DataVisor powers insight into fraud and abuse patterns for enterprise and mobile customers

DataVisor introduced new functionality with its 2018 Fall release to improve customers’ ability to gain insight into the fraud and abuse impacting their business.

Fraud continues to have a bottom-line impact for both businesses and their customers. A TransUnion report in March found that synthetic fraud balances grew by 6.6% to $885.42 million in Q4 2017. This alarming trend demands better tracking and detection of fraud patterns that allow companies to take action before they cause damage to their bottom line and reputation.

“Fraud prevention continues to be reactionary, relying on knowledge from historic fraud patterns. Fraudsters are more nimble – they evolve their techniques faster than organizations can update their fraud tools. Organizations need to re-think their fraud strategy, recognizing and understanding emerging patterns so they can stay ahead of the fraudsters. This is exactly what our new capabilities enable,” said DataVisor CEO and co-founder Yinglian Xie.

The DataVisor Threat Insights Dashboard features charts and visualizations that give customers insight into fraud trends and connections across their user accounts. Driven by DataVisor’s Unsupervised Machine Learning Engine that detects attacks, this new dashboard enables customers to gain a real-time understanding of emerging fraud patterns.

The dashboard highlights the attacks and trends with key stats such as number of malicious accounts and events. Fully configurable, it enables users to select from a library of charts and drill down on fraud patterns by attack category, geography, activity type and more.

In addition, customers can now view the history for malicious accounts including the fraud group or rule that triggered the detection, making results transparent for internal and external compliance. Daily tracking of new malicious accounts enables users to monitor how attacks grow and evolve over time.

Other new DataVisor features include Enhanced Fraud Reporting, which enables users to configure scheduled or on-demand reports with options such as attribute selection, filters and alerts for flexibility when using DataVisor fraud reports.

DataVisor also augmented its fraud detection algorithm for clients with mobile user acquisition needs. The DataVisor Click Fraud Detection Engine incorporates ad click data for identification of click-initiated fraud including click spamming, click injection and more.

Media Source and Publisher Analytics allow customers to slice and dice their KPIs such as install volume, fraud rate and retention rate using key dimensions, in order to enable purchasing and targeting decisions.

“We have to take the fight to the fraudsters. Today’s fraud experts have to adapt to new types of fraud and fraud attacks that have never been seen before,” said DataVisor’s Xie. “With the DataVisor Threat Insights Dashboard along with our other enhancements, customers can gain actionable insights to play offense instead of defense.”

from Help Net Security https://ift.tt/2Qb557F

Comodo launches Dome Shield Platinum to secure and control Internet access

Comodo Dome Shield Platinum, the cloud-delivered, DNS-based SaaS solution allows organizations to protect users’ digital presence by blocking access to harmful websites that other measures do not recognize as dangerous. The solution implements a configurable web filter to check the content and reputation of sites per company IT policy based on both safety and appropriateness.

The new Platinum version extends the current Comodo Dome Shield, deployed and validating 2.5 billion user DNS requests every day to regulate and secure their web access, blocking 1.2 million attack attempts daily. The product protects against a range of threats and attacks, such as phishing, bots and botnets, command-and-control servers, spyware and spam.

The Comodo Dome Shield Platinum additionally lets businesses protect all internet-connected devices, with deployment across any size infrastructure, from a global enterprise to a small business, deploying in under two minutes, both in the office or on the go.

Comodo Dome Shield Platinum accommodates configurations based on internal IP addresses, subnet, IP address block and site-based web filtering, supports threat policies, and provides IP-based visibility and monitoring. Moreover, the Comodo solution is capable of bypassing internal domain resolution and corporate DNS servers with the option of encrypting all DNS traffic.

“Comodo created the Dome Shield solution by listening to real-world user needs, as well as requirements from MSPs and channel partners,” noted Bulut Akisik, Comodo Dome Shield product manager.

“These organizations consume their IT budgets attempting to regulate employee web browsing and stopping web-borne attacks, in complex multi-office network environments, for roaming users and BYOD, and for the gamut of connected devices. For these and myriad other configurations, Comodo Dome Shield Platinum offers visibility, control and protection with rapid deployment and the lowest TCO.”

End-user and cybersecurity product tester, Robin Toy of UK-based StrobeIT, echoes Akisik, stating “Comodo Dome Shield just works.”

Key features of the Comodo Dome Shield Platinum include:

• Visibility and protection anywhere on any device. Deliver web filtering and protection to any type of internet-connected device: desktops, netbooks, tablets, mobile phones, appliances, IoT devices,
• Web access control and filtering. Block websites by category (86 pre-defined) and by creating blacklists and whitelists per user, by networks, across company sites and locations, for mobile devices and roaming laptops. Gain visibility into every website visit occurring on your network,
• Protection against web-based threats. Leverage Comodo Threat Intelligence, which protects 600,000 businesses and 85 million endpoints worldwide Encrypted DNS traffic. Stop prying eyes from your observing DNS traffic with network-wide DNScrypt encryption,
• Off-network protection. Secure users, even on the road, with endpoint agents for roaming laptops, and via mobile apps for iOS and Android,
• Secure browsing. Restrict web browsing based on site category and security policies,
• Faster internet with Anycast DNS. Comodo Dome Shield offers organizations faster internet access by resolving domain names with Comodo Anycast DNS, located near the main hubs of internet,
• Multi-office protection. Secure and control all your sites from a single pane of glass.

MSPs also benefit from the low total cost of ownership afforded by Comodo Dome Shield and can attract new business by bringing security-related services to customers. Comodo Dome Shield DNS filtering not only delivers malware protection to MSP customers, it provides an opportunity to expand product portfolios. That’s why more than 10,000 MSPs use Comodo Dome DNS filtering for web access controls and protection against web-borne threats to customers of all sizes.

Comodo Dome Shield legacy customers and new ones using free Comodo Dome Shield Gold, can issue up to 300,000 DNS requests per month. Beyond that ceiling, an upgrade to Comodo Dome Shield Platinum is required.

from Help Net Security https://ift.tt/2qlC6Th

IKARUS Security Software partners with PolySwarm to advance early malware detection

PolySwarm partners with IKARUS Security Software to advance its early malware detection capabilities. IKARUS will assist PolySwarm in its efforts to expand its network of antivirus vendors and developers by uploading IKARUS’ engine into Polyswarm’s marketplace.

“The way PolySwarm compensates security companies for successfully detecting potential threats will pave the way to a new era in threat detection,” said Mario Bono, head of the malware lab at IKARUS. “The ability to access a vast stream of new malware samples that improve our products coupled with the ability to generate passive income is what drew us to PolySwarm’s marketplace.”

“IKARUS is a world leader in reinforcing and defending against malware, as it invests around 65 percent of the total turnover in software research and development in this space,” said PolySwarm CEO Steve Bassi. “Their commitment to continually finding new approaches and solutions to protect against the explosive growth of threats will help broaden our ability to identify issues across an ever-growing network of internet-connected devices.”

from Help Net Security https://ift.tt/2P6pSgg

WindTalker launches cloud-based content security technology

WindTalker launched its cloud-based content security software with an initial focus on the legal sector. The WindTalker platform allows attorneys and business professionals to protect a document’s text and image content. WindTalker solves the four key challenges that organizations struggle to manage: “Need-To-Know” access to sensitive information, unrestricted information sharing, a user-friendly application, and user awareness of sensitive information.

WindTalker scales to suit organizations of all sizes and is designed for use by law firms, corporations, government agencies, and any entity which needs to protect sensitive or privileged information. The software classifies, encrypts, redacts, and labels sensitive content within documents. WindTalker delivers control, protection, and compartmentalized access via permissions.

Law firms and corporate legal departments can leverage WindTalker to secure documents for corporate, transactional, and litigation matters. Corporations can protect documents containing confidential text and images related to intellectual property/R&D, human resources, financial, and executive privilege. Government agencies need WindTalker to protect confidential information that is not subject to public disclosure.

According to Marc Colin, Managing Partner of Denver-based Bruno, Colin & Lowe, P.C. law firm: “Bruno, Colin & Lowe is committed to providing optimal security and risk management for our firm and its clients. WindTalker provides us with the tools we need to protect and securely share sensitive information both internally and externally. In fact, WindTalker has quickly become a cornerstone of our client data protection and our digital transformation programs and it is so important that we are recommending WindTalker to our clients.”

Christopher Combs, President of CEO of WindTalker, said: “Information security breaches are more prevalent than ever, and WindTalker effectively solves the problem of securing sensitive content within a document. WindTalker increases productivity and saves time and money by streamlining workflow. We have already successfully installed WindTalker at several client sites, and our robust sales pipeline confirms that we are introducing the right product at the right time. WindTalker’s applications are infinite, and its potential is unlimited.”

from Help Net Security https://ift.tt/2RtTPUe

Car Thieves Love to Strike on Halloween

The 10 Best Deals of October 31, 2018

The Most Common Voting Scams—and How to Get Around Them

Kitchen Tools You May Not Realize You Need for Thanksgiving

Apple's New Macs Use '100 Percent Recycled Aluminum,' But What Does That Mean?

This $21 Remington Is Designed Specifically For Self-Haircuts

Oh Come On, Apple Could Have Made the 'New' MacBook Air Years Ago

How to Block Ads and In-App Purchases From Your Kid's Apps

How Spotify Family Plan Subscribers Can Get a Free Google Home Mini

Find Your Polling Place Using This Hall & Oates Hotline

Do It All With This 12-Tool Gerber Multi-Plier For Just $24

Was the Triton Malware Attack Russian in Origin?

