Posts Tagged

Security

This month’s Windows and Office security patches: Bugs and solutions

It’s been another strange patching month. The usual Patch Tuesday crop appeared. Two days later, we got a second cumulative update for Win10 1903 and 1909, KB 4551762, that’s had all sorts of documented problems. Two weeks later, on Monday, Microsoft posted a warning about (another) security hole related to jimmied Adobe fonts.

Predictably, much of the security press has gone P.T. Barnum.

The big, nasty, scary SMBv3 vulnerability

Patch Tuesday rolled out with a jump-the-gun-early warning from various antivirus manufacturers about a mysterious and initially undocumented security hole in the networking protocol SMBv3.

Later that day, Microsoft released a broad description of the SMBv3 security hole in Security Advisory ADV200005 – apparently trying to close the door after the cow escaped. And the crowd went wild. How could Microsoft tell these antivirus vendors about a forthcoming fix, then fail to deliver the fix – and not warn the AV folks in time to pull their press releases? Tales of impending doom ran rampant.

Then, on Thursday, we saw another cumulative update for Win10 versions 1903 and 1909. KB 4551762 patches the SMBv3 security hole and, being a cumulative update, includes all earlier patches. The rush was on to install the patch-of-a-patch, but we started seeing all sorts of problems: errors on installation; random reboots; performance hits; and the return of our old profile-zapping bug, which leaves folks with empty desktops and hidden files.

Here’s the punch line. (Tell me if you’ve heard this one before.) After all the sturm un drang, researchers (notably including Kevin Beaumont) discovered that they couldn’t effectively use the security hole to take over a system:

“Windows Defender, which is enabled by default, detects exploitation even if unpatched.”

As of this writing, I don’t know of any real-world attacks using the SMBv3 vulnerability. Certainly, one will appear sooner or later, but it isn’t a big deal right now.

The big, nasty, scary Adobe Type Manager font bugs

Yesterday, Microsoft released another Security Advisory. ADV200006  — Type 1 Font Parsing Remote Code Execution Vulnerability describes a security hole in the way Windows handles fonts. We’ve seen a lot of those in Windows over the years. This one came with the usual zero-day language, advising that Microsoft has seen “limited targeted attacks that could leverage un-patched vulnerabilities.” The advisory shows that every version of Windows – going back to Win7 – is vulnerable.

Once again, the blogosphere went nuts. Microsoft’s warning meeeeeeelions of Windows users that their systems are under attack!

Yeah. Sure.

When Microsoft says it’s seen “limited targeted attacks,” that means some well-heeled hacking group is using the security hole against a very specific target – usually a government agency or a high-stakes corporate group. For normal people, in normal situations, it’s not a big deal.

We’ve seen these “sky-is-falling” scenarios play out over and over again in the past year or so. Some security holes (e.g., for EternalBlue/WannaCry and BlueKeep) need to be plugged shortly after the patches are released. But in the vast majority of cases, waiting a week or two or three to install the latest crop of Windows and Office patches just makes sense.

Windows Defender ‘Items skipped during scan’

Many – but not all – Windows 10 users report that a manual scan by Windows Defender triggers this “Items skipped during scan” notification (screenshot).

Windows Defender items skipped during scan 2 Microsoft

It appears to be a bug. According to Lawrence Abrams at BleepingComputer:

“It seems that in the older Windows Defender engines network scanning was enabled by default… [in newer versions of the engine] you can see that the Windows Defender preferences show that network scanning has now been disabled by a newer engine. It is not known why Microsoft decided to make this change, but the alerts appear to just indicate that network scanning was skipped.”

Günter Born originally reported on the bug. He has come up with a manual workaround to enable network scanning.

Other developments

More on the patching front:

  • Microsoft has announced that it’s extending end-of-life for Win10 version 1709 Enterprise (and Education) to Oct. 13, 2020.
  • Abbodi86 has discovered a way to install the latest Windows 7 security patches, even if you haven’t yet set up Extended Security Updates. Many people, including Patch Lady Susan Bradley, are asking Satya Nadella to offer Win7 Extended Security Updates to all “genuine” Win7 customers, particularly because of the increase in work-from-home.
  • In the same vein, there’s a lot of discussion about throttling back on Windows auto updates, specifically to help keep work-from-home systems stable. Many advocate holding off on the inevitable Win10 version 2004 update. No indication that Microsoft has heard the pleas.

If there ever were a time for Windows patching stability, this is it.

We’ll keep pushing on AskWoody.com.





Source link

Don’t let the coronavirus make you a home office security risk

Welcome to life working at home, where the only one standing between you and all kinds of malware, ransomware and other security foul ups is, well, you.

Sure, the tech support desk will try to help you, but it’s not like they can stop by your desk and install a patch for you anymore. It’s a brave new scary world and we’re all trying to do the best we can. So, here, are six tips on how to keep your computer safe.

We hate to say it but all too many computer problems are, as they say in tech support land,  “Problem exists between chair and keyboard (or PEBCAK).” That is, little old you. No one’s asking you to become a security guru and win the next Pwn2Own competition. But you must learn a little bit about how to keep your computer safe and you must be warier of potential threats.

You see, there really are people out there who want to grab your password, steal your data and your company’s data, and infect your computer with ransomware while they’re at it. Or, to be more precise, there are automatic botnet systems out there spending every second of the day pounding on your virtual door.

It’s nothing personal. Just like the coronavirus, though, these really are out to get you. So, you need to act accordingly.

Enable automatic updates (usually)

If you, or your corporate IT staff, haven’t done it before, turn on automatic software updates for your operating system and programs.

Everyone says that, but let me add a caveat: If you use Windows for your desktop operating system, learn what your business’s recommendations are for Windows update. You may not want to update Windows at all.

