Category Archives: Internet Security
To protect the future of the internet, US-led tech diplomacy must change tack – TechCrunch
Andrew BennettContributor
Andrew Bennett is a senior policy analyst at the Tony Blair Institute for Global Change, focused on internet policy and geopolitics. He recently co-authored "The Open Internet on the Brink: A Model to Save Its Future."
TheTechCrunch Global Affairs Projectexamines the increasingly intertwined relationship between the tech sector and global politics.
In the wake of its recent Democracy Summit, the U.S. has proposed that like-minded democracies should form a new Alliance for the Future of the Internet to uphold open, liberal values online. The latest in a long line of cooperation initiatives, it is a promising candidate for delivering progress. But in its current guise, it risks falling short. Now, with disagreements between officials delaying the launch, the U.S. must take this opportunity for a rethink.
The underlying logic behind the Alliance remains sound: Internet freedoms are increasingly under threat globally, governments are competing to assert their authority, and a decades-long governance system formed of voluntary bodies is now creaking. As Tim Wu, adviser to the Biden administration on tech policy, recently said, we are on the wrong trajectory. Against this backdrop, a new initiative to promote and defend open, liberal values in the internet era is sorely needed.
In practice, however, the U.S. focus on like-minded democracies working together risks undermining its own objectives. Thats because the future of the open internet will not be secured either by a small club of democracies talking only to themselves or by employing coercion alone. Instead, any Alliance must be far more inclusive, focusing on setting the economic and security incentives right from day one to build a wide and sustainable coalition for the long term.
This would represent a much more internationalist approach to internet policy than the U.S. has usually needed to take. For decades, Americas outsized jurisdictional power has underwritten the open internet model: Despite only 7.1% of the worlds internet users being based in the U.S., it is home to 61% of core infrastructure services for the global internet. Its dominance has supported the model of permissionless innovation, interoperable networks and dumb pipes infrastructure that cant see what content it is transporting which has generated such immense economic and social value. Only China, home to 19% of global internet users, has comparable geopolitical sway.
Yet U.S. hegemony can be relied upon no longer to maintain a free internet. Many countries are at a tipping point in how they govern the internet, with authoritarian internet models including censorship, surveillance and shutdowns quickly gaining ground. And today, 3.7 billion people still do not have internet access.
As connectivity improves, the developing countries that are home to most of this group will come to determine the future of the internet and at present they are likelier to receive the necessary financing from China than anywhere else. The shift to a multipolar internet is a given, but its direction open or closed, liberal or authoritarian is not.
On these trends, focusing only on cooperation among todays democracies amounts to overindexing on an ever-smaller section of the internet. Organizing solely around values also highlights those areas where traditional allies are not yet in agreement, such as the EU and U.S. on several areas of internet regulation. For any alliance to succeed, therefore, it must move beyond the accepted clich of like-minded partners and adopt a twin approach prioritizing economic and security incentives alongside commitments on internet openness, such as a ban on internet shutdowns to encourage a broader set of countries to join.
This strategy will be particularly important to convince those countries that are increasingly considering more restrictive internet policies. For example, since 2015, 31 of 54 African countries have blocked access to social media to some degree. Undoubtedly, some of these shutdowns have been due to overt repression and must be met with a strong international response. Yet other interventions have been less ideological: When violent content online has left leaders worried about public safety, a combination of muddled policy, low state capacity and underinvestment in content moderation from major social media services has led to regrettable actions that might otherwise have been avoided with greater support.
It is not too late to arrest this trend and secure core internet freedoms. But such efforts will not succeed through coercion alone. While the fight against authoritarianism is crucial, allowing every debate to get wrapped up into polarized democracies versus authoritarians language can actually close off opportunities for cooperation, only accelerating greater restrictions and fragmentation. The effect of this corrosive discourse can already be seen in Africa, where the West too often treats states as little more than sites for proxy battles in a larger U.S.-China cold war. Neither of these conceptions are helpful.
China is not a monolith: It is a partner, competitor and adversary to the West all at once. The U.S., EU and others cannot force China out of the global internet infrastructure market, and nor should they want or need to. Africa, the U.S. and China would all be better served by a globally competitive market for internet infrastructure, with no one state either monopolizing provision or footing the entire bill.
Similarly, not only do African countries have their own political priorities and challenges, but it is often in the Wests own economic interests to offer support. Connecting all 3.7 billion people without internet access would, for example, cost just 0.02% of the gross national incomes for OECD states a group of countries including the U.S., UK, Korea and Japan while generating a huge 25x return.
