Entrusted with the collection and storage of highly sensitive patient and physician data, companies operating in the healthcare space have a responsibility to be hypervigilant in their security and governance practices. Similarly, healthcare service providers must hold their partners and vendors to strict security standards as well. The fact that almost 900 million records were left exposed without even basic password protection or identity authentication requirements displays a concerning lack of security guardrails. Far too often databases are unknowingly left exposed, leaving confidential patient and physician data vulnerable to malicious threat actors. Although in this instance, ethical security researchers discovered the breach and the issue was remediated thereafter, in many cases bad actors are the first to find and exploit exposed data. In order to properly secure sensitive data, organizations must take the first step of cyber asset management to discover all cyber assets in their IT environment and understand connections between business services. This allows for comprehensive visibility and management of all data in an IT environment and the security measures in place, in real time.

Security of cloud data is critical to modern IT infrastructure. It is surprising to see the reported breach rate last year nearly approaching a coin flip probability. With the increasing rate of headline making cyber attacks, network administrators have a large burden to ensure that data interoperability and security are held to the highest standards. Organizations need to move quickly to improve their cyber security position and ensure they are investing in the talent pipeline necessary to improve these statistics.

We can see how federal regulators are pushing for improved security standards. It will be a matter of time for other industry pillars such as corporate insurance to demand standards in order to purchase cyber incident policies. In any case, we have the technology to find top talent even in a tight labor market. We need to grow the next generation of cybersecurity professionals or risk impacting market growth and prosperity under these lax standards.

The recent ransomware attack against Papua New Guinea's finance department is yet another reminder that no one is immune to being victimised as cyber criminals don't honor global boundaries and they usually carry out 'spray and pray' tactics, relying on mass email spam campaigns or malicious websites for attacks. Cybereason's advice is not to pay the ransom, rely on backups to return the networks to operation and to deploy a security strategy that includes EDR technology that will help put an end to successful ransomware attacks. Also, in some cases, you can't legally pay ransoms because it is funding terrorism and organised crime. It's not a good idea to ever pay unless the cost of doing so affects human life, public safety or is existential. Paying doesn't make the ransomware problem go away since nearly half don't recover data correctly, and it will become public anyway. Paying only defers some cost possibly and delays the time when it becomes public knowledge.

The attack on Papua New Guinea’s finance system goes to show that the attacker responsible has no regard for livelihood, especially when it may take weeks to restore or even incur huge restoration costs. Their sole goal is to obtain a payment, and sadly has chosen a target that is currently struggling to keep up with the implementation of secure cyber security infrastructure. While demanding ransom on a critical system would pressure the government to cave in to the demand, the attacker has failed to realize that the current target may not have the means to pay up the ransom (though the amount demanded is currently unknown). Instead, the attack may potentially trigger a larger effort from the industry or nations to help Papua New Guinea restore its system and perhaps even attributing the attacker.  

As defenders, this attack has helped us realize that more effort could be channelled to offer assistance to organizations or institutions that may not have cyber security as priority in building resiliency towards cyber attacks”.

Government organisations are often top targets for ransomware attacks due to the amount of personal and business data that they hold, which cyber criminals can steal and use for monetary gain. The recent news about the attack on the Papa New Guinea’s finance department is certainly a worry. The networks were exposed to bad actors who have now exploited the vulnerabilities to launch a ransomware attack. If the government continues to allow their networks to be exposed, other cyber criminals are likely to return and attack again, putting further pressure on the IT security teams. 

The consequences of attacks such as the breach on the Papua New Guinea finance department can have significant and devastating social impacts, particularly on those who depend on financial support. This attack in particular has caused delays to governments receiving access to foreign aid which has caused further disruption to sending vital support to those most in need. 

The finance department’s IT team will be working hard to determine the type of malware installed. Even in a short amount of time, the impact of a ransomware attack can cause significant damage to the systems. A ‘prevention-first’ mindset is key - attacks need to execute and run before they are picked up and checked to see if they are malicious, sometimes taking as long as 60 seconds or more, which is too to wait Organisations need to invest in solutions that use technology such as deep learning which can deliver a sub-20 millisecond response time to stop a ransomware attack, pre-execution, before it can take hold.

We continue to see ransomware as one of the most significant threats facing organizations of all kinds, all over the world today. This particular situation can be detrimental to the government of Papua New Guinea and its citizens because access to foreign aid money has been affected. 

We are seeing cybercriminals being more selective and purposeful in their targets. Hitting high profile targets, or organisations that can't withstand extended periods of downtime can become lucrative for criminals. 

It's encouraging to see that the ransom was not paid and that the department was able to recover their systems which is a good sign of having robust recovery processes in place. 