You see lately Windows 10 has a truly lousy patching record.  This included machines not booting properly; your desktop vanishing into the ether; and the File Explorer Search box went haywire for a while. Microsoft has even delayed retiring Windows 10 1709, known to you as the 2017 Fall Creators Update by six months. That’s just so people don’t have to update their older Windows 10 systems and possibly run into problems.

Given all this, do you really want to update, run into a problem, and then try to troubleshoot it on your own? No, I didn’t think so.

Instead, I suggest you pause Windows 10 updates for now. To do that with a business edition of Windows 10, you do this by going to Settings > Update & Security > Windows Update > Advanced Options. Once there, under the “Choose when updates are installed” heading, select Semi-Annual Channel. This delays major feature updates by about four months, when all the bugs should be worked out. Under the quality update heading, change the deferral period to 30 days from its default of zero. These are the Patch Tuesday patches.

If you’re running a Windows 10 Home and it’s Windows 10 1903 (aka the May 2019 Update, or newer) you can also delay patches. To do this go to Settings > Update & Security > Windows Update, and look for the “Pause updates for 7 days” button. With this, you can keep delaying it in 7 day chunks for up to 35 days.

Everything else, just go ahead and update. There may even be programs you rely on hiding in your system that need patching but do a poor job of alerting you. For these, you can use SUMo or  PatchMyPC or to track other programs software on your PC that may need an update..

Finally, if you go to a random website and it tells you must update Adobe Flash or some other program before you can use it and you can download it from a link they provide, DON’T DO IT. Often this is a corrupted website trying to put malware on your computer.

Anti-viral software: Who needs it?

You wouldn’t know if from all the ads, but viruses are among the least of your security worries these days. There are all kinds of malware out there, but the traditional virus or worm? Not so much.

That said, while you can use one of the latest and best antivirus programs for most of us Microsoft’s own free Windows Defender Security Center is all you’ll need. If you want more check out, Norton Security Premium or AVG Internet Security,

If you use a Mac, you may think you’re safe. Nope. While you’re far less likely to run into malware than your Windows-using colleagues, there are viruses out there with your Mac’s name on them. For overall protection, we recommend Sophos Home Premium. If you just want good free antivirus protection give AVG Antivirus for Mac‘s free tier a try.

Desktop Linux user? You don’t really need an antivirus program. It’s not that Linux’s security is perfect — nothing is in this world — but it’s better than the rest. There’s never really been an effective Linux desktop virus.

Password management

We all hate passwords and want to move on. Well, maybe someday two-factor authentication (2FA) will be perfected. But, we’re not there yet. In the meantime, here are some simple suggestions on how to use passwords safely and efficiently.

First, use passphrases, like “I-Hate-Coronavirus!!,” which you can remember instead of easy to guess passwords like “abcdef,” the ever popular “password,” or your birthday. Nor, should you use memory unfriendly passwords such as “Gog$^Yack4.” Your memory and your security will thank you.

You should also use a password manager. With most of us having to deal with dozens of sites and services requiring passwords, no one can remember all of them. The answer’s a password management program.

Password managers enable you to manage your login credentials across all your devices while keeping your passwords secure. They can also automatically fill in web forms for you. Many web browsers, such as Edge, Firefox, and Google Chrome include this functionality

If you don’t trust Microsoft, Mozilla or Google with your data, or you want non-internet password management, you need a standalone password manager. The best of these are LastPass and 1Password.

Of course, if 2FA is available on services you use all the time. Use It. Yes, it can be a nuisance entering in a PIN from a text message or the like, but it makes them orders of magnitude more secure.

Bad guys gone phishing

The single biggest security problem you’re most likely to run into is phishing. There are two kinds of phishing. In the older type, scammers use email or text messages to trick you into giving them your personal information. Once they have your passwords, account numbers, or Social Security number, you can kiss your privacy, credit score and possibly your job good-bye. In the other, you’re encouraged to download or open a file or click on a link, which will infect your computer with malware.

In either case, they often look like they’re from someone or a company you trust.  They often tell you a story to trick you into making a fatal mistake. This can include the following: Saying they’ve noticed some suspicious activity or problem, there’s a problem with your account, you’re eligible for a refund or you need to pay a (fake) invoice. 

There’s already been a significant rise in coronavirus phishing messages. You can be sure they’ll be many more proclaiming a cure, an urgent message from the CDC, and the like.

Phishing messages also disguise themselves with personal information. They’ll include your home address, your pets’ names and so on. Don’t buy it. It’s easy to find your personal information on the internet. Just consider for a moment how much to tell people about yourself on Facebook and the other social networks.

You can spot phishing messages with several tell-tale signs. If you look closely at the address instead of being from a real address, say [email protected] it will be from am[email protected]. They also often open with a generic solution such as “Hi Dear” instead of your real name.

When you get a phishing message, delete it. Never reply to it or open any link or attachment within it.

Finally, another phishing variant is the Microsoft support call scam.  In this one, you’ll get a call from someone claiming to be from Microsoft or a partner and that an automatic scan of your PC has shown a problem and they’re here to help all for one low price No, no they’re not. Microsoft will never call you out of the blue. At the very least, you’ll lose a few bucks and the worst you may find your computer and all your company’s files locked up with ransomware,

Virtual private networks: VPNs still a necessity

These days a lot of our front-line business programs, such as Office 365, Google Docs, and QuickBooks Online use a software-as-a-service (SaaS) cloud model. For these, you don’t need a VPN. But, a lot of our in-house applications still are humming away in our data centers and server rooms. That means, you’ll need a VPN to safely get to them.

If your company hasn’t set up a VPN for you, tell them to set one up right now. Otherwise anything you send between your home and your office is vulnerable to be spied on.

Picking a VPN isn’t your job — you may be acting as a chief security officer, but you aren’t paid like one nor do you have the technical expertise.

