Stuart O'Brien, Author at Cyber Secure Forum | Forum Events Ltd - Page 60 of 61
Posts By :

Stuart O'Brien

Security IT Summit

EVENT REVIEW: Security IT Summit

 960 640 Stuart O'Brien
By:
0
0

The UK’s cyber security industry descended on the the Hilton London Canary Wharf last Tuesday (July 4th) for the Security IT Summit.

And the timing couldn’t have been more serendipitous – the latest high profile cyber attack demonstrated that companies around the world remain vulnerable.

After the WannaCry ransomware infected more than 230,000 computers in 150 countries last month, the latest virus outbreak last week disrupted world business again, with economic losses expected to be in the billions.

As such, the Security IT Summit represented a unique opportunity for delegates from some of the UK’s biggest corporations and organisations to find the tools they need to protect their business, allowing them to meet with trusted cyber security solution providers, learn from industry experts and discuss challenges with like-minded peers.

Among the solution providers delegates were able to meet were LogRhythm, Bomgar, Celestix, Darktrace, ESET, LGC, Onapsis, Okta, Performanta, Pervade Software, PhishMe, PT Global Solutions, SonicWall, Twist and Shout Media, Unipart Security Solutions, Varonis, WinMagic Data Security and more.

Meanwhile, the event’s seminar programme tackled the big issues of National Cyber Security Strategy, Cloud Software Security and GDPR Compliance.

Plus, delegates got to hear first hand from ex-fraudster Elliot Castro, whose seminar session ‘Fraud: How it’s done – and what to look out for’ detailed how he managed to scam call centres and individuals out of £2 million.

But don’t worry if you weren’t able to attend – we’ll be announcing dates for the Security IT Summit 2018 shortly – for more information about how you can take part, contact Haydn Boxall on 01992 374 084 or email h.boxall@forumevents.co.uk.

10Duke

INDUSTRY SPOTLIGHT: 10Duke Authentication & Authorisation

 960 640 Stuart O'Brien
By:
0
0

10Duke provides authentication and authorisation as-a-service solutions for leading consumer and technology brands worldwide such as Trimble, Unilever, Savills, Volvo, Rovio and more.

Our products are used to address three primary use cases:

The 10Duke Identity Provider – enables Single Sign-On (SSO) for customers accessing applications, whether they are desktop, mobile or web, using either their preferred email (direct login), their company ID (domain login) or their favourite social ID (social login).

The 10Duke Identity Bridge – a cloud-based service that provides Single Sign-On (SSO) capability for employees and contractors to seamlessly access multiple SaaS applications with the same username and password without the need to login separately to each service.

The 10Duke Entitlements – gives you control of the delivery and licensing of your applications; it provides an engine to dynamically create and manage the licenses you offer to customers and supports a wide variety of license models.

bluetooth

GUEST BLOG: Everything you need to know about Bluetooth security

 960 640 Stuart O'Brien
By:
0
0

By Alex Viall, MD, Mustard IT

Bluetooth technology has been around since 2000. It’s become a seamless way for professionals to connect devices and it can be deployed for a variety of uses – from diverting voice calls through car speakers, to providing the freedom of wireless mice, headphones and more. The question now however, is how safe is Bluetooth technology?

Has the ubiquity of the technology created complacency regarding Bluetooth network security? Everyone is aware of the risks involved with using the internet for business, but have you thought about the impacts of a breach of a Bluetooth connection?

This article will explore how Bluetooth actually works, where the Bluetooth security vulnerabilities are, and how to reduce your Bluetooth security risks, both on the go and from an organisational perspective.

What are the security issues?

Bluetooth is extremely convenient, but it can leave users vulnerable to Bluetooth security risks if it’s not used safely. If you have email, social media, banking apps or confidential files on your device, you are at risk.

It’s vital that devices used for business in particular are protected from attack. Once we understand some of the many ways hackers can wreak havoc on your systems using Bluetooth vulnerabilities, we can learn to protect ourselves.

Viruses and worms

Smartphones and tablets are vulnerable to viruses often downloaded from reputable looking apps. Smartphone keyboards are prone to typing errors, which can lead to mistyped web addresses. Misspelling a common website name by one letter can lead to malware and other damaging files can be installed on your devices. As smartphone screens are smaller, counterfeit websites can be more difficult to spot. Once a virus has been installed, it can open up the device to Bluetooth security vulnerabilities and other issues.

