CyberheistNews Vol 7 #48
Which of Your Employees Are Most Likely to Expose Your Organization to a Cyber Attack? 
Kon Leong at Harvard Business Review wrote an excellent article about the problem of employees exposing your organization to cyberthreats through human error. Here is a short quote:
"Today, cybersecurity has expanded far beyond its traditional domain of external threats, typified by external hackers attacking network vulnerabilities. It now includes insider threats, which are much more complex and difficult to manage, as evidenced by some very serious recent insider breaches, such as those involving Edward Snowden and Chelsea Manning. The nature of insider threats can be categorized into malicious, accidental, or negligent."
Now, which departments are causing the biggest cybersecurity problems at your office?
TechRepublic wrote: "People are always the weak link when it comes to enterprise cybersecurity—but some departments are more likely to get hit and fall victim to attacks than others.
"Everyone is susceptible to these attacks. Nobody is immune," said Wesley Simpson, COO of (ISC)2. "It doesn't matter what type of organization, how strong you think you are, how much money that you're investing into your hardware and software environment to have the latest and greatest technology. We're all vulnerable, and you can't do it alone."
Here are three departments that are often most likely to fall victim to cyberattacks:
The Harvard Business Review article suggests four areas where you can significantly mitigate this risk:
They recommend:
A recent report by PriceWaterhouseCoopers (PwC) called "Strengthening digital society against cyber shocks", covering key findings from the global state of information security survey 2018 showed that:
“Many organizations need to evaluate their digital risk and focus on building resilience for the inevitable,” said Sean Joyce, PwC’s US Cybersecurity and Privacy Leader. A human firewall is a critical piece of that puzzle.
We can add to this the following from a ransomware report by AlienVault:
Excellent ammo to add to a request for IT security budget for security awareness training. Here is a direct link to the article:
https://hbr.org/2017/12/which-of-your-employees-are-most-likely-to-expose-your-company-to-a-cyberattack
I strongly suggest you get a quote for new-school security awareness training
And find out how affordable this is for your organization. You simply have got to start training and phishing your users ASAP, because your filters never catch all of it. Get a quote now and you will be pleasantly surprised:
https://info.knowbe4.com/kmsat_get_a_quote_now
You can also find this post at the KnowBe4 blog with links to all the referenced reports and graphs:
https://blog.knowbe4.com/which-of-your-employees-are-most-likely-to-expose-your-company-to-a-cyberattack
Kon Leong at Harvard Business Review wrote an excellent article about the problem of employees exposing your organization to cyberthreats through human error. Here is a short quote:
"Today, cybersecurity has expanded far beyond its traditional domain of external threats, typified by external hackers attacking network vulnerabilities. It now includes insider threats, which are much more complex and difficult to manage, as evidenced by some very serious recent insider breaches, such as those involving Edward Snowden and Chelsea Manning. The nature of insider threats can be categorized into malicious, accidental, or negligent."
Now, which departments are causing the biggest cybersecurity problems at your office?
TechRepublic wrote: "People are always the weak link when it comes to enterprise cybersecurity—but some departments are more likely to get hit and fall victim to attacks than others.
"Everyone is susceptible to these attacks. Nobody is immune," said Wesley Simpson, COO of (ISC)2. "It doesn't matter what type of organization, how strong you think you are, how much money that you're investing into your hardware and software environment to have the latest and greatest technology. We're all vulnerable, and you can't do it alone."
Here are three departments that are often most likely to fall victim to cyberattacks:
- IT and development. They are not immune to mistakes or attacks that result in security breaches, as 2017 has proved, said Forrester analyst Jeff Pollard. For example, we saw that Amazon S3 storage buckets were a constant source of data exfiltration, often by security researchers and bug bounty hunters, but also by attackers.
- Finance. A large number of attacks in 2016 and 2017 targeted procurement and finance teams, Pollard said. These attacks attempted to get employees of the company to transfer large sums of money to the attackers, bypassing normal accounts payable procedures and controls. There's no reason to believe those attacks will drop in 2018, he added.
- The C-Suite. C-level executives—including the CEO—are the most at risk of being hacked when working outside the office, according to a recent report from iPass. These employees often work long hours, are rarely confined to the office, and have unrestricted access to the most sensitive company data, making them highly valuable and highly available targets, the report found.
