ActiSoft Technology - Blog #Incident Response

Zero-Day Attacks: What Are They, Who's at Risk and How to Avoid Them

Tue, 31 May 2022 11:00:14 +0000

Zero-day attacks are on the rise, with events reaching an all-time high in 2021. But what exactly is a zero-day attack, and how can you avoid it wreaking havoc for your organisation?

Zero-Day is a generic term which describes a cyber threat that’s just been discovered. When a vendor or developer finds out about the flaw they have to fix it immediately, meaning they have “zero days” in which to act. It’s sometimes written as 0 Day, and a range of different words are used alongside, including attack, vulnerability and exploit

Let’s take a quick look at each one individually, because there are some important differences.

Zero-Day Vulnerabilities are flaws in software that attackers discover before vendors know anything about them. Because those vendors are blissfully unaware, they haven’t yet been able to create the necessary patches to keep them safe.
Zero-Day Exploits refer to the methods hackers use to make the most of those vulnerabilities, and:
Zero-Day Attacks are the next step, when hackers take action and steal data from vulnerable systems

How Do Zero-Day Attacks Work?

You’ve probably heard of patches; solutions that fix problems that arise as the result of software updates. Developers are always on the lookout for these problems, but unfortunately, so are hackers. So, if the attacker gets their first, developers find themselves in a race against time.

Attackers come in a number of forms, the most common being cyber criminals who are in it to make money. Other Zero Day attackers are:

Hacktivists: hackers who are motivated by social or political causes and want to raise awareness of their beliefs

Corporate Spies: these people engage in espionage on behalf of organisations looking for information – often about their competitors

Countries and Political Bodies engaging in Cyberwarfare

Once hackers identify a vulnerability, they will quickly write and develop a code (known as an “exploit code”) that enables them to take advantage of it. The most common way they do this is through phishing emails, which look like they’ve been sent from a trusted source. The message will ask the recipient to click on a link, visit a website or download malicious software. Once the code has been deployed, victims are open to a vast range of cyber-attacks, including identity theft.

Hackers will be constantly looking for vulnerabilities to exploit, and they can also buy them on the dark web. Depending on the software and the type of data that can be obtained, these exploits are hugely valuable – in 2018, the average cost was around £2,000. Cyber criminals sometimes act straight away, but they may just sit and wait for the best time to attack.

As soon as developers are made aware of a vulnerability, they will try to patch the software in order to prevent an attack. Unfortunately, it can take days, weeks or months for these vulnerabilities to present themselves – and be fixed.

As soon as an exploit has been identified and patched, it’s no longer seen as a Zero-Day threat.

Common Targets

If your system has been infiltrated, you might start noticing things like unexpected traffic, and suspicious scans and log-ins. It’s not always easy to spot a Zero-Day vulnerability, especially if you’re not in the know, but here are a few things that developers look out for:

Missing data encryption
Broken links and algorithms
Bugs
Missing authorisation information

How to Prevent an Attack

By their very definition, Zero-Day attacks are impossible to patch. However, there are some methods that can be used to prevent them happening in the first place. These include vulnerability scanning, patch management software and input validation, which all help you spot threats in real time.

One of the most effective and popular ways to prevent a Zero-Day attack is with a good web application firewall, which helps filter out unwelcome visitors and identify weak spots. We can help with all of the above, as well as offering a range of other systems and services to help protect your organisation from common cyber-attacks. Contact our team of cyber security specialists here at Actisoft Technology to find out more.

Are your users putting a big target on your organisation’s back?

Cybercriminals are constantly coming out with new ways to hack into your network and steal your organisation’s confidential information.

Find out if your users are putting a big target on your organisation’s back.

KnowBe4’s new Password Exposure Test (PET) is a complimentary IT security tool that allows you to run an in-depth analysis of your organisation’s hidden exposure risk associated with your users.

PET makes it easy for you to identify users with exposed emails publicly available on the web, and checks your Active Directory to see if they are using weak or compromised passwords that are part of a known data breach. PET then reports on any user accounts affected so you can take action immediately!

Here's how it works:

Checks to see if any of your organisations email addresses have been part of a data breach
Tests against 10 types of weak password related threats associated with user accounts

Checks against breached or weak passwords currently in use in your Active Directory

Reports on the accounts affected and does not show/report on actual passwords

Just download the install, run it, get results in minutes!

