Tag: Cyber Security Page 17 of 41

Cookies & Online Privacy

On August 26, 2021

When surfing online, a common pop-up that a user receives is ‘Accept The Cookies’. Some websites use cookies to provide a more personalized and convenient website browsing experience. But in order to understand the relationship between cookies and user’s online privacy, it is first important to understand what cookies are.

What Are Cookies?

Cookies are text files that contain small amounts of data that can be used to identify your computer network. Specific HTTP cookies are used to identify specific users for improving their web browsing experience.

Data stored in the cookies is created when a user connects to an online server. This data is marked with an ID that is unique to the user and his computer/system. When cookies are exchanged between user’s computer and network server, the server reads this data for identifying the information that should be served to the user.

Cookies are of two types:

Magic Cookies: This is an old computing term that refers to packets of information that can be sent & received without any charges. This data is commonly used for logging in to a computer’s database systems. This concept is a precursor of modern day ‘cookies’.
HTTP Cookies: It is a repurposed version of magic cookies, which was created for internet browsing. It was specifically created to assist web browsers in tracking, personalizing, and saving information about a user’s online session. The server sends cookies only when it wants the web browser to save it. These are stored locally by the browser, so that when the user revisits a website, web browser can return the data stored in the cookies to help the server recall data from previous session. HTTP cookies can be further classified as – Session Cookies and Persistent Cookies.

How Are Cookies Used?

While session cookies are only used during navigating a website and are stored on RAM (never written to the hard drive), persistent cookies remain on the computer indefinitely.

Persistent cookies can be used for two main purposes:

Authentication: They help in identifying if a user has logged in and if yes, under what username. They also help in streamlining login credentials so that the user is not required to remember them.
Tracking: This is to track multiple visits to a website or webpage over time. This property is used by merchants to identify a user’s browsing behavior to suggest products that may interest the user.

Why Cookies Can Be A Threat?

Since the data written in the cookies cannot be changed, they are harmless. However, cyber criminals can get hold of the cookies to access victim’s browser sessions.
Third-party cookies (generated by ads on a webpage, even if user doesn’t click on ads) allow the ad owners to track user’s browsing history, thus interfering in his privacy.
Zombie cookies can be permanently installed on user’s system and reappear even after deleted.

Removing cookies can help in combating the risk of privacy breach.

For more information on cookies, online privacy and IT Security, contact Centex Technologies at (254) 213 – 4740.

Cyber Security Concerns Of Smartphone Users

By centexitguy

On August 25, 2021

In Security

As the ‘Work From Home’ and ‘Bring Your Own Device’ culture has gained popularity, organizations have increased their attention towards mobile security. Most employees routinely access organizational data from their personal mobile devices, cyber criminals also try to gain on this opportunity. So, organizations have to keep their employees informed about major cyber security concerns that can be woven around smartphones.

Here are some major cyber security concerns of smartphone users:

Data Leakage: Data leakage refers to unauthorized transfer of data from within an organization’s systems to an external destination or recipient. It is one of the most bothersome cyber security threats for enterprises. In order to combat the issue of data leakage, organizations need to implement an app vetting process that does not overwhelm the administrator and does not frustrate the users as well. However, this doesn’t help in taking care of data leakage resulting from user error such as transferring company files onto public cloud, copying confidential information to a wrong place, forwarding an email to unintended recipient, etc.
Social Engineering: It is a manipulation technique that exploits user error to gain private information, unauthorized access, etc. These scams are also known as ‘human hacking’ scams because these scams work by luring unsuspecting users into exposing data, spreading malware infections, or giving access to restricted systems. Social engineering scams usually aim at theft of information as well as sabotaging organization’s reputation by disrupting or corrupting data. Common examples of social engineering attacks include phishing attacks, baiting attacks, physical breach, pre-texting attacks, access tail-gaiting attacks, quid pro quo attacks, scareware attacks, etc.
Wi-Fi Interference: A mobile device is secure only in case the network through which data is transmitted is secure. Cyber criminals find an array of ways to intercept the transmission. Some of the tactics include setting up fake Wi-Fi networks, intercepting communications transferred across public networks, etc. Organizations can combat this issue by motivating users to download and make use of VPN.
Cryptojacking Attacks: Cryptojacking is a type of attack where cyber criminals use victim’s device for mining cryptocurrency without victim’s knowledge. The cryptomining process relies on the user’s resources such as mobile device processor, network, data, storage, etc. This reduces the performance level of the mobile device.

For more information on cyber security concerns of smartphone users, contact Centex Technologies at (254) 213 – 4740.

Web Application Vulnerabilities: Securing Online Applications

By centexitguy

On July 29, 2021

In Security

Web application vulnerabilities are system flaws that can arise due to improper validation or sanitization of form inputs, misconfigured web servers, or application design flaws. Such vulnerabilities can be exploited by cybercriminals to compromise the application’s security and gain access to use the application as a breeding ground for malware.

