Understanding cyber attacker motivations to best apply controls

Implementing a risk based security program and appropriate controls against adaptive cyber threat actors can be a complex task for many organizations. With an understanding of the basic motivations that drive cyber-attacks organizations can better identify where their own assets may be at risk and thereby more efficiently and effectively address identified risks.  This article will discuss the Rational Actor Model (RAM) as well as the seven primary intrinsic and extrinsic motivations for cyber attackers.
Deterrence and security theory fundamentally rely upon the premise that people are rational actors. The RAM is based on the rational choice theory, which posits that humans are rational and will take actions that are in their own best interests.  Each decision a person makes is based upon an internal value calculus that weighs the cost versus the benefits of an action.  By altering the cost-to-benefit ratios of the decisions, decisions, and…

Posted by: Chris Mark

Read full post

      

The post Understanding cyber attacker motivations to best apply controls appeared first on Cybersecurity Insiders.

February 19, 2020 at 09:08PM

Read More

Cyber Attack result is Coronavirus outbreak

Yes, what you’ve have read is right! There is a talk going on the web that the current outbreak of Coronavirus could be a result of a cyber-attack. Unlike, the ongoing speculation that it was either a result of Chinese project failure related to bio-war or a Xi-Jiping led nation’s war on the world to kill the entire human populace in the 7 Continents across the globe; except China.

Speaking at the Muni Expo 2020, Dr. Erel Margalit, the Chairman of Jerusalem Venture Partners (JVP) ignited a new hypothesis related to the Wuhan Virus outbreak- saying that there is a high possibility that hackers could have infiltrated the database of a lab and altered the composition of a chemical composition resulting in the Covid 19 virus occurrence in China.

Well, we cannot ward off such conjectures as fake news as anything can happen in the sophistication filled digital world of technology.

Margalit added to his statement that hackers could be watching the financial impact of Coronavirus spread on the International Economy and could take it as a resource platform to launch cyber threats of bigger in range.

Readers of the Cybersecurity Insiders should notify a fact over here that the above-stated words were spoken during the presentation of the Margalit Start-Up City which is intended to accelerate the growth of tech startups,

As Israel is acting as a central IT hub, Margalit felt that it should act as an International Cyber Center as Cyber Threats are being touted as the biggest global threats to industries like Health, Finance, Media, Infrastructure, democratic frameworks, and personal freedom.

The post Cyber Attack result is Coronavirus outbreak appeared first on Cybersecurity Insiders.

February 19, 2020 at 08:49PM

Read More

Ransomware attack on US Gas supply

DHS has issued an advisory yesterday citing a recent ransomware attack on a natural gas supplier as an example that critical infrastructure in the United States was super-vulnerable to cyber attacks. The security advisory has highlighted the fact that companies should take the incident as a wake-up call and take all necessary measures to prevent such incidents from hitting their infrastructure in the future.

 

Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency disclosed to the media that a threat actor somehow managed to induce a spear-phishing link into the IT infrastructure of the natural gas compression facility and obtains access to some data.

 

However, before any untoward situation occurred, the IT staff were quick enough to spot the attack and neutralize it in time. Details on when the incident occurred and the name of the gas supply operator has been kept as a secret from media for reasons.

 

As the ransomware did not come in contact with the Programmable Logic Controllers(PLCs), the factor operations remained unaffected. However, the operator decided to go for a deliberate shutdown to get clear access to the situation.

 

Although the name of the ransomware strain is yet to be revealed to the media, the suspicion pointer is hitting hard at the Snake Ransomware aka EKANS Ransomware which is known as malware that targets only industrial control systems.

 

Note- Snake Ransomware spreaders are known to steal data at first and then encrypt the database. And this is done to ensure that the hackers never go empty-handed if the victim refuses to pay the ransom as they can sell the data on the dark web marketplace and make a merry.

 

The post Ransomware attack on US Gas supply appeared first on Cybersecurity Insiders.

February 19, 2020 at 11:34AM

Read More

Plastic surgery videos leaked due to misconfigured Amazon Web Services Cloud

A study carried out by a team of security experts from vpnMentor has found that a database exposure due to a misconfigured cloud server has leaked plastic surgery photos and videos of patients belonging to a French Plastic Surgery Company named “NextMotion”.

The 2015 founded company which is into the sales of digital cameras meant to record events related to plastic surgeries in dermatology clinics has issued a public apology yesterday to all those patients of its 170 clinics operating in over 35 countries.

NextMotion from France also offers software for facial analysis and documentation procedures for the treatments carried out in its clientele databases. It is known to keep a tab of digital consent forms, treatment reports, quotes and the billing details on cloud-based databases- and this where the trouble started.

Due to misconfiguration error, researchers from vpnMentor have discovered that many sensitive images of plastic surgery patients uploaded from the medical devices and software were accessed fraudulently by hackers.

News is out that hackers could have gained access to over 900,000 images from Amazon Web Services S3 bucket which might have exposed details such as patients’ private parts.