Yet when the G7 launched its Build Back Better World project this year, designed to compete with Chinas infrastructure offer, it came with no new money. Meanwhile there has been little effort to reform World Bank and IMF development programs, which the U.S. could influence, despite them being uncompetitively bureaucratic, risk averse and expensive for many African leaders facing fragile development pathways and urgent job-creation demands.
For years, weve lacked the necessary political leadership and ambition for a program of this kind. But the Alliance for the Future of the Internet has the potential to provide a reset. To succeed, it must show there is no pathway to prosperity that undermines core internet freedoms, while also providing the right guidance and incentives to enable a different approach. While there will always be some countries who never sign up, these strong incentives could persuade many swing states such as Indonesia, Kenya or Brazil to join. Only by building wide, internationalist coalitions that are in everyones economic and security interests to sustain will the open, global internet truly be protected for the long term.
Go here to see the original:
To protect the future of the internet, US-led tech diplomacy must change tack - TechCrunch
Anxinsec won two awards of the Top 100 of Cybersecurity Innovation Capability 2021 by ISC – PRNewswire
BEIJING, Dec. 22, 2021 /PRNewswire/ -- In the middle of December 2021, initiated by Internet Security Conference (ISC), the award ceremony of Top 100 of Cybersecurity Innovation Capability 2021, also referred to as "Innovation Top 100", was successfully concluded in both Beijing and Shanghai. ISC, founded in the Asia-Pacific region, is a global security summit with high specifications, wide radiation and far-reaching influence.
As one of the candidates, Anxinsec won the award of top 10 cybersecurity companies of innovation capability 2021, and its Memory Protection System was shortlisted for the top 100 products of innovation capability in endpoint security field. Additionally, as one of the cutting-edge forces among the top 10 companies entering the hall of fame for future digital security by ISC, Anxinsec will jointly leverage the future of cybersecurity innovation and comprehensively empower the digital transformation to high-quality development.
Meanwhile, in the recently-published 2021 China Digital Security Capability Map by one of the co-sponsors of Innovation Top 100- a credible and independent research agency in digital industry in China- Digital World Consulting, Anxinsec has been selected as the innovator in endpoint security field, the application scenarios of AD domain security and risk and threat assessment.
As a leading company of memory security and a delver in endpoint security, Anxinsec has always taken technological innovation as its core support of enterprise development, by taking the lead in adopting hardware virtualization and context behavior analysis to form three-dimensional protection in the application-layer, system-layer and hardware-layer. We build security defense for endpoints from the bottom layer, and it is well applied to attack and defense exercise, AD domain defense, memory Webshell defense and other scenarios.
Equipped with a strong expert service team and senior information security experts with more than 10 years of security service experience, Anxinsec provides clients with Regulatory and Standard Compliance Consultation, Compromise Assessment, Penetration Test and Red/Blue Team Test. By delivering those services, what we want to achieve is to help organizations comply with cybersecurity law and privacy protection regulations, prevent or mitigate legal and regulatory risks, build up brand credit and reputation, earn trust from customers and investors, and boost business performance.
SOURCE Anxinsec
Read more from the original source:
Anxinsec won two awards of the Top 100 of Cybersecurity Innovation Capability 2021 by ISC - PRNewswire
How to disable your webcam and protect it from hackers – for free – TechRadar
Webcams are great for sharing moments with friends and family, but not so much if you're being spied on by rogue websites or malicious apps.
Antivirus software providers like Avast, Bitdefender, Norton and others have internet security suites which warn you about unauthorized access to your webcam, and allow you to block untrusted apps.
There's no need to spend big money or install heavyweight security suites just to take more control over your webcam, though. Tweak a system setting or two, and you can do it right now...and for free!
If you're mostly concerned about websites accessing your camera, then the solution could be just a browser click or two away.
In Chrome, for instance, click Settings, Privacy and Security, Site Settings. Scroll down, click Camera and make sure the default is set to 'Don't allow sites to use your camera'.
If you're at a site and decide it should be able to use your webcam after all, just click the site (padlock) icon to the left of the address bar, and click the 'Camera: not allowed' switch to turn it on. Chrome still blocks webcam access for other websites, but this one will be able to use the camera in future.
You'll find a similar options in Firefox, at Settings > Privacy and Security > Camera Permissions in Firefox. And in Safari, visit Preferences, Websites, Camera, and make sure 'all other websites' is set to Deny.
