PC PORTAL

Experienced. Trusted. Solutions.

IT Security

By

Employee Spotlight: The Human Faces Behind Artificial Intelligence

Webroot BrightCloud® Threat Intelligence relies on the collective power of millions of devices working together. But what sometimes gets lost is the actual humans behind bringing this technology to market. In this Employee Spotlight, we talk to Account Development Executive, Jordan Gray, who works with C-level executives to integrate threat intelligence solutions within their environments.

What brought you to Webroot?

In 2018, I was looking for a career change away from insurance. After doing some extensive research into the market, I decided that the tech industry, particularly in Ireland, was right for me as more and more tech companies start setting up offices here. After initially setting up a call with a recruiter to discuss a role at Webroot, I fell in love with the product and company vision. The rest is history!

What is your role in the company?

My main role requires me to conduct high level discovery calls and sessions to BANT qualify C-Level and VPs before passing qualified opportunities onto our Sales Director to discuss integration and pricing in detail.

Have you ever had any close calls with malicious actors?

Thankfully, I never had any close calls with real malicious actors. However, about six months into my role at Webroot, I was successfully phished by our IT department who were sending out simulated phishing emails at the time. They sent me a delivery notice from a courier that was sending me a parcel and I clicked the link without checking. Nonetheless, I brushed up on my security awareness training afterwards! Lesson learned from me.

What are the top three malicious actors you think people should be concerned about?

Coronavirus scams are spreading nearly as fast as the virus itself. As of Jan. 3, the Federal Trade Commission (FTC) had logged more than 298,000 consumer complaints related to COVID-19 stimulus payments, 68 percent of them involving fraud or identity theft. They’ve also shut down hundreds of suspected phishing sites, which promise vaccines and other aid. That being said, our Tier-1 URL filtering can really help organizations block access to malicious sites keeping them and their customers safe.

Malware is the second big threat facing businesses. It encompasses a variety of cyber threats, such as trojans and viruses. It’s a general term for malicious code that hackers create to gain access to networks, steal data or destroy data on computers. Malware usually comes from malicious website downloads, spam emails or from connecting to other infected machines or devices. Businesses can stay safe by using Webroot’s industry leading endpoint protection.

Ransomware is one of the most common cyber-attacks, hitting thousands of businesses every year. They’ve grown more common recently, as they are one of the most lucrative forms of attacks. According to Forbes, ransomware payments have more than doubled in the last 12 months.

How have malicious threats evolved since the early days of the internet to now?

Cyber threats are evolving every day. Hackers are constantly looking for new ways to exploit individuals and organizations. It’s becoming easier for even amateur hackers to access high-level malicious software, with the availability of ransomware as a service (RaaS).  This allows highly skilled cyber criminals to create malware and sell it off to other cyber criminals, making a profit without the risk of deploying the malware themselves.

How have our defenses evolved to match the growing threats that malicious actors represent?

Webroot is currently using 6th Generation machine learning (ML), which uses complex neural networks that allow the machine to more accurately and autonomously identify relevant patterns and concepts within continually growing amounts of telemetry from Webroot customers.

What specifically is Webroot doing with regards to its threat intelligence platform to combat these increasingly sophisticated attacks?

Webroot’s threat Intelligence platform continues to improve every day. We have a uniquely diverse customer base, from consumer to small and midsize businesses and all the way up to the enterprise. So, we see every type of online threat. Also, we have started to work closer with our partners to identify how we can solve industry problems such as the cloud access security broker (CASB) market and become leaders within these market segments.

Where do you think the future of threat intelligence is headed? 

The market is still growing. Research suggests threat intelligence could be a $13 billion market by 2023. Organizations of all sizes are starting to use threat intelligence. I personally think cybersecurity will move from reactive to proactive. Threat intelligence will effectively predict and prevent attacks at the earliest stage, and sooner or later, underpin the whole concept of proactive cybersecurity and organizational risk.

What else are you into besides threat intelligence?

I am a big football fan, or soccer as the guys in the U.S. would say. In my free time, you’d find me watching Manchester United play while having a Guinness or spending time going on road trips with my girls when COVID and the weather permits. 