How To Play Long Video Games When You Have No Time

Spooky miasmic gas bricks hospital iPhones (mwah ha ha ha)

Earlier this month, an IT admin at Morris Hospital near Chicago started receiving complaints that dozens of staff iPads, iPhones, and Apple Watches had suddenly stopped working.

That’s an unusual failure rate for a single building but what made it odder was that non-Apple devices seemed to be working fine.

As the admin, identified by iFixit as systems specialist Erik Wooldridge, wrote in a subsequent Reddit post:

This is probably the most bizarre issue I’ve had in my career in IT.

One explanation was the installation of a new Magnetic Resonance Imaging (MRI) scanner, the testing on which had commenced just before the devices went wrong.

My immediate thought was that the MRI must have emitted some sort of EMP [electro-magnetic pulse], in which case we could be in a lot of trouble.

Possible in theory, but such a pulse would surely have affected numerous devices and not only those made by Apple.

No laughing matter

Almost all the affected Apple devices appeared to be dead or, if working, behaving very erratically. After consulting with the MRI maker GE, an unexpected suspect emerged – helium.

Helium?

MRI machines use the gas (He) in liquid form to super-cool the superconductive magnetic coils that become extremely hot when the machine is used.

During the test phase for the new MRI, 120 litres had reportedly leaked over a five-hour period, expanding 750-fold as it seeped through the hospital. Added Wooldridge:

The MRI room is not on an isolated HVAC loop, so it shares air with most or all of the facility.

That’s a lot of helium – roughly 90,000 m³.

It doesn’t sound like a silent iPhone killer, but the otherwise inert gas apparently can do nasty things to tiny MEMS (microelectromechanical systems) sensors used in mobile devices to enable motion-sensing gyroscopes.

That still doesn’t explain why only Apple devices were affected. The best hypothesis (assuming it isn’t a hoax) is that Apple uses a particular MEMS that isn’t as well sealed as those in use by other equipment makers.

A scrap of evidence supporting this: the hospital’s single iPhone 5 was unaffected – downed devices were all from the iPhone 6 and later which might be using a different MEMs.

Or perhaps, iFixit has speculated, helium caused problems for the device’s system clock built around quartz oscillation.

These are central to all microelectronics and generate the frequency used to synchronise numerous internal components with one another. No working internal clock, no working computer.

This seems like a more likely cause of the problems and when iFixit tested an iPhone 8 in the presence of helium found that it shut off within minutes.

Lending credibility to the account of the incident, Apple even warns of the effects of helium in its user guide, something precisely nobody would ever assume applied to them.

Exposing iPhone to environments having high concentrations of industrial chemicals, including near evaporating liquified gasses such as helium, may damage or impair iPhone functionality. Obey all signs and instructions.

Once again, this doesn’t explain why only Apple devices seem to have been affected. Nor is it clear that the volume of liquid helium leaked from the MRI would be sufficient to cause the reported problems. It’s a mystery.

Smartphone makers expend a lot of marketing effort to convince buyers that their expensive devices are waterproof and resistant to scratches.

Perhaps in future helium resistance should be added to the features list.

Follow @JohnEDunn
Follow @NakedSecurity

from Naked Security https://ift.tt/2yIOjpx

Make Better Pumpkin Seeds by Brining Them in Beer

Here's the Best Way to Feed a Cat

Buy Yourself a New Year's Eve Outfit Tomorrow

Wednesday's Best Deals: Noise Canceling Headphones, Levi's, Foam Rollers, and More

Endgame introduces Total Attack Lookback for incident review

Endgame has made critical threat intelligence data available to all customers free of charge through Total Attack Lookback – the forensic review feature to exceed average adversary dwell time. Endgame Total Attack Lookback provides a record of operating system events, to ensure assessment of the origin and extent of an attack, meet notification requirements, and minimize exposure to compliance and regulatory violations.

“At Endgame, my team focuses every day on the earliest possible prevention; however, there is a much larger and richer story to be told to understand all the behavior of the adversary. Total Attack Lookback tells that story. When you combine Endgame’s data retention with Endgame Artemis, I believe you get the most robust and accessible EDR capability in the market,” says Jamie Butler, Chief Technology Officer at Endgame.

Why 120 days?

According to the 2018 SANS Threat Hunting Survey, average adversary dwell time within an organization’s network exceeds 90 days, increasing the potential for damage and loss.

Endgame collects and stores a range of operating system events including process, file, and network events for up to 120 days, capturing all activity, and identifying the complete attack path, including all affected users and assets.

Automated investigations

The Endgame user interface includes three technologies to automate investigations across the Endgame event store, at scale.

• Artemis, the natural language understanding (NLU) chatbot that enables tier one analysts or security mangers to investigate incidents, triage, hunt and respond to threats in plain English.
• Resolver, Endgame’s visualization technology, provides a view into the entire attack, correlating all security events in the timeline and enabling users to interact, investigate, and respond using a graphical user experience.
• EQL, Endgame’s event query language provides investigators and analysts with a scripting interface to hunt for and identify suspicious activity across Endgame’s event data, using the Artemis chat interface.

Endgame’s multi-tier architecture ensures investigations scale to the largest enterprises, and include disconnected endpoints, while ensuring privacy across geographies with the lowest impact on resources.

from Help Net Security https://ift.tt/2RrgYX3

Bricata delivers improved threat hunting with enhanced network metadata

Bricata’s latest update provides security teams with flexibility to control the breadth and depth of the network metadata they want to capture – and to customize the ways they want to view it. This expands how security analysts inspect, investigate and hunt for threats in network metadata, which accelerates incident resolution.

“This is another enhancement to Bricata’s advanced network threat hunting capabilities that makes it accessible to experts and novices alike,” said Bricata CEO John Trauth. “We’ve greatly expanded the scope of the rich network metadata to provide more granular detail without sacrificing the scalability, flexibility and ease-of-use our customers have come to expect in our solution.”

The improvements to data collection tunability and scalability are coupled with improvements to the user interface. For example, the new version of the solution comes with usability enhancements that let users define views of the metadata that suits their purposes. In other words, the Bricata views self-adjust in alignment with the metadata the team has configured for collection.

“It’s really tailoring the experience to let the analyst do threat hunting the way they want to,” added Trauth. “This is part of our overall goal to deliver a modern network security tool that both scales for the largest enterprises but flexes to meet the specific needs and requirements of users and their environments.”

One of the many things that sets Bricata apart from other cybersecurity tools is that it employs multiple threat detection technologies on its platform. This includes signature detection, anomaly detection, and artificial intelligence to screen for zero-day malware. The improved metadata supports user-defined anomaly detection scripts and will serve as a foundation for future Bricata threat detection methods.

Earlier capabilities released this year have included support for the cloud; a new dashboard for better alert triage; and smart packet capture (PCAP) with backtesting, which scans previously captured PCAPs against new global threat intelligence signatures to detect threats that slipped by at the time of capture before a threat signature was available.

from Help Net Security https://www.helpnetsecurity.com/2018/10/31/bricata-enhancements/

Tripwire IP360 re-certified to meet Common Criteria certification standards

Tripwire’s latest version of its vulnerability management solution, Tripwire IP360, v9.0.1, has achieved Common Criteria Evaluation Assurance Level 2 augmented with Flaw Remediation (EAL2+).

Internationally recognized as the evaluation standard for IT security products, Common Criteria certifications provide independent assurance to government and commercial agencies that the products being purchased satisfy security requirements for information systems.

“Tripwire IP360 has a long history of enabling governments to accurately prioritize risk and take action on their most exposed assets,” said Mitchell Jukanovich, vice president of federal at Tripwire. “Achieving the most current Common Criteria Certification illustrates Tripwire’s continuing commitment to meet increasingly stringent U.S. national and international security standards and is assurance that we’re bringing the most secure products to market.”

The certification was issued by the Communications Security Establishment (CSE), the Government of Canada’s center for IT security expertise, advice and guidance, and a participant of the Common Criteria Recognition Arrangement (CCRA). The CCRA brings together 28 nations who agree to accept a unified approach to the evaluations of IT products and protection profiles for information assurance and security.

As a vulnerability and security risk management solution, Tripwire IP360 provides a view of vulnerability risks across hybrid environments, including on-premise, in the cloud and in container-based environments. It offers both agent-based and agentless scanning options for an assessment of vulnerability risks, and prioritizes security risks within business context by combining business asset values with vulnerability scores.

Tripwire’s cyber integrity solutions are used across every DoD Branch service, including Army, Air Force, Navy, Marine Corps, numerous intelligence agencies and more than 85 percent of the Federal Government’s civilian agencies.

from Help Net Security https://www.helpnetsecurity.com/2018/10/31/tripwire-ip360/

Watch: How to Vote Even If You're Turned Away on Election Day

You know it’s important to vote. We know that you will enthusiastically show up to the polls this year. However, there are voter suppression tactics (and sometimes just clerical errors) that can prevent you from casting your ballot.

To prepare for what might happen, Myrna Perez, Deputy Director of the Democracy Program at the Brennan Center for Justice lays out the steps for how to make sure your vote is counted.

