Expert(s):
Senior Vice Presidentfeature_status*/ ?>
comforte AG

Comments Dotted : 14
April 20, 2021

Data Security Expert Comment On Geico Admits Fraudsters Stole Customers’ Driver’s License Numbers For Months
Personal data is pervasive across the insurance supply chain, and at risk of compromise.

Insurance companies deal with more sensitive data than many other financial firms, including data acquired from quoting new prospects, handling multi-party claims, and deep risk analytics. Consequently, personal data is pervasive across the insurance supply chain, and at risk of compromise if not protected end-to-end from agents through operational claims platforms and on to corporate risk analytic platforms with modern data-centric approaches as used by leading insurance firms. Driver’s

.....Read More

Insurance companies deal with more sensitive data than many other financial firms, including data acquired from quoting new prospects, handling multi-party claims, and deep risk analytics. Consequently, personal data is pervasive across the insurance supply chain, and at risk of compromise if not protected end-to-end from agents through operational claims platforms and on to corporate risk analytic platforms with modern data-centric approaches as used by leading insurance firms. Driver’s license data is particularly sensitive and its disclosure may result in fraudulent insurance or a line of credit, significantly impacting consumer trust for affected individuals. While it’s not clear yet how this data was leaked, the breach shows that even industry leaders can succumb to data compromise from gaps in data-security effectiveness leading to breach notification.

  Read Less
April 02, 2021

Italian Menswear Brand Loses Corp Data in Ransomware Attack – Expert Comments
Organizations must mitigate ransomware risk through constant backup to ensure data can be restored rapidly if it is locked.

Ransomware attacks are the new great digital train robbery, stealing data and crippling business through a constantly evolving attack ecosystem and malware that can evade perimeter controls.

 

Organizations must mitigate ransomware risk through constant backup to ensure data can be restored rapidly if it is locked, and also utilize proven data-centric security to foil the attack itself. If data is neutralized using modern data-centric techniques that enable data use in the enterprise while

.....Read More

Ransomware attacks are the new great digital train robbery, stealing data and crippling business through a constantly evolving attack ecosystem and malware that can evade perimeter controls.

 

Organizations must mitigate ransomware risk through constant backup to ensure data can be restored rapidly if it is locked, and also utilize proven data-centric security to foil the attack itself. If data is neutralized using modern data-centric techniques that enable data use in the enterprise while protected while restricting access to the minimum live data, attackers will get the equivalent of digital coal, not data gold, and soon move on to the next vulnerable target. For the enterprise, this avoids the impact of a data breach and financial demand at the same time.

  Read Less
March 11, 2021

Experts Reaction On Verkada Hack Affecting 150,000 Of Its Security Cameras
The new generation of high-tech growth innovators born in the cloud.

The new generation of high-tech growth innovators born in the cloud and disrupting industry can’t rely on more only traditional security approaches based on perimeter controls, container or transit encryption, especially given the backdrop of increasingly complex data privacy regulations. One of the challenges is that while cloud backbones provide the basic container and pipe data security, gaps in data lifecycle protection can result in exploits, accidents or unauthorized access, especially

.....Read More

The new generation of high-tech growth innovators born in the cloud and disrupting industry can’t rely on more only traditional security approaches based on perimeter controls, container or transit encryption, especially given the backdrop of increasingly complex data privacy regulations. One of the challenges is that while cloud backbones provide the basic container and pipe data security, gaps in data lifecycle protection can result in exploits, accidents or unauthorized access, especially as data is moved from operational platforms to data engineering analytics systems.

 

In this breach, it’s been reported that both video as well as personal financial data was compromised. So whether its digital data, or personal data, every company processing, using and storing personal or personal identity-related data has to think about a modern data-centric approach to secure it comprehensively well beyond the reach of traditional controls which were evaded in this compromise.

  Read Less
March 10, 2021

Cybersecurity Expert Insight: SITA Data Breach
Central airline management systems are attractive targets for attackers.

