Category Archives: Internet Security
In the News: Self-Employment is Best for Mental Health – Small Business Trends
To say the past 18 months with COVID-19 have been stressful for business owners is a huge understatement, which has shined the impact the pandemic has had on mental health. The 2021 Self-Employed Mental Health Report produced by Freshbooks in partnership with Mind Share Partners, sheds some light on the issue. And according to the report, people that are self-employed have experienced fewer mental health symptoms.
The data is in this weeks lead roundup up article,Self-employed Faring Better Mentally in Pandemic. The survey of 2,000 self-employed individuals also reveals72% say their mental health is either good or very good. And a total of 85% of small business owners say self-employment is the best form of employment for mental health. This is despite the many challenges brought on by the pandemic. Only 10% of the small business owners say their mental health was very poor.
In addition to this article, this week you can take a look at how to protect your business from cyber attacks by reading about the partnership between McAfee and Visa as well as how to sell your domain names with GoDaddys List for Sale service.
Take a look at the rest of the roundup.
As cybersecurity breaches continue to lead the news, McAfee and Visa have announced the formation of a new partnership. In this agreement, McAfee is going to offer internet security solutions to Visa Business cardholders. McAfee and Visa Partnership to Protect Small Businesses The goal of the partnership is to help protect Visa Business cardholders in North America and EMEA.
If you have domain names you are not using, GoDaddy is making it easy to sell them with List for Sale. This is a tool/service that lets you sell any unused domain names you have easily and quickly as a GoDaddy customer. GoDaddy Launches List for Sale to Sell Domains The goal of List for Sale is to simplify the cumbersome process of selling a domain name online.
If you run a handmade products business, one of the best ways to grow your business is to offer customers new and innovative products. By taking online craft classes, you can not only create more products for your business, but learn new skills that can help you come up with craft ideas to sell.
Have you ever come out of an important meeting feeling confused or frustrated? Was there ever an occasion where you found it difficult to explain yourself to a colleague or customer? When it comes to communication, theres no one-size-fits-all style. All of us communicate differently and sometimes this difference can make matters difficult for your business.
Internal customer service involves everything an organization can do to help their employees fulfill their duties, reach their goals and enjoy their work. It covers how different departments communicate with each other and how individuals interact with their colleagues, subordinates and superiors.
Have you ever wanted to create a captivating photo slideshow? A photo slideshow can be a useful tool to organize and engage with your audiences by letting you deliver compelling stories. Through the use of photo slideshows, you get to provide information via images about your products and services while expanding your brands reach.
You probably hate sales. You think its low or beneath you. Deep down you may believe if you have the best product or service in the marketplace, it will sell itself. More likely, you dont like sales because you have a fear of rejection. On The Small Business Radio Show this week, I talk with Tom Stern who says he was the black sheep in a family of lions.
Image: Depositphotos
See the original post:
In the News: Self-Employment is Best for Mental Health - Small Business Trends
How accounting firms can protect against remote work security threats – Accounting Today
The COVID-19 pandemic has fundamentally changed the way people work. Millions of employees have been able to stay productive while working from home during the lockdowns thanks to remote collaboration technologies like Zoom, WebEx and Teams. Very quickly, virtual meetings became ever-present, and people could connect with their managers and clients or give presentations from any location with internet access, including other countries. Even as much of the country returns to business (mostly) as usual, firms instituting flexible or work-from-home policies may need to review their telecommuting policies and practices to help keep data safe.
While working from home has been key to business continuity over the last 15 months, it has also opened up some potentially major security issues for firms. In an office setting, there are multiple ways to secure data, including firewalls and physical security measures such as badges, doors, locks and keys. However, remote employees could be working from their homes, their cars, or at a local coffee shop. They have laptops, mobile phones, tablets and smartwatches all of which communicate with each other and could use several different services (Wi-Fi, Bluetooth, cellular data, RFID).
Being outside a secure office makes these employees, and their data that is, your data and your clients data vulnerable to data leaks and hacks. Even something like a chat or text message could contain confidential information, such as a Social Security number, birth date, tax information, or even medical information.
This is why robust data security is vital for any company. Data breaches that compromise client or employee data are notoriously costly, averaging over $3.9 million in 2020. They not only hurt a firm's reputation and bottom line but can also result in the theft of client information, proprietary information or intellectual property. Think of all the due diligence-related information your firm has on clients who might be preparing for an IPO or merging with another company.
It's these risks, by the way, that drove the American Institute of CPAs to add to its Code of Professional Conduct Confidential Client Information Rule 1.700.001, which deals with disclosure of confidential client information without the specific consent of the client. This rule goes hand in hand with Internal Revenue Code Sec. 7216, where failure to comply can lead to fines and other consequences.
It is against that background that all firms must make a concerted effort to be vigilant about protecting their data and their clients data. Accounting firm leaders must recognize the issues affecting their firms and take measures to educate their professionals. With that in mind, here are a few practical ways to help secure access to data, stay compliant, and mitigate the damage in the event of a breach.
Encryption is your friend
You may have outfitted all of your employees with laptops and a secure virtual private network. While a VPN might be enough protection when employees use their devices on a secure home network, what if theyre traveling or decide to work in a cafe? Many hotels, airports and cafes offer free Wi-Fi, but these unsecured networks can allow hackers to gain access to data that is supposed to be secure. A VPN may protect outbound data, but it still leaves the laptop or tablet itself vulnerable via other potentially active services such as Bluetooth, hotspots or RFID. Encrypting the device itself will make it much harder for criminals to access the data.