If you’re running a small business, you need to pick a small-office/home-office (SOHO) VPN now, Some of the best, easy-to-deploy choices are ExpressVPN, StrongVPN, or TunnelBear

Backups: Your last chance for survival

Last, but never least, you may not think of backups as part of security, but they are. They’re the last safety belt to save you from disaster when everything else has gone wrong. As long as you have a good backup, even if your files are frozen by ransomware and your machines are working more for a botnet than they are for you, you can still wipe everything and start fresh.

Again, this is something your IT department should be handling for you. But, in the rush to get you out the door and working from home. it may have been neglected.

The quickest, easiest way to back up your business PC from home is to use a cloud backup service. Once your company’s sysadmins catches up they’ll also find it easier to get at your backups if they’re on the cloud rather than if you’re using an old-style DVD or even tape backup system. Ones to consider are Acronis, Carbonite, and IDrive. A more home Mac and Windows friendly solution is Google’s Backup and Sync.

Secure at home

Keeping your work safe from home isn’t easy. Butit’s not rocket science either. Just follow these tips and you should be OK.

After all, I’ve been following them for more than 30 years of working from home without a single security incident. If I can do it, you can, too.

Welcome to life working at home, where the only one standing between you and all kinds of malware, ransomware and other security foul ups is, well, you.

Sure, the tech support desk will try to help you, but it’s not like they can stop by your desk and install a patch for you anymore. It’s a brave new scary world and we’re all trying to do the best we can. So, here, are six tips on how to keep your computer safe.

We hate to say it but all too many computer problems are, as they say in tech support land,  “Problem exists between chair and keyboard (or PEBCAK).” That is, little old you. No one’s asking you to become a security guru and win the next Pwn2Own competition. But you must learn a little bit about how to keep your computer safe and you must be warier of potential threats.

You see, there really are people out there who want to grab your password, steal your data and your company’s data, and infect your computer with ransomware while they’re at it. Or, to be more precise, there are automatic botnet systems out there spending every second of the day pounding on your virtual door.

It’s nothing personal. Just like the coronavirus, though, these really are out to get you. So, you need to act accordingly.

Enable automatic updates (usually)

If you, or your corporate IT staff, haven’t done it before, turn on automatic software updates for your operating system and programs.

Everyone says that, but let me add a caveat: If you use Windows for your desktop operating system, learn what your business’s recommendations are for Windows update. You may not want to update Windows at all.

You see lately Windows 10 has a truly lousy patching record.  This included machines not booting properly; your desktop vanishing into the ether; and the File Explorer Search box went haywire for a while. Microsoft has even delayed retiring Windows 10 1709, known to you as the 2017 Fall Creators Update by six months. That’s just so people don’t have to update their older Windows 10 systems and possibly run into problems.

Given all this, do you really want to update, run into a problem, and then try to troubleshoot it on your own? No, I didn’t think so.

Instead, I suggest you pause Windows 10 updates for now. To do that with a business edition of Windows 10, you do this by going to Settings > Update & Security > Windows Update > Advanced Options. Once there, under the “Choose when updates are installed” heading, select Semi-Annual Channel. This delays major feature updates by about four months, when all the bugs should be worked out. Under the quality update heading, change the deferral period to 30 days from its default of zero. These are the Patch Tuesday patches.

If you’re running a Windows 10 Home and it’s Windows 10 1903 (aka the May 2019 Update, or newer) you can also delay patches. To do this go to Settings > Update & Security > Windows Update, and look for the “Pause updates for 7 days” button. With this, you can keep delaying it in 7 day chunks for up to 35 days.

Everything else, just go ahead and update. There may even be programs you rely on hiding in your system that need patching but do a poor job of alerting you. For these, you can use SUMo or  PatchMyPC or to track other programs software on your PC that may need an update..

Finally, if you go to a random website and it tells you must update Adobe Flash or some other program before you can use it and you can download it from a link they provide, DON’T DO IT. Often this is a corrupted website trying to put malware on your computer.

Anti-viral software: Who needs it?

You wouldn’t know if from all the ads, but viruses are among the least of your security worries these days. There are all kinds of malware out there, but the traditional virus or worm? Not so much.

That said, while you can use one of the latest and best antivirus programs for most of us Microsoft’s own free Windows Defender Security Center is all you’ll need. If you want more check out, Norton Security Premium or AVG Internet Security,

If you use a Mac, you may think you’re safe. Nope. While you’re far less likely to run into malware than your Windows-using colleagues, there are viruses out there with your Mac’s name on them. For overall protection, we recommend Sophos Home Premium. If you just want good free antivirus protection give AVG Antivirus for Mac‘s free tier a try.

Desktop Linux user? You don’t really need an antivirus program. It’s not that Linux’s security is perfect — nothing is in this world — but it’s better than the rest. There’s never really been an effective Linux desktop virus.

Password management

We all hate passwords and want to move on. Well, maybe someday two-factor authentication (2FA) will be perfected. But, we’re not there yet. In the meantime, here are some simple suggestions on how to use passwords safely and efficiently.

First, use passphrases, like “I-Hate-Coronavirus!!,” which you can remember instead of easy to guess passwords like “abcdef,” the ever popular “password,” or your birthday. Nor, should you use memory unfriendly passwords such as “Gog$^Yack4.” Your memory and your security will thank you.

You should also use a password manager. With most of us having to deal with dozens of sites and services requiring passwords, no one can remember all of them. The answer’s a password management program.

Password managers enable you to manage your login credentials across all your devices while keeping your passwords secure. They can also automatically fill in web forms for you. Many web browsers, such as Edge, Firefox, and Google Chrome include this functionality

If you don’t trust Microsoft, Mozilla or Google with your data, or you want non-internet password management, you need a standalone password manager. The best of these are LastPass and 1Password.

