For consumers

GUEST ESSAY: How to detect if a remote job applicant is legit — or a ‘Deepfake’ candidate

By Zac Amos

Technology provides opportunities to positively impact the world and improve lives.

It also delivers new ways to commit crimes and fraud. The U.S. Federal Bureau of Investigation (FBI) issued a public warning in June 2022 about a new kind of fraud involving remote work and deepfakes.

The making of Deepfakes

The world is on track to see around 50% of workers transition to sustained, full-time telecommuting. Conducting job interviews online is here to stay, and deepfakes may be part of that new normal.

The term refers to an image or video in which the subject’s likeness or voice was manipulated to make it look like they said or did something they didn’t.

The deepfake creator uses “synthetic media” applications powered by machine learning algorithms. The creator trains this algorithm on two sets of videos and images. One shows the target’s likeness as they move and speak in various environments. The second shows faces in different situations and lighting conditions. The application encodes these human responses as “low-dimensional representations” to be decoded into images and videos.

The result is a video of one individual convincingly overlaid with the face of another. The voice is more difficult to spoof.

Q&A: Here’s how the ‘Matter’ protocol will soon reduce vulnerabilities in smart home devices

By Byron V. Acohido

After years of competitive jockeying, the leading tech giants have agreed to embrace a brand new open-source standard – called Matter – that will allow consumers to mix and match smart home devices and platforms.

After numerous delays and course changes, the Matter protocol, is set to roll out this fall, in time for the 2022 holiday shopping season. To start, seven types of smart home devices will be capable of adopting the Matter protocol, and thus get affixed with a Matter logo.

Matter is intended to foster interoperability of smart home devices – so a homeowner can stick with just one voice assistance platform and have the freedom to choose from a wide selection of smart devices sporting the Matter logo.

What this boils down to is that a consumer living in a smart home filled with Matter devices would no longer be forced to use Amazon’s Alexa to control some devices, while having to switch to Apple’s Siri, Google’s Assistant or Samsung’s SmartThings to operate other devices. No surprise: Amazon, Google, Apple and Samsung are the biggest names on a list of 250 companies supporting the roll out of Matter.

The qualifying types of smart home devices, to start, include light bulbs and switches; smart plugs; smart locks; smart window coverings; garage door openers; thermostats; and HVAC controllers. If all goes smoothly, surveillance cams, smart doorbells and robot vacuums would soon follow.

Byron Acohido · A primer on the importance of 'attack surface management'

FIRESIDE CHAT: ‘Attack surface management’ has become the centerpiece of cybersecurity

By Byron V. Acohido

Post Covid 19, attack surface management has become the focal point of defending company networks.

As digital transformation continues to intensify, organizations are relying more and more on hosted cloud processing power and data storage, i.e. Platform as a Service (PaaS,) as well as business tools of every stripe, i.e. Software as a Service (SaaS.)

I had the chance to visit with Jess Burn, a Forrester senior analyst, about the cybersecurity ramifications.

Guest expert: Jess Burn, Senior Analyst, Forrester Research

We discussed how the challenge has become defending the cloud-edge perimeter. This entails embracing new security frameworks, like Zero Trust Network Access, as well as adopting new security tools and strategies.

This boils down to getting a comprehensive handle on all of the possible connections to sensitive cyber assets, proactively managing software vulnerabilities and detecting and responding to live attacks.

A new category of attack surface management tools and services is gaining traction and fast becoming a must-have capability. To learn more, please give the accompanying Last Watchdog Fireside Chat podcast a listen.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

GUEST ESSAY: The case for physically destroying — and not just wiping clean — old hard drives

By Kyle Mitchell

Cybersecurity poses a risk to all businesses.

Dataprot reports that 59 percent of Americans have experienced cybercrime in the past. An estimate stated that $6 trillion worth of damage was caused by cybercrime in 2022, making it vital for businesses to securely destroy data.

Deleting information from a hard disk drive (HDD) is not enough. Hackers can recover data from physical drives, even when the information has been removed. When businesses have spent years building trust with customers, it is important to take the necessary precautions to protect data and the brand’s reputation by destroying data effectively.

Limits to wiping

Deleting files isn’t enough to keep data safe. With the right tools, hackers can retrieve deleted files. Depending on the operating system, there may be built-in tools to erase data. This is a quick and convenient method but third-party utilities offer a greater level of security.

DBAN is a free tool but is limited in its abilities, as it only works on hard drives and not solid-state drives (SSD). Working independent of the operating system (OS), DBAN can wipe the entire machine. This is important for any businesses upgrading their hardware to new technology, as it allows for the safe transfer of data before it is removed from old machines.

