Real-time cyber trainer in employee browsers

Scammers disguised two domains as a content delivery network (CDN) in an attempt to quietly target visitors with a credit card skimmer. Malwarebytes noticed something suspicious within the website code of a Parisian boutique store. At first, the script looked like a JQuery library loaded from a third-party CDN. But the actual content of the […]… Read More The post Scammers Disguise Two Domains as CDN to Cloak Credit Card Skimmer appeared first on The State of Security.

Since I was exposed to three different online scam campaigns in the last three weeks, without having to go out and search for them, I thought that today might be a good time to take a look at how some of the current online scams work.

A targeted phishing attack using SLK attachments is underway against thirteen companies, with some of them being well-known brands, to gain access to their corporate networks.  [...]

Phishing poses a looming vulnerability for many enterprises today because the attackers have upped their game. They can now set up and take down phishing attacks within minutes, making it very hard for current defenses to identify the problem before users succumb to a scam. The major types of phishing and social engineering threats today […] The post Slow Response Times to Blame for Phishing Attack Success on Organizations appeared first on Security Boulevard.

Britton White is a cybersecurity & HIPAA Compliance advisor. The following article is reproduced with his kind...

Hospitals and other healthcare facilities are under attack from cyber criminals. In 2019 healthcare was one of the most targeted industries. In the first half of 2019 alone, there were 168 attacks that breached more than 30 million health care records. And according to IBM research, the average cost of a breach at a healthcare facility was $3.92 million. And as hospitals continue to go digital, these stats are on track to get even worse. The post Zero Trust Can Fix Healthcare’s Security Problem appeared first on Security Boulevard.

Attackers are exploiting the hype surrounding this year's Oscar Best Picture nominated movies to infect fans with malware and to bait them to phishing websites designed to steal sensitive info such as credit card details and personal information. [...]

Phishing scam perpetrated by attackers posing as vendors cheated the school district of approximately $2.3 million before the business compromise scheme was discovered about a month later.

An employee at a New York City medical center was tricked into giving out patient information by a threat actor purporting to be one of the facility's executives. In a Notice of Data Privacy Incident statement published on VCRN's website, the company stated: "The unauthorized actor requested certain information related to VCRN patients. Information obtained by the threat actor included first and last names, dates of birth, and medical insurance information, including provider name and ID number for 674 patients. The medical center said that they weren't aware of any personal patient information having been misused as a result of this event. VCRN has taken steps to notify all the patients who have potentially been impacted by the cyber-attack. VCRN advised patients "to remain vigilant against incidents of identity theft and fraud and to review account statements, credit reports, and explanation of benefits forms for suspicious activity and report any suspicious activity immediately to your insurance company, health care provider, or financial institution."

We look at the threat of spear phishing, why it's such a problem, and what organizations can do to lessen the chance of a successful attack. Categories: Social engineering Tags: 101businessmalspamorganisationorganizationorganizationsphishphishingscamsmishingSocial Engineeringspamspear phishspear phishingwhaling (Read more...) The post Spear phishing 101: what you need to know appeared first on Malwarebytes Labs.

IT security practitioners are aware of good habits when it comes to strong authentication and password management, yet often fail to implement them due to poor usability or inconvenience, according to Yubico and Ponemon Institute. The conclusion is that IT security practitioners and individuals are both engaging in risky password and authentication practices, yet expectation and reality are often misaligned when it comes to the implementation of usable and desirable security solutions. The tools and … More → The post Users still engaging in risky password, authentication practices appeared first on Help Net Security.

A complex and robust password is the first step towards a safer online presence, but some people straight up ignore this simple rule and choose the worst possible password. The weakest passwords, at least, are remarkably consistent from year to year, according to information provided by SplashData. The user name and password for login are […] The post !@#$%^&*: The Most Used Passwords in the World Are as Bad as You Imagine appeared first on Security Boulevard.

63% of enterprise professionals have created at least one account without their IT department being aware of it, and two-thirds of those have created two or more, the results of a recent 1Password survey have revealed. Even more worryingly, only 2.6% of these 63% use a unique password when they create a new shadow IT account at work and just 13% use a password generator – the rest re-use a memorable password or use a … More → The post Shadow IT accounts with weak passwords endanger organizations appeared first on Help Net Security.

As an early domain name investor, Mike O'Connor had by 1994 snatched up several choice online destinations, including bar.com, cafes.com, grill.com, place.com, pub.com and television.com. Some he sold over the years, but for the past 26 years O'Connor refused to auction perhaps the most sensitive domain in his stable -- corp.com. It is sensitive because years of testing shows whoever wields it would have access to an unending stream of passwords, email and other proprietary data belonging to hundreds of thousands of systems at major companies around the globe.

The security of your bank account, Netflix account and email inbox depends on how well you safeguard your passwords.

Behind each cyberattack on the MSP is typically a system left unpatched, asset management undone, security officer not hired, or board who sees investment in security as a cost center rather than a long-term investment. Categories: Opinion Tags: advanced persistent threatadvanced persistent threatsAPTbreachcredential managementcredentialsdata breachhackingmanaged service providerMSPMSPsphishing (Read more...) The post Securing the MSP: their own worst enemy appeared first on Malwarebytes Labs.

With the complexity of consumer devices only increasing, contextual security should be a priority for all – a situation which would avoid password shaming.

Hackers began hijacking accounts hours after Disney+ launched earlier this week.

