HP to fix vulnerabilities in its 150 product models by this year end

In a detailed report released by F-Secure, over 150 models of HP are suffering from two vulnerabilities that, when exploited by hackers, could trick the victim into visiting a malevolent website or to launch a cross printing cyber attack.

F-Secure also notified the vulnerability to HP in an official way and the multinational company has assured that it will release a fix to the said flaws by this year’s end.

Researchers say that the susceptibility could allow hackers to execute an arbitrary code that could allow them to steal text from the document meant for printing.

F-Secure claims that the flaw can act as an entry point for hackers to enter the corporate network and can also lead to ransomware attacks, data steal or espionage.

Nowadays, companies are releasing Multi-functional printers that are acting as computing devices and can lead to compromise of networks and endpoints such as workstations.

There is a high possibility that such compromised devices can act as bots in a network and then take part in other attacks, such as Ddos and malware spread.

Hewlett Packard Inc has taken a note of the situation and has reportedly pressed its engineers into service to neutralize the flaws by the middle of this month.

Note- Multi functional printers are those which can scan and print and are mainly used in large offices, SMBs and, sometimes, in private households.

The post HP to fix vulnerabilities in its 150 product models by this year end appeared first on Cybersecurity Insiders.

December 02, 2021 at 04:11PM

Read More

Ransomware attack leads to data leak of over 400,000 patients

A Los Angeles based healthcare provider that is into the service of providing motherhood to woman through innovative treatments has reportedly suffered a ransomware attack leading to data leak of over 400,000 patients.

Planned Parenthood, a non-profit organization that is into reproductive care reacted to the news that the IT service provider, serving it was hit by a cyber attack and that led to the leak of sensitive details such as email IDs, contact info, diagnosis procedure, insurance info, treatment they are seeking and their physical address data.

John Erickson, the spokesperson of Planned Parenthood, admitted the breach and assured that more details about the incident will be released to the media once the investigation gets concluded.

Probably, the threat actors involved in the incident could use the stolen information to launch identity based attacks or could indulge in other fraudulent attacks such as phishing.

With a ransomware attack, the information on the database is encrypted until a ransom is paid. However, in recent times, the threat actors are seen indulging in double extortion tactics, where they first steal data and then encrypt the database until a ransom in millions is paid to them in bitcoins or in other forms of cryptocurrency.

Note- Planned Parenthood is a non-profit organization that offers reproductive healthcare at low or no cost. The said health services provider is a member of International Planned Parenthood Federation and also takes up legal abortions and does them at a very low cost.

The post Ransomware attack leads to data leak of over 400,000 patients appeared first on Cybersecurity Insiders.

December 02, 2021 at 04:10PM

Read More

CCSP vs. Symantec Certified Cloud Credentials: How Do They Compare?

The mounting cybersecurity challenges facing organizations worldwide show no sign of slowing. Not only the shortage of qualified cybersecurity staff but also the lack of security awareness and skills among employees remain the biggest concerns, according to the 2021 Cloud Security Report by Cybersecurity Insiders.

Global need for cybersecurity experts specializing in cloud security is growing demand for certification. But with so many credentials out there, which most effectively demonstrates the broad knowledge and skills required to secure any cloud environment? Let’s compare three leading certifications: (ISC)² Certified Cloud Security Professional (CCSP) vs. Symantec Certified Specialist-Administration of Symantec Cloud Workload Protection-R1 and Symantec Certified Specialist-Administration of Symantec Cloud SOC-R2.

CCSP is a vendor-neutral certification that demonstrates the broad knowledge to successfully secure any cloud environment, regardless of vendor affiliation. It proves expert skills and experience in cloud security design, implementation, architecture, operations, controls, and compliance with the full range of regulatory frameworks. The globally recognized certification is available from (ISC)², the creators of the Certified Information Systems Security Professional (CISSP) Common Body of Knowledge.

Symantec Certified Specialist-Administration of Symantec Cloud Workload Protection-R1 focuses on mastering Symantec Cloud Workload Protection to provide cloud-native security with automatic discovery for public cloud workloads.

