In life there are a set of rules that apply to certain scenarios. When you are driving and want to change lanes, you check your mirror, indicate, check your mirror again, safely switch lanes, and finish up by turning off the indicator. These rules are in place in order for everyone to have a safe driving experience. The same practise can be applied to your online security, which is critical considering almost everything is completed online these days. In some cases an 8-16 character password is all that’s protecting your finances – that should be reason enough to want to protect yourself.
So, how do you make sure to keep yourself safe? Follow these 10 steps:
ONE – Look for browser warnings and the green lock before entering credentials.
Whenever you access a website, your browser runs background checks to make sure that the site you are visiting is indeed who they claim to be. When the websites fail these checks, your browser will warn you. These warnings are there for a reason! So make sure to listen to those warnings and respect them.
TWO – Maintain Unique passwords for every account and website.
Too often people will use the same email and password for their bank, as they do for any odd website out there that has asked them to create an account. The issue with this is that once that website becomes compromised and your account details are stolen, threat actors will often use those same credentials against a variety of services like PayPal, large banks and more, and will be end up being successful in stealing your information.
THREE – Use Random Generated or pass phrases as your password.
Regarding passwords, you are looking for length and complexity. Complexity does not mean take your name and replace an ‘A’ with an ‘@’. Complexity means that you couldn’t break a password just by changing characters. Remembering truly random passwords is tough, so passphrases are the next best thing. Simply take a saying or a line from your favourite song, poem or book, and use that as your password, spaces and all. You could also take the first letter of each word to create a new passphrase. Generally speaking, if you add a number or two that should satisfy password complexity standards.
FOUR – Do not click links that arrive in unsolicited email.
Phishing is a scamming method that uses fear and urgency to get you to act irrationally. If you are not expecting to be contacted by the sender, and a link urges you to ‘click here’, and they are threatening that something bad will happen, like your email account getting shutdown or blocked, it is generally fake. If you are still unsure, you can hover over the link to gain more information. If Microsoft claims they sent you the email, the link should be Microsoft’s. In the end, if you are ever in doubt, then contact the company directly and see if they sent you the email.
An example:
Microsoftpasswordreset.suvlaki.co – FAKE
login.microsoftonline.com – GOOD
FIVE – Where possible enable multi-factor authentication
Multi-factor authentication is a second way of verifying your identity. This can be achieved using methods such as a text, phone call, or a generated token. This should be enabled because in the event of your password being stolen, the threat actors are still unable to access your account. When multi-factor is set up, you should always be aware that if you receive an authentication code without trying to log in, then it could mean that someone has your password and is trying to log in.
SIX – Change passwords regularly
Your job is to make stolen passwords redundant. You can do this by changing your passwords often which heavily reduces the impact of a stolen password
SEVEN – Try not to write down your passwords, if you do, do not store them in plain sight.
You should not have your passwords written down, makes it easy to gain access to your devices. But if you really insist on it, which again, please don’t. Then PLEASE, hide them – and no, NOT UNDER THE KEYBOARD!
EIGHT – Use a password manager to help you remember your unique passwords.
A strong password is one that is long and can’t be remembered. No one is asking you to remember them all, instead securely store them in a password vault. Password vaults are invaluable at keeping your everyday passwords safe, and then ensure that access to your vault is protected by a strong passphrase and multi-factor (Step three and five).
NINE – keep ALL software up to date.
Updating your operating system or antivirus is only half the battle against protecting your device. Any out of date applications, such as Adobe, Zoom etc, can allow a threat actors to gain full access to your system and everything within.
Ten – With emails, ensure that the send and the senders email address are correct.
It is incredibly easy to change your display name for an email address to appear as someone else. Your job is to make sure the person emailing you is actually the person they claim to be. You can work this out by comparing their display name to the actual email address.
About the author
Alexander Duffy is Security Solutions Architect for emt Distribution, working in the Threat Intelligence space on a full range of emt’s cybersecurity portfolio like ThreatConnect, Flashpoint, etc. For more security updates follow him on LinkedIn
By Alexander Duffy, Security Solutions Architect, emt Distribution
In September last year, the ABC Investigations journalism unit published an in-depth report
looking into the use in Australia of surveillance cameras manufactured by Chinese companies, Hikvision and Dahua, with security ramifications for any organisation installing Internet-connected devices.