Encryption can also help protect a device if it is physically stolen. Unattended computers, tablets or mobile phones are tempting targets for thieves. With the device in their possession, the thief could have a treasure trove of confidential information they can sell or use to scam your clients. If a device is encrypted, the data is safe, and you only lose the device. It could mean the difference between $1,000 or $1,000,000.
Turn off services
Mobile devices are designed to make communication easy. This is a double-edged sword, however, unless there are security protections in place. For example, virtually all mobile devices have Bluetooth, and a growing number can be used as internet hotspots or have radio frequency identification (RFID) technology built right in. If these services are turned on, a hacker could potentially compromise the device. While these services can be beneficial, they do not need to be active 24/7. All employees should be instructed to turn them off until they are needed, especially while traveling.
Make sure to back up your data
With millions of Americans telecommuting, tens of millions of laptops and other devices are floating around filled with potentially sensitive data. This creates a greater chance that data could be lost if a device is lost, stolen or damaged. Employees should back up their devices daily, or at the very minimum, weekly, so the information will remain accessible if there is a catastrophic failure. Moreover, it is vital that employees restrict backups solely to company-approved destinations (e.g., cloud storage, on-premises servers, encrypted hard drives). If they make a backup to another location, it exposes their organizations to a potential data breach they have no control over.
As a firm leader, you should work with your IT team to ensure the mobile devices with access to firm information use properly containerized apps such that your firms data is automatically backed up, even if the rest of the devices data is not. Note that even email and everyday collaboration tools are loaded with documents and sensitive data that could be easily leaked. To reiterate, always (1) encrypt the devices and (2) back up important information.
A few decades ago, it was practically unthinkable that employees would have access to a secure server from their home, or for them to be a potential target for hackers. Accounting firm leaders must adapt their security practices to the time and, perhaps most importantly, educate employees about cybersecurity. Even with just these three relatively simple steps, firms can significantly reduce the chances of being subject to a costly data breach or cybercrime incident.
See more here:
How accounting firms can protect against remote work security threats - Accounting Today
It started life behind the Iron Curtain – now UK-listed Avast could become the latest to succumb to a US takeover – Sky News
Another day and another leading UK company is in talks to be taken over.
This time, it is Avast, the cyber security provider and one of the biggest tech companies listed on the London Stock Exchange.
Avast, which floated on the stock market in May 2018 and which was promoted to the FTSE 100 in June last year, confirmed overnight it is in "advanced" talks to sell itself to its US rival Norton LifeLock.
Shares of the company, which have doubled in value since the flotation, have surged by 13% on the news.
Avast, whose stock market valuation at the close on Wednesday evening was 5.2bn, is expected to be taken out at a value close to 5.9bn.
That would represent a decent premium to the price at which the shares have changed hands during the last five months or so but would nonetheless still represent a modest discount to the price at which they were trading in July and August last year.
A deal, on top of swoops for UK-listed companies such as John Laing, St Modwen, Signature Aviation, Spire Healthcare, Aggreko and the recent deal agreed for Morrisons, is sure to provoke more anguished discussion.
There is a growing sense among some politicians and some in the media, as well as in fund management circles, that the boards of many UK-listed companies are agreeing too readily to takeovers by foreign buyers and, in particular, to takeovers by private equity firms.
It may be harder to build such a sense of outrage in the case of Avast, however, since it is not exactly a company that is draped in the Union Jack.
The company's global headquarters is in Prague, where the vast majority of its 1,700 employees worldwide are based, with just 100 or so in the UK.
Nonetheless, Avast's decision to list not in New York but in London was a welcome boost to the latter's tech credentials, while its takeover would reduce the ranks of "pure" tech companies in the FTSE to just two - the engineering software group Aveva and the accounting software group Sage.
It would also deprive the UK market of what has been an inspiring story.
Avast emerged from a workers co-operative called ALWIL which was founded in then-Communist Czechoslovakia in 1988 a year before the fall of the Berlin Wall.
After the collapse of Communism, the co-operative's founders, computer scientists Eduard Kucera and Pavel Baudis, set it up as a company, having already made their names defeating a computer virus called the Vienna bug.
The business had to fend off unwanted takeover approaches from rivals such as McAfee and at one point came close to collapse after struggling to conquer the United States.
The company's fortunes turned around when, in 2001, it adopted a freemium business model, making the most basic version of its anti-virus software free to download, but charging for premium services and selling corporate licences.
Less than three years later, its software had been downloaded by more than one million people.
It now boasts an estimated 435 million users around the world and more than 13 million of them are paying customers.
The company was a beneficiary of the pandemic, putting on more than one million such paying customers during 2020, partly because of a rise in demand from people working from home and seeking extra security for their phone or telephone.
It is also a business that values continuity in more ways than one: the current chief executive, Ondrej Vlcek, joined the business as an 18-year old intern more than 25 years ago and has remained there ever since.
A takeover is not yet a done deal.
While there has been an increase in competition in the cyber security sector in recent years, with Microsoft in particular taking market share, competition regulators around the world may take a dim view of two such well-known players in the anti-virus space getting together and particularly as both have strong positions in the consumer market.
Some investors may also demand more of a premium: analysts at Berenberg bank told clients this morning that "nothing short of a $10bn (7.2bn) valuation is fair to Avast's shareholders".
That may ultimately come down to Mr Baudis and Mr Kucera who, respectively, have 25% and 10% stakes in the business.
