Organizations ‘not doing enough’ to prevent data breaches

By Narinder Purba

Organizations need to do more to prevent themselves from experiencing data breaches, as many people are of the opinion that not enough is currently being done.

This according to a new report from the Internet Society, which found that 59% of users would be reluctant to do business with an enterprise that had been compromised.

The paper was keen to highlight how damaging a data breach can be. Not only does it negatively affect the organization that has been attacked, it also impacts on its employees and consumers.

Moreover, it damages the way people think about technology. As Michael Kende, the author of the report, noted, “the ultimate casualty is trust in the internet”.

“Without trust, those online are less likely to entrust their personal information to the internet, and, those who are not yet online will have a reason to stay offline.”

“The vision of the Internet Society is that the internet is for everyone, everywhere,” he stated.

“Trust in the internet is at the core of that vision. Without trust, those online are less likely to entrust their personal information to the internet, and, those who are not yet online will have a reason to stay offline.”

One of the most interesting points raised by the paper concerns the seeming lack of investment from businesses in information security, said Kende, an economist and internet society fellow.

He added that while many appreciate the seriousness of data breaches, organizations are “not doing everything they could to prevent” them from happening.

To help change this, the Internet Society has come up with some recommendations on what can be done to boost cybersecurity efforts.

This includes making organizations more accountable for data breaches, making information security a priority and increasing transparency around security incidents around the world.

“Up-to-date security systems, usable security, and awareness on how to deal with threats and social engineering are needed for reducing the opportunities for data breaches and device compromise,” commented Olaf Kolkman, chief internet technology officer at the Internet Society.

“The report shows that as much as 93% of all breaches could have been avoided if the correct measures were put in place.”

A study from earlier this year revealed that many IT professionals are not confident that they would be able to protect data in the event of a successful attack.

http://www.welivesecurity.com/2016/11/24/organizations-not-enough-prevent-data-breaches/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

ESET lance ESET Threat Intelligence, un service d’alerte anticipée pour les entreprises

Dès aujourd’hui, ESET® propose ESET Threat Intelligence, un service qui prédit et informe de manière proactive les clients en temps réel au sujet de menaces qui ciblent leur entreprise. Ceci leur permet de gagner en flexibilité et de s'adapter plus facilement à des menaces qui évoluent rapidement. Bien que ce service ne soit implémenté qu’à partir de 2017, il est disponible dès maintenant aux Pays-Bas, en Pologne, en Espagne et en Ukraine. Pour plus d’informations, veuillez contacter MGK Technologies.

Développé à partir des dernières technologies d'ESET et de la base de connaissances existante, ESET Treat Intelligence permet aux utilisateurs de comprendre et de gérer les risques que coure l’entreprise, d’atténuer les menaces et d’améliorer l’efficacité de leur propre système de défense. 

« Entre les attaques ciblées, les menaces persistantes avancées (APM - advanced persistent threats) ou les attaques botnets zero-day, il est difficile de prévoir une éventuelle attaque ciblée ou une campagne de malware en ne disposant que de l’information des réseaux internes de l’entreprise, » explique Marc Mutelet, CEO de MGK Technologies, distributeur exclusif des produits ESET sur la Belgique et le Luxembourg. «ESET Threat Intelligence offre toute l’information dont ESET dispose afin d’obtenir un état des lieux complet de la sécurité, d’élargir la vue d’ensemble et de combler l’écart entre l’information obtenue en interne et celle disponible à l'échelle mondiale. »

Développé en tant que service, ESET Threat Intelligence se base sur des preuves, des informations contextuelles, divers mécanismes et indicateurs ainsi que d'autres types d'informations concrètes sur les risques existants ou émergeants que coure l’entreprise. Ces éléments peuvent alors être utilisés pour se faire une idée des décisions à prendre.

ESET Threat Intelligence offre les fonctionnalités suivantes :

Rapport sur les menaces ciblées : rapport basé sur des critères personnalisés, qui informe les utilisateurs au sujet des attaques potentielles en préparation ou déjà actives, ciblées spécifiquement sur leur organisation.

Rapport d'activité botnet : fournit des rapports réguliers et des données quantitatives  au sujet des familles de malware identifiées ainsi que les variantes du botnet qui sont surveillées par ESET Threat Intelligence.

Analyse d’échantillon : les utilisateurs ont la possibilité de télécharger vers un serveur des fichiers ou des échantillons afin de générer des rapports personnalisés.

Flux de données : les flux de données sont conçus pour être intégrés dans les systèmes de gestion de sécurité et de gestion d’événements (Security Information and Event Management (SIEM)) existants, et offrent une couche de protection supplémentaire. L’intégration de flux de données permet, par exemple, la corrélation des rapports journaliers arrivant vers le SIEM  en provenance de différents appareils du réseau avec les flux de données d’ESET.