And if you would like to have an reference handy when you show up on Election Day, check out our written guide on what to do if you get turned away at the polls.

from Lifehacker https://lifehacker.com/watch-how-to-vote-even-if-youre-turned-away-on-electio-1830097578

How to Play —and Win—Google's Halloween-Themed Multiplayer Game

How to Time Your Next Pregnancy to Reduce Health Risks

Take Your Pick of Noise Canceling Headphones For $40 Or Less [Exclusive]

How Was Your Month of Deadlifts?

Ask The Salty Waitress: Do I need to tip my coworker for making me an espresso?

That's Not the Social Security Administration on the Phone

How one man could have taken over any business on Facebook

I'm Adrienne Willis, Executive and Artistic Director of Lumberyard, and This Is How I Work

Apple releases security updates, says new MacBooks will disconnect microphone when lid is closed

Apple unveiled new Macs and iPads on Tuesday and has pushed out security updates for macOS (Mojave, High Sierra, Sierra), iOS, watchOS, tvOS, Safari, iTunes, and iCloud for Windows.

Among the various vulnerabilities fixed is an ICMP packet-handling vulnerability in the XNU kernel that could be exploited remotely to achieve code execution on, extract data from, or crash macOS powered devices (as demonstrated in the following video):

Closed MacBooks disable microphone

During the Apple event that presented the new devices to the world, Apple has also revealed that all new Mac portables (MacBooks) that have the T2 security chip built in automatically disable the microphone when the lid of the device is closed.

“This disconnect is implemented in hardware alone, and therefore prevents any software, even with root or kernel privileges in macOS, and even the software on the T2 chip, from engaging the microphone when the lid is closed,” Apple explained.

“The camera is not disconnected in hardware because its field of view is completely obstructed with the lid closed.”

Security updates

The security updates for the various supported macOS versions fix a bucketload of vulnerabilities.

Among these is CVE-2018-4407, a vulnerability in Apple’s XNU operating system kernel that was discovered and reported by Semmle security researcher Kevin Backhouse.

It is a heap buffer-overflow vulnerability in the ICMP packet-handling module of the kernel’s networking code and may allow an attacker to execute arbitrary code or extract data from a target device by sending a malicious IP packet across the network, as well as to crash the device and force a reboot.

“Because the vulnerability can be easily exploited, and is remotely triggerable without any user interaction, the vulnerability could be automated as a denial-of-service attack, continually crashing all vulnerable devices on a network, which could effectively shut down an organization,” the company explained.

The vulnerability affects iMacs and MacBooks, iPhones and iPads, iWatches and Apple TVs. Apple has already patched it in iOS, watchOS, tvOS and macOS Mojave in September, and has now finally plugged the hole in macOS Sierra and High Sierra.

Backhouse noted that the vulnerability can be exploited without special permissions or specialist hardware and that, apart from upgrading, there’s very little users can do to protect themselves, so he advised users of all affected devices to hop to it.

The iOS security update (iOS 12.1) is also chock-full of fixes, including those for:

• A vulnerability in the Graphics Driver that could allow a remote attacker to initiate a FaceTime call causing arbitrary code execution (CVE-2018-4384)
• Many kernel and WebKit vulnerabilities
• Two vulnerabilities (CVE-2018-4387, CVE-2018-4388) that may allow a physically present attacker to bypass the device’s lock screen. The flaws were flagged by researcher Jose Rodriguez, who recently demonstrated similar passcode bypass vulnerabilities.

from Help Net Security https://ift.tt/2JwFRhy

Your Muscles Give Thanks For This One-Day TriggerPoint Roller Sale

ID Systems Throughout the 50 States

Jim Harper at CATO has a good survey of state ID systems in the US.

from Schneier on Security https://ift.tt/2P2tgZc

Google’s stealthy reCAPTCHA v3 detects humans – no questions asked

Crypto exchange collapses, victims accuse it of exit scam

Mirai author fined $8.6million, gets 6 months house arrest

Businesses unprepared for Windows 10 migration, fear vulnerability to cyber threats

A new WinMagic study has found that organisations are largely unprepared for when support of older versions of Microsoft’s Windows OS will be withdrawn in January 2020. When questioned about their lack of readiness for the obligatory migration to Windows 10, respondents cited IT security and fears of being exposed to a cyber security vulnerability as two areas of concern.

The study was carried out at IP Expo in London in October 2018. One hundred and fifty visitors were asked a series of questions to determine their awareness of the need to migrate to Windows 10, and to understand any concerns they might have regarding their organisation’s own migration plans.

Key highlights

• Nearly a quarter of organisations (23 percent) are not ready to migrate to Windows 10
• 30 percent are not aware that support for older versions of Windows OS will cease
• Around one third (29 percent) are fairly or very concerned about the migration process
• Nearly two thirds (68 percent) fear exposure to a cyber security vulnerability during the migration process
• One third (33 percent) do not know if they have the right tools in place to deliver a secure migration.

Lack of preparedness

The study found overwhelmingly that not only are nearly a quarter of businesses yet to start preparations for the migration to Windows 10 (23 percent), 17 percent were ignorant to the topic all together and had no idea if preparations within their organisation are even in place. Furthermore, nearly one third of those questioned (30 percent) did not know that support for these older versions of Windows OS would stop in less than 18 months’ time.

Respondents to the survey expressed varying levels of concern about the migration, with 29 percent being fairly or very concerned. Only around one third of respondents (34 percent) had no concerns about migrating to Windows 10.

Of those who are worried about the migration, security and user data loss were amongst the biggest concerns (28 percent), and 68 percent of respondents feared the migration process could expose their organisation to a security vulnerability. Other concerns included one quarter (25 percent) who cited application management, software & hardware compatibility and around one fifth (18 percent) who stated user disruption or loss of productivity.

Migration process

When it came to the actual migration process, 36 percent had not considered migration technology as an option. Over one quarter (28 percent) did not know if their organisation was considering migration technology. And around one third (33 percent) did not know if they had the right tools in place to deliver a secure migration.

Luke Brown, VP EMEA at WinMagic, said: “The clock is ticking and if organisations don’t move fast they could find themselves scrabbling last minute to deliver a seamless and secure migration to Windows 10. The results of our survey show that there is still limited knowledge around what will be a very significant IT transition for many organisations. IT teams need to act now. If they don’t, come January 2020 they could find themselves experiencing the worst ever New Year hangover.”

from Help Net Security https://ift.tt/2AEtblX

RSA Conference 2019 expands innovation program

RSA Conference announced submissions are open for the returning RSAC Innovation Sandbox Contest and the first-ever RSAC Launch Pad.

RSAC Launch Pad will give three chosen security innovators the coveted opportunity to pitch their company to three high-profile venture capitalists in a Shark Tank-style format. If the prominent VCs like the 10-minute pitch, participants could go home with real funding and support to expedite their company’s growth. Interested parties can apply online to compete in RSAC Launch Pad.

Returning for its 14th year, RSAC Innovation Sandbox Contest is accepting submissions to name the “RSAC Most Innovative Startup 2019.” Past winners include successful companies such as Phantom, Invincea, UnifyID and most recently BigID. In the past five years alone, the contest’s top 10 finalists have collectively seen 12 acquisitions and have received over $2.05 billion in investments. Qualifying companies can apply online for a chance at competing in RSAC Innovation Sandbox Contest.

Companies interested in participating in either RSAC Innovation Sandbox Contest or RSAC Launch Pad are invited to submit an entry online no later than 8 p.m. PT on Tuesday, December 4. Top 10 finalists for RSAC Innovation Sandbox Contest will be announced at the end of January 2019 and the three selected participants for RSAC Launch Pad will be announced mid-February 2019. Terms and conditions for both events can be found here.

The addition of RSAC Launch Pad will broaden the opportunities for the industry’s boldest and brightest thinkers to turn their innovative companies into full-scale, influential cybersecurity businesses. RSAC Launch Pad is geared toward earlier-stage companies with no revenue, while RSAC Innovation Sandbox Contest is tailored to start-ups under five years of age with less than $5 million in annual revenue.

“Over the past few years, RSAC’s innovation programming has experienced a growing interest outside of Silicon Valley, with entrepreneurs from Belgium, Australia, France and Israel submitting to and taking part in RSAC Innovation Sandbox Contest. Our goal is to expand opportunities even further, for innovators at all points in their career and from all corners of the globe, to bring their ideas to fruition,” said Dr. Hugh Thompson, RSA Conference Program Chair, one of the experts behind the creation of RSAC Launch Pad and host of both events. “I think we’re going to see a lot of unique and creative approaches to today’s biggest cybersecurity challenges presented in March, and I can’t wait to see the collective brainpower behind these ideas.”

RSAC Early Stage Expo will also expand this year to include 50 of the industry’s most promising newcomers in its expo hall in the Marriott Marquis. Each startup will provide short demos of their innovative products and solutions to attendees at their kiosks, as well as give informative talks in the Early Stage Expo Briefing Center. On Monday, March 4, RSA Conference will host a half-day “How-To for Innovators and Entrepreneurs Seminar” aimed at attendees interested in learning more about obtaining funds, approaching busy CISOs and clients, and best practices in go-to-market.

