This past week, has been quite an interesting one, While reviewing our weekly Cyberthreat reports, what continues to strike me; again and again; is the infinite depths to which people will go to prove that there is no such thing a common sense and that Stupidity Reigns Supreme:

Case in point, unauthorised or personal cloud sharing services is a great way to ‘enable’ customer personal information with third parties to process claims, without any kind of limitation on the access, duration and whom the access is provisioned for; so here we go again, doing all the technical stuff preventing the scary hacker guys from destroying reputations only to undone by users that are trying to get their jobs done and being innovate in the process.

Visibility, awareness with positive behaviour nurturing, is the only way to keep out of this dangerous maelstrom, take it from me.

With this in mind, enjoy our roundup of stories for this week…

World Password Day?

Every First Thursday of May is World Password Day. Mark Burnett, Security researcher, whom first encouraged people to have a “password day,” where they’d update important passwords in his 2005 book Perfect Passwords. Inspired by this, Intel Security built upon this idea and to declare the first Thursday in May World Password Day in May 2013.
Password Day is meant to create awareness of the need for good password security.

Fast Forward to Last week when twitter decided to upstage all by notifying all 300 million twitter users to change passwords after the plaintext password debacle.

Twitter CTO: “We didn’t have to” tell users about the password debacle |  Fast Company

Opportunity for Managed Services: InfoSec

Trying to implement a security program that focusses purely on controls, invariably, fails. Focus purely given to point solutions like firewalls and antivirus just aren’t enough to protect a company from a devastating hack. While it’s usually the big companies that make the headlines, the reality is every organization is a target, regardless of size. In fact, cyber-attacks are on the rise for small and midsize businesses, which is logical since most lack the essential security resources or controls necessary to mitigate risk - in fact, 61% of data breach victims were small & mid-size companies in 2016 (2017 Verizon Data Breach Report). The most disturbing fact is that the majority of small businesses that are breached are forced to close their doors within six months later (US National Cyber Security Alliance).

We have been in consultation with many industry players and the most common issues that customers face are:

1. Where and How to Start
2. What to Fix First and why
3. Insufficient personal
4. Insufficient budget
5. Lack of understanding how to defend against cyber-attacks
6. Insufficient enabling security technologies
7. Lack of in-house expertise

Opportunity for Managed Services: InfoSec | Mke Lapeters
The Need for Greater Focus on the Cybersecurity Challenges Facing Small and Midsize Businesses | Commissioner Luis A. Aguilar

POPIA and GDPR (My attempt and Take)

Recently a good friend of mine and a customer asked me to give advice on whether they were on the right track in terms of POPIA and GDPR; this is the long version response I had for them:

As Regulations continue to change, there are principles; that you should adopt as you may or may not be a listed Company, some are but not limited to:
Follow the KING adopt the KING Code of Practice III / IV, look and understand the Laws of the land of South Africa; e.g. POPIA, The Electronic Communications and Transactions Act and the Consumer Protection Act etc. etc. etc.

For Example: Section 19 of POPIA places an obligation on a responsible party to secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent loss, damage to, or unauthorised destruction of; and unlawful access to, personal information.

To comply with this obligation, the responsible party must take reasonable measures to:

Identify all reasonably foreseeable internal and external risks to personal information under its control;

• establish and maintain appropriate safeguards against the risks identified;
• regularly verify that the safeguards are effectively implemented; and
• ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

In a nutshell GDPR vs. POPIA:

The good news is that the GDPR and POPIA are simply different flavours of data protection laws. They are actually quite similar to each other. Obviously, when South African enacted POPIA, South Africa did not know what the GDPR would look like. The concern was that the GDPR would be radically different from POPIA and it would mean that Parliament would need to change POPIA significantly.
The GDPR is more an update to data protection law, rather than a complete overhaul. There is much debate whether this is a good thing and whether the GDPR protects data privacy in the world we live in.

But for those who have already done much to comply with POPIA, it is good news. You won’t need to start again. But you will need to tweak what you have been doing. And in some cases, the GDPR will even help you by providing answers to questions we have been asking.

Follow these principles and you should be fine:

EXECUTIVE AWARENESS

GDPR/POPIA affects your business. It’s not simply a security issue. If your organization wants to keep up with global competitors and do business with EU citizens this is everyone’s issue. You have to get your entire executive team and the board on the same page, and in order to mitigate and continuously manage this, you need to name a Data Protection Officer (DPO).

PRIVACY OFFICE

Once you have the executive team on board—with funding and full commitment—it’s time to organize your privacy office. This should really be a full network; your entire organization should be looped in and everyone should be accurately updated on regulations and rules. Your DPO needs to align a privacy counsel and program manager to help roll out GDPR/POPIA compliance all the way from the CEO to sales and marketing and support to IT ops, and so forth.

