Infrastructure Organizations Beware

According to the 2018 Verizon Data Breach Investigations Report, 29.2% of reported breaches happen in industries considered infrastructure. These industries include utilities, transportation, healthcare and others that use operational technology systems.

What can organizations that are considered infrastructure do to mitigate these risks? First, let’s take a look at what the risks are, and then how to secure your organization from them.

The first risk is the environment where the organization exists. If there is no inventory of the systems, a lack of security and a lack of understanding of what data is being used, the organization is at a major risk. In order to best combat this risk, one should start by gaining an understanding of overall security posture. If an organization is operating in multiple environments, pick a representative environment and apply what was learned to the other environments.

The second risk is patch management. This is self-explanatory, and its solution is as well. Patch your systems! Running outdated OT systems greatly increases the chance of a breach. Network Segmentation is the third risk, with many OT systems having connections between systems that should not be connected. In order to combat this, develop a plan for network segmentation, that way if one network is breached it is contained rather than spreading.

The fourth risk is the supply chain. It is very hard to control how organizations handle their data, which is why it is important to include security requirements when bringing on new systems, as well as continuing maintenance efforts within their vendor management programs. The fifth risk is a lack of a united front within the organization regarding security. To avoid this, one should foster cooperation and respect between the groups who address cyber threats. Training, communication and cooperation are key here.

With the world becoming increasingly digital, state actors are waging war behind the scenes more and more. A good example of this is Russia crippling Ukrainian infrastructure by launching a cyber-attack on power plants. All organizations are at risk for a cyber-attack, but those that are considered infrastructure should consider that the person trying to hack you isn’t necessarily some kid in his mom’s basement or even a pro hacker. It could be an intelligence agency with hundreds of well-trained specialists trying to see how your systems tick and how to break them.https://www.darkreading.com/vulnerabilities---threats/vulnerabilities-in-our-infrastructure-5-ways-to-mitigate-the-risk/a/d-id/1333211

For more information checkout our website at www.bitxbit.com or call 877.860.5863

Hackers are Bundling Up This Fall.

Well, it’s nearing the end of the year. You know what that means: it’s time for the ‘best of 2018’ collections to start coming out. One category is Best Movies of 2018… personally, I think The Incredibles 2 is at the top of that list. Another category is Best of Ransomware. Yes, there is a ‘best of the year’ collection for cybercriminals. To the surprise of no one, the ransomware collection is being sold on the Dark Web, but there are many surprising elements to the bundle.

First off, the fact that the year’s most dangerous ransomware variants are being sold as a package deal at a reduced price should show the... professionalism… of the Dark Web marketplaces, as strange as it is to use that word to describe cybercriminals. This crime-as-a-service model is nothing new, but this bundle is undoubtedly a step above the norm. There are 23 ransomware variants included in the bundle, including SamSam. Yes, the notorious SamSam ransomware is included in the bundle. If you don’t know what SamSam is, it is a variant of ransomware that is infamous because of the high-profile targets it has been used against and because until now, it was under lock and key deployed only by a highly specialized group.

This bundle is not for inexperienced hackers, however, which would be worse than the current situation. An unskilled hacker would find difficulty putting most of the bundle to use. The bundle will be removed from the marketplace after sold 25 times, according to the seller, although it is unclear why this is the case. Don’t let one of the hackers who buy this bundle use it against your business! See last week’s The Week in Breach for tips on avoiding ransomware.

https://www.zdnet.com/article/giant-ransomware-bundle-threatens-to-make-malware-attacks-easier-for-crooks/

Need help? Give us a call at 877.860.5831

Webinar | Is Your Business Protected Against the Dark Web? Find Out Now!

http://pages.icpro.co/archive/bWVzc2FnZV8zNDA5NDMzXzI4OF8xMTIwXzIwNzAz

Did you know that your digital credentials can be sold for $1 in the secretive corners of the Dark Web? It's a small price for a cyber crime that steals your identity, breaches your data, and could cost your company millions. 

User names, passwords, business applications, and online services -- they're all vulnerable to lurking cyber criminals. They're easily compromised and you might not even know it until it's too late.

Worried yet? You should be.

Find out if your critical assets are exposed before the damage is done with Dark Web Monitoring, a cutting-edge threat intelligence and identity monitoring solution.

In this webinar, you will learn:

• What makes up the Dark Web & why it's so lethal
• How everyone in your organization is at risk of exposure
• The ways Dark Web Monitoring provides real-time awareness of compromised credentials before identity theft or data breaches occur
• How Dark Web Monitoring will safeguard your business & protect your assets, employees & customers from threats

Sign up to attend this webinar & receive a free, one-time scan of your ID credentials to see if you're exposed!

Register here:

https://register.gotowebinar.com/register/1676475251523228419

Under Attack - An Examination of Cyber-Security Breaches on Industry an Ebook