Archive for September, 2021

What is LockBit Ransomware?

LockBit is a ransomware family that is part of a RaaS (Ransomware-as-a-Service) operation associated with LockerGoga and MegaCortex. LockBit has been seen in the wild since September 2019. The group previously advertised their services on hacking forums. They started advertising an affiliate program as “LockBit 2.0” in June 2021 via their own website on the dark web.

LockBit is initially deployed manually by an attacker that has already gained access to a victim system, but will quickly begin spreading to other systems by itself. The LockFile payload is known for its fully automated attacks and quick encryption. It prevents victims from accessing their files on an infected system by first encrypting the files adding a .lockbit extension to them. It then instructs the victim to pay a ransom in order to regain access to those encrypted files. The malware is capable of automatically spreading to other systems via SMB (Server Message Block) shares and executing PowerShell scripts. Victims regain access to their files by paying the ransom. They then obtain a custom decryptor that decrypts the locked and encrypted files.

This threat group uses a double extortion technique, threatening to release the stolen data if the ransom is not paid. Experts believe LockBit is part of a ransomware cartel involving collaboration between multiple ransomware groups, including Maze and Ragnar Locker.

So, how would you protect yourself from getting infected by the LockBit ransomware?

5 proactive and protective best practices helps you and your firm stay resilient against any cyber attack:

  1. Social Engineering Awareness: The users and employees must be provided end user security awareness training periodically. Organizations can release advisories and suggest best practices. Users must be demonstrated how to identify, block and report malicious emails. They must be able to differentiate between legit and illegit, email senders and user profiles on social media based on a list of Red Flags provided to them.
  2. Credentials policy and 2FA/MFA: Usernames and passwords must be configured in a manner that they cannot be guessed easily by the attackers. Use alphanumeric characters and keep the minimum length to 16. Threats ranging from account breaches to ransomware infections can be prevented if only the administrators pay attention to credential policies. You can check haveibeenpwned.com and follow NIST’s guidelines to set secure credentials. Use random password generator and check the complexity score of your password at passwordmeter.com. Enabling MFA (Multi-Factor Authentication) & 2FA (2-Factor Authentication) will prevent brute force attacks on your account. This adds more authentication layers on the top of your initial password-based logins. Alternatively you can implement biometrics and / or physical USB (Universal Serial Bus) key authenticators.
  3. ACL (Access Control List): Grant or assign the privileges or access on a Need-to-Know basis only.! Deployment of IAM (Identity and Access Management) strategy prevents accidental information modification from unauthorized employees. This also limits the scope of access for hackers having stolen the employees’ credentials. Enable a systematic deprovisioning process for employees leaving the company. Revoking the access rights of people who have left the organization is a crucial security responsibility that must be completed on the LWD (Last Working Day) & not get delayed.
  4. Fail-safe Backups: You can encrypt the data in upload it in cloud or keep in offline storage. Choose the CSP (Cloud Service Provider) that provides military-grade encryption. Implement, deploy & launch backup & disaster recovery mechanisms to protect your data.
  5. Holistic IT Strategies: Maintaining your organization’s credibility is very important. Comply to various regulatory standards & frameworks to protect highly sensitive business information. In-house SOC (Security Operations Center) team can monitor the real-time activities of users, services, and applications in your IT environment. Alternatively, to facilitate inadequate budgets & lack of resources, you can hire an MSSP (Managed Security Service Provider). They help you to outsource your security logging & monitoring requirements. They prevent, detect, analyze, & mitigate security risks, threats, vulnerabilities, & incidents for your business. Protect your data & devices with various security solutions such as NGAVs (Next-Gen Anti-Virus), DLP (Data Loss Prevention), XDR (Extended Detection and Response), Honeypot and likewise. Training and securing your users and employees would give hackers a hard time targeting your IT infrastructure.

