The Central Texas IT Guy

Web Development Austin, SEO Austin, Austin Search Engine Marketing, Internet Marketing Austin, Web Design Austin, Roundrock Web Design, IT Support Central Texas, Social Media Central Texas

Tag: Cyber Attack Page 7 of 14

Cybersecurity Leadership Principles For Secured Business Operations

By

On May 31, 2022

In Security

Businesses becoming more reliant on the internet and digital platforms must examine cyber resilience from a business standpoint. The leadership must look at the cybersecurity posture of the various operational risks. They must also develop a flexible attitude in terms of how they would respond to and recover from a significant cyber incident. The ideas that follow help organizational leaders outline a plausible course of action balancing short-term goals along with the medium to long-term requirements.

Encourage a cyber-resilient organizational work culture

Businesses must establish plans to maintain durable and sustainable networks while also taking advantage of the benefits that digitalization may offer. Following important measures assist executives in instilling a cyber resilience culture throughout the organization and wider ecosystem: –

  1. Enforce the cyber-resilience governance in place
  2. Designing infrastructure for disaster flexibility
  3. Exceed the call of duty hours and deploy 24/7/365 security team
  4. Employee habits and behaviors that assists in being flexible and proactive in responding to cyber threat should be strengthened

Concentrate on safeguarding the most vital capabilities and services

The leaders are advised to identify the possible repercussions of a crisis on revenue, workers, customers, and the availability of key services. Business executives must have a holistic and systemic perspective of their critical services, applications, suppliers, and assets. The important steps listed below assist executives in maintaining their company’s cyber health and protecting critical capabilities and services: –

  1. It is necessary to ensure strict digital hygiene
  2. It is important to keep crucial assets safe, isolated, and air-gapped
  3. Keep a watch out for any strange activity around the most valuable assets
  4. Automating cybersecurity helps to reduce the fatigue of Security teams

Risk-informed decisions and judgments during and after the crisis

Enterprises should realize that their business risk posture has shifted dramatically and, following the crisis, has to be restored to an acceptable level. Leaders may balance risk-informed choices by taking following important steps: –

  1. Transition the switch to a zero-trust approach to supply chain security
  2. Define and utilize useful cyber-resilience measurements
  3. Concentrate on cyber-threats that are vital to operations

Revise and rehearse your response and continuity strategies

Veteran cyber-resilience leaders and CEOs use their previous crisis expertize to respond to cyber-attacks. The important steps listed below assist leaders in maintaining business continuity through the volatile and dynamically changing period: –

  1. Develop a thorough crisis management strategy
  2. Keep the reaction and resilience plans up to date and revamp them as required
  3. Get ready to adopt the changes

Collaboration throughout the cyber security ecosystem should be strengthened

Leaders in the public and private sectors must encourage collaboration and actively participate in projects to ensure that steps are made to protect the broader ecosystem from existing and potential cyber threats. Furthermore, businesses must set clear expectations with suppliers about their cybersecurity controls in order to encourage regulatory alignment in terms of 3rd party assurance. They should also advance a variety of community initiatives to raise cybersecurity risk awareness throughout the supply chain. Following important measures assist leaders in building a collaborative culture inside the organization and across the ecosystem: –

  1. Boost overall situational awareness
  2. Motivate people to work together
  3. Take a holistic strategy to manage cyber risks

Business leaders may better satisfy their duties to sustain their organization’s security posture and ensure business continuity if they follow the guidelines set up in cyber-security plan. Businesses can create smarter, quicker, and more connected futures with strong cyber-risk management and cyber-resilience strategies, promoting corporate development and efficiency.

Centex Technologies helps business leaders understand and implement necessary cybersecurity principles. To know more about cybersecurity, contact Centex Technologies at Killeen (254) 213 – 4740.

Training Employees To Reduce Cybersecurity Risks

By

On May 30, 2022

In Cybersecurity

The use of IT and cyber technology in business operations is expanding. As a result, the number of phishing attempts on enterprises has also skyrocketed. In the fight against cybersecurity attacks, inadequate cybersecurity awareness training continues to be a major issue for businesses.

