Posts Tagged Cyber Security

Most Common Social Engineering Attacks

PDF Version:  Most-Common-Social-Engineering-Attacks

, , , , ,

No Comments

Cybersecurity Terminology That Everyone Should Know

The following is a list of the top 50 cyber security terms that everyone should be familiar with: –

  1. Adware: Application or software displaying unsolicited advertisements on your devices.
  2. APT (Advanced Persistent Threat): Unauthorized user attacks and gains access to network or systems without being detected.
  3. Anti-Virus Software: Application program used to prevent, detect, mitigate and remediate malware.
  4. Authentication: A process ensuring, confirming, and verifying a user’s identity credentials.
  5. Back door: Secret method to bypass security and gain access to a restricted part of a network/system.
  6. Backup: To make copies of data stored on devices so as to reduce the potential impact of data loss.
  7. Baiting: Online baiting is facilitated by trapping any victim with fake incentives and profits/gains.
  8. Blackhat Hacker: Infringes laws and breaches computer security unethically for malicious purposes.
  9. Botnet: A group of internet-connected systems, including computers, servers, IoT, and mobile devices which are infected and controlled by a common malicious software operated by any blackhat hacker.
  10. Brute Force Attack: Repetitive successive attempts of various credential combinations.
  11. Bug: Error, fault, or flaw in an algorithm or a program resulting in unintended execution/behavior.
  12. Clickjacking: UI redressing attack creating invisible HTML page element overlaying the legitimate page.
  13. Cookie: Websites recognize users and devices keeping track of their preferences via stored cookies.
  14. Critical Update: A resolution software to address and resolve a high severity issue.
  15. Cyber Warfare: Cyber-attacks perpetrated by one digital entity against one/multiple other digital entities.
  16. Data Breach: A high-severity and a high-impact confirmed incident where a system or network data has been stolen without the consent and knowledge or authorization of the system’s or network’s owner.
  17. DDoS (Distributed Denial Of Service): A cyberattack aiming to disrupt an ongoing service by flooding it with malicious traffic from multiple sources or botnets affecting the availability of that service online.
  18. Deepfake: Videos that have human faces either swapped or morphed, leveraging AI algorithms.
  19. Exploit: Malicious code or script used to target vulnerabilities in systems and networks.
  20. Honeypots: Decoy networks or systems operationalized to lure potential attackers.
  21. Incident Response Policy: A plan stating the company’s response to any cyber security incident.
  22. Keystroke Logger: Software covertly logging the keyboard and mouse keys pressed/clicked in devices.
  23. Malware: Malicious software developed to cause damage to any target device or network.
  24. Malvertising: Using online advertisements and allied print management services to deliver malware.
  25. MFA (Multi-Factor Authentication): A security process where a user provides multiple authentication factors to identify themselves.
  26. Packet Sniffer: Software designed to monitor and record network traffic.
  27. Patch: A code applied after the software program has been installed to rectify an issue in that program.
  28. Penetration testing: Pentesting is the science of testing not only networks and systems but also websites and software to find vulnerabilities that an attacker could exploit.
  29. Phishing: Method to try and gather PII (Personally Identifiable Information) using deceptive emails.
  30. Pre-texting: Act of creating fictional narratives manipulating victims into disclosing sensitive information.
  31. Ransomware: Malicious software deployed to block access to devices until a sum of money is paid.
  32. Rootkit: A type of malware developed to stay hidden and persistent inside the hardware of devices.
  33. Security Awareness Training: Program aimed to improve end-user security awareness of employees.
  34. SOC (Security Operations Centre): Monitors digital activities to prevent, detect, mitigate and respond to any potential threats, risks, and vulnerabilities.
  35. Smishing: A type of phishing involving text messages to lure victims.
  36. Social Engineering: The art and science of manipulating people to disclose confidential information.
  37. Spear Phishing: Email-spoofing attack targetting a specific organization or individual to obtain PII data.
  38. Spyware: A type of software installing itself on devices to secretly monitor and report victims’ activities.
  39. Tailgating: Someone lacking proper authentication follows a legitimate employee into a restricted area.
  40. Trojan: Malicious software disguised as legitimate software to gain access to systems of target users.
  41. 2FA: A security process where a user provides two authentication factors to identify themselves.
  42. Virus: Malicious program on devices performing malicious activities without user’s knowledge & consent.
  43. Virtual Private Network (VPN): A software allowing users to stay anonymous while using internet services by masking/hiding their real location and encrypting communications traffic.
  44. Vulnerability: A vulnerability refers to a flaw in a system that can leave it open to attack.
  45. Vishing: A form of phishing to scam victims over the phone to gather PII data used for identity theft.
  46. Whaling: A type of phishing targeted at specific high-profile company leadership and management.
  47. Whitehat Hacker: Perform ethical hacking on behalf of legitimate entities and organizations.
  48. Worm: Computer program replicating itself to spread to other devices in the network.
  49. Zero-Day: A recently discovered vulnerability that hackers are using to breach into networks & systems.