In many cases, ransomware infects organisations through unpatched software or through social engineering attacks like spearphishing. By putting in place controls to defend against these, organisations can greatly reduce the risk of being victims. 

The recent ransomware incident affecting Papua New Guinea’s finance department underscores a harsh reality that every governmental agency must confront: a ransomware attack isn’t just a remote possibility but rather a likely imminent event. Being able to shut down operations, encrypt critical operational data, and cause general mayhem in the delivery of governmental services are the main goals of the threat actors behind these attacks. Why? Putting organizations under a harsh public spotlight as these events unfold puts incredible pressure on them to pay a ransom as the most expedient mitigating tactic.

A better course of action other than relying on paying a ransom is to prepare for this eventuality with robust recovery capabilities (tools and processes) combined with proactive data-centric protection. The former restores the IT and data environment to a pre-breach state, while the latter ensures that threat actors can’t exfiltrate sensitive data and use that compromised information as further leverage. Data-centric security methods such as tokenization and format-preserving encryption protect the data itself rather than the environment around it. Even if hackers get their hands on data, they can’t blackmail organizations with the threat of imminent release of that data. And that’s what ransomware is all about—blackmail. Don’t let that happen to your organization. Accept the eventuality and prepare accordingly.

As today’s enterprises increasingly turn to application programming interfaces (APIs) to enhance user experience and drive innovation, they often overlook the need to protect these services with fine-grained authorization and consent. In this case, the exposed data was more than enough for cybercriminals to launch highly targeted phishing attacks against the impacted users. Any organization responsible for consumers’ personally identifiable information (PII) must prioritize implementing proper security guardrails to mitigate data leakage and exposure risks. Enforcing context-based granular authorization on all APIs and externalizing it from the API code prevents hackers from attacking flaws that expose sensitive personal information and ensures authorization and consent safeguards cover all users.

Most of the modern web applications have serious vulnerabilities in their APIs and web services. Some vulnerabilities allow executing remote code and taking full control of the remote system. Such security flaws are usually undetectable by automated scanning tools due to their exploitation complexity. Few software developers have the requisite security skills to make complex cross-application eco-systems secure, while usage of a multi-cloud environment and containers boosts complexity and exacerbates the situation.

This specific incident may trigger serious legal ramifications under GDPR, moreover, the unreasonably long period to fix a fairly simple flaw will likely cause a higher fine if competent DPA decides to impose monetary penalties. The sensitive nature of the exposed data, if misappropriated by cybercriminals, can foster targeted phishing campaigns, identity theft and financial fraud.

All companies that operate large web systems, that handle personal or other types of regulated data, should consider implementing a Secure-SDLC program that would include, among other things, continuous security monitoring and regulation penetration testing. Systems like WAF or RASP can be used to timely detect and prevent exploitation of vulnerabilities while developers are working on patches.

APIs provide easy interfaces between applications, enabling the exchange of data and flow of information. As such, APIs are a convenience that modern application ecosystems cannot do without. Unfortunately, the API flaw discovered within Scoolio many have inadvertently exposed the sensitive data of thousands of users. The incident reveals that human error—whether misconfigurations during deployment and operations, or bugs and flaws during design and development—all too often fuels breaches in data privacy.

Software development organizations are encouraged to maintain rapid and highly agile cadences, meaning that they develop working code quickly throughout shorter cycles in order to meet minimum functional requirements, then flex and adapt according to dynamic user demands. Refinement of functioning software comes in subsequent iterations of the code. Nobody wants development teams to work more slowly, but at the same time cadence cannot be maintained at the expense of proper security design and testing. The Scoolio incident should encourage every software development organization and team to move security from an overlay function at the tail end of the development cycle to a critical component of the initial design and planning phase.

API Security is still not as mainstream as web application security. Although the technologies are very similar and convergence is underway, the challenge is both in tooling and approach.

The majority of web security tooling is not suited to easily and adequately test API’s for security issues - this is certainly part of the problem, inadequate security assurance within the API development lifecycle.

Encryption of the leaked data is irrelevant assuming the exposure was via the API, and even if it was encrypted an injection attack against the API would decrypt the data the same as a legitimate request.

Continuous security testing has become the standard to help pick up such weaknesses. What is also important to note is that if the vulnerability was a “logical weakness” as opposed to the “technical weakness” security tooling generally would not discover such an issue. Logical weaknesses take human intelligence to discover, a shortfall of an entirely automated approach to cyber security.

Despite having enterprise cybersecurity budgets, financial services organizations are, like all organizations, vulnerable to phishing attacks because no solution blocks 100% of phishing emails. The moment an email is blocked, a hacker is making adjustments to increase their chances of success on the next try.

