Why Policing Network Traffic Is Not Enough & the Data Itself Must be Secured

- Ken Hawkins, BOHH CTO

With Point of Sale (POS) attacks becoming more common with each passing day, securing your network traffic and data inside the network has reached a paramount point in today’s digital age. Sadly, this is not a new attack on the rise, but instead just one that has been around for a while. The tools that have worked are still working effectively and many corporations are simply walking a tightrope of risk management and data security, putting end user’s data they hold at risk. What this signifies to the end user is that their potentially sensitive data transmitted to the business is only worth securing up to a monetary tipping point, and perhaps the damage done by exposing sensitive data might well be costlier for said business to protect than to reimburse the user for that damage if it happens. I believe this is not a nefarious act by an uncaring business, rather the reality in the complexity of securing data on a business’ network, especially those who employ some type of third party POS solution who arguably have twice as many network security issues to manage based on the deployment of those POS terminals that can be another doorway both into and out of your network. This statement might not ring true in its entirety because generally through some isolation methodologies you can manage the network traffic and there are some real wizards in the realm of network traffic marshalling.

However, where I’d like to focus is on the data itself, both at rest and in transport. Both states of data are often managed via modern AES based encryption methodologies. These are strong but have one weakness that is continually exploited and is most easily described as “brute force type attacks,” which are generally defined as continually asking “can I have it?” or “Is this item correct?” Given how cheap today’s hardware is, coupled with great speed improvements in processing power, have made this questioning-based attack extraordinarily efficient on not only network attacks but also attacking blockchain-based systems like what bitcoin is based upon, but that is another discussion all together. Once we come to terms with this inherent weakness of AES we can start to effectively address the problem.

Given that a business will easily spend millions to protect access to data, it would only make sense to secure the data itself as well. But wait you say we do that, right? Well if you rely solely on the TLS/SSL transport, then you are not protecting data, rather you are attempting to hold the horde at the castle gate by monitoring access to potentially unencrypted data. Once inside, more often than not the network is wide open to the malicious code or individual and like a kid in a candy store data can be easily taken control of in some fashion and an unencrypted database can be a gold mine of information. In the enterprise business IT environment, TLS/SSL based securities can be as easily circumvented by an errant upgrade to expose data, which we have seen too many times. If that update has malicious code within it, that update could tear open a hole in it and at minimal siphon your businesses’ important documents, and worse, it could set up residence within the network. Once there, it can report back anything that happens on the network and/or machine it is on. Now of course this appears on face value to be a simple ok, just verify the updates and smart IT professionals would never, EVER blindly apply an update to a production facing server, right? Well it does happen and the majority of big breaches we hear about today are a product of that scenario. In our collective rush to “live update” hardware and software so we can develop at a faster pace and in theory adjust for attacks in real time, we forget that people make mistakes and one seemingly small mistake can destroy a company’s livelihood, not to mention the individuals who could also be affected based on the data stolen.

Once we ween ourselves off the blind reliance of secure TLS/SSL protocols to do policing of network traffic, the problem of securing data in the network is more easily addressable and ultimately your data is safer. I’m not knocking the router companies or the many permutations of lite security-based web servers and/or software-based managers. We have come a long way, and coupled with today’s learning networks, they can be effective when included with other methodologies involving elaborate routing and reporting systems and make a pretty good gate keeper against TCP layered attacks. However, most of those systems still rely on TLS/SSL as the core transport mechanism verifying the requestor, entering, exiting the network and accessing data.

In order to properly isolate data access and monitor intrusions, the IT professional today will have to take at minimal a three-pronged approach to securing the data.

1. Network traffic monitoring – Yes watch and react quickly to questionable external and internal network traffic.
2. Implement up to data access methodologies – This can be timed password rotation, hard locks on computers, etc.
3. Encrypt the data – Ensure all data on the system or systems is properly encrypted at all times.

Properly addressing these areas is no small challenge for any of us as individuals, however, for the IT professional it can seem practically impossible to always stay up to date and ahead of the hackers. Particularly addressing data encryption and access can be an ongoing battle as users want data to be secure but not have to have a complicated means of accessing it. Unfortunately, todays encryption methods use a password or some form of unique key/passphrase to encrypt data and we like to only use one password. This is a problem and always will be until we build a better mouse trap in regard to data encryption and access.