The Harvard Business Review article suggests four areas where you can significantly mitigate this risk:
- Rethink employee training
- Identify high-risk users and intervene
- Shape the solution to the human user and not vice versa
- Constantly adapt to changing threats
They recommend:
- Consider frequent and interactive training sessions
- It’s a case of train, retrain, and repeat
- Use the tried and true method of simulation, sending out mock-phishing emails
A recent report by PriceWaterhouseCoopers (PwC) called "Strengthening digital society against cyber shocks", covering key findings from the global state of information security survey 2018 showed that:
- "Forty-four percent of the 9,500 executives in 122 countries surveyed by the 2018 say they do not have an overall information security strategy.
- Forty-eight percent say they do not have an employee security awareness training program, and 54% say they do not have an incident response process.
“Many organizations need to evaluate their digital risk and focus on building resilience for the inevitable,” said Sean Joyce, PwC’s US Cybersecurity and Privacy Leader. A human firewall is a critical piece of that puzzle.
We can add to this the following from a ransomware report by AlienVault:
- Security professionals rank user awareness training the most effective tactic to prevent and block ransomware (77%) followed by endpoint security solutions (73%), and patching of operating systems (72%) as preventive approaches to ransomware threats.
Excellent ammo to add to a request for IT security budget for security awareness training. Here is a direct link to the article:
https://hbr.org/2017/12/which-of-your-employees-are-most-likely-to-expose-your-company-to-a-cyberattack
I strongly suggest you get a quote for new-school security awareness training
And find out how affordable this is for your organization. You simply have got to start training and phishing your users ASAP, because your filters never catch all of it. Get a quote now and you will be pleasantly surprised:
https://info.knowbe4.com/kmsat_get_a_quote_now
You can also find this post at the KnowBe4 blog with links to all the referenced reports and graphs:
https://blog.knowbe4.com/which-of-your-employees-are-most-likely-to-expose-your-company-to-a-cyberattack
Report: Email Attacks Increasing, But None As Much As Impersonation Phishing
Email filtration is getting good enough to catch most malware, but it's not anywhere near capable of stopping a well-targeted impersonation attack.
How email attacks stack up
The latest ESRA report from Mimecast sifted through nearly 56 million emails. More than 12 million of them were spam, 9,055 contained harmful files, 2,535 came with malware, and 18,971 were impersonation attacks—a 50% quarter-over-quarter increase.
Attacks of all kinds are bound to increase in quantity, but 50% is staggering, especially when harmful files and malware only increased by 15% over the same time frame. The top three takeaways:
https://www.techrepublic.com/article/report-email-attacks-increasing-but-none-as-much-as-impersonation-phishing/
Email filtration is getting good enough to catch most malware, but it's not anywhere near capable of stopping a well-targeted impersonation attack.
How email attacks stack up
The latest ESRA report from Mimecast sifted through nearly 56 million emails. More than 12 million of them were spam, 9,055 contained harmful files, 2,535 came with malware, and 18,971 were impersonation attacks—a 50% quarter-over-quarter increase.
Attacks of all kinds are bound to increase in quantity, but 50% is staggering, especially when harmful files and malware only increased by 15% over the same time frame. The top three takeaways:
- Impersonation attacks have experienced a 50% quarter-over-quarter increase, making them the fastest growing form of email-based cyber attack.
- Impersonation attacks are spear phishing emails that attempt to mimic an internal email, or something from another trusted source. Their goal is to trick a user into giving up financial information or confidential data.
- It's practically impossible for email filters to catch well-crafted impersonation attacks. Security teams need to be on top of user training and penetration testing to be sure an attack doesn't hit them.
https://www.techrepublic.com/article/report-email-attacks-increasing-but-none-as-much-as-impersonation-phishing/
Announcing a Brand-New Email Security Tool: Second Chance
Wouldn't it be great if your users had a way to "roll back time" when they forgot to "think before they clicked"?
What if they could have a second chance, to decide one more time if they *really* wanted to go to that link, or if it actually was too high a risk?
Now they can!
KnowBe4 is excited to announce Second Chance, a brand-new security tool for the Outlook email client that you can download and deploy at no cost.
As the name implies, Second Chance enables your user to make a smarter security decision by giving them a way to back out of that click in the email body or links in email attachments like Office Docs or PDFs.
Second Chance takes a smart look at the clicked URL, and asks your user if they are sure they want to do this, in case they clicked on a potentially unsafe or an unknown website. Second Chance even prompts your user when they click on a Punycode link!
You can set the message your user gets through the Second Chance console, and you also are able to set "No Prompt" domains. You can install it standard, command-line or GPO.
You might ask: "What happens if my user continues or aborts their action?""
If they choose to abort their action, the prompt will be closed, and the URL will not be opened. If they choose to continue, their browser will navigate to the URL they clicked on. Either action taken will be recorded in the data and reports on your console.