Controlling browser access to your webcam is a smart way to prevent external attacks, but there's the possibility that a rogue app might be capturing frames without your knowledge.
Fortunately, most platforms have permission-based systems which give you control over what an app can do, and what it can't. Set the default Camera permission to Off, and no app can access your webcam until you specifically approve it. (In theory, anyway. Real life can be more complicated, but we'll talk about that in a moment.)
In Windows, press Win+I to launch Settings, then click Privacy, Camera.
Scroll down and you'll find switches to disable webcam access for specific apps. Or for more security, set 'Allow apps to access your camera' off to block Microsoft Store apps, and disable the 'Allow desktop apps to access your camera' setting to cover everything else.
Life is a little simpler on mobile devices, where you can usually just disable permissions for your camera app. On Android, go to Settings, Apps, Camera, Permissions, Disable; on iOS, go to Settings, Restrictions, Camera, Disable.
App permissions systems work well, most of the time, but there are exceptions. For instance, Windows can only control webcam use for apps which use standard Windows commands to access your hardware. If an app installs a driver, or uses some other sneaky trick of its own, turning webcam permissions off may not make any difference at all.
If you really want to turn off a webcam completely, then - to make nothing can use it, at all - you'll get better results by disabling it at the device or the driver level.
In Windows, click Start, type Device Manager and press Enter. Click the arrow to the left of Cameras to expand the device list, right-click your camera and select Disable. (Right-click and choose Enable if you need to restore access to the camera, later.)
Other platforms don't typically give access to devices at this level. There are apps which might be able to help, but beware - they can cause new problems.
The Permanently Disable Camera Android app turns off your camera ever, for instance, and even blocks factory resets to prevent you getting it back. It works, but that's a serious step, and you should be very sure what you're doing before you try it. (Just read the reviews for plenty of people who didn't realize 'permanently disable' really did mean 'permanently.')
If that's a little too scary, there's always the tried-and-tested 'stick some tape over the lens' route. Not exactly stylish, but it works, and it's very easy to reverse when you find you need your camera, after all.
Today's best webcams deals
Read more:
How to disable your webcam and protect it from hackers - for free - TechRadar
1.1 billion identities were recently exposed to theft Here’s how to find out if you’re at risk – Salt Lake Tribune
Sponsored: Were you exposed?
(Getty Images) Is your identity protected?
| Dec. 21, 2021, 7:00 a.m.
Symantec Corporations most recent Internet Security Report is 77 pages but heres the scary truth:
They report 1,209 breaches in recent years.
15 of those breaches exposed more than 10 million identities, deeming them mega breaches.
The total number of identities exposed soared to 1.1 billion
The average number of identities exposed in each breach were 927,000.
Do note, these numbers are from across the globe. However, the United States sits pretty (or not) at the top the list of the top 10 countries by number of identities stolen.
The best way to quickly check is to peek at your credit. You might know federal law entitles you to one free credit report per year.
But your annual report doesnt include your actual credit scores, which are a nice, easy benchmark for figuring out if somethings wrong.
Most companies will charge you for this information which is why we like the free website Credit Sesame.
Once you create a free account, the first thing youll see is a user-friendly overview of your current credit situation, including a TransUnion score.
Even if youre pretty sure youre not a victim of identity theft, its worth checking out. I mean, its free, and its always good to know where you stand
It takes 90 seconds to sign up and see if your identity was stolen.
The internet runs on free open-source software. Who pays to fix it? – MIT Technology Review
To support MIT Technology Review's journalism, please consider becoming a subscriber.
For something so important, you might expect that the worlds biggest tech firms and governments would have contracted hundreds of highly paid experts to quickly patch the flaw.
The truth is different: Log4J, which has long been a critical piece of core internet infrastructure, was founded as a volunteer project and is still run largely for free, even though many million- and billion-dollar companies rely on it and profit from it every single day. Yazici and his team are trying to fix it for next to nothing.
This strange situation is routine in the world of open-source software, programs that allow anyone to inspect, modify, and use their code. Its a decades-old idea that has become critical to the functioning of the internet. When it goes right, open-source is a collaborative triumph. When it goes wrong, its a far-reaching danger.
Open-source runs the internet and, by extension, the economy, says Filippo Valsorda, a developer who works on open-source projects at Google. And yet, he explains, it is extremely common even for core infrastructure projects to have a small team of maintainers, or even a single maintainer that is not paid to work on that project.