Of course, if 2FA is available on services you use all the time. Use It. Yes, it can be a nuisance entering in a PIN from a text message or the like, but it makes them orders of magnitude more secure.

Bad guys gone phishing

The single biggest security problem you’re most likely to run into is phishing. There are two kinds of phishing. In the older type, scammers use email or text messages to trick you into giving them your personal information. Once they have your passwords, account numbers, or Social Security number, you can kiss your privacy, credit score and possibly your job good-bye. In the other, you’re encouraged to download or open a file or click on a link, which will infect your computer with malware.

In either case, they often look like they’re from someone or a company you trust.  They often tell you a story to trick you into making a fatal mistake. This can include the following: Saying they’ve noticed some suspicious activity or problem, there’s a problem with your account, you’re eligible for a refund or you need to pay a (fake) invoice. 

There’s already been a significant rise in coronavirus phishing messages. You can be sure they’ll be many more proclaiming a cure, an urgent message from the CDC, and the like.

Phishing messages also disguise themselves with personal information. They’ll include your home address, your pets’ names and so on. Don’t buy it. It’s easy to find your personal information on the internet. Just consider for a moment how much to tell people about yourself on Facebook and the other social networks.

You can spot phishing messages with several tell-tale signs. If you look closely at the address instead of being from a real address, say [email protected] it will be from [email protected]. They also often open with a generic solution such as “Hi Dear” instead of your real name.

When you get a phishing message, delete it. Never reply to it or open any link or attachment within it.

Finally, another phishing variant is the Microsoft support call scam.  In this one, you’ll get a call from someone claiming to be from Microsoft or a partner and that an automatic scan of your PC has shown a problem and they’re here to help all for one low price No, no they’re not. Microsoft will never call you out of the blue. At the very least, you’ll lose a few bucks and the worst you may find your computer and all your company’s files locked up with ransomware,

Virtual private networks: VPNs still a necessity

These days a lot of our front-line business programs, such as Office 365, Google Docs, and QuickBooks Online use a software-as-a-service (SaaS) cloud model. For these, you don’t need a VPN. But, a lot of our in-house applications still are humming away in our data centers and server rooms. That means, you’ll need a VPN to safely get to them.

If your company hasn’t set up a VPN for you, tell them to set one up right now. Otherwise anything you send between your home and your office is vulnerable to be spied on.

Picking a VPN isn’t your job — you may be acting as a chief security officer, but you aren’t paid like one nor do you have the technical expertise.

If you’re running a small business, you need to pick a small-office/home-office (SOHO) VPN now, Some of the best, easy-to-deploy choices are ExpressVPN, StrongVPN, or TunnelBear

Backups: Your last chance for survival

Last, but never least, you may not think of backups as part of security, but they are. They’re the last safety belt to save you from disaster when everything else has gone wrong. As long as you have a good backup, even if your files are frozen by ransomware and your machines are working more for a botnet than they are for you, you can still wipe everything and start fresh.

Again, this is something your IT department should be handling for you. But, in the rush to get you out the door and working from home. it may have been neglected.

The quickest, easiest way to back up your business PC from home is to use a cloud backup service. Once your company’s sysadmins catches up they’ll also find it easier to get at your backups if they’re on the cloud rather than if you’re using an old-style DVD or even tape backup system. Ones to consider are Acronis, Carbonite, and IDrive. A more home Mac and Windows friendly solution is Google’s Backup and Sync.

Secure at home

Keeping your work safe from home isn’t easy. Butit’s not rocket science either. Just follow these tips and you should be OK.

After all, I’ve been following them for more than 30 years of working from home without a single security incident. If I can do it, you can, too.



Source link

COVID-19 and tech: New collaboration tools mean new security risks

Shortly before Slack’s IPO this spring, the company addressed potential security threats to workplace chat software in an SEC filing. The risks identified included malware, viruses, worms and ransomware, among others. A 2019 Accenture report found that 85 percent of organizations experienced phishing and other social engineering attacks, an increase of 16 percent in a single year.

Ready or not: Collaborate

If your company hadn’t yet decided to move their communication and file sharing onto collaboration platforms, the coronavirus crisis made the decision for you. While the move to collaboration tools became a necessity, security threats will continue to surface, requiring new methods of securing the environment.

“It’s a safe bet for malicious attackers that their targets are using one – or more – popular tools such as Microsoft Teams, Slack, Google, Zoom and so on,” said Mike Puglia, chief strategy officer at Kaseya. It’s a low effort way to gain access to enterprise tools.”

The Slack filing also pointed to the potential threat posed by organized crime, as well as hostile nation states and attackers acting on their behalf, as a risk to Slack, it’s partners and its users. 

“Hackers and cybercriminals are acutely aware of the wealth of sensitive information that’s shared via such workplace collaboration tools,” said Attila Tomaschek, a digital privacy expert at ProPrivacy. “They are therefore naturally quite attractive targets to go after.”

A host of threats (beyond COVID-19)

Tomaschek notes that a phishing attack could introduce malware that might compromise an entire organization’s collaboration platform, as well as personal and sensitive business documents and files. 

Another potentially concerning vulnerability could appear from third-party apps that integrate with software like Teams and Slack. 

“Equally concerning is cybercriminals’ ability to take advantage of APIs to gain access to companies’ data through their collaboration tools,” Tomaschek said. These tools work with a host of third-party applications that companies will often integrate into the tools for a convenient and more seamless experience with other applications. The problem is that the API that’s used to connect the collaboration software with the third-party application can be exploited by a hacker to intercept data and communications between the two applications.”

[ Related: How to automate repetitive tasks in Slack ]

Companies are increasingly focused on automation and integration, said Steve Tcherchian, chief product officer at XYPRO, who also sees a door opening for malicious hackers. 