The post Employee Spotlight: The Human Faces Behind Artificial Intelligence appeared first on Webroot Blog.

By

Cyber News Rundown: Gaming Industry in Crosshairs of Cybercriminals

Top gaming companies positioned to be next major cyberattack target

After healthcare and higher education emerged as lucrative targets for cyberattacks in 2020, researchers have identified the video gaming industry as another key target. By scouring the dark web for stolen data belonging to any of the top 25 largest gaming firms, over a million unique and newly uploaded accounts were discovered. Additionally, researchers found credentials for over 500,000 gaming company employees exposed in previous data breaches but used for multiple accounts.

Hardcoded backdoors discovered in Zyxel devices

Researchers recently stumbled upon an undocumented admin account on multiple Zyxel devices using basic login credentials and granting full access to devices commonly used to monitor internet traffic. This vulnerability was first spotted when several warnings for unauthorized login attempts were identified using admin/admin as the username and password, presumably in hopes of accessing other unprotected devices on the network. This undocumented account can only be viewed through an SSH connection or a web interface and could be an issue for over 100,000 Zyxel devices currently connected to the internet.

Vodafone operation reveals major data breach

Vodafone’s budget operators ho. Mobile has revealed their systems were compromised late last month and a database containing sensitive information belonging to nearly 2.5 million customers was leaked. Along with personally identifiable information is data related to customer SIM-cards, which can be used to enable SIM-swap attacks that allow attackers to control specific users’ messaging services. The stolen database has been for sale on a dark web for a starting price of $50,000 since shortly after the attack was discovered.

ElectroRAT quietly steals cryptocurrency across multiple operating systems

After operating for nearly a year the silent cryptocurrency stealer ElectroRAT has finally been identified using multiple different Trojanized apps to operate on Windows, Mac and Linux systems. To make these malicious apps appear more credible, authors placed advertisments on social media and cryptocurrency-related websites that have led to thousands of installations. By spreading the attack across multiple different operating systems, the attackers increased their chances of accessing information of value.

Vancouver’s TransLink Suffers Ransomware Attack

Nearly a month after officials identified technical issues with IT systems at Metro Vancouver’s TransLink transportation authority, the interruption was discovered to be the work of the Egregor Ransomware group. While the attack didn’t compromise customer data, it is believed that employee banking and personal information was stolen. TransLink employees are working to restore systems to proper functionality, though some seem to have been more damaged than others.

The post Cyber News Rundown: Gaming Industry in Crosshairs of Cybercriminals appeared first on Webroot Blog.

By

Maze Ransomware is Dead. Or is it?

“It’s definitely dead,” says Tyler Moffitt, security analyst at Carbonite + Webroot, OpenText companies. “At least,” he amends, “for now.”

Maze ransomware, which made our top 10 list for Nastiest Malware of 2020 (not to mention numerous headlines throughout the last year), was officially shut down in November of 2020. The ransomware group behind it issued a kind of press release, announcing the shutdown and that they had no partners or successors who would be taking up the mantle. But before that, Maze had been prolific and successful. In fact, shortly before the shutdown, Maze accounted for an estimated 12% of all successful ransomware attacks. So why did they shut down?

I sat down with Tyler to get his take on the scenario and find out whether Maze is well and truly gone.

Why do you think Maze was so successful?

Maze had a great business model. They were the group that popularized the breach leak/auction website. So, they didn’t just steal and encrypt your files like other ransomware; they threatened to expose the data for all to see or even sell it at auction.

Why was this shift so revolutionary?

The Maze group tended to target pretty huge organizations with 10,000 employees or more. Businesses that big are likely to have decent backups, so just taking the data and holding it for ransom isn’t much of an incentive.

Now think about this: those huge businesses also would’ve been subject to pricey fines for data breaches because of regulations like GDPR; and they’re also more likely to have big budgets to pay a ransom. So, instead of simply saying, “we have your data, pay up,” they said, “we have your data and if you don’t pay, we’ll expose it to the world – which includes the regulators and your customers.” Most of the time, paying the ransom is going to be the more cost effective (and less embarrassing) option. We don’t know if the Maze group invented this tactic, but they definitely set the trend, and a bunch of other ransomware groups started following it.