Mr Vlcek owns a further 2.3% stake.
Norton's approach is also likely to spark interest from private equity companies.
Avast could probably live with such an ownership structure as it has experience of it.
When it came to market it was 23% owned by CVC Capital Partners.
But management would be justified in pushing for a higher price.
Avast is already growing strongly in a lot of markets around the world.
Mr Vlcek noted in March, at the company's results presentation, that it had, in the previous 12 months, enjoyed a 33% rise in customers in Mexico, 19% growth in Brazil, 17% growth in Argentina and 16% growth in Ukraine.
That growth is only going to accelerate as the 'Internet of Things' (IoT) takes off and everyday items like fridges and cookers become potentially more susceptible to hacking attacks.
Avast may not be one of the best-known companies in the FTSE 100.
But it will be missed if it is taken over.
Read this article:
It started life behind the Iron Curtain - now UK-listed Avast could become the latest to succumb to a US takeover - Sky News
How the internet censorship world turned on NetBlocks | WIRED UK – Wired.co.uk
WHO DO YOU ask to find out if the government of Ethiopia has really shut down the internet? If Facebook is blocked in India? Or if Wikipedia is unreachable from Venezuela? For the past few years, the answer to all those questions has been NetBlocks.
Since its launch in 2016, the London-based outfit has alerted the world to all and every internet incident. Whenever a ruler, junta or strongman tampers with a countrys connectivity, NetBlocks will be tweeting about it, publishing graphs and reports showing how the disruption unfolded. Day after day, crisis after crisis, NetBlockss alerts pour in, almost a fixture of the age of internet censorship.
The groups rise has been unstoppable. It has over 125,000 followers on Twitter and its posts can rake in thousands of retweets and tens of thousands of likes. Articles citing NetBlocks have appeared in The New York Times (at least 15 articles), CNN (over 150 times), BBC (over 100), and WIRED (at least ten stories). United Nations documents about the scourge of internet censorship include links to NetBlocks, as do working papers by the governments of the UK and the US. Yet, as NetBlocks has attained stardom among internet-watchers, a question has rumbled on: how does it know that the internet is down?
Its a seemingly simple question with a complex answer. Several experts in the internet measurement sector have spent years scratching their heads at the vagueness of the organisations explanations of its methods and have continually called for more transparency. To those pleas, NetBlocks and its firebrand British-Turkish founder, Alp Toker, have replied with defensiveness and accusations of unfair competition.
But, even as other specialists worry about NetBlockss lack of transparency, attention-seeking, and potentially unethical practices, the companysmedia cachet has never been stronger. Governments across the globe are increasingly turning to internet shutdowns and censorship to oppress their citizens. In parallel, the internet measurement community is engaged in a battle, unevenly fought, to discover, document, and report the truth with accuracy and prudence. For this community, the behaviour of a fast-moving, fiercely competitive startup like NetBlocks raises questions not just about the truth but also who gets to tell it and how. And, at the centre of this row is a crisis that affects us all: who monitors the internet monitors?
ON DECEMBER 15, 2019, Collin Anderson an American researcher with a decade of experience investigating internet censorship fired off a fusillade of tweets revealing a security flaw that he believed posed a risk to internet users in repressive countries. In this case, he claimed, the danger did not come from state-backed snoopers or ruthless security services: Anderson was pointing the finger at NetBlocks, the self-styled internet observatory. And he had a stark warning: NetBlockss website could be dangerous.
[NetBlocks] is running undisclosed experiments that could endanger people, Andersons tweet read. Without their permission, visitors to [NetBlocks] are forced to conduct censorship measurements. When a user opened netblocks.org, a series of inconspicuous scripts in the pages source code would hijack his or her browser and have it connect to dozens of websites, including social media, news outlets, internet forums, and websites selling VPNs, among others.
NetBlockss script could gauge what was blocked and where: if the browser of someone in, say, France, reported back that it could not connect to Twitter, that would provide NetBlocks with useful data. Andersons view was that it was unethical. Not only were these tests conducted without the users express consent; worse, Anderson thought they could put people in danger. If someone whose internet traffic was already being monitored by an oppressive government were to access netblocks.org, Anderson argued, their unwitting connection to certain websites for instance US-backed Voice of America, or the controversial imageboard 4Chan, both among the checked websites might put a target on their backs. That was not just a speculative scenario: in 2016, Turkey jailed 150 teachers who had been reportedly tracked down because they used a texting app linked to president Recep Tayyip Erdogans arch-rival Fethullah Gulen. Anderson was categorical. [NetBlocks] should stop immediately, he signed off his thread.
View post:
How the internet censorship world turned on NetBlocks | WIRED UK - Wired.co.uk
Fastly Announces Two New Appointments to Board of Directors – Business Wire
SAN FRANCISCO--(BUSINESS WIRE)--Fastly, Inc. (NYSE: FSLY), provider of an edge cloud platform, today announced that it has appointed Paula Loop, previously an assurance partner at PwC and the leader of PwCs Governance Insights Center and Charles Meyers, President and Chief Executive Officer of Equinix, to its board of directors effective July 8, 2021. These independent director appointments increase Fastlys Board of Directors to nine members.
I am thrilled to welcome Paula and Charles to the Fastly Board as we continue building and delivering a more trustworthy and secure Internet for all, said Artur Bergman, Executive Chairperson of Fastly. Their expansive experience across consumer, retail, and internet, paired with their deep commitment to Fastlys values, make them exceptionally qualified to serve and further advance our vision of combining edge computing and security together to create the best of the Internet.
