Amazon Web Services mandates MFA Security

Amazon Web Services (AWS) has taken a significant step toward enhancing security by mandating multi-factor authentication (MFA) for all privileged accounts starting from April 2024. This move aims to mitigate the risks associated with account hijacking, reinforcing the importance of default security measures.

Steve Schmidt, Chief Security Officer (CSO) at AWS, stated, “By the end of this year, privileged account users who have yet to enable MFA will receive notifications regarding this security change. Early next year, they will be required to activate MFA as a mandatory procedure to maintain access.”

Standalone AWS accounts will also need to adopt this mandatory MFA procedure by the end of the upcoming year. AWS is committed to minimizing cyber risks associated with stolen account credentials, which can be exploited for malicious purposes.

This initiative traces its origins back to 2021 when AWS allowed organizations in the United States to register up to 8 MFA devices per root user. The company now seeks to make MFA usage compulsory, encouraging users to leverage MFA as a defense against phishing attempts.

In a separate development, Israeli cybersecurity firm Oligo has issued a red alert regarding an open-source tool employed by companies to scale up their AI models within the AWS TorchServe Project, in collaboration with Meta.

Oligo researchers have raised concerns about a Shell-Torch vulnerability in the PyTorch Library, a high-resource, large-scale machine learning framework based on AI. They emphasized that this vulnerability could enable attackers to upload malicious models to the server. Meta, in response, promptly issued a patch for this issue in August of this year, aligning with the security community’s recommendations.

The post Amazon Web Services mandates MFA Security appeared first on Cybersecurity Insiders.

October 06, 2023 at 08:35PM

Read More

How to Secure Customer Data in the Age of AI and Cloud Computing

In the age of AI and cloud computing, businesses are harnessing the power of data like never before to gain insights, improve operations, and enhance customer experiences. While these technological advancements offer countless benefits, they also present significant security challenges, especially when it comes to protecting sensitive customer data. In this article, we will explore the key strategies and best practices to secure customer data in an era dominated by AI and cloud computing.

Encrypt Data at Rest and in Transit-Encryption is the foundation of data security in the digital age. Whether data is stored on cloud servers or transmitted over networks, it should be encrypted to protect it from unauthorized access. Implementing strong encryption protocols ensures that even if data is intercepted or stolen, it remains unintelligible to malicious actors. Many cloud providers offer encryption options for data at rest and in transit, which should be utilized to safeguard customer information effectively.

Access Control and Identity Management-Implement strict access controls and identity management systems to ensure that only authorized personnel can access customer data. Utilize role-based access control (RBAC) to grant permissions based on job responsibilities, and em-ploy multi-factor authentication (MFA) to add an extra layer of security. Regularly audit and review user access privileges to prevent unauthorized data access.

Continuous Monitoring and Threat Detection-Deploy advanced monitoring and threat detection solutions that leverage AI and machine learning algorithms to identify suspicious activities and potential security breaches in real-time. These systems can help detect anomalies, abnormal access patterns, and unauthorized attempts to access customer data. Rapid detection allows for immediate response and mitigation.

Data Minimization and Retention Policies-Collect and retain only the data that is necessary for business operations. Data minimization reduces the volume of sensitive information that needs to be protected, limiting the potential impact of a breach. Implement clear data retention policies that outline how long customer data will be stored and when it should be securely deleted once it’s no longer needed.

Secure Development Practices-Follow secure coding practices when developing AI and cloud-based applications. Conduct regular security assessments and penetration testing to identify vulnerabilities and address them proactively. Ensure that security is integrated into the development lifecycle, not added as an afterthought.

Data Privacy Compliance-Stay compliant with data privacy regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). These regulations have strict requirements for how customer data is collected, processed, and protect-ed. Failure to comply can result in severe penalties, so it’s crucial to understand and adhere to relevant data privacy laws.

Employee Training and Awareness- Human error is a common cause of data breaches. Train employees on security best practices and make them aware of the importance of safeguarding customer data. Encourage a culture of security within the organization, where employees understand their role in protecting sensitive information.

Conclusion

In the age of AI and cloud computing, securing customer data is paramount to maintaining trust and regulatory compliance. By implementing encryption, access controls, continuous monitoring, and other best practices, businesses can mitigate the risks associated with handling customer data in a digital landscape. Remember that data security is an ongoing process, and staying vigilant is key to protecting customer information from evolving threats.

The post How to Secure Customer Data in the Age of AI and Cloud Computing appeared first on Cybersecurity Insiders.