“There are very few other industries that need the forward-thinking, creative ideas that the cybersecurity field does today, a space that is expanding and shifting almost daily,” said Rob Sloan, Cybersecurity Research Director at The Wall Street Journal. “We’re excited to be an event partner with RSA Conference’s Innovation Sandbox Contest and Launch Pad this year, and we know that the concepts presented on stage during these two events will change the security industry for decades to come.”

from Help Net Security https://ift.tt/2Jqwy2q

Damaging cyberattacks surge ahead of 2018 U.S. midterm elections

Carbon Black released its Quarterly Incident Response Threat Report (QIRTR) aggregating key findings from IR partner investigations during the last 90 days.

Key findings

• Destructive cyberattacks are on the rise. IR firms said that victims experienced destructive attacks 32% of the time
• Of 113 investigations Carbon Black partners conducted in the third quarter, 41 percent stemmed from Russia and China
• Two-thirds of IR professionals interviewed believe cyberattacks will influence the upcoming U.S. elections.

“Our research found that today’s attackers are increasingly punitive, sophisticated and confident,” said Tom Kellermann, Chief Cybersecurity Officer for Carbon Black and one of the report’s authors. “And because of the dark web, they have access to complex tools and compromised infrastructures, including voter databases. This allows attackers to exploit new security vulnerabilities and operate at a higher level of sophistication than before.”

Voter databases available for purchase

Researchers also found 20 different state voter databases available for purchase on the dark web, several from swing states. Critical information in these offerings include voter IDs, full names, current / previous addresses, genders, phone numbers, and citizenship status, among other information.

According to the research, the dark web also offers hacking and influence campaigns targeting social media sites, as well as hackers for hire, who offer to target government entities for the purposes of database manipulation, economic/ corporate espionage, DDoS attacks and botnet rentals.

from Help Net Security https://ift.tt/2DdTgKP

CA Technologies updates mainframe solutions, promoting a platform for hybrid environments

CA Technologies updates its mainframe solutions that are designed to accelerate modernization and integration initiatives, allowing enterprises to leverage mainframes as enablers of digital transformation to drive revenue growth. These new and enhanced offerings enable customers to use intelligence and automation to maximize resources and protect data while working with the latest technologies and open innovations, across hybrid environments.

“Mainframes are an integral part of any hybrid IT environment where workloads should run on platforms that provide the best advantage,” said Greg Lotko, general manager, Mainframe, CA Technologies. “Only CA can bring a more simplified user experience that spans the breadth of open DevOps and machine learning-based operational intelligence to make the mainframe an agile, integrated part of an evolving IT architectural landscape.”

“We’ve found CA’s tools to be flexible, easy to use and cost-effective for a dynamic workforce that includes developers and mainframers,” said Jim Magnus, vice president of partner development at Ensono, a leading hybrid IT services provider and CA partner. “Our work and relationship with CA Technologies is vital to driving digital transformation for our clients. We believe the company is making the right investments in mainframe innovations to help clients optimize and modernize their hybrid IT environments.”

Modernizing development and operations for more efficient innovation

CA Technologies, a founding contributor of the Open Mainframe Project’s Zowe initiative, is making the core elements of its CA Brightside solution and the API Remediation code base open source through Eclipse Public License 2.0, which encourages collaboration and innovation opportunities for the IBM z/OS platform.

CA Brightside, designed to make it easy to integrate the mainframe into enterprise DevOps workflows, allows development teams to control, script and build for the mainframe like any other cloud platform, using familiar open source tools, such as Jenkins, Gradle and IntelliJ, thru a command line interface. Releasing the code via public domain enables a broader community to contribute new innovations and improvements, while further strengthening the mainframe platform and ecosystem.

“We are excited that CA Technologies has formally released the code through the Eclipse Public License,” said John Mertic, director, Open Mainframe Project. “This demonstrates a strong commitment to grow and develop the Zowe framework in support of the open community model. At the same time, it is a critical step to ensuring ongoing innovation so that mainframe customers gain access to the latest technologies.”

For enterprises struggling to keep pace with development and DevOps methodologies while dealing with limited resources, updates to CA’s Continuous Testing solutions provide mainframe organizations with testing capabilities that enable delivery of quality software. Development teams can conduct software tests by virtualizing mainframe environments with CA Service Virtualization; conduct functional and performance testing with CA BlazeMeter; and create test data that never leaves the mainframe with CA Test Data Manager.

IT operations leaders are managing environments that span from the mainframe to a range of cloud and distributed platforms. CA Operational Intelligence – recently introduced as part of CA’s AI Ops-driven platform – provides service intelligence, analyzes structured and unstructured data sources from the cloud to the mainframe to help IT operations teams act on potential issues earlier, isolate root causes and remediate issues before they impact the business.

Leveraging mainframe data and applications to drive new apps and engagements with customers means enterprises are dealing with greater exposure to compliance risks. Compliance is an issue that affects all data and processes, so it’s critical to have simplified solutions that can analyze risk exposure on the mainframe.

New machine-learning capabilities in CA Data Content Discovery simplifies the creation of custom analytics and data classifiers to enable higher levels of accuracy, automates the discovery of new data as it is generated to address compliance issues at scale, and improves visualization of key insights to make it easier for mainframe and non-mainframe IT staff to understand potential risks across mainframe data infrastructures.

from Help Net Security https://ift.tt/2DcSi1D

Many water and energy systems vulnerable to significant cyber risk

New Trend Micro research revealed how exposed human machine interface (HMI) systems in thousands of critical water and energy organizations around the world could be exploited, causing significant real-world impacts, such as contaminating the water supply.

U.S. critical infrastructure dependency flow according to econometric analysis

Exposed human machine interfaces

HMIs are a key part of industrial IT systems that allow human operators to interact with supervisory control and data acquisition (SCADA) environments. A large majority of the identified exposed systems are from smaller energy and water organizations that feed the major enterprise supply chain, which serves the general public. With access to an exposed HMI system, an attacker is not only able to see all the information about critical systems, but can also interact with and abuse these interfaces.

“Critical infrastructure is a national focal point for cybersecurity – and for cybercriminals, who can pinpoint and exploit the weakest link in these connected systems,” said Mark Nunnikhoven, VP of cloud research for Trend Micro. “That’s troubling, as Trend Micro Research continues to find critical devices, and the networks that they connect to, needlessly exposed. This exposure, combined with the record number of ICS vulnerabilities reported through the Zero Day Initiative this year, highlights a growing risk that extends into each of our communities.”

Many of these HMIs are legacy systems that were not initially designed to be connected to a network in this way. Today, connectivity is being added to many legacy operational technology systems, which have long lifespans and are very difficult to patch, exacerbating the risk of attack.

“The Trend Micro search results are not a representative sample – that they found medium-sized utilities’ HMIs exposed to the Internet at all suggests this is the tip of an iceberg. The defenses recommended in the report’s Appendix are dated – layers of firewalls are only speed bumps to modern attackers. Modern defenses recognize that all attacks are information and so the first step to defense is to control information flows, not just encrypt them: block USB ports, forbid external laptops, and if you need an HMI on the Internet, use a Unidirectional Gateway, not a firewall,” Lior Frenkel, CEO and co-founder, Waterfall Security Solutions, told Help Net Security.

Real-world impact to critical infrastructure

Attackers may soon turn their attention to exploiting these exposed systems due to an increase in new vulnerabilities found this year. Trend Micro’s Zero Day Initiative has published nearly 400 SCADA-related vulnerability advisories in 2018 so far – a 200 percent increase compared to the same time last year.

Based on a recent survey by Trend Micro, operational technologies like these have not typically been managed by IT or security teams. The ongoing confusion around who in an organization is responsible for securing connected devices often leaves them more at risk.

Breakdown of origin countries for non-critical and critical attacks from the SCADA honeypot research

To protect HMI systems against the risk of attack, security leaders must ensure the interfaces are properly secured if they must be connected to the internet. Likewise, there should be as much isolation as possible in place between these devices and the corporate network, which maintains operational needs while eliminating the risk of exposure and exploitation.

“If we hadn’t found the command and control malware in our SCADA environment, our toxic gases monitoring systems could have been compromised and may put human lives in danger,” said Ireneo Demanarig, chief information officer, CEITEC S.A. “Security must be at the core of our company.”

from Help Net Security https://ift.tt/2Jt35ou

Wider breach awareness fosters more security conversations

Focal Point Data Risk released the second annual Cyber Balance Sheet Report, a closely watched research study using in-depth surveys and interviews of corporate board members and CISOs to offer a rare window on the state of cyber risk management in the boardroom. The Report is independently produced by the Cyentia Institute, a cybersecurity research firm, co-founded by Dr. Wade Baker, widely known for creating the landmark Verizon Data Breach Investigations Report (DBIR).

This year’s report findings reveal a complex risk management sequel to the inaugural 2017 edition, which tracked cyber risk as an escalating oversight issue among boards. The 2018 report reveals that wider awareness of risks – including third-party data breaches, ransomware and geopolitical conflicts – spurs more security dialogue in the boardroom. However, C-Suite and security leaders struggle to frame risk in productive decision-making terms and keep an eye on whether companies are operating within their proper risk appetite.

“The more important issue uncovered by the research is that this surge of interest – while commendable –seldom resolves executives’ two most important questions: ‘What is our risk appetite?’ and ‘Are we operating in or out of this comfort zone?’ When these questions are buried or unanswered, it becomes a recipe for miscalculation and false assurances. Helpfully, security teams and business leaders can use the report’s anecdotes and data to revisit how they frame risk management with leadership,” said Andrew Cannata, Focal Point’s CISO and national Cyber Security Practice leader.