“The most things that can integrate with each other and provide a single pane-of-glass view, the less cost, management overhead and potential for problems exist,” Tcherchian said. “Most of these [collaboration] apps have third-party integrations to just about every other apps for this purpose. The challenge becomes how secure are the integrations, what data is shared between them and what risk is introduced into your platform?”

Collaboration tools will become a prime target for hackers, Tomaschek said, because, by design, they make it easy to spread data through the organization.

[ Related: Three encrypted Slack alternatives worth a look ]

“Along with the largely informal and casual communication style generally used on these platforms, unassuming users could easily let their guard down and not being vigilant about what they communicate and what links they click on,” Tomaschek said. “Compounding that is the inherent immediacy of the medium, which encourages quick responses and which can further lead to carelessness and imprudent activity by users.”

Bart McDonough, CEO of Agio, agrees that the level of trust an employee expects in their workplace chat software may lead to vulnerabilities. 

“There’s less general skepticism around inbound communications,” McDonough said. “While it’s uncommon for bad actors to spoof and fake messages on collaboration platforms, the reality is if one assumes the identity of an employee, the content they share becomes highly trusted very quickly. Email, in contrast, has experienced many years of publicized risks, negative stories, and user awareness training, sharpening the sword of cynicism among users.”

Credential stuffing is also on the rise, said Mike Puglia, chief strategy officer at Kaseya. “Attackers can gain credentials through phishing or simply by purchasing them from the millions of records for sale on the dark web and then testing – credential stuffing – those credentials on popular collaboration tools sites.”

It only takes one person’s chat login to be hacked, to expose multiple employee’s data through the collaboration software, noted Tim Roberts, managing director, digital-cyber team at AlixPartners. “People also feel more comfortable once within an apparently secure collaboration space, and therefore may drop their guard when faced with requests to share passwords or send confidential documents. This false sense of security needs to be managed.”

[ Related: How to pick the right collaboration tools]

Future threats

Tomaschek expects over time to see attacks that incorporate artificial intelligence and machine learning to target collaboration tools. 

“For instance, bots could be developed to mimic genuine human interaction over these collaboration systems,” Tomaschek said, “and could potentially become incredibly effective at gathering sensitive information from unsuspecting employees or get them to click on files containing malware.”

In terms of threats in the wild, Tomaschek points to malware that stole data via Slack and Github, surreptitiously moving data between the two platforms. 

“There has been malware that connects to collaborative software version control platforms, like Github, for downloading commands,” Tomaschek said. “It then outputs the results of those commands to cloud-based proprietary instant messaging platforms, like Slack, and then uses free cloud storage services for uploading stolen files and documents. Abusing legitimate tools and services allows attackers to fly under the radar of traditional security solutions.”

In addition to traditional hacking threats, in its SEC filing Slack also pointed out that collaboration software faces “threats from sophisticated organized crime, nation-state and nation-state supported actors who engage in attacks …  Third parties may attempt to fraudulently induce employees, users, or organizations into disclosing sensitive information such as user names, passwords, or other information or otherwise compromise the security of our internal electronic systems, networks and/or physical facilities in order to gain access to our data or the data of organizations.”

Steps to take to ensure security in chaotic times

The outbreak of the coronavirus may have forced your hand, but there steps you can take to ensure a secure collaboration envjronment. McDonough sats that organizations can help secure their virtual workspaces by employing similar security practices to what are already have in place for email.

“Make sure that two-factor authentication is enabled for all logins,” McDonough said, “and across all associated software – not just the collaboration tools themselves. There’s also an education gap employers must close by training users around identity management risks. Administrators should also ensure that employee access and accounts on these platforms are promptly removed once an individual leaves the company.”

Security policies will need to revamped to include educating employees on potential threats in collaboration software, advises Liviu Arsene, global cybersecurity researcher for Bitdefender.

“At the same time IT and security teams should set in place monitoring tools and technologies designed to spot potential sensitive data that might be exposed,” Arsene said. “Educating employees in cybersecurity best practices and having a strong company policy in terms of accepted apps, coupled with highly regulated access to company-critical data, can help organizations increase they cybersecurity posture and reduce the footprint of potential misuse of collaboration software.” 

Shortly before Slack’s IPO this spring, the company addressed potential security threats to workplace chat software in an SEC filing. The risks identified included malware, viruses, worms and ransomware, among others. A 2019 Accenture report found that 85 percent of organizations experienced phishing and other social engineering attacks, an increase of 16 percent in a single year.

Ready or not: Collaborate

If your company hadn’t yet decided to move their communication and file sharing onto collaboration platforms, the coronavirus crisis made the decision for you. While the move to collaboration tools became a necessity, security threats will continue to surface, requiring new methods of securing the environment.

“It’s a safe bet for malicious attackers that their targets are using one – or more – popular tools such as Microsoft Teams, Slack, Google, Zoom and so on,” said Mike Puglia, chief strategy officer at Kaseya. It’s a low effort way to gain access to enterprise tools.”

The Slack filing also pointed to the potential threat posed by organized crime, as well as hostile nation states and attackers acting on their behalf, as a risk to Slack, it’s partners and its users. 

“Hackers and cybercriminals are acutely aware of the wealth of sensitive information that’s shared via such workplace collaboration tools,” said Attila Tomaschek, a digital privacy expert at ProPrivacy. “They are therefore naturally quite attractive targets to go after.”

A host of threats (beyond COVID-19)

Tomaschek notes that a phishing attack could introduce malware that might compromise an entire organization’s collaboration platform, as well as personal and sensitive business documents and files. 

Another potentially concerning vulnerability could appear from third-party apps that integrate with software like Teams and Slack. 

“Equally concerning is cybercriminals’ ability to take advantage of APIs to gain access to companies’ data through their collaboration tools,” Tomaschek said. These tools work with a host of third-party applications that companies will often integrate into the tools for a convenient and more seamless experience with other applications. The problem is that the API that’s used to connect the collaboration software with the third-party application can be exploited by a hacker to intercept data and communications between the two applications.”