NextMotion has given a brief clarification on its website that data related to patients such as names, birth dates, and contacts and surgery history is stored on a separate database whereas the photos and video evidence were stored on the media database. The authorities at the healthcare have mentioned in the statement that only details from the media database might get exposed to hackers- if at all they accessed the database due to the misconfiguration error.

The healthcare has also further disclosed in its statement that it has been storing patient records as per the regulations prevailing in the country such as HIPAA, GDPR, ISO and such…

As the database was named after the company, it became easy for vpnMentor researchers to contact the company about the possible data breach. And the NextMotion officials reacted on February 5th, 2020 by taking down the database offline.

The post Plastic surgery videos leaked due to misconfigured Amazon Web Services Cloud appeared first on Cybersecurity Insiders.

February 19, 2020 at 11:31AM

Read More

Why vendor management is a cornerstone of security

When it comes to building a security program, one of the most frequently overlooked areas is that of vendor management. Organizations focus significant resources on internal security, such as vulnerability scans, centralized log management, or user training, while not extending the same diligence towards their third-parties. Organizations end up trusting the security of their network and data to an unknown and untested third-party.
As we all know, a chain is only as strong as its weakest link. If an organization cannot verify the security of its third-parties, then it has introduced the potential for risk and reduced the information assurance of their system. It is essential to realize that even if the cause of a breach is due to a third-party, it is still your company’s name and brand that is at risk.
The potential cost associated with a breach can include:
Fines
Loss of trust
Brand damage
…

Posted by: Zachary Curley

Read full post

      

The post Why vendor management is a cornerstone of security appeared first on Cybersecurity Insiders.

February 18, 2020 at 09:08PM

Read More

Windows and Linux Servers globally are vulnerable to Cyber Attacks

Millions of servers running on Windows and Linux operating systems are reported to be vulnerable to cyber-attacks. And this was concluded in a research carried out by researchers from Eclypsium- a company offering Enterprise Firmware Security.

 

Going deep into the facts, the security researchers have discovered that the vulnerability is being created due to unsigned firmware seen in WiFi Adapters, USB Hubs, Trackpads and cameras used in servers and workstations operating worldwide. This includes those systems supplied by noted companies such as Dell, HP, Lenovo, Asus, Acer, and Huawei.

 

To prove their findings the researchers launched a successful cyber attack on a server through a network interface card that was running on an unsigned firmware. And to their surprise, they found that once infected the network cards linked to the servers of some noted manufacturers were acting as per the control commands directed by hackers.

 

It is a noted fact that many PC manufacturers do not follow a practice of adopting peripherals from manufacturers who use signed firmware. And this is where millions of Windows and Linux PCs are said to be getting exposed to cyber attacks such as data exfiltration, disruption in operations and getting exposed to malware inductions such as ransomware.

 

Disadvantages of using components without a signed firmware in devices 

 

• Hackers can deliver malware through an email or a malicious website, to those devices which use unsigned firmware. As it allows a hacker to write malicious code to defenseless components.
• If the device runs on a component that uses an unsigned firmware, then the component can run the command without any admin authentication which can further deteriorate the attack repercussions.

 

Therefore all these days there has been a regular practice of focusing only on vital components when it comes to securing PCs from cyber attacks.

 

Perhaps its high time that organizations, especially device manufacturers start adding firmware to their vulnerability management and cyber threat prevention posture in response to the increasing number of cyber threats.

 

More details on the components used by different PC manufacturers that are exposed to the said vulnerability are available on the official website of Eclypsium.

 

The post Windows and Linux Servers globally are vulnerable to Cyber Attacks appeared first on Cybersecurity Insiders.

February 18, 2020 at 08:46PM

Read More

Cisco and NEC partnership to offer Cyber Threat proof network equipment

Amid claims that Chinese 5G network equipment supplier Huawei is offering products with backdoors for conducting espionage, Japanese IT Giant NEC and Cisco have decided to offer network equipment under a partnership deal where the supplied equipment will be cyber threat proof by 100% all down the supply chain.

 

Cisco aims to achieve its objective by integrating its fraud detection technologies with NEC’s blockchain technologies meant to secure network devices.

 

An official statement released by NEC says that the equipment will be ready and released into the market by mid-2020 and the entire risk management in the supply chain will be done by an expert’s team which will keep an eye on the product production right from the design, to development and will carry forward its surveillance entirely through the transportation and maintenance stage.

 

As a part of this initiative, Cisco has agreed to permit NEC authorities to verify the existing authenticity of the already produced equipment by integrating NEC’s Lightweight Tamper Detection and blockchain technology with Cisco’s Proprietary Trustworthy Technology.

 

As all the data will be historically recorded through blockchain technology, network admins can check the authenticity of the devices during production, shipment inspection, and network installation stage.

 

In the near future, NEC plans to extend its cyber threat detection technology throughout the entire life cycle including expansion, upgrade, maintenance and operation.

 

Note- Cisco has been approached by the Japanese telecom sector for a local 5G project which has to be done in an authentic way sans controversy.

 

The post Cisco and NEC partnership to offer Cyber Threat proof network equipment appeared first on Cybersecurity Insiders.

February 18, 2020 at 10:13AM

Read More