Symantec Certified Specialist-Administration of Symantec Cloud SOC-R2 focuses on configuring and administering the Symantec CloudSOC product in a security operations role.

Read more in the full article.

To discover more about how the CCSP credential can help you gain expertise in the cloud and advance your career, download our Ultimate Guide to the CCSP or our latest white paper Cloud Security Skills Can Take Your Career to Infinity (And Beyond).

The post CCSP vs. Symantec Certified Cloud Credentials: How Do They Compare? appeared first on Cybersecurity Insiders.

December 02, 2021 at 09:18AM

Read More

Concentric Named Industry’s Cybersecurity Rising Star in US Channel Innovation Awards 2021 Program

SAN JOSE, Calif.–(BUSINESS WIRE)–Concentric Inc., a leading vendor of intelligent AI-based solutions for protecting business-critical data, today announced that it was named the winner of the Cybersecurity Rising Star Award in the Channel Partner Insight (CPI) Channel Innovation Awards 2021 program out of hundreds of other entries.

The annual Channel Innovation Awards by CPI are designed to recognize channel players and their vendors across the US who are at the forefront of growth, new technologies and thought leadership. Independently run, the awards shine a spotlight on new thinking, solutions and success in the channel over the previous 12 months.

“On behalf of the whole Channel Partner Insight team I wish a warm congratulations to all those solution providers, distributors and vendors who are truly galvanizing the channel to advance into new opportunities and technologies,” said CPI Editor Nima Sherpa Green. “What we’ve seen over the last year has shown us that more than ever, being innovative is a real differentiator for customers and growth. We think it’s important to celebrate success and want to shine a spotlight on those companies who are leading from the front.”

Concentric’s Semantic Intelligence automates unstructured and structured data security using deep learning to categorize data, uncover business criticality and reduce risk. Its Risk Distance analysis technology uses the baseline security practices observed for each data category to spot security anomalies in individual files. It compares documents with peers in the same category to identify risk from oversharing, third-party access, and wrong location or misclassification. Channel clients benefit from the expertise of content owners without intrusive classification mandates, with no rules, regex or policy maintenance needed.

“It is an honor to be named as the industry’s top Cybersecurity Rising Star, and to be highlighted by CPI in their Channel Innovation Awards program over hundreds of other entries,” said Karthik Krishnan, Concentric CEO. “Concentric stands out in the industry due to its use of advanced deep-learning technology to solve the ongoing challenges of unstructured and structured data security – both in the cloud and on-premises. We deliver the channel’s best autonomous data discovery and categorization capability for complete data protection that gives enterprises the tools they need to effectively manage risk. Offered as a SaaS platform, the solution’s time-to-value is days, not months or years as with other solutions, which is attractive in the channel.”

About Channel Partner Insight

Channel Partner Insight provides leaders of resellers, distributors, MSPs and other specialist consultancies with exclusive analysis of the fast-changing channel sector in the US and Europe, helping them to make smarter business decisions. The transatlantic title, launched in 2019, is owned by London-based Incisive Media. With journalists based in the UK and the US, CPI provides high-quality journalism for channel business leaders, taking a uniquely transatlantic view on the market. For more information, see https://www.channelpartnerinsight.com/.

About Concentric

With Concentric, organizations can finally address their unmet data security needs by discovering and protecting business critical content. Concentric protects intellectual property, financial documents, PII/PCI content, customer data, business confidential data and more, across on-premises and cloud-based data stores. The Concentric Semantic Intelligence Data Access Governance solution uses deep learning and Risk Distance analysis to accurately categorize data, assess risk and remediate security issues – without relying on upfront rules or complex configuration. Concentric is venture backed by leading Silicon Valley VCs and is headquartered in San Jose, Calif. For more information, see https://www.concentric.ai.

Concentric, Semantic Intelligence and Risk Distance are or may be registered trademarks of Concentric AI, Inc. All other marks and names mentioned herein may be trademarks of their respective companies.