Firms are recommended to take following proactive measures to stay protected against cyberattacks:

  • Identifying cybersecurity risks: Workplace culture, people profiles, job tasks, and other variables can impact risk factors.
  • Educating employees: Commit to a range of methods for keeping employees informed about cyber security attacks and what they can do about it. This necessitates a mental shift: instead of perceiving the person who opened the phishing link as the center of failure, recognize that the security and training framework surrounding that individual has failed.
  • Invest in reducing Cybersecurity risks to strengthen the overall security posture: Change has to start from the top. Put a monetary value on everything, from the cost of losing access to mission-critical data to the risk of being held liable for losing consumer information.
  • Avoiding social engineering assaults using employee training: Social engineering strategies include sending questionnaires to employees and encouraging them to provide personal information. Appropriate training will help employees to identify if they are being targeted.
  • Practice thwarting social engineering attempts right from their onboarding phase: Several social engineering attack scenarios must be simulated, and the employee must be tested as a result. From the initiation phases, password security, phishing, and social engineering assaults must all be addressed. Most importantly, employees have to not only understand the compliance and regulations but also why the best practices are so vital.
  • Rewarding employees motivate them: Giving out rewards for detecting genuine network attacks and weaknesses is an excellent illustration of this.
  • Evaluating employee security awareness: Corporate assessments and committee meetings have the unexpected effect of improving cybersecurity awareness.
  • Trust & encourage open communication in work culture: Employees should not be hesitant to report system issues. They should be encouraged to share their knowledge with others. If everyone is on the same page, it will be much easier to raise awareness about cybersecurity issues.
  • Discuss about updates and news in Cybersecurity domain everyday: Employees must pay attention to latest developments at cyber security front. Make sure employees are informed about any new crypto-malware or exploits that might cause phones or devices to crash with a single message.

How to plan a curriculum that trains employees to reduce cybersecurity risks?

Employee cyber security awareness training plan must include the following aspects:

  1. Phishing emails that are dummy; just to check employees’ alertness levels
  2. Blog articles, workbooks, documents for self-learning and updating themselves
  3. E-learning that is customized as per the business, sector, and vertical requirements
  4. Quizzes and short questionnaires to check the skills evaluating employees’ security awareness

Each of these characteristics helps employees have a better understanding of how security methods and tactics work, as well as how security mishaps might develop.

How does training employees with security awareness reduce cybersecurity risks to businesses?

Cybersecurity awareness training benefits stakeholders across the business in the following ways:

  1. Increasing the cyber-resilience of the organization
  2. Helping develop a security-conscious workplace culture
  3. Taking steps to reduce human error and solve the security problems
  4. Increasing audit findings and demonstrating regulatory compliance
  5. By generating a yearly, bi-annually, and quarterly schedule of events, detecting areas of overlap, and recognizing user weariness, corporations save time and money when planning a security awareness campaign.

Cybersecurity awareness training should begin at the outset of a company and not be hurried. Before starting their new positions, employees and candidates must complete network security training to guarantee that they understand how to use technology and stay secure online. It’s not enough to be aware of dangers; you must actively seek out and monitor them. Users must be educated and informed about network security methods and solutions to get the most out of them. It’s more important for digital and e-commerce businesses to create awareness and educate staff on cybersecurity risks and trends. Employees and workers who refuse to keep up should be dismissed, and cyber awareness training programs should become necessary to stay safe and secure online.

Centex Technologies provides advanced cybersecurity solutions to businesses. To know more about cybersecurity, contact Centex Technologies at Killeen (254) 213 – 4740, Dallas (972) 375 – 9654, Atlanta (404) 994 – 5074, and Austin (512) 956 – 5454.

All You Need To Know About Enemybot DDOS Botnet

By

On April 28, 2022

In Cybersecurity

Enemybot is a new botnet that is conducting DDoS (Distributed Denial of Service) assaults on several routers and websites. It is attacking various routers and websites by leveraging existing vulnerabilities in ARM, BSD, x64, x86, and other architectures. Enemybot was identified by FortiGuard labs in mid-March.

This botnet is mostly based on the source code of Gafgyt, however it has been reported to borrow various modules from Mirai’s original source code. To avoid detection, the Enemybot employs a number of obfuscation techniques and hides Command and control (C2) server on the TOR network. The Enemybot botnet spreads and assaults other IoT devices through a variety of tactics. It attempts to gain access to systems using weak or default credentials by logging into devices with a list of hardcoded username/password combinations. By running shell commands, the bot also attempts to infect misconfigured Android devices that expose the Android Debug Bridge port (5555). Enemybot has been observed infecting Seowon Intech and D-Link routers as well as abusing a previously disclosed iRZ router vulnerability.

The bot leverages a number of known and previously disclosed loopholes, which include: –

  • SEOWON INTECH SLC-130 and SLR-120S routers are vulnerable to CVE-2020-17456.
  • Earlier D-Link routers were vulnerable to CVE-2018-10823.
  • CVE-2022-27226 affects iRZ mobile routers.
  • CVE-2022-25075 to 25084 affects TOTOLINK routers, which were formerly used by the Beastmode botnet.
  • CVE-2021-41773/CVE-2021-42013 is a vulnerability that affects Apache HTTP servers.
  • CVE-2018-20062: This vulnerability affects the ThinkPHP CMS.
  • CVE-2017-18368 is a vulnerability that affects Zyxel P660HN routers.
  • CVE-2016-6277 is a vulnerability that affects NETGEAR routers.
  • CVE-2015-2051 is a vulnerability that affects D-Link routers.
  • CVE-2014-9118 is a vulnerability that affects Zhone routers.