Security researchers assert that vulnerabilities in Hikvision and Dahua cameras leave them open to malicious actors looking to syphon off video, audio and other data. Both companies have also been accused of spying on behalf of the Chinese Government and have been banned from U.S. government use.
According to Terry Dunlap, Co-founder of ReFirm Labs, governments are taking the right step in evaluating whether Chinese companies like Hikvision are an acceptable risk as suppliers.
“Chinese firms have a long history of embedding backdoors in their equipment,” said Dunlap. “And it’s not happening by accident – in 2013, we found purpose-built backdoors in Huawei equipment. In 2017, we saw the same embedding technique in Dahua security cameras, which the U.S. Congress then banned in 2018.
“All telecom gear coming from China that is placed into critical infrastructure, for example, needs to undergo a thorough security vetting from top layer applications all the way down to the firmware level where we see backdoor implants. Companies need to think twice about purchasing Chinese-made equipment if they don’t have vetting and monitoring capabilities in place to detect such backdoors and implants.”
ABC Investigations found the Chinese cameras above the entrances to the Australian Government Solicitor headquarters in Canberra and an office block used by the Department of Home Affairs and Attorney-General, AUSTRAC, and the Office of National Assessments. Another camera – removed once the Department Of Defence became aware of it – was found at the RAAF Base Edinburgh in South Australia.
Surveillance cameras and telecommunications equipment are just some of the Internet-connected devices subject to cyber attack. There are thousands of other kinds of vulnerable devices described by the term ‘Internet of Things’, and they number in the millions if not billions.
While most organisations have taken increased measures in recent years to strengthen the security of their information systems, many overlook device security. Not surprisingly, vulnerabilities in IoT devices are often the easiest targets for threat actors and often represent the initial point of entry into organisations’ networks.
In a breach featured in a webinar by Joseph Carson, Chief Security Scientist at Thycotic, an attack by Somalian pirates on a secure database detailing shipping movements was initiated by exploiting wireless lights that had been incorrectly configured, giving hackers network access.
Unfortunately, the security measures most organisations currently have in place don’t effectively protect IoT devices. Current security measures don’t effectively protect firmware, and fail to proactively address vulnerabilities before it’s too late.
In a 2018 report, research firm Gartner predicted that until 2020, the biggest inhibitor to growth for IoT security will come from a lack of prioritisation and implementation of security best practices and tools in IoT initiative planning. “In IoT initiatives, organisations often don’t have control over the source and nature of the software and hardware being utilised by smart connected devices,” said Ruggero Contu, research director at Gartner.
As cyber intrusions become more commonplace, CSOs and CISOs have to look towards more innovative solutions to protect their organisations. Among the challenges they face is allowing business units to meet the demand for IoT devices with the confidence that they do not pose a security risk.
The introduction of cyber security tools into Australia and New Zealand for vetting, validation and monitoring of organisations’ firmware security has now closed this security gap for enterprises, government agencies, operators of critical infrastructure, and other organisations.
With these tools, organisations reliant on IoT devices can vet firmware images for vulnerabilities in around 30 minutes, without requiring source code, giving them confidence in the choices they make. Without them, they could be learning about the vulnerabilities they have introduced to their networks, or their customers, from the media.
About the author
Alexander Duffy is Security Solutions Architect for emt Distribution, the Australia and New Zealand representative for ReFirm Labs, which provides the industry’s first IoT and firmware security solutions that proactively vet, validate and continuously monitor IoT devices for hidden threats.
https://www.emtdist.com/wp-content/uploads/2015/03/EMT_logo_topheader.jpg00Naina Dasguptahttps://www.emtdist.com/wp-content/uploads/2015/03/EMT_logo_topheader.jpgNaina Dasgupta2019-07-22 11:52:282019-07-22 11:52:28Internet of Things Security Often Overlooked in Cyber Defence
We are excited to be exhibiting at the AusCert Conference 2019 at the Surfers Paradise Marriott Resort & Spa, Swing by booth 37 to say hello to the team and booth vendors – Flashpoint,ThreatConnect and VMRay.
Exhibiting at the conference is also our other vendors – Thycotic and Airlock
AusCert 2019 is a great opportunity to learn about new approaches to info security, discover the latest technology and interact with top security leaders and pioneers in ANZ community.
