Guest Blog Post

SHARED INTEL: The non-stop advance and diversification of ransomware extortion tactics

By Zac Amos

Cybercriminals are becoming more creative as cybersecurity analysts adapt quickly to new ransomware strategies.

Ransomware has evolved from classic attacks to more innovative approaches to navigate reinforced security infrastructure.

Here’s how hackers crafting new ransomware extortion tactics to keep analysts on their toes:

Data exfiltration is no more. Most ransomware attacks follow a familiar formula — the hacker gets into a network, grabs data and takes it out to hold onto until the company pays. This storyline is flipped on its head if ransomware hackers decide to destroy information when companies don’t pay the ransom.

This increases the stakes, primarily if entities did not engage in proper backup protocols before the attack. This is known as data destruction. It makes scenarios worse if hackers remain in the network,

GUEST ESSAY: A roadmap to achieve a better balance of network security and performance

By Sashi Jeyaretnam

Here’s a frustrating reality about securing an enterprise network: the more closely you inspect network traffic, the more it deteriorates the user experience.

Slow down application performance a little, and you’ve got frustrated users. Slow it down a lot, and most likely, whichever knob you just turned gets quickly turned back again—potentially leaving your business exposed.

It’s a delicate balance. But there’s something you can do to get better at striking it: build that balance into your network testing and policy management.

Navigating threats

Why do so many businesses struggle to balance network security and user experience? Because recent trends create new challenges on both sides of the equation. Trends like:

•More distributed users and applications. Even before COVID, enterprises saw huge increases in people working outside the traditional corporate firewall. Today, users could be working anywhere, accessing applications and data from any number of potential vulnerable public and private clouds. It adds up to a much larger potential attack surface.

GUEST ESSAY: Sure steps to achieve a robust employee cybersecurity awareness training regimen

By Idrees Shafiq

Employee security awareness is the most important defense against data breaches.

It involves regularly changing passwords and inventorying sensitive data. Cybercriminals view employees as a path of least resistance. As such, you should limit the amount of information that employees have access to.

There are several ways you can protect your business from data breaches.

•Create security awareness for employees. One of the most important ways to protect against data breaches is to increase employee security awareness. Employees are the first line of defense against cybercrime and should understand how to recognize phishing emails and what to do if they suspect them. With proper training, employees can prevent these attacks before they happen.

While the protection of the company’s assets can never be completely guaranteed, security awareness training should be a top priority for business owners. Without it, a business is vulnerable to a variety of risks, including financial loss, damage to intellectual property, and brand reputation.

SHARED INTEL: A breakout of how Google, Facebook, Instagram enable third-party snooping

By Federico Morelli

More and more consumers are using apps every year. In fact, Google Play users downloaded 111.3 billion apps in 2021 alone, up more than 47 percent since 2018.

This increased demand for apps also raises the need for improved data protection measures, which Google took steps to address with the new data safety section they launched in July 2022.

This data safety section aims to help users understand how apps handle their data (especially when it comes to collection and sharing) and make more informed decisions about which apps to download.

To provide even further insight into the data safety and privacy practices of app developers, researchers at Incogni conducted a study of the top 500 paid and top 500 free Google Play Store apps. The results shed light on how much data apps really share, which apps pose the biggest risks to data privacy, and how transparent developers are about their practices.

Rampant ‘sharing’

The study revealed that more than half (55.2 percent) of the apps share user data with third parties.

GUEST ESSAY: Privacy risks introduced by the ‘metaverse’ — and how to combat them

By Vivek Nair and Gonzalo Munilla Garrido

As digital technologies become more immersive and tightly integrated with our daily lives, so too do the corresponding intrusive attacks on user privacy.

Virtual reality (VR) is well positioned to become a natural continuation of this trend. While VR devices have been around in some form since well before the internet, the true ambition of major corporations to turn these devices into massively-connected social “metaverse” platforms has only recently come to light.

These platforms, by their very nature, turn every single gaze, movement, and utterance of a user into a stream of data, instantaneously broadcast to other users around the world in the name of facilitating real-time interaction. But until recently, the VR privacy threat has remained entirely theoretical.

Berkeley RDI is a preeminent source of open-access metaverse privacy research. To test the true extent of data collection in VR, we designed a simple 30-person user study called MetaData. Users were asked to play an innocent-looking “escape room” game in VR, while in the background, machine learning scripts were secretly observing their activity and trying to extract as much information about them as possible.

GUEST ESSAY: Restore Us Institute (RUI) aims to protect Americans from online harms and crimes

By Scott Cleland

How did America and Americans regress to being much less secure than before the Internet?

Everyone knows the many amazing conveniences, benefits, and advances the Internet has enabled. What everyone doesn’t know is how irrational the Internet’s utopian founding premises have proven to be concerning America’s and Americans’ security over the last quarter century.

The first irrational security-related premise is that U.S. Government policymakers decided in the 1990s to promote inherently insecure, nascent Internet technology to be the world’s primary global information infrastructure for all the world’s communications, content, and commerce.

Unfortunately, the Internet was never designed to operate at that scale, or with the necessary authentication, security, and privacy capabilities essential for such an infrastructure. Utopia meet reality.

The Internet’s co-designer, Vint Cerf, in a 2008 Guardian interview, explained how the Internet’s 1974, essential enabling Internet-protocol had a design flaw in not enabling packet authentication, security, or privacy at scale.

GUEST ESSAY: These advanced phishing tactics should put all businesses on high alert

By Zac Amos

Phishing attacks are nothing new, but scammers are getting savvier with their tactics.

The Iranian hacker group TA453 has recently been using a technique that creates multiple personas to trick victims, deploying “social proof” to scam people into engaging in a thread. One example comes from Proofpoint, where a researcher began corresponding with an attacker posing as another researcher.

Other Iranian-based cyberattacks have included hackers targeting Albanian government systems and spear phishing scams. According to a new study, phishing attacks rose 61 percent in 2022, with cryptocurrency fraud increasing 257 percent year-over-year.

Companies and consumers must be more cautious than ever when using their devices. Here are four new phishing trends keeping businesses on their toes.

Spear phishing

Spear phishing attacks have taken the dangers of traditional phishing to another level, mainly because it’s highly targeted and precise.

Nowadays, small businesses are more susceptible to spear phishing since they lack the IT security infrastructure in larger organizations. As more people work remotely, companies must be vigilant when sending and filling out online forms, such as login pages — a newly-preferred mode of enticing potential victims.

« Newer Articles

Older Articles »

The Last Watchdog

Guest Blog Post

SHARED INTEL: The non-stop advance and diversification of ransomware extortion tactics

By Zac Amos

GUEST ESSAY: A roadmap to achieve a better balance of network security and performance

By Sashi Jeyaretnam

GUEST ESSAY: Sure steps to achieve a robust employee cybersecurity awareness training regimen

By Idrees Shafiq

SHARED INTEL: A breakout of how Google, Facebook, Instagram enable third-party snooping

By Federico Morelli

GUEST ESSAY: Privacy risks introduced by the ‘metaverse’ — and how to combat them

By Vivek Nair and Gonzalo Munilla Garrido

GUEST ESSAY: Restore Us Institute (RUI) aims to protect Americans from online harms and crimes

By Scott Cleland

GUEST ESSAY: These advanced phishing tactics should put all businesses on high alert

By Zac Amos