[ Related: How to automate repetitive tasks in Slack ]

Companies are increasingly focused on automation and integration, said Steve Tcherchian, chief product officer at XYPRO, who also sees a door opening for malicious hackers. 

“The most things that can integrate with each other and provide a single pane-of-glass view, the less cost, management overhead and potential for problems exist,” Tcherchian said. “Most of these [collaboration] apps have third-party integrations to just about every other apps for this purpose. The challenge becomes how secure are the integrations, what data is shared between them and what risk is introduced into your platform?”

Collaboration tools will become a prime target for hackers, Tomaschek said, because, by design, they make it easy to spread data through the organization.

[ Related: Three encrypted Slack alternatives worth a look ]

“Along with the largely informal and casual communication style generally used on these platforms, unassuming users could easily let their guard down and not being vigilant about what they communicate and what links they click on,” Tomaschek said. “Compounding that is the inherent immediacy of the medium, which encourages quick responses and which can further lead to carelessness and imprudent activity by users.”

Bart McDonough, CEO of Agio, agrees that the level of trust an employee expects in their workplace chat software may lead to vulnerabilities. 

“There’s less general skepticism around inbound communications,” McDonough said. “While it’s uncommon for bad actors to spoof and fake messages on collaboration platforms, the reality is if one assumes the identity of an employee, the content they share becomes highly trusted very quickly. Email, in contrast, has experienced many years of publicized risks, negative stories, and user awareness training, sharpening the sword of cynicism among users.”

Credential stuffing is also on the rise, said Mike Puglia, chief strategy officer at Kaseya. “Attackers can gain credentials through phishing or simply by purchasing them from the millions of records for sale on the dark web and then testing – credential stuffing – those credentials on popular collaboration tools sites.”

It only takes one person’s chat login to be hacked, to expose multiple employee’s data through the collaboration software, noted Tim Roberts, managing director, digital-cyber team at AlixPartners. “People also feel more comfortable once within an apparently secure collaboration space, and therefore may drop their guard when faced with requests to share passwords or send confidential documents. This false sense of security needs to be managed.”

[ Related: How to pick the right collaboration tools]

Future threats

Tomaschek expects over time to see attacks that incorporate artificial intelligence and machine learning to target collaboration tools. 

“For instance, bots could be developed to mimic genuine human interaction over these collaboration systems,” Tomaschek said, “and could potentially become incredibly effective at gathering sensitive information from unsuspecting employees or get them to click on files containing malware.”

In terms of threats in the wild, Tomaschek points to malware that stole data via Slack and Github, surreptitiously moving data between the two platforms. 

“There has been malware that connects to collaborative software version control platforms, like Github, for downloading commands,” Tomaschek said. “It then outputs the results of those commands to cloud-based proprietary instant messaging platforms, like Slack, and then uses free cloud storage services for uploading stolen files and documents. Abusing legitimate tools and services allows attackers to fly under the radar of traditional security solutions.”

In addition to traditional hacking threats, in its SEC filing Slack also pointed out that collaboration software faces “threats from sophisticated organized crime, nation-state and nation-state supported actors who engage in attacks …  Third parties may attempt to fraudulently induce employees, users, or organizations into disclosing sensitive information such as user names, passwords, or other information or otherwise compromise the security of our internal electronic systems, networks and/or physical facilities in order to gain access to our data or the data of organizations.”

Steps to take to ensure security in chaotic times

The outbreak of the coronavirus may have forced your hand, but there steps you can take to ensure a secure collaboration envjronment. McDonough sats that organizations can help secure their virtual workspaces by employing similar security practices to what are already have in place for email.

“Make sure that two-factor authentication is enabled for all logins,” McDonough said, “and across all associated software – not just the collaboration tools themselves. There’s also an education gap employers must close by training users around identity management risks. Administrators should also ensure that employee access and accounts on these platforms are promptly removed once an individual leaves the company.”

Security policies will need to revamped to include educating employees on potential threats in collaboration software, advises Liviu Arsene, global cybersecurity researcher for Bitdefender.

“At the same time IT and security teams should set in place monitoring tools and technologies designed to spot potential sensitive data that might be exposed,” Arsene said. “Educating employees in cybersecurity best practices and having a strong company policy in terms of accepted apps, coupled with highly regulated access to company-critical data, can help organizations increase they cybersecurity posture and reduce the footprint of potential misuse of collaboration software.” 



Source link

12 security tips for the ‘work from home’ enterprise

If you or your employees are working from home while our governments lurch awkwardly through the current crisis, then there are several security considerations that must be explored.

Your enterprise outside the wall

Enterprises must consider the consequences of working from home in terms of systems access, access to internal IT infrastructure, bandwidth costs and data repatriation.

What this means, basically, is that when your worker accesses your data and/or databases remotely, then the risk to that data grows.

While at normal times the risk is only between the server, internal network and end user machine, external working adds public internet, local networks and consumer grade security systems to the mix of risk.

Here are some of the approaches to take to minimize this risk.

1. Provide employees with basic security knowledge

People working from home must be provided with basic security advice: to beware of phishing emails, to avoid use of public Wi-Fi, to ensure home Wi-Fi routers are sufficiently secured and to verify the security of the devices that they use to get work done.

It is likely that attempts to subvert security using phishing attacks will increase at this time.

Employees should be particularly reminded to avoid clicking links in emails from people they do not know, and installation of third-party apps should be confined to bona fide stores, even on personal devices.

Your people need to be in possession of basic security advice, and it is also important that your company has an emergency response team in place. People need to know who to contact in the event they detect a security anomaly.

2. Provide your people with access to VPN

One way to secure data as it moves between your core systems and externally based employees is to deploy a VPN. These provide an additional layer of security, which (in simple terms) provides the following:

  • Hide your IP address.
  • Encrypt data transfers in transit.
  • Mask your location.