Second Chance could one day be the difference between a ransomware infection and a free weekend. Give it a try!
Here is the form to download the install. Again, no charge:
https://info.knowbe4.com/second-chance-tool-chn
Here is the Product Manual:
https://support.knowbe4.com/hc/en-us/articles/115011813867-Second-Chance-Installation-and-User-Guide
Wouldn't it be great if your users had a way to "roll back time" when they forgot to "think before they clicked"?
What if they could have a second chance, to decide one more time if they *really* wanted to go to that link, or if it actually was too high a risk?
Now they can!
KnowBe4 is excited to announce Second Chance, a brand-new security tool for the Outlook email client that you can download and deploy at no cost.
As the name implies, Second Chance enables your user to make a smarter security decision by giving them a way to back out of that click in the email body or links in email attachments like Office Docs or PDFs.
Second Chance takes a smart look at the clicked URL, and asks your user if they are sure they want to do this, in case they clicked on a potentially unsafe or an unknown website. Second Chance even prompts your user when they click on a Punycode link!
You can set the message your user gets through the Second Chance console, and you also are able to set "No Prompt" domains. You can install it standard, command-line or GPO.
You might ask: "What happens if my user continues or aborts their action?""
If they choose to abort their action, the prompt will be closed, and the URL will not be opened. If they choose to continue, their browser will navigate to the URL they clicked on. Either action taken will be recorded in the data and reports on your console.
Second Chance could one day be the difference between a ransomware infection and a free weekend. Give it a try!
Here is the form to download the install. Again, no charge:
https://info.knowbe4.com/second-chance-tool-chn
Here is the Product Manual:
https://support.knowbe4.com/hc/en-us/articles/115011813867-Second-Chance-Installation-and-User-Guide
Live Webinar: Counter The Careless Click, Tools To Help You Train Your Users
Cybercriminals are successfully and consistently exploiting human nature to accomplish their goals. Employee training is tied as the third-most-effective method (higher than antivirus) of decreasing the cost of a data breach.*
Many IT pros know users are the weakest link in network security, but don’t exactly know where to start when it comes to creating a security awareness program that will work for their organization.
Join this 30-minute webinar “Counter the careless click, tools to help you train your users” where Erich Kron CISSP, Security Awareness Advocate of KnowBe4, will provide a practical session with tips and free tools you can implement now to help you create your “human firewall”.
Erich will cover:
Register Now: https://attendee.gotowebinar.com/register/8169791794686637313?source=CHN
* Based on recent research by the Ponemon Institute
Let's stay safe out there.
Cybercriminals are successfully and consistently exploiting human nature to accomplish their goals. Employee training is tied as the third-most-effective method (higher than antivirus) of decreasing the cost of a data breach.*
Many IT pros know users are the weakest link in network security, but don’t exactly know where to start when it comes to creating a security awareness program that will work for their organization.
Join this 30-minute webinar “Counter the careless click, tools to help you train your users” where Erich Kron CISSP, Security Awareness Advocate of KnowBe4, will provide a practical session with tips and free tools you can implement now to help you create your “human firewall”.
Erich will cover:
- Current threat landscape
- Top 5 tips for security awareness
- How to easily create your security awareness program
- Outlining how and where tools are helpful
Register Now: https://attendee.gotowebinar.com/register/8169791794686637313?source=CHN
* Based on recent research by the Ponemon Institute
Let's stay safe out there.
Warm Regards,
Stu Sjouwerman
Founder and CEO
KnowBe4, Inc.
Quotes of the Week
"Whether one believes in a religion or not, and whether one believes in rebirth or not, there isn't anyone who doesn't appreciate kindness and compassion." - Dalai Lama (born 1935)
"A positive attitude causes a chain reaction of positive thoughts, events and outcomes. It is a catalyst and it sparks extraordinary results." - Wade Boggs - Athlete (born 1959)
Thanks for reading CyberheistNews
"A positive attitude causes a chain reaction of positive thoughts, events and outcomes. It is a catalyst and it sparks extraordinary results." - Wade Boggs - Athlete (born 1959)
Thanks for reading CyberheistNews
Security News
Phishing And Social Engineering Are The Big Problems (Malware Not So Much)
We hear a lot about malware, and the picture of the hacker in popular culture is of the hoodied wizard typing his attack code and saying "I'm in." Well, maybe.
