Not All Encryptions Are Created Equal

In today’s volatile digital security world, encryption has become a standard security measure to keep your data protected. Many in the security industry would even goes as far to say that it is one of the most important methods for providing data security, especially for end-to-end protection of data transmitted across networks. The core foundation of encryption focuses on converting information or data into a form unreadable by anyone except the intended recipient. Once a file or data piece is encrypted, it becomes difficult for external sources to get access/understand the encrypted information.

While highly touted, encryption is hardly a new strategy with the origins of hidden messages and cryptography dating back to the 19th century. Since then, it has evolved and there are many different types of encryption algorithms that are used. However, not all of these are created equal or are completely secure. Below are several types of today’s popular encryption algorithms all of which have security loopholes.

Homomorphic Encryption

Homomorphic encryption requires a public key to enable search. This also means it requires a keystore to hold the private key to enable the encryption. The person with access to the keystore has access to your data! This means you are putting your data at risk to internal misuse and in the hands of who owns the keystore. You don’t believe you would have an internal person who abuse this power? Nor did the CIA until Edward Snowden fled the country.

Data Masking

Data masking has generally been created as an intermediate layer between the data store and the user and is becoming more common as part of the GDPR regulations. The masking gateway accesses the data as an administrator and transforms (masks) the data on a user query. However, the stored data remains in clear text and is vulnerable. Simply put, this is really just application redaction.

TDE – Transparent Data Encryption

This technology encrypts the data file on disk, stopping anyone from reading it, while it is at rest on the disk drive. HOWEVER, as soon as it is loaded in to the database, it is decrypted and available to be viewed by all who have admin privileges. This puts the encrypted data at risk to internal misuse as admins have approved access to the keys and could decide to capitalize on this access to sensitive information. 

Column Level Data Encryption

Column level data encryption is generally implemented with a keystore, which means that those with access to the store also have access to the data. However, just as importantly, if this is implemented post production, it requires whole-sale changes to the database and the calling applications, leading many implementations to remain incomplete, as well as expensive.

As you can see, many of these encryption tools are lacking in complete external and internal security.

At BOHH Labs, we believe that the parties at the two ends of a data message – the sender and requester – should be the only ones who have access to that data message. We believe encryption should be dynamic. In other words, your keystore should be dismantled and the encryption keys, IV’s Salts, should be created by the application based on different criteria at that moment in time. This means that each piece of data, each network message, or each file is encrypted to a unique key, so it doesn’t leave your data open on your key store and accessible to unauthorized employees.  Dynamic key creation encryption that has no reliance on web security or keystores is a cornerstone of BOHH’s data security service. Every data request is isolated from the requestor and is encrypted using transient keys that are destroyed after each transaction. This means the original data request never has direct access to the company network or backend database and terminates intercepting party connections and renders partial data a third party may get access to useless, making it very difficult for to steal useable data (including a database admin). Further, by uniquely providing field level security, removing these fields from the source, storing the encrypted data and separately, without changing the underlying database structure or using a keystore to manage the encryption keys, which removes not only the hacker threat to the data, but also the more prominent insider threat.

As such, despite being popular in the security industry, it’s clear that many of the current encryption methods that have backdoors, especially for internal misuse. If you are interested in more about BOHH’s keystore-less encryption method that makes these security loopholes obsolete, reach out to learn more.

Why Policing Network Traffic Is Not Enough & the Data Itself Must be Secured

- Ken Hawkins, BOHH CTO

With Point of Sale (POS) attacks becoming more common with each passing day, securing your network traffic and data inside the network has reached a paramount point in today’s digital age. Sadly, this is not a new attack on the rise, but instead just one that has been around for a while. The tools that have worked are still working effectively and many corporations are simply walking a tightrope of risk management and data security, putting end user’s data they hold at risk. What this signifies to the end user is that their potentially sensitive data transmitted to the business is only worth securing up to a monetary tipping point, and perhaps the damage done by exposing sensitive data might well be costlier for said business to protect than to reimburse the user for that damage if it happens. I believe this is not a nefarious act by an uncaring business, rather the reality in the complexity of securing data on a business’ network, especially those who employ some type of third party POS solution who arguably have twice as many network security issues to manage based on the deployment of those POS terminals that can be another doorway both into and out of your network. This statement might not ring true in its entirety because generally through some isolation methodologies you can manage the network traffic and there are some real wizards in the realm of network traffic marshalling.

However, where I’d like to focus is on the data itself, both at rest and in transport. Both states of data are often managed via modern AES based encryption methodologies. These are strong but have one weakness that is continually exploited and is most easily described as “brute force type attacks,” which are generally defined as continually asking “can I have it?” or “Is this item correct?” Given how cheap today’s hardware is, coupled with great speed improvements in processing power, have made this questioning-based attack extraordinarily efficient on not only network attacks but also attacking blockchain-based systems like what bitcoin is based upon, but that is another discussion all together. Once we come to terms with this inherent weakness of AES we can start to effectively address the problem.