October 06, 2023 at 11:18AM

Read More

Cybersecurity news headlines trending on Google

The Navy Exchange Service‘s sale of Lenovo laptops at steep discounts and duty-free rates has raised concerns among U.S. lawmakers due to the manufacturer’s ties to the People’s Republic of China. There are apprehensions that these laptops could potentially contain pre-installed malware aimed at spying on users in Western countries. While currently, this is only an alert generating media attention, it has the potential to gain momentum rapidly, as any connection to China and data security tends to trend on Google within days.

Microsoft recently conducted a study that led to the conclusion that the trend of BYOD (Bring Your Own Device) should be renamed “bring your own disaster.” The study found that a significant percentage of these devices were responsible for causing issues within corporate computer networks. Microsoft’s research revealed that 80-90% of ransomware attacks in the past year originated from unmanaged devices. These findings were detailed in Microsoft’s Digital Defense Report for 2023, and it anticipates a global increase of such attacks by 200%.

According to a threat report released by SecureWorks, ransomware groups have become more efficient in deploying file-encrypting malware within just 24 hours of hacking their targets. This marks a significant reduction from the previously estimated period of 6-7 days, and it’s attributed to the increased sophistication of malware developed by cybercriminals.

BlackBaud, a South Carolina-based cloud computing company, has agreed to pay $49.6 million to approximately 13,000 customers across 49 states and the District of Columbia to settle litigation stemming from a 2020 ransomware attack. During this breach, hackers managed to access customer data, including social security numbers and bank account information. Notably, this settlement includes a $3 million payment to the Security Exchange Services (SEC) and $900,000 to Massachusetts.

In an alarming revelation, the United States Department of State has admitted to being unaware of the extent of its in-house cybersecurity risks. The federal agency attributes this lack of awareness to outdated hardware and software systems. It also raises concerns about Chinese vendors supplying equipment through cross-linked trade treaties with countries like Malaysia and Singapore. This means that Chinese products could enter the American market with different labels, linking them to companies in Singapore and Malaysia but ultimately part of China’s trade consortium.

According to a report by internet security company WatchGuard Technologies, there has been a decline in malware infections despite an increase in campaigns aimed at spreading malware. The report emphasizes that while malware distribution has decreased, the sophistication of attacks has risen to new heights.

The post Cybersecurity news headlines trending on Google appeared first on Cybersecurity Insiders.

October 06, 2023 at 11:13AM

Read More

Cyber Attack blocks calls to Lyca Mobile customers

Approximately half of Lyca Mobile’s customer base has recently encountered disruptions in their calling and messaging services, with some customers reporting that these issues date back to September 29th, 2023. Lyca Mobile, a virtual mobile service provider utilizing EE’s telecom resources, operates in around 60 countries, including the United Kingdom and the United States.

Acknowledging the network problems faced by its users, the sim-based mobile service provider suggested that the root cause could potentially be attributed to a cyber incident affecting their telecom operations. Among the problems experienced by Lyca Mobile customers, some noted the unavailability of Porting Authorization Codes due to disruptions in the texting system.

As of now, it remains unclear exactly how many of Lyca Mobile’s 16 million customers worldwide have been impacted by these incidents. Fortunately, the regulatory body Ofcom can step in to help resolve persistent network issues like these, granting affected customers the right to seek refunds or credits for enduring prolonged network downtime.

It’s worth noting that cyber attacks targeting the telecommunications sector are a significant national security concern, as they can disrupt essential services, causing economic and political turmoil. Lyca Mobile, owned by Mr. Subaskaran and headquartered in the United Kingdom (UK), may not be an obvious target for state-funded attacks. However, confidential sources have suggested that the infrastructure disruption might be linked to a competitor who allegedly paid hackers to launch a ransomware attack on Lyca Mobile’s network. It’s important to note that there is currently no concrete evidence to confirm this theory as fact.

The post Cyber Attack blocks calls to Lyca Mobile customers appeared first on Cybersecurity Insiders.

October 05, 2023 at 08:42PM

Read More

McLaren Health Care data breached by BlackCat Ransomware Gang

McLaren Health Care has revealed that its servers fell victim to a ransomware gang called BlackCat, also known as ALPHV, during August and September of this year. The cybercriminals are now issuing threats to expose the pilfered data on the dark web unless their ransom demands are met.

As reported on X, formerly known as Twitter, the BlackCat gang managed to purloin approximately 6 terabytes of sensitive information related to approximately 2.5 million patients. To substantiate their claims, they’re threatening to release a portion of this data.

Sources who wished to remain anonymous divulged that the ransomware attack wreaked havoc on IT services across 14 Michigan hospitals during that period. Just when things appeared to be stabilizing, the threat actors initiated a campaign of blackmail, using the specter of data leaks as leverage.