Identify how many users take the bait and reply before the bad guys do!

Try It Now!

Eight Top Tips for Managing Risk in Your Organisation

Thu, 26 May 2022 14:23:25 +0000

Technology presents us with opportunities that even just a few years ago would have seemed impossible, but with those opportunities come a whole new set of risks. So, how do you strike a balance? We’ve put together a list of habits to help you embrace the digital revolution and minimise risks.

1) Make Sure You Know Your Business Inside Out

In order to properly manage risks, you need to first have a clear picture of what you’re working with. Once you have a detailed list of all your critical assets, technologies (including all devices), objectives and processes, you’ll be able to get a better idea of vulnerabilities – and how to tackle them.

2) Prioritise Tasks According to Risk

It might feel a bit overwhelming trying to work out where to start, which is why a thorough inventory is worth its weight in gold. Once you’ve identified all the devices and processes you use, do a risk assessment for each one and prioritise your task list according to your findings.

3) Understand What Your Stakeholders and Board Members Want

Most boards and customers are asking more questions about data security now, so you’ll need to be prepared to answer their questions and provide accurate reports. Take the time to build relationships with your stakeholders and listen to their concerns and draw up a risk report based on their needs. Ask your board how often they want to be updated and what level of detail they want – in most cases, they won’t need to understand the minutiae of how you’re handing every risk, as long as you can prove you’ve thought about all eventualities and are being proactive.

4) Follow Industry Best Practice and National Standards

Drawing up a risk management strategy can be time consuming, and your time is precious, so don’t stress yourself by trying to reinvent the wheel. Take a look at best practice in your industry and do some research into how other businesses in your sector are managing risk, then adapt it accordingly to suit your own organisational requirements.

5) Create a Resilient System

Any IT expert will tell you that prevention is much better than cure, so it’s all about being proactive and resilient. Ransomware continues to be a big threat for industries across the board, but it’s actually pretty easy to manage with the right software and processes in place. That said, there’s no silver bullet that offers guaranteed protection against all cyber threats, so you’ll also need a robust incident response plan in place to ensure that if your data does become compromised you can get back up and running quickly and cost effectively.

6) Promote a Culture of Awareness

You can invest a fortune in anti-virus software, but the most important part of your cyber security toolkit is arguably your people. Hackers can only infiltrate your system if someone lets them in, so invest in good training and keep your staff up to date on common risks and how to spot them.

7) Make Informed Decisions

There are lots of different types of software out there that all claim to offer all singing, all dancing protection against cyber-attacks. But just because a brand claims to be good, there’s no guarantee they will be, so take your time to ask questions, read (genuine) reviews and work out what you really need. Never assume systems, people and processes can be trusted until you’ve done your homework.

8) Know Your Enemy

Sun Tsu wrote about it centuries ago in The Art of War, and it’s still relevant now – when you understand who your adversaries are know how they behave, you’ve got a much greater chance of winning the battle. It’s essential to make security awareness an intrinsic part of everything you do and keep on top of the latest cyber crime trends and tactics – or, if you really can’t stand getting bogged down in such things, you invest in a good ally who will fight on your behalf.

To find out more about how to manage risk in your organisation, contact our friendly team of specialists here at Actisoft Technology today!

Are your users putting a big target on your organisation’s back?

Cybercriminals are constantly coming out with new ways to hack into your network and steal your organisation’s confidential information.

Find out if your users are putting a big target on your organisation’s back.

KnowBe4’s new Password Exposure Test (PET) is a complimentary IT security tool that allows you to run an in-depth analysis of your organisation’s hidden exposure risk associated with your users.

Here's how it works:

Checks to see if any of your organisations email addresses have been part of a data breach
Tests against 10 types of weak password related threats associated with user accounts

Checks against breached or weak passwords currently in use in your Active Directory

Reports on the accounts affected and does not show/report on actual passwords

Just download the install, run it, get results in minutes!

Identify how many users take the bait and reply before the bad guys do!

Try It Now!

What is the Fourth Industrial Revolution?

Mon, 23 May 2022 14:32:18 +0000

As the cyber threat landscape continues to evolve, passwords and anti-virus software simply aren’t enough anymore. And while there’s no silver bullet that totally eliminates all attacks, employing a Multi Layered Defence will definitely help.