Given that a business will easily spend millions to protect access to data, it would only make sense to secure the data itself as well. But wait you say we do that, right? Well if you rely solely on the TLS/SSL transport, then you are not protecting data, rather you are attempting to hold the horde at the castle gate by monitoring access to potentially unencrypted data. Once inside, more often than not the network is wide open to the malicious code or individual and like a kid in a candy store data can be easily taken control of in some fashion and an unencrypted database can be a gold mine of information. In the enterprise business IT environment, TLS/SSL based securities can be as easily circumvented by an errant upgrade to expose data, which we have seen too many times. If that update has malicious code within it, that update could tear open a hole in it and at minimal siphon your businesses’ important documents, and worse, it could set up residence within the network. Once there, it can report back anything that happens on the network and/or machine it is on. Now of course this appears on face value to be a simple ok, just verify the updates and smart IT professionals would never, EVER blindly apply an update to a production facing server, right? Well it does happen and the majority of big breaches we hear about today are a product of that scenario. In our collective rush to “live update” hardware and software so we can develop at a faster pace and in theory adjust for attacks in real time, we forget that people make mistakes and one seemingly small mistake can destroy a company’s livelihood, not to mention the individuals who could also be affected based on the data stolen.

Once we ween ourselves off the blind reliance of secure TLS/SSL protocols to do policing of network traffic, the problem of securing data in the network is more easily addressable and ultimately your data is safer. I’m not knocking the router companies or the many permutations of lite security-based web servers and/or software-based managers. We have come a long way, and coupled with today’s learning networks, they can be effective when included with other methodologies involving elaborate routing and reporting systems and make a pretty good gate keeper against TCP layered attacks. However, most of those systems still rely on TLS/SSL as the core transport mechanism verifying the requestor, entering, exiting the network and accessing data.

In order to properly isolate data access and monitor intrusions, the IT professional today will have to take at minimal a three-pronged approach to securing the data.

1. Network traffic monitoring – Yes watch and react quickly to questionable external and internal network traffic.
2. Implement up to data access methodologies – This can be timed password rotation, hard locks on computers, etc.
3. Encrypt the data – Ensure all data on the system or systems is properly encrypted at all times.

Properly addressing these areas is no small challenge for any of us as individuals, however, for the IT professional it can seem practically impossible to always stay up to date and ahead of the hackers. Particularly addressing data encryption and access can be an ongoing battle as users want data to be secure but not have to have a complicated means of accessing it. Unfortunately, todays encryption methods use a password or some form of unique key/passphrase to encrypt data and we like to only use one password. This is a problem and always will be until we build a better mouse trap in regard to data encryption and access.

BOHH Breakdown Part 21: How to Better Protect your Cryptocurrency Investments

In our last post, we addressed how to support digital innovations without sacrificing security. Today, we are talking about the hot topic of cryptocurrency and how to better protect your investments.

Many of the major cryptocurrency exchanges have seen a major drop in price over the last few days. Bitcoin, one of the most popular cryptocurrency exchanges is reported to have had a major downfall from its highest value of almost $20,000 to now trading below $7,500 as of Monday according to an article from Ars Technica. 

Does this mean we are headed for the burst of the cryptocurrency bubble? Only time will tell if this will be the start of the end or if this is just a natural dip in the market adjusting to mainstream adoption. One thing is for sure though, with over 1,000 cryptocurrencies on the market and many celebrities jumping in on the cryptocurrency craze, there are still many people excited to jump on the cryptocurrency bandwagon.

Because cyber criminals are starting to capitalize on the money being put in to cryptocurrency trading, it’s important for users to know proper security measures to take to help keep their cryptocurrency wallets more protected. Below are several tips people should think about when they are investing in cryptocurrencies.

• Use Multi-factor authentication: this will add extra security layers for hackers to get through while trying to empty your wallet.
• Don’t store all your passwords in the same place: make sure to have your wallets and passwords stored in different places so both are not compromised in a hack.
• Use different passwords: don’t use a password that you have used before and make sure the password you choose is unique. Here is a past blog we have featured on the do’s and don’ts of picking a good password.
• Don’t save your passwords on your phone or computers. 
• Think about where you are transacting from. For example, by using public Wi-Fi, it makes you more vulnerable for someone to intercept your data in a man-in-the-middle attack. It is advisable to use your own Wi-Fi network that is setup with password protection to your cryptocurrency trading.
• Be careful of what you post on social media. This may sound silly, but by posting personal information about yourself and the cryptocurrency exchanges you are using on your social tools can give criminals easy access to find more information about you and use it to their advantage.
• Have a dedicated email for each of your cryptocurrency exchange. Never use the same one for different exchanges.
• Spread your cryptocurrencies among several wallets, so if one gets hacked, not all of them are compromised.