An informant from ALPHV, active on the Telegram platform, disclosed that their team successfully infiltrated McLaren Health Care’s systems by exploiting a persistent vulnerability or backdoor that still exists.

In response to the breach, McLaren Health Care enlisted the services of cybersecurity experts. These professionals are collaborating with the healthcare network’s IT staff to minimize the risks associated with this dual-threat ransomware attack, which combines data encryption with extortion tactics.

It’s important to note that the criminal gang behind this attack predominantly communicates in Russian. However, there is no concrete evidence linking them to Russian intelligence agencies. Nevertheless, certain Western media outlets have speculated that the Russian government is training cyber operatives to carry out financially motivated cyberattacks. This shift in strategy is thought to be a response to the economic strains imposed by U.S. sanctions, stemming from Vladimir Putin’s actions in Ukraine.

The post McLaren Health Care data breached by BlackCat Ransomware Gang appeared first on Cybersecurity Insiders.

October 05, 2023 at 10:02AM

Read More

OneSpan Sign: Delivering Digital Trust in a Changing World

In the world of digital transactions, electronic signatures have become indispensable. As companies continue to make the shift from paper-based workflows to digital ecosystems, the need for secure, compliant, and user-friendly e-signature solutions is more pressing than ever.

One company that has carved out a leadership space in this domain is OneSpan. In this review, we’ll explore OneSpan’s unique take on solving the e-signature challenge, offering robust electronic signature solutions that not only accelerate digital transformation for clients but also pave the way to enable secure, efficient, and trust-based customer relationships.

The Evolution of e-Signatures

E-signatures have evolved from simply being an efficiency tool to becoming crucial for enhancing customer experience and operational productivity, especially amid the shift towards digital-first and mobile-first business strategies. Initially designed to streamline laborious paper-based processes, e-signatures have transformed into vital assets for customer-facing roles and organizations. This shift gained momentum due to the COVID-19 pandemic, making digital signatures not just convenient but essential for conducting business in today’s world.

Superior User Experience

OneSpan’s primary differentiator is its commitment to providing a secure and user-friendly experience designed to drive adoption of electronic signatures. OneSpan’s approach is fundamentally different in how it engages with the user. While you often might not see their name explicitly, OneSpan powers the e-signature capabilities of giants like Standard Chartered and RBC, fully integrated and white-labeled within these trusted platforms. This private-labeling strategy allows client brands to stay front and center during the entire e-signing process and aligns with the company’s philosophy that adoption is best achieved when users trust the entity they’re interacting with.

Complete Electronic Signature Platform

OneSpan Sign extends far beyond the act of capturing an electronic signature, offering a complete solution suite including secure electronic signature, identity verification, strong authentication, secure collaboration and video conferencing including remote online notarization and immutable storage.. It comes with a rich out-of-the-box user interface, eliminating the need for businesses to develop their own, thereby saving both time and money. In addition, there’s a Sender GUI that enables manual, sender-driven transaction management, offering an alternative to traditional system-generated transactions. Not only does OneSpan offer its product as a subscription service to enterprises, they also cater to SMB customers in a scalable and cost-effective manner.

Ease of Integration Accelerates Digital Transformation

OneSpan Sign seamlessly integrates with clients’ current systems, enabling a quick transition to digital workflows no matter the business size. With an open REST API and fully supported SDKs, integration is quick and efficient.

OneSpan Sign comes with pre-built connectors for popular applications such as Salesforce, Workday, and Microsoft Dynamics 365. This means minimal coding or IT resources are required to integrate digital signing into clients’ daily business applications and allowing users to sign documents through a variety of channels, including mobile devices, online portals, and even call centers.

Architecture & Deployment: Flexibility at Its Core

One of the standout features of OneSpan Sign is its flexible architecture, which is divided into two main components. The OneSpan Platform serves as the product’s core, handling transactional and business logic. Then there is the OneSpan Sign Application, the user-facing part of the product that can be accessed via a graphical user interface (GUI), APIs, SDKs, or connectors. This two-tiered architecture ensures a streamlined user experience and offers the flexibility needed to adapt to different organizational requirements.

Scalable and Versatile Enterprise-Grade Solution

OneSpan prides itself on being an enterprise-grade solution. In an industry filled with niche vendors and segmented point products, OneSpan’s comprehensive capabilities set it apart.

