT devices, belonging to the Mirai botnet, flooded Dyn's DNS service with up to 1.2 TBps of bogus traffic, making it impossible to respond to genuine DNS requests for their customers' websites. Read more…

BOHH Breakdown 20: Supporting Digital Innovation Without Sacrificing Security

In our last post, we took a closer look at Artificial Intelligence and how it can enhance the cybersecurity industry. Today, we are addressing how to support digital innovations without sacrificing security. 

What makes a company successful? Ask almost any enterprise today and they will tell you that innovation is a critical piece to ensuring long-term success in the current and evolving business environment. The companies that are able to adapt to the ways in which the market is evolving, compete with newer entrants, and even capitalize on the opportunities and possibilities innovation brings, will be the ones to emerge as successful leaders. Since 2000, a significant number of Fortune 500 companies that are no longer trading, as they couldn’t embrace business change.

Innovation can mean a lot of different things, but for today’s purpose, we will focus on digital innovation of new devices, tools and methods to help businesses streamline their operations and communication engagements with customers. As such, cloud services, IoT implementations and chatbots are some of the top digital innovations that are dominating today’s enterprise ecosystem. Adoption of these technologies is exploding across enterprise cloud services. And while every enterprise would agree these channels are good business investments, there are still challenges of these tools opening their systems and users to massive, widespread and malicious security threats.

At BOHH, we believe that innovation should not come at the expense of security and vice versa. While it may be tricky, there is a way to find balance between the two. Below are several recommendations to support integrating digital innovations in to your business strategy without sacrificing security.

1. Consider how these new innovations are handling data before full adoption. Organizations must plan for how the information is stored, how long it’s stored for, how it’s used, and who has access to it on these new channels. This is especially important for highly regulated industries that will deal with sensitive customer information. Perhaps before initiating complete adoption, organizations should consider automating some services using digital innovation tools but still have them working in tandem with human teams to improve the data flow without sacrificing security. 
2. Research thoroughly the digital innovation tools you plan to integrate if you are using a third party.  Many brands are integrating tools such as chatbots and IoT devices that are third-party platforms. While this is a convenient solution, it does mean that the security features are decided by the third party’s own security branch, which means the organization does not have as much control over the security features on the tools they are using to interact with customer data that needs to be protected. If possible, businesses should rely on building their own digital innovation channels from scratch with security built in at the foundation level or working with third party platforms that follow this same rule. Because businesses hold responsibility in keep their data and customers’ data safe, it is important to do a lot of research on the security protocols needed before integrating these tools in to their business strategy.
3. All communication on these new tools should be encrypted and deployed only on encrypted channels. This is something that is relatively easy to set up on an organization’s own website and encryption is a great tool to help keep data protected. However, it is important to note that if the data is not encrypted from end-to-end in the transaction process, it leaves an opening for hackers to get access to that data once they have penetrated your system. End-to-end encryption is key to keeping data encrypted throughout the whole data journey, so the data stays better protected from bad actors no matter what channel it is being stored on or accessed through. 

Hopefully these tips offer some good balance on adding innovative digital tools to your business strategy without compromising security. Come back next week and we will switch gears a bit and talk about the hot topic of cryptocurrency and how to better protect your investments.

The BOHH Breakdown, Part 10: How BOHH Brings More Confidence to IoT Security

In our last post, we talked about the rise in popularity of chat bots and how BOHH supports the security of them. For this week’s installment, we will take a look at the state of security for the Internet of Things (IoT) and how BOHH Labs’ approach brings more confidence to keeping these devices secure.

Market analysts predict dramatic growth in the adoption of enterprise cloud services incorporating IoT technologies. In fact, Gartner predicts that more than half of major new business processes and systems will incorporate some element of the IoT by 2020.
However, the world has already witnessed some of the consequences to the growing adoption of IoT with the likes of the infamous Mirai botnet that took down major companies including Twitter, Amazon, PayPal and Netflix and off the Internet. 

While this trend continues to gain popularity in updating companies’ strategies, the IoT industry continues to be a top challenge for security professionals and keeping those devices and networks safe.

Some of the major challenges companies are faced with by integrating IoT applications include:

• Many IoT products are designed with convenience in mind and don’t have the proper security measures built in place at the design level/product development, leaving them insecure from the start. 
• IoT devices often come with old or unpatched operating systems. Additionally, these systems often need frequent software updates to patch for vulnerabilities, and if users do not complete these, it opens the devices to risks.
• Most IoT devices come with a default password that users don’t often change, making it easier for cybercriminals to hack these devices and easily hop on to a company’s network that the user is trying to connect with.
• IoT devices communicate with your network, as well as multiple other outside systems and networks companies don’t have control over. This throws open the door to malicious attacks directly on the enterprise databases and applications accessed by these services.

Although the security industry has been talking about how to secure IoT devices for years now, there are still too many backdoors and insecure devices being used today. Unfortunately, with the rise in IoT networks, comes the rise of security threats and questions about who is really at the other end of the connection.  

Companies’ digital strategies should not come at the expense of security. At BOHH, we support the use of IoT devices, while keeping the enterprise network safe by enabling a secure flow of all data traffic between these devices and the end enterprise services. 

We help enterprise networks stay better protected against attacks open by IoT services by managing the whole data transaction process and working natively with the IoT devices to secure the messages that are passed back and forth between the requestor and the responder. Our approach separates out the requestor from the request and securely allows, after AI validation, the request to navigate to whatever end-point is required. This leaves the requestor waiting until the response has been collected and checked before moving it forward and returning the request to the requestor. 