While these are not full-proof plans to ensure your cryptocurrency exchanges are not hacked, it does help add more layers of protection. Hopefully these tips offer some insight in security measures to take before investing in cryptocurrency exchanges. 

Come back next week and we will continue focusing on the cryptocurrency topic and look specifically at one type of attack – cryptojacking and how to protect against it.

The BOHH Breakdown, Part 12: Giving Thanks to Our Favorite Security Techniques

In our last post, we talked about some of the most famous corporate data breaches and how BOHH could have prevented them. This week, in honor of Thanksgiving, we are looking at some of the best security techniques being used to keep our data protected and giving thanks.

Encryption

This is hardly a new strategy for keeping our data protected, but it is has become a standard protocol in today’s security measures. The core foundation of encryption focuses on converting information or data into a form unreadable by anyone except the intended recipient. While encryption itself does not prevent hackers from getting access to data, it does make it unreadable to those who intercept it. At BOHH, we believe the parties at the two ends of a data message – the sender and requester – should be the only ones who have access to that data message. We use a keyless encryption algorithm from end-to-end to ensure all data – both at rest and in transit – stays protected, without any possibility of decrypting it, even at the sever level.
Artificial Intelligence

Though popular culture used to associate Artificial Intelligence (AI) with robots and science fiction, it is on the rise as a technology influencing a variety of sectors, including the cybersecurity industry. Staying ahead of hackers has become increasingly challenging. As such, the self-learning capabilities and ability to recognize patterns and anomalies within them, makes AI a great tool to detect threats. At BOHH, our AI Engine is a core component to our security approach. We use an AI Engine to do threat analysis and to prevent intrusion – it manages ports, interacts with user requests, and maintains a secure connection by identifying and removing any unwanted traffic before it is passed along and gets access to any of the backend applications or databases. 

Firewalls

Firewalls have been around for a while and are often overlooked as a part of a security strategy, but they are a useful tool to help thwart attacks from external bad actors. Much like its name describes, firewalls are used to keep networks protected and act as a first line of defense of all data traffic that passes in and out of the network. Based on pre-set rules and security requirements set by a company, firewalls examine incoming traffic against those pre-set rules and blocks unauthorized attempts trying to get in. Firewalls continue to be one of the most popular tools in the IT industry and continue to evolve over time as more sophisticated security challenges and attacks develop. At BOHH, we work in conjunction with a firewall system. The BOHH security platform sits on top of the firewall and enables full encryption inside the firewall for added security to keep data protected.

Multi-Factor Authentication 

As technology advances and hackers’ attacks evolve and become more sophisticated to take advantage of these advancements, using only a single authentication system, like a password is no longer enough. This is where multi-factor authentication comes in. The goal is to add multiple layers of security to make it more difficult for unauthorized users to take over an account. Multi-Factor Authentication is a great technique because if one factor is compromised, an attacker still has one or two other barriers to get through before successfully breaking into the target. There are many different methods to do Multi-Factor Authentication such as password followed by text, email, pin number confirmation, or even biometric authentication (voice, fingerprint, etc.) which is gaining popularity as technology advances. At BOHH, we employ multi-factor authentication via voice authentication, fingerprint or sending code confirmation messages to your mobile phone or email for verification.

Each of these technologies have a critical place in companies’ security strategy; however, each of these are just on piece of the whole puzzle and should not be the only tool used to combat security threats. For security to keep pace with the evolving and complex attacks in today’s complex environment, there must be a more holistic approach when securing data by combining the various security solutions available. 

Now that we’ve highlighted some of the security techniques we are thankful for, come back next Tuesday when we will share some of our predictions for what lie ahead in 2018.

The BOHH Breakdown, Part 10: How BOHH Brings More Confidence to IoT Security

In our last post, we talked about the rise in popularity of chat bots and how BOHH supports the security of them. For this week’s installment, we will take a look at the state of security for the Internet of Things (IoT) and how BOHH Labs’ approach brings more confidence to keeping these devices secure.

Market analysts predict dramatic growth in the adoption of enterprise cloud services incorporating IoT technologies. In fact, Gartner predicts that more than half of major new business processes and systems will incorporate some element of the IoT by 2020.
However, the world has already witnessed some of the consequences to the growing adoption of IoT with the likes of the infamous Mirai botnet that took down major companies including Twitter, Amazon, PayPal and Netflix and off the Internet. 