Rapport sur le phishing : basé sur des critères personnalisés, il montre toutes les données concernant le phishing ciblé (d’e-mails) pour le client concerné.

Tableau de bord :  donne un aperçu basique de l'activité.

Accès API : les utilisateurs peuvent connecter à ESET Threat Intelligence depuis leurs propres systèmes internes via API.

Etant un service qui fonctionne sans être déployé sur l’infrastructure réseau d’une entreprise, même ceux qui ne sont pas encore clients ESET peuvent bénéficier des connaissances  d’ESET afin de renforcer la sécurité de leur organisation.

Pour plus d’informations sur ESET Threat Intelligence, visitez www.eset.com ou contactez le distributeur de votre région.  

Siemens-branded CCTV webcams require urgent firmware patch

By Graham Cluley

Siemens-branded IP-based CCTV cameras are the latest internet-connected devices to be found vulnerable to hacking attacks.

In this particular instance, according to a security advisory issued by Siemens, the vulnerability – known as CVE-2016-9155 – could be remotely exploited by malicious attackers to trick CCTV cameras into revealing admin passwords:

The latest update for SIEMENS-branded IP-based CCTV cameras fixes a vulnerability that could allow a remote attacker to obtain administrative credentials from the integrated web server.

Until patches can be applied, restricting access to the integrated web server with appropriate mechanisms is recommended

The following CCTV camera models, built by Vanderbilt Industries who acquired Siemens’ security product line in June last year, are said to be at risk:

·         CCMW3025: All versions prior to 1.41_SP18_S1

·         CVMW3025-IR: All versions prior to 1.41_SP18_S1

·         CFMW3025: All versions prior to 1.41_SP18_S1

·         CCPW3025: All versions prior to 0.1.73_S1

·         CCPW5025: All versions prior to 0.1.73_S1

·         CCMD3025-DN18: All versions prior to v1.394_S1

·         CCID1445-DN18: All versions prior to v2635

·         CCID1445-DN28: All versions prior to v2635

·         CCID1445-DN36: All versions prior to v2635

·         CFIS1425: All versions prior to v2635

·         CCIS1425: All versions prior to v2635

·         CFMS2025: All versions prior to v2635

·         CCMS2025: All versions prior to v2635

·         CVMS2025-IR: All versions prior to v2635

·         CFMW1025: All versions prior to v2635

·         CCMW1025: All versions prior to v2635

The good news is that Vanderbilt has released updates for the vulnerable devices. The further good news is that, to date, there is no evidence that any malicious hackers have exploited the vulnerability.

There is bad news, however.

Firstly, it sounds as if the attack is relatively trivial for an attacker to pull off by sending a carefully-formed but simple HTTP request.

Additionally, it’s easy to predict that many of the vulnerable devices may not have patches applied to them in a prompt fashion (if at all) – a common problem with the Internet of Things.

Just making a patch available does not mean that the problem has gone away.

And that’s a problem. In the case of the Siemens-branded CCTV cameras they’re in use around the world at commercial facilities, in the healthcare industry and at government facilities. Not the kind of organizations that one imagines can afford to have their admin credentials leaked to cybercriminals.

This is, of course, far from the first time that flaws have been found in CCTV cameras that could be exploited by attackers.

For instance, last month there was a massive DDoS attack against domain name service Dyn, which in turn disrupted access to well-known sites such as Twitter, Pinterest, Reddit, and the Playstation network.

The DDoS attack was perpetrated by the Mirai botnet, powered by hijacked IoT devices, including hacked webcams.

As the Internet of (often insecure) Things expands, it poses a bigger threat to businesses and home users alike. ESET warned earlier this year that IoT would make more regular appearances in security headlines:

“For the future, the challenge for security in IoT is not restricted to the household. Technology keeps improving and time
and time again we see how governments, industries and markets in general are turning towards interconnectivity for all equipment, systems, and services. From market research to traffic systems, all things are being interconnected through existing technologies but, in certain cases, without the proper implementation of security protocols.”

It feels to me that when it comes to IoT security things are going to get worse before they have any hope of getting better.

And it’s also clear that news of the CCTV camera vulnerability has only added to a bad month for the Siemens brand in terms of security.

Earlier this month, the Department of Homeland Security’s ICS-CERT issued an alert that industrial control products developed by Siemens suffered from a local privilege escalation vulnerability that could leave SCADA equipment open to attack.

http://www.welivesecurity.com/2016/11/22/siemens-branded-cctv-webcams-risk-hacking-require-urgent-firmware-patch/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Get Safe Online warns of Amazon email scam

By Narinder Purba

Amazon customers are the latest victims of an email scam, warns Get Safe Online.

