In 2013 Cyber Conflicts become the norm: Symantec predicts

Symantec released its 5 most important security threat expectations of the  year 2013. Symantec claims that these predictions are based on their expertise, “understanding of threat evolution” as well as “experience in previous cybersecurity trends”.  Symantec Corporation is an American global computer security software corporation headquartered in Mountain View, California.

The threat expectations for 2013 and beyond go like this – 

Cyber conflict becomes the norm among nations, organizations, and individuals. Espionage can be successful and easily deniable. Nation States, organizations and groups of individuals use cyber tactics to gain advantage over their opponents. The conflict is moving more and more on cyber assets from physical.




 
Ransomware is the new scareware: With online payment methods becoming omnipotent and omnipresent, criminals find it easy to extract money at anytime from anywhere!! Get ready for more professional ransom screens and methods. FBI keeps cautioning the users as more cases are already being reported.According to Kevin Haley, Director of Security Response at Symantec, during 2013, there’ll be increasing utilization of commercial ransom screens, exploitation of targets’ sentiments, along with utilization of techniques, which will make recovery more difficult following system compromise.


Madware adds to the insanity: Mobile adware or “madware” is a nuisance that disrupts the user experience and can potentially expose location details, contact information and device identifiers to cybercriminals.The past experience sees rapid growth in this menace, an increase of 210% in 9 months in 2012!! Free mobile apps are going to contribute more aggressive and potentially malicious approach.


Monetization of social networks introduces new dangers – the growing social spending trend also provides cybercriminals with new ways to lay the groundwork for attack. Symantec anticipates an increase in malware attacks that steal payment credentials in social networks and trick users into providing payment details, and other personal and potentially valuable information, to fake social networks.


As users shift to mobile and cloud, so will attackers – Symantec claims that mobile platforms and cloud services will be likely targets for attacks and breaches in 2013. The rapid rise of Android malware in 2012 confirms this. It is predicted that in 2013, mobile technology will continue to advance and thereby create new opportunities for cybercriminals.

 

Wrong use of devices in corporate networks that utilize clouds will witness growing danger of personalized assaults and breaches into the devices’ data, the security firm explains.

The threats could be more alrming to India. Identity fraud is turning out be as a major concern in India with the growing number of Internet, social media and internet users through mobile phone devices.

A recent Symantec report stated, of the total 137 million Internet users in India, 42 million have fallen prey to the cyber fraud in one way or the other. The financial loss per cyber crime victim is around Rs 10,000 for 2012, as per Semantec.

While this list is more on expected lines considering the cyber crime trends being witnessed in the recent past. The key to the threat management lies in end-user education in protecting the online privacy, a more disciplined online behaviour and much better understanding of their smart phone.

In a lighter vein: 

On January 17, 2012, Symantec admitted to their network getting hacked. A hacker known as “Yama Tough” obtained Symantec’s source code by hacking an Indian Government server. Yama Tough has released parts of the source code, and has threatened to release more. 

Advertisements

Top IT Challenges & Audit: Protiviti Survey 2012

Information Security (including data privacy, storage and management) ranked #1 among the top technology challenges faced by organisations, according to 2012 IT Audit Benchmarking Survey conducted by Protiviti, a global consulting firm operating in over 20 countries. Protiviti conducted the survey at the end of September 2012 with 1,000 people from companies with 100+ employees.

Cloud computing, social media, risk management & governance and regulatory compliance followed the list of top technology challenges.

IT Audit

The survey hints that a large of number of organizations may be understaffed in terms of IT Audit capabilities in their internal audit functions. Organizations are meeting this gap with guest auditors, co-source providers and outsource IT audit function. 


While the survey indicates a significant gap in the IT audit capabilities of many organizations, 48% of small companies are  not using any outside resources, clearly indicating  that these organizations lack necessary skills and resources to manage IT risk. 

 
In-house internal audit department lacking the specific skill sets seems to be the major reason for organizations using external resources to meet the IT audit requirements. 67% of the participants expressed this opinion, which stood at 62%  in 2011. This clearly indicates, the organizations are increasingly looking forward to avail the services of experienced and qualified IT auditors, while keeping the costs low.
 
Considering the fact that a significant number of companies have limited or no resources devoted to IT Audit,   the survey concludes that a number of  organizations are not in compliance with Standard 1210.A3 stipulated by the IIA. 

IIA Standard 1210.A3  Internal auditors must have sufficient knowledge of key information technology risks and controls and available technology-based audit techniques to perform their assigned work. However, not all internal auditors are expected to have the expertise of an internal auditor whose primary responsibility is information technology auditing.