Most larger organizations will already have a VPN service in place, and should check they have sufficient seats to provide this protection across their employee base. Smaller enterprises may need to appoint a VPN provider.

There are lots of VPN service providers, but not all of them can be trusted. ExpressVPN or NordVPN appear to be good choices, but it is in your own interest that you do your own due diligence before selecting a provider for your company.

[Also read: How to stay as private as possible on Apple’s iPad and iPhone.]

Once chosen, you should ensure that all remote employees are provided with access to the service, and that they use them for all business-related activity.

3. Provision security protection

Make sure up-to-date security protection is installed and active on any devices that will be used for work. That means virus checkers, firewalls, device encryption should all be in palace. I have two articles which should help with some of this:

4. Run a password audit

Your company needs to audit employee passcodes.

That doesn’t mean requesting people’s personal details, but does mean passcodes used to access any enterprise services are reset and redefined in line with stringent security policy.

Alphanumeric codes, use of two-factor authentication should become mandatory, and you should ask your people to apply the toughest possible protection across all their devices. You should also ensure all your business-critical passwords are securely stored in the event anything happens to key personnel. Enterprise-focused password manager, LastPass may help here.

5. Ensure software is updated

Encourage your teams to upgrade their software to the latest version supported under company security policy. (Some enterprises lag the release schedule for Apple software, though most don’t). Activate automatic updating on all your devices.

6. Encourage use of (secure, approved) cloud services

One way to protect your employee end points is to ensure your confidential information is not stored locally.

Content storage should be cloud-based where possible, and employees should be encouraged to use cloud-based apps (such as Office 365). It’s also important that any third-party cloud storage services used are verified for use by your security teams.

NB: This is particularly important if your business requires use of critical personal data.

7. Reset Wi-Fi routers

Not every employee will have reset the password for their Wi-Fi router.

If you have an IT support team then providing telephone guidance to secure home routers should become a priority. You do not want your information being subjected to man in the middle, data sniffing or any other form of attack.

You may also need to make arrangements to pay for any excess bandwidth used, as not every broadband connection is equal. Some providers (most recently, AT&T) are making positive sounds around extending available data packages in the current crisis. Employees should be told to avoid public Wi-Fi, though doing so is made a little more secure if used with a VPN.

8. Mandatory backups

It will be useful to ensure online backup services are used, if available.

Otherwise, employees should be encouraged to use external drives to back computers up too, or iCloud. If you use an MDM service then it is possible you’ll be able to initiate automated backups via your system’s management console.

(NB: I’m a little concerned about backup to local storage in employee homes as this simply becomes another potential security problem).

9. Avoid use of USB sticks

Don’t use USB sticks at all if you can avoid it. There have been too many examples of such devices being infested with malware. The Department of Homeland Security has a page about this.

10. Use an MDM solution

It may make sense to deploy an MDM system at this time.

This will make it much easier to provision and manage your fleet of devices while also separating corporate from personal data. It also ensures device and Mac security can be better controlled.

This is a topic in itself, but the experts at company’s such as Jamf, Addigy or even your Apple business advisor should be able to provide useful advice.

11. Develop contingency now

Triage your teams. Ensure that management responsibilities are siloed between teams and ensure you put contingency plans in place now in the event key personnel get sick. Tech support, password and security management, essential codes and fail-safe roles should all be assigned and duplicated.

12. Care and community

The reason many people are working from home is because there is a health pandemic. The grim truth is that your employees may get sick, or worse, during this crisis.

With this in mind, community chat, including group video chat using tools such as FaceTime or Zoom will become increasingly important to preserving mental health, particularly for anyone enduring quarantine.

Encourage your people to talk with each other, run group competitions to nurture online interaction, and identify local mental health and grief counsellors who may help if the crisis becomes more extreme.

I have heard of one group of people working remotely that are using a home exercise app and Group FaceTime to exercise together during the day, which they think helps boost team feeling even while working remotely.

The bottom line is that your people are likely to be under a great deal of personal stress, so it makes sense to raise each other up through this journey.

Also read:

Good luck everyone.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

 

Copyright © 2020 IDG Communications, Inc.





Source link

Verizon: Companies will sacrifice mobile security for profitability, convenience

Despite an increase in the number of companies hit by mobile attacks that led to compromises, four in 10 businesses sacrificed security to meet profit goals or avoid “cumbersome” security processes, according to Verizon’s third annual Mobile Security Index 2020.

It showed that 43% of organizations sacrificed security. More typical reasons for companies exposing themselves to risk, such as lack of budget and IT expertise, trailed “way behind” things such as expediency (62%), convenience (52%) and  profitability targets (46%). Lack of budget and IT expertise were only cited by 27% and 26% of respondents, respectively.

“In fact, the study found that 39% of respondents reported having a mobile-security-related compromise. Sixty-six percent of organizations that suffered a compromise called the impact ‘major,’ and 55% said the compromise they experienced had lasting repercussions,” Verizon stated.

Verizon mobile security Verizon

The findings are based on a survey of more than 850 IT professionals responsible for buying, managing and securing mobile and IoT devices. In addition to insights from Verizon’s analysts, the report includes real-world data from security and management companies, including Asavie, IBM, Lookout, MobileIron, NetMotion, Netskope, Symantec, VMware and Wandera.

This year, Verizon added questions to find out why companies are knowingly exposing themselves to risks. The need to meet targets was the most commonly stated reason, whether it was time (62%) or money related (46%).

Despite an increase in the number of companies hit by mobile attacks that caused breaches, Verizon’s data does show a reduction in the proportion saying that they had knowingly compromised security (down from 48% in FY2019 to 43% in FY2020).