While this trend continues to gain popularity in updating companies’ strategies, the IoT industry continues to be a top challenge for security professionals and keeping those devices and networks safe.

Some of the major challenges companies are faced with by integrating IoT applications include:

• Many IoT products are designed with convenience in mind and don’t have the proper security measures built in place at the design level/product development, leaving them insecure from the start. 
• IoT devices often come with old or unpatched operating systems. Additionally, these systems often need frequent software updates to patch for vulnerabilities, and if users do not complete these, it opens the devices to risks.
• Most IoT devices come with a default password that users don’t often change, making it easier for cybercriminals to hack these devices and easily hop on to a company’s network that the user is trying to connect with.
• IoT devices communicate with your network, as well as multiple other outside systems and networks companies don’t have control over. This throws open the door to malicious attacks directly on the enterprise databases and applications accessed by these services.

Although the security industry has been talking about how to secure IoT devices for years now, there are still too many backdoors and insecure devices being used today. Unfortunately, with the rise in IoT networks, comes the rise of security threats and questions about who is really at the other end of the connection.  

Companies’ digital strategies should not come at the expense of security. At BOHH, we support the use of IoT devices, while keeping the enterprise network safe by enabling a secure flow of all data traffic between these devices and the end enterprise services. 

We help enterprise networks stay better protected against attacks open by IoT services by managing the whole data transaction process and working natively with the IoT devices to secure the messages that are passed back and forth between the requestor and the responder. Our approach separates out the requestor from the request and securely allows, after AI validation, the request to navigate to whatever end-point is required. This leaves the requestor waiting until the response has been collected and checked before moving it forward and returning the request to the requestor. 

Unlike other security approaches, our approach prevents a request in to the network without being validated before gaining authorized access to a backend system or application. This approach enables BOHH to separate, recognize and maintain a secure connection to all relevant enterprise systems (i.e. the many different IoT devices and systems they connect with) and prevents any third parties from trying to hop on (piggyback onto) the connection and get to the backend database/application.

The use of IoT is here to stay, and is only predicted to grow, so it is more important than ever that new security is applied to securing enterprise networks to keep pace with innovation in enterprise IoT services.

Now that we’ve highlighted how BOHH helps enhance IoT security, check back in next Tuesday when we take a look at some of the most popular past breaches and how BOHH could have helped.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Hilton data breaches lead to $700,000 penalty

The attorneys general of New York and Vermont both announced today that their joint investigation into two Hilton data breaches has resulted in a $700,000 penalty and a promise to strengthen security. In all, over 363,000 credit card numbers were exposed. Read more…

Trump Organization didn't discover shadow subdomains with Russian IPs for four years

A series of shadow subdomains, all with Russian IP addresses and associated with malware campaigns, were created after hackers accessed the domain registration account of the Trump organization and likely went undiscovered until as recently as this week. Read more…

Unencrypted USB stick with 2.5GB of data detailing airport security found in street

An unencrypted USB flash drive detailing airport security and anti-terror measures was found on a street and sparked an investigation by Heathrow Airport. The USB stick, which contained 2.5GB of data, was neither encrypted nor required a password to access it, and contained 76 folders, packed with maps, documents and videos, even security measures to protect the Queen. Read more…

Malaysian data breach sees 46 million phone numbers leaked

A massive data breach has seen the customer data of more than 46 million mobile subscribers in Malaysia leaked on to the dark web. The leaked information includes mobile numbers, unique phone serial numbers, as well as home addresses. Read more…

The BOHH Breakdown, Part 8: Many Breaches Are Preventable – Let’s Look at How

In our last post, we revisited some of the most pressing cybersecurity trends in 2017 and tracked where the industry is at as the end of the year nears. Today, we will address an important subject: breaches and how many of them can be prevented. 

This year has seen its fair share of major breaches – from WannaCry and Petya to Equifax and the recent Deloitte email server hack. All these breaches have something in common – and it is not just the fact that millions of records were exposed – they all could have been prevented or greatly reduced by simple patches and software updates.

Unfortunately, these are just a few of the attacks that could have been prevented by simply updating software systems and vulnerabilities. While security is no easy feat, it is becoming too common that many breaches are occurring due to companies’ negligence caused by failure to update software components that are known to be vulnerable for months or even years.

There is no excuse for breaches when there are known security updates available to fix the vulnerabilities. A large part of the issue today is that companies have not been prioritizing these fixes and other security solutions. Below are several recommendations from BOHH Labs that companies can employ to help bring better tools to their security strategy.