Common security vulnerabilities that affect web applications.

Injection: This happens when an interpreter receives a compromised query or command. Examples of injection flaws include SQL, LDAP, and OS. The best way to stay protected against injection flaws is to avoid accessing external interpreters. Language specific libraries can be used to perform functions for system calls or shell commands as they don’t use shell interpreter of the Operating System. If a call must be employed (such as calls made to backend database), make sure to validate the data carefully.
Cross Site Scripting (XSS): XSS attacks occur when a web application sends data to a client browser without thorough validation. XSS vulnerabilities allow intruders to run malicious scripts on victim browser which spy on user sessions and redirect users to malicious websites in some cases. In order to avoid XSS, applications should be designed to perform vigorous checks against defined specifications. It is recommended to adopt a positive security policy which defines only what should be allowed.
Broken Authentication & Session Management: If these functions aren’t properly configured, attackers can compromise user identities and exploit a vulnerability to steal session tokens, keys, and passwords. This type of attack can be avoided by using custom authentication and session management mechanisms. Some session management criteria that should be incorporated include password change requests, password strength checks, session ID protection, browser caching, trust, backend authentication, etc.
Cross Site Request Forgery (CSRF): In this case, the attacker forces the victim to send requests that the server will consider to be legitimate. The requests are sent in the form of forged HTTP requests including session cookie of victim and other identification information. To prevent this, applications should use custom tokens in addition to tokens received from browsers because custom tokens are not remembered by browsers to initiate a CSRF attack.
Security Misconfiguration: It is important for applications to have a secure application environment. Application developers need to consider guidelines pertaining security mechanisms configuration, turning off unused devices, logs & alerts, etc.

Centex Technologies offers web application development and cybersecurity solutions to its clients. For more details on how to make your web application secure, contact Centex Technologies at (254) 213 – 4740.

Cloud Computing Security: Challenges & Solutions

By centexitguy

On June 23, 2021

In Security

Cloud computing is a vast term that covers a wide range of technology resources that are delivered “as-a-service” via an internet connection. The cloud services include software-as-a-Service (SaaS), platform-as-a-service (PaaS), and infrastructure-as-a-service (IaaS). All these cloud computing models provide a different level of service, control, and responsibility.

When switching to a cloud computing model, business organizations need to be aware of the following cloud computing challenges:

Potential Loss Or Theft Of Intellectual Property: IP represents competitive advantages for a business, so a loss of IP may have a tangible impact on the business’s market share. Fraudsters may use this IP information to create fake products and cheaper processes since they don’t cover research & development costs.
Regulatory Compliance Violations: Cloud computing service providers may not meet the strict regulatory compliance standards of the industry. It can lead to compliance violations for businesses availing these services.
Reduced Visibility Of Cloud Environment: Some Cloud Service Providers do not provide visibility into the cloud environment. This problem is more intense in SaaS solutions because PaaS and IaaS solutions offer more visibility. After all, in these cases, users are expected to do their configuration and management for the cloud environment.
Lateral Attack Spread: If defense-in-depth controls of a cloud environment are not strong enough, it can be easier for an attacker to spread from one workload on the cloud to the next. Thus, multiple databases or apps can be compromised quickly during a breach.
Increased Complexity Of Security: Businesses that work with multiple cloud service providers have to face several different complicated cloud security processes. For example, one CSP may require multi-factor authentication using text messages, while another CSP may use a different authentication method. It increases process complexity making it difficult for users to access various cloud solutions in their day-to-day workflows.

Solutions To Cloud Computing Security Challenges

Limit Cloud Computing Vendors: Different Cloud Service Providers may have different security tools and processes, making it difficult for businesses to manage their cloud solutions. This challenge can be handled by trying to limit the cloud computing vendors. Companies should try to source as many cloud solutions from a single vendor as possible.
Verify Your Access To Information: Visibility into the cloud environment is vital for ensuring cybersecurity. So, verify the level of access to information that Cloud Service Provider would offer. With greater visibility into the cloud environment, businesses can more easily track and control security.
Verify Security SLAs: Verifying security SLAs (Service Level Agreements) before signing an agreement with CSP helps to ensure that the service provider will meet the industry’s cybersecurity standards and protect the business from extended service disruptions.
Consult A Cybersecurity Expert: Get assistance from cybersecurity experts before switching to the cloud computing model.

We, at Centex Technologies, help businesses in switching to cloud computing. We offer IT consulting services for educating businesses on their cloud computing requirements and ensuring cybersecurity. For more details on challenges & solutions related to cloud computing security, contact Centex Technologies at (254) 213 – 4740.

What Is New In Technology?

By centexitguy

On May 29, 2021

In Security

PDF Version: What-Is-New-In-Technology