Other than the leak sites, did they do anything else noteworthy or different from other groups?

One of the bigger threat trends we saw in 2020 was malware groups partnering up for different pieces of the infection chain, such as Trojans, backdoors, droppers, etc. The botnet Emotet, for example, was responsible for a huge percentage of ransomware infections from various different groups. Maze, however, was pretty self-contained. We saw them working with a few other groups throughout 2020, but they had their own malspam campaign for delivery and everything else they needed in-house, so to speak. They were like a one-stop shop.

Do you think the move to remote work during the pandemic contributed to their success?

Absolutely, though you could say that about any ransomware group. Phishing and RDP attacks really ramped up when people started working from home. Home networks and personal devices are generally much less secure than corporate ones, and cybercriminals are always looking for ways to exploit a given situation for their gain.

If Maze was doing so well, why did they shut down?

Probably because they’d gotten too much attention. The more notoriety you get, the harder it is to operate. We see this with a lot of malware groups. They shut down for a while, either to lie low because the heat is on, or to just spend the money they’ve gotten from their payouts and enjoy life. Or, sometimes, they don’t lie low at all but just rebrand themselves under a new name. Either way, they tend to come back. For example, a ransomware variant called Ryuk went dark and came back as Conti. Emotet went away for a long time too and then came back under the same group name.

How can you tell when an old group has rebranded?

Unless they announce it in some way, the only way to really tell is if you can get a sample of the malware and reverse engineer it and look at the code. One of our threat researchers did that with a sample of Sodinokibi and discovered it had “GandCrab version 6” in its code. So, that’s an example of a rebrand, but it can be hard to spot.

Do you think Maze is done for good?

Not a chance. They attacked huge targets and got massive payouts. Most ransomware groups attack smaller businesses who are less likely to have strong enough security measures. Even the ones that targeted larger corporations, like Ryuk, still attacked businesses one-fifth the size of a typical Maze target. Now, the Maze group can relax and take a lavish vacation with all the money they got. But I’d be pretty shocked if they just abandoned such a winning business model entirely.

The verdict: Maze may be gone for now, but experts are fairly certain we haven’t seen the last of this virulent and highly successful malware group. In the meantime, Tyler advises businesses everywhere to use the lull as an opportunity to batten down their cyber resilience strategies by implementing layered security measures, locking down RDP, and educating employees on cybersecurity and risk avoidance.

Stay tuned for more ransomware developments right here on the Webroot blog.

The post Maze Ransomware is Dead. Or is it? appeared first on Webroot Blog.

By

How to Build Successful Security Awareness Training Programs in 2021 and Beyond

Security awareness training is one of the most straightforward ways to improve a business’ overall resilience against cyberattacks. That is, when you get it just right.

Thanks to the disruptions to “normal” work routines that COVID-19 has brought, launching a company-wide training program to teach end users how to avoid phishing scams and online risks is a big challenge. Unfortunately, COVID-19 has also brought a major acceleration in phishing activity. With so many office employees working outside the safety of corporate network protections, you can see why the need for training has never been more critical.

But there’s another issue: training is outside the skillset for most IT admins, and the level of effort to set up and run a program of training courses, compliance accreditations and phishing simulations can be daunting.

To help you get started, here are our top 5 recommendations for starting your security awareness program so you can maximize the impact of your efforts.

  1. Get buy-in from stakeholders.

While you probably already have some combination of security tools in place, such as endpoint protection, DNS or web filtering, etc., the 2020 Verizon Data Breach Investigations Report states that phishing and social engineering are still the primary tactics used in successful cybersecurity breaches.

Make sure your stakeholders understand these threats. Send an email introducing the program to management and clearly explain the importance of educating users and measuring and mitigating your risk of exposure to phishing and other social engineering attacks.