Update old systems and Implement Security Patches 
Businesses often ignore server patches or updates until they encounter issues. When this happens, hackers use malware and other type of attacks to exploit these holes and get into your system. Because Software systems are constantly evolving, security updates and patches are commonly released to keep up with software improvements. Often, these patches come with instructions to make the updates and failure integrate these into your system can lead to vulnerability and allow hackers to gain access company and customer data.

Implement a Zero Trust Model
In today’s complex cyber world, there is no longer any trust in security. It is clear there are no longer a trusted and an untrusted engagement on our security devices, on our networks or even users. It is time companies eliminate the idea of a trusted network and start implementing a zero-trust model approach that views all users and network traffic as untrusted that must be verified and enforce strict access control. At BOHH Labs, we have embraced the Zero Trust Model into our security approach and prevent unauthorized third-party interaction with all data traffic by a keyless encryption algorithm that automatically invalidates data when accessed by unauthorized users, rendering it useless to the unauthorized party.

Break the Data Request for Better Security
Following off the concept of the Zero Trust Model, it is important not to assume that every data request that comes in is from a trusted source. As such, a user’s data request should never have direct access to the network server as there could be malicious attackers who have jumped on to the connection to get entrance into your system. One way to help prevent this situation is to break every data request before it goes into your network. At BOHH, we employ this technique and when a data request comes in to the company network, the BOHH security appliance receives the request first and decrypts the request before passing it through, knocking out any other requests trying to hop on the original request and get into the network.

Encrypt End-to-End
Encryption is a great tool to help keep data protected, but if the data is not encrypted from end-to-end in the transaction process, it leaves an opening for hackers to get access to that data once they have penetrated your system. At BOHH, we believe the parties at the two ends of the data message – the sender and requester – should only have access to that data message. At BOHH, we use keyless encryption from end-to-end to ensure all connections to backend assets reveal no infrastructure details to an attacker as to location of firewall, keystore, database, or other assets if they find a way in to the network. End-to-end encryption is key to keeping data encrypted, without any possibility of decrypting, even at the sever level.

There is no sign of hackers and attacks against companies stopping any time soon but these are a few tools companies can use to help stay better protected from tomorrow’s breach.

Now that we’ve highlighted some ways companies can increase their potential to prevent data breaches, check back in next Tuesday when we take a dive in to the world of bots and how they can be used to securely.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

NotPetya cyber attack on TNT Express cost FedEx $300m

Falling victim to the Petya cyber attack cost FedEx around $300m during the last quarter of the financial year, the company has revealed in its latest earnings report. Operations of FedEx's TNT Express unit in Europe were disrupted by the attack and the company previously warned that the financial cost of the incident was likely to be significant. Read more…

Equifax hackers likely in network since March

It took Equifax 141 days to discover a breach that exposed the data of 143 million U.S. consumers with hackers likely accessing the credit monitoring firm's systems in March, a full two months before Equifax originally said they did. Read more…

Hackers May Have Traded on Stolen SEC Data

The chairman of the U.S. Securities and Exchange Commission will face a Senate committee next week following the agency's disclosure that hackers pulled secret market data from its systems and possibly used it to conduct trades. Read more…

CCleaner Malware Targeted Tech Giants Cisco, Google, Microsoft

The backdoor discovered in Avast's CCleaner targeted top tech companies including Google, Microsoft, Samsung, Sony, VMware, and Cisco. When Cisco Talos and Morphisec discovered a version of Avast CCleaner had been compromised to deliver malware, it was bad enough to learn millions of endpoints were threatened. Now, security experts say the attackers had espionage in mind. Read more…

The BOHH Breakdown, Part 1: How to Get Closer to a Cure for Cyber Hacks

In the first installment of the BOHH Breakdown series, BOHH Labs’ CEO and search and security expert Simon Bain, outlines the steps needed for the industry to prepare for the increasingly complex world of cyber warfare.


The incidents of cybercrime continue to rise every day at alarming rates. As ransomware, fraud, Point-of-Sale, phishing, keylogging, and malware-based attacks and more continue to gain traction, organizations are at increased risk of enduring costly hacks that grow more intricate and difficult to prevent each day.

Even though organizations have the industry’s best solutions: firewalls, VPN’s, SSL certificates, encryption, and authentication policies, we still see on a daily basis that millions, and in some cases billions, of records (for example, consumer information, money, and private personal details), are stolen from these so-called secure systems. 

So how do we go about fixing this?


Diagnosing the Problem

What’s wrong with cybersecurity today? Currently, most security solutions are merely analyses of the network that assess network holes and system weaknesses without patching or offering fixes. Simply put, the main focus and financial investment is on support for early detection and minimizing the impact of attacks; however, this does not address the root of the problem. 

In essence, it’s like getting a diagnosis from your doctor without receiving any guidance on treatments: “We noticed that you’re sick and the operation will be costly. Good luck.”