The Report organizes CISO and executive insights along seven key “balance points” that reveal key differences on issues, including how boards view cybersecurity as a unique risk or extension of other hazards, different metrics and reporting structures boards and CISOs use in briefings, varying approaches to identifying risk appetite and exposure and what board members say instills satisfaction and confidence in security programs.

Many organizations have not formally established a cyber risk appetite

Risk appetite is defined as the amount and type of risk an organization is willing to accept. It is the responsibility of boards and C-Level executives to weigh risk appetite against growth opportunities. Yet, less than half of participants could describe their risk appetite quantitatively, preferring terms like “very low,” instead. This makes it difficult to identify and track risk appetite over time as business and technology forces continually change operations.

More metrics can muddy what matters most

“Security incidents and losses,” “compliance status” and “security program maturity” are the top three most-reported metrics to the board. Surprisingly, “third-party and supply chain,” “risk appetite” and “external threat trends” were reported less frequently – despite their urgency for decision-making and frequency in data breach headlines.

Finding the magic “return on reporting”

The report objectively looks at reporting and conversation topics in the boardroom, using visualizations to chart their frequency of occurrence, versus depth of resulting dialogue and reported value. For example, “compliance” is one of the most reported on topics, but respondents give compliance particularly poor “return on reporting,” because it ultimately spurs little talk and value. Conversely, “security governance and resources” surfaces less frequently, though participants report more conversations and greater value around the topic.

“This latest report shines a light on remarkable progress and stakes surrounding how boards and security teams interface and support one another,” added Baker, the lead Cyber Balance Sheet Report researcher. “The data show cyber risk is still an emerging area for boards with more experience facing other existential threats. However, there is wider recognition that IT is a risk vector for everything that keeps leaders up at night, from regulatory issues and protecting trade secrets to reputational matters and avoiding lawsuits. The report shows we are crossing a key threshold where boards realize that requesting metrics and asking more security questions only helps to a point. The new premium is on each board, C-Suite and security team determining the most important issues for them to productively set their risk appetite course and navigate appropriately.”

from Help Net Security https://ift.tt/2ABkbOq

NTT Security adds botnet infrastructure detection to Managed Security Services

NTT Security has developed a new network analytics technology to detect and defend NTT Group’s Managed Security Services (MSS) customers from attacks launched on botnet infrastructures. The new network flow data analysis uses machine learning and scalable streaming analytics – developed in partnership with NTT Group companies – and pulls data from NTT’s global network infrastructure, which provides visibility into the world’s internet traffic.

The enhancement will enable NTT Security to find attacks on customers’ internet-connected devices in real time and help affected organizations react more quickly, minimizing interruption to the business. Machine learning is used to detect Command & Control (C&C) servers which are added to NTT security’s blacklist, which is then accessed by experts to analyze the threat in detail and applied to detect attacks.

“With access to our internet backbone traffic from around the world and experience in using machine learning as part of a layered approach to cybersecurity, NTT Security is ideally positioned to offer botnet infrastructure detection,” commented Kenji Takahashi, VP of Innovation at NTT Security.

“Our new technology is a major benefit to NTT Group’s MSS customers that, rightly so, expect real time and proactive protection against the growing onslaught of cyber crime. We can see behind attacks, add context and identify if these attacks are random or targeted. Our technology not only provides visibility into the customer perimeter, but also far beyond it. It is the world’s first commerical application of the latest machine learning techniques to internet backbone traffic for the purpose of botnet infrastructure detection.”

Malicious actors are increasingly leveraging C&C and botnet servers to launch attacks, such as Distributed Denial of Service (DDoS) attacks and malware distribution, on organizations. The consequences can be devastating and, with the rise of Internet of Things (IoT), these malicous actors have the potential to affect millions of systems worldwide.

The Mirai botnet, for example, was used to conduct what was, at the time, the largest ever DDoS attack – a flood of communications designed to make the target system unusable. Attackers used Mirai to harness hundreds of thousands of compromised IoT devices from consumer and corporate environments to disrupt the operations of other devices and networks. NTT Security’s technology makes it possible to mitigate such large scale attacks.

Kenji added: “The number of ways in which IoT devices can help people and organizations is boundless. However, IoT devices pose new and unique security challenges because of their massive and ubiquitous installed base as well as the limitation in their computing resources. Along with NTT Group companies, NTT Security continues to invest in enhancing its large-scale network analytics not only for IoT but also other disruptive technologies, such as the cloud and Software Defined Networking (SDN). Furthermore, we will leverage the capablities to enhance NTT Security’s threat intelligence together with our Global Threat Intelligence Center (GTIC).”

Collaboration with NTT Communications and NTT Secure Platform Laboratories has made the network flow data analysis technology possible. New and existing MSS customers will benefit from this disruptive technology and, because it is integrated throughout the NTT Security MSS value chain, they will get it automatically without the needs of additional installation effort or costs.

Kazuhiro Gomi, President and CEO of NTT America, and a member of Board of Directors of NTT Communications, commented: “This latest enhancement is the result of a collaboration between three companies that share the same passion and experience in business resilience. Together, we have invested considerably into research and development to ensure that, as a group, we can deliver the best integrated security solutions to organizations using the wide range of services that NTT Group provides worldwide.”

from Help Net Security https://ift.tt/2yF7eSg

LookingGlass Cyber Solutions software platform manages third party cyber risks

LookingGlass Cyber Solutions released its Third Party Risk Monitoring offering. Built on the ScoutPrime platform, the LookingGlass subscription service offering leverages the threat data along with a team of expert security and intelligence analysts to mitigate risks, provide visibility into potential vendor exposure, and reduce time to action with negligible false positives.

Beyond the digitized walls of every company is a world of vendors, suppliers, providers, and subsidiaries, all connected to a company’s network or data and each with the potential access to publicly expose customer information, intellectual property, or heavily regulated data.

Without insight into these broader networks and data relationships, businesses risk leaving an enormous portion of their attack surface unmonitored and unchecked, undermining their ability to pinpoint or remediate third party security weaknesses and avoid costly data breaches. And while more than 60 percent of companies admit they know where third party risks are most likely to arise, they acknowledge they struggle to detect them.

The LookingGlass Third Party Risk Monitoring service delivers more than scorecards or access to infrequently updated data bases. Using LookingGlass’ global Internet topology, the service identifies third party network elements and assets to deliver notifications of compromises, vulnerabilities, and network breaches.

LookingGlass’ security analysts then review identified cyber threats for relevance, minimizing the likelihood of false positives. Designed for flexibility and scale, customers can monitor up to 5,000 third parties across over a dozen categories of cyber risk, obtaining a view into vulnerabilities, breaches, open ports, misconfigured certifications and other evidence of a potential system risk or compromise.

Users can also add, delete, or query any vendor at any time and, with built-in reporting, can collect and report metrics to company leaders to promote security visibility across the organization.

“When it comes to risk, companies have more than just their own perimeters to consider. Every new or existing vendor increases the possibility for exposure that could lead to a breach and impact revenue, brand, and reputation,” said Eric Olson, senior vice president of product at LookingGlass Cyber Solutions.

“Changing regulations that require organizations to demonstrate effective identification and management of third party relationships and associated cyber risk add even more layers of complexity to the already time-consuming task of keeping networks secure from a constant barrage of evolving inbound threats. Our Third Party Risk Monitoring service empowers security teams to effectively manage their company’s security posture by delivering the efficient, reliable analysis essential to making strategic, proactive risk management decisions.”

The LookingGlass Third Party Risk Monitoring service can be delivered as a shared or hosted service via LookingGlass or select partners in the company’s worldwide Cyber Guardian Network. It includes support along with on-boarding and provisioning.

In addition to monitoring of third parties, it also performs scanning of the surface, social, deep, and dark web for both structured and unstructured data, including phishing activity, compromised account credentials, and vulnerabilities in vendor products.

from Help Net Security https://ift.tt/2Q3POpa

Avi Networks launches SaaS solution for multi-cloud load balancing and application services

Avi Networks launched Avi SaaS, the SaaS solution for multi-cloud load balancing. Avi SaaS provides cloud-managed software to deliver application services including load balancing, web application firewall (WAF), global server load balancing (GSLB), and service mesh for containers across a multi-cloud environment.

The solution overcomes the limitations of appliance-based ADCs, which are not designed for the public cloud. Avi SaaS combines the deployment of cloud-provider solutions and enterprise-grade features without being constrained to a single environment. Avi SaaS delivers consistent capabilities regardless of infrastructure, accelerates time-to-value, lowers OpEx, and drives operational simplicity.

Avi SaaS complements Avi’s product, the Avi Vantage Platform, by delivering the Avi Controller as a cloud-managed service. Avi’s SaaS model delivers the path to productivity for provisioning load balancers, monitoring application performance in real time, and resolving application issues. Avi’s central control plane is provisioned and managed for customers by Avi, with the Avi Service Engines (distributed load balancers) deployed close to the applications that enterprises own.

The benefits of Avi’s SaaS delivery model and architecture include:

Time-to-value — Avi SaaS helps enterprises get an easy start to delivering application services. Businesses reduce time-to-market for applications since administrators can login into Avi’s cloud-managed SaaS controller and configure virtual services and policies for their applications.

Operational simplicity — Avi SaaS simplifies the management and maintenance of application services by removing the need to manage cloud or on-premises infrastructure. IT operations and networking teams can focus their attention on delivering self-service, automation, and issue resolution for application owners.