But really, not usually. The typical hack is a con. It's social engineering, convincing some user to act against their own best interest. A lot of that social engineering arrives in your email in-box. The first step is acknowledging (and teaching your people to acknowledge) that this is a problem. More at CSO:
https://www.csoonline.com/article/3239644/data-breach/5-computer-security-facts-that-surprise-most-people.html
We hear a lot about malware, and the picture of the hacker in popular culture is of the hoodied wizard typing his attack code and saying "I'm in." Well, maybe.
But really, not usually. The typical hack is a con. It's social engineering, convincing some user to act against their own best interest. A lot of that social engineering arrives in your email in-box. The first step is acknowledging (and teaching your people to acknowledge) that this is a problem. More at CSO:
https://www.csoonline.com/article/3239644/data-breach/5-computer-security-facts-that-surprise-most-people.html
Visual Hacking (That is, Reading Someone's Screen Over Their Shoulder)
Not all hacking involves sophisticated coding skills. And social engineering isn't always as elaborate as running a con game. Sometimes the bad actors can get everything they want by looking over your shoulder. 3M offers a timely reminder that visual hacking hasn't gone away, and that as we increasingly move through crowds, wait in lines, and ride buses, trolleys, and subways with our eyes locked on our phones or tablets, it can be a very easy way of stealing information from the distracted and the unwary.
It can also be a problem in your office, and here some of the more elaborate forms of social engineering, like the crooks' wearing badges identifying them as temps, employees, or contractors, can come into play. In 2015 and 2016 the Global Visual Hacking Experiment looked at awareness of this threat in forty-six companies located variously in China, France, Germany, India, Japan, South Korea, the United Kingdom, and the United States. (The experiment was a white-hat exercise conducted with the knowledge and permission of the participating countries.)
The white hat posed as a temporary employee, security badge in order and properly displayed, and set out to accomplish three "overt tasks": see and log sensitive information from a screen, on a desk, or on a printer; pick up business documents labeled "confidential" from a desk and put them in a briefcase, and use a phone to take a picture of sensitive information on a screen.
The visual hackers were depressingly successful. 91% of the time they were able to get away with sensitive business information. More than half the hacks, 52%, were committed by looking at an employee's unprotected computer screen. The information stolen was, in some 275 of the trials, significant: credentials, financials, even privileged attorney-client communication.
And the information loss was fast, too: in almost half the attempts the testers got what they were after in less than fifteen minutes.
The morals of this story are the familiar lessons of sound operational security. Be aware of your surroundings. Keep your desk clean. Lock your screens when they're unattended. And above all, ask questions. Don't assume that the person you've never seen before must be legitimate, badge or no badge, and don't assume that someone who seems closer to you than they need to be just has a different sense of personal space.
Education and training are key, here, and there's a role for human resources, too: introducing the new employees to their co-workers is more than just a nice thing to do. It can also make a contribution to security. More here:
http://ww2.cfo.com/data-security/2017/12/prevent-visual-hacking/
Not all hacking involves sophisticated coding skills. And social engineering isn't always as elaborate as running a con game. Sometimes the bad actors can get everything they want by looking over your shoulder. 3M offers a timely reminder that visual hacking hasn't gone away, and that as we increasingly move through crowds, wait in lines, and ride buses, trolleys, and subways with our eyes locked on our phones or tablets, it can be a very easy way of stealing information from the distracted and the unwary.
It can also be a problem in your office, and here some of the more elaborate forms of social engineering, like the crooks' wearing badges identifying them as temps, employees, or contractors, can come into play. In 2015 and 2016 the Global Visual Hacking Experiment looked at awareness of this threat in forty-six companies located variously in China, France, Germany, India, Japan, South Korea, the United Kingdom, and the United States. (The experiment was a white-hat exercise conducted with the knowledge and permission of the participating countries.)
The white hat posed as a temporary employee, security badge in order and properly displayed, and set out to accomplish three "overt tasks": see and log sensitive information from a screen, on a desk, or on a printer; pick up business documents labeled "confidential" from a desk and put them in a briefcase, and use a phone to take a picture of sensitive information on a screen.
The visual hackers were depressingly successful. 91% of the time they were able to get away with sensitive business information. More than half the hacks, 52%, were committed by looking at an employee's unprotected computer screen. The information stolen was, in some 275 of the trials, significant: credentials, financials, even privileged attorney-client communication.
And the information loss was fast, too: in almost half the attempts the testers got what they were after in less than fifteen minutes.
The morals of this story are the familiar lessons of sound operational security. Be aware of your surroundings. Keep your desk clean. Lock your screens when they're unattended. And above all, ask questions. Don't assume that the person you've never seen before must be legitimate, badge or no badge, and don't assume that someone who seems closer to you than they need to be just has a different sense of personal space.