Hands-on sessions, keynotes and informal gatherings allow attendees to tap into a smart, forward-thinking community that inspires and empowers the cyber security community in Australia and New Zealand. Learn more about AusCert2019 here
10 Cybersecurity Tactics Everyone should Implement Now!
/in 101, Cybersecurity /by Naina DasguptaBy Alex Duffy
In life there are a set of rules that apply to certain scenarios. When you are driving and want to change lanes, you check your mirror, indicate, check your mirror again, safely switch lanes, and finish up by turning off the indicator. These rules are in place in order for everyone to have a safe driving experience. The same practise can be applied to your online security, which is critical considering almost everything is completed online these days. In some cases an 8-16 character password is all that’s protecting your finances – that should be reason enough to want to protect yourself.
So, how do you make sure to keep yourself safe? Follow these 10 steps:
ONE – Look for browser warnings and the green lock before entering credentials.
Whenever you access a website, your browser runs background checks to make sure that the site you are visiting is indeed who they claim to be. When the websites fail these checks, your browser will warn you. These warnings are there for a reason! So make sure to listen to those warnings and respect them.
TWO – Maintain Unique passwords for every account and website.
Too often people will use the same email and password for their bank, as they do for any odd website out there that has asked them to create an account. The issue with this is that once that website becomes compromised and your account details are stolen, threat actors will often use those same credentials against a variety of services like PayPal, large banks and more, and will be end up being successful in stealing your information.
THREE – Use Random Generated or pass phrases as your password.
Regarding passwords, you are looking for length and complexity. Complexity does not mean take your name and replace an ‘A’ with an ‘@’. Complexity means that you couldn’t break a password just by changing characters. Remembering truly random passwords is tough, so passphrases are the next best thing. Simply take a saying or a line from your favourite song, poem or book, and use that as your password, spaces and all. You could also take the first letter of each word to create a new passphrase. Generally speaking, if you add a number or two that should satisfy password complexity standards.
FOUR – Do not click links that arrive in unsolicited email.
Phishing is a scamming method that uses fear and urgency to get you to act irrationally. If you are not expecting to be contacted by the sender, and a link urges you to ‘click here’, and they are threatening that something bad will happen, like your email account getting shutdown or blocked, it is generally fake. If you are still unsure, you can hover over the link to gain more information. If Microsoft claims they sent you the email, the link should be Microsoft’s. In the end, if you are ever in doubt, then contact the company directly and see if they sent you the email.
An example:
Microsoftpasswordreset.suvlaki.co – FAKE
login.microsoftonline.com – GOOD
FIVE – Where possible enable multi-factor authentication
Multi-factor authentication is a second way of verifying your identity. This can be achieved using methods such as a text, phone call, or a generated token. This should be enabled because in the event of your password being stolen, the threat actors are still unable to access your account. When multi-factor is set up, you should always be aware that if you receive an authentication code without trying to log in, then it could mean that someone has your password and is trying to log in.
SIX – Change passwords regularly
Your job is to make stolen passwords redundant. You can do this by changing your passwords often which heavily reduces the impact of a stolen password
SEVEN – Try not to write down your passwords, if you do, do not store them in plain sight.
You should not have your passwords written down, makes it easy to gain access to your devices. But if you really insist on it, which again, please don’t. Then PLEASE, hide them – and no, NOT UNDER THE KEYBOARD!
EIGHT – Use a password manager to help you remember your unique passwords.
A strong password is one that is long and can’t be remembered. No one is asking you to remember them all, instead securely store them in a password vault. Password vaults are invaluable at keeping your everyday passwords safe, and then ensure that access to your vault is protected by a strong passphrase and multi-factor (Step three and five).
NINE – keep ALL software up to date.
Updating your operating system or antivirus is only half the battle against protecting your device. Any out of date applications, such as Adobe, Zoom etc, can allow a threat actors to gain full access to your system and everything within.
Ten – With emails, ensure that the send and the senders email address are correct.
It is incredibly easy to change your display name for an email address to appear as someone else. Your job is to make sure the person emailing you is actually the person they claim to be. You can work this out by comparing their display name to the actual email address.
An example:
John Harry <[email protected]> – BAD
John Harry <[email protected]> – GOOD
About the author
Alexander Duffy is Security Solutions Architect for emt Distribution, working in the Threat Intelligence space on a full range of emt’s cybersecurity portfolio like ThreatConnect, Flashpoint, etc. For more security updates follow him on LinkedIn
Internet of Things Security Often Overlooked in Cyber Defence
/in Cybersecurity, IoT /by Naina DasguptaBy Alexander Duffy, Security Solutions Architect, emt Distribution
In September last year, the ABC Investigations journalism unit published an in-depth report
looking into the use in Australia of surveillance cameras manufactured by Chinese companies, Hikvision and Dahua, with security ramifications for any organisation installing Internet-connected devices.
