If you don’t where it is, you can’t protect it.
Do you know where ALL your organisation’s data is – not physically, but on which web and cloud services?
Here’s the problem. If you don’t where it is, then you can’t protect it. The secondary problem is finding out, because not everyone in your organisation will be onboard. It is common for people to sign up to web services because they offer something useful that helps them do their job.
They sign up using their email address and creating a password. There is the first headache – how does anyone track what has been signed up to across your organisation, let alone who has access to it? If that person leaves, no one will change the account credentials if they don’t know about it, but your ex-colleague still has access.
Secondly, what data do they upload? Is that data that you have a legal or moral responsibility for?
There’s nothing noble about Nobelium.
This isn’t theory – it’s real. USAID is a pretty important US organisation – promoting democracy and human rights around the world. Turns out, someone there was using a well-known email database tool called Constant Contact. But their account wasn’t well protected. Worse still, their account had a huge mailing set up, and of course, it had all the official USAID templates.
So, these Nobelium people, allegedly a Russian state-sponsored hacker group, compromised the Constant Contact account and sent a bulletin out. The bulletin contained malware that allowed the hackers to take command and control over victims computers. Ironically the fake email alleged interference in the US federal elections.
So, what can you do?
The first step is knowing what SaaS tools your people are using. We call this SHADOW IT and it is inevitable. Rather than stopping it, the job IT has is to identify it and manage it. The second step is to secure those platforms. That’s why our KARE for Security S2 plan contains a useful tool to help you identify what services your people are using.
Refer : What We Know About The Apparent Russian Hack Exploiting USAID : NPR
Is automated Microsoft patching enough?
Microsoft have been releasing patches for 30 years. It’s easy to become blasé about them. Yes, Microsoft can automatically apply updates to Windows and Office. But that does not mean that you can rely on it. Any system is only as good as how well it is monitored....
Beware of “Pig-Butchering” – a new trend in Social Engineering
Where do these names come from? The latest trend is referred to as Pig-Butchering. The name comes from the Chinese underworld (shāzhūpán). The term refers to fattening up a pig, taking a longer-term view. They develop their target slowly, looking to get maximum...
What does the LastPass breach mean for you?
There have recently been a couple of well-publicised breaches of LastPass. Most people will be familiar with LastPass but in case you are not, it’s a well-known and popular password vault/manager.Does this mean you shouldn’t use a password vault? Absolutely not. YOU...
Are you making the most of your password manager?
Passwords are the basic protection for our various online accounts. It amazes me how basic some people’s passwords are. Passwords like, well ‘password’ or ‘123456’ are still commonly in use! In case that sounds unbelievable, here’s a list of the top 200 for...
Kinetics KARE clients – we’ve just added a layer of security
With the latest news of yet another local New Zealand high-profile cyber attack, it must be obvious that cyber-threats are real. EVERYONE is at risk of cyber attack! This latest incident is particularly close to home for me, because I chair the board of one of the...
Multifactor Authentication (MFA) gets even more secure!
Microsoft are making their authenticator even safer! Most of us will have experienced random pop-ups on authenticator asking us to approve access to our systems. We will have wondered what triggered it. Is it a hacker? Now we'll be able to get more information. Your...
Is your cyber-insurer testing your business?
Over the last month, we’d heard about this happening in the US and now it seems to be happening in NZ as well. Cyber insurers are working hard to mitigate their risk and that includes stepping up their testing of their clients. Right now, that appears to be more...
Is public WiFi safe?
Free public WiFi can be tempting.Whether it is in cafe, an airport or a shopping centre, free Wi-Fi is very tempting. Who wouldn’t want faster data, without the cost. But, as with anything that is free, be very careful! It is very easy to become a victim of something...
What can you expect if you get crypto-locked?
!Right now, there’s a crypto-locked server in the lab in our Kinetics Auckland Office. It’s not from one of our clients, but a business that’s come to us, after the event, asking for help. We are busy rebuilding it and restoring the data and configuration to the...
Are you meeting the requirements of your Cyber Insurer? (And are you minimising your risk anyway?)
Given the scale of cyber-attacks, we aren’t surprised to be hearing reports of insurers applying a "duty of care" test before agreeing to pay out. Despite sending chills up your spine, when you consider this, it makes sense as Insurers do the same thing to vehicles,...