Education and training are key, here, and there's a role for human resources, too: introducing the new employees to their co-workers is more than just a nice thing to do. It can also make a contribution to security. More here:
http://ww2.cfo.com/data-security/2017/12/prevent-visual-hacking/
What’s On The Horizon For Security And Risk Management Leaders?
By 2022, cybersecurity ratings will become as important as credit ratings when assessing the risk of business relationships, Gartner analysts believe.
They also predict that, by 2020, 60% of organizations engaging in M&A (mergers and acquisitions) activity will consider cybersecurity posture as a critical factor in their due diligence process. Having a mature security awareness training program in place by then will count heavily, better start now:
https://www.helpnetsecurity.com/2017/12/07/risk-management-leaders/
By 2022, cybersecurity ratings will become as important as credit ratings when assessing the risk of business relationships, Gartner analysts believe.
They also predict that, by 2020, 60% of organizations engaging in M&A (mergers and acquisitions) activity will consider cybersecurity posture as a critical factor in their due diligence process. Having a mature security awareness training program in place by then will count heavily, better start now:
https://www.helpnetsecurity.com/2017/12/07/risk-management-leaders/
Left of Boom
Security too often exists in tension with usability. This is as true of organizations as it is of individuals. Policies, however well-intentioned and however much they might improve security, won't be followed if they make it difficult or impossible for people to do their jobs. Email is of course a very common attack vector, and if no one in an enterprise used it, that enterprise would become immediately more secure.
But that's impractical. Email remains an essential business tool in all sorts of ways. So the challenge is to devise training and policies that help people use it safely. So communicate, educate, test, and patch. See more here:
http://searchenterprisedesktop.techtarget.com/tip/Relaxed-security-lets-email-phishing-sink-an-organization
Security too often exists in tension with usability. This is as true of organizations as it is of individuals. Policies, however well-intentioned and however much they might improve security, won't be followed if they make it difficult or impossible for people to do their jobs. Email is of course a very common attack vector, and if no one in an enterprise used it, that enterprise would become immediately more secure.
But that's impractical. Email remains an essential business tool in all sorts of ways. So the challenge is to devise training and policies that help people use it safely. So communicate, educate, test, and patch. See more here:
http://searchenterprisedesktop.techtarget.com/tip/Relaxed-security-lets-email-phishing-sink-an-organization
48 Servers Of North Carolina County Held Hostage by LockCrypt Ransomware
One of the more common payloads a phishing email can carry is ransomware, either real criminal extortion as seen with Locky, Scarab, and other currently common strains, or destructive pseudoransomware like Notpetya.
Organizations that depend upon the availability of their data are especially vulnerable to ransomware, which is why some of the earliest and still most common targets are healthcare providers.
Even TV showrunners now know this: a recent episode of Grey's Anatomy, for example, recently featured a storyline about how Grey Sloan Memorial Hospital lost access to its medical records in a ransomware attack. It's dramatized, but it might serve as a teaching tool to convince the skeptical that this is a real problem.
Local governments and their agencies, down to transit systems and public libraries, have also figured prominently among ransomware victims. One local government, Mecklenburg County, North Carolina, offers a good example of what to do both left and right of boom. The county, whose largest city is Charlotte, was hit by ransomware that demanded 23,000.00 to return access to affected systems. The county said "no," a good response, and they were able to do so because their preparations were sound: they had a solid plan in place to back up their data.
So what might have been a disaster became an inconvenience. See the New York Times piece here:
https://www.nytimes.com/2017/12/06/us/mecklenburg-county-hackers.html
I do not have to tell you how this could have been prevented.
One of the more common payloads a phishing email can carry is ransomware, either real criminal extortion as seen with Locky, Scarab, and other currently common strains, or destructive pseudoransomware like Notpetya.
Organizations that depend upon the availability of their data are especially vulnerable to ransomware, which is why some of the earliest and still most common targets are healthcare providers.
Even TV showrunners now know this: a recent episode of Grey's Anatomy, for example, recently featured a storyline about how Grey Sloan Memorial Hospital lost access to its medical records in a ransomware attack. It's dramatized, but it might serve as a teaching tool to convince the skeptical that this is a real problem.
Local governments and their agencies, down to transit systems and public libraries, have also figured prominently among ransomware victims. One local government, Mecklenburg County, North Carolina, offers a good example of what to do both left and right of boom. The county, whose largest city is Charlotte, was hit by ransomware that demanded 23,000.00 to return access to affected systems. The county said "no," a good response, and they were able to do so because their preparations were sound: they had a solid plan in place to back up their data.