Contact Centex Technologies at (254) 213 – 4740. for IT and Cybersecurity Solutions for businesses.

, , , , ,

No Comments

How To Identify Signs Of A Phishing Attempt?

Organizations of all sizes are subjected to regular, highly sophisticated phishing attempts. Expecting IT and security teams to identify and combat all phishing attacks solely through technology is impractical. Phishing can take many forms, but it is essentially any email attack that is aimed to get the recipient to take a specific action. Phishing emails are now being meticulously researched and concocted to target specific receivers. So, how can you raise awareness about it and train your team to recognize a phishing email?

Phishing emails frequently include a variety of red flags that, if detected by the receiver, can prevent the attack from succeeding. A few red flags as mentioned below suggest the authenticity of any email: –

  1. Addressing, greeting, and context of the email: When reading a phishing mail, the first thing that generally raises suspicion is the words, tone, and figure of speech. In most of the mails, someone impersonating as a coworker may suddenly becomes overly familiar, or a family member may become a little more professional.
  2. Unfamiliar looking email ids, URIs: Looking for suspicious email ids, URIs (Uniform Resource Identifiers), and domain names is another simple approach to spot a potential phishing scam. It’s recommended to double-check the originating email ids against previous similar correspondence done. If the email contains a link, hover the pointer over the link to see what pops up. Don’t click if the domain names don’t match the links.
  3. Threats or high level of importance: Any email that threatens unpleasant repercussions should be viewed with caution. Another strategy used by criminals is to convey a sense of urgency to encourage, or even demand, urgent action from the receiver in order to confuse them. The fraudster expects that by reading the email quickly, the content will not be thoroughly reviewed, allowing additional phishing-related irregularities to go undetected.
  4. Attachments are the root cause of all evils: Be wary of emails with attachment(s) from an unknown sender. When the recipient did not request or expect to receive a file from the sender, the attachment should not be opened. If the attached file contains a file extension that you have never heard of, be cautious. You can flag it for an anti-virus scan before opening it.
  5. Irrelevant follow-ups: In a follow up email of some previous correspondence, if the correspondence requests something unusual, could be a sign of fraudulent communication. For example, if an email purports to be from the IT team and requests you to install a program or click a link to patch your asset whereas all patching is typically handled centrally. It is a strong indication that you’ve received a phishing email and should not follow the instructions.
  6. Concise and precise: While many phishing emails will be crammed with information in order to provide a false sense of security, others will be sparse in order to capitalize on their uncertainty. A scammer may send an email impersonating a familiar connection with some irrelevant text, for example – “Are you up for a profitable business venture with me?” and an attachment “Business Proposal”. These kinds of emails are usually sent to 9 to 6 working professionals who are looking to make side-income apart from their primary profession.
  7. Recipient didn’t initiate the email thread: As phishing emails are unsolicited, a common red flag is to inform the receiver that he or she has won a reward. The recipient can be lured to qualify for a prize if they reply to the email, or will receive a discount if they click on a link or open an attachment. There is a significant likelihood that the email is questionable if the receiver did not initiate the dialogue by opting in to receive marketing materials or newsletters.
  8. PII (Personally Identifiable Information) requested: When an attacker creates a false landing page that users are directed to via a link in an official-looking email, often some sort of credentials, payment information, or other personal information is asked.
  9. Grammatical errors: The use of poor grammar and spelling is another prevalent symptom that raises a red flag. As most firms have the spell check feature turned on in their email client, you’d expect emails from a professional source to be free of errors in language and spelling.

Sifting through the numerous reports to eliminate false positives is difficult and cumbersome. So, how can a business prevent phishing emails and spot phishing attacks? One strategy is to give priority to notifications from individuals who have a history of correctly recognizing phishing messages. These prioritized reports from employees help the SOC (Security Operations Center) team quickly respond to possible phishing attempts. This reduces the risk to individuals and business partners who could fall prey to such phishing campaigns.