A notable feature of OneSpan is its ability to scale applications to meet the varying needs of different transaction types. Whether it’s a mortgage application requiring a 30-year commitment or a simple in-store loan at IKEA, OneSpan’s platform adjusts the level of assurance required. This adaptability makes the platform not just user-friendly but also incredibly versatile. According to Alexander Kiesswetter, CIO at Raiffeisen: “We wanted to innovate and simplify the customer experience. With OneSpan, we were able to do that.”

Additionally, the global footprint of OneSpan allows the company to serve different markets, accommodating varying legal frameworks for e-signatures. OneSpan serves 60 of the top 100 global banks, which speaks volumes about its capabilities and solutions quality.

Strong Identity Assurance

In the wake of the increased remote interactions due to the pandemic, the challenge of establishing identity and trust online became critical. OneSpan addresses this by incorporating identity and trust functionalities directly into its product. This focus on verification ensures that businesses can trust that they are interacting with who they claim to be, providing varied levels of assurance based on the type of transaction. OneSpan Sign employs a plethora of identity , ranging from government ID and biometric verification to SMS one-time passcodes and knowledge-based authentication. This assures that signers are who they claim to be, bolstering the integrity of each transaction.

Security: A Commitment to Trust

Security is a cornerstone of OneSpan Sign’s offering. The platform ensures the integrity of the documents being signed as well as the transactional workflow. Each document is protected by digital signature encryption and a tamper-evident seal, providing robust digital evidence to confirm that a document has not been altered during the signing process. This is in addition to comprehensive audit trails, to ensure that your e-documents are not just secure but also compliant with laws like UETA, ESIGN, and eIDAS. This level of evidence is particularly crucial in highly regulated industries, such as banking, where security and compliance is not an option but a necessity.

The platform undergoes regular updates to counteract vulnerabilities and supports a wide array of platforms, operating systems, and browsers without compromising on security standards.

Compliance

Another critical dimension is compliance. From GDPR in Europe to CCPA in California, each jurisdiction presents its unique set of regulations affecting identity, data, signatures, and much more. A large part of digital signature adoption is driven by industries with high levels of regulatory or compliance requirements, such as banking. Whether it’s a consent form from a customer or maintaining records for legal reasons, OneSpan aims to serve these diverse compliance needs effectively.

The platform maintains comprehensive audit trails to facilitate easy verification and legal compliance. OneSpan Sign is compliant with various regulations like ESIGN, UETA, and eIDAS, and has also obtained certifications like FedRAMP, SOC 3 Type II, ISO/IEC 27001 and HIPAA.

The Future of Digital Signatures

The future of digital signatures is poised for transformation, driven by advances in artificial intelligence (AI), blockchain technology, and changing perceptions of what constitutes consent and agreements. OneSpan predicts that AI will be pivotal for fraud detection and user productivity, enhancing security while also making form-filling more contextually relevant. Blockchain will also play an important role, providing immutable, transparent digital storage of not just documents but a range of digital artifacts, like PDFs and smart contracts throughout the lifespan of the agreement

This evolutionary trajectory indicates that digital signatures are set to become an integral part of a more complex, secure, and user-friendly digital experience.

The concept of ‘signing’ is expected to extend beyond traditional documents to include various mediums like web pages and voice messages. By investing in these emerging technologies and redefining what constitutes an ‘agreement,’ companies like OneSpan are leading the charge in shaping a future where the e-signature landscape is far more dynamic than it is today.

Our Verdict

OneSpan Sign stands out as a versatile, secure, and highly integrable electronic signature solution. Its emphasis on strong identity verification, advanced security protocols, and a user-friendly experience make it a favored choice for businesses in highly regulated industries.

In an industry filled with competitors, OneSpan distinguishes itself through a secure, private-labeled, and user-friendly experience designed to drive adoption. Its focus on security, compliance, identity verification, and scalability makes it an enterprise-grade solution capable of serving varied and complex needs. This capability has earned OneSpan the trust of the world’s most demanding financial institutions, solidifying the company’s status as a leader in the e-signature space.

For more information, visit: https://www.onespan.com/

The post OneSpan Sign: Delivering Digital Trust in a Changing World appeared first on Cybersecurity Insiders.

October 05, 2023 at 03:18AM

Read More

Why Are CISOs Struggling with Governance, Risk, and Compliance Reporting?

By Sravish Sridhar, CEO & Founder, TrustCloud

In our increasingly digitally connected world, cybersecurity risks are at an all time high and only growing. With this in mind, businesses are beginning to embrace and understand, if they didn’t before, just how essential a healthy governance, risk, and compliance (GRC) program is to their organization’s overall success.