The post Concentric Named Industry’s Cybersecurity Rising Star in US Channel Innovation Awards 2021 Program appeared first on Cybersecurity Insiders.

December 02, 2021 at 09:17AM

Read More

Privacy alert as Texas school district scans student devices

A school district in Texas has decided to scan its student devices to find whether they are mentally sound and haven’t been targets of cyber bullying. However, the school district has to learn a fact that such surveillance tactics might/have already triggered a kind of privacy concern among students and parents.

Longview Independent School District (Longview ISD) is the school that is discussion and has partnered with a technology firm named Gaggle that will supply the required surveillance software to monitor the messages and emails of students through a set of keywords.

The plan is to use the software and see whether the students are searching appropriate content and staying away from content that can cause self harm, suicidal tendencies, threats, inappropriate content and cyber bullying.

Longview ISD has approved a budget of $60,000 for the software purchase and deployment on school supplied devices of students. And the scanning software will be deployed on the devices by December 9th,2021.

A source from Gaggle said that its software is being used in over 1500 school districts and is doing more harm than what is being expressed by some students & parents as a concern.

Note 1- As per a 2018 study made by PEW Research Center, over 58% of teens in United States went through cyber bullying or online harassment. And name-calling stood tall on the list with over 43% of teens experiencing it in the past two years.

Note 2- Some students in Longview ISD were found circulating mendacious rumors that the about-to-be installed software can detect devices on which X-rated images were shared or downloaded in the past.

The post Privacy alert as Texas school district scans student devices appeared first on Cybersecurity Insiders.

December 01, 2021 at 08:41PM

Read More

Deepfake technology and its implications for the future of cyber-attacks

Introduction

Recently I received a call on my personal cellphone. The call started out as many do; with a slight pause after I answered. Initially I assumed this pause was caused by whatever auto-dialer software the spammer was using to initiate the call before their text-to-speech software starts talking about my car’s extended warranty. Once the pause was over, however, I was surprised by a very human voice. She initiated the conversation by giving her name and a simple greeting, which was closely followed by the pitch she was trained to give.

It was during my response to her greeting (a “How are you doing” type question) that I noticed the issue. Another slight pause. As soon as I started speaking, the noise on the other side of the phone went dead, as if a recording had been switched off. This was my first sign that I wasn’t dealing with your run-of-the-mill telemarketer. Once the recording (for this is what it turned out to be) began with the next line in the pre-programmed speech, with no acknowledgement of my response, I knew I was dealing with a robot powered by technology that simulated a real voice.

What is a ‘Deepfake’?

While my initial example does not match all the pieces of a deepfake, I am certain many of those that read this will be familiar with the experience. The use of human-like voices combined with auto-dialers, while a new occurrence, are not all that unusual in the world of spam calls. Deepfakes, however, take this concept to a whole new level.

Imagine receiving a call from your CEO, someone you have never personally met but have heard speak at a variety of town halls and e-mailed video correspondences. This call says they really appreciate your work, and wondered if you would do them a small favor. After a slight pause, they ask you to purchase some gift cards for an upcoming raffle from whatever local retailer is close to you. They assure you the company will reimburse you, and apologizes for the inconvenience.

After you hang up the phone you pause for a moment and think “Hey, didn’t IT just send out a warning about being asked to purchase gift cards?”. Of course they did, but they said to be wary of unknown callers or suspicious emails, not personal calls from the CEO. To assuage your concern, you quickly search for the most recent town hall video your company sent out and confirm the voice you heard on the phone matches that of the CEOs. Satisfied, you pick up your wallet and head out of the office to purchase the requested gift cards.

Unfortunately, it turns out that the call you received wasn’t from your CEO. It was created by a machine learning algorithm (MLA) designed to mimic their way of speaking. This is, put simply, all that a ‘Deepfake’ is. It’s a falsified (although legitimate looking) video, sound clip, or picture, created to deceive the viewer into believing it is authentic by using existing content as needed to simulate the experience. They may take many forms, and be used for many purposes, but the core concept remains the same.