So what might have been a disaster became an inconvenience. See the New York Times piece here:
https://www.nytimes.com/2017/12/06/us/mecklenburg-county-hackers.html
I do not have to tell you how this could have been prevented.
Cyberattack: It Can't Happen to Us (Until It Does)
Just because your small or medium-sized business doesn't have tens of millions of customers, or the name recognition of a Target or a Yahoo, doesn't mean you're immune to becoming a cybercrime victim. In fact, there's a good chance that your SMB has been victimized and you don't know it.
The Identity Theft Resource Center has tracked security breaches since 2005. They estimate that 1,055,228,349 unique records containing personal identifying information have been compromised in nearly 8,000 data breaches that have occurred between January 1, 2005, and November 22, 2017.
If those numbers don't grab your attention, consider that the average cost for each lost or stolen record containing sensitive and confidential information is 141.00, according to the Ponemon Institute's "2017 Cost of Data Breach Study."
That cost jumps for businesses in financial services (245.00) and healthcare (380.00). Those dollar amounts do not include the cost of notifying affected parties. They also don't account for damage to your reputation.
Are your company's pockets deep enough to weather that financial storm? Even if they are, wouldn't you rather spend that money on marketing your products and services, new R&D, or business expansion?
What can a small business or a startup do to lessen the chance it becomes a cybercrime victim? Here are three commonsense steps that any business can take:
https://www.darkreading.com/risk/cyber-attack-it-cant-happen-to-us-(until-it-does)/a/d-id/1330533?
Just because your small or medium-sized business doesn't have tens of millions of customers, or the name recognition of a Target or a Yahoo, doesn't mean you're immune to becoming a cybercrime victim. In fact, there's a good chance that your SMB has been victimized and you don't know it.
The Identity Theft Resource Center has tracked security breaches since 2005. They estimate that 1,055,228,349 unique records containing personal identifying information have been compromised in nearly 8,000 data breaches that have occurred between January 1, 2005, and November 22, 2017.
If those numbers don't grab your attention, consider that the average cost for each lost or stolen record containing sensitive and confidential information is 141.00, according to the Ponemon Institute's "2017 Cost of Data Breach Study."
That cost jumps for businesses in financial services (245.00) and healthcare (380.00). Those dollar amounts do not include the cost of notifying affected parties. They also don't account for damage to your reputation.
Are your company's pockets deep enough to weather that financial storm? Even if they are, wouldn't you rather spend that money on marketing your products and services, new R&D, or business expansion?
What can a small business or a startup do to lessen the chance it becomes a cybercrime victim? Here are three commonsense steps that any business can take:
- Train Your Team
- Assess Your Risk
- Ask For Help
https://www.darkreading.com/risk/cyber-attack-it-cant-happen-to-us-(until-it-does)/a/d-id/1330533?
Ransomware Up Nearly 2,000% In Two Years As “Cyber Mafia” Hit Business
Cyber attacks on businesses in 2017 grew in frequency, sophistication and malice, a report on the new age of organized cyber crime reveals.
The new generation of cyber criminals increasingly resembles traditional mafia organizations, requiring a new approach to dealing with it, according to a report by security firm Malwarebytes.
Cyber criminals have the same professional organization as mafia gangs of the 1930s, but they also share a willingness to intimidate and paralyze victims, the report shows.
Malwarebytes’ analysis also shows that, in spite of acknowledging the severe reputational and financial risks of cyber crime, many business leaders greatly underestimate their vulnerability to such attacks.
“The new mafia, identified by our report, is characterized by the emergence of four distinct groups of cyber criminals: traditional gangs, state-sponsored attackers, ideological hackers and hackers-for-hire,” said Marcin Kleczynski, CEO of Malwarebytes. More:
http://www.computerweekly.com/news/450431447/Ransomware-up-nearly-2000-in-two-years-as-cyber-Mafia-hit-business
And what’s behind the rising tide of ransomware? IBM explains:
https://securityintelligence.com/whats-behind-the-rising-tide-of-ransomware/
Cyber attacks on businesses in 2017 grew in frequency, sophistication and malice, a report on the new age of organized cyber crime reveals.
The new generation of cyber criminals increasingly resembles traditional mafia organizations, requiring a new approach to dealing with it, according to a report by security firm Malwarebytes.
Cyber criminals have the same professional organization as mafia gangs of the 1930s, but they also share a willingness to intimidate and paralyze victims, the report shows.