Once one of the foregoing problems has been exploited, the bot will use the shell command LDSERVER to download a shell script from a URL that the C2 server will dynamically update. The script then downloads the real Enemybot binary, which is adapted to the target device’s architecture. If the download server goes down, the botnet managers can update the bot clients with a new URL. The bot connects to its C2 server after being placed on a device and waits for new orders.

Enemybot’s Capabilities

Enemybot connects to the C2 server and waits for orders to be executed when a device is infected. Although the majority of the instructions are connected to DDoS assaults, the virus is not just focused on them. Fortinet presents the following set of supported commands: –

  1. ADNS: Perform a DNS amplification attack with ADNS.
  2. ARK: Stealth survival while launching an attack on the game’s servers.
  3. BLACKNURSE — Flood the target with ICMP packets indicating that the destination port is unreachable.
  4. DNS – Inundate DNS servers with DNS UDP requests that have been hardcoded.
  5. HOLD – Flood the target with TCP connections and keep them alive for a certain amount of time.
  6. HTTP — Send a flood of HTTP requests to the destination.
  7. JUNK — Flood the destination with non-zero-byte UDP packets at random intervals.
  8. OVH – Send custom UDP packets to OVH servers.
  9. STD — Send a flood of random-byte UDP packets to the destination.
  10. TCP — Send a flood of TCP packets to the target with forged source headers.
  11. TLS — Carry out an SSL/TLS attack.
  12. UDP — Send UDP packets with forged source headers to the destination.
  13. OVERTCP — Use randomized packet delivery intervals to launch a TCP assault.
  14. STOP — Put an end to continuous DoS assaults.
  15. LDSERVER – Update the exploit payload download server.
  16. SCANNER — SSH/Telnet brute-force attacks and vulnerabilities spread to additional devices.
  17. TCPOFF/TCPON — Turn the sniffer off or on at ports 80, 21, 25, 666, 1337, and 8080, potentially to gather credentials.

Preventing Botnet Attacks

Always apply the latest available software and firmware updates for your product to prevent Enemybot or any other botnet from infecting your devices and recruiting them to malicious DDoS botnets.

One of the most common signs that your router may be infected with a botnet malware infection is that the router may become non-responsive, internet speeds drop, and the router becomes hotter than usual. In such a scenario, you should restart the router and change the passwords. It is also advised to take services of specialized cyber-security professionals to find and weed out the problem.

Centex Technologies provide state-of-the-art cybersecurity and network security solutions for businesses. To know more, contact Centex Technologies at Killeen (254) 213-4740, Dallas (972) 375-9654, Atlanta (404) 994-5074, and Austin (512) 956-5454.

Ways To Keep Your Business & Home Networks Secure

By

On February 27, 2022

In Security

The ongoing digital revolution across multiple sectors has been a lucrative target for hackers for the past few decades. Follow these simple yet profound tips to keep your work and home networks secure.