The team is working around the clock, Yazici told me by email when I first reached out to him. And my 6 a.m. to 4 a.m. (no, there is no typo in time) shift has just ended.
In the middle of his long days, Yazici took time topoint a finger at critics, tweetingthat Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we arent paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns.
Before the Log4J vulnerability made this obscure but ubiquitous software into headline news, project lead Ralph Goers had a grand total of three minor sponsors backing his work. Goers, who works on Log4J on top of a full-time job, is in charge of fixing the flawed code and extinguishing the fire thats causing millions of dollars in damage. Its an enormous workload for a spare-time pursuit.
The underfunding of open-source software is a systemic risk to the United States, to critical infrastructure, to banking, to finance, says Chris Wysopal, chief technology officer at the security firm Veracode. The open-source ecosystem is up there in importance to critical infrastructure with Linux, Windows, and the fundamental internet protocols. These are the top systemic risks to the internet.
Read the rest here:
The internet runs on free open-source software. Who pays to fix it? - MIT Technology Review
Coles, Westpac, AMP and Department of Defence caught up in ‘significant’ data breach of Finite Recruitment – ABC News
The personal details of job applicants and staff at a range of major Australian companies and government agencies have potentially been exposed in a "significant"data breach and extortion attempt against Australian recruitment company Finite.
Hackers have accessed and releasedsensitive data that includes resumes, offers of employment, contracts,timesheets and vaccine certificates, with the likely goal of extracting a ransom.
Finite has a long list of major Australian clients, including Coles, Westpac, AMPand the departments of Defence, Health and Home Affairs.
Conti the same hacking group responsible for the data breach affecting up to 80,000 South Australian government employees disclosed last weekhas so far released more than 12,000 files and is threatening to publish more.
A notice posted on the hacking group's website, designed to extract a ransom payment, claims more than 300 gigabytes of data has been stolen, including financials, contracts, customer databases, phone numbers, addresses, passports and a variety of other sensitive personal information.
Finite Recruitment said in a statement sent to the ABC that the data "relates to a one-off cyber incident that occurred back in October", adding that the incident was still being investigated and affected parties would be notified when the investigation concluded.
"We are aware that a small subset of Finite Group's data has been downloaded and published on the dark web," the statement said.
An Australian Cyber Security Centre profile of the hacking group notes that "leaked information is hosted on The Onion Router (TOR) network, enabling greater anonymity to Conti threat actors hosting illicitly obtained material".
However, the group appears to have more recently been posting leaked data on a regular website available to all internet users. The ABC was able to view and access leaked files using a standard web browser.
The data already released includes the personal details of Australians who have sought employment through the firm, including resumes, salary information, reference checks, criminal history checks and visa checks.
A long list of businesses, banks and government agencies were caught up in the leak by way of their ties with Finite, including Westpac, ME Bank, Coles, Adairs, AMP, Suez Australia, NBN Coand the departments of Defence, Home Affairs and Health.
Some of Finite Recruitment's clients contacted by the ABC said they were aware of the leak, while others had not been notified.
A federal health spokesperson saidthe department useda range of hire firms, including Finite Group APAC Pty Ltd, but didnot share "any sensitive or classified data" with those providers.
"The department has not received any correspondence from Finite Group APAC Pty Ltd regarding any security breach or data loss," aspokesperson said.
Coles which has a service agreement with Finite Recruitment and was listed in the leaked documents said it was conducting its own investigations into the breach.
"We have engaged directly with Finite to understand what steps they are taking to investigate the incident and to secure their systems, and to assess any impact to Coles contractors or team members," a Coles spokesperson said.
Australian National University which was also listed in the breach said in a statement that it had not been informed of this data breach, but added there was nothing to suggest its systems were currently under threat.
The ABC also contacted the departments of Defence and Home Affairs, but neither wasable to respond in time for publication. The ABC also reached out to Downer, IBM, AMP, Hostplusand the Australian Cyber Security Centre for comment.
Conti is a Russian-based criminal organisation behind ransomware technologies. In short, they're after money.
Canberra-based cyber security researcher Robert Potter saysConti is a highly professionalised hacking group which uses a variety of well-known tools to gain access to its target'snetworks before stealing data and seeking a ransom.
Ransomware attacks work by encrypting victims' data, rendering it inaccessible. Groups will then offer to sell the victim a decryption key to re-access that data.