 IT Audit Risk Assessment

Considering the pace of technology proliferation in organizations IT implementation and business models as well as the changing threat scope in general, IT audit risk assessment needs to be carried out on an ongoing process and at least in a quarter. Interestingly, only 13% of the organizations are conducting the risk assessment at this frequency and as many as 65% of the organizations conduct at annual intervals !! This clearly indicates,  majority of organizations are NOT keeping pace with the rate of technology change, emerging new threats and innovations in the organizations.

Frameworks

On a positive note, 86% of the organizations adopted a framework to based their IT Audit Risk Assessments with COBIT (63%) and COSO (43%) leading the list.

IT Governance

The survey tested the organizations’ IT Governance processes as against the IIA standard to ensure the internal audit function assesses whether the IT Governance sustains and supports organization’s business strategy and objectives.

IIA Standard 2110.A2 – The internal audit activity must assess whether the information technology governance of the organization supports the organization’s strategies and objectives.

Unfortunately, responses from about three fourths of the organizations indicate that IT Governance process is NOT a priority.

The survey also covered other aspects like training, gaps in audit plan and can be accessed  from http://www.protiviti.com/en-US/Documents/Surveys/2012-IT-Audit-Benchmarking-Survey-Protiviti.pdf

Mobile Security: Malware Threats

Secure your Mobile !


Mobile devices, of late, gaining popularity with the acceptance of BYOD (Bring your Own Device) policy across the Corporates. Many large organizations are realizing that it’s easier to develop and deploy their own secure apps for employees with off-the-shelf solutions. Barclays bank, one of the world’s largest bank, hits the News this week by giving 8,500 of its employees an early Christmas present: iPads !  According to Baxter-Reynolds, Barclays’ total cost of ownership for 8,500 iPads works out to approximately £13.8 million, or $2,600 USD per unit.

What about Information Security?

While Barclays is focusing on a bigger business gain and employee confidence, security, of course, is a major concern. “With the lockdown offered on iOS devices — including encrypted content — iPads have all the things that reassure the ‘necessarily-paranoid’ in any bank’s IT department,” wrote Charles Arthur in the Guardian UK, commenting on Barclays’ decision to go with iPads.

barclays logo Zack Whittaker at ZDNet agrees, saying Barclays confidence in IPad safeguards sets a trend for other companies, particularly banks. “The huge iPad deployment shows a significant level of trust in the Apple platform — that it’s secure enough for banking,” Whittaker wrote in his analysis. “Finance, after all, is only one-notch below national security in the grand scheme of data protection priorities.”

Mobile Security in General

Yes, Barclays invested huge amounts on the devices, training and security mobile logomanagement of mobile technology. Waht about other companies- big and small – adopting rapidly the policy of BYOD yet not fully geared to understand and prepare to the face the risk? FBI & Internet Crime Complaint Center (IC3are warning the smart phone users of malware targeting mobile devices. Malware seems to be the worst threat to the mobility considering the low levels of mobile security awareness equally among the management & users.

Some tips to secure your mobile 

  • When purchasing a Smart phone, know the features of the device, including the default settings. Turn off features of the device not needed to minimize the attack surface of the device.
  • Depending on the type of phone, the operating system may have encryption available. This can be used to protect the user’s personal data in the case of loss or theft.
  • With the growth of the application market for mobile devices, users should look at the reviews of the developer/company who published the application.
  • Review and understand the permissions you are giving when you download applications.
  • Passcode protect your mobile device. This is the first layer of physical security to protect the contents of the device. In conjunction with the passcode, enable the screen lock feature after a few minutes of inactivity.
  • Obtain malware protection for your mobile device. Look for applications that specialize in antivirus or file integrity that helps protect your device from rogue applications and malware.
  • Be aware of applications that enable Geo-location. The application will track the user’s location anywhere. This application can be used for marketing, but can be used by malicious actors raising concerns of assisting a possible stalker and/or burglaries.
  • Jailbreak or rooting is used to remove certain restrictions imposed by the device manufacturer or cell phone carrier. This allows the user nearly unregulated control over what programs can be installed and how the device can be used. However, this procedure often involves exploiting significant security vulnerabilities and increases the attack surface of the device. Anytime a user, application or service runs in “unrestricted” or “system” level within an operation system, it allows any compromise to take full control of the device.
  • Do not allow your device to connect to unknown wireless networks. These networks could be rogue access points that capture information passed between your device and a legitimate server.
  • If you decide to sell your device or trade it in, make sure you wipe the device (reset it to factory default) to avoid leaving personal data on the device.
  • Smartphones require updates to run applications and firmware. If users neglect this it increases the risk of having their device hacked or compromised.
  • Avoid clicking on or otherwise downloading software or links from unknown sources.
  • Use the same precautions on your mobile phone as you would on your computer when using the Internet.