Bluesnarfing

If a hacker gains access to your device (by connecting without your permission) they can steal personal data from calendars, email, images, contacts, messages etc. This could compromise any amount of sensitive information. Does Bluetooth use data once it’s been hacked? No, it remains limited to radio waves.

Denial of Service Attacks (DDOS)

This is a malicious tactic sometimes used to inconvenience or intimidate a person. If a DDOS attack is launched on your device, it will become overwhelmed with nuisance instructions and freeze up. Calls can’t be answered, data is (sometimes permanently) inaccessible and chews up battery power.

Bluebugging

This is also known as Bluetooth eavesdropping. Just as virus websites use a misspelled address to trick users, hackers set up common looking device names (‘printer’ for example) and trick you into pairing with them instead of the actual device you were seeking. These are an unfortunate factor of Bluetooth security vulnerabilities.

As you pair with them, they gain access to your entire device – they can hear and record calls, track your location on GPS and use your contact list.

If you have connected to a headset with a microphone, hackers can even listen in to conversations that are happening around you. As with bluesnarfing, you wonder does Bluetooth use data when it’s been hacked and the answer is no, so that’s one less thing to worry about.

How to reduce risk – update your Bluetooth versions

The level of Bluetooth security involved depends on which Bluetooth versions the devices use. We’ll explain each of the versions below. It can sometimes be difficult to tell which Bluetooth versions your devices have. If you’re unsure, contact the manufacturer directly. No matter which version you use, Bluetooth multi connect won’t be available, but it may update with newer releases of the hardware.

Level One

If you have level one devices, it means they will ‘pair’ (connect) without requiring any Bluetooth passkey or verification. This can be very risky – it is essentially an open door, where anyone can pair to your device and access what’s stored there.

Level Two

This is the most common Bluetooth security setting. The devices pair together, and then ask for security codes to be exchanged to verify the connection. The short period of time between pairing and verification can create a security vulnerability but the risk is minimal.

Level Three

Devices with level three security offers strong Bluetooth protection against unwanted intrusions. These devices must authenticate (swap security codes) before pairing, which means the gap found in level two devices is completely closed.

Level Four

These devices have the most stringent authentication protocols. They act like level three devices and authenticate before pairing. The authentication process is more complex, making it extremely difficult to penetrate, reducing the Bluetooth security risks significantly.

Accessories

A final point on hardware – it may be worth researching common Bluetooth enabled accessories, such as headsets or headphones. Some brands have additional layers of encryption available. It is worth paying more for extra risk reduction, and helps to answer the question: is Bluetooth safe?

How to reduce risk – behavioural change
Once you are confident that you are using the most appropriate version of Bluetooth on your devices, you can begin to focus on behavioural change.

Because proximity is critical to connecting, a lot of harm can be avoided by doing the majority device set up in a secure location (like the office).

Implementing these changes will see a huge boost for your Bluetooth network security.

Connect devices in secure locations

The biggest opportunity for hackers to access a device through Bluetooth vulnerabilities is the moment between two devices pairing and trading authentication codes.

This gap can be only a second long but it’s long enough to be a risk. To avoid exposing yourself to this risk and increase Bluetooth protection, pair devices at the office or at home.

You only need to do this once for each coupling. Once the connection is authorised the gap is closed. Connecting privately reduces the risk of Bluetooth eavesdropping.

If your devices do become unpaired (it happens), resist the urge to reconnect them in public, even if you are on the go.

When you can’t return to the office, remember the 50m proximity rule and find somewhere isolated to reconnect.

Hide your connection

If Bluetooth is enabled on a device, it will automatically broadcast its presence to every other device within range. This is called being set to ‘discoverable’. It’s necessary to be discoverable when you’re trying to pair with another device of course. If you are not actively seeking to connect to a device, change your settings to ‘undiscoverable’ to avoid Bluetooth eavesdropping. You can still use your Bluetooth but no-one else can find your device on a list. If you’re not using Bluetooth, turn the function off completely until you do need it to provide additional Bluetooth protection.