AI, NLP, Blockchain: Yes, We’re on The Buzzword Bandwagon but Here's Why

- Simon Bain, BOHH Labs CEO

Like every year, there are certain technologies that get more attention than others. Right now, some of the biggest ones making a good run include Artificial Intelligence (AI), Natural Language Processing (NLP) and Blockchain. Based on the number of companies or new products that have come out of the woodwork using these technologies, it’s clear people love to use buzzwords and tout they are using the hottest, most innovative technology on the market to gain competitive edge and create the illusion of being a forward-thinker. However, many companies jump on the buzzword bandwagon simply because it is something popular everyone is doing, and so they do it too. While this may just sound like a lame popularity contest giving you nightmares of your high school days, when this strategy is applied to something critical like data security, there can be serious ramifications for companies laying all their eggs in one basket and settling for solutions that are hot at the moment.

Before I go on about how bad it is to jump on buzzword bandwagons, I first must address that at BOHH Labs we do apply the AI, NLP and Blockchain technology buzzwords taking the industry by storm. However, what makes our approach unique is that we do not rely on just one of these, but instead use them in an interconnected way that helps us ensure we can secure all user, applications and data access. So yes, we do fall in to the bucket of one of those companies using buzzwords, but we leverage the benefits that make each one of them unique in to a full-encompassing security solution. Below is a breakdown why and how we apply each of these technologies:

• Artificial Intelligence (AI):  AI uses a compound set of algorithms to detect patterns and predict outcomes from a large amount of data online, as such, the self-learning capabilities and ability to recognize patterns and anomalies within them, makes AI a great tool to detect cybersecurity threats within the network in real time. We use an AI engine to do threat analysis and to prevent intrusions. Our AI manages ports, interacts with and processes user requests, and maintains a secure connection by learning, identifying and removing any unwanted traffic before it is passed along and gets access to any of the backend applications or databases. 
• Natural Language Processing: NLP is a great tool to connect the gap between human and machines as technology continues to advance and will have many advantages to streamlining processes. Our NLP is critical to ensuring the BOHH solution works properly. It works like most human brains work. When a request comes in, it determines if it is a command or question, then it does entity recognition, looks and finds the answer from the correct database(s), performs any additional processing math, and then formats the response and passes it back. 
• In-Memory Distributed Blockchain Ledger: The underlying technology of blockchain offers great potential to bring more granularity to areas where you have an open network of millions of transactions. It offers the potential of an unchangeable, universally visible ledger that creates its own audit trail, decreasing the possibility of backdoor transactions. We use an encrypted In-Memory Distributed Blockchain Ledger. Unlike other standard databases, the ledger fields do not hold complete data. This means that the database service requires less memory and processing power, less management of resources for the database itself and controls field level access of data down to an individual or device level. The power of this is that you can have multiple devices accessing a single database and table, yet each can only access a single field managed by that database regardless of the SQL query that has been sent. 

There you have it. To sum up, I believe it is my role as a technologist to help companies understand why it is important to invest in security technologies that will make an impact on their solution, and not just apply something new that is hot now.

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Equifax data breach affected 2.4 million more consumers

The 2017 Equifax data breach has expanded again, with the company announcing last week that another 2.4 million U.S. consumers had their information stolen. Read more…

Massive Coin-Mining Attempt Targets Nearly Half a Million PCs

Microsoft has averted a massive and widespread campaign that would have seen tens of thousands of machines impacted. The software giant reported that on March 6, "Windows Defender AV blocked more than 80,000 instances of several sophisticated Trojans that exhibited advanced cross-process injection techniques, persistence mechanisms and evasion methods." Read more…

DDoS Record Broken Again as Memcached Attack Hits 1.7 Tbps

Days after a massive 1.35 Tbps DDoS attack against GitHub, an even larger attack reported at 1.7 Tbps by Netscout Arbor emerges to become the largest DDoS yet. Read more…

Code for massive 'Memcrashed' DDoS attack made public

You, too, can now attempt a record-setting denial-of-service attack, as the tools used to launch the attacks were publicly posted to GitHub this week. Proof-of-concept code by Twitter user @037 combined with a list of 17,000 IP addresses of vulnerable memcached servers allows anyone to send forged UDP packets to memcached servers obtained from the Shodan.io computer search engine. Read more…

Why Data Security Must Be Treated as a Core Business Value

- Ted West, BOHH Labs Chairman

What makes a company successful? Ask almost any enterprise today and they will tell you that strong revenue, a loyal base of customers and forward-thinking are the keys to ensuring long-term success. However, in our digitally-driven, cloud and mobile-dispersed business world, security is becoming a top priority for more and more organizations, especially for the customer, operations and transactions data they hold. When companies are hit with a data breach or expose sensitive data to “bad actors”, the ramifications can be huge: loss in customers, reimbursement to customers, legal fines and data recovery fees, or perhaps even something worse – damage to reputation. All of these repercussions of a data breach can greatly impact the success and revenue stream of a business, yet data security is still largely viewed as a role of the CIO, CISOs or whomever is in charge of the company’s security strategy.