After purchasing the gift cards, or creating a new user account for an employee, or completing whatever task the attacker requested, you are left holding the bag. Money is lost (either yours or the company’s), access is granted (to the attacker, or to whomever they sell the account to), and reputation is lost (or gained in the case of an attacker demoing their new technology). Regardless, the enemy has won. Despite the best efforts of the company’s IT department, attackers found a new way to crack the weakest link – the human element.

Phishing evolved

The famous phrase “believe nothing of what you hear, and only half of what you see” comes to mind. The things that we hear, even when spoken by a trusted voice, cannot be believed. What we see, whether it is shared on social media or by a friend, is suspect. Much like the attacks of the past, Deepfake-supported attacks rely on the implicit trust that people share with one another, whether they be employees, friends, or even family.  

This isn’t unusual, unexpected, or even a negative. Our entire society exists, to some degree, on our ability to trust other people to accomplish certain tasks or do certain jobs. It is a requirement we must accept as a cost of doing business with our current operations. Unfortunately, this opens all our businesses to the risk of nefarious actors exploiting these relationships for their own gain.

As we have seen concepts like ‘Ransomware-as-a-service’ evolve and grow, it is safe to assume that the use of Deepfakes will only continue to profligate within the industry. Even today it is possible to create a convincing fake with only an hour or less (depending what tool you use) of audio. Given how active many prominent business leaders can be on social media platforms, townhalls, or other speaking opportunities, it is not unreasonable to expect attackers to be able to harvest the necessary data from publicly available sources.

What you can do

As always, my first answer will be to train, train, train, and then train some more. Employees are always the weakest link in any chain, regardless if they work in IT, or the mailroom, or in the executive office. If an attacker can exploit human nature to gain access it will likely be the easiest avenue available. It’s important training includes more than just a series of videos and a test; organizations have to leverage active participation tools as well such as social engineering campaigns.

My second answer is to empower your employees to act on the training you give them. Many social engineering attacks rely on the presumed authority of the requester, or some form of threat of punishment to obtain compliance. It is critical that employees are empowered to say “no” or to question a request that seems unusual, even if it comes from the CEO.

Third, define what ‘appropriate’ business looks like. Strong documentation with clear communication channels, employee expectations, and current operations can greatly reduce the opportunity for attackers to exploit the human condition so effectively. There should be defined processes for employees’ duties, what they can expect to do, and what classifies unusual or malicious behavior.

Conclusion

With every passing day attackers grow more and more intelligent, creative, and technologically advanced. These groups outpace even the most tech-friendly, innovative, startups when it comes to adopting new technology and trying new strategies. This ignores any of the groups which may serve as government agents and have more advanced training or better funding. Competing against these forces is, therefore, no easy task.

Security teams and their companies have to stay abreast to the everchanging landscape and always be on guard for new attacks. Even in subjects the company, and its employees, are well versed in may become a source of breaches as hackers change how they execute their attacks. Taking a proactive and informed approach to managing cybersecurity risks, and building a program that is flexible and can meet the changing threat landscape, are critical to warding off attacks.

The post Deepfake technology and its implications for the future of cyber-attacks appeared first on Cybersecurity Insiders.

December 01, 2021 at 09:10PM

Read More

CISSPs from Around the Globe: An Interview with Chinyelu Philomena Karibi-Whyte

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted.

In this installment, we talk Chinyelu Philomena Karibi-Whyte. Chinyelu shares with us why she pursued CISSP and how achieving it enabled her to develop her career and negotiate a better salary.

What job do you do today?

I am a Cyber Security Consultant within the Cloud Infrastructure Service at a Consulting Organisation.

What problems does your company solve?

My team and I help organisations deliver secure cloud projects, ensuring cybersecurity is applied from the design stage of the project through to the delivery stage. This is to ensure cybersecurity is not placed as an after thought.

What was life like when you started out in your career in cybersecurity?