Other tools, such as CCleaner, require an upgrade to the premium version in order to fully wipe data, and cannot wipe the drive hosting the OS as this is where it will be installed.

GUEST ESSAY: Advanced tools, tactics required to defend latest attack variant — ‘DeepSea phishing’

By Michael Aminov

Phishing itself is not a new or a particularly complicated threat. But the emergence of advanced phishing techniques – “DeepSea Phishing” – poses an entirely new challenge for enterprises.

Related: Deploying human sensors

Phishing comes with a simple premise – lure someone to interact with a malicious link, file, or credentials-input, disguised as a legitimate email or website.

The financial impact of phishing attacks quadrupled over the past six years, with the average cost for U.S. companies rising to $14.8 million in 2021, compared with $3.8 million in 2015.

Despite increased public awareness of cybersecurity risks and safe browsing practices, the impact of phishing has increased exponentially – IBM’s 2021 Cost of Data Breach Report found phishing to be the second most expensive attack vector for enterprises.

Novel tactics

This is so, in part, because growing awareness has pushed hackers to create even more sophisticated means to plunder log-in information, or to lure employees to click on a malware-infected link – AKA next-gen, or “DeepSea” phishing.

These attacks use novel and rarely seen phishing techniques, often employing several layers of deception in parallel. Take this recent phishing attempt, which was identified by Perception Point’s Incident Response team:

Q&A: Here’s why VPNs are likely to remain a valuable DIY security tool for consumers, SMBs

By Byron V. Acohido

It is astounding that billions of online accounts have been breached over the past 18 years and that US consumer accounts are by far the most compromised.

Related: VPNs vs ZTNA

Now comes hard metrics quantifying the scope of this phenomenon. It’s in findings of a deep dive data analytics study led by Surfshark, a supplier of VPN services aimed at the consumer and SMB markets.

Surfshark partnered with a number of independent cybersecurity researchers to quantify the scope and pattern of data breaches over the past couple of decades. For this study, a data breach was defined as an intruder copying or leaking user data such as names, surnames, email addresses, passwords, etc. Much of the hard evidence came from correlating breached databases sitting in the open Internet.

Data scientists sorted through 27,000 leaked databases and created 5 billion combinations of data. Researchers could then sort those combinations based on specific data points, such as countries, and perform a statistical analysis of their findings.

The data analytics show:

•A total 2.3 billion U.S. accounts have been breached so far. The scale is so massive that it makes up 15 percent of all breached users globally since 2004 (the year data breaches became widespread)

•More than two thirds of American accounts are leaked with the password, putting breached users in danger of account takeover.

GUEST ESSAY: The Top 5 online privacy and data security threats faced by the elderly

By Lyle Solomon

What is it about the elderly that makes them such attractive targets for cybercriminals? A variety of factors play a role.

Unlike many younger users online, they may have accumulated savings over their lives — and those nest eggs are a major target for hackers. Now add psychological variables to the mix of assets worth stealing.

Perhaps elderly folks who haven’t spent a lot of time online are easier to deceive. And, let’s be honest, the deceptive writing phishing assaults and other cyber threats today employ are skilled enough to fool even the most trained, internet-savvy experts.

Ever present threats

Some of our elderly may be concerned that any hint of weakness will convince their relatives that they can no longer live alone. Thus hackers rely on them not revealing they’ve been duped. That said, here are what I consider to be the Top 5 online threats seniors face today:

•Computer tech support scams. These scams take advantage of seniors’ lack of computer and cybersecurity knowledge. A pop-up message or blank screen typically appears on a computer or phone, informing you that your system has been compromised and requires repair.

Older Articles »

The Last Watchdog

For consumers

GUEST ESSAY: How to detect if a remote job applicant is legit — or a ‘Deepfake’ candidate

By Zac Amos

Q&A: Here’s how the ‘Matter’ protocol will soon reduce vulnerabilities in smart home devices

By Byron V. Acohido

FIRESIDE CHAT: ‘Attack surface management’ has become the centerpiece of cybersecurity

By Byron V. Acohido

GUEST ESSAY: The case for physically destroying — and not just wiping clean — old hard drives

By Kyle Mitchell

GUEST ESSAY: Advanced tools, tactics required to defend latest attack variant — ‘DeepSea phishing’

By Michael Aminov

Q&A: Here’s why VPNs are likely to remain a valuable DIY security tool for consumers, SMBs

By Byron V. Acohido

GUEST ESSAY: The Top 5 online privacy and data security threats faced by the elderly

By Lyle Solomon