Paula Loop said, I am delighted to be joining the outstanding Fastly team. With Fastlys focus on growth and on supporting businesses through their digital transformation journeys, Im looking forward to leveraging my background in corporate governance on the Board.
Charles Meyers said, Fastlys leadership position in the market and strong focus on combining edge computing with security makes it an exciting time to help steward the company towards continued growth and further success. I look forward to bringing my experience in scaling high-growth technology companies to the Fastly Board.
After conducting an extensive search, our Committee unanimously recommended Charles and Paula to the Fastly board. We're confident that they will be outstanding independent directors, making the interests of our shareholders and stakeholders a priority," said Aida Alvarez, Chair, Nominating and Corporate Governance Committee.
Paula Loop joined PwC in 1983 and most recently served as the Leader of PwCs Governance Insights Center, where she provided guidance to numerous boards. She previously served as PwCs New York Metro Assurance Leader and prior to that as the US and Global Talent Leader. Paula brings expertise in corporate governance, technical accounting, and SEC and financial reporting matters. She currently serves on the board of Robinhood Markets Inc. and is a member of the Value Reporting Foundation Board.
Charles Meyers is the President and Chief Executive Officer of Equinix, the worlds digital infrastructure companyTM. He previously served as President, Strategy, Services & Innovation, as well as Chief Operating Officer, after joining Equinix in 2010 as President, Americas Region. Meyers also previously held senior operating roles at Level 3 Communications and Verisign and was a member of the pre-IPO executive team at Internet Security Systems.
About Fastly
Fastly helps people stay better connected with the things they love. Fastlys edge cloud platform enables customers to create great digital experiences quickly, securely, and reliably by processing, serving, and securing our customers applications as close to their end-users as possible at the edge of the internet. Fastlys platform is designed to take advantage of the modern internet, to be programmable, and to support agile software development with unmatched visibility and minimal latency, empowering developers to innovate with both performance and security. Fastlys customers include many of the worlds most prominent companies, including Pinterest, The New York Times, and GitHub.
This press release contains forward-looking statements that are based on our beliefs and assumptions and on information currently available to us on the date of this press release. Forward-looking statements may involve known and unknown risks, uncertainties, and other factors that may cause our actual results, performance, or achievements to be materially different from those expressed or implied by the forward-looking statements. These statements include, but are not limited to, statements regarding our ability to develop edge computing and security products, our ability to invest in our platform for future growth, and our ability to deliver on our long-term strategy. Except as required by law, we assume no obligation to update these forward-looking statements publicly or to update the reasons actual results could differ materially from those anticipated in the forward-looking statements, even if new information becomes available in the future. Important factors that could cause our actual results to differ materially are detailed from time to time in the reports Fastly files with the Securities and Exchange Commission (SEC), including in our Quarterly Report on Form 10-Q for the fiscal quarter ended March 31, 2021. Copies of reports filed with the SEC are posted on Fastlys website and are available from Fastly without charge.
Source: Fastly, Inc.
Read the original here:
Fastly Announces Two New Appointments to Board of Directors - Business Wire
MAGA-Branded ‘Freedom Phone’ Is a Black Box That Should Be Avoided at All Costs – Gizmodo
Screenshot: YouTube/YourVoice Network, Inc
Be it Parler, Gab, or GETTR, recent times have seen no shortage of dollar-sign-eyed entrepreneurs looking to capitalize on conservative Americas disdain for liberal Silicon Valley. It was only a matter of time before someone tried to invent the MAGA phone.
Er, make that...the Freedom Phone. The device, which launched Thursday, is the product of Erik Finman, a 22-year-old crypto-millionaire who says that he wants Americas patriots to take back control of their lives from the tech oligarchy. Finmans phone, which costs $499, claims to offer conservatives a way to be free of Big Techs spying and censorshipthough it is radically vague on the details. Like a random handgun, the phone should be treated as if it were loaded and dangerous because we simply dont know whats under the hood.
Freedom Phone claims that it can protect users from the data collection that comes with an iOS or Android operating system (it has something called a FreedomOSwhich, ironically, just appears to be a modified version go Googles Android OS). The phone is also meant to liberate users from Big Techs alleged ideological preferences: it has an uncensorable app store (called the PatriApp, lol), where it is apparently impossible for apps to get booted no matter how unsafe or horrendous they are.
The device also comes pre-loaded with a host of privacy features (Signal, DuckDuckGo, Brave), as well as a suite of apps that seem tailor-made for Trump voters: Parler, One America News Network, Newsmax, and Rumble are all included.
This is the first major pushback on the Big Tech companies that attacked us - for just thinking different, Finman tweeted Thursday morning. Were finally taking back control. Other right-wing influencers and commentators could also be seen promoting the product on their channels.
G/O Media may get a commission
Yet while the product is being sold as an escape from Big Techs nefarious oversight, in reality, it appears to be a budget phone from Asia that may end up compromising buyers autonomy rather than protecting it.
Before we get into the specifics of why this device probably sucks, let me just say that the desire to have a phone that is dedicated to protecting your autonomy and privacy is a reasonable oneand should be encouraged. That said, I dont think the Freedom Phone provides that. Actually, aside from its overt partisan bent, its impossible to tell what kind of device this is because Finman and his acolytes havent provided any information about it.