Immunizing the Disease 

Detecting security weaknesses is not enough to keep hackers, bent on stealing resources and consumer funds and information, from winning. 

Security systems need to evolve automatically with each new call; they need to be able to react to situations, like how the human immune system reacts to an incoming disease – much like an immunization can react when germs enter the body, rather than creating feeble and unrealistic goals to prevent the germs spreading disease in the first place. 

Similarly, data must be protected from within. It is up to organizations to try preventive measures initially, to stop the disease – in this case the hack – in the first place and to protect consumer data before there’s a threat.

Rebuilding the “System”

The first step the industry needs to take: Rethink the entire approach to protecting data.

Instead of only securing the network from the outside in, the focus must turn to tools securing the network inside out. This starts by turning a critical eye to the shortcomings of current solutions. 

• Firewalls help with external hacks, but cannot defend against internal ones and other sophisticated attacks. 
• Database encryption, perhaps among the most buzzed about solutions today, is also among the most insecure methods in use. 
• VPNs are of varying effectiveness that are only as good as the users’ knowledge of protocols and public Wi-Fi and password management.
• Two-Factor Authentication: Though this may seem more secure that just having a password, two-factor authentication technologies actually face many of the same risks as password-driven systems.
• SSL Certificates: Too often people think simply using SSL certificates protects them from all web security vulnerabilities. While SSL certificates offer an encrypted connection between the client server, many servers are badly configured and often expose data instead of securing it.

Current technologies still have a part to play in security, but they remain unreliable in a vacuum without addressing their vulnerabilities in the first place. 

Creating a Collaborative “Vaccine”

Improving security in 2017 requires industry collaboration. With all the detection solutions being employed currently, organizations must share the insights they learn during the nearly constant stream of hacks they face daily. 

Take virus protection – everyone shares that information publicly and within a few hours the virus is dead. Most organizations do not want to disclose to the public incidents of breaches for fear of damage to their reputation and customer loyalty, but without open communication organizations are not making progress when it comes to security analysis and preventing future hacks. 

While some organizations have started to unite behind closed doors and there are industry regulations emerging on how and when to report a breach, the industry as a whole needs to create a knowledge-sharing standard. The reality is that most hackers collaborate, so organizations should too.

If industry wants to take steps in improving security in 2017, we must reevaluate the approach and commit to investing in security by viewing it as an integral part of an organization’s livelihood and not just a routine, integrated process. 

Now that we’ve addressed how the industry can get closer to a cure, come back next Tuesday, when we will share with you how BOHH Labs is the way forward to secure organizations in the new wave of cyber warfare. 

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

1. Incredible Shrinking Bank Populations

The number of U.S. banks has fallen by 24% since the end of 2010, a result of mergers, failures and a dearth of de novo activity. Read more…

2. Targeting the Weak Link in the Supply Chain: Amazon Third-Party Sellers Hacked

Tens of thousands of dollars have been stolen from seller accounts, and fake items have been listed for sale to steal even more money. Read more…

3. Simply Entering your Phone's Password Is Now Enough to Compromise It

As more and more of our personal data is stored on smartphones, the ways of securing those phones continue to be revealed as less and less robust. Next on the chopping block is your trusty PIN. Read more…

4. Hacked Dallas Sirens Get Extra Encryption to Fend Off Future Attacks

After being hacked last week setting off 156 emergency sirens, Dallas city officials have added extra encryption and other security measures to the outdoor warning sirens. Read more…

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

1. UK government renews calls for WhatsApp backdoor after London attack

Following last week’s terror attack in London, the government has renewed calls for access to read messages on end-to-end encrypted messaging apps. Read more…


2. FBI: Attackers Targeting Anonymous FTP Servers in Healthcare

The FBI has issued a warning that threat actors are going after anonymous File Transfer Protocol (FTP) servers associated with medical and dental organizations. Read more…

3. US House votes to undo broadband privacy rules

The U.S. House of Representatives has followed in the footsteps of the Senate in voting to repeal privacy rules that can prevent broadband providers from selling customers’ internet-browsing histories and other data without their permission. Read more…

4. Were the robbers behind the Bangladesh Central Bank job North Korean?

Authorities are reportedly closing in on the culprit behind the February 2016 Bangladesh Central Bank heist. Not only does the FBI officially believe the robbers to be state sponsored, but unofficially authorities suspect they are North Korean. Read more…

How to Stay Protected During Tax Season

Tax season is upon us, and as individuals and companies alike start gathering their information, it is important to remember to stay protected while filling out personal, tax, and financial data at home and online. Due to the nature of the information reported during tax season, people continually become victims of cybertheft carried out by cybercriminals looking to steal social security numbers, account numbers, password information and other sensitive information. Below are several tips to help you stay better protected while filing taxes this season.

