PDF Version: Public-WiFi-Security
As the ‘Work From Home’ and ‘Bring Your Own Device’ culture has gained popularity, organizations have increased their attention towards mobile security. Most employees routinely access organizational data from their personal mobile devices, cyber criminals also try to gain on this opportunity. So, organizations have to keep their employees informed about major cyber security concerns that can be woven around smartphones.
Here are some major cyber security concerns of smartphone users:
- Data Leakage: Data leakage refers to unauthorized transfer of data from within an organization’s systems to an external destination or recipient. It is one of the most bothersome cyber security threats for enterprises. In order to combat the issue of data leakage, organizations need to implement an app vetting process that does not overwhelm the administrator and does not frustrate the users as well. However, this doesn’t help in taking care of data leakage resulting from user error such as transferring company files onto public cloud, copying confidential information to a wrong place, forwarding an email to unintended recipient, etc.
- Social Engineering: It is a manipulation technique that exploits user error to gain private information, unauthorized access, etc. These scams are also known as ‘human hacking’ scams because these scams work by luring unsuspecting users into exposing data, spreading malware infections, or giving access to restricted systems. Social engineering scams usually aim at theft of information as well as sabotaging organization’s reputation by disrupting or corrupting data. Common examples of social engineering attacks include phishing attacks, baiting attacks, physical breach, pre-texting attacks, access tail-gaiting attacks, quid pro quo attacks, scareware attacks, etc.
- Wi-Fi Interference: A mobile device is secure only in case the network through which data is transmitted is secure. Cyber criminals find an array of ways to intercept the transmission. Some of the tactics include setting up fake Wi-Fi networks, intercepting communications transferred across public networks, etc. Organizations can combat this issue by motivating users to download and make use of VPN.
- Cryptojacking Attacks: Cryptojacking is a type of attack where cyber criminals use victim’s device for mining cryptocurrency without victim’s knowledge. The cryptomining process relies on the user’s resources such as mobile device processor, network, data, storage, etc. This reduces the performance level of the mobile device.
For more information on cyber security concerns of smartphone users, contact Centex Technologies at (254) 213 – 4740.
Web application vulnerabilities are system flaws that can arise due to improper validation or sanitization of form inputs, misconfigured web servers, or application design flaws. Such vulnerabilities can be exploited by cybercriminals to compromise the application’s security and gain access to use the application as a breeding ground for malware.
Common security vulnerabilities that affect web applications.
- Injection: This happens when an interpreter receives a compromised query or command. Examples of injection flaws include SQL, LDAP, and OS. The best way to stay protected against injection flaws is to avoid accessing external interpreters. Language specific libraries can be used to perform functions for system calls or shell commands as they don’t use shell interpreter of the Operating System. If a call must be employed (such as calls made to backend database), make sure to validate the data carefully.
- Cross Site Scripting (XSS): XSS attacks occur when a web application sends data to a client browser without thorough validation. XSS vulnerabilities allow intruders to run malicious scripts on victim browser which spy on user sessions and redirect users to malicious websites in some cases. In order to avoid XSS, applications should be designed to perform vigorous checks against defined specifications. It is recommended to adopt a positive security policy which defines only what should be allowed.
- Broken Authentication & Session Management: If these functions aren’t properly configured, attackers can compromise user identities and exploit a vulnerability to steal session tokens, keys, and passwords. This type of attack can be avoided by using custom authentication and session management mechanisms. Some session management criteria that should be incorporated include password change requests, password strength checks, session ID protection, browser caching, trust, backend authentication, etc.
- Cross Site Request Forgery (CSRF): In this case, the attacker forces the victim to send requests that the server will consider to be legitimate. The requests are sent in the form of forged HTTP requests including session cookie of victim and other identification information. To prevent this, applications should use custom tokens in addition to tokens received from browsers because custom tokens are not remembered by browsers to initiate a CSRF attack.
- Security Misconfiguration: It is important for applications to have a secure application environment. Application developers need to consider guidelines pertaining security mechanisms configuration, turning off unused devices, logs & alerts, etc.
Centex Technologies offers web application development and cybersecurity solutions to its clients. For more details on how to make your web application secure, contact Centex Technologies at (254) 213 – 4740.
VPN stands for Virtual Private Networking. VPNs encrypt your internet traffic in real time and disguise your online identity. This makes it difficult for third parties to track your online activities and steal data.
How Does VPN Work?
A VPN hides an IP address by letting the network redirect it through a specially configured remote server run by a VPN host. This states that when surfing online with VPN, the VPN server acts as the source of your data. Due to this, the Internet Service Provider (ISP) and other third parties cannot see the websites you visit or data you send or receive.
Benefits Of VPN:
- Secure Encryption: VPN ensures secure encryption of data transmitted and received. User requires an encryption key to read the data. This makes it difficult for the hackers or third parties to decipher the data, even if they corrupt the network.
- Disguise The Location: VPN servers act as a proxy for you on the internet. This ensures that the actual location of the user is not determined. Additionally, most VPN services do not store activity log which further ensures that no information about user behavior is passed on to hackers or third parties.
- Secure Data Transfer: As the trend of working remotely is gaining popularity, secure data transfer has become immensely important. Organizations can make use of VPN servers to ensure the security of data being transmitted and reduce the risks of data leakage.
Zero Trust Security
Main tenet of “zero trust security” is that vulnerabilities can appear if businesses are too trusting of individuals. This model maintains that no user, even if allowed on the network, should be trusted by default because it may lead to end point being compromised.
How Does Zero Trust Security Work?
Zero Trust Network Access (ZTNA) is an important aspect of Zero Trust Security model. ZTNA uses identity based authentication to establish trust before providing access while keeping the network location (IP address) hidden. ZTNA secures the environment by identifying anomalous behavior such as attempted access to restricted data or downloads of unusual amounts of data at unusual time or from unusual location.
Benefits OF Zero Trust Security:
- Increased Resource Access Visibility: Zero Trust Security model provides organizations better visibility into who accesses what resources for what reasons and understand the measures that should be applied to secure resources.
- Decreased Attack Surface: As Zero Trust Security model shifts the focus to securing individual resources, it reduces the risk of cyber-attacks that target network perimeter.
- Improved Monitoring: Zero Trust Security model includes the deployment of a solution for continuous monitoring and logging of asset states and user activity. This helps in detection of potential threats in a timely manner.
Zero Trust and VPN are both types of network security and although they seem to have different approaches, these can be used in conjunction for a comprehensive security strategy. Organizations can use Zero Trust concepts and VPNs to delineate clear network perimeter and then create secure zones within the network.
At Centex Technologies, we recommend network security protocols and solutions to formulate an effective network security strategy. For more information, call Centex Technologies at (254) 213 – 4740.