To know more about various cyber-attacks and methods to prevent them, contact Centex Technologies at (254) 213 – 4740.

, , , , , ,

No Comments

What is LockBit Ransomware?

LockBit is a ransomware family that is part of a RaaS (Ransomware-as-a-Service) operation associated with LockerGoga and MegaCortex. LockBit has been seen in the wild since September 2019. The group previously advertised their services on hacking forums. They started advertising an affiliate program as “LockBit 2.0” in June 2021 via their own website on the dark web.

LockBit is initially deployed manually by an attacker that has already gained access to a victim system, but will quickly begin spreading to other systems by itself. The LockFile payload is known for its fully automated attacks and quick encryption. It prevents victims from accessing their files on an infected system by first encrypting the files adding a .lockbit extension to them. It then instructs the victim to pay a ransom in order to regain access to those encrypted files. The malware is capable of automatically spreading to other systems via SMB (Server Message Block) shares and executing PowerShell scripts. Victims regain access to their files by paying the ransom. They then obtain a custom decryptor that decrypts the locked and encrypted files.

This threat group uses a double extortion technique, threatening to release the stolen data if the ransom is not paid. Experts believe LockBit is part of a ransomware cartel involving collaboration between multiple ransomware groups, including Maze and Ragnar Locker.

So, how would you protect yourself from getting infected by the LockBit ransomware?

5 proactive and protective best practices helps you and your firm stay resilient against any cyber attack:

  1. Social Engineering Awareness: The users and employees must be provided end user security awareness training periodically. Organizations can release advisories and suggest best practices. Users must be demonstrated how to identify, block and report malicious emails. They must be able to differentiate between legit and illegit, email senders and user profiles on social media based on a list of Red Flags provided to them.
  2. Credentials policy and 2FA/MFA: Usernames and passwords must be configured in a manner that they cannot be guessed easily by the attackers. Use alphanumeric characters and keep the minimum length to 16. Threats ranging from account breaches to ransomware infections can be prevented if only the administrators pay attention to credential policies. You can check haveibeenpwned.com and follow NIST’s guidelines to set secure credentials. Use random password generator and check the complexity score of your password at passwordmeter.com. Enabling MFA (Multi-Factor Authentication) & 2FA (2-Factor Authentication) will prevent brute force attacks on your account. This adds more authentication layers on the top of your initial password-based logins. Alternatively you can implement biometrics and / or physical USB (Universal Serial Bus) key authenticators.
  3. ACL (Access Control List): Grant or assign the privileges or access on a Need-to-Know basis only.! Deployment of IAM (Identity and Access Management) strategy prevents accidental information modification from unauthorized employees. This also limits the scope of access for hackers having stolen the employees’ credentials. Enable a systematic deprovisioning process for employees leaving the company. Revoking the access rights of people who have left the organization is a crucial security responsibility that must be completed on the LWD (Last Working Day) & not get delayed.
  4. Fail-safe Backups: You can encrypt the data in upload it in cloud or keep in offline storage. Choose the CSP (Cloud Service Provider) that provides military-grade encryption. Implement, deploy & launch backup & disaster recovery mechanisms to protect your data.
  5. Holistic IT Strategies: Maintaining your organization’s credibility is very important. Comply to various regulatory standards & frameworks to protect highly sensitive business information. In-house SOC (Security Operations Center) team can monitor the real-time activities of users, services, and applications in your IT environment. Alternatively, to facilitate inadequate budgets & lack of resources, you can hire an MSSP (Managed Security Service Provider). They help you to outsource your security logging & monitoring requirements. They prevent, detect, analyze, & mitigate security risks, threats, vulnerabilities, & incidents for your business. Protect your data & devices with various security solutions such as NGAVs (Next-Gen Anti-Virus), DLP (Data Loss Prevention), XDR (Extended Detection and Response), Honeypot and likewise. Training and securing your users and employees would give hackers a hard time targeting your IT infrastructure.

For more information on various ransomware attacks and IT security measures to be adopted by businesses, contact Centex Technologies at (254) 213 – 4740

, , ,

No Comments

Tips on Securing Remote Work Space

PDF Version: Tips-on-Securing-Remote-Work-Space

, ,

No Comments