• Check for encryption on websites when filing your taxes online. Look for a small lock icon somewhere on your browser and URLs that begin with “https:” This means the site is secured and your data is encrypted.
• Make sure your security software is up-to-date, regardless of if you are using a computer or mobile device.
• Encrypt sensitive files such as tax records, account numbers, etc. that you store on your computer. Also, make sure you your social security card and tax records are kept in a safe place in their physical forms.
• Phishing attacks are more frequent than ever and are projected to be one of the top methods for cybercriminals to carry out scams this season. Learn to recognize and avoid phishing emails, threatening calls, and texts from thieves posing as legitimate organizations such as your bank, credit card company, and even the IRS. The IRS will NOT email you. Be cautious on what links you click on and don’t download attachments from unknown or suspicious emails.
• Don’t respond to emails that claim to be from the IRS (or any other company) requesting your account details. Do not ever send personal information or credit card information via email. It is best to call back instead using a phone number you can verify from their official website.
• If you are filing your taxes online using a computer, think about where you are doing it from. For example, by using public Wi-Fi, it’s rather simple for someone to intercept your data in a man-in-the-middle attack. It is advisable to use your own Wi-Fi network that is setup with password protection when filing your taxes online. If you can’t file your taxes at home, you can still check your account on the go, just make sure your device is using cellular data instead of Wi-Fi.
• If you are using an online tax software to file your taxes, make sure you use strong passwords for your account. Create a password that can’t be easily guessed by a human or computer. This typically means a password with 8 or more characters, including letters, numbers and symbols. It is also advisable to use different user IDs and passwords for your financial accounts and for any other sites you use online.
• Sign out when you finish filing your taxes online. This may sound easy, but you should always log out of your online session rather than let it expire. This will help reduce the chances of your session being hacked. Most site will log you out automatically after you are idle for a couple of minutes, but logging out is still a good habit.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

1. WikiLeaks reveals the CIA hacked into Apple iPhones, Google Android phones and Samsung TVs

All the buzz this week is about how WikiLeaks released over 8,000 pages of documents detailing numerous CIA programs that appear to undermine encryption in iPhones, Google’s Android phones, Samsung smart TVs and other connected devices. Read more…

2. Researchers Find Multiple Critical Flaws In Confide Secure Messaging App

An app that is supposed to be used for secret communications by political operatives in DC was found to have several security flaws. The app says they have all been fixed now. Read more…

3. Latest Executive Order Draft Promotes Risk-Based Approach

The latest version of the draft of a cybersecurity executive order from the White House would direct the federal government to take a risk-based approach to IT security and hold cabinet secretaries and agency heads responsible for the security of their organizations' IT assets. Read more…

4. Fears of election hacking spread in Europe

The U.S. may not be the only one to face cybersecurity concerns in relation to national elections. France has followed the Netherlands in placing its faith in paper-based voting systems ahead of key elections later this year, following allegations that Russian hackers influenced last year's U.S. presidential election. Read more…

Security Takeover: When Internal Sources Turn on You

As cybersecurity continues to be at the top of mind for organizations, most of the conversation has surrounded keeping information safe from external threats and hackers, with little attention given to internal security threats. What about the unhappy employee, the ex-employee who was recently sacked, an employee who has an axe to grind, or even an employee who simply stumbled upon sensitive information and decided to capitalize on it? All of these internal sources have approved access to data, passcodes, keys and so on that can pose as security vulnerabilities to your organization.

In fact, according to the 2016/17 Kroll Annual Global Fraud and Risk Report¹, 60% of respondents who worked for companies that suffered from fraud identified a combination of perpetrators that included current employees, former employees, and third parties. Furthermore, an overall 44% of respondents reported that insiders were the primary perpetrators of a cyber incident, with former employees the most frequent source of risk (20%), 14% citing freelance or temporary employees, and 10% citing permanent employees.

Threats that come from within are difficult to defend against, because a one-size-fits-all solution and traditional security products like firewalls, VPNs and SSL do not work in this case. With access to the company network and the ability to fly under the radar, the disgruntled employee can use inside knowledge to share a virus, share or sell documents with rivals, or misuse company and personnel data for other benefits. While internal threats are difficult to defend against, there are several actions you can take to try be as protected as possible. Below are several tips on practicing safe internal security.