Malwarebytes’ analysis also shows that, in spite of acknowledging the severe reputational and financial risks of cyber crime, many business leaders greatly underestimate their vulnerability to such attacks.
“The new mafia, identified by our report, is characterized by the emergence of four distinct groups of cyber criminals: traditional gangs, state-sponsored attackers, ideological hackers and hackers-for-hire,” said Marcin Kleczynski, CEO of Malwarebytes. More:
http://www.computerweekly.com/news/450431447/Ransomware-up-nearly-2000-in-two-years-as-cyber-Mafia-hit-business
And what’s behind the rising tide of ransomware? IBM explains:
https://securityintelligence.com/whats-behind-the-rising-tide-of-ransomware/
KnowBe4 Introduces New Feature: Security Roles
KnowBe4 is proud to announce the introduction of a new feature, Security Roles. Security Roles can be used to assign granular access throughout the KnowBe4 console. Each Security Role is completely customizable to allow for the creation of the exact roles needed by your organization.
Because the roles are not simply a set of predefined permissions it is possible to create the exact permission model that fits your needs. Below are some common scenarios where Security Roles will allow the console administrator to give users access to only the portions of the KnowBe4 console that are needed to obtain their results:
https://info.knowbe4.com/kmsat-request-a-demo-chn
In other related news, We are extremely pleased to tell you that KnowBe4 hase won a prestigious award. Frost & Sullivan is a global research and consulting firm and they recently announced that we received their 2017 North American Cybersecurity Awareness and Training Platform Customer Value Leadership Award.
This is a pretty big deal. More here:
https://blog.knowbe4.com/knowbe4-wins-frost-sullivan-cyber-security-awareness-training-platform-customer-value-leadership-award
KnowBe4 is proud to announce the introduction of a new feature, Security Roles. Security Roles can be used to assign granular access throughout the KnowBe4 console. Each Security Role is completely customizable to allow for the creation of the exact roles needed by your organization.
Because the roles are not simply a set of predefined permissions it is possible to create the exact permission model that fits your needs. Below are some common scenarios where Security Roles will allow the console administrator to give users access to only the portions of the KnowBe4 console that are needed to obtain their results:
- Auditors that need to review training history
- HR departments that want to see individual user results
- Training groups that want to review training content prior to deployment
- Review (but don't touch!) results of phishing tests
- Management of Users and Groups
- Create new Phishing Security Campaigns
- Review of training content available in the ModStore
https://info.knowbe4.com/kmsat-request-a-demo-chn
In other related news, We are extremely pleased to tell you that KnowBe4 hase won a prestigious award. Frost & Sullivan is a global research and consulting firm and they recently announced that we received their 2017 North American Cybersecurity Awareness and Training Platform Customer Value Leadership Award.
This is a pretty big deal. More here:
https://blog.knowbe4.com/knowbe4-wins-frost-sullivan-cyber-security-awareness-training-platform-customer-value-leadership-award
Interesting News Items This Week
Bitcoin uses about as much electrical power as the country of Denmark. This has led to belated concerns about the sustainability of the cryptocurrency, and perhaps other blockchain-based systems:
https://digiconomist.net/bitcoin-energy-consumption
Here’s How Boards Should Measure Anti-Phishing Programs:
https://phishme.com/heres-boards-measure-anti-phishing-programs/
Customers are leaving a personal data trail behind in rental vehicles:
https://www.v3.co.uk/v3-uk/news/3022575/rental-companies-failing-to-protect-customer-data-says-report
Krebs on Security — Phishers Are Upping Their Game. So Should You:
https://krebsonsecurity.com/2017/12/phishers-are-upping-their-game-so-should-you/
Security Awareness Training company, KnowBe4, has stepped up to the plate and started to talk about Artificial Intelligence Driven Agent or AIDA:
https://www.csoonline.com/article/3239527/phishing/can-ai-eliminate-phishing.html
Security Think Tank: Employees are in the cyber attack firing line, so educate them well:
http://www.computerweekly.com/opinion/Security-Think-Tank-Employees-are-in-the-cyber-attack-firing-line-so-educate-them-well