I have been working on IT hardware for 11 years and realised I had a passion for being secure in all I do. I took a work break to return to school to get an MSc degree in Cyber Security.

What was your first cybersecurity job?

A Security Consultant with a Consulting Firm. I was responsible for conducting security risk assessment for the Galileo System Data Centres. Galileo system is the European Union equivalent of the US GPS system.

Why did you first decide to get into cybersecurity?

In 2006 I wanted to specialise in a part of Information Technology at some point in my career not just being a general IT person. I realised I had a passion for wanting to be secure at all times. That passion was what pushed me into Cyber Security. The cyber space is broad, with the surface web making up only about 20%. The rest of the cyber space which comprises of the deep web and dark web is somewhat dangerous with a lot of threat actors planning and initiating attacks. Thus keeping the cyber space secure is a goal for me.

What first attracted you to consider getting a cybersecurity qualification?

To prove I was committed and passionate about becoming a Cyber Security Professional.

Why did you decide to undertake CISSP?

Most job requirements in the Cyber Security domain had a requirement to be CISSP certified or be working towards it.

What prompted you to do that?

To enable me get into the Cyber Security role I loved.

How long did it take to achieve CISSP?

1 year and 3 months of personal study

How did you prepare for the exam?

It was all self-study. I used Shon Harris videos, 11th Hour CISSP by Eric Conrad, (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide and used CISSP Official (ISC)² Practice Tests and CCCure for my practice questions.

What most surprised you about CISSP?

How broad the 8 domains were and the fact that I completed the 250 questions in 4 hours instead of 6 hours.

How did it change how you approached your work?

I understand that Security is ultimately a business decision because Security exists for the business.

What were the first changes you noticed after becoming a CISSP?

I got so many interests in my CV and got interviews. CISSP enabled me negotiate a better independent contractor daily rate and employee salary.

What steps brought you to the job you do today?

My quest to keep my skills updated and my working as an independent consultant in multiple organisations, giving me different exposure to clients needs and requirements.

What is the biggest challenge you have faced in your career?

Working with a client where the environment was toxic.

What ambitions do you have for your career ahead?

To develop a security product that will reduce cyber security risks.

What is it about your job that you love?

Being able to identify all the security vulnerabilities existing within an environment and proffer ways to reduce the associated cyber risks.

What achievement or contribution are you most proud of?

Completing an MSc degree in Cyber Security and having my dissertation on Analysis of Techniques for Visualising Security Risks and Threats published.

How do you think you have personally benefited from becoming a CISSP?

Becoming a CISSP has made me approach issues in a structured and professional manner. The Code of Ethics keeps you in check and helps you remain professional in all you do.

How do you ensure your skills continue to grow?

I am involved in a lot of Continuous Professional Education. I have also gone on to obtain other Information Security certifications and have recently passed the Cloud Security exam offered by (ISC)².

What do you think the biggest challenge is for cybersecurity right now?

The biggest challenge in Cyber Security is human. No matter the technical advancements,  there will always be human errors occurring, be it intentional or unintentional. These risks cannot be completely eradicated but mitigated with constant security awareness and education as well as developing tools based on machine learning to predict and detect insider threats to a greater degree of accuracy. 

What solutions do you think could address this?

Constant security awareness, education and training will reduce human errors in cyber security.

Who inspires you in the world of cybersecurity?

Uncountable professionals that I cannot begin to enumerate.

What do you think people considering a career in cybersecurity should know?

Cyber Security is constantly evolving. Being in Cyber Security means you have to keep updating your knowledge base to keep up with the ever changing threat landscape.

 

To discover more about CISSP download our Ultimate Guide or learn more with our white papers, 9 Traits You Need to Succeed as a Cybersecurity Leader or The Definitive Guide to Cybersecurity and Business Prosperity.

Or, check out more interviews with CISSPs as a part of this CISSP interview series.

The post CISSPs from Around the Globe: An Interview with Chinyelu Philomena Karibi-Whyte appeared first on Cybersecurity Insiders.

December 01, 2021 at 09:10PM

Read More