Too Many Stakeholders Need Governance, Risk, and Compliance Reports

CISOs and their teams are now inundated with numerous requests to prove their security and privacy posture. Each stakeholder requires the data to be reported in different ways:

• Customers & Partners: They want assurance that their data is protected. Often, they use compliance frameworks like SOC 2, ISO 27001, NIST, HIPAA and GDPR as proof of information security. In many cases, adherence to one of (or many of) these frameworks is a necessary qualification before an organization can consider becoming a customer or partner.
• Boards & Company Leadership: Given the size of GRC investments, and the potential liability to boards and leaders, GRC is a business level priority that requires buy-in and support from the board and C-Suite. Not only do they want to know how these resources are impacting business, they also have a strong interest in mitigating company and personal liability that comes with a security breach.
• Internal CISOs and InfoSec Team Reporting: These are the programs they lead, therefore security professionals are heavily invested in the strategy and results of risk management and compliance.
• Regulators: They are in charge of coming up with the specific compliance and risk management measures all organizations should be adhering to, in order to adequately protect themselves and their customers from the growing and changing modern threat landscape.
• Auditors: External auditors are looking for specific compliance and risk artifacts; the easier it is for them to find exactly what they need, the more likely a company is to pass an audit in a reasonable timeframe.
• CFO: CFOs need justification for the budget they are giving to CISOs. So they want to see results. And not just any results, but results that positively impact or accelerate revenue.

The Impact of the SEC’s New Cybersecurity Regulations

The SEC recently published new rules for public companies specific to cybersecurity and compliance. With the new ruling, public companies will need to:

• Disclose material cybersecurity incidents within four business days
• Describe processes for “assessing, identifying, and managing material risks from cybersecurity threats”
• Report and disclose material information regarding cybersecurity risk management, strategy, and governance on an annual basis
• Describe the board of directors’ oversight of risks from cyber threats and management’s role and expertise in assessing risks and threats

While for now, this ruling only requires publicly traded companies to take these steps, these policies set new foundational standards for GRC and transparency when it comes to the way we do business. Not only will organizations be required to disclose cybersecurity incidents in a timely manner, but they will also have to share information on overall GRC and cybersecurity policies every year. Moreover, the SEC is specifically holding the board of directors and management responsible for GRC and management of cyber risk. Circling back to our question from earlier, “who cares about risk management & compliance?,” well the SEC is now making sure that an organization’s board of directors and management care, if they didn’t before.

Connecting Risk to Business Impact

While there are countless examples of what can happen to an organization when a cyber risk is exploited (think loss of data, customers, trust, tarnished brand reputation), CISOs are still struggling to connect risk to business impact and justify their security budgets.

An organization’s CFO and board will often evaluate projects based on impact, which means CISOs need data and evidence to connect how they protect against risk to how it impacts the business’s bottom line. While risk is a broad term, a more tangible definition is contractual risk – the commitments made to customers and partners, and the size of the contracts at stake if those commitments are not met. A concrete definition that reports in ARR (or another key revenue-related KPI) makes it easier for CISOs to communicate the size of relevant risks, which in turn help justify budget requests and program spend.

How Should CISOs Solve Their Reporting Requirements?

CISOs should be able to share a few key metrics that management, the board, and the CFO need to know in order to better understand the value and benefits being delivered from the security and GRC program. Metrics to share with key stakeholders include:

• Potential Financial Impact: An estimate of how much this risk could cost factoring in direct financial loss, ransomware payments, legal costs, PR, lost business, lost competitive advantage, customer churn, or changes to insurance premiums.
• Residual Financial Impact: How much of my potential financial impact still exists now that I have taken some action to reduce my risks? What’s the impact after I have created and implemented a treatment plan? How much liability am I still carrying?
• Top Five Risks: CISOs and leadership teams should focus on the top five risks that have the greatest residual financial impact or represent key security threats along with how much progress is outstanding.
• Revenue Accelerated by Security Programs: The ARR associated with contracts that required a security review. While not a direct measure of risk, it is helpful context to show how the security program impacts growth overall.

When a CISO is able to identify and share metrics like these, they can articulate the value and impact of their security and GRC program in terms that the C-Suite and board can understand, and better connect risk to business impact. When everyone is speaking the same language on compliance and risk, the result is an organization that is better aligned to prioritize, build, and maintain a healthy GRC and security program and showcase the results of that program and its benefits to customers and stakeholders.

 

Image by mindandi on Freepik

The post Why Are CISOs Struggling with Governance, Risk, and Compliance Reporting? appeared first on Cybersecurity Insiders.

October 04, 2023 at 10:45PM

Read More