100,000-strong botnet built on router 0-day could strike at any time:
https://arstechnica.com/information-technology/2017/12/100000-strong-botnet-built-on-router-0-day-could-strike-at-any-time/
Russian hackers hold UK to ransom. Article in The Times (paywall):
https://www.thetimes.co.uk/article/russian-hackers-hold-uk-to-ransom-r960c00fz
Salted Hash Episode 10: Office 365 phishing examples, the bad and the ugly:
https://www.csoonline.com/article/3239727/security/salted-hash-ep-10-office-365-phishing-examples-the-bad-and-the-ugly.html
Social Engineer Shows How to Get Easy Cash at Black Hat Europe:
https://www.infosecurity-magazine.com/news/bheu-social-engineer-easy-cash/
Despite Equifax Breach Causes, Social Engineering Still Biggest Threat to Data Security:
https://www.lexology.com/library/detail.aspx?g=b0356db3-a8a3-453b-8ee7-f5ae287b2b51
8 security breaches that got someone fired:
https://www.csoonline.com/article/2859485/data-breach/the-buck-stops-here-8-security-breaches-that-got-someone-fired.html
Bitcoin uses about as much electrical power as the country of Denmark. This has led to belated concerns about the sustainability of the cryptocurrency, and perhaps other blockchain-based systems:
https://digiconomist.net/bitcoin-energy-consumption
Here’s How Boards Should Measure Anti-Phishing Programs:
https://phishme.com/heres-boards-measure-anti-phishing-programs/
Customers are leaving a personal data trail behind in rental vehicles:
https://www.v3.co.uk/v3-uk/news/3022575/rental-companies-failing-to-protect-customer-data-says-report
Krebs on Security — Phishers Are Upping Their Game. So Should You:
https://krebsonsecurity.com/2017/12/phishers-are-upping-their-game-so-should-you/
Security Awareness Training company, KnowBe4, has stepped up to the plate and started to talk about Artificial Intelligence Driven Agent or AIDA:
https://www.csoonline.com/article/3239527/phishing/can-ai-eliminate-phishing.html
Security Think Tank: Employees are in the cyber attack firing line, so educate them well:
http://www.computerweekly.com/opinion/Security-Think-Tank-Employees-are-in-the-cyber-attack-firing-line-so-educate-them-well
100,000-strong botnet built on router 0-day could strike at any time:
https://arstechnica.com/information-technology/2017/12/100000-strong-botnet-built-on-router-0-day-could-strike-at-any-time/
Russian hackers hold UK to ransom. Article in The Times (paywall):
https://www.thetimes.co.uk/article/russian-hackers-hold-uk-to-ransom-r960c00fz
Salted Hash Episode 10: Office 365 phishing examples, the bad and the ugly:
https://www.csoonline.com/article/3239727/security/salted-hash-ep-10-office-365-phishing-examples-the-bad-and-the-ugly.html
Social Engineer Shows How to Get Easy Cash at Black Hat Europe:
https://www.infosecurity-magazine.com/news/bheu-social-engineer-easy-cash/
Despite Equifax Breach Causes, Social Engineering Still Biggest Threat to Data Security:
https://www.lexology.com/library/detail.aspx?g=b0356db3-a8a3-453b-8ee7-f5ae287b2b51
8 security breaches that got someone fired:
https://www.csoonline.com/article/2859485/data-breach/the-buck-stops-here-8-security-breaches-that-got-someone-fired.html
Cyberheist 'Fave' Links
This Week's Links We Like, Tips, Hints and Fun Stuff
- This you must see: 314 viral YouTube clips perfectly edited by Luc Bergeron (aka Zapatou) to the music of 'Sanctis' by Worakls:
http://www.flixxy.com/best-of-the-web-2017-by-zapatou.htm?utm_source=4
- A compilation of some of the best video clips from the year 2017 by the YouTube channel People Are Awesome:
http://www.flixxy.com/most-awesome-people-of-the-year-2017.htm?utm_source=4
- James May is still alive. Promo for The Grand Tour Season 2:
https://www.youtube.com/watch?v=uaLwpoULKRY&feature=youtu.be
- This Is So Cool - Wait For It.... How to build a wall without any effort - domino style:
http://www.flixxy.com/this-is-so-cool-wait-for-it.htm?utm_source=4
- Great Escapes! It takes a lot of determination, patience and skill to finally achieve freedom. LOL:
http://www.flixxy.com/great-escapes.htm?utm_source=4
- The Amazing Grace Christmas House was located in Pleasant Grove, Utah. Designed and programmed by Richard Holdman, the display started in 2006, but traffic became too much of an issue and it's no longer running. Richard has gone on to create Holdman Lighting which installs animated lighting displays around the world:
http://www.flixxy.com/best-christmas-lights-display.htm - From The Archives: A Popular Mechanics short film from 1948, showcasing technology of their near and distant future:
http://www.flixxy.com/cars-of-the-future-1948.htm?utm_source=4
