Gallery

Security vendor CheckPoint provides insight into what are the organizational cybersecurity priorities for next two years, as well as where cybersecurity is going to be challenging.

It’s no secret; cybersecurity has become much harder this year. The pandemic has taken a toll on every organization’s cybersecurity posture, making it increasingly more difficult as more users want to work from home and cybercriminals step up their game to take advantage of this “new normal.”

New survey data from CheckPoint highlights where the problems are and what organizations are planning on doing about it:

• 58% of organizations feel they are facing an increase in cyberattacks since the pandemic
• 95% say they changed security strategies mid-year
• The two biggest security challenges are remote workers (47% of orgs) and protecting against phishing and social engineering attacks (42%)
• Securing remote working is the top priority for the next two years (cited by 61% of orgs)
• Half of orgs say their new security approach is here to stay, even after the pandemic subsides.

With a remote workforce, it’s imperative that organizations look to improve the security posture, even by those users working on a home network and a personal device. Security Awareness Training is the one part of your security strategy that can be easily applied regardless of where the user works, what device they are on, etc.

Organizations look to be getting serious about how they will maintain the same levels of security they’ve enjoyed for years within the corporate network now that a material portion of their workforce works remotely. Ensuring the user plays a part of that strategy is going to be the critical element to determine whether the org is truly secure moving forward.

Researchers at Anomali have discovered eighteen scam websites offering pets for sale. Most of the websites purport to be selling dogs, although some offer cats and birds as well. The sites are all operated by the same group of scammers that use similar social engineering tactics to lure people in.

“The websites all share similar and sometimes identical text in their reviews/testimonials pages,” the researchers write. “There are also numerous typos in the testimonials with one post discussing how a German Shepherd had ‘hatched’ and was available, which is a clear copy-and-paste error from the actors’ bird fraud websites.”

While the scammers’ writing skills won’t win any awards, the photos of puppies may be enough to get people to lower their defenses. If a user clicks the “Buy me!” button, they’ll be taken to a contact form where they can get in touch with the scammers.

The researchers explain that the scammers are exploiting the holiday season as well as the increased demand for pets amid the pandemic.

“The COVID-19 pandemic has increased pet purchases as stay-at-home policies and remote work makes people seek companionship from their animal friends, a condition that may amplify the bad actors’ ability to run a more successful scam,” the researchers write. “Furthermore, these scams focus on purebred dogs, which again are increasingly difficult to find.”

Anomali offers the following tips for users to avoid falling for scams:

• “Be extremely cautious if the price is too good to be true.
• “Be extremely cautious if the site does not provide you with the owner’s names, address, and social pages.
• “Pay attention to elaborate testimonials that are too good to be true. They are often copied too, so you may google a part of it to see if it is unique.
• “Pay attention to typos and phrases like “Labrador baby had hatched,” scammers often sloppy in their templates and have bad English.
• “If they give you a phone number, try Googling it. Often the fraudsters use the same phone number for different schemes, and it might be already listed on some scam lists.
• “Be extremely careful if you are advised to pay for your future pet with Bitcoins or gift cards, which is even more suspicious.”

And besides, people who can’t keep the puppies and the hatchlings apart in their own minds can hardly be reliable pet sellers. And, as always, new-school security awareness training can teach your employees to follow security best practices.

Anomali has

New data reported earlier this year by Security Magazine shared a report from Secure OAuth that 53% of users reuse the same passwords on multiple accounts. Among those 44% admit to using their personal passwords at work.

Additional findings include management having the worst password hygiene. Only 38% of those in leadership positions say their work passwords are unique. 34% of Director-level positions admit to using one of the most common passwords.

In 2018, OpenVPN reported that the number of employees reusing common passwords on their accounts was only 25%. This year, the percent has nearly doubled.

Password sharing also runs rampant in the office, with text message being the common way people share a password. As most users continue to work in a remote environment, it’s important to teach your users how to have healthy password hygiene to avoid any potential data breach or malicious attack.

Some ways to avoid reusing the same passwords would be to invest in a password management system. Password management systems can help your users store complex passwords without having to remember the laundry list of passwords for you. You can also implement effective password policies, such as giving a timeframe on how often users should update their passwords, or consequences if a common password is used.

Consistent education is essential in ensuring your users are prepared with the tools to apply these best practices to their day-to-day work functions. New-school security awareness training can teach your users tips and tricks on how you can stay safe from the bad guys from infiltrating your account.

A new report from the Identity Theft Research Center discusses which cybersecurity attacks will be most impactful next year as part of the ITRC’s 2021 predictions.

It’s a pivotal moment with an organization primarily focused on helping individuals with identity theft bothers to say that cybercriminals are less focused on making the consumer a victim and more interested in attacking organizations. When they say it, you should be listening.

And that’s exactly what was reported in this year’s ITRC 2021 predictions. According to the ITRC, cybercriminals are generating more revenue through ransomware attacks and business email compromise (BEC) via phishing schemes than they are via individual consumer scams or consumer behavior.

According to the report:

“Cybercriminals are focusing on cyberattacks that require logins and passwords to get access to corporate networks for ransomware or Business Email Compromise (BEC) scams. These attacks require less effort, are largely automated, the risk of getting caught is less, and the payouts are much higher than taking over an individuals’ account. The average ransomware payouts for all businesses have grown from less than $10,000 in Q3 2018 to more than $178,000 per event by the end of Q2 2020. Large enterprises are making average ransomware payments of over $1 million. BEC scams cost businesses more than $1.8 billion in 2019.”

And because a consumer-focused organization is saying this, it’s even more imperative that you take note and do something about it. The use of phishing is a constant in both BEC and ransomware scams. Teaching users not to engage with such malicious content via Security Awareness Training is a critical part of a strong security defense that stops attacks before they gain a foothold within your organization.

Cybercriminals are still using Zoom and other conferencing platforms as phishbait, according to Zlati Meyer at Fast Company. This phishing theme isn’t likely to let up any time soon, so employees need to know how to recognize these scams.

“The bait is decorated with the Zoom logo and sent via text, email, or social media message to say that your account has been suspended (but can be reactivated by clicking on the attached link), that you missed a meeting (but can click on the link to find out the details and schedule), or that Zoom is welcoming you (but you need to click on the link to activate your account), according to the Better Business Bureau,” Meyer writes. “Of course, the link does none of those things and instead downloads malware to your computer or mobile device or takes you to a login page where you need to enter your login and password, which lets the thieves gain access to other accounts with similar combinations.”

Edgar Dworsky, founder of Consume World, told Fast Company that this trend isn’t surprising, since scammers always capitalize on what’s popular at the moment.

“For people who are in this business of doing phishing schemes, it becomes the scam du jour,” Dworsky said. “What’s popular now? How can I capitalize on something that’s in people’s minds, that they use? The timeliness and popularity is something they look for.”

Dworsky added that scammers exploit the fact that Zoom notifications are something they have to pay attention to for their jobs.

“They create a sense of urgency, because they know you have some upcoming meeting and need to fix this,” Dworsky said. “With any one of theses phishing scams, you have to look before you click. The relevance lends credence to the fact that that’s legit.”

New-school security awareness training with realistic, up-to-date phishing simulations can help your employees recognize social engineering tactics.