  • Start with a baseline phishing campaign.
    When you run your first phishing campaign, you establish your starting point for measuring and demonstrating improvement over time. (You can also use this real-world data to accurately show the need for improvement to any still-skeptical stakeholders.) Ideally this initial campaign should be sent to all users without any type of forewarning or formal announcement, including members of leadership teams. Make sure to use an option that simply shows a broken link to users who click through, instead of alerting them to the campaign, so you can prevent word-of-mouth between employees from skewing the results.
  • Set up essential security and compliance training.
    Create training campaigns to cover essential cybersecurity topics including phishing, social engineering, passwords and more. Establish which compliance courses are appropriate (or required) for your organization and which employees need to complete them.
  • Establish a monthly phishing simulation and training cadence.
    Repetition and relevance are key for a successful security awareness training program. By setting up a regular simulation and training schedule, you can more easily measure progress and keep an eye on any high-risk users who might need extra attention. Using our shorter 4-5-minute modules in between more substantial training is an effective tactic to keep security top of mind while avoiding user fatigue. And if you can’t run phishing simulations monthly, strive for a quarterly cadence. If you get pushback on sending emails to everyone, then we recommend you prioritize testing users who failed the previous round.
  • Communicate results
    A great way to raise awareness and increase the impact of your phishing campaigns is to share the results across the organization. Keep in mind, the goal is to capitalize on collective engagement and share aggregate results, not to call out individuals. (Your “offenders” will recognize themselves anyway – no need to call them out!)

The critical piece is that seeing the statistics on where the organization stands as a whole.  After the baseline phishing simulation, send out an email to all employees with the results and the reasoning for the campaign. Communicating these numbers will not only help show improvement over time, it’ll also demonstrate the value of the program overall and reinforce to employees that cyber resilience isn’t just IT’s job – it’s a responsibility we all share.

Although there are numerous other tips and tricks that can help ensure the success of your security awareness training program, these are our top five basic pieces of advice to get you on your way. When you follow these steps, it won’t take long to see the very real returns on your training investment.

For more detailed tips on how you can put Webroot® Security Awareness Training to work to improve your business’ cyber resilience posture, view our white paper.

The post How to Build Successful Security Awareness Training Programs in 2021 and Beyond appeared first on Webroot Blog.

By

Cyber News Rundown: Trickbot Spreads Via Subway Emails

Trickbot spreading through Subway company emails

Customers of Subway U.K. have been receiving confirmation emails for recent orders that instead contain malicious links for initiating Trickbot malware downloads. Subway has since disclosed that it discovered unauthorized access to several of its servers, which then launched the campaign. Users who do click on the malicious link initiate a process in Task Manager that can be stopped to prevent additional illicit activities typical of Trickbot infections.

Scores of municipal websites attacked in Lithuania

At least 22 websites belonging to various municipalities in Lithuania were compromised after a sophisticated cyberattack allowed intruders to take control. After gaining access to the sites, the attackers began delivering misinformation emails under the auspices of Lithuanian government and military ministries. Much of the misinformation being spread revolved around military enlistment and the suspicion of corruption at an airport housing a NATO facility.

Researchers discover millions of medical records online

Researchers at CybelAngel have uncovered over 45 million healthcare records on unprotected servers. Amongst the sensitive data was personal health information and other personally identifiable data, all left on servers with a login page that allowed access without credentials. It’s likely this data was left unsecured because of the number of medical professionals needing to access, though the security lapse is inexcusable. With healthcare facilities prime targets for ransomware attacks, communications between organizations should entail strict security to protect the valuable data.

Ransomware strikes city of Independence, Missouri

Officials for the city of Independence, Missouri, have been working for weeks to recover from a ransomware attack that forced them to take several essential services offline. Fortunately, recent file backups were available to restore some of the encrypted systems to normal. At this point, officials remain uncertain if customer or employee data was stolen during the attack, and no ransomware group has come forward to take credit for the attack or post the stolen data for sale.

Data Breach Compromises Patient Data at California Hospital

California’s Sonoma Valley Hospital recently delivered letters to roughly 67,000 patients regarding a data breach back in October that may have compromised personally identifiable information and other healthcare records. While the hospital was able to shut down some of their systems to prevent the breach from spreading, the attackers are believed to have gained access to and stole sensitive data.

The post Cyber News Rundown: Trickbot Spreads Via Subway Emails appeared first on Webroot Blog.