East Bay community college data compromised in January cyber-attack

Read More

Training institute partners with HBCUs to offer new cybersecurity education scholarship

Read More

The UK regulator experienced a huge surge in spam, phishing and malware email attacks during 2021

Read More

You may hear corporate cybersecurity experts hail the benefits of a VPN, or a virtual private network, to keep company information safe from ransomware attacks and cyber criminals seeking to steal valuable business secrets. It’s unlikely that everyday people, such as yourself, will be targeted by a ransomware scheme, so you may be stumped on how a VPN can help someone like you be safer online. Luckily, a VPN is very easy to install and use, so you can experience these three everyday benefits to keep your browsing activities safe from eavesdroppers seeking to profit from your online comings and goings. 

1. Stay Safe on Unsecure Networks

The most widely known benefit of a VPN for daily use is to safeguard your device when it’s connected to a public Wi-Fi network. Coffee shops, libraries, hotels, transportation hubs, and other public places often provide courtesy internet service to visitors. Shifty characters often lurk on unprotected networks to lift personally identifiable information (PII) from people handling sensitive emails, making banking transactions, or shopping online. Public Wi-Fi eavesdroppers can lift credit card numbers, addresses, birthdays, and Social Insurance Numbers. 

When you connect to public Wi-Fi that doesn’t have a lock icon, that’s a sign that you should toggle on your VPN. Also, even if you’re required to enter a password, be wary of any network you share with strangers.  

2. Hide Location Data

A VPN can also hide your location data. How does this help you protect your browsing history? First, when you scramble your location, you’re likely to confuse ad networks trying to send you targeted ads. This will free your social media feeds and search engines from targeted ads that often are so accurate they seem like an invasion of privacy. 

Second, hiding your location can protect you from cybercriminals looking to mine PII. VPNs make it impossible for criminals to discover your IP address. (The internet protocol address is what ties your device to a specific local network.) When they’re visible, criminals can trace IP addresses to reveal home addresses, full names, and phone numbers: all of which are key pieces of PII that, in the wrong hands, can jeopardize your identity. 

Plus, there’s the bonus that hiding your location may allow you to access TV shows and movies on streaming services that aren’t available in your region. Also, you may enjoy savings when online shopping, especially for plane tickets. Airlines can see where in the world you access their site from and may jack up prices according to your location. Consider connecting to a server in a country that is neither your departure nor destination to see discounts. 

3. Restrict Data Snooping by ISPs

While Canada and the European Union don’t allow ISPs (internet service providers) to even collect the browsing data of their customers, keep in mind that in some countries, like the U.S., ISPs can collect, store, and sell customer data. While advertisers are often the buyers of customer data, in the case of a breach, the more places your PII lives, the more likely it may be involved in a security incident. The goal is to limit the extent and number of places where your browsing history is stored. 

VPNs can scramble your online movements to the point where not even ISPs can track it. Plus, when you log out, your device doesn’t keep a record of what you did while connected to the VPN. Incognito mode on your internet browser hides your IP address, but the websites you visit still collect cookies and store data about your online whereabouts, meaning that it’s not truly private browsing. 

Protect Your Privacy With McAfee 

McAfee Safe Connect VPN encrypts your online activity to protect your data from prying eyes. With a premium paid plan, you can protect up to five devices at once with bank-grade Wi-Fi encryption. Feel more confident whenever you hop on the internet across all your connected devices with just one quick and easy step. 

The post Why Everyone Needs a VPN appeared first on McAfee Blog.

Read More

‘Tis the season for tax scams here in the UK, and it’s no surprise to learn that scammers are spamming out fraudulent messages posing as HMRC.

Thankfully, at least some accountants are warning their clients about the danger of falling for a phish.

Read More

Real figure likely to be much higher, warns Chainalysis

Read More

Bunnie Huang has created a Plausibly Deniable Database.

Most security schemes facilitate the coercive processes of an attacker because they disclose metadata about the secret data, such as the name and size of encrypted files. This allows specific and enforceable demands to be made: “Give us the passwords for these three encrypted files with names A, B and C, or else…”. In other words, security often focuses on protecting the confidentiality of data, but lacks deniability.

A scheme with deniability would make even the existence of secret files difficult to prove. This makes it difficult for an attacker to formulate a coherent demand: “There’s no evidence of undisclosed data. Should we even bother to make threats?” A lack of evidence makes it more difficult to make specific and enforceable demands.

[…]

Precursor is a device we designed to keep secrets, such as passwords, wallets, authentication tokens, contacts and text messages. We also want it to offer plausible deniability in the face of an attacker that has unlimited access to a physical device, including its root keys, and a set of “broadly known to exist” passwords, such as the screen unlock password and the update signing password. We further assume that an attacker can take a full, low-level snapshot of the entire contents of the FLASH memory, including memory marked as reserved or erased. Finally, we assume that a device, in the worst case, may be subject to repeated, intrusive inspections of this nature.

We created the PDDB (Plausibly Deniable DataBase) to address this threat scenario. The PDDB aims to offer users a real option to plausibly deny the existence of secret data on a Precursor device. This option is strongest in the case of a single inspection. If a device is expected to withstand repeated inspections by the same attacker, then the user has to make a choice between performance and deniability. A “small” set of secrets (relative to the entire disk size, on Precursor that would be 8MiB out of 100MiB total size) can be deniable without a performance impact, but if larger (e.g. 80MiB out of 100MiB total size) sets of secrets must be kept, then archived data needs to be turned over frequently, to foil ciphertext comparison attacks between disk imaging events.