• Implement File Level Encryption: Add an extra level of security to your sensitive data. As with web apps, all of your files should be encrypted in addition to any current security and encryption that you deploy. Full data encryption solutions encrypt the entire hard drive from the operating system to all applications and data stored on it. As information is read from the disk, it is decrypted and any information written to the disk is encrypted in turn. Without the encryption key, the data stored on the disk remains inaccessible.
• Disable Key Stores: Encryption should be dynamic. In other words, your Key Store should be dismantled and the encryption keys, IVs and Salts, should be created by the application based on different criteria at that moment in time. This means that each piece of data, each network message, or each file is encrypted to a unique key, so it doesn’t leave your data exposed on your key store and accessible to unauthorized employees.
• Define Levels of Access: Each employee in the company is important, but some have more need to access sensitive data than others. One security measure that could add protection to sensitive data is for IT to define the level of access that employee has and to assure that access levels are maintained whether employees are working behind or beyond the corporate firewall depending on their role.
• Remove Access Rights: When a member of your staff moves, whether it is externally all together from the company or even just a different department from within, the first measure that must be taken is changing the access rights of that employee. IT should be immediately notified to revoke all computer, network, and data access the employee who is moving on has and should be documented for legal purposes.

• Less is more: When you are dealing with sensitive information, it is a good rule of thumb to limit the amount of people who have access to it. Having fewer people with access to your most sensitive documents helps protect it from being misused.

¹ The Kroll Annual Global Fraud and Risk Report 2016/17 includes a full detailed industry analysis across a range of fraud categories and regions. 

Security is All Around Us, Why Isn’t It Working?

Simon Bain, CEO of BOHH Labs

Security is all around us. We have firewalls, VPN’s, encryption and policies. Yet still it seems that millions, and in some cases billions of records, (our information, our documents, our money and our private details) are stolen from so called secure systems.

Why?

I believe that the reason for this is very simple. Security has become a buzz word. “Yes of course our systems are secure;” “We use the latest security systems;” “We employ the most up to date security systems and policies” …

In these cases, the word security has been used as an excuse not to go in to details or to throw off blame and recrimination. Yahoo sent this sentence to its users after its breach announcements, “We continuously enhance our safeguards and systems that detect and prevent unauthorized access to user accounts.” What does it mean? “We continuously …”

So there is continuous monitoring, yet still it would seem up to 1 billion records seem to have been stolen?

It is time for a change. Security needs to be taken seriously. Not used as a funding mechanism, or a word that corporations can use to try and shift responsibility to someone else when a theft of data happens. Yes, theft of data. Let’s stop talking about hacks and hackers. This word in my lifetime has had different meaning, from a general reporter, a kid in his bedroom having fun, to statewide intrusions into systems. Let’s start talking about these attacks as theft. Theft of our data, our money and our privacy.

Security systems need to come up to scratch. Firewalls help but they are poor defenses for theft that has arisen from an internal source. Database encryption is only as good as the administrators of the database and password hashing let it just stop being used. In today’s climate, we need systems in place that are more dynamic in nature. These systems need to change automatically with each call, they need to be able to react to situations, much like an immunization against TB can react when the real TB bacteria enters the body. An immunization against a disease is not there to stop a bacterium entering your body, but when it is in, it renders it useless without disrupting the body’s ability to carry on. It is up to you to try and stop the disease in the first place. That is where Firewalls and policies have a role. But today we also need the immunization program, one that creates systems that can protect our data from within. A system that does not hinder the role of the system even under an attack and one that renders the information useless to all but those who are authorized to view it.

Security needs to become more dynamic in its role within the enterprise. We in the industry need to start redefining how security is seen, and more importantly, how security WORKS.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

1. Phone-cracking firm Cellebrite hacked
   Cellebrite, an Israeli firm that markets hacking tools, is the latest victim of a cyber attack. Information about its customers has been compromised. Read more…
2.  Giuliani announces he’ll be Trump’s czar for the cyber thing 
   The former mayor of New York will be leading up a cybersecurity advisory group for the Trump administration. Giuliani’s appointment of this role stems from his time as chair of the “Cybersecurity, Privacy and Crisis Management Practice” at the New York law firm Greenberg Traurig. Read more…
3. Ukraine power cut ‘was cyber-attack’
   This week, researches declared that a power cut that affected Kiev, the Ukrainian capital, in December 2016 was indeed a cyber-attack. This was also linked to an incident to a hack and blackout in 2015 affecting more than 225,000 people. Read more…
4. Deloitte opens blockchain lab in New York to push for working prototypes
   Deloitte will open a laboratory in New York to explore blockchain solutions for the financial services industry. This is the second lab Deloitte has opened dedicated to blockchain. In total, they have 800 people in 20 countries dedicated to blockchain. Read more…
5. FTC vs. D-Link: A Warning to the IoT Industry
   The Federal Trade Commission filed a complaint against router and camera manufacturer D-Link for its poor security practices. Could this lead to the beginning of a long battle to fix systemic industry problems surrounding IoT and security? Read more…