If the victim doesn't give in to the attackers' demands, they can permanently lose access to the data.
Conti affiliates are also known to use a technique known as "double-extortion",which involves threatening to release the stolen data unless payment is made.
Mr Potter saidthe group was becoming more brazen and was quite open about who they havetargeted in recent times.
He saidConti was increasinglyideological, sometimes using Russian foreign policy talking points, suggesting this might be a tactic to appeal to the people who provide them protection.
"Conti are doing a roaring trade, they're not subtle," Mr Pottersaid.
Conti attacks have made headlines before for targeting high-profile organisations, demanding large amounts of money asransom in exchange for agreeing not to publish full data leaks.
ProDraft a cyber security and intelligence company that monitors incidents of potential cybercrime said,that since 2020, it hadseen data from 567 different companies shared on Conti's extortion site. ProDraft also says its teams have noticed a recent surge in Conti attacks.
"Conti has shown itself to be a particularly ruthless group, indiscriminately targeting hospitals, emergency service providersand police dispatchers," the report said.
Conti is also offered as a Ransomware-as-a-Service (RaaS). This allows affiliates to use the ransomware as they want, as long as a percentage of the ransom payment is shared with the Conti operators as commission.
Research carried out by ProDraft found that, since July 2021, Conti has received more than500 bitcoin in ransomware payments which, at the time of writing, was worth $32.8 million.
According to Mr Potter, Conti is sophisticated enough that they take an "almost actuarial approach"to determining ransom amounts, even targeting a dollar value close to what they think an organisation's insurance will cover.
Mr Potter saidmost Australian organisations hit by ransomware attacks did notpay up, which isthe right move.
However, he wasaware of at least one large ransom payment from an Australian-based organisation targeted by Conti.
Zimperium and Intertrust Partner to Provide End-to-end Security for IoT devices in Zero-trust Environments – PRNewswire
DALLAS and SAN FRANCISCO, Dec. 16, 2021 /PRNewswire/ -- Zimperium, the global leader in mobile security, andIntertrust, the pioneer in trusted computing and digital rights management (DRM) technology, today announced a partnership to provide end-to-end security and data management for IoT devices, apps and media services operating in Zero Trust environments. Under the terms of the partnership, Intertrust will offer Zimperium's Mobile Application Protection Suite (MAPS) to its Intertrust Platform and Intertrust ExpressPlaycustomers.
"The Zimperium-Intertrust partnership completes our offering of the world's best end-to-end secure data operations and rights management solution, with bulletproof endpoint technology," said Talal Shamoon, Intertrust's Chief Executive Officer. "We're proud to partner with the world leader in this space and look forward to delivering robust end to end solutions to our customers"
Intertrust Platform is a breakthrough product that provides trusted interoperable data operations for business ecosystems. It also connects to authenticated IoT devices and apps, creating a circle of trust between clouds and devices. ExpressPlay Media Security Suite offers a number of innovative content protection services including ExpressPlay DRM, a cloud-based multi-DRM service. Zimperium's revolutionary security technology creates a protected processing environment on devices and sensors that lowers the risk of malicious tampering and signals when an attack is taking place. The combination gives enterprises and media service providers alike access to trusted data ecosystems and a high level of assurance that devices and apps in the Zero Trust environments they work with are highly resistant to hacks that can cause major disruptions or inappropriate access to data.
"Devices and apps in the field can be a weak point for attackers to steal data or disrupt vital data-based services," said Shridhar Mittal, Zimperium's Chief Executive Officer. "As the only platform that protects mobile apps across the entire DevSecOps lifecycle, from in-development to on-device, MAPS gives Intertrust's customers the confidence that their edge devices and apps are protected."
Intertrust provides software and services to major corporations globally and is offering MAPS to its current and future customers immediately.
About ZimperiumZimperium provides the only mobile security platform purpose-built for enterprise environments. With machine learning-based protection and a single platform that secures everything from applications to endpoints, Zimperium is the only solution to provide on-device mobile threat defense to protect growing and evolving mobile environments. Zimperium is headquartered in Dallas, Texas and backed by Warburg Pincus, SoftBank, Samsung, Sierra Ventures and Telstra. For more information, follow Zimperium on Twitter and LinkedIn, or visitwww.Zimperium.com.