Deployment flexibility — Avi SaaS delivers the same enterprise-grade feature set as Avi Vantage, giving enterprises the freedom to deploy Avi software the way they want to – managed by their IT teams or by Avi.

High performance and low cost — Avi SaaS brings the best of both worlds to customers by deploying the distributed load balancers close to applications while delivering central policy and lifecycle management as a service. This deployment model lowers operational costs while ensuring high throughput.

“Avi SaaS is an excellent way to leverage Avi Networks’ separation of the control plane and data plane,” said Kevin Tolly, founder of The Tolly Group. “Its ability to deploy services anywhere from a single centralized controller is well-suited to multi-cloud environments, and customers will find its easy-to-consume management model very attractive.”

“Avi SaaS is ideal for cloud-oriented organizations, emerging brands, and highly distributed businesses,” said Murali Basavaiah, VP of Engineering and Co-Founder at Avi Networks. “It provides all the flexibility and automation of the Avi Vantage Platform and makes it available on tap, no matter where applications are deployed.”

Avi SaaS customers can select the region(s) where their controllers are hosted to fit their needs for delivery and resilience requirements. They can also opt for isolated instances to meet security and compliance policies.

from Help Net Security https://ift.tt/2qlqD6i

Female leaders recognized for contributions to biometrics and security

Five distinguished leaders in the biometric identity and security industry have been selected as the 2018 winners of the Women in Biometrics Awards, co-founded by the Security Industry Association (SIA) and SecureIDNews and co-presented with sponsors FindBiometrics, IDEMIA and SIA’s Women in Security Forum.

“Biometric identity solutions and services are crucial to the security industry and to other industries like banking and health care,” said Don Erickson, SIA’s CEO. “These 2018 honorees have helped advance this important field through their impressive leadership, involvement, innovation and mentorship efforts across industry and government. SIA, along with our partners and sponsors, is proud to recognize this inspiring group of female biometric leaders with the Women in Biometrics Awards presented at SIA Honors Night.”

The five winners for 2018’s awards, selected from a global pool of nominees, are:

Kelly Gallagher, Senior Account Manager, NEC Corporation of America

With more than 30 years of experience in law enforcement and background working with biometric technology, Gallagher has focused on the cutting edge of forensic science, working to understand the issues of the law enforcement community and work effectively to address those needs. In her current role, she has led the Los Angeles County Sheriff’s Department switchover to NEC’s ID 5 Multimodal Biometric Identification Solution, which serves criminal identification needs for the Los Angeles Police Department, 45 additional police departments in the county and the county as a whole.

She is a member of AFIS Internet and is critical to organizing the annual AFIS Internet Users Conference. In addition to a degree in criminal justice from the California State University of Sacramento and a wealth of biometrics training and experience, she holds several certifications from the U.S. Department of Justice, the FBI and more.

Lisa MacDonald, Director, Identity Capabilities Management Division, Office of Biometric Identity Management (OBIM), U.S. Department of Homeland Security (DHS)

A leader in DHS’ biometrics organization, Macdonald has more than 25 years of professional experience spanning all facets of organizational transformation in both public- and private-sector organizations with high-impact results. Highlights include leading a campaign to garner $200 million for a replacement biometric system for DHS, then spearheading the source selection; designing and executing repeatable strategic planning and implementation processes for both DHS and the Department of the Army’s biometrics organizations; leading process improvement efforts for more than 100 DHS and Army processes, using interactive SharePoint functionality for enduring benefit; and serving federal clients in all facets of organizational transformation, including supporting the development of the Office of Management and Budget’s performance reference model. MacDonald is a certified project management professional and previously served as an examiner for the state of Virginia’s Baldrige program.

Colleen Manaher, Executive Director, U.S. Customs and Border Protection (CBP), DHS

In her work at CBP, Manaher has strengthened public-private partnerships with the airlines, airports and the U.S. Transportation Security Administration (TSA) around the use of biometrics in air travel to enhance the customer experience. While there is a mandate to verify when foreign travelers depart the United States, CBP has built a biometric matching service that air travel stakeholders can use wherever identity verification is needed – check-in, bag drop, TSA or an airline lounge.

Manaher has been at the center of CBP innovation for years and is an integral part of the success of CBP’s biometric mission at 14 entry and 15 exit locations, with more on the way. Manaher proactively engages with a variety of key stakeholders in the air travel industry, federal partners and technology vendors and challenges them to disrupt the status quo by developing solutions and partnering with CBP to change the face of travel. Under her leadership, CBP is regarded as the catalyst of innovation in the government and has advanced the biometric exit mission at an unprecedented level.

Lora Sims, Senior Biometric Examiner, Ideal Innovations, Inc. (I-3)

An International Association for Identification-certified tenprint examiner and senior biometric examiner at I-3, Sims supports the Defense Biometric and Forensic Agency’s examination services branch in fingerprint, face and iris compositions. She is a co-author of a training-to-competency program on facial identification and comparisons and the main author of the facial identification training curriculum I-3 offers worldwide.

She has trained hundreds of individuals in the facial identification field, including intelligence analysts, police officers and forensic artists, and has traveled worldwide to train personnel in international, federal, state, local and commercial organizations. She chairs both the Facial Identification Scientific Working Group and the Organization of Scientific Area Committees’ Facial Identification Subcommittee and is a frequent presenter on facial identification at biometric and forensic conferences.

Anne Wang, Director of Biometric Technology Research & Development, Gemalto Cogent

Since joining Gemalto Cogent (formerly Cogent Systems) in 1991, Wang has been with the company through two acquisitions and supported and directly contributed to many of its top-ranking, world-renowned biometric algorithms. She has also contributed to the design of numerous biometric matching software development kits and multi-modal biometric identification devices being used around the globe.

Most recently, she has led the development efforts for touchless biometric capture technology. She contributed her expertise in multimodal biometrics to the United Kingdom visas program, designed to acquire tenprints and compliant facial images for visa applicants and visitors to the UK, and has supported various government and commercial clients, including the OBIM program and Financial Information Network & Operations Ltd. Wang participates in National Institute of Standards and Technology evaluation of Gemalto Cogent fingerprint, facial and iris algorithms and participates on several biometric standards subcommittees. She has presented to the forensic community at the International Association of Investigation and regularly speaks at Gemalto Cogent’s international user group meetings.

Each year, the Women in Biometrics Awards recognize the efforts of top female leaders helping drive the biometric identity and security industry. Nominees and past winners include those working for biometric companies, peripheral suppliers, system integrators, academia, government or security and IT departments at a variety of organizations.

from Help Net Security https://ift.tt/2OZBam5

Adequate Man Help!

Adequate Man Help! My Boss Just Followed Me On Twitter | The Slot What Is Going On With This Highly Suspect Scheme Alleging Women Were Paid to Accuse Robert Mueller of Sexual Harassment??? [UPDATED] | Splinter Jonathan Swan Is a Bootlicker | The A.V. Club Lucy Davis on getting sick from Shaun Of The Dead and watching the U.S. version of The Office | The Root Hair Salon Owner Claims She Didn’t Know Blackface Was a ‘Thing’ After Employee Gets Caught in Racist Michael Jackson Costume |

from Lifehacker https://ift.tt/2OfWQW8

The 10 Best Deals of October 30, 2018

What Is Birthright Citizenship?

The 6 Most Important Announcements From Apple’s October 2018 Event

This Must-Have Feature Will Make Your Next Family Car So Much Better

You Can Freeze and Reheat Mashed Potatoes for Thanksgiving

At $40, This Canon Is the Cheapest Wireless Laser Printer We've Ever Seen

Use a Voice Alarm to Wake Your Child During a Fire

Use this App To Enable the Pixel 3's Camera Features on Older Pixel Smartphone Models

How to Easily Remove Halloween Face Makeup

This 50 Pound Adjustable Dumbbell Set Has Never Been Cheaper

How to Get a Free Election-Day Ride to the Polls

Here's All the Stuff Apple Announced Today

How to Pre-Order the New Macbook Air and iPad Pro

Program Some Music With This Online Sequencer

How to Wash Your Nice Dishes Without Breaking Them

Tuesday's Best Deals: Osprey, Dumbbells, Baby Monitors, and More

Stop Calling Every Brown Spider a Brown Recluse

How to Make Safari Even More Secure With GhosteryLite

Now U.S. Citizens Can Jump the Epically Long Customs Line in London

Stretch Out and Relieve Back Pain With This Discounted Inversion Table

Alleged SWATter will plead guilty to dozens of serious new federal charges

Why the Fall Foliage in Your Area Might Be Disappointing This Year

How to Find an iOS App's In-App Purchases Before You Buy It

The Best New Features in iOS 12.1

The Root Black Navy Sailor Attempting to Help ‘Stranded Motorist’ Shot and Killed | Deadspin Even Th

The Root Black Navy Sailor Attempting to Help ‘Stranded Motorist’ Shot and Killed | Deadspin Even The Mighty Premier League Must Bow Before The Power Of America’s Stupidest Sport | Splinter Are You Seeing This Shit? | Jezebel Doctor Won’t Face Jail Time For Dyeing Patient’s Vagina Purple as a ‘Joke’ | The A.V. Club The case for watching horror, as made by someone who used to hate it |

from Lifehacker https://ift.tt/2zemcxX

When a Sale Isn't Actually Worth It

Open a Motion-Sensor Door With Vape Smoke

We’ve never run a vape trick on Lifehacker. Until today. It’s a pretty specific trick: if you’re locked outside a door, but the door has motion sensors on the other side, you can vape through the crack to open that door. Watch the video above to see it work.