MAP PROTECTED DATA

Everyone’s on board? Great. Now it’s time to take a look at what personally identifiable information (PII) is collected and why. Where is it stored and how is it classified? Take an in-depth audit now. Is PII transferred across borders? Why and who is it shared with?

OPERATIONAL IMPLEMENTATION

It’s time to build and customize your company’s processes and Incident Response Process (which has to happen within 72 hours under GDPR/POPIA will probably align to this). Your DPO should also assess your third party vendor risks at this time. Be thorough.

AWARENESS AND TRAINING (REPEAT)

Build new specifics into your new-hire training, but don’t forget about ongoing technical training for senior staff. Make annual security training mandatory and brief your executive leadership on new GDPR/POPIA readiness.

Continuous compliance, detailed mapping and auditing of the “why” and “how” of your customer’s PII and data, and setting up a strong privacy team with a Data Protection Officer who knows the importance of getting buy-in from the board will keep your company compliant.

Talk to us we can help!

My 18 year old son recently decided to become a scuba-diver. Not a hobbyist scuba-diver, a full-blown professional. His journey starts here at the south western tip of Africa where the wild and unforgiving Indian and Atlantic oceans meet. Not only that, his want is to be the best scuba-diver in the world - Ever! Astronaut good. He dives every day, and every week-end to the point where he complains about the aches and pains that goes with frequent diving activities. There are a few home truths about scuba-diving, you cannot do it by yourself, you need a buddy. Every day he learns and improves his techniques and goes out as crew on boats from Simons Town, Kommetjie or Hout Bay harbours. Yes, I know what you’re thinking, some of the biggest and “bitiest” sea creatures and sharks existing within this part of the ocean. This does not deter him, he is fearless in his quest, and relentless in perusing his passion.

This made me reflect on my peers and the cybersecurity industry; can we say the same for our tenacity and passion? Do we hold ourselves up to the same high standards. To achieve high standards for ourselves or as part of a team, we must proactively communicate realistic beliefs within ourselves about how hard things are and are going to be – something that I believe each of us face each and every day. Some of us more successfully than others.

Learn from my son.
With this in mind, enjoy our roundup of stories for this week…

How Lucrative is Cybercrime, anyway?

The volume boggles the mind, I found this intriguing perspective. If cybercrime was a country, it would have the 13th highest GDP in the world.
Attackers generate $1.5 trillion in annual profit, which is about equal to the GDP of Russia, according to a new study on the interconnected economy of cybercrime.

Cybercrime Economy Generates $1.5 Trillion a Year |  Kelly Sheridan

SPY V. SPY

Spy vs. Spy is a wordless meme before memes were memes Published in Mad magazine. As a kid, I was always fascinated by their antics. Basically the cartoon features two agents involved in stereotypical and comical espionage activities. One is dressed in white, and the other in black, but they are otherwise identical, and are particularly known for their long, beaklike heads. The pair are constantly at war with each other, using a variety of booby-traps to inflict harm on another. The spies usually alternate between victory and defeat with each new strip.
This brings me to an NSA leak that revealed the agency's list of enemy hackers.

Spy v. Spy: an NSA leak reveals the agency's list of enemy hackers | Andy Greenberg

The InfoSec Marshmallow

The marshmallow experiment, is based on a delayed gratification test conducted back in the 1970s at Stanford University.  It was designed to see if children who exercised delayed gratification would end up (many years later) performing better on aptitude tests as well as other positive life outcomes. I wonder how some of us in the InfoSec community would have fared if we were subjects of that experiment.  Given the various InfoSec personality types, here are some of Bob’s comical thoughts about how we would potentially measure up.

The InfoSec Marshmallow | Bob Covello

Cyber protection for SMEs

According to the South African Banking Risk Information Centre (SABRIC), SA ranks third highest in the world for cyber-attacks. Whilst there do not appear to be stats on the local SME sector, internationally a report by Deloitte reveals that in Holland, cybercrime costs the Dutch SME sector 1 billion Euro each year. At today’s exchange rate, that equates to R16704 250 000,00. The figure for the Dutch economy as a whole is put at around €10 billion, or 1,3% of that country’s GDP.

Cyber protection for SMEs | Technews
SA Ranks World’s Third Highest Cybercrime Victims | Business Media MAGS
Cybercrime costs Dutch SME sector €1 billion each year | Deloitte NL

Worm Resurfaces

(Guest Post by my friend and colleague Jarred Reid-Robertson)
Over the past week, I have seen an upsurge in alerts across the customer base; whereby a worm has been seen surfacing introduced by removable media devices.

Let me give a short boring description of what a computer worm is “A computer worm is a form of malware computer program that replicates itself in order to spread to other computers with the ability to change itself to avoid being detected by signature based anti-viruses”.

