Monthly ArchivesApril 2018

By the end of this year, there will be billions of connected endpoints. The world has never seen a larger digital threat surface. And it has never seen one that is so poorly-secured.

“The ease with which hackers can exploit security vulnerabilities in these cheap and plentiful [IoT] devices is disturbing,” writes PivotNine Chief Analyst Justin Warren. “It threatens the reliability of the Internet upon which millions of people have come to depend…the flood of new Internet-connected devices only increases each year, as the hype train gathers speed and those with dreams of striking it rich join in with this latest gold rush.”

These vendors are not interested in security. They are not interested in the expenses involved in protecting data – whether business or consumer. They are interested in ease-of-use, cost of distribution, and time-to-market.

And they are largely interested in consumers, who do not have the same security concerns as businesses. Yet a smart thermostat or connected coffee maker can see use in an office just as easily as a home. Once such a device is patched into a corporate network, it is essentially an invitation to hackers.

Until the regulatory climate surrounding IoT devices matures, this will not change. There is currently no liability for vendors and manufacturers. There is no reason for most of them to care about cybersecurity.

It is therefore up to us – all of us – to take IoT security into our own hands:

• Pursue a new mindset. The onus of corporate data security is still largely in the hands of employees – but they cannot be expected to secure the coming flood of endpoints. Your business must pursue new security practices and processes, such as automation and intelligent threat mitigation.

• Train your staff. Cybersecurity training is more critical than ever. Update your awareness programs to incorporate the importance of IoT security, and include advice on how workers can protect their own smart hardware at home.

• Understand your endpoints. Use an endpoint management solution that allows you to directly manage and monitor smart endpoints. You need more than EMM or MDM.

• Segment nonessential devices. Your office coffee machine and thermostat do not need to be on your core network. Configure a guest network for non-essential endpoints, and isolate it from your business’s main network.

• Automate your updates. In addition to working with vendors who pledge to take security seriously, ensure that IoT updates are applied automatically – there is no other way to keep all your endpoints up to date.

• Configure every IoT device.  This includes changing the default username and password and testing each new device for vulnerabilities.  

From a cybersecurity perspective, the Internet of Things is a mess. But it also represents one of the best evolutions for both our personal and professional lives. That’s why there is no slowing the growth of IoT – the best you can do is prepare yourself for the risks it brings with it.

And now you know how to do exactly that.

Posted in:
Security

Cybersecurity is a constant balancing act between convenience and data protection. The former always wins, no matter how much IT professionals might wish otherwise. The consumerization of IT is at the heart of this issue.

Modern workers demand that the tools and applications they are provided in the workplace offer a user experience in-line with what they use in their personal life. When that demand is ignored, they are remarkably skilled at circumventing security protocols. They are interested in doing their jobs – not in adhering to IT’s expectations on how to protect their data.

Worse, even if you do manage to somehow strike a balance, security is not certain. Workers may still have a lax attitude towards protecting corporate data. Learning to recognize such an attitude is essential.

They Dislike Your IT Department

Your IT department should be seen by others within the organization as valuable members of the team. If workers consider them an impediment or roadblock to doing their jobs, that’s a sure sign something needs to change – both culturally and with your security processes. The divide between IT professionals and regular workers is a relic of the past.

Let’s leave it there.

They Overuse Consumer Apps And Devices

There is nothing wrong with the regulated use of consumer tools in the workplace. Some of them can actually be secure under the right conditions. But if every single worker in your business uses consumer apps instead of corporate ones, this signifies two things.

First, your corporate tools are inadequate. Second, your workers don’t understand the reason you mandate their usage. The first can only be solved by revisiting the toolkit you provide your employees – the second will require security awareness training.

They’re Careless

Do your workers still use old, insecure passwords? Do they even bother changing their default login information when given a new account? Do they use consumer file-sharing services and thumb drives for sharing sensitive data?

Most employees are well-intentioned, but ignorant. They might accidentally forward a document to the wrong recipient, or open a phishing email without realizing it’s not actually from their boss. Security awareness training is necessary to mitigate this carelessness.

Cybersecurity Is Serious Business

Your employees are your most valuable resource – but they are also your biggest cybersecurity headache. It is your job to teach them about the importance of good security practices. Show them how to properly use software, talk to them about the importance of a password manager, and inform them of how to recognize phishing scams and malicious emails (to name a few examples).

Because while many of them may be ignorant now, that doesn’t mean they should remain so. Do your part to help them take cybersecurity more seriously. Your customers and stakeholders will thank you for it – and you’ll be glad you made the effort.