Lets start with the website (freedomphone.com). Hilariously, it provides literally zero specs about the actual device. There is no information about the phones operating system, storage, camera, CPU, or RAM capabilities. It has a list of features, but there are no actual details about them. Instead, under each feature, theres merely a Buy it now button which redirects you to the sites shopping cart. The phones hefty price, combined with the companys total lack of transparency, is ridiculousessentially asking the buyer to cough up half a grand in exchange for, uh, something! We sent an email to Freedom Phone to ask for further information and will update this story if they ever respond.
The fact that the device is essentially a black box also makes it a potential security (and thus also privacy) nightmareand once again, it should be treated that way until proven otherwise. In fact, based on the assessment of some security professionals who have scoped it out, the Freedom Phone should be avoided at all costs.
Matthew Hickey, the co-founder of Hacker House and longtime cyber professional, said that, while it hasnt been confirmed, the Freedom Phone would appear to be a cheap Android device sourced from Asiathe likes of which could be vulnerable to all assortment of supply chain risks and other issues.
Based on photographs from the company website a number of Internet sleuths identified that the device has the same form-factor, shape, and appearance of a Umidigi A9 Pro, said Hickey, via email. This device is a drop-shipped customizable Android-based phone that can be ordered from ASIAPAC region and customized to a projects requirements, he said, clarifying that such devices can be bought and shipped in bulk with custom logos and branding so as to give the appearance of a phone that has been designed for a unique purpose but is actually just a common cheap Android-based smartphone with core components produced in Taiwan and the surrounding areas. Its also very cheap: the A9 Pro is currently available for about $120, much less than the Freedom Phones $500.
According to The Daily Beast, Finman confirmed that the device he was selling was made by Umidigi but couldnt say what specific model it was.
On top of everything, Freedom would also appear to be using a CPU from Taiwan produced by Mediatek, the likes of which is popular in low-end Android-based devices and is known to be buggy, said Hickey.
Historically Mediatek devices have shipped with a wide number of insecure configurations and are prone to trivial vulnerabilities that allows anyone with physical possession of such a device to read/write the data on the phone through its early bootloader, Hickey said. They make phones specifically to permit high customization and as such many of the vendors own software [that] can be used to manipulate the devices, which is why such hardware is popular in countries like North Korea as often the security enabled by a user can simply be circumvented by a state operative, he added.
Nothing screams freedom like products popular in the DPRK.
The funny thing is, if Trump voters are looking for a way to get off the Big Tech grid, theres no need for them to buy this sketchy shit. There are actually entire subcultures within the phone industry dedicated to escaping the Android/iOS paradigm. You can wade into the de-Googled phone sector, for instancewhere Android phones are sold that have ostensibly been refurbished to rid the devices of code that will send your personal data back to the tech giant. Theres also the Linux-based Pinephone, which sells at a fraction of the Freedom Phones cost (between $150 and $200), and is a favorite of those in the privacy community. All of these come with caveats, obviously, but the point is that there are much more transparent and affordable options than the Freedom Phone.
Of course, total security and privacy arent really what the Freedom Phone is about. For Finman and his company, its just a cash-in on the growing conservative demand for products that are brand MAGA. For the customers, meanwhile, buying a phone like this is a statement of identitya consumer choice that brings with it a sense of community, as well as a chance to give a big middle finger to the commercial and cultural establishment that they feel has repudiated them.
Itd be nice if Americans could actually come together around the issue of privacy since its an area whereregardless of political partywere all collectively getting screwed. However, something tells me the Freedom Phone isnt exactly a harbinger of thatmore the opposite.
Read the original here:
MAGA-Branded 'Freedom Phone' Is a Black Box That Should Be Avoided at All Costs - Gizmodo
Ransomware as a Service is becoming a trend. Heres what these ASX cyber stocks do to … – Stockhead
Malware attacks and ransoms are becoming even more of a concerning trend lately.
The latest high profile attack was on Florida-based Kaseya, which was delivered a ransom demand of US$70 million by a purported hacker group from Russia calling itself REvil.
Although the ransom has not been paid, what made this attack particularly troubling is that Kaseya provides managed services to smaller clients that might not be so well resourced with tech departments of their own.
The company admitted that up to 2,000 of its clients computers might have been compromised in the attack.
But how do these threat actors gain access, and who are they?
According to experts, REvil actors can target a network via a number of potential entry point.
They could use a previously compromised login credentials to gain remote access, or a malicious email attachment that a user downloads.
In recent attacks however, REvil was able to bypass the networks security by targeting the very systems used to protect customers from malicious software, such as system update files.
The hackers success has given rise to a new industry and criminal networks that essentially take a percentage of the ransom price in return for whats called Ransomware as a Service (RaaS).
Essentially, RaaS is a subscription-based model that enables affiliates to use already-developed ransomware tools to execute ransomware attacks, who then earn a percentage of each successful ransom payment.
This year alone, REvil has been able to extort millions of dollars from its nefarious activities, with the last ransom of US$11 million being paid to the group by the worlds largest meat processing company, JBS.
The group has now grown to become a big operation, and is said to be working out of an unknown base in Russia.
The most recent high-profile cyber attack to hit our shores was one committed on ASX-listed aged care provider, Regis (ASX:REG).
In August last year, Regis announced that it had lost data to an overseas actor which had also started leaking it.
Regis said it was hit using the Windows Maze ransomware, but had apparently refused to pay the undisclosed ransom demanded.