Fraudsters claiming to be from Amazon have sent out thousands of emails to consumers, telling them that there is a ‘problem’ with their order.

To resolve the alleged issue, the email asks customers to confirm ‘certain information’ by clicking on a link. Otherwise, they will not be able to access their Amazon account.

This directs people to a seemingly credible but fake website, making it easy for even the most vigilant customer to fall for the scam.

Here, they are required to input in personal information. When customers have entered in their details, they are asked to click a ‘Save & Continue’ button.

This then takes them to Amazon’s official website, again making it difficult for most people to suspect of any fraudulent activity.

Get Safe Online warns that customers are more easily exploited in the lead up to Christmas, with last minute shopping anxiety making them more susceptible to threats.

Online fraudulent activity is becoming increasingly common, with high quality, authentic looking phishing scams being especially difficult to spot.

Get Safe Online has issued a list of safety precautions for online shoppers to watch out for while shopping on Amazon.

Along with being aware of emails asking them to update their details or fix a problem with their account, it advises customers to regularly check their bank statements.

Looking out for a secure website page is also vital. This can be done by ensuring that the address contains ‘https’ at the beginning, with the ‘s’ standing for secure.

http://www.welivesecurity.com/2016/11/22/get-safe-online-warns-amazon-email-scam/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

New airline scam promises free Emirates flight tickets

By Denise Giusto Bilić

Year-end celebrations are close and many people are looking to book their plane tickets to visit relatives and friends. As expected, cybercriminals are looking to exploit users over the festive period – social engineering techniques are frequent over the holidays, as demonstrated by a scam that is promising people free flight tickets.

What is the scam about?

We have previously warned WeLiveSecurity readers about a multi-brand scam spreading via WhatsApp (one that promises bogus discounts to their victims).

Now, a new form of fraud is once again going viral on WhatsApp, this time making reference to the Emirates airline company. It offers people the possibility of receiving a couple of free flight tickets.

It is worth noting that although the link enclosed to the brief description in the message seems to redirect the user to the airline’s official website, the real link in the message text reveals the true scam, which redirects users to a website that does not bear any relation to the company.

Read full article on

http://www.welivesecurity.com/2016/11/17/new-airline-scam-promises-free-emirates-flight-tickets/?utm_source=newsletter&utm_medium=email&utm_campaign=wls-newsletter-171116

Three mobile network experiences data breach

By Narinder Purba

UK mobile company Three has fallen victim to a major data breach, with up to six million customers reported to have been affected.

Data that has been accessed includes names, phone numbers, addresses and birth dates.

Three said that fraudsters were able to retrieve the information by logging into a database listing the names of customers who were entitled for a phone upgrade.

Three men have subsequently been arrested by the National Crime Agency (NCA), in connection with the data breach.

According to the BBC, Three is now investigating exactly how many of its nine million customer accounts were accessed.

A spokesman for Three said: “Over the last four weeks, Three has seen an increasing level of attempted handset fraud.

“This has been visible through higher levels of burglaries of retail stores and attempts to unlawfully intercept upgrade devices.

“To date, we have confirmed approximately 400 high-value handsets have been stolen through burglaries and eight devices have been illegally obtained through the upgrade activity”.

The UK mobile operator is the latest company to fall victim to a cyberattack. Last year, TalkTalk saw over 150,000 of its customers have their personal details compromised.

Recently, a 17-year old boy admitted to being behind the TalkTalk cyberattack, describing it at the time as “a passion”.

The teenager pleaded guilty to seven offences, admitting to Norwich Youth Court in the UK that he “didn’t think of the consequences” behind the attack.

TalkTalk, for its part, was fined a record £400,000 for not having in place adequate cybersecurity measures.

Zakelijke apps vormen belangrijk concurrentiefactor in logistiek

■       Mobiele apps wordt door 89,5 procent van de ondervraagden beschouwd als concurrentiefactor

■       Gebruik hoofdzakelijk in transport management en voor technische informatie

■       Transparantie, flexibiliteit en controle zijn de  belangrijkste voordelen van zakelijke apps

■       Algeheel gebruik van apps is nog steeds relatief laag

Het is onmogelijk geworden om een voorstelling van het dagelijkse privéleven zonder mobiele apps te maken. Maar welke functie vervullen zakelijke apps, en dan met name in de gebieden internationale handel, logistiek en supply chain management? In de Global Trade Management Agenda 2017, een studie van software bedrijf AEB in samenwerking met de Baden-Württemberg Cooperative State University (DHBW) in Stuttgart, is dit onderwerp onderzocht. Het onderzoek is gebaseerd op een enquête onder 330 experts uit de logistiek, internationale handel en supply chain management. Het resultaat: negen van de tien experts beschouwen zakelijke apps als een belangrijke concurrentiefactor in internationale handel en logistiek. De meeste deelnemers (86,7%) zijn het erover eens dat het belang van zakelijke apps voor deze vakgebieden blijft groeien.