For more information on various ransomware attacks and IT security measures to be adopted by businesses, contact Centex Technologies at (254) 213 – 4740

, , ,

No Comments

Tips on Securing Remote Work Space

PDF Version: Tips-on-Securing-Remote-Work-Space

, ,

No Comments

Online Payment Security Risk

The advent of ECommerce digital technologies and the sales revenue generated by such businesses has benefitted global economies but attracted a lot of adversaries well. This has exponentially increased the rate at which PSPs (Payment Service Providers) are attacked. Risks and threats need to be identified, quantified & measured so they can be dealt with proactively.

5 common hurdles encountered in online payments systems:

  • Chargebacks: The “card-not-present” transactions indicate a fraudulent usage of payment networks and data theft. However, fraud-monitoring tools detect the same but deploying EMV (Europay, MasterCard® & Visa®) embedded chip & biometric authentication technologies are advisable. Too many chargebacks not only damage the business reputation but often the merchant closes its accounts. Deploying effective customer service and customer checks substantially reduces frauds and chargebacks.
  • Domestic and international transactions: National banking infrastructures require Private PSPs to enable cross-border transactions facilitating global trade. Government-led initiatives & mandates have regularized payment processors which were initially slow levying expensive transactions service charges. Managing credit risk, liquidity of assets, outsourcing business and professional services, and cost-to-benefit analysis for MNCs (Multi-National Companies) is now easily handled by transnational PSP systems.
  • Cyber-attacks: PSPs face DDoS (Distributed Denial of Service), phishing, vishing, smishing, e-skimming, etc. attacks. It is advised to subdue the application, network, data, & infrastructural security risks by following Defense-in-Depth and Depth-in-Defense approaches. Enforce the Security CIAAAN and comply with various physical, technical, tactical, operational procedures. Getting complied with regulatory compliance frameworks and standards increases your business reputation and customer acceptance. Implementing PCI-DSS, GDPR, ISO’s OSI model, HTTPS-SSL-TLS ensures the Credibility of your firm’s Security posture to your partners, merchant vendors, & customers.
  • Domestic & foreign currency payments: Merchants initially required different bank accounts and business entities as per the national/regional market. But nowadays, PSPs facilitate merchants, retailers, and customers paying in regional currencies increasing multi-currency, cross-border transactions.
  • Technological workflows: With digitization, integrating various technologies across the world to function & operate with common objectives faces a few difficulties as well. Payment processors need to deploy good security mechanisms which of course is expensive for merchants to bear its costs. The PSP has to roll out its own hardware and software that facilitates secure payment transactions between merchants, retailers, & customers. The seamless, safe and secure payment experience has its costs that the end-users have to bear.

5 Best practices to deal with online payment security risks:

  • Educate employees: Employees and partners need to understand the bigger picture of business risk. Everyone must take moral ownership to keep the risky online payment business safe and secure in their individual capacities. User awareness training must be conducted to prevent the staff from getting targeted by social engineering attacks.
  • Prevent, detect, and mitigate risks: Ensuring cybersecurity and secure data practices is the first step to preventing imminent risks. Detection & mitigation is strengthened by deploying in-house SOC (Security Operations Center) and/or NOC (Network Operations Center) or outsourcing them to MSSP (Managed Security Service Providers).
  • KYC and compliances: Complying with the various regulatory standards & compliance frameworks shows credibility to business partners, merchants vendors, clients, customers, and likewise. Adhering to Data privacy laws is very much recommended.
  • Conducive company policies: The online payment shipping, returns, refund amount, data privacy policies must be well stated over the online platforms that the Users use every day. Satisfaction, convenience, and security of customers must be prioritized.
  • Risk modeling: Risks & threats must be assessed beforehand. The relevant BCP (Business Continuity Plan), as well as DRP (Disaster Recovery Plan), must be clearly defined. Frauds must be dealt with strict legal actions to instill fear in fraudsters and maintain or improve business reputation in the market.

To know about Online Payment Security solutions for business, call Centex Technologies at (254) 213 – 4740

, , , ,

No Comments

Manufacturing Business Security: How To Protect Your Manufacturing Business From Cybersecurity Threats?