In January this year, corporate regulator ASIC said its systems were breached by an external actor who stole data containing attachments to Australian credit licence applications.
No ransom demand was made in that incident.
Following the attacks, the Australian government set up a website and advised companies not to pay the ransoms, explaining there was no guarantee that paying it will fix devices or prevent future attacks from the same group.
Speaking in parliament this year, Home Affairs Minister Karen Andrews said she was considering forcing businesses to report ransomware attacks.
Many businesses who have been subject to a ransomware attack are not necessarily forthcoming in providing that information, Andrews said.
That could be for a number of reasons theyre concerned about the implications of it being well known that they have been subject to attack, that some of the data has been lost, and that theyre unable to recover that data.
To address these attacks, the Morrison government has announced the nations largest ever investment in cyber security promising $1.35 billion in funding over the next decade to enhance our cyber security capabilities, and assistance provided to Australian companies.
Although each of these ASX-listed companies has a different focus and tech capabilities, they are allset to benefit from the new government funding:
Senetas (ASX:SEN)
The companys subsidiary Votiro owns the software tools that protect against malware and ransomware attacks.
Founded in Israel, Votiro has developed the technology that has the ability to proactively eliminate all known and unknown threats hidden in files.
According to Senetas, Votiros secure file gateway is the only SaaS-based file security solution that ensures all files coming into an enterprise are safe from malware threats and particularly ransomware.
Tesserent (ASX:TNT)
Tesserent is a pure-play cyber-security stock, providing Internet Security-as-a-Service for a customers computer infrastructure.
Its currently the largest provider of cybersecurity services to the Australian Federal government.
The company provides a one-stop shop for a full, end-to-end cybersecurity solution which includes cyber strategy consulting and digital forensics.
archTIS (ASX:AR9)
This data-centric security technology company will prevent malicious and accidental loss of information for its clients.
archTIS products include Kojensi, a multi-government certified platform for the secure access, sharing and collaboration of sensitive and classified information.
Whitehawk (ASX:WHK)
Whitehawk is thefirst global online cyber security exchange marketplace.
The company offers an online toolthat enables small and midsize businesses to take immediate action against cybercrime, fraud, and disruption.
Hubify (ASX:HUB)
Hubify specialises in business connectivity across mobile, data, voice, cloud solutions, and of course, cyber security.
Its other offerings include managed networks, global wi-fi, and hosted voice.
At Stockhead, we tell it like it is. While archTIS is a Stockhead advertiser, it did not sponsor this article.
Get the latest Stockhead news delivered free to your inbox.
It's free. Unsubscribe whenever you want.
You might be interested in
Read the original:
Ransomware as a Service is becoming a trend. Heres what these ASX cyber stocks do to ... - Stockhead
Check Point Software Technologies Sponsors The Smart Factory @ Wichita by Deloitte to Demonstrate the Need for an Integrated Cyber Security Approach -…
SAN CARLOS, Calif., July 06, 2021 (GLOBE NEWSWIRE) -- Check Point Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cyber security solutions globally, today announced it has become a sponsor of The Smart Factory @ Wichita, a new Industry 4.0 immersive experience center by Deloitte. The sponsorship identifies the need for cyber security as a core component of any secure smart factory and enables Check Point customers access to experience the advanced manufacturing methods and technologies at the heart of digital transformation.
As a sponsor, Check Point Software will work with Deloitte to advance the execution of smart factories and enable manufacturers to adopt Industry 4.0 technologies that boost quality, productivity and sustainability, in a digitally secure manner. As part of the sponsorship, Check Point will leverage the powerful ecosystem of The Smart Factory @ Wichita to help customers secure their manufacturing infrastructures and supply chains. From augmented workforce efficiency through asset intelligence to smart warehousing solutions, the digital transformations that manufacturers are undertaking requires a comprehensive cyber security architecture to keep every element of a smart factory safe from ransomware attacks and hackers.
The increasing connectivity of smart factories and the convergence of OT and IT networks expands the attack surface of industrial manufacturing and critical infrastructure facilities, says Dan Yerushalmi, Chief Customer Officer at Check Point Software Technologies. Cyber attacks in the US alone have increased over 300% in the past 9 months creating the need for consolidated cyber security architecture that minimizes risk exposure across IT and OT environments, and blocks attacks before they reach critical assets.
The Smart Factory @ Wichita is a highly digitized, connected production facility that uses technologies such as artificial intelligence (AI), Internet of Things (IoT) and robotics to help companies manufacture products, create new business value, unlock data-driven insights, and automate or eliminate business processes. These technologies enable people to do their jobs in a more productive and efficient manner while improving quality and overall safety. The Smart Factory @ Wichita will bring secure digital transformations to life by demonstrating how to merge existing technologies with new innovations, sparking a dialogue about how companies can accelerate their journeys toward scalable and sustainable capabilities.
Story continues
We are thrilled to have Check Point Software onboard as a Builder sponsor of the Smart Factory @ Wichita to accelerate the secure adoption of Industry 4.0 technologies and the value it can bring to manufacturers across their business ecosystem, said Stephen Laaper, principal, Deloitte Consulting LLP. The integrated cyber approach that Check Point brings to the Smart Factory @ Wichita, and the combined power and effort of our sponsors will enhance the experience and outcome available to clients that walk through the factory doors, accelerating the speed and adoption of a secure digital transformation for their organization.