The Fourth Industrial Revolution, also known as 4IR and Industry 4.0, is a term used to describe a new amalgamation of the physical, biological and digital worlds. It combines engineering with science, Artificial Intelligence (AI), robotics, quantum computing, the Internet of Things (IoT) and other emerging technologies. Together, these new systems, processes and tools are completely changing the world around us – and the way we live in it.

It may sound like the stuff of sci-fi movies, but most of us have been using at least some of these services for a while. Sat Navs, mobile banking apps, iPhone face scans and tools like Alexa are a common part of daily life. But it’s perhaps in the workplace that the 4IR is having the biggest impact; disrupting every business sector at an unprecedented pace.

A Brief History of Industrial Revolutions

Most people are aware of the first Industrial Revolution, which took place in the 18th Century. It was prompted by the invention of the steam engine, and with these new machines came new opportunities and huge social, cultural and economic changes. The second revolution saw the invention of electricity, mass production and other big scientific improvements, and the third saw the birth of computers and digital devices such as clocks.

In 2016, the founder of the World Economic Forum Klaus Schwab wrote a book entitled The Fourth Industrial Revolution, which outlined the effects - good and bad - that technological innovation is having on the world.

These technologies include:

Blockchain: Often confused with cryptocurrency, blockchain is actually a type of storage facility that enables cryptocurrency such as Bitcoin to be created and exchanged in monetary terms.

Biotechnology: This kind of technology merges tech with biology. It’s particularly prevalent in the pharmaceuticals industry, because it allows scientists to develop cellular and biomolecular processes for the production of new drugs, among other things. It’s also used in manufacturing and is making great strides in the production of greener, more efficient energy.

Virtual Reality (VR) and Augmented Reality (AR): VR is all about immersive digital experiences that simulate the world around us (currently via a headset) whereas AR is a combination of the physical and digital worlds, such as mobile apps that allow us to add filters and change the appearance of selfies.

3D Printing: Printers have come a long way in the past few years, and today’s 3D versions enable users to create actual objects based on an image. Manufacturers can now print their own parts, while in the medicine world prosthetic limbs, tissues and even organs are now being produced.

Robotics: The sci-fi books of the 1960s often spoke about the possibility of robots taking over the world, and with the latest developments it doesn’t seem like such a far-fetched notion! While we’re a long way from having walking, talking and free-thinking robots in every home, they’re becoming increasingly advanced and playing an important role in everything from manufacturing to health and safety.

The Internet of Things/IoT: This is a term that covers a huge range of devices, from smart mobile phones and security cameras to wearable health and fitness devices, smart phones, smart fridges, thermostats and mobile devices.

Other technologies included in the Fourth Industrial Revolution include data storage, Cloud computing, cyber security technology, renewable energy…and much more.

The Impact on Businesses

There’s no doubt that the Fourth Industrial Revolution is having a huge effect on businesses everywhere. Although many worry that the increased role of technology could be bad news for humans, we’re nowhere near that yet. In fact, the 4IR is all about combining humanity with technology to create better experiences for us all – particularly customers. modern technology gives businesses the power to connect with people far more effectively than ever before, because it presents us with the data we need to really understand each other.

That said, because there’s so much more choice available these days, customers have higher expectations, which means more pressure on businesses to get with the programme in terms of their digital offerings. Customers also have more control of their own personal data too, and with the advent of the GDPR organisations of all sizes must be doing everything they can to keep client information safe. That means having robust cyber security processes and tools in place and ensuring all staff understand common risks, and how to avoid them.

To find out more about how you can embrace the Fourth Industrial Revolution without putting your customer’s data at risk, get in touch. As cyber security specialists we help our clients make the most of modern technology whilst protecting them from viruses, hacks and other cyber-attacks. Find out more today!

Are your users putting a big target on your organisation’s back?

Cybercriminals are constantly coming out with new ways to hack into your network and steal your organisation’s confidential information.

Find out if your users are putting a big target on your organisation’s back.

KnowBe4’s new Password Exposure Test (PET) is a complimentary IT security tool that allows you to run an in-depth analysis of your organisation’s hidden exposure risk associated with your users.

Here's how it works:

Checks to see if any of your organisations email addresses have been part of a data breach
Tests against 10 types of weak password related threats associated with user accounts

Checks against breached or weak passwords currently in use in your Active Directory

Reports on the accounts affected and does not show/report on actual passwords

Just download the install, run it, get results in minutes!