Unlike other security approaches, our approach prevents a request in to the network without being validated before gaining authorized access to a backend system or application. This approach enables BOHH to separate, recognize and maintain a secure connection to all relevant enterprise systems (i.e. the many different IoT devices and systems they connect with) and prevents any third parties from trying to hop on (piggyback onto) the connection and get to the backend database/application.

The use of IoT is here to stay, and is only predicted to grow, so it is more important than ever that new security is applied to securing enterprise networks to keep pace with innovation in enterprise IoT services.

Now that we’ve highlighted how BOHH helps enhance IoT security, check back in next Tuesday when we take a look at some of the most popular past breaches and how BOHH could have helped.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Bad Rabbit: A new Petya-like ransomware that's spreading, but beatable

A new form of ransomware, dubbed Bad Rabbit, is infecting computers via drive-by attacks masquerading as Flash updates. This latest form of rapidly spreading ransomware is believed to be a variant of the Petya family; DLLs associated with it share approximately 67% of their code with known Petya variants. Read more…

WannaCry ransomware: Hospitals were warned to patch system to protect against cyber-attack - but didn't

The National Health Service (NHS) was left vulnerable to the WannaCry ransomware attack because, despite local health trusts being warned to patch their systems, many had failed to do so. A National Audit Office (NAO) investigation found that the impact of WannaCry could have been prevented if basic security best practice had been applied. Read more…

Criminals mimic popular cryptocurrency exchange in Google Play

Cybercriminals took advantage of popular cryptocurrency exchange Poloniex's lack of an official app to dupe unsuspecting users into downloading credential stealing malware. Read more…

Senators try to reform law that allows U.S. agencies to surveil citizens

A bipartisan group of U.S. senators introduced the USA Rights Act to limit surveillance of Americans' communications under Section 702 of the Foreign Intelligence Surveillance Act. Read more…

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Microsoft never disclosed 2013 hack of secret vulnerability database

Hackers broke into Microsoft's secret, internal bug-tracking database and stole information related to vulnerabilities that were exploited in later attacks. But the software developer never disclosed the breach, Reuters reported, citing former company employees. Read more…

Severe weakness in Wi-Fi security gives hackers wide access to eavesdrop

Nearly everyone using Wi-Fi is being urged to patch their devices as a new widespread vulnerability to virtually all modern protected Wi-Fi networks leaves a huge swath of internet traffic potentially open for eavesdropping. Read more…

Ransomware: Security researchers spot emerging new strain of malware

A new form of ransom is being distributed via the same method as one of the most successful families of file-locking malware, and may represent a new evolution of the menace. Read more…

Phishing campaigns used victim's location to determine whether to deliver Locky or Trickbot

Researchers recently detected two email-based phishing campaigns that infected users with either Locky ransomware or the Trickbot banking trojan based on the victim's geographical location – a technique that the company claims is rather uncommon. Read more…

SAP+Google Cloud Intelligent App Challenge Winner, BOHH Labs Delivers Security of Data Transit and Access

At BOHH Labs, we are excited to announce that our secure app solution was selected as a winner of the Intelligent App Challenge, sponsored by SAP & Google Cloud. We are honored to be selected from hundreds of challenge registrants and recognized for our emerging solution that is based on some of today’s most innovative technologies including the use of SAP HANA Express Edition, Google Cloud Platform, Machine Learning, Artificial Intelligence and encryption to address the security of data transport and access for Cloud and Internet of Things (IoT) streamline workflows.

As part of our submission for the Intelligent App Challenge, we demonstrated how our app enables users to search securely across multiple databases and repositories using voice and text commands to find information quickly in real-time.

We combined our BOHH Labs Secure Federated Search application with our Secure BOHH(T) Bot application, running through SAP HANA and Google Cloud Platform, to enable users to not only find data and documents in a secure way off their cloud services (in this case Google Drive), but also to ask the devices they are working on to find and return specific information they are looking for in real-time.

For the challenge, we highlighted how our technology works using an IoT scenario for maintenance on a mechanical device using a hand-held device from Samsung that allows an engineer hands-free ability to access all the data needed to deliver maintenance on a device that needs service in real-time. Before starting the maintenance service, the engineer onsite connects to the BOHH Labs application and asks BOHH to find a drawing of the equipment document repository so he can see the exact location of the part that needs service, as well as the data from the last person who serviced the part and what service was completed. BOHH securely accesses the maintenance databases, the sensor database, stock inventory etc. in real-time and returns the requested data using a patented encryption method and AI technology to manage ports, maintain a secure connection and interact with user requests.

The engineer can continue to ask BOHH to connect him with information needed throughout the servicing of the device until it is completed. After the servicing is completed, the engineer can communicate with the BOHH application and provide an update on what service he did and it will automatically go directly back into the database to record the service.

This example highlights how BOHH can streamline tasks that require real-time data access and streamline workflow without the worry of third-party intervention and hacking, time-wasted looking for data or even loss of data all together. To see a demo of the above scenario on how BOHH Labs’ app works, click here.

If you like to learn more about BOHH labs, we are attending and participating in SAP TechEd 2017 and look forward to speaking to you more on how our technology works. You can also visit us at www.bohh.io for more information.