As weirdly particular as this is, we hope that some vaping MacGyver one day gets to use it like a vigilante hero. Wherever someone is locked out of a very specific kind of door, there you will find the Caped Vaper, face pressed up against the crack, vaping into the wall.

Advertisement

YouTube commenters point out that vape smoke could also trigger a smoke detector this way, so do some cost-benefit analysis before you try this out. And tell us if you know any other practical hacks using vape smoke.

(via Digg)

from Lifehacker https://ift.tt/2zdHNqw

How to Stretch If You Hate Stretching

Gov worker visits 9k porn sites without protection, spreads infection

Schlep All Your Stuff With Amazon's One-Day Osprey Sale

Nastiest malware of 2018: Top attack payloads wreaking havoc

Webroot highlights the top cyberattacks of 2018 in its latest nastiest malware list, which showcases the malware and attack payloads that have been most detrimental to organisations and consumers alike.

Three nastiest: Botnets and banking trojans

Emotet is this year’s nastiest botnet that delivers banking Trojans. It aspires to increase the number of zombies in its spam botnet, with a concentration on credential gathering. Threat actors have recently developed a universal plug and play (UPnP) module that allows Emotet to turn victims’ routers into potential proxy nodes for their command-and-control infrastructure.

Trickbot follows a similar attack plan, but contains additional modules (with more added each day) and has even been seen dropping ransomware. Imagine all of the machines in your network being encrypted at once!

Zeus Panda has similar functionality to Trickbot, but has more interesting distribution methods including macro-enabled Word documents, exploit kits and even compromised remote monitoring and management services.

Three nastiest: Cryptomining and cryptojacking

GhostMiner’s distribution method is the scariest part for its victims because they don’t know its entry point, similar to a scary movie where you know someone’s in the house but you don’t know where. GhostMiner is most commonly seen being distributed via an exploit in Oracle WebLogic (CVE-2018-2628).

WannaMine’s Windows management instrumentation (WMI) persistence technique is extremely nasty, allowing it to remain stealthy and difficult to find and remove.

Coinhive, initially innocent, was quickly added to the standard toolkit for attackers compromising websites. Even legitimate website owners are using Coinhive without knowing the impact it will have on their visitors. If your computer processing power (CPU) spikes to 100 percent when simply visiting a website, it might be Coinhive.

Three nastiest: Ransomware

Crysis/Dharma goes hand in hand with the term “compromised RDP.” This ransomware has been evolving to remain one of the top dogs of the ransomware as a service (RaaS) world and specifically targets the RDP vector. System administrators consistently return to work after a weekend to find one or more of their machines encrypted, usually without knowing the source.

GandCrab is yet another RaaS. It is especially nasty, as it is distributed via malspam campaigns, exploit kits, and RDP. Another interesting fact is that it uses the .bit TLD (top level domain), not sanctioned by ICANN, providing an added level of secrecy.

SamSam, initially distributed via a JBoss exploit, soon turned to RDP and is now bringing down entire cities (or portions of them at least). You’ve likely seen these attacks in the news for taking down the city of Atlanta or the Colorado Department of Transportation.

from Help Net Security https://ift.tt/2yBKqTt

Snakes in the grass! Malicious code slithers into Python PyPI repository

Cell Phone Security and Heads of State

China hijacking internet traffic using BGP, claim researchers

Safeguarding global critical networks now and in the future

Lior Frenkel is the CEO and co-founder of Waterfall Security Solutions, a provider of unidirectional security gateways, stronger-than-firewalls perimeter security solutions for industrial control networks and critical infrastructures.

In this interview he talks about the vulnerability of global critical networks, challenges related to safeguarding such security architectures from zero-day attacks, ICS security in the future, and much more.

Based on your experience, how vulnerable are global critical networks?

There are a lot of big industrial sites in the world and far more small sites. In my experience, many of the larger sites and some of the smaller ones are reasonably well defended against the simplest attacks, like common malware and stolen passwords. But the opposite is true as well – some of the big sites and a huge number of small ones are poorly defended.

Most sites have at least some protection in place – most commonly firewalls and some encryption, especially on their remote access connections. After all, remote access is so convenient for so many of us … and our enemies as well. More fundamentally, every path through a firewall that lets data out lets attacks pass back in. Cryptosystems encrypt attacks just as happily as they encrypt legitimate communications. Intrusion detection is held up as the holy grail by a lot of experts, but intrusion detection, when it works, takes time, and incident response takes even longer. How long are we willing to give our enemies once they control equipment on our industrial networks?

When it comes more sophisticated attacks – zero-day exploits, sophisticated attack tools, remote attack teams, spear phishing and so on – very few sites of any size have robust protections in place.

This is a very big problem.

Given the complexities of ICS networks, what are the most significant challenges related to safeguarding such critical security architectures from zero-day attacks?

It is not the complexity of networks that is the issue, but the practices of owners, operators, employees and vendors. All cyber attacks are information and every information flow can encode attacks, yet we see people remoting into these sites and carrying USB’s and laptops into them. When inbound information/attack flows are thoroughly controlled, zero-days pose no greater threat than any other vulnerability.

The problem I see is that a lot of people still think they can control information flows with firewalls and encryption. Firewalls are software. So firewalls have zero-days too. So do encryption libraries. Using firewalls full of zero days with encryption libraries full of zero days to protect networks full of zero days is like bailing out your basement with a bottomless bucket – it’s fun to watch but you’d hate to be the one who needs to see progress.

What advice would you give to a security leader that was tasked with improving the security of a large industrial operator?

I would urge them to pick and choose among the standards and advice out there. The French ANSSI advice for industrial control system security for example is robust – but a lot of other advice is either just wrong, or so nebulous it is easy to use it incorrectly. I would paraphrase the ANSSI advice as cyber-security “back to basics”:

• Inventory your ICS information flows – these are your attack vectors.
• Minimize them – all information inbound into your industrial networks is your enemy’s tool.
• Control online information flows with hardware, not just software, most often unidirectional gateways.
• Control offline information flows as well, with a variety of techniques.

ANSSI and a lot of other modern standards forbid firewalls at the perimeter of industrial networks and permit only unidirectional gateways. The unidirectional hardware is physically able to send information in only one way – out of an industrial network. Unidirectional gateway software makes copies of database servers and other servers to IT networks where the copies can interact normally with IT systems. With gateways instead of firewalls, it doesn’t matter how many zero days there are in any software, or how many passwords have been stolen. If no information gets back into an ICS, no attacks get back.

Standard advice to control offline information flows includes anti-virus and sandboxing cleansing stations for removable media, and simply banning external laptops entirely. When a vendor schedules a visit to the site, have an ICS-only laptop provisioned for them with all of the software packages they need. Turn on alerting for all violations of the media & laptop policy. Integrate the security program into the safety program and treat all alerts as security and safety near misses. In short order, we teach our people never to carry information blithely into our industrial networks – they quickly learn and practice that inbound information is their enemy.

This is not rocket science. If zero-day exploits cannot get into our industrial networks to touch our zero-day vulnerabilities, the vulnerabilities are mitigated. We probably still want to patch our systems eventually, but there is no need to do it in the mad, costly panic that we see at so many sites.

I think part of the problem with adoption is the terminology. Most of us think we need to “protect the data” in our control systems, but all cyber attacks are data. We don’t need to protect the data – we need protection from the data. We need to control, thoroughly, all the nasty little ways data and attacks are leaking into our control systems.

How has ICS security changed over the years, and how do you see it evolving in the near future?

Industrial systems face the same pressures as everybody else:

• For 30 years CPUs have been getting cheaper so there are more of them everywhere, and more software everywhere. The problem is that all software can be hacked – so the attack surface increases constantly.
• For 30 years connectivity has been increasing, and every information flow is a potential attack, so the attack surface increases even more.
• And attack tools and techniques get better every year as well – so it becomes ever easier for the bad guys to take advantage of the increased attack opportunities.

In short, it looks bad for our heroes. To make a bad situation worse, a lot of the advice out there, like “quick, patch everything!” is really expensive for reliability-critical sites – and almost every industrial site is reliability-critical.

I believe we need a new way of thinking about the problem. Stop seeing software vulnerabilities and misconfigurations as the problem – the problem is attacks. Stop trying to protect our data – it is our physical equipment, the safety of our workers and the productivity of our physical sites we need to protect – from incoming attack data. Do continue monitoring our industrial networks – we can only optimize what we measure, so we have to measure our security. But stop imagining that monitoring is going to save us from zero-days and other nasties.

Start controlling those incoming data and attack flows – outbound flows into the IT network have IT-class consequences. It is the inbound flows, both online and offline that can carry attacks with unacceptable physical consequences.

This is the kind of change that Waterfall Security Solutions is trying to enable with our Unidirectional Security Gateways and related hardware-based / physical protection products. There are no silver bullets, but if we can enable industrial sites to control information flows much more thoroughly than they do today, we can dramatically improve protections for industrial control systems and dramatically simplify their security programs.

from Help Net Security https://ift.tt/2RoVxpL

21% of all files in the cloud contain sensitive data

McAfee released its Cloud Adoption and Risk Report, which analyzed billions of events in anonymized customers production cloud use to assess the current state of cloud deployments and to uncover risks. The report revealed that nearly a quarter of the data in the cloud can be categorized as sensitive, putting an organization at risk if stolen or leaked.