Identify how many users take the bait and reply before the bad guys do!

Try It Now!

Multi-Layered Defence

Mon, 16 May 2022 10:11:48 +0000

What do we mean by Multi-Layered Defence?

Also known as Defence-in-Depth and Layered Security, Multi-Layered Defence is an approach to network security that uses a variety of tools. The aim is to keep all bases covered by ensuring every individual aspect of your cyber security strategy has a backup to protect against vulnerabilities. Think of it in the same way as keeping your house secure – you can lock your doors and close your windows, but your home will be even safer if you’ve also got a burglar alarm and security cameras installed. When you’ve got an arsenal of protection working together against hackers and other threats, your business will be more secure too.

Multi-Layered Defence is recognised as Best Practice, as recommended by the National Institute of Standards and Technology (NIST) Cyber Security Framework. The framework outlines five key areas to help businesses protect their systems and data:

Identify
Protect
Detect
Respond
Recover

Networks can be defended by implementing twelve essential layers, as outlined below.

1) Firewalls: A firewall is commonly the first line of defence in an organisation’s network security, acting as a barrier between the network and any unsolicited traffic.

2) Patch Management: Hackers are always on the lookout for vulnerabilities, and outdated software often provides them with the perfect way in. Patch management is essential because it means errors and bugs can be easily identified and fixed, making it far harder for cyber criminals to strike.

3) Multi-Factor Authentication: An MFA is an electronic automation method that requires users to be verified in two or more ways before they’re granted access to particular networks, applications and websites. Users are asked to provide information on:

Something they know (e.g., a password or PIN)
Something they have (a physical object, like a card, security key or mobile device)
Something they are (this method uses biometric verification, such as fingerprints, voice recognition and retina scans). While it may sound like a lot to ask a user, these solutions have been developed so effectively and efficiently that they’re easy to use and cause minimal disruption.

4) Endpoint Protection: Today’s businesses have a lot of different devices logging onto their networks, which significantly increases security risks. Every phone, laptop, PC , camera, printer, scanner and smart device (known as “endpoints”) must be individually protected as part of your cyber security strategy.

5) Content Filtering: There’s an enormous amount of web content out there, and if just one of your users happens to access a dangerous website your entire network could be compromised. Web content filtering allows you to block inappropriate or untrusted sources that could put you at risk of cyber-attacks.

6) Email Filtering: The vast majority of cyber-attacks - 94% to be precise - are still delivered by email. Hackers know all it takes is one click on a dodgy link for an entire network to be compromised, so by filtering emails before they arrive in users’ inboxes you can help stop them in their tracks.

7) Security Awareness Training: Knowledge is power, so many experts believe that educating employees is often the best line of defence. By providing staff with the training they need to spot common hacking tactics, such as phishing emails, you will be creating a culture of security and confidence. Threats evolve rapidly, so it’s important to keep training up to date and relevant, and it’s a good idea to conduct regular phishing simulations to keep people on the ball.

8) Robust Password Policies: A recent study from NordPass revealed that millions of people still use “qwerty” and “123246” as their passwords, and – even more concerning - over half of IT professionals still use the same password to access different accounts. In fact, as many as 73% of passwords are duplicates, which means if one account is hacked, the chances are your others will be too. By requiring users to change to complex passwords (containing special characters, numbers and inconsistent capitalisation) you’ll be making it much harder for hackers to break in.

9) Physical Barriers: Although much of modern business is conducted online, it’s still important to consider what physical security you’re using in your workplace. Security staff, cameras, alarms, key cards and good old-fashioned locks are still as effective as the ever were, and combined with modern biometric tools like thumb and retina scans they go a long way towards preventing crime.

10) Dark Web Monitoring: The dark web is notoriously a hotbed of illicit, insidious online activities, which includes the sale of business-critical data. Employee data is often targeted, enabling hackers to send malicious emails and install viruses. You can invest in tools that search the dark web for staff email addresses and passwords to keep you one step ahead.

11) Disaster Recovery: With new threats emerging all the time and the security landscape becoming increasingly complex, it’s impossible for anyone to offer 100% certainty against attacks. But what you can do is ensure that if the worst does happen, you’ve got the right business continuity and disaster recovery methods in place. These solutions include performing regular data backups and making sure your business continuity plan is routinely tested, maintained and updated, vastly improving your chances of getting back to business quickly and with minimal disruption.