Most CIOs acknowledge that cybersecurity is a core expectation of their leadership, yet many believe that companies still view security and risk management as mere “compliance chores” and a “cost of doing business.” Industry analysts report that more companies are increasing spending on security investments. However, if companies are making investment decisions in security simply based on implementing what meets the minimum requirements of securing data, and they are not looking at how these investments directly impact business strategy and the bottom line, they will likely fall short of what is needed. 

Data is an asset

It’s clear data is an asset to businesses and holds a lot of weight to how successful a business can be. It’s no secret that most businesses today are happy to put investments in to analyzing data to increase sales and market shares, but those analytics are not useful if business can’t keep their data protected. Business leaders, starting from the Board of Directors and moving through the C-suite, must insist on their organizations adapting the most effective security measures in their IT platforms and workflows and processes today keep the data they hold secure. Their success depends on it. They have no choice, and they should expect nothing less. While this task is not always easy, there is a great opportunity for those businesses who do place importance on keeping data protected and treating it like a core business value to gain a competitive advantage and strengthen their ability to keep the “bad actors” from compromising their good data, their customers’ trust and loyalty, and their critical brands.

Data security is becoming existential, no longer circumstantial, for many organizations

With the current climate of breaches revealed daily and the number and scope of attacks on the rise, organization leaders must start asking themselves: Is fixing a security breach that exposes millions of client records and brings financial and brand damage merely a “compliance chore”, or is it more than that? Is the investment needed to prevent such a breach from happening again a simple “cost of doing business”, or is it more than that? Is fixing a breach, or guarding against it in the first place, a strategic issue impacting the trust and reputation of the organization and its position to grow and retain a loyal base of customers? We think so.

Mastering Digital Transformation with BOHH Labs For Simple, Secure Data Access

- Alan Jamieson, BOHH VP of Business Development

Today, data security and the ease of data access for customers and employees is at the forefront of enterprises minds, including which solutions to deploy and where they should fit in to the company and product roadmap design. However, one critical piece to mastering digital transformation is ensuring that there is a secure data platform behind the transformation, which is becoming vital in our increasingly regulated world. Plus, add to the fact that once data loss has occurred, customer ‘trust’ is broken and can impact business moving forward.

At BOHH, our philosophy is data privacy and securing applications without restricting data access. We believe it is critical to support customers and employees alike without sacrificing productivity for security or vice versa.  Coming from a secure federated search background, BOHH knows being unable to quickly and easily find information can result in the loss of customers and wasted employee time.  Now, we combine that with BOHH’s secure application gateway (often classified within the CASB domain) to ensure data is secure, plus accessible in encrypted and unencrypted format using keyboard and voice requests.

In order to provide a secure and enterprise solution, our gateway is built using our own technologies, including: Artificial Intelligence (AI), Natural Language Processing (NLP), chatbots, etc. to prevent the bad guys (unwanted intruders) from accessing corporate access.  Put simply, we prevent squatters from accessing your property to steal customer data, pricing information, intellectual property (IP), etc. Once they are inside, the damage is done, so prevention of unauthorized access is paramount.

Our security gateway is vendor agnostic, so it can support Cloud (public or private) or on prem deployments.

While we put a lot of focus on securing data, we also help users get simple access to their data using type-and-text keyboards or the increasingly popular voice-activated requests such as bots or Robotic Process Automation (RPA) capabilities. The use of mobiles, computers, tablets etc. is constantly changing, and the younger generation has become accustomed to using these tools to ask for data/information to complete their tasks, while the older generation is still more traditional and keyboard-centric. Additionally, the customers are embracing more of these innovations, especially voice-activated home devices to ask for information, place orders etc. As such, a solution is needed to secure these transactions, and more importantly, enable access to all enterprise systems to quickly find the answer to asked questions. 

This is where BOHH’s unique capabilities come in to help enterprises securely master digital transformation and seamless access to data:

Our AI engine is used to manage various components within our gateway such as dynamic ports, Denial of Service attacks, our keyless AES 256 encryption, entity mappings, and security attacks.

Our NLP engine has been designed to think as we humans do. We break down questions into contact and entities, which we then search within across the data platform. We access the answer, we use a probability engine and process additions (i.e. weight in Kg’s not stone) to deliver the most relevant answer to the question.  BOHH’s NLP enables data assets to be securely and quickly searched, as we find answers from within data assets and avoid the need to build an answers/Frequently Asked Questions (FAQ) database. This significantly reduces the time to deploy a voice-activated front end on to a RPA or chatbot application.

Our Block Ledger database is designed to support the increasing world of Internet of Things (IoT), especially the ability to access or isolate a specific robot in a manufacturing plant if an intrusion attack occurs.