“It seems that many companies still see mobile security as an impediment to their business objectives rather than a business imperative in itself,” Verizon said. “But attitudes are changing. Eighty-seven percent of respondents said they were concerned that a mobile security breach could have a lasting impact on customer loyalty, and 81% said that a company’s data privacy record will be a key brand differentiator in the future.”

Dionisio Zumerle, a senior director of research at Gartner, said enterprises today have a plethora of security challenges; for many, it is simply not possible to tackle everything at once.

“For a number of reasons, mobile today is a smaller issue than many others,” Zumerle said via email. “Among other factors, the operating system is more hardened, and mobile devices have less access to critical enterprise infrastructure and data.”

The Verizon report found that 39% of organizations admitted to suffering a security compromise involving a mobile device — up from 33% in the 2019 report and 27% in 2018. Of those that suffered a compromise, 66% said the impact was major and 36% said it had lasting repercussions.

Twenty-percent of organizations that suffered a mobile compromise said a rogue or insecure Wi-Fi hotspot was involved.

“Although the risks of public Wi-Fi are becoming well known, convenience trumps policy – even common sense — for many users. Some organizations are trying to prevent this by implementing Wi-Fi-specific policies, but inevitably, rules will be broken,” Verizon said.

According to MobileIron, 7% of protected devices detected a man-in-the-middle (MitM) attack in the past year.

According to Wandera, employees connect to an average of 24 Wi-Fi hotspots per week. The company also found that 7% of devices encounter a hotspot that presents a low-to-medium severity risk, and 2% encounter one rated as a high risk—one known to be affected by MitM, or a protocol attack like SSL Strip.

Overall, the average mobile device connects to two to three insecure Wi-Fi hotspots per day. The most common settings are retail, hospitality and transportation hubs, including airports. 

Despite the risks, less than half (42%) of organizations said that they prohibit employees from using public Wi-Fi to perform work-related tasks.

Verizon mobile security Verizon

“Open Wi-Fi networks are convenient, but they are as open to users as they are to attackers,” Zermerle said. “There are a number of ways to achieve this, but essentially an attacker can conduct a MitM attack where he can see everything that a user sends over the network. This includes account credentials and confidential information among other data.

“There are a number of ways to respond,” Zermerle continued, “such as using adequate transport security (e.g. a VPN with certificate pinning), or an MTD solution …  that can identify MitM attacks.”

All vertical industries were included in the survey results, including manufacturing (where 41% suffered a mobile-related compromise) and the public sector (39%). And companies of all sizes were hit — from small and medium-sized businesses (28%) to those with more than 500 employees (44%).

At the same time, 80% of organizations said mobile will be their primary means of accessing cloud services within five years. 

Mobile end users were the primary vector for attacks, Verizon found. In fact, even among companies with defenses in place, including mobile device management (MDM) systems and at least one form of email filtering, many users still received – and clicked on – phishing links.

The main issue is that mobile management and mobile application management tools are just that – primarily management tools and not detection and remediation tools, according to Phil Hochmuth, IDC’s vice president of research for enterprise mobility

“That’s where mobile threat management/mobile threat defense (MTM/MTD) tools come in,” he said via email. “These are sometimes called (mistakenly) ‘iOS/Android antimalware.’ [They] look for more than malicious apps and on-device software. These tools also look for malicious Wi-Fi activity, as well as app-level threats.”

Verizon mobile security Verizon

Of the users who fell for a phishing attack, most were repeat victims. More than half (53%) of users that clicked on a phishing link clicked on more than one, the data showed.

Hochmuth agreed the biggest mobile app-level threat is phishing, “or, using the communication channel in any app … not just e-mail or SMS apps … to trick and phish users.

“Almost every app has some form of built-in messaging feature and attackers are using all of these to get at targets – social media apps and websites, etc,” Hochmuth said. “While the industry has not seen the extremely costly effects of malware and targeted attacks on PC operating systems vs. mobile, smartphones are now the primary access device for most Internet users, and are ubiquitous in enterprises.”

While it’s generally harder to compromise mobile OSes, they do represent a “huge attack” and “growing” attack vector, Hochmuth said.

If companies don’t become more proactive in addressing mobile threats, governments and industry bodies may well force their hands, Verizon’s report said.

Following the passage of the EU’s General Data Protection Regulation (GDPR) in 2016 and California’s Consumer Privacy Act in 2018 (they went into effect in May 2018 and January 2020, respectively), there has been increased momentum behind comprehensive privacy legislation.

In the U.S., several states, from Hawaii to Rhode Island, have initiated such measures. Four other states, including Texas and Louisiana, have set up task forces to look into the issue, Verizon noted.

While only 33% of companies said regulatory penalties are a consequence they are worried about, that could be because governments have given them adequate time to prepare. Sixty-seven percent said that increased regulation had driven them to spend more on security as a whole.

Gartner’s Zumerle said IT security leaders who want to address mobile threats should start from a security hygiene standpoint: device vulnerability management (removing vulnerable, unpatchable devices) and application vetting (disallowing leaky and malicious apps).

“In the long term, we see mobile security solutions such as MTD converging and being part of a unified endpoint security solution,” Zumerle said.

Indeed, over the past year and a half, vendors have touted a marriage between unified endpoint management (UEM) and security tools, offering a more comprehensive strategy for securing all enterprise endpoints, according to Nick McQuire, a senior vice president of research at CCS Insights.

Artificial intelligence and machine learning tools are at the core of some of the latest “zero-trust” frameworks being deployed by vendors, which is more about threat detection even while an employee is already logged into a corporate system via a mobile device.

“A lot of [threat detection] has to do with knowing what the device is, who the user is…, the health of the device and making sure the user is tied to their credential and that credential is tied to the device,” said Bill Harrod, federal CTO at MobileIron. “Then it’s about being able to evaluate the risk in all those places.”

Copyright © 2020 IDG Communications, Inc.



Source link