Security researchers assert that vulnerabilities in Hikvision and Dahua cameras leave them open to malicious actors looking to syphon off video, audio and other data. Both companies have also been accused of spying on behalf of the Chinese Government and have been banned from U.S. government use.
According to Terry Dunlap, Co-founder of ReFirm Labs, governments are taking the right step in evaluating whether Chinese companies like Hikvision are an acceptable risk as suppliers.
“Chinese firms have a long history of embedding backdoors in their equipment,” said Dunlap. “And it’s not happening by accident – in 2013, we found purpose-built backdoors in Huawei equipment. In 2017, we saw the same embedding technique in Dahua security cameras, which the U.S. Congress then banned in 2018.
“All telecom gear coming from China that is placed into critical infrastructure, for example, needs to undergo a thorough security vetting from top layer applications all the way down to the firmware level where we see backdoor implants. Companies need to think twice about purchasing Chinese-made equipment if they don’t have vetting and monitoring capabilities in place to detect such backdoors and implants.”
ABC Investigations found the Chinese cameras above the entrances to the Australian Government Solicitor headquarters in Canberra and an office block used by the Department of Home Affairs and Attorney-General, AUSTRAC, and the Office of National Assessments. Another camera – removed once the Department Of Defence became aware of it – was found at the RAAF Base Edinburgh in South Australia.
Surveillance cameras and telecommunications equipment are just some of the Internet-connected devices subject to cyber attack. There are thousands of other kinds of vulnerable devices described by the term ‘Internet of Things’, and they number in the millions if not billions.
While most organisations have taken increased measures in recent years to strengthen the security of their information systems, many overlook device security. Not surprisingly, vulnerabilities in IoT devices are often the easiest targets for threat actors and often represent the initial point of entry into organisations’ networks.
In a breach featured in a webinar by Joseph Carson, Chief Security Scientist at Thycotic, an attack by Somalian pirates on a secure database detailing shipping movements was initiated by exploiting wireless lights that had been incorrectly configured, giving hackers network access.
Unfortunately, the security measures most organisations currently have in place don’t effectively protect IoT devices. Current security measures don’t effectively protect firmware, and fail to proactively address vulnerabilities before it’s too late.
In a 2018 report, research firm Gartner predicted that until 2020, the biggest inhibitor to growth for IoT security will come from a lack of prioritisation and implementation of security best practices and tools in IoT initiative planning. “In IoT initiatives, organisations often don’t have control over the source and nature of the software and hardware being utilised by smart connected devices,” said Ruggero Contu, research director at Gartner.
As cyber intrusions become more commonplace, CSOs and CISOs have to look towards more innovative solutions to protect their organisations. Among the challenges they face is allowing business units to meet the demand for IoT devices with the confidence that they do not pose a security risk.
The introduction of cyber security tools into Australia and New Zealand for vetting, validation and monitoring of organisations’ firmware security has now closed this security gap for enterprises, government agencies, operators of critical infrastructure, and other organisations.
With these tools, organisations reliant on IoT devices can vet firmware images for vulnerabilities in around 30 minutes, without requiring source code, giving them confidence in the choices they make. Without them, they could be learning about the vulnerabilities they have introduced to their networks, or their customers, from the media.
About the author
Alexander Duffy is Security Solutions Architect for emt Distribution, the Australia and New Zealand representative for ReFirm Labs, which provides the industry’s first IoT and firmware security solutions that proactively vet, validate and continuously monitor IoT devices for hidden threats.
AusCert 2019
/in emt, News /by Naina DasguptaWe are excited to be exhibiting at the AusCert Conference 2019 at the Surfers Paradise Marriott Resort & Spa, Swing by booth 37 to say hello to the team and booth vendors – Flashpoint, ThreatConnect and VMRay.
Exhibiting at the conference is also our other vendors – Thycotic and Airlock
AusCert 2019 is a great opportunity to learn about new approaches to info security, discover the latest technology and interact with top security leaders and pioneers in ANZ community.
Hands-on sessions, keynotes and informal gatherings allow attendees to tap into a smart, forward-thinking community that inspires and empowers the cyber security community in Australia and New Zealand. Learn more about AusCert2019 here