  1. Maintain a CMDB of your entire IT Infrastructure – Businesses are advised to create and maintain a list of their IT assets, hardware, and software in a CMDB (Configuration Management Database). Configuration Management Database helps IT teams to quickly manage and configure the hardware and software assets the business requires. Security frameworks such as ISO, NIST, and even CIS benchmarks are driven by IT Asset CMDBs. An automated system for scanning and finding IT assets, as well as in-depth information on those assets, is your best choice for ensuring your IT asset inventory is up-to-date, accurate, and thorough.
  2. Continuous surveillance and monitoring – IT department must keep track of all the assets as soon as they connect with the enterprise network, as vulnerabilities in them can allow a cyberattack to take place. Asset discovery solutions provide device detection features; allow IT teams to detect and identify rogue and unknown assets across the IT infrastructure. Hence, it also eliminates blind spots. This is especially essential as people connect work laptops to home networks, where a range of unprotected personal and IoT gadgets can act as entry points for malware and fraud.
  3. Update, upgrade and upscale your IT infrastructure – Security disclosures, vulnerability bulletins, and other technology vendor upgrades must all be kept up to date. Unpatched appliances are a typical attack vector for cybercriminals. Organizations have been frequently breached months or years after a patch is released because updates were not implemented as part of a managed program. Keep your software up to date and, if feasible, keep up with all the newest software patches.
  4. Implement access control and IAM (Identity Access Management) – IT Teams can reduce the risk potential as they adopt the principle of least privilege. Here, users are only assigned the permissions they need to do their work tasks. This should also apply to removing access to facilities such as Local Administrator access. Review and restrict the use of highly privileged accounts such as Domain Administrator and Global Administrator.
  5. Securing data from malicious entities as well as disasters – A security compromise can result in data loss and damage; thus regular backups are essential. Backups provide infinite scalability and remove additional infrastructure expenditures. Cloud is an excellent choice for data backup. Predictable storage costs and negligible downtime allow data to be accessed and restored immediately, ensuring business continuity.
  6. Educate and train the people – Let it be your family members at home or your employees, colleagues in the business; educate them all about end-user security awareness. However, the majority of people are unaware of how to see a threat and fail to notice a fraud attempt when they encounter one. You can limit risk and reduce occurrences by educating people about the hazards of cyber-attacks, what to look for, and how to report a probable attack.
  7. Strengthen your Incident response strategies – The best strategy to ensure timely corrective action after facing a cybersecurity incident is to have an IR (Incident Response) plan. Following a breach, a good IR identifies the procedures and actions that the staff should take. The Incident responder also assists in the coordination of resources to quickly restore operations. The incident response plan should specify responsibilities and provide step-by-step technical instructions for repairing the vulnerability. It must also include assessing the damage, recovering any lost or damaged data, and documenting the occurrence. The impact of an event will be minimized and the business will be protected from unnecessary harm and costs if everyone is on the same page with a plan of action and access to a central data repository.

Seek a consult with Centex Technologies for complete IT security audit of your business. Contact at (254) 213 – 4740.

How Would You Protect Your Remote Workforce From Emerging Cyber-attacks?

By

On February 25, 2022

In Security

The pandemic has facilitated, rather than forced, many office workers to work remotely for their individual firms. Professionals working remotely encounter a number of challenges particularly in the arena of cyber security. The onslaught of pandemic has led cyber threat actors to exploit the situation and target those working remotely.

It is advised that businesses and employee undertake the below measures to ensure that their remote working experience is safe and secure:

Security-first environment – When working remotely, it’s critical to choose a physically secure location. The employer or employee has to avoid disclosing any PII (Personal Identifiable Information) when connected online. Remote workers delivering online video conferences and presentations must try to mask their personal surroundings. Malicious actors are continuously on the lookout for PII that is revealed during such video calls. It is also important that other persons in the house do not have access to your laptop and desktop system. Do not use public networks for personal or business purposes.

Securing your Wi-Fi network – Make sure your WiFi Security is set to WPA2 on your Broadband Router. The default credentials across your routers, modems, and cellular WiFi hotspots must be changed. As you are working remotely, it’s a good idea to set up specific Wi-Fi networks. A Host network must be reserved for employees-employers and the Guest network available to the rest of the family. This will allow you to isolate data transmission between WiFi networks and avoid bottlenecks and network clogs.

Remote working communication and collaboration platforms – Employers need to invest in video conferencing apps, cloud-based office suites, and other technologies to be able to operate remotely. As managers and leaders, it is your responsibility to ensure that these tools are safe to use by your employees. You may assess the safety and security of any apps you want your employees to use by working with your IT and Security staff. It’s also crucial to remind your remote workers to update their software applications on a frequent basis to ensure that they have the most up-to-date security updates.

Do not use office equipment for personal use – Employees who have been given work equipment should avoid using it to log into personal social media accounts. Remote workers should not engage in any personal activities of interest on company-issued devices and appliances.

Avoid any suspicious content, emails and chat messages on social media – The pandemic has prompted criminal actors to take advantage of the situation and send phishing emails around the world. They replicate emails from local government officials and containing forms to be filled out with personal information or work-related information. Rather than believing in any random unconfirmed message on social media being propagated by bad actors, pay attention to your local and regional government news broadcasts and laws.

Strengthen the cyber security posture of your organization – Antivirus software alone is no longer sufficient to keep hackers and cyber criminals at bay. You should invest in a complete cybersecurity system that can protect you from all types of malware, frauds, and zero-day assaults.

VPNs must be provided to ensure encrypted and secure transmission of work data – Enable the different security features offered by vendors and OEMs in your devices and use them to protect yourself and your data while working remotely. It is advised to use VPN connections to connect to official applications.

These are just a few of the security options remotely working employers and employees must adopt. While the employees might not be physically protected from the office, employers must ensure to provide them adequate digital security while working remotely.

Centex Technologies provide complete cybersecurity solutions to businesses. For more information, call at (254) 213-4740

© Copyright 2022 The Centex IT Guy. Developed by Centex Technologies
Entries (RSS) and Comments (RSS)