Net Concepts with Aaron Wagner

You can find Wolfgang here: https://jwgoerlich.com/principles-for-designing-security-capabilities/

To one degree or another, remote work is here to stay. A Gartner survey of 317 CFOs and finance leaders in late March found that 74 percent will move at least 5 percent of their previously on-site workforce to permanently remote positions post-COVID 19. And almost 25 percent of respondents said they will shift at least 20 percent of their on-site employees to permanent remote positions.

Components of Cyber Resilience

Cyber resilience aims to secure the whole organization dynamically. It should be a preventive measure to defend against all insecure parts in the infrastructure. Cyber resilience has four components. These components are as follows:

Threat Protection

Recoverability

Adaptability

Durability

Resources:

https://threatpost.com/security-takeaways-work-from-home/159358/

https://blog.rsisecurity.com/what-is-cyber-resilience-and-why-is-it-important/

https://www.adacom.com/news/press-releases/cyber-resilience-importance/

Thank you for listening!

Ransomware gangs add DDoS attacks to their extortion arsenal

Things you can do?

https://www.cloudflare.com/ddos/

Lower your risk (offload email, lower the value off the data)

Avoid being attacked in the first place! Take the steps to protect your company.

Enforce remote access IP limits

https://www.bleepingcomputer.com/news/security/ransomware-gangs-add-ddos-attacks-to-their-extortion-arsenal/

New service checks if your email was used in Emotet attacks

“When infected, Emotet will steal a victim's email and transmit it back to servers under the attacker's control. These emails will then be used as part of future spamming campaigns to make the malicious spam look legitimate.

Over time, the Emotet trojan will download and install other malware such as TrickBot and QakBot on an infected user's computer. These trojans are known to lead to ransomware attacks by the operators of Ryuk, Conti, and ProLock.”

https://www.haveibeenemotet.com/

It is important to note the compound nature of ransomware attacks lately.

https://www.bleepingcomputer.com/news/security/new-service-checks-if-your-email-was-used-in-emotet-attacks/

Spammers add random text to shortened links to evade detection

But, the structure of the hardcoded URLs includes a gibberish "userinfo" part right before the domain name, to give off the impression these are different URLs.

Therefore, for example, if an enterprise security product was previously blocking the malicious link https://j[.]mp/kassaasdskdd it isn't clear if the product would also interpret something like https://nonsensical-text@j[.]mp/kassaasdskdd in the same manner and block it too.

https://www.bleepingcomputer.com/news/security/spammers-add-random-text-to-shortened-links-to-evade-detection/

Resources:

“Over 41 percent of cyber insurance claims in 2020 came from ransomware attacks”

“Interestingly, Coalition found that companies using Microsoft Office 365 were three times more likely to experience a business email compromise incident than companies using alternatives such as G Suite or WPS Office.”

https://www.techspot.com/news/86714-over-41-percent-cyber-insurance-claims-2020-came.html

6 Reasons Why Office 365 Backup is Critical

Accidental deletion: If you delete a user, whether you meant to or not, that deletion is replicated across the network. A backup can restore that user, either to on-premises Exchange or Office 365.

Retention policy gaps and confusion: Office 365 retention policies are hard to keep up with, let alone manage. A backup provides longer, more accessible retention all protected and stored in one place for easy recovery.

Internal security threats: Many businesses are experiencing threats from the inside, and they are happening more often than you think. Having a high-grade recovery solution mitigates the risk of critical data being lost or destroyed.

External security threats: Malware and viruses have done serious damage to organizations globally in just the past year alone. A backup can easily restore mailboxes to an instance before the attack.

Legal and compliance requirements: Ensure you can retrieve mailbox data during legal action and to meet any regulatory compliance needs.