To learn more about the partnership, please visit:https://www.checkpoint.com/partners/global-systems-integrator/deloitte/
About Check Point Software Technologies Ltd.Check Point Software Technologies Ltd. (www.checkpoint.com) is a leading provider of cyber security solutions to governments and corporate enterprises globally. Its Infinity portfolio of solutions protects enterprises and public organizations from 5th generation cyber-attacks with an industry leading catch rate of malware, ransomware and other threats. Check Point Infinity comprises three core pillars delivering uncompromised security and generation V threat prevention across enterprise environments: Check Point Harmony, for remote users; Check Point CloudGuard, to automatically secure clouds; and Check Point Quantum, to protect network perimeters and datacenters, all controlled by the industrys most comprehensive, intuitive unified security management. Check Point protects over 100,000 organizations of all sizes.
About DeloitteDeloitte provides industry-leading audit, consulting, tax and advisory services to many of the worlds most admired brands, including nearly 90% of the Fortune 500 and more than 7,000 private companies. Our people come together for the greater good and work across the industry sectors that drive and shape todays marketplace delivering measurable and lasting results that help reinforce public trust in our capital markets, inspire clients to see challenges as opportunities to transform and thrive, and help lead the way toward a stronger economy and a healthier society. Deloitte is proud to be part of the largest global professional services network serving our clients in the markets that are most important to them. Building on more than 175 years of service, our network of member firms spans more than 150 countries and territories. Learn how Deloittes more than 330,000 people worldwide connect for impact at http://www.deloitte.com.
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (DTTL), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as Deloitte Global) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the Deloitte name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see http://www.deloitte.com/about to learn more about our global network of member firms.
Ana Perez Check Point Software 415-299-7767press@us.checkpoint.com
See the original post:
Check Point Software Technologies Sponsors The Smart Factory @ Wichita by Deloitte to Demonstrate the Need for an Integrated Cyber Security Approach -...
Some Experts Think It’s Time For An International Cyber Treaty – NPR
U.S. President Biden and Russian President Vladimir Putin shake hands as Swiss President Guy Parmelin (right) looks on during the U.S.-Russia summit at Villa La Grange on June 16 in Geneva, Switzerland. Peter Klaunzer/Getty Images hide caption
U.S. President Biden and Russian President Vladimir Putin shake hands as Swiss President Guy Parmelin (right) looks on during the U.S.-Russia summit at Villa La Grange on June 16 in Geneva, Switzerland.
The recent ransomware attacks on the U.S. gas and meat industries have sparked renewed conversations about the possibility of an international cyber agreement that would set the ground rules for what is and isn't permissible, and spell out sanctions for violators.
In the latest sign of the U.S.-Russia cyber tensions, the National Security Agency and other government security branches issued a joint advisory Thursday on how Russia's military intelligence has been trying to break into government and private computer networks for the past two years.
The statement did not cite specific hacks, though it provided pages of technical details, noting, for example, that the attackers often sought to go through Microsoft's cloud services to reach an intended target.
The timing of the U.S. government advisory was also seen as noteworthy. It came just two weeks after President Biden held a summit with Russian leader Vladimir Putin in Geneva, warning the Russian leader the U.S. would respond to future hacks, especially those directed at "critical infrastructure."
As shown by the attack on Colonial Pipeline that shut down a major East Coast oil distribution network, the U.S. and other countries have a compelling interest in containing such a threat, says Glenn Altschuler, a professor of American Studies at Cornell University.
"We're talking about the possibility of taking out power grids, water systems, hospital services," he tells NPR.
Altschuler thinks such an agreement at least a bilateral version of it between the U.S. and Russia could be loosely modeled on Cold War arms agreements.
Such discussions have been kicking around for years, but many cyber experts remain deeply skeptical that such an agreement could be reached, let alone enforced.
The first big challenge would be simply getting everyone to agree to the rules. Russia, China, Iran and North Korea have all been blamed for significant hacks against the U.S., and analysts say those countries see cyber strikes as cheap, effective and easy to deny.
It's not even clear if such countries would be willing to actually agree to terms, because cyber attacks for them are "really useful in their geopolitical positioning," April Falcon Doss, a former National Security Agency official who now heads a technology program at Georgetown's law school, tells NPR.
Compared to the arms agreements between the U.S. and Soviet Union, a cyber treaty would be extremely difficult to monitor and enforce. That's because the production, development and stockpiling of nuclear, biological and chemical weapons is fundamentally different from the ephemeral nature of cyber weapons, says Doss.
"If the question is whether or not a signatory to a nuclear arms control treaty is building up their nuclear stockpile, there will almost certainly be some evidence, factory production, storage of nuclear weapons," she says. "There will be satellite imagery or there will be on the ground reports."
Tests of nuclear weapons or ballistic missiles, such as those carried out by North Korea in recent years, are also relatively simple to monitor compared to the challenge of keeping an eye on the dark corners of the Internet to track down new cyber weapons, Doss says.
"Detecting their development is much harder because you don't have big stockpiles of missiles sitting around and there's nothing that's visible in that sense," she says.
Thomas Graham, a U.S.-Russia expert at the Council on Foreign Relations, says any analogy to a Cold War-style arms agreement would be tenuous.
"We're dealing with computer code. So this is radically different from some nuclear weapons," he tells NPR.
The Budapest Convention on Cybercrime, currently the only binding international agreement governing cyber crimes and hacking, dates to the early 2000s. It aims to increase cooperation, harmonize national laws dealing with hacking and improve techniques for investigating cyber crimes. While Washington has signed on, Moscow, Beijing, Pyongyang and Tehran have not.