Reset the PIN

The authorisation code used to couple devices is commonly a preset 4 digit PIN. If you have the option to change this, do so. Extend the code from 4 to 8 characters, and make the code an alphanumeric scramble. Treat it with the same respect as any other password.

Lock down your smart device

In today’s mobile business environment, a smartphone is the most likely device to broadcast information through a Bluetooth connection. Add passwords, codes and authorisations on any account that’s linked to business data. That way if hackers do access the device, there may be little for them to see, reducing Bluetooth vulnerabilities.

How to reduce risk – policy change

It’s possible that your staff are completely unaware of the risks they can bring to the business by using Bluetooth in public places. Depending on the size of your workforce, you will need to educate them on the risks and make some changes to company devices are managed.

There are changes that can be made with Bluetooth network security on the individual behavioural level and also in cooperation with your IT and cyber security teams.

The following suggestions centre around smartphones and tablets, because they are common data hubs and most likely to be paired in public areas.

When a new device is deployed:

  • Install encryption software
  • Install mobile anti-virus software
  • Enable password protection (using voice recognition and fingerprint scans if possible)
  • For all accounts connected to the device, use randomly generated passwords
  • Turn off on-screen notifications. This stops confidential business related messages and emails displaying on screen for anyone to see

Use digital hygiene:

  • Connect to company networks using SSL VPNs only. This scrambles access for opportunist hackers.
  • Do not save passwords on the device (either as autocomplete options or as a note). Autofilled passwords are a gift to anyone with bad intentions.
  • Close applications that aren’t in use. It will save battery life and restrict hackers from accessing them without passwords
  • Unpair devices from one-time connections like printing booths or rental cars. Delete your connection from the car if you can.
  • Clearing this data should be routine for company cars due for return from long term leases.
  • Turn off WiFi, Bluetooth and GPS when the connections aren’t being actively used. It’s far more difficult to connect to a device when these pathways are closed. It will save battery, too.
  • Install updates as soon as they are available. Updates are released in response to newly identified weaknesses in data security.
  • Failing to update leaves devices vulnerable to known risks.
  • Back up data as often as practical. This may occur automatically through cloud accounts or need to be done manually on a schedule. Ensure the data storage is secure too.
  • If a device goes missing (i.e. lost or stolen) it must be reported directly. Remove the device from all lists of paired devices to deny access.
  • Do not pair with an unknown device, or accept a digital business card without an identifiable source. Spontaneous pairing requests should always be denied, especially if it requests your Bluetooth passkey. Avoid this by keeping devices set to undiscoverable.

IT department involvement:

  • Issue company devices for staff. There will be an initial cost, however having high level access and control on these devices can provide a huge ROI in terms of cyber security threat reduction.
  • Make use of a company rights management system on smart devices. This allows an additional layer of security before allowing access to sensitive company data. For more information on this or other network security issues read our page on securing your network.
  • Decide if personal devices should be permitted to connect to company wifi networks. This has huge potential for exploitation. Consider establishing a separate, limited network that provides connection but no access to company systems.
  • Install anti virus software onto company devices. Business management apps can also monitor usage, which can feed into security, efficiency and other metrics.
  • Develop a new user checklist to include with company issued devices. The checklist could include information about is Bluetooth safe, instructions on how to pair Bluetooth devices safely, what is the range of Bluetooth, how to connect to the CRM and password requirements, for example.
Wannacry

BT and KPMG pinpoint corporate cyber security traps

 960 640 Stuart O'Brien
By:
0
0

BT and KPMG have published a new cyber security report offering practical advice to businesses of all sizes on how best to manage their security journey and turn it into a business opportunity.

The new report, “The cyber security journey – from denial to opportunity”, warns businesses against falling into dangerous traps as they deal with the complexity of securing a digital enterprise. These include being stuck in ‘Denial’ and ‘Worry’ phases at one end of the spectrum, and ‘False Confidence’ and ‘Hard Lessons’ at the other end.

While the report stresses that investment in technology such as firewalls and antivirus protection is essential ‘good housekeeping’ practice at the start of the security journey, firms should avoid throwing money away on IT security products as a knee-jerk reaction. This is especially true for companies who have matured from the stage of denial into the stage of constant worry, where investing in the latest technology can be viewed as the silver bullet to the problem. This common mistake can make such firms a target, not just for cyber criminals, but also for over-zealous IT salespeople.

