2-factor Authentication helps protect your identity.
You should deploy 2-factor Authentication. This increases your security and reduces your chances of becoming an identity theft victim. Most services encourage 2-factor Authentication and let you deploy it at no additional cost.
Here's a quick question for you.
When attempting to access a website, the website can challenge you based on:
A) What you know (e.g. password).
B) Who you are (e.g. fingerprints).
C) What you have (e.g. phone).
D) All of the above.
Correct answer: D.
How it looks in real life.
Daisy runs a dental office in Folsom, CA. Keeping the practice up and running is her top priority. She runs most of her patient, insurance and vendor communications through her Gmail account. She deploys 2-factor Authentication with the steps at https://myaccount.google.com/signinoptions/two-step-verification/enroll-welcome. She keeps her smartphone nearby. ... Read More
Social media connection requests are not always real
Meet Lynne. She sent you a social media connection request. Here's some background on Lynne. Happily married to a professional athlete. Real estate agent in San Francisco. Runs three marathons a year. Promised her mom she would visit all seven continents before turning 50. Laughs and walks away when you try talking politics.
Would you accept a social media connection request from Lynne? She looks decent and honest, right?
Fake profile
Think twice. She is fake. I visited https://www.thispersondoesnotexist.com/ and chose three pictures for my book. I wrote the profiles from scratch. https://www.thispersondoesnotexist.com/ uses a generative adversarial network, defined at https://en.wikipedia.org/wiki/Generative_adversarial_network to create pictures. Wikipedia tells us “a GAN trained on photographs can generate new photographs that look at least superficially ... Read More
Did you know your multifunction printer has its own backdoor WIFI?
Allen called me one day and said his printer was printing nonstop garbage. He wasn’t printing anything, but somebody was printing through WIFI. This print job was consuming his toner and paper. How did this happen?
I told Allen that in addition to joining your multi function printer to your office or home WIFI, you’ll find the printer broadcasts its own WIFI signal. You, or anybody close enough to the printer, can hop on that printer through that WIFI. A hacker could then cause mischief, including changing the printer’s IP addresses or printing large print jobs that consume paper and toner. I am showing you how to identify your printer’s WIFI, and how to secure it.
Assumptions
... Read More
Insurance companies pay off ransomware
Fasten your seat belt. Ransomware may be poised to return as a top scourge for companies, as more and more of them pay up—actually their insurance companies pay up. They try to minimize the cost of recovery.
In this new RSA Conference 2019 Threatpost video, Josh Zelonis, senior analyst at Forrester Research, discusses the next great security threats to enterprises.
According to Zelonis, a new trend of victims paying off the ransoms could reverse the wane in ransomware attacks that has been seen in the last year or so. Here is a snippet from the interview:
Cheaper for insurance companies
Tara Seals: "Before we kick off our video interview here, you had mentioned that you’ve been seeing a trend of companies actually paying the ransomware when they ... Read More
Ransomware Authors Agreed to $400,000
Officials in Jackson County, Georgia, paid $400,000 to cybercriminals last month. That was the extortion fee to get an encryption key for a ransomware infection and regain access to their IT systems. The County hired a cyber-security consultant to negotiate a ransom fee with the hacker group. Jackson County officials have not yet confirmed how hackers breached their network.
The infection forced most of the local government's IT systems offline, with the exception of its website and 911 emergency system.
"Everything we have is down," Sheriff Janis Mangum told StateScoop in an interview. "We are doing our bookings the way we used to do it before computers. We're operating by paper in terms of reports and arrest bookings. We've continued to function. It's just more ... Read More
Extortionists demand money even though no agreement made
Anyone who depends upon good public opinion can be vulnerable to orchestrated bad word-of-mouth, especially in the form of online reviews.
Podcasters are being targeted by extortionists who threaten to swamp their shows with negative reviews, according to Mark Asquith at Rebel Base Media. Asquith cites one recent case in which a scammer reached out to a podcaster on social media and offered to promote their show.
When the podcaster expressed interest, the scammer didn’t respond for several days. After that, the scammer sent a message informing the target that they’d been promoting the target’s podcast for the past few days. The scammer then demanded hundreds of dollars in payment for this supposed service. “No agreement had even been discussed, ... Read More
New Cybersecurity best practices
In December 2018, the Department of Health and Human Services (HHS) published the “Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients” publication. This new directive offers cybersecurity best practices that healthcare organizations of any size can implement. Originally posted by Fred Langston CISSP, CCSK at CI.Security.
I’ve been doing health industry cybersecurity for a long time, which has led to my involvement in helping to craft cybersecurity policy for the healthcare industry. One of my first experiences was back in 1996, when I was part of the working group that provided guidance on the proposed HIPAA Security Rule. That rule established certain standards for security moving forward. The resulting risk-based approach was meant to allow the vastly different types and sizes ... Read More
Water utilities are popular targets
It wasn't the first time the Fort Collins-Loveland Water District and its wastewater counterpart had been hit by "ransomware," a type of malware that encrypts victims' computer files and demands online payment to unlock them.While operations weren't harmed, the infection prompted the water district to switch out its information technology service provider and call in the FBI. The case, first reported by the Coloradoan, remains under active investigation. FCLWD and the South Fort Collins Sanitation District treat and distribute water to 45,000 customers in northern Colorado.Colorado water officials aren't alone in their cybersecurity woes. The nation's nearly 70,000 water and wastewater utilities are struggling to keep their heads above a rising tide of online threats, based on interviews with security experts ... Read More
Social engineering led to potential kidnapping
Social engineering and impersonation attacks can lead to far more dangerous consequences than monetary losses, according to Matt Devost from OODA LLC. Devost appeared on the CyberWire’s Hacking Humans Podcast last week, where he described the attacks he’s seen involving cybercriminals with fraudulent personas.
Devost described one case in which an attacker impersonated a broker and an investor to target a successful entrepreneur who was looking for funding for a new startup. Under the guise of the broker, the attacker introduced the target to the supposed investor. Now posing as the investor, the attacker conversed with the target about the company, and eventually asked the entrepreneur to fly to South America so they could meet.
“That individual is very, very close to ... Read More
Malicious links on otherwise honest web pages
Webroot revealed the results of their 2019 Threat Report, showing that tried-and-true attack methods are still going strong, but new threats emerge daily, and cybercrime is highly innovative. This includes adding malicious URLs (web page addresses) as links on legitimate sites.
Hal Lonas, Webroot's CTO said: “We wax poetic about innovation in the cybersecurity field, but you only have to take one look at the stats in this year’s report to know that the true innovators are the cybercriminals. They continue to find new ways to combine attack methods or compromise new and existing vectors for maximum results. My call to businesses today is to be aware, assess your risk, create a layered approach that protects multiple threat vectors and, ... Read More