About IntertrustIntertrust provides trusted computing products and services to leading global corporationsfrom mobile, consumer electronics and IoT manufacturers, to service providers and enterprise software platform companies. These products include the world's leading digital rights management (DRM) and technologies to enable private data exchanges for various verticals including energy, entertainment, retail/marketing, automotive, fintech, and IoT. Founded in 1990, Intertrust is headquartered in Silicon Valley with regional offices in London, Tokyo, Mumbai, Bangalore, Beijing, Seoul, and Tallinn. The company has a legacy of invention, and its fundamental contributions in the areas of computer security and digital trust are globally recognized. Intertrust holds hundreds of patents that are key to Internet security, trust, and privacy management components of operating systems, trusted mobile code and networked operating environments, web services, and cloud computing. Additional information is available atintertrust.com, or follow us onTwitterorLinkedIn.
Contacts:
ZimperiumMike Reillyfama PR for Zimperium[emailprotected]
IntertrustJordan SladeMSR Communications[emailprotected]
SOURCE Intertrust
Excerpt from:
Zimperium and Intertrust Partner to Provide End-to-end Security for IoT devices in Zero-trust Environments - PRNewswire
Zimperium and Intertrust Partner to Provide End-to-end Security for IoT devices in Zero-trust Environments – inForney.com
DALLAS and SAN FRANCISCO, Dec. 16, 2021 /PRNewswire/ -- Zimperium, the global leader in mobile security, andIntertrust, the pioneer in trusted computing and digital rights management (DRM) technology, today announced a partnership to provide end-to-end security and data management for IoT devices, apps and media services operating in Zero Trust environments. Under the terms of the partnership, Intertrust will offer Zimperium's Mobile Application Protection Suite (MAPS) to its Intertrust Platform and Intertrust ExpressPlaycustomers.
"The Zimperium-Intertrust partnership completes our offering of the world's best end-to-end secure data operations and rights management solution, with bulletproof endpoint technology," said Talal Shamoon, Intertrust's Chief Executive Officer. "We're proud to partner with the world leader in this space and look forward to delivering robust end to end solutions to our customers"
Intertrust Platform is a breakthrough product that provides trusted interoperable data operations for business ecosystems. It also connects to authenticated IoT devices and apps, creating a circle of trust between clouds and devices. ExpressPlay Media Security Suite offers a number of innovative content protection services including ExpressPlay DRM, a cloud-based multi-DRM service. Zimperium's revolutionary security technology creates a protected processing environment on devices and sensors that lowers the risk of malicious tampering and signals when an attack is taking place. The combination gives enterprises and media service providers alike access to trusted data ecosystems and a high level of assurance that devices and apps in the Zero Trust environments they work with are highly resistant to hacks that can cause major disruptions or inappropriate access to data.
"Devices and apps in the field can be a weak point for attackers to steal data or disrupt vital data-based services," said Shridhar Mittal, Zimperium's Chief Executive Officer. "As the only platform that protects mobile apps across the entire DevSecOps lifecycle, from in-development to on-device, MAPS gives Intertrust's customers the confidence that their edge devices and apps are protected."
Intertrust provides software and services to major corporations globally and is offering MAPS to its current and future customers immediately.
About Zimperium
Zimperium provides the only mobile security platform purpose-built for enterprise environments. With machine learning-based protection and a single platform that secures everything from applications to endpoints, Zimperium is the only solution to provide on-device mobile threat defense to protect growing and evolving mobile environments. Zimperium is headquartered in Dallas, Texas and backed by Warburg Pincus, SoftBank, Samsung, Sierra Ventures and Telstra. For more information, follow Zimperium on Twitter and LinkedIn, or visitwww.Zimperium.com.
About Intertrust
Intertrust provides trusted computing products and services to leading global corporationsfrom mobile, consumer electronics and IoT manufacturers, to service providers and enterprise software platform companies. These products include the world's leading digital rights management (DRM) and technologies to enable private data exchanges for various verticals including energy, entertainment, retail/marketing, automotive, fintech, and IoT. Founded in 1990, Intertrust is headquartered in Silicon Valley with regional offices in London, Tokyo, Mumbai, Bangalore, Beijing, Seoul, and Tallinn. The company has a legacy of invention, and its fundamental contributions in the areas of computer security and digital trust are globally recognized. Intertrust holds hundreds of patents that are key to Internet security, trust, and privacy management components of operating systems, trusted mobile code and networked operating environments, web services, and cloud computing. Additional information is available atintertrust.com, or follow us onTwitterorLinkedIn.