Manufacturing businesses across the world were able to operate without strengthening their cyber security posture as that sector initially did not face critical cyber threats. However, the advent of PLC-SCADA (Programmable Logic Controller – Supervisory Control and Data Acquisition), IoT (Internet of Things), Robotic Automation, M2M (Machine-to-Machine) Communication, and State-of-the-Art Technological innovations have attracted the heat from APT (Advanced Persistent Threat) groups. Disrupting production and assembly lines, intellectual property theft, economic and employment failures, and hacktivism are some of the causes and motives that drive attackers apart from just the financial gains.

5 Best practices businesses can follow to protect manufacturing, production and assembly lines from hackers:

  1. Educate and train the employees, partners, and customers: Humans are the weakest link in the entire IT infrastructure that is evident when attackers phish employees for credentials. Security awareness training must be conducted periodically and the company can release advisories and suggest best practices as well. People must be trained to identify, block and report phishing and malicious emails which often is the simplest yet effective way to ward off the biggest cyber threats. Employees must be able to differentiate between genuine and spoofed email senders and user profiles on social media based on a list of red flags provided to them. Everyone in the organizational ecosystem must take ownership of cybersecurity from the entry-level work roles to the C-Suite.
  2. Deploy 2FA / MFA with Biometrics: Implementing 2FA (2-Factor Authentication) and MFA (Multi-Factor Authentication) along with biometric locks will keep unauthorized users or hackers at bay. It is advised to periodically change the credentials used to access the various digital resources across your organization. Modify and update the vendor-supplied default security configuration to customize as per the business requirements. Deploying an appropriate IAM (Identity and Access Management) plan not only prevents an accidental information modification from employees unauthorized to do so but also limits the scope of access for hackers having stolen the employees’ credentials.
  3. Update and upgrade the software and hardware: Always update the hardware and software components used in your equipment and technologies periodically as per the vendor’s suggestions. Your lethargy or temptation to ignore the security updates might attract the attention of attackers to hack into your production systems and cause damage. Customers, partners, and end-users must be notified every time a new hardware or software update or upgrade is available for roll-out with the company. Patch the software for existing vulnerabilities and also design plans for setting up network communication architecture implementing defense-in-depth and depth-in-defense approaches.
  4. Data Privacy & Security with Disaster Resiliency: Companies must be aware of all the T&Cs (Terms and Conditions) about data storage and usage policies of its partners and customers. It is advised to conduct KYC (Know Your Client) background checks before storing any PII (Personally Identifiable Information) or confidential data of your customers and partners. You must encrypt the trade secrets, blueprints, business strategy related files in online and/or offline storage. Utilize encrypted and secure channels to share or transfer data with authorized users and groups. Businesses must aim to procure and deploy a robust and reliable technology tech-stack. The SaaS (Software-as-a-Service), PaaS (Platform-as-a-Service) and IaaS (Infrastructure-as-a-Service) applications must be used along with leveraging Military-grade encryption, Fail-safe Data Backups, Anti-Ransomware Solutions and Disaster Recovery mechanisms to protect your data from loss or corruption in case of any human or natural disaster.
  5. Holistic IT Strategies: Maintaining your organization’s credibility in the market among customers via complying to the various regulatory compliances is very important to protect highly sensitive business information. In-house SOC (Security Operations Center) team can monitor the real-time activities of Users, Services, and Applications in your productions and assembly environment. Alternatively, to facilitate inadequate budgets and lack of resources, you can hire an MSSP (Managed Security Service Provider) to outsource your security logging & monitoring requirements. They help in preventing, detecting, analyzing, & mitigating security risks, threats, vulnerabilities, and incidents. Protect the industrial automation machinery & M2M communication equipments with various security solutions such as NGAVs (Next-Gen Anti-Virus), DLP (Data Loss Prevention), XDR (Extended Detection and Response), Honeypot and likewise. Securing the productions and assembly lines would give Hackers a hard time targeting your manufacturing business.

Centex Technologies provide IT and Cybersecurity solutions to businesses including manufacturing units. For more information, call Centex Technologies at (254) 213 – 4740

 

 

, , , , , ,

No Comments