12) Managed Detection and Response: It’s impossible for one human (or even a whole team of them) to monitor a system 24/7 and detect potential threats. Managed Detection and Response (MDR) is a solution that combines human skill and experience with state-of-the-art software to ensure your network is as safe as possible, all day, every day. Without the right tools data breaches can go unnoticed for over 200 days, which means cyber criminals to wreak havoc while you’re blissfully unaware.

If you want to do more to protect your organisation’s data and reputation, contact us today to find out more about our Multi-Layered Defence services.

Find out now how many of your users take the bait and reply to a spoofed email

Did you know that 60% of spoofed email attacks do not include a malicious link or attachment? When crafted well, most users are likely to fall victim to a highly targeted social engineering attack.

Try our Phishing Reply Test (PRT) it is a complimentary IT security tool that makes it easy for you to check to see if key users in your organisation will reply to a highly targeted impersonation attack.

PRT will give you quick insights into how many users will take the bait so you can take action to train your users and better protect your organisation from these fraudulent attacks!

Here's how it works:

Immediately start your test with your choice of three phishing reply scenarios

Spoof a Sender's name and email address your users know and trust

Phishes for user replies and returns the results to you within minutes

Get a PDF emailed to you within 24 hours with the percentage of users that replied

Identify how many users take the bait and reply before the bad guys do!

Try It Now!

Questions Your Board Might Ask about Data Security (And How to Answer Them!)

Fri, 29 Apr 2022 13:25:47 +0000

“We’ve Had a Data Incident. How Did it Happen?”

Board members expect you to have everything under control, so when they find out it’s not, you can expect to be hauled over the coals. Data incidents have become more common since people started working from home, and boards will want to know you’re doing everything in your power to keep the reputation of your organisation intact.

The best way to respond to this question is to stick to the facts, but keep it brief. This is where it’s important to have an incident response policy in place, so you can clearly identify where things went wrong. Tell them what you know, how it’s impacted operations and – most importantly – what you’re going to do to make sure it doesn’t happen again.

“Is the Network Definitely 100% Safe Now?”

Unfortunately, in such a complex and constantly evolving threat landscape, it’s impossible for any organisation to say they’re completely immune to cyber-attacks. If your board members are asking this question and demanding that you give them 100% certainty, it’s important to put them straight – nobody can.

What you can do is reassure them that you have all the right systems and policies in place now, to ensure the risks are properly managed and reduced where possible without restricting operations. Tell them that as your organisation grows, so too will your level of security, and that you have the right software and security partners in place to keep things under control.

“How are We Doing Compared to Other Similar Organisations?”

With so many news stories about big name companies being hacked, it’s no wonder board members feel under pressure to ensure their businesses don’t end up in the headlines too. You can’t really second guess the details of what happened in other companies, but you can go away and do some research and bring it back to the next meeting.

Again, what’s really important here is that you’re able to identify any weaknesses in your own organisation and implement a robust new strategy accordingly.

“Are We Spending the Right Amount of Money on This Stuff?”

As we mentioned earlier, until recently, a lot of board members tended to be keen to see managers keep cost low and spend as little as possible on things like cyber security. Nowadays, the opposite tends to be true. Your board will want to know that you’re doing everything you can to keep your reputation, information and resources safe, which means carefully balancing out risks with a good ROI.

Conclusion

Board members are not ogres, honestly they're not ,but they will expect you to be able to answer burning questions and give them peace of mind that your organisation’s data is in safe hands. By having firm protocols and systems in place you’ll be able to prove you’re doing everything you can to protect the future of your company. To find out more about how to keep your business-critical data safe, contact our friendly team at Actisoft today.

Find out now how many of your users take the bait and reply to a spoofed email

Did you know that 60% of spoofed email attacks do not include a malicious link or attachment? When crafted well, most users are likely to fall victim to a highly targeted social engineering attack.

PRT will give you quick insights into how many users will take the bait so you can take action to train your users and better protect your organisation from these fraudulent attacks!

Here's how it works:

Immediately start your test with your choice of three phishing reply scenarios

Spoof a Sender's name and email address your users know and trust

Phishes for user replies and returns the results to you within minutes

Get a PDF emailed to you within 24 hours with the percentage of users that replied

Identify how many users take the bait and reply before the bad guys do!

Try It Now!