Contacts:
Zimperium
Mike Reilly
fama PR for Zimperium
Intertrust
Jordan Slade
MSR Communications
View original content:https://www.prnewswire.com/news-releases/zimperium-and-intertrust-partner-to-provide-end-to-end-security-for-iot-devices-in-zero-trust-environments-301446462.html
SOURCE Intertrust
Never Gonna Give You Up: staying on top of IoT security risks – Security Boulevard
The old bait-and-switch digital prank Rickrollinghaswavered in and out of popularity for the last decade and a half, but an18-year-oldstudent ofSecurity Research and Computer Science put up a blog postearlier thisyeardetailingacreative spin on the classic prank he Rickrolled hisentire school districtvia an IoThack.
Thankfully, for all those involved, the outcome of thisWhitehathackingprank was hilarious, entertaining, and relatively victimless. The perpetrators took care to ensurethey wouldnot disrupt anyschool sessions or tests. Theyeven debriefed the school districts IT team withinformation onhow and where they found the vulnerabilitiestoprevent amalicious attackin the future.You can read the full account of the incident, accompanied by a video,here.
IoT has been around for decadesnow, soyou might wonder howthispractical jokewas so easy to pull off? The short answer is that IoT is often overlooked in cybersecurity because IoT devices are built withconvenience, not security, in mind. As well explore here,its imperative that your IoTlandscapebeincluded aspart of yourcybersecurity risk assessment.With the amount of datahandled via IoT,it can quickly become overwhelming. This iswhereAxio360s platformcan help you gain a better, holistic understanding of your environment.
IoT, or the internet of things,is a term used to describesensors and actuators embedded in physical objects [that are] linked through wired and wireless networks.It includesabroad list of devices used tocollect andtransmit data from one device to another without human intervention.Mostfolks arethe most familiar withconsumer IoT.Consumer IoT includes thingswe use every day. A network of devices, such asSiri,FitBit,Alexa,Ring doorbells,Smart Homeautomation, etc.,are allexamples ofIoT devices. They are meant to operate in the background andmake daily tasks easier.
ConsumerIoT is ubiquitous, and becauseitoften runsin the background and integratesso seamlessly with our daily lives,its no surprise that many people dont often think about or consider security when using or purchasing these devices.Using webcam feeds as an example,CNNdemonstratedin 2019how easily consumer IoT devices can behacked,and ourpersonal privacycompromised. And there aremany,many,more examplesto be found online.The popularity ofpersonalIoT devicescontinues to grow at amuch quicker rate than the call for betterprotection against IoT attacks,raising the risk of attacks onhome network security.
Smart technology requires smart handling,saysMartinSchallbruch,former Cybersecurity consultant to the German government; hecomparesordinary usersliving in smart housesfullof smart devicestoa systems admin managing a data center.Meaning, consumers should follow basic cyber hygieneguidelines, just assysadmins are required, like keeping software up to date, changing passwords, etc.
Whether a person chooses to outfit their homewithsmart devices or not is irrelevant because,in 2021,living without IoT is nearly impossible.Today, there are more than10 billion active IoT devices,andin the US, IoT devices are used throughout our critical infrastructure.Examples includemedical devices,supply chain tracking (GPS), predicting when manufacturing equipmentneedsmaintenance, and other critical infrastructure systemmanagementlike power plant or water plant monitoring.Deloitte projects that, in healthcare alone, theglobal IoT marketwill be worth $158.1B in 2022.
Thegrowthof IoTinthe business world brings with it anevolutionof cyber riskand increased scope of damage.In 2017,the FDAdiscovered avulnerability inpacemakersissued by St. Jude Medical, leading to a recall of 500,000 devices. The security flaw allowed potentialhackersunauthorized access tothe devices viacommercially available equipment.In 2021, Peloton learned from its AdvancedThreat Research consultant, McAfee,thatits bike had a vulnerabilitythat would have allowed a hacker to gain access to the Peloton tablet, where they couldinstall malware and intercept the users personal data, or even gain control of the devices camera and microphone.Peloton issued a patch for thisvulnerabilitybefore anyknown exploitsoccurred, but itdoesntensure future vulnerabilitiescantarise.While the NSAhas helpedensurethatPresident Bidens Pelotonand other devicesaresecure,what aboutotherhigh-rankingofficials, judges, CEOs,etc. thatdonthave the NSAshelp?
Theadvancement of IoT technology reduces manual labor and cost while it increases efficiency through automating business processes.A 2021 studyfound that the main revenue driver formostenterprise IoT projects is cost savings, and, on average, over 80% of senior executives across industries say IoT is critical to some or all lines of business.