This worm is doing the rounds and seems to exploit the windows autorun.ini feature which automatically execute the worm. It spreads to the computer which in turn could infect files such as “google chrome.ink” and if left unchecked your entire environment.

I have two pieces of advice:

The First One, check your antivirus solutions and confirm with your managed service providers and teams that they are aware and ensuring the latest antivirus detection rules and latest patching levels.  As my team and I continuously monitor these types of threats, please contact me for advice and support. 

The Second piece of advice I can give is to review the autorun feature within your IT environments and enforce centralised policy. I always, as a rule, disable them within managed IT environments and as a policy we block this feature.

Does your Anti-Virus still only do signature-based Detection? | Rakesh Sharma
Worm:Win32/Autorun.gen!inf | Microsoft

This week in the J2 CSC, What can be worse than a false sense of security? Bad Hygiene, the Zuckerbot Privacy Malfunction Protocol and Precision Agriculture.

What a week we have had, and as a scholar and a humble consumer of wisdom and knowledge some days I become a bit overwhelmed by the sheer scale of destruction that I observe on a daily basis. Which brings me back to the now infamous quote by Robert Oppenheimer, after he witnessed the first detonation of a nuclear weapon during the Trinity nuclear tests on July 16, 1945. He was famously quoted from the sacred Hindu text the Bhagavat-Gita: “Now I am become Death, the destroyer of worlds”. It is, perhaps, the most well-known line from the Bhagavad-Gita, and to my mind also the most misunderstood.

From my very humble and limited understanding; Krishna is stating that you have to simply do your duty as a warrior. Considering the two pole opposites, Peace and War. Within peace time you wouldn't have to do this, but when you are at war you have to. In the larger scheme of things, we are at War (under assault) and have been for quite some time; We are witnessing destruction on a massive scale and have a choice to make: either be on the side-lines or get into the fight! So within Destruction there is renewal, Information Security and Cybersecurity / Defence, whatever you want to call it, for the most part has failed, and the logical conclusion is to break it down (Destroy) and start again, reset you prejudices so that the renewal can begin!

With this in mind, enjoy our roundup of stories for this week…

What is Worse than security?

What are account takeovers (ATOs) and why do we care? How can you decipher between fact or fiction? With Security Vendors and Service Partners promising solutions. Getting it right matters. So here they are, plain and simple, so you can make the best decisions for your company, employees and customers, the six most popular ATO approaches on the market and reasons why ATOs are successful even with them in place.

1. Multi-Factor Authentication
   Usability -
   It’s about how many people would we drive out if we force them to use additional security.
2. Password Managers
   Password Reuse -
   It doesn’t take a mathematician to figure out that passwords are widely re-used among multiple sites and applications and guess your current version of your password.
3. 90-Day Password Rotations
   Password Compromise -
   Frequent password changes only inconvenience attackers, probably not enough to offset the inconvenience to users.
4. Behavior or Heuristics-Based Solutions
   Compromised Detection -
   Detection of Compromised accounts and action upon the compromise without delay.
5. Deep & Dark Web Scanners, Crawlers and Scrapers
   For Our Eyes Only -
   Scanners, therefore, only pick up redacted samples of what threat actors use to advertise their products publicly.
6. Corporate Policy
   General Policy Statements expected to solve Specific Requirements -
   Implementing policies, it becomes clear that threat lurk between the lines for companies to monitor their employees’ exposure due to password reuse between personal and employee accounts.

Six Reasons for a False Sense of Security - ATOs |  SpyCloud

To err is Human to make the same mistakes is just bad Hygiene

My frustration has no bounds while questing to update home routers, trying to find the right firmware is probably the major reason my hair is not a thick and lush as it once was, so without delay, here are the five commonly-forgotten security best practices.

The Biggest “Small” Personal Digital Security Mistakes | Lesley Carhart, Full Spectrum Cyber-Warrior Princess (hacks4pancakes)

The Zuckerbot Malfunction Protocol and WhatsApp with privacy at Facebook?

With the ongoing Zuckerbot privacy malfunctions, the co-founder of WhatsApp, Jan Koum, is leaving Facebook; and trust me this is a loss of one of the strongest advocates for privacy inside Facebook.
Apparently this is due to the ongoing Rock'em Sock'em Robots Clash within the parent company over WhatApp’s strategy and Facebook’s attempts to use its personal data and weaken its encryption.

WhatsApp co-founder to quit in loss of privacy advocate at Facebook | David Ingram

Precision Agriculture and AI

While looking at emerging application of the Digital Transformation Paradigm, I found this really interesting perspective and though you might enjoy this huge opportunity in a cause that is very close to my heart: “Food Waste”.
As human populations increase, utilizing every centimetre of arable land and conserving resources is paramount to meet demand and for sustainable agriculture systems and as automation isn’t new to the agriculture industry, the use of drones to make farm production more precise is still in its infancy.