Data in the cloud

The study found that while organizations aggressively use the public cloud to create new digital experiences for their customers, the average enterprise experiences more than 2,200 misconfiguration incidents per month in their infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) instances.

Cloud service providers only cover the security of the cloud itself, not customer data or customer use of their infrastructure and platforms. Companies are always responsible for securing their data wherever it is, hence highlighting the need to deploy cloud security solutions that span the whole cloud spectrum, from SaaS (software-as-a-service) to IaaS and PaaS.

“Operating in the cloud has become the new normal for organizations, so much so that our employees do not think twice about storing and sharing sensitive data in the cloud,” said Rajiv Gupta, senior vice president of the Cloud Security Business, McAfee. “Accidental sharing, collaboration errors in SaaS cloud services, configuration errors in IaaS/PaaS cloud services, and threats are all increasing. In order to continue to accelerate their business, organizations need a cloud-native and frictionless way to consistently protect their data and defend from threats across the spectrum of SaaS, IaaS and PaaS.”

Cloud collaboration a blessing and a curse

Cloud services bring a momentous opportunity to accelerate business through their ability to quickly scale, allowing businesses to be agile with their resources and provide new opportunities for collaboration. Cloud services like Box and productivity suites like Office 365 are used to increase the fluidity and effectiveness of collaboration. However, collaboration means sharing, and uncontrolled sharing can expose sensitive data. Findings demonstrate that:

• Twenty-two percent of cloud users share files externally, up 21 percent YoY
• Sharing sensitive data with an open, publicly accessible link, has increased by 23 percent YoY
• Sensitive data sent to a personal email address also increased by 12 percent YoY

To secure sensitive data in cloud storage, file-sharing and collaboration applications, organizations must first understand which cloud services are in use, hold their sensitive data, and how that data is being shared and with whom. Once organizations have gained this visibility, they can then enforce appropriate security policies to prohibit highly sensitive data from being stored in unapproved cloud services and provide guardrails that prevent noncompliant sharing of sensitive data from approved cloud services, such as when data is shared with personal email addresses or through an open, public link.

IaaS and the risks of misconfiguration

With SaaS, securing data, user identity and access to data is primarily the customer’s responsibility. With IaaS, customers take on a much larger share of security responsibility that includes data, identity, access, applications, network controls and host infrastructure. While this provides customers with an opportunity to have greater control over their cloud infrastructure, it also increases the organization’s surface area for security risks and their responsibility for the same. IaaS providers, like AWS, provide several infrastructure and platform services, each having deep and complicated security settings. Magnifying the IaaS/PaaS security challenge is the fact that organizations use multiple IaaS/PaaS vendors running several instances of each vendor’s product. McAfee research found:

• Ninety-four percent of IaaS/PaaS use is AWS, but 78 percent of organizations using IaaS/PaaS have both AWS and Azure
• Enterprise organizations have an average of 14 misconfigured IaaS/PaaS instances running at one time, resulting in over 2,200 individual misconfiguration incidents per month
• Five-and-a-half percent of AWS S3 buckets have world read permissions, making them open to the public

McAfee recommends that organizations continuously audit and monitor their AWS, Azure, Google Cloud Platform and other IaaS/PaaS configurations as a standard security practice, while protecting data stored in IaaS/PaaS platforms. IaaS/PaaS use is growing rapidly as an alternative to on-premises data centers. Businesses need to get ahead and address their security responsibilities—data protection and threat defense as they would for SaaS cloud services and also configuration compliance and workload protection for IaaS/PaaS cloud services—before they experience a security incident.

Cloud threats continue to grow

Compromised accounts and insider threats

Most of the threats to data in the cloud result from compromised accounts and insider threats. The average organization generates over 3.2 billion events per month in the cloud, of which 3,217 are anomalous behaviors and 31.3 are actual threat events. In addition:

• Threat events in the cloud, such as a compromised account, privileged user, or insider threat, have increased 27.7 percent YoY
• Eighty percent of all organizations experience at least one compromised account threat per month
• Ninety-two percent of all organizations have stolen cloud credentials for sale on the Dark Web
• Threats in Office 365 have grown by 63 percent YoY

To get ahead of comprised accounts and insider threats, organizations should understand how cloud services are used. They should also identify anomalous behavior, such as when the same user accesses the cloud from disparate locations simultaneously, which could indicate a compromised account threat.

As a first step towards protecting data in the cloud, cloud access security brokers (CASB) should be implemented. CASBs are cloud-native services that enforce security, compliance and governance policies for cloud services. They help organizations leverage and extend their existing security controls where appropriate and define and deploy new cloud-native ones where appropriate to enable enterprises to consistently protect their data and defend from threats across the spectrum of SaaS, IaaS and PaaS.

from Help Net Security https://ift.tt/2JnYYdm

ZeroStack delivers inter-cloud VPN-as-a-service

ZeroStack unveiled that administrators of its cloud platform can set up secure tunnels between users or networks at disparate sites, bringing a new layer of collaboration while maintaining security in multi-site cloud users.

While ZeroStack has long supported virtual firewalling or networking between tenants, the ZeroStack cloud’s security capabilities have now been expanded so a cloud administrator can enable VPN configurations for one or more tenants or Business Units (BU).

The BU administrators in turn can configure VPN tunnels between local networks and users that are located in one or more sites. In a cloud that supports two different sites, for example, the cloud administrator can use inter-cloud VPN-as-a-service to establish a secure tunnel between those two sites to give specific users access to a specific application.

“ZeroStack prides itself on offering highly granular control over users and resources,” said Michael Lin, director of product management at ZeroStack. “VPN-as-a-service establishes a new level of control by enabling secure tunneling between users and applications.”

from Help Net Security https://ift.tt/2CPNKgv

The A.V.

The A.V. Club Netflix is just going to keep killing its American Vandals | The Grapevine Al Roker Joins a Full-Color Cast in Megyn Kelly’s Today Slot | Splinter Sarah Huckabee Sanders’ First Post-Pittsburgh Briefing Was a Total Nightmare | Deadspin Steph Curry Is Still Unreal | Jezebel All The Criticisms We Have About Bella Hadid’s Disturbingly Perfect Fridge |

from Lifehacker https://ift.tt/2RlbAop

The 10 Best Deals of October 29, 2018

Here's What Hiring Managers Actually Care About

Anne Lamott Upgrades Our Lives

10 Ways To Defeat Hate And Terror With Love

Tackle Your Next DIY Project With This 170-Piece Toolset For $63

More on the Supermicro Spying Story

How to Build the Best Weightlifting Sandbag

How to Find the Light in Dark Times

The Best Ways to Spend $20, According to Reddit

How to Support Those Affected By the Pittsburgh Synagogue Shooting

Upgrade to 5.1 Surround Sound For Just $148, No Receiver Required

How to Add Chapters to Your Podcast

Let's make a fried BBBRRRAAAIIINNNSSS sandwich

Beyond “Monster Mash”: 60 minutes of killer tunes for your graveyard smash

Word documents seemingly carrying videos can deliver malicious code instead

A feature that allows anyone to embed a video directly in a Word document can be easily misused to trick target users into downloading and running malware, Cymulate researchers have demonstrated.

The attack

Producing a document that will deliver the malicious payload is easy.

An attacker must first create a Word document, fill it with whatever content they deem appropriate, then use the Insert -> Online Video option, add a YouTube video to the document and save the file.

The saved file should then be unpacked with an unpacker or by changing the .docx extension to .zip and unzipping it. These actions allow the attacker to access an XML file called document.xml in the Word folder, to open it and edit it.

Instead of the YouTube iframe code for the video (included after the embeddedHtml parameter), the attacker can choose to put a malicious HTML or JavaScript code, then save the changes, update the .docx package, and find a way to deliver the file to the target and convince them to open the file and click on the embedded video to view it.

The click will trigger the download of the embedded executable by opening Internet Explorer Download Manager. The target will be asked whether they want to run or save the file but won’t be warned about possible dangers of doing so. And, unfortunately, many users don’t think twice about clicking through the prompts and OK-ing the action if their interest is piqued.

“Attackers could use this for malicious purposes such as phishing, as the document will show the embedded online video with a link to YouTube, while disguising a hidden HTML/JavaScript code that will be running in the background and could potentially lead to further code execution scenarios,” Cymulate CTO Avihai Ben-Yossef pointed out.

What now?

The researchers consider this to be a bug and a security flaw and say that it has the potential to impact all users with Office 2016 and older versions of the productivity suite.

Microsoft has been notified of it, but for now they don’t plan to do anything about it as the software is “properly interpreting HTML as designed.”

But if the feature starts getting widely abused they might end up doing something about it.

A similar situation happened last year when, after a considerable increase of malware campaigns abusing the Dynamic Data Exchange (DDE) feature in Word, Microsoft initially said that it was a feature, not a bug, and just offered attack mitigation advice, but ultimately ended up disabling DDE by default to stem the malicious tide.

In the meantime, though, users are advised not to open unsolicited email attachments from unknown or suspicious sources and enterprise administrators to block Word documents containing an embedded video.

from Help Net Security https://ift.tt/2SteqcA