“De resultaten laten zien dat het onderwerp bijzonder relevant is en dat we nog maar aan het begin van een dynamische ontwikkeling staan”, benadrukt Prof.Dr. Dirk H. Hartel, Hoofd van de Department of Business Administration Service / Logistics Management aan de DHBW Stuttgart. “De respondenten beamen dit, ook al worden zakelijke apps op dit moment nog niet in veel bedrijven gebruikt.”

Logistiek loopt voorop ondanks laag gebruik van apps

Niet meer dan 17,6 procent van de respondenten geeft aan dat ze al apps in supply chain management, logistiek of internationale handel gebruiken. Nog eens 21,1 procent is van plan om mobiele apps te implementeren. Logistiek speelt een pioniersrol als het gaat om gebruik van apps, samen met de disciplines administratie, verkoop en marketing. Daartegenover staat dat apps niet of nauwelijks een rol spelen in financiën (4,7%) en in inkoop (10,2%).

In logistiek ligt de focus van de gebruikte apps op het zoeken en verschaffen van technische informatie (28,4%). Daarnaast zijn apps relatief wijdverbreid in transport management. Meer dan een kwart van de respondenten gebruikt apps voor het monitoren van transport (26,1%), iets meer dan een vijfde voor vlootbeheer (28,4%). Nog eens 20,4% van de logistiek managers gebruikt apps voor containerbeheer. Gebruik van mobiele tools is een stuk zeldzamer in andere logistieke gebieden, denk aan order management, personeelsplanning of laden van vrachtauto’s. Hoe dan ook, nog eens één op de drie respondenten uit alle toepassingsgebieden wil in de toekomst apps gaan gebruiken.

Het onderzoek kijkt ook naar het gebruik van apps in internationale handel. Screening tegen terreurlijsten is de meest gebruikte toepassing hier: bijna 29,4% van de respondenten gebruikt hiervoor apps, 33,8% is dat in de toekomst van plan. Het gebruik van mobiele apps is bijzonder zeldzaam als het gaat om exportcontrole, hoewel 36,8% van plan is hierin verandering te brengen. Ook in douane management zullen zakelijke apps steeds breder worden toegepast. Apps worden nog maar door een vijfde van de bedrijven gebruikt voor classificatie, om een voorbeeld te noemen, bijna 50 procent heeft plannen daarvoor.

Transparantie, flexibiliteit en controle – de belangrijkste voordelen

Transparantie (46,9%), flexibiliteit (46,4%) en controle (46,0%) zijn de belangrijkste voordelen van mobiele apps voor bijna de helft van de respondenten. Slechts 30,4% daarentegen zegt dat apps zeer waarschijnlijk zullen bijdragen aan concurrentievoordeel.

Het topmanagement is bijzonder optimistisch als het gaat over zakelijke apps. Deze groep denkt vaker dan de andere respondenten dat de genoemde voordelen daadwerkelijk worden gerealiseerd. Medewerkers zonder leidinggevende functie kijken met veel meer scepsis naar mobiele apps.

“De visie van het topmanagement moet niet worden beschouwd als berekenend optimisme, maar is meestal gebaseerd op persoonlijke ervaringen”, zegt Dr. Ulrich Lison, Portfolio Manager en Lid van de Raad van Bestuur van AEB, die samen met Prof.Dr. Hartel de studie heeft uitgevoerd. Tenslotte maken topmanagers nu al vaker gebruik van zakelijke apps dan gemiddeld (ongeveer 80% tegenover een gemiddelde van 64%).

In het onderzoek is ook gevraagd naar de top 3 succesfactoren voor het gebruik van apps. Integratie met andere IT-systemen is de meest kritieke succesfactor: bijna één op de twee respondenten (47%) noemt dit. De mogelijkheid om apps op verschillende platformen te gebruiken is eveneens belangrijk (33,3%), net als de toegevoegde waarde van de app (29,4%).

Over het onderzoek

 Het onderzoek “Global Trade Management Agenda 2017 – Apps in global trade and logistics, and the top priorities in global supply chain management” is gebaseerd op een enquête onder 330 experts uit verschillende sectoren, afkomstig uit de disciplines logistiek, internationale handel en supply chain management. De respondenten werken bij bedrijven van verschillende grootte uit verschillende landen, waarbij bijna 49% in Duitsland is gevestigd. Circa 67% van hen heeft een leidinggevende functie als hoofd van een bedrijf, divisie, afdeling, team of project. Het onderzoek wordt jaarlijks uitgevoerd door softwarebedrijf AEB en DHBW sinds 2013. U kunt het volledige rapport aanvragen via www.aeb.com/study.