Central airline management systems are attractive targets for attackers. Data has to persist for booking management over long periods of time, and the trove of personal data can be extensive spanning financial data, identity, reservations, passports as well as travel history data. Given global travel data’s very nature, it also falls under a myriad of  privacy and data security regulations from GDPR to CCPA and beyond. For this reason, it’s precisely the kind of data that should be

.....Read More

Central airline management systems are attractive targets for attackers. Data has to persist for booking management over long periods of time, and the trove of personal data can be extensive spanning financial data, identity, reservations, passports as well as travel history data. Given global travel data’s very nature, it also falls under a myriad of  privacy and data security regulations from GDPR to CCPA and beyond. For this reason, it’s precisely the kind of data that should be protected with modern data tokenization technology to reduce its exposure to compromise, and only make it available when absolutely necessary.

  Read Less
February 05, 2021

New Malware Hijacks Kubernetes Clusters To Mine Monero – Experts Insight
Kubernetes is extremely powerful and a new foundation of IT strategy.

Kubernetes is extremely powerful and a new foundation of IT strategy, but not immune from malware, vulnerability and exploitation. Indeed, the dynamics, agility and scale that make it attractive to run scaled workloads at a moment’s notice also make it an attractive target for exploitation. While many attacks to date have focused on cryptomining, with the growing utilization of Kubernetes across industry, it will continue to be a focus of attack. The nature of this malware evidences that

.....Read More

Kubernetes is extremely powerful and a new foundation of IT strategy, but not immune from malware, vulnerability and exploitation. Indeed, the dynamics, agility and scale that make it attractive to run scaled workloads at a moment’s notice also make it an attractive target for exploitation. While many attacks to date have focused on cryptomining, with the growing utilization of Kubernetes across industry, it will continue to be a focus of attack. The nature of this malware evidences that managing risk when running kubernetes applications has to go beyond dependence on the bare minimum infrastructure level controls like TLS and container encryption, and shift to data-centric security for sensitive personal data. This has proven highly effective over the last decade, with new techniques like stateless data tokenization taking strategic prominence with industry leading enterprises. The good news is this available for cloud-native/kubernetes ecosystems today and ready to mitigate threats while letting enterprises get on with digital transformation at full throttle without breach risks getting in the way.

  Read Less
January 07, 2021

Security Experts Insight On Nissan Source Code Leaked
onnected systems at the edge, including automotive components, are not always simple to update at a firmware level.

Modern connected cars with convenient features like remote unlock, remote start require at least a 4 digit PIN to do it and strong authentication to use them. It’s curious then why the alleged source code repository for the backend and front-end for this technology wasn’t protected with an equally bare minimum security method. This is a classic example of the security being only as good as the weakest link – most likely in this case down to both human error and lack of process for risk

.....Read More

Modern connected cars with convenient features like remote unlock, remote start require at least a 4 digit PIN to do it and strong authentication to use them. It’s curious then why the alleged source code repository for the backend and front-end for this technology wasn’t protected with an equally bare minimum security method. This is a classic example of the security being only as good as the weakest link – most likely in this case down to both human error and lack of process for risk scanning of critical infrastructure for vulnerable credentials and effective data security”.

The recent Solarwinds situation should have prompted organisations across industry to be revisit their supply chain security, data security and authentication as a matter of priority – including any internet facing or cloud components. Access to code for potential core IoT/connected car applications opens up a raft of potential vulnerability exploits for attackers, if the claims of the full source code dump circulating on twitter are indeed true. Connected systems at the edge, including automotive components, are not always simple to update at a firmware level to address new threats, requiring dealership processes. This means any discovered exploits such as vulnerable TCP/IP stacks, credential management and offline authentication methods in the connected path to the vehicle’s bevvy of connected devices may indeed become targets for attacker analysis and compromise, made easier with access to source code.

  Read Less
December 11, 2020

Payments Processor TSYS Ransomware Attack – Expert Comment
Data processors and payment organizations at the heart of entire industries are always on the radar of attackers.
Data processors and payment organizations at the heart of entire industries are always on the radar of attackers. The high volumes of third-party data make them very attractive – both for the data they handle themselves and the data they have been entrusted with. Historically, they have also been entities where an attack to the administrative side has led to subsequent and secondary breaches of core processing platforms from attackers using data in emails, files, and databases. While so.....Read More
Data processors and payment organizations at the heart of entire industries are always on the radar of attackers. The high volumes of third-party data make them very attractive – both for the data they handle themselves and the data they have been entrusted with. Historically, they have also been entities where an attack to the administrative side has led to subsequent and secondary breaches of core processing platforms from attackers using data in emails, files, and databases. While so far, the good news is the core processing systems have not been impacted, likely from a modern data-centric approach to protecting it that’s common in leading payment processors, the bottom line is that this sends a clear reminder to any organization in the scaled data collection and processing business to ensure data security is implemented end-to-end, or made a top priority for the next year as we collect, store and process more sensitive data than ever. Privacy and security regulations are clearly motivation, but having gigabytes of sensitive data leaked can quickly morph into an uncontainable nightmare with equally uncontained cost impact without it.  Read Less
December 02, 2020