Managing hybrid email deployments and migrations to Office 365: Whether you are migrating to Office 365 or have a blend of on-premises Exchange and Office 365 users, the exchange data should be managed and protected the same way, making the source location irrelevant.

https://www.veeam.com/blog/momentum-office-365-backup.html

New Vulnerabilities Bypass Multi-Factor Authentication for Microsoft 365

https://www.proofpoint.com/us/blog/cloud-security/new-vulnerabilities-bypass-multi-factor-authentication-microsoft-365

https://threatpost.com/flaws-in-microsoft-365s-mfa-access-cloud-apps/159240/

Discussion source articles:

https://www.bleepingcomputer.com/news/security/cisco-engineer-resigns-then-nukes-16k-webex-accounts-456-vms/

Cisco engineer resigns then nukes 16k WebEx accounts, 456 VMs

https://solutionsreview.com/identity-management/insider-threat-awareness-month-2020-the-experts-comment/

September marks the beginning of Insider Threat Awareness Month 2020. Enterprises can’t ignore that some of the most pressing threats to their digital IT infrastructure might not come from without but from within. Whether it stems from actual malice or from simple ignorance, employees and third-parties could cause data breaches, data leaks, or business disruptions just as easily as any hacker.

https://www.ekransystem.com/en/blog/insider-threat-statistics-facts-and-figures

Despite that, the number of insider-related breaches rises every year. The Verizon 2019 Data Breach Investigations report says that 34% of all breaches in 2018 were caused by insiders.

https://securelist.com/it-threat-evolution-q2-2020-pc-statistics/98292/

Vulnerable applications used by cybercriminals during cyberattacks

Intellectual Property Protection Safeguard Your Company’s Trade Secrets, Proprietary Information and Research

U.S. Department of Justice Federal Bureau of Investigation Domestic and foreign companies may try to illegally acquire your company’s information. Foreign nations that seek to improve their economies and militaries target US technology companies.

https://www.uspto.gov/learning-and-resources/ip-motion/intellectual-property-and-us-economy

1 in 5 corporations say China has stolen their IP within the last year: CNBC CFO survey

One in five North American-based corporations on the CNBC Global CFO Council says Chinese companies have stolen their intellectual property within the last year. In all, 7 of the 23 companies surveyed say that Chinese firms have stolen from them over the past decade.

https://www.cnbc.com/2019/02/28/1-in-5-companies-say-china-stole-their-ip-within-the-last-year-cnbc.html

How To Stop China From Stealing Your Intellectual Property

https://www.forbes.com/sites/kenrapoza/2019/09/18/how-to-stop-china-from-stealing-your-intellectual-property/#11745e110055

Top Ten Cases of Chinese IP Theft

https://www.prosperousamerica.org/top_ten_cases_of_chinese_ip_theft

Intellectual property protection: 10 tips to keep IP safe

Are mobile phone calls “secure?”

https://anewcellphone.com/are-cell-phone-calls-secure/

Unit 61398: Chinese Cyber-Espionage and the Advanced Persistent Threat

https://resources.infosecinstitute.com/unit-61398-chinese-cyber-espionage-and-the-advanced-persistent-threat/

We discuss the benefit of compliance. We also touch on layers of security and where Net Concepts fits into a company’s strategy.

Though we couldn’t locate an article that pre dates the 2010 Google attack, the 2010 attack and the eff.org article demonstrate the same issue. These articles point to one thing, operating out of China is risky at best.

China’s Global Reach: Surveillance and Censorship Beyond the Great Firewall

https://www.eff.org/deeplinks/2019/10/chinas-global-reach-surveillance-and-censorship-beyond-great-firewall

TikTok says it will stop accessing clipboard content on iOS devices

https://www.theverge.com/2020/6/26/21304228/tiktok-security-ios-clipboard-access-ios14-beta-feature

Zoom suspends account of US-based Chinese activists after Tiananmen meeting

https://www.bbc.com/news/world-asia-53003688

Google may pull out of China after cyberattacks

https://www.infoworld.com/article/2629434/google-may-pull-out-of-china-after-cyberattacks.html

Chinese hackers who breached Google reportedly targeted classified data

https://arstechnica.com/information-technology/2013/05/chinese-hackers-who-breached-google-reportedly-targeted-classified-data/

Twitter attack: https://twitter.com/mikko/status/1284371546723831808?s=20

https://www.bleepingcomputer.com/news/security/exposed-frost-and-sullivan-databases-for-sale-on- hacking-forum/

https://threatpost.com/sodinokibi-ransomware-now-scans-networks-for-pos-systems/156855/

https://www.securityweek.com/sophisticated-phishing-kit-used-multiple-groups-target-executives

https://arstechnica.com/information-technology/2020/06/to-evade-detection-hackers-are-requiring- targets-to-complete-captchas/