I have been thinking about this sort of thing for many, many years. (Here’s my analysis of one such system.) I have come to realize that the threat model isn’t as simple as Bunnie describes. The goal is to prevent “rubber-hose cryptanalysis,” simply beating the encryption key out of someone. But while a deniable database or file system allows the person to plausibly say that there are no more keys to beat out of them, the perpetrators can never be sure. The value of a normal, undeniable encryption system is that the perpetrators will know when they can stop beating the person — the person can undeniably say that there are no more keys left to reveal.

Read More

Bridge cryptocurrency hack follows bridge cryptocurrency hack follows bridge cryptocurrency hack.

Read More

The evolution of cyber threats and the confluence of new systems and legacy systems are biggest challenges, according to a panel of CISOs

Read More

This blog was written by an independent guest blogger.

Cybersecurity is among the most critical issues facing financial institutions today. Cyberthreats have been on the rise over recent years at the same time digital banking has gained popularity among consumers. Banks that want to meet demand without compromising safety must overcome several key security challenges.

1. Remote work

Since the onset of the COVID-19 pandemic in 2020, remote work is no longer the exception but the rule. While many financial institutions had to move to remote work arrangements out of necessity, employees are staying home out of preference. Surveys from late 2021 indicate that 37% of people want to continue working fully remote even after the pandemic. Another 54% said they want a hybrid arrangement, split between remote work and office hours.

Banks need to consider their employees’ needs and best interests, but remote work does require some extra cybersecurity measures. People working from home, coffee shops or elsewhere lack the protection of an office’s physical cybersecurity defenses.

2. Phishing

Phishing attacks have been a favorite tool for cybercriminals recently. Mobile phishing attacks surged by a shocking 161% from 2020 to 2021. They use disguised emails or domains to trick individuals into downloading malware or giving away personal information, which is known as credential phishing.

Employees and customers are at risk of phishing when it comes to digital banking. Cybercriminals may send emails disguised as official bank correspondence to customers, which can prove effective for stealing financial information. Likewise, employees must be on the lookout for phishing that seeks login credentials to access customer information.

3. Malware and ransomware

Malware and ransomware have been among the most dangerous threats across all industries over the last couple of years. In-depth studies by INTERPOL found that the COVID-19 pandemic sparked a 36% increase in malware and ransomware attacks, a surge second only to that of phishing. These attacks are becoming more common and advanced. During the pandemic, the percentage of cyberattacks using previously unseen tactics has increased from 20%-35%.

Organizations have begun using next-gen cybersecurity tactics to defend against these advanced threats. Behavioral analysis, AI and machine learning are becoming increasingly common cybersecurity tools. Digital banking must also evolve, incorporating cutting-edge technologies to stay ahead of cyber criminals’ innovations.

4. Customer behaviors

Customer behavior can put data at risk just as much as employee behavior can, if not more. Poor cybersecurity practices from digital banking customers can compromise their information in seconds. Everything from reusing passwords to opening suspicious emails can quickly result in losing sensitive financial data. In fact, one of the biggest challenges in digital banking today is implementing cybersecurity at scale, covering millions of phones, tablets and computers.

There are a few ways digital banking organizations can prevent breaches due to customer errors. They can use well-designed mobile apps with a streamlined user experience and built-in security functions. A user might utilize the fingerprint scanner on their phone or another multifactor authentication method to access their account. Sending out regular correspondence on the importance of good security practices is another way to encourage customers to be careful with their banking data.

5. Spoofing

Spoofing is similar to phishing but often more complex. There are a few main types of spoofing attacks, all utilizing some form of impersonation. Domain spoofing consists of creating a fraudulent version of an actual domain meant to trick users into giving away login credentials and personal information. This tactic bets on the likelihood that people will not look closely if a website appears to be legitimate.

Similarly, a hacker could “spoof” a financial institution’s phone number to call or text customers. The bank’s correct caller ID will show up on the customer’s phone, making it difficult for customers to tell if it is a legitimate message or not. Even if people do not fall for spoofing attacks, digital banking organizations need to keep an eye out for them since they can decrease customer trust.

6. Fraud and identity theft

Fraud and identity theft has skyrocketed over recent years. The Federal Trade Commission received nearly 1.4 million reports of identity theft in 2020, which was approximately a 213% increase from 2019. These attacks are not new to financial institutions, but they are evolving with cybercrime. Now fraud and identity theft can be conducted through other cyberattack channels, and digital tactics may make it more difficult to detect.

Digital banking organizations must implement cybersecurity strategies that actively search for suspicious account activity to fight these attacks on the virtual front. This is one of the surest ways to catch fraud attempts. For example, a user attempting to buy something from an unusual location could indicate their information has been stolen, and a cybercriminal is utilizing it.

Evolving digital banking security

Cyberattacks are becoming more common and sophisticated every year. More consumers are turning to the internet for everything from shopping to paying their bills, so digital banking organizations must take their security to the next level. Protecting customers is no longer as simple as complex passwords. Financial institutions need to remain at the forefront of cybersecurity innovations in today’s digital banking environment. That way, they can stay ahead of cybercrime and stop breaches before they happen.

Read More