In summary, BOHH’s security application gateway provides greater security and data access capabilities to existing technologies and offers enhanced and complementary capabilities to support the enterprise goal of secure data, but with easy data access. After all, what good is data if it can’t be accessed?

For more information, please go to www.bohh.io

Weekly News Roundup

Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

23,000 HTTPS certificates axed after CEO emails private keys

A major dust-up on an Internet discussion forum is touching off troubling questions about the security of some browser-trusted HTTPS certificates when it revealed the CEO of a certificate reseller emailed a partner the sensitive private keys for 23,000 TLS certificates. Read more…

Equifax Discloses 2.4 Million More Mega-Breach Victims

Equifax says it identified 2.4 million U.S. consumers whose names and snippets of their driver's license numbers were stolen, adding to what is one of the largest and most sensitive data breaches on record. Read more…

Big banks want to weaken the internet’s underlying security protocol

The tech and financial industries are butting heads over the latter’s push to intentionally weaken a security protocol that underlies how the public securely accesses the vast majority of the internet. Critics are charging that the financial industry is pushing for a weakness in the new version of the Transport Layer Security (TLS) protocol, all for the sake of avoiding the time, effort and resources needed to adapt to the new standard. Read more…

Another massive DDoS internet blackout could be coming your way

A massive internet blackout similar to the Dyn DNS outage in 2016 could easily happen again, despite relatively low-cost countermeasures, according to a new study. The DDoS attack on Dyn took many major web sites offline for most of a day, including Twitter, PayPal, Reddit, Amazon, and Netflix. Millions of compromised IoT devices, belonging to the Mirai botnet, flooded Dyn's DNS service with up to 1.2 TBps of bogus traffic, making it impossible to respond to genuine DNS requests for their customers' websites. Read more…

Confessions of a Marketer: Data Is Everything, But I Won’t Share Mine Until I know It’s Securely Protected

You might think that as a marketing professional, I would be fascinated by loyalty programs and their power to grow revenue by creating repeat sales and building customer relationships. (I am!) So logically you might expect me to sign up for every loyalty program possible where I regularly spend $, to both experience it as a marketer, as well as reap the benefits of being a member. (Free makeup samples at Sephora! Special discounts at Rite Aid! Birthday bonuses from Anthropogie!) The truth? I avoid Loyalty Programs like a middle seat on a 6-hour flight.

I avoid all manner of giving away personal info to companies, even ones where I regularly spend my cash. My privacy is worth more to me than free mascara samples and 20% off coupons. I know how valuable my personal details are to the marketing team at a company, but its security is far more valuable to me than any incentive a company has ever dangled in front of me. I’m not giving it away just for a discount on a new spring skirt or some cute espadrilles. I’d rather spend the extra $ and keep my personal info secure. Why?  For one, it is clear by the breaches that happen almost daily now, that companies are struggling to protect customers’ data. Just look at some of the more recent breaches from top-name companies: Equifax – exposed data of 143 million customers; Uber – over 56 million customers affected by a data breach, and there is still aftermath from the Yahoo data breach that happened years ago with it being revealed last year that the number of people affected jumped from 1 billion to 3 billion. Secondly, working in the security industry, I just know too much know about data security to feel confident my data will be secure. The risk of accidental or intentional exposure of my data is far too high in today’s world.

There is not always a lot of control users have when it comes to data breaches, but one small line of defense I can take is to control how much of my information I share with the companies and services I am using.

As a customer, I would never sell my personal info and my purchase history for some free samples or a birthday discount because I don’t think we fully understand the implication of privacy breaches in our data driven economy yet, other than of course the direct impact of our credit card being stolen or our social security number being compromised. I don’t think I’ll ever participate in loyalty programs unless laws are enacted to protect our privacy, but beyond that, I would need to know how companies protect my privacy.

As a user, before giving away my personal information to a company, I want to know how that company will keep my data protected and give me secure access to my data. Currently, I believe there is too much focus from companies on figuring out how to collect and analyze customer data to apply toward marketing and audience targeting strategies and not enough focus on keeping that customer data they interact with safe. At BOHH Labs, we believe that data is invaluable and we are focused on re-evaluating how customers can have access to their data, yet keep it safe when sharing it with companies and services.

We believe that the parties at the two ends of a data message – the sender and requester – should be the only ones to have access to that data message. As such, our security approach focuses on ensuring a secure transport of data between all users, applications, and the end database services. We use a powerful combination of keyless encryption that keeps data protected both in transit and at rest and Artificial Intelligence technology, Natural Language Processing, and In-Memory Distributed Blockchain Ledger to ensure that your data stays protected, no matter where it is stored or accessed from. And until I know that the companies I do business with protect my data with the same care, I guess I’ll be paying more for my moisturizer and melatonin. But I wont be losing sleep over who has access to my private info.