Despite Bill Gates predicting the demise of passwords back in 2004, they are still very much in use. Passwords, like email, seem future proof; but they are also the source of many cybersecurity problems. Key drivers of these issues are human behavior and the desire for convenience, which results in password reuse across multiple accounts. The 2018 Global Password Security Report shows a staggering 50 percent of users use the same passwords for their personal … More → The post The password reuse problem is a ticking time bomb appeared first on Help Net Security.

Redmond urges users to switch on MFA

Maia Snow reports: Concerns have been expressed after documents containing patient information was stolen from a...

Faced with increasing volume and sophistication of cyber threats, CISOs and security teams need to find ways to ... Read More The post How to Use NIST’s Cybersecurity Framework to Foster a Culture of Cybersecurity appeared first on Hyperproof. The post How to Use NIST’s Cybersecurity Framework to Foster a Culture of Cybersecurity appeared first on Security Boulevard.

Make cybersecurity your top priority, moving away from addressing individual problems with Band-Aids and toward attaining a long-term cyber-fitness plan.

43% of IT professionals report using spreadsheets as one of their resources for tracking assets, according to Ivanti. Further, 56% currently do not manage the entire asset lifecycle, risking redundant assets, potentially creating a risk, and causing unnecessary and costly purchases. Findings from the survey demonstrate the need for greater alignment between ITSM and ITAM processes, especially when looking at the time spent reconciling inventory/assets. Nearly a quarter of respondents reported spending hours per week … More → The post 43% of IT professionals are still tracking assets in spreadsheets appeared first on Help Net Security.

A surprising number of users seem to be setting Trello boards, and their often highly sensitive content, to ‘public’.

Supporters say sacking was motivated by their union activity

Article by Andrea Babbs, UK General Manager, VIPRE SafeSend With the number and sophistication of cyber attacks increasing significantly, organisations have had to become aware and adapt to new and evolving digital threats. Yet, many would still consider the simple error of sending an email to the wrong contact trivial, at most embarrassing, but not of concern when it comes to data security. However, misaddressed emails have far-reaching consequences that can seriously impact an organisation, especially in highly regulated industries such as healthcare and finance. From fines to data breaches, what are the potential ramifications of sending an email to the wrong address? Reputational and Financial Damage While accidentally dialling a wrong number can be a little embarrassing, the same cannot be said for sending an email to the wrong contact. You could try to correct the error with a follow-up email to apologise and request that the recipient delete the message, but even if you’ve spotted the error it’s often too late. Moreover, the misuse of CC and BCC functions could expose your entire contact database, potentially giving your competitors an opportunity to lure your customers or employees away, or worse – exposing customer emails to potential hackers. BitMEX, one of the world’s largest cryptocurrency trading platforms accidentally leaked thousands of private customer email addresses when they sent out a mass mailshot without using the BCC function. While the company maintains that customer privacy remains a top priority, its customers were left wondering how they could trust BitMEX with huge personal assets in the aftermath of this data protection failure. A similar incident in 2018 led to the Independent Inquiry into Child Sexual Abuse (IICSA) being fined £200,000 by the Information Commissioner’s Office (ICO) for failing to protect the identity of possible victims of child abuse after a human error accidentally exposed victim identities to third parties, when they included their email addresses in the ‘To’ rather than ‘BCC’ field. In the age of increased data protection regulations, this example demonstrates just how seriously the ICO takes these types of data breaches. The pain of embarrassment from sending an email to the wrong contact pales in comparison to the business pain from financial penalties. Intellectual Property Loss Should confidential corporate information fall into the wrong hands, the consequences could be devastating. Crucial company information such as trade secrets or blueprints of an unpatented new product leaking into the public domain could easily be intercepted by the competition, resulting in a lost competitive advantage. All it takes is a simple missed or added character in the email address, autocorrect taking over, or simply pressing send too soon and the information that was once confidential is sitting in the wrong inbox. It could be that of an unknown individual, competitor, or even a cyber-criminal. In 2018, Commonwealth Bank staff inadvertently sent 651 emails to an overseas company as they forgot to include ‘.au’ at the end of the domain that should have read ‘cba.com.au’. This data leak occurred over a long period without anyone noticing, so could have potentially exposed sensitive company data or private customer information to competitors, putting the company at serious risk. However, luckily on this occasion, the company confirmed that no customer data had been compromised. Data Breach The ICO found that misaddressed emails are the largest source of data loss for organisations – over 269 billion emails are sent around the world each day. Gone are the days when employees operated from a single office-based computer, the modern workforce is now working from potentially several locations across a number of devices. Combine this with increasing pressures on staff juggling deadlines and deliverables to perform better and faster, it’s no surprise that most don’t spend time verifying the accuracy of the email address they are about to send confidential information to – no organisation is immune to human error. Hackers can capitalise on this complacent email culture by cleverly disguising emails to look like they are coming from inside the company, but actually, have a similar spoofed domain name that the employee would probably fail to spot on a first glance. Potentially opening the organisation up to a devastating hacking, malware or ransomware attack and a clear reason why Business Email Compromise (BEC) scams continue to be popular with cybercriminals. Conclusion The ramifications of misaddressed emails go far beyond just an embarrassing mishap – the threat that comes from accidental data leakage can be just as damaging as the external threat of cybercrime, especially as these leaks often go unnoticed for a period of time. Businesses need a clear strategy to address the issue of misaddressed emails and mitigate the associated risks to remain compliant and secure. What is required is a tool that prompts users for a double-check of their email based on set parameters, who it is being sent to, the contents and attachments. But this isn’t about adding time or delay to employees that are already under pressure – it’s about increasing awareness and improving email culture where mistakes can so easily be made. The post Three Consequences of a Misaddressed Email appeared first on Security Boulevard.