Businesses must first assess their current controls against best practice, such as the guidance issued by the UK’s National Cyber Security Centre (NCSC), to help identify any gaps and prioritise essential areas in which to invest. Furthermore, everyone in the organisation, from the board down, must take responsibility for maintaining high standards of cyber hygiene, while businesses must invest in training and raise awareness amongst staff. This can help turn employees from the weakest point in any security chain into every company’s greatest asset in the fight to protect data.

Mark Hughes, CEO, BT Security, said: “The global scale of the recent ransomware attacks showed the astonishing speed at which even the most unsophisticated of attacks can spread around the world. Many organisations could have avoided these attacks by maintaining better standards of cyber hygiene and getting the basics right. These global incidents remind us that every business today – from the smallest sole trader through to SMEs and large multinational corporations – needs to get to grips with managing the security of their IT estate, as well as their people and processes.

“Our report aims to help secure the digital enterprise by navigating businesses through their cyber security journey. By sharing valuable insights from senior IT security leaders, we hope to help businesses of all sizes transform cyber security from operational risk into a business opportunity.”

David Ferbrache, Technical Director in KPMG’s cyber security practice, said: “The recent spate of cyber-attacks is keeping cyber risk at the top of the business agenda, and as such investments are being made. The business community needs to avoid knee-jerk reactions as cyber security is a journey – not a one size fits all issue, and getting the basics like patching and back-ups right matters. It’s important to build a security culture, raise awareness amongst staff, and remember that security needs to enable business, not prevent it.

“Cyber threats are evolving and businesses face ruthless criminal entrepreneurs. The solution isn’t jargon ridden technology silver bullets but one that involves a community effort in a world where business boundaries are vanishing. With criminals getting increasingly creative about finding the weakest link, the CISOs of the future need to care about digital risk, help the business seize opportunities and build cyber resilience.”

Although cyber security issues are increasingly discussed at board level today, the report claims that those discussions are too infrequent and are treated as a separate and disconnected issue from broader operational risk. All too often, the issue of cyber security is not incorporated into the overarching business strategy.

The paper also argues that overly complex IT architecture can worsen security gaps. This is especially the case if the technology deployed is too difficult to use or there’s a lack of integration.

In order to address these risks and gain true leadership in cyber security, the report calls on firms to focus on good governance processes, the proper integration of technologies and to consider outsourcing some less critical aspects of their security to a trusted partner. This, combined with the sharing of intelligence, good practice and hard-won lessons among a network of peers and beyond would put the company in a position to think about cyber security differently. Namely, not as a risk which is discussed by the board perhaps twice a year, but as a business opportunity and enabler for digital transformation.

Hacking

Cyber security specialist Trend Micro launches $100m venture fund

 960 640 Stuart O'Brien
By:
0
0

Trend Micro has launched a corporate venture fund to explore emerging technology markets with an initial investment of $100 million.

The fund will nurture a portfolio of startups that are incubating ideas in hyper growth markets, such as the Internet of Things (IoT).

Japan-based Trend Micro cites Gartner data, which estimates 26 billion devices will be connected to the Internet by 2020

Eva Chen, founder and chief executive officer for Trend Micro, said:”Trend Micro’s vision has always been to make the world safe for exchanging digital information. The explosion of devices is transforming how the world works, thinks and acts. It is clear that the ecosystem is still evolving and there is work to do to ensure organisations and individuals can operate and live safely in this new reality.”

Trend Micro’s venture will offer companies financial backing, access to its global threat intelligence, strategic alliances, as well as its channel of more than 28,000 partners.

In return, the company says working with these investments will uncover insights into emerging ecosystem opportunities, disruptive business models, market gaps and skillset shortages – influencing its cybersecurity solution planning.

“We have a 29-year history of successfully anticipating technology trends to secure all types of environments,” said Chen. “The first mega wave we caught was the growth of the PC marketplace; we committed early on to endpoint protection and remain a Leader in Gartner’s Magic Quadrant for Endpoint Protection Platforms today2. The second mega wave was all about the cloud; we made a bet early on to securing the cloud and so far we have secured over two billion workload hours on Amazon Web Services (AWS) alone. Now, we believe the next wave has arrived with IoT; our fund will help us harness this opportunity.”