Posted in:
Security

How well-equipped is your IT department? Do your administrators have everything they need to do their jobs effectively? If you don’t know the answers to those questions, you need to learn them.

These are the men and women who, at the end of the day, are your best (perhaps only) defense against the array of cyberthreats facing your business and its data. Treat them well and provide them with what they need, and they will keep your business secure. Mistreat them and expect them to spin gold from twine?

You may as well hand your files to a hacker yourself.

But how exactly can you tell if your administrators are frustrated and put-upon? What are the warning signs your IT department is under-resourced or understaffed? And more importantly, what can you do about it?

Your first step is to examine both workplace culture and the status of your own software and hardware:

• You regularly hear employees talking about how difficult an administrator (or the entire department) is to deal with. Such a hostile relationship could indicate serious frustrations on both sides.
• IT workers seem apathetic or disconnected when you interact with them – as though they don’t care about your organization.
• Your IT systems have not been updated or improved in years.
• Security updates and device provisioning are not automated – everything must be done manually.
• Your executive board constantly pushes for new technology or functionality, simply because they can – not because they need it.
• You find yourself regularly disregarding or ignoring the advice of your administrators (or notice colleagues doing the same).
• If your organization is struck by a data breach, your administrators seem unsurprised by it.
• You do not have security awareness or risk management training at your organization. Employees are simply left to their own devices.

When In Doubt, Communicate

It was once a common misconception that cybersecurity is solely the domain of IT. This idea is toxic. There needs to be an open dialogue between IT and every other department and executive within your organization.

In other words, the best way you can determine whether or not your administrators are happy with your business’s security practices is to simply talk to them. Ask them about what they need to better do their jobs. Ask them how they might improve organizational security posture.

Remember that you’re all in this together – and that by working together, you can achieve far more than you ever could divided.

Posted in:
Security

Cryptomining malware is a new form of malware that uses the resources of compromised servers and hosting accounts to generate cryptocurrencies like Bitcoin and Litecoin. Before a coin can be created, miners have to demonstrate “proof of work,” which involves computationally intensive mathematical operations. Legitimate miners buy powerful computers to do the hard work, but criminals use malware-infected machines.

Over the last few weeks the value of cryptocurrencies, particularly Bitcoin, has increased quickly. By using compromised machines to generate coins, criminals create a digital asset that can be converted into hard currency. Because the value of cryptocurrencies is rising, we can expect to see more frequent and sophisticated attacks through 2018.

Cryptocurrencies are based on blockchain technology. A blockchain is a distributed ledger, a data structure that records transactions and is shared, modified, and verified by many different network nodes. The ledger records transactions like transfers of coins between users, but also the creation of new coins. You can read more about how new coins are created here, but, in a nutshell, to create a coin a miner has to prove to the network that they have done an amount of work. Without the proof of work, it would be easy for anyone to make coins and individual coins wouldn’t be worth much.

In the early days of cryptocurrencies, creating coins was easy: they could be generated quickly on low-powered hardware. Over time, the amount of work needed increases, and today serious miners use clusters of machines with powerful GPUs. But the alternative to a few high-powered specialized machines is many low-powered machines like laptops and smartphones.

Cryptomining malware — code injected into websites via known vulnerabilities or installed along with pirate themes and plugins — allows its authors to run the proof-of-work calculations on large networks of compromised machines, generating coins with minimal investment.

One of the most popular pieces of cryptomining malware for WordPress sites is called Cloudflare.solutions, which has nothing to do with the real Cloudflare. Discovered earlier this year, cloudflare.solutions loads malicious cryptomining code. When a user opens a page on a compromised site, the malicious code runs and uses the device’s resources to perform mining operations. Hijacking the processor can degrade browser and device performance and diminish battery life.

In an unpleasant twist, cloudflare.solutions has recently been modified to include a keylogger that sends text entered into WordPress text entry fields, including password fields, to the criminals’ servers.

It should be mentioned that some “legitimate” publishers are taking advantage of cryptomining to generate revenue for their sites. I’ll avoid debating the ethics here, but it’s undeniable that a large number of cryptomining scripts found on the web are the result of exploited sites and are funneling money to criminal organizations.

The best way to avoid being infected by cryptomining malware is to follow standard WordPress security best practices: use two-factor authentication, update your WordPress site when new versions are released, and only install themes and plugins from trusted sources.

Posted in:
Security