Sophisticated groups like EvilCorp know their targets, and they know what is protecting them: the security infrastructure that is in place, including email security. Many email security solutions are even visible in a simple MX query. This gives the hacker an advantage. When they know what they are up against, they can find a way to reverse engineer the solution and breakthrough.

When an email does slip through, even a trained user can mistake a highly sophisticated phishing email for a legitimate email. The OneDrive and SharePoint links in the MirrorBlast campaign add an air of legitimacy to the emails, and the use of a redirect from a legitimate service confuses the email filter.

It ultimately comes down to two things: invisibility and user training. Your security stack should not be visible to cybercriminals--they will learn how to exploit them, and your users must be trained on the latest threats--not once or twice a year but continually and particularly after they have made the mistake of engaging with a malicious email.

  Read Less

Although there is a frustration for people who feel they are constantly having to upgrade their phones, it is important to innovate and push security updates which can often mean stopping supporting apps on older phone models.  

In an ideal world security updates would go on forever, but the complexity of operating systems and apps involved would require constant ongoing support which soon becomes an impossible task. Developers have long struggled to keep their apps secure across multiple devices but when older phones are thrown into the mix it makes this security far more difficult.  

Malicious actors are continually targeting older phone and the protection of these devices is paramount. Using older, out of date devices causes a severe risk to your phone and data so it is vital they are updated to the latest security patches and all apps are up to date. Once such security updates are no longer available, the device instantly becomes a risk and should be used cautiously.

This attack doesn’t come as a huge surprise, Telco’s have been the target of cybercriminals for many years with the aim usually being to defraud the customer, and these kind of attacks have only increased during the disruption bought about by the pandemic. Hackers have benefited as many businesses frantically switched their focused from security to survival, and over the past two years we have seen attackers start to operate more like a businesses, diversifying as opportunities arise.  

For every barrier a business puts in the way they should expect to see a new evolution of attacks as a result, highlighted by the growth in ransomware and increase in businesses being held to ransom in unique ways. Unfortunately for businesses, it means they cannot get complacent and need to constantly understand and analyse where their security weak points are in order to address where and how they could be targeted. With companies now facing advanced and persistent threats, they need to start thinking like a hacker and learning how to reduce the chance of compromise and disruption through security and resilience.

There is no shortage of compromised devices out there (desktops, laptops, tablets, mobiles, etc.). These compromised devices are often pooled to form bot networks (or botnets for short). Attackers take advantage of this situation by either controlling large botnets or buying access to them. Once the attackers have a massive botnet at their disposal, they can decide to turn it against their next victim or victims in an instant.

This week, UK VoIP providers are the latest victims, as attackers decided to turn their armies of bots against them. Unfortunately, there is little organisations can do to stop the compromised devices themselves. Instead, businesses should focus on what they can do within the figurative walls of their virtual enterprise to protect themselves from these (and other) attacks. In other words, compromised devices and botnets are here to stay. DDoS protection and protection from other types of attacks (including bot attacks), however, has improved. Modern DDoS protection is now quite advanced. Solutions can include multi-layered defences that protect against blended network attacks and sophisticated application attacks – all while enabling full SSL decryption, anti-bot capabilities, and advanced detection methods.

It’s very naive to dismiss DDoS as an unsophisticated attack vector. Like most criminal methodologies it has evolved over time into a very useful tool for cybercriminals. It’s often a vehicle for distraction whilst other data breach activity takes place but is equally useful as a Ransomware technique. Ransomware relies on the inaccessibility of data and, whilst commonly achieved by network infiltration and encryption, denying access is equally effective albeit for a shorter period of time. The VoIP service providers currently under attack have clearly taken the best approach by informing and liaising with the relevant authorities. Whilst it may take some time to resolve the issue, their customers should be patient and observant, follow any advice provided, and be confident that this approach will make the sector a much less attractive target in the future.

The problem here is that “DNS Attacks” are so extremely vaguely defined, and other terms are also used rather carelessly. Looking to for example organizations that have been subjected to an attack with malware or phishing, the numbers are not close to 100% which they would if they represented who had actually been attacked, those responding here must have been subjected to successful attacks.

DNS Attacks” then include DNS amplification attacks, a method used for abuse on other DNS servers to target an organization in a DDOS attack – this is a DDOS attack based on DNS and not related to any of the scenarios described in the text. In all essence, secure changes to your DNS. Ensure you have a rock-solid infrastructure for it. Ensure to track your domains and sunset them with care if you discontinue something. But note that grouping all those attacks as “DNS attacks” is deceptive and the treatments for the different risks spread, similarly for the narrative and creation of big numbers, terms such as “Network attacks” could carelessly be used and would hence group even more attacks under the same umbrella.

  Read Less