However, theseapplications become vulnerable as they need to communicate via the internet to send information to other devices, makingIoT cybersecurity for businesses critical. Yourcybersecurity strategy is only as strong as your weakest link.Just one device can compromise the entire system, whether its a home or an entire industrial system,Schallbruchpoints out.Cyber-attacksagainstcritical systemsare on the rise,and the reliance on IoTproduces a landscape where attacks are easy to create and difficult to remedy.Business leaders need to understand thatIoT securitymust be includedin the foundations of their cybersecurity risk management strategy.
Again, most IoT devices are built with convenience in mind,and oftenthe cost of convenience is security.Outside of home automation and digital assistants, IoT plays an integral part in the way we do business at an enterprise level today. It provides the data we need to make better business decisions.
Part of yourcybersecurity riskassessment processneeds to lookatIoT devices because, for the most part,theyre not built with security in mind.MostIoTvendors dont think of themselves as security professionals, so its up to businesses andgeneral consumersto ensure their devices are secure.IoTdevices aresignificantpotential risk factorsthat youmustconsiderin your risk assessment scenarios.Axio360 offers practical business solutions that you can useto discern what basic cybersecurity principles apply to your IoT devices when makingrisk management decisions.
Read more:
Never Gonna Give You Up: staying on top of IoT security risks - Security Boulevard
Top 4 cloud misconfigurations and best practices to avoid them – TechTarget
As organizations use more cloud services and resources, they become responsible for a staggering variety of administrative consoles, assets, services and interfaces. Cloud computing is a large and often interconnected ecosystem of software-defined infrastructure and applications. As a result, the cloud control plane -- as well as assets created in cloud environments -- can become a mishmash of configuration options. Unfortunately, it's all too easy to misconfigure elements of cloud environments, potentially exposing the infrastructure and cloud services to malicious activity.
Let's take a look at the four most common cloud configuration misconfigurations and how to solve them.
Among the catalog of cloud misconfigurations, the first one that trips up cloud tenants is overly permissive identity and access management (IAM) policies. Cloud environments usually include identities that are human, such as cloud engineers and DevOps professionals, and nonhuman -- for example, service roles that enable cloud services and assets to interact within the infrastructure. In many cases, there can be many nonpeople identities in place. These can frequently have overly broad permissions that may allow unfettered access to more assets than needed.
To combat this issue, be sure to do the following:
Another typical misconfiguration revolves around exposed and/or poorly secured cloud storage nodes. Organizations may inadvertently expose storage assets to the internet or other cloud services, as well as reveal assets internally. In addition, they often also fail to properly implement encryption and access logging where appropriate.
To ensure cloud storage is not exposed or compromised, security teams should do the following:
Overly permissive cloud network access controls are another area ripe for cloud misconfigurations. These access control lists are defined as policies that can be applied to cloud subscriptions or individual workloads.
To mitigate this issue, security and operations teams should review all security groups and cloud firewall rule sets to ensure only the network ports, protocols and addresses needed are permitted to communicate. Rule sets should never allow access from anywhere to administrative services running on ports 22 (Secure Shell) or 3389 (Remote Desktop Protocol).
In some cases, organizations have connected workloads to the internet accidentally or without realizing what services are exposed. This exposure allows would-be attackers to assess these systems for vulnerabilities.
Vulnerable and misconfigured workloads and images also plague cloud tenants. In some cases, organizations have connected workloads to the internet accidentally or without realizing what services are exposed. This exposure enables would-be attackers to assess these systems for vulnerabilities. Outdated software packages or missing patches are another common issue. Exposing cloud provider APIs via orchestration tools and platforms, such as Kubernetes, meanwhile, can let workloads be hijacked or modified illicitly.
To address these common configuration issues, cloud and security engineering teams should regularly do the following:
Guardrail tools can help companies avoid cloud misconfigurations. All major cloud infrastructure providers offer a variety of background security services, among them logging and behavioral monitoring, to further protect an organization's data.
In some cases, configuring these services is as easy as turning them on. Amazon GuardDuty, for example, can begin monitoring cloud accounts within a short time after being enabled.
While cloud environments may remain safe without using services like these, the more tools an organization puts in place to safeguard its operations, the better chance it has to know if an asset or service is misconfigured.
Go here to read the rest:
Top 4 cloud misconfigurations and best practices to avoid them - TechTarget