In 2015, when Barack Obama was president, the U.S. and China reached a cyber agreement declaring that neither side would "conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information for commercial advantage."
The Trump administration criticized the deal, which has been widely seen as ineffective.
Priscilla Moriuchi, a former National Security Agency official, calls the U.S.-China deal "a great experiment" that "failed for a number of reasons."
While at the NSA, Moriuchi's job was to monitor Chinese compliance. In an email to NPR, she said her view is that "the Chinese government never really complied with the agreement."
Storage tanks at a Colonial Pipeline Inc. facility in Avenel, New Jersey, U.S. In May the pipeline was hit by a major ransomware attack that caused it to shut down for days. Mark Kauzlarich/Bloomberg via Getty Images hide caption
Storage tanks at a Colonial Pipeline Inc. facility in Avenel, New Jersey, U.S. In May the pipeline was hit by a major ransomware attack that caused it to shut down for days.
Meanwhile, China, Russia, North Korea and particularly Iran have reasons to be just as suspicious of the U.S. and its allies. What many consider the most successful cyber attack ever the 2010 Stuxnet worm that targeted Iranian nuclear centrifuges has been attributed to the U.S. and Israel, though neither country has ever officially acknowledged it.
Recent hacks, including the one against Colonial Pipeline, the major gasoline supplier, and JBS, the world's largest meat producer, were blamed on Russian criminal gangs, not the Russian government itself.
This activity by non-state actors makes the problem of "attribution" that much more difficult, says Graham. "There's also the possibility of false flag operations, because people can disguise the IP addresses," he says.
Cornell's Altschuler says while Cold War arms agreements might not be a perfect prototype, they could at least provide a framework for a cyber treaty.
Instead of inspectors on the ground to guarantee the destruction of nuclear weapons, such a cyber treaty might ensure compliance via remote monitors, he says.
"It would also have to include limiting the monitoring to international cyber traffic and it would have to have protection for privacy so that in most instances, metadata could not be converted into an investigation of an individual," Altschuler says. But he acknowledges that "all of those things are complicated, extremely difficult to work out."
Robert G. Papp, a former director of the Center for Cyber Intelligence at the Central Intelligence Agency, has also called for a cyber agreement with Russia. "It is in our national interest to negotiate some limits to this activity to reduce these threats and the human and financial resources needed to address them," he writes.
Meanwhile, it's important to distinguish between electronic snooping and other types of cyber activity, such as the theft of intellectual property, and attacks that cause physical damage, like shutting down an electrical grid.
"[Cyber] spying is unlikely to go away," Doss says. "No nation is going to want to give up that ability."
So, where does that leave things? Is there a way to limit the damage done by hacking without a formal treaty?
At the recent summit in Geneva between Biden and Putin, the U.S. leader presented Putin with a list of 16 areas of critical infrastructure from energy to water that the U.S. considers off limits.
"[If] in fact they violate these basic norms, we will respond," Biden said.
U.S. officials say Putin has used cyber for his own political purposes and has shown little interest in curbing Russia-based ransomware attacks that prove disruptive to the West. Still, the Russian leader said after the summit that the two sides could "begin consultations" over cybersecurity issues.
A set of such norms would be more obtainable that any sort of formal treaty, Moriuchi says.
She says the only way to establish that kind of norm is outlining clear red lines and imposing consequences if lines are crossed.
Here is the original post:
Some Experts Think It's Time For An International Cyber Treaty - NPR
Greetings from the Internet! Connect with EFF this Summer – EFF
Every July, we celebrate EFFs birthday and its decades of commitment fighting for privacy, security, and free expression for all tech users. This years membership drive focuses on a central idea: analog or digitalwhat matters is connection. If the internet is a portal to modern life, then our tech must embrace privacy, security, and free expression for the users. You can help free the tubes when you join the worldwide community of EFF members this week.
Join EFF!
Free the Tubes. Boost the Signal.
Through July 20 only, you can become an EFF member for just $20, and get a limited-edition series of Digital Freedom Analog Postcards. Each piece of this set represents part of the fight for our digital future, from protecting free expression to opposing biometric surveillance. Send one to someone you care about and boost our signal for a better internet.
Physical space and cyberspace arent divided worlds anymore. The lines didnt just blur during the last year; they entwined to help carry us through crisis. This laid bare the brilliance and dangers of a world online, showing us how digital policies will shape our lives. You can create a better future for everyone as an EFF member this year.
Will you help us encourage people to support internet freedom? It's a big job and it takes all of us. Heres some language you can share with your circles:
Staying connected has never been more important. Help me support EFF and the fight for every tech users right to privacy, free speech, and digital access. https://eff.org/greetings
Twitter | Facebook | Email
We introduce new member gear each summer to thank supporters and help them start conversations about online rights. This year's t-shirt design is a salute to our resilience and power when we keep in touch.
EFFCreative Director Hugh D'Andrade worked in this retrofuturist, neo-deco art style to create an image that references an optimistic view of the future that we can (and must) build together. The figure here is bolstered by EFF's mission and pale gold and glow-in-the-dark details. We have all endured incredible hardships over the last year, but EFFwith the strength of our relationships and the power of the webnever stopped fighting for a digital world that supports freedom, justice, and innovation for all people. Connect with us and we're unstoppable.
Donate TOday
K.I.T. Have a nice summer <3 EFF
See the original post:
Greetings from the Internet! Connect with EFF this Summer - EFF