Expert Insight: Docker Malware Is Now Common – Devs Need To React Accordingly
To thwart the variations of malware and attacks from misconfiguration or API exploitation, a data-centric approach is vital.
Platforms like Kubernetes enable immense application delivery power. However, the built-in security controls reflect classical data-at-rest and transport encryption, perimeter, and access control based security. While these controls are important, the last decade has seen leading enterprises and data processors shift towards data-centric over perimeter controls to combat advanced malware, ransomware, and insider risk to sensitive data. Fundamentally, to thwart the variations of malware and.....Read More
Platforms like Kubernetes enable immense application delivery power. However, the built-in security controls reflect classical data-at-rest and transport encryption, perimeter, and access control based security. While these controls are important, the last decade has seen leading enterprises and data processors shift towards data-centric over perimeter controls to combat advanced malware, ransomware, and insider risk to sensitive data. Fundamentally, to thwart the variations of malware and attacks from misconfiguration or API exploitation, a data-centric approach is vital even with advanced container and app orchestration ecosystems to avoid data compromise or attacks that can create havoc for data-hungry enterprises depending on them.  Read Less
November 20, 2020

Experts On New Grelos Skimmer Variant Reveals Overlap in Magecart Activities
The online retail industry can expect to see increasingly obfuscated variants of the magecart skimmers.
The shift to increasingly online merchant transformation as a result of the pandemic combined with consumers embracing potentially new retailers for out-of-stock items as we enter the holiday season creates the dual-edge sword of retail business growth and increased attack opportunity for criminal groups. The online retail industry can expect to see increasingly obfuscated variants of the magecart skimmers that steal data on web form entry along with more deeply penetrating malware and.....Read More
The shift to increasingly online merchant transformation as a result of the pandemic combined with consumers embracing potentially new retailers for out-of-stock items as we enter the holiday season creates the dual-edge sword of retail business growth and increased attack opportunity for criminal groups. The online retail industry can expect to see increasingly obfuscated variants of the magecart skimmers that steal data on web form entry along with more deeply penetrating malware and ransomware to attack and disrupt the merchant data supply-chain to steal PII, financial, and credit card data. The solution has to be the one-two punch of integrity checking on web sites on a continuous basis to knock out rogue javascript injection, and end to end data protection beyond the web front-end using proven technology including tokenization to render sensitive data useless at the earliest capture point. This potent combination will mitigate these threats and disrupt the attackers own theft-to-darkweb retail business.  Read Less
October 20, 2020

What Experts Say On EU Investigating Instagram Over Child Data Violations
Vendors have the utmost responsibility for compliance and transparency.
For obvious reasons, children’s data collection and protection have very specific handling in many jurisdictions and called out in GDPR very specifically. While a data protection regulator is no substitute for parenting and education to ensure children begin to understand how their data is eventually used, vendors have the utmost responsibility for compliance and transparency. In GDPR Article 8, the consent requirements, age limitations, and responsibilities are very clear, especially around.....Read More
For obvious reasons, children’s data collection and protection have very specific handling in many jurisdictions and called out in GDPR very specifically. While a data protection regulator is no substitute for parenting and education to ensure children begin to understand how their data is eventually used, vendors have the utmost responsibility for compliance and transparency. In GDPR Article 8, the consent requirements, age limitations, and responsibilities are very clear, especially around consent. The fact that a data scientist has discovered trivial data exposure of what appears to be vulnerable minors in data collection applications is alarming if true. This is especially a concern given that it is also equally simple these days to de-identify, mask, or secure it and thus there are few excuses not to comply. In a world of attacks, data theft, and misuse, privacy and security has to be a first priority, especially the data of our next generation’s citizens.  Read Less