 

Tim Cook

Apple and Cisco team up for cheaper corporate cyber security insurance

 960 640 Stuart O'Brien
By:
0
0

Apple and Cisco Systems have teamed up on an initiative they claim should enable businesses to secure cheaper cyber security insurance.

The tech giants shared a stage in Las Vegas to pitch the idea that if companies are using a combination of their respective technologies, which both claim are more secure than rivals such as Android, then this should be reflected in the pricing of premiums.

There were few details of how this would work in practical terms, but Apple CEO Tim Cook (pictured) said: “The thinking we share here is that if your enterprise or company is using Cisco and Apple, the combination of these should make [cyber-security] insurance cost significantly less. This is something we’re going to spend some energy on. You should reap that benefit.”

Cisco elaborated a little further in a blog post, stating that the partners were “collaborating with insurance industry heavyweights… to offer more robust policies to customers.”

One area the company is looking at is continuous security monitoring, with checks and balances available to insurers so they can see if systems have been set up and configured correctly.

It’s an interesting development, which will almost certainly illicit a response from rivals in the corporate IT and software sectors.

Security IT Summit

EVENT PREVIEW: Security IT Summit

 960 640 Stuart O'Brien
By:
0
0

The Security IT Summit will be logging in to the Hilton London Canary Wharf next Tuesday (July 4th), giving senior cyber security professionals the opportunity to meet, learn and do business in what is a unique industry event format.

Delegates from some of the largest companies in the UK will discover the latest IT security solutions, while having the chance to learn, first hand, in a keynote seminar how ex-fraudster Elliot Castro managed to scam call centres and individuals out of £2 million.

Elsewhere, Martin Landless of LogRhythm will present Threats are evolving: A new approach to cyber security is required, focussing on the early detection of, and the response to threats.

In addition, CensorNet’s Richard Walters will discuss Going beyond CASB to manage tomorrow’s threat landscape. He will take a look at how the increasing adoption of cloud applications is driving the market need for a context and user behaviour-driven security approach.

Delegates at the Security IT Summit will be representing companies including Kingfisher, GE Capita, RWE Innogy, Specsavers, Sainsbury’s, Bank of America Merrill Lynch, NGC, Astellas, Aviva, The Open University, Nomura, Clifford Chance, Barking, Havering & Redbridge NHS Trust, SSP Group, DST (International financial data services), Ford Credit Europe, The Hillingdon Hospitals, SI Group, Cancer Research UK, Close Brothers, Westfield (Europe), The Celtic Manor Resort Amnesty International, Worldpay and many more.

Attending solution providers include LogRhythm, Bomgar, Celestix, Darktrace, ESET, LGC, Onapsis, Okta, Performanta, Pervade Software, PhishMe, PT Global Solutions, SonicWall, Twist and Shout Media, Unipart Security Solutions, Varonis, WinMagic Data Security and more.

To find out more about the Security IT Summit, contact Haydn Boxall on 01992 374 084 or email h.boxall@forumevents.co.uk.

LogRhythm

INDUSTRY SPOTLIGHT: LogRhythm Threat Lifecycle Management

 960 640 Stuart O'Brien
By:
0
0

LogRhythm, a leader in Threat Lifecycle Management, empowers organisations around the globe to rapidly detect, respond to and neutralise damaging cyberthreats.

The company’s patented award-winning platform unifies next-generation SIEM, log management, network and endpoint monitoring, user entity and behaviour analytics (UEBA), security automation and orchestration (SAO) and advanced security analytics.

In addition to protecting customers from the risks associated with cyberthreats, LogRhythm provides compliance automation and assurance, and enhanced IT intelligence.

Among its many industry accolades, LogRhythm has been positioned as a Leader in Gartner’s SIEM Magic Quadrant, received SC Labs’ “Recommended” rating for SIEM and UTM for 2017 and won “Best SIEM” in SANS Institute’s “Best of 2016 Awards.”