Why Precision Agriculture Will Change How Food Is Produced | Jennifer Kite-Powell

In this week’s news roundup I am always intrigued and mildly bemused by the  annual Verizon reports. Information security, Data breaches, firmly on the board agenda, is the problem everyone has to deal with and not the only problem that IT and security professionals have to deal with anymore. Ongoing impacts are continuously felt across the whole business and its eco systems—from Business Continuity and Disaster Recovery Planning to legal teams, tied up in perpetual firefighting mode in term of advisory, seeking external opinion in terms of litigation, to your coalface employees, who can’t execute on the day to day operational activities they need to do their jobs. Everyone is an integral part in managing the risks and issues, people make mistakes and are not always malicious in intent. Visibility is key to understanding the problem, and then, and only then, can decisive action can be taken!

Verizon 2018 Data Breach Investigations Report

Verizon released the 11th version of their Data Breach Investigations Report (DBIR) for 2018 on the 10^th of April.
The headline for this year’s report is ransomware, present in 39% of malware related cases.
Beyond ransomware, other highlights from the report include:

• 53,308 reported security incidents, 2,216 data breaches, 65 countries, 67 contributors
• 76% of reported breaches were financially motivated
• 72% of reported attacks were perpetrated by outsiders
• 50% of reported attacks were perpetrated by organized crime groups
• Pretexting incidents nearly tripled from last year
• Companies are 3x more likely to be breached by social attacks than vulnerabilities

2018 Data Breach Investigations Report | Verizon

Unpatched Vulnerabilities Are The Source Of Most Data Breaches

It is all and well that we are all in the same boat in terms of keeping the lights on within all our own respective enterprises; by 2018 I had an expectation, as a starry eyed kid, that we would be commuting for home to work in flying cars and have automatons as personal assistants enhancing every aspect of our daily lives. The reality for most of the aforementioned enterprises, is that we cannot get the basics right, like patch management, let alone focus on innovation.

Here is an insightful report that the Ponemon Institute and ServiceNow put together detailing how much of a problem we are all facing.
Some of the insights include the concept of “patching paradox”, whereby the idea of hiring more people will improve security hygiene. Though in reality it doesn’t. 64% of companies are planning to hire more dedicated people to handle
vulnerabilities, accounting for a 50% increase in headcount – this alone will not improve their security posture if they don’t fix broken patching processes. The study shows that firms struggle with patching because they use manual processes and can’t prioritize what needs to be patched first. As stated previously due to the manual patching process 61% admit that this manual approach to patching puts them at a disadvantage, and 55% note that they spend more time dealing with internal processes than managing the vulnerabilities. All agree that more than 12 days are lost coordinating between teams to get patches applied. Some key Insights include:

• 73% have no common view of assets and applications across security and IT
• 57% admit that patches slip through the cracks due to emails and spreadsheets used to manage the process
• 62% have no easy way to track whether vulnerabilities of being patched in a timely manner
• 65% say they find it difficult to prioritize what needs to be patched first

Today’s state of vulnerability response: patch work demands attention | Ponemon Institute and ServiceNow

Brian Krebs angers userbase of pr0gramm.com for a good cause

• The angry userbase of pr0gramm.com, a German image board similar to Imgur, blocked by my Zscaler Agent ????, has donated over €103,000 ($126,000) to local cancer research organizations as a way to protest against an article published by Brian Krebs, an IT security journalist.
  
  Angry Users Donate $120K to Cancer Research After Brian Krebs' Coinhive Article| Bleeping Computer

Your Old Bitcoin addresses can be stolen so move now!

All Bitcoin addresses generated using the BitAddress client-side wallet pre-2013 and Bitcoinjs pre-2014 are affected.
Bitcoin users who generated Bitcoin addresses using affected tools are advised to generate new Bitcoin addresses with a new tool and move funds from old accounts to the new ones.

Old JavaScript Crypto Flaw Puts Bitcoin Funds at Risk | Bleeping Computer

How does Facebook make money anyway?

Revenues from Facebook’s two largest markets – North America and Europe - are expected to be affected as a result of the fallout from the Cambridge Analytica scandal. Both are extremely lucrative markets for Facebook. In 2017, Facebook earned an average of $84.41 from each North American user and $27.26 from each user in Europe. In contrast, each user in Asia was worth $7.61. Good news for Facebook investors is that the company is making significant inroads into new markets, such as Africa and Asia. While it does not contribute much to overall revenue, WhatsApp has become a runaway hit with users in Asia and South America. Other services, such as Instagram, are also making inroads into new markets.

How Does Facebook Make Money? | Rakesh Sharma