| Security News |
| Cylab Researchers Expose How Our Ability To Spot Phishing Is Spotty |
|
Interesting news item from Carnegie Mellon's Cylab. Each year, tens of millions of phishing emails make it to employees' inbox, not caught by spam filters. Of the ones that make it through, millions slide past your user's judgment and are clicked and opened. A recent study revealed just how likely users are to take the bait.
“Despite the fact that people were generally cautious, their ability to detect phishing emails was poor enough to jeopardize computer systems,” says Casey Canfield, a CyLab researcher from Carnegie Mellon’s Department of Engineering and Public Policy.
In the study, on average participants were only able to correctly identify just over half of the phishing emails presented to them. Fortunately, participants displayed a little more caution when it came to their behavior: roughly three-quarters of the phishing links were left un-clicked.
Based on the results, the authors of the study suggest interventions such as providing users with feedback on their abilities and emphasizing the consequences of phishing attacks. One effective training method that companies commonly use, Canfield explains, is sending out fake phishing emails and teaching a user about phishing emails if they open the email.
“It seems like those trainings may not always be making people better at telling the difference, but it’s probably making them more cautious,” Canfield says. “Helping people tell the difference may not be as useful as just encouraging them to be more cautious.” We agree. Full article here:
https://www.cylab.cmu.edu/news_events/news/2016/gone-phishin-cylab-researchers-expose-how-our-ability-to-spot-phishing-emails-is-far-from-perfect.html
|
| New Phishing Attachment Payload: Windows Troubleshooting Tool |
|
Matthew Mesa at Proofpoint just published this interesting piece on their blog. On top of exploiting the Windows Troubleshooting Tool, this attack also uses OLE embedded objects to kick off the attack:
"Proofpoint researchers have uncovered a new technique of attachment-based delivery. In the observed campaign, the attackers abuse a feature in Windows called the Windows Troubleshooting Platform (WTP), intended for troubleshooting problems, to social engineer the recipients into executing malware.
This attack is particularly effective since execution of WTP is not accompanied by a security warning and users have been conditioned to run the troubleshooter when it appears in Windows. In this case, though, running the troubleshooter leads to the installation of LatentBot, a well-documented modular bot used for surveillance, information stealing, and remote access."
More at: "Looking for Trouble: Windows Troubleshooting Platform Leveraged to Deliver Malware:"
https://www.proofpoint.com/us/threat-insight/post/windows-troubleshooting-platform-leveraged-deliver-malware
|
| FTC Enforcement Possible For Failing To Guard Against Ransomware |
|
The Dataprotection Report site wrote something that may be useful ammo if you need more IT Security budget. At the very least this will raise some eyebrows in the C-suite.
"Recent comments by FTC Chairwoman Edith Ramirez suggest that a company’s failure to take preventative measures to address ransomware could result in an enforcement action by the FTC, even if a company is never actually subject to a ransomware attack.
"The Chairwoman’s comments reflect a growing concern among US government agencies regarding ransomware and may foreshadow additional FTC action, building upon a developing trend of US regulators engaging in pre-breach enforcement action."
If you read the article, the quick conclusion is that Ramirez suggests that failing to patch vulnerabilities exploited by ransomware could result in FTC enforcement before the fact.
The problem with this is that a lot of ransomware relies exclusively on social engineering to get the malcode executed; there *are* no technical controls.
To prevent the FTC coming down like a ton of bricks on your organization, you need to assess the reasonableness of your cybersecurity policies and practices and take actions to remediate any gaps that are identified in the assessment – particularly with respect to ransomware preparedness.
That means new-school security awareness training, which educates employees to make smarter security decisions and keeps them on their toes. Here is the article:
http://www.dataprotectionreport.com/2016/10/ftc-enforcement-possible-for-failing-to-guard-against-ransomware/
And here is a whitepaper that explains the legal principle of "reasonable measures" that any organization is expected to take to prevent lawsuits:
https://info.knowbe4.com/whitepaper-overly-kb4
|
| 5,000 Marin Patients’ Medical Data Lost After Ransomware Attack |
|
The Marin Healthcare District and Prima Medical Foundation are notifying more than 5,000 patients that some of their medical data was lost due to a glitch that followed a ransomware attack in August.
Prima Medical Foundation supports the Prima Medical Group, many of whose doctors work closely with Marin General Hospital.
The computer records of Marin Medical Practice Concepts, a Novato company that provides medical billing and electronic medical records services to many Marin physicians, were taken hostage by ransomware on July 26. As a result, some Marin doctors were unable to access their patients’ medical records for more than a week.
There is a twist in this story though. Ransom was paid and files decrypted but during the restore process, one of MMPC’s backup systems failed, causing information to be lost that was collected at the district’s nine medical care centers between July 11, 2016 and July 26, 2016.”
I recommend you start using weapons-grade backup solutions that allow for 5-minute snapshots and test your restore function religiously. Here is the whole story:
http://www.marinij.com/article/NO/20160929/NEWS/160929766
|
| OUCH! Newsletter From SANS: Four Steps To Stay Secure |
|
SANS wrote: "We are excited to announce the October issue of OUCH! This month, led by Guest Editor Ryan Johnson, we focus on Four Steps to Staying Secure. Far too often people are overwhelmed with the latest technology or security tips and may get confused. By focusing on just these four basic concepts, people will go a long way to securing themselves, regardless of the technology they are using. As such, we ask you share OUCH! with your family, friends, and coworkers." English Version (PDF)
http://securingthehuman.sans.org/newsletters/ouch/issues/OUCH-201610_en.pdf
|
|
|
|
.jpg)