Calipsa launches next-gen video surveillance

 400 280 Stuart O'Brien
By:
0
0

British start-up Calipsa has launched its next generation video surveillance technology, built on Deep Learning models.
The technology revolves around algorithms that can process and analyse hours of video feeds to provide alerts and detailed reports for applications where real-time video monitoring is key, including traffic enforcement, road accidents and public disorder.
The Calipsa engine uses a feedback loop to continuously evolve and improve over time. Human operators can ‘teach’ the artificial intelligence using a simple point and click interface, which automates repetitive parts of their jobs. Designed to work with any existing camera or video source, the technology can be deployed quickly via the cloud or on-premise, with no retrofit required. Calipsa is highly adaptable to all weather and lighting conditions, with 95 per cent accuracy.
“There are around 250 million video surveillance cameras in operation worldwide today, capturing 1.6 trillion hours of video annually. Yet despite the fact that we live in the 21st century, the majority of video surveillance carried out by the police, military, transport operators and security companies, is still done by humans,” explains Mohammad Rashid Khan, co-founder and CEO at Calipsa. “This doesn’t make sense, as it’s very time consuming, expensive and inefficient. You can imagine that manually viewing huge quantities of video data for hours and hours can lead to fatigue, loss of attention, and most important, errors – at a time when video surveillance has never been more critical in our society.”
The Calipsa team, which comprises expertise from universities including Cambridge, Imperial College London and UCL, has raised a seven figure seed funding round from a number of well-respected venture capitalists, including LocalGlobe, Horizons Ventures and Entrepreneur First – which have backed some of the biggest companies in the world.
Calipsa is already working with customers in the UK, France and India and is now seeking strategic partners to take its technology to the market.
www.calipsa.io

Security

GUEST BLOG: The WannaCry fallout – It’s not just hospitals looking for extra protection

 960 640 Stuart O'Brien
By:
0
0

By Claire Stead, Online Safety Expert at Smoothwall

It is without doubt that the international uproar and magnitude of the WannaCry cyber-attack on the NHS has left many organisations on edge. Unfortunately, this is the digital world organisations now live in, with cyber-crime now accounting for 50% of all UK crime. Not only that, but ransomware attacks have risen by 600% from 2015 to 2016, highlighting how much more serious ransomware and other cyber-attacks are becoming.

It seems that the NHS’s cyber-attack has been a wake-up call for organisations, as we at Smoothwall have seen a notable increase in the number of inbound requests from organisations not in healthcare, but in business and education looking to shore up their security offerings. What’s clear, is that this has been a wake-up call for each and every industry sector, whose fingers have just got that little bit closer to the panic button.

All organisations, no matter how large or small, public or private sector, need to realise that they have a target on their backs and make cyber security a top priority. They need to have both the cyber security tools and processes in place, as well as an on board workforce to ensure their cyber security is as tight as possible.

All members of an organisation need to be educated to understand the importance and risks around cyber security, and the appropriate processes to follow to keep hackers out, and data safe and secure. This goes throughout the organisation from the c-suite to the rest of the workforce. It is common knowledge that human error accounts for the majority of cyber security incidents with many businesses not investing in the training of their staff to ensure they can detect against malicious email, web pages or links. Organisations need to instil a cyber security mantra within its employees, so that they do not become the weak link in the cyber security chain.

Our approach is simple and is summed up using our 4Ps:

Perception – the security mindset must now be shifted to a ‘security first’ policy. Businesses, schools and hospitals now have to put security at the forefront of all their policies as the risk of an attack grows year by year.

Policy – whether in a school or a business, pupils/staff need educating about the risks of their actions and know the security measures in place to mitigate those risks. This could be anything as simple as regularly updating complicated passwords to recognising ‘phishing’ emails.

Protection – a layered security programme, creating a brick wall of security that can verify the organisation is constantly protected.

Proactivity – it’s no good to have a security programme installed and to never think on it again. The landscape is developing at an incredible rate, and as a result, schools need to ensure that they are keeping up to date with the latest updates and improvements to ensure that they are protected as best they can be.

No cyber security programme is ever going to be 100% secure, but with the right measures and tools in place, with a fully compliant team on board, it will give organisations that much more of a fighting chance against the threats of cyber criminals.