Cybercriminals target SVB customers with BEC and cryptocurrency scams

Read Time:37 Second

Cybercriminals have started taking advantage of Silicon Valley Bank’s (SVB) downfall to carrying out scams that can steal money, and bank account information, or infect customers’ systems with malware.

SVB was shut down on March 10 by the California Department of Financial Protection and Innovation, after the bank failed to raise capital to keep running.

SVB customers are expected to transfer their financial operations to other banks in the coming weeks. This means these customers will receive notifications including the new bank account numbers from their new bank. Hackers are using this as an opportunity by posing as banks and carrying out phishing and business email compromise (BEC) campaigns, targeting SVB customers.

To read this article in full, please click here

Read More

Palo Alto announces new SD-WAN features for IoT security, compliance support

Read Time:41 Second

Cybersecurity vendor Palo Alto has announced new software-defined wide area network (SD-WAN) features in its Prisma SASE solution for IoT device security and to help customers meet industry-specific security compliance requirements. It has also announced advanced URL filtering for the prevention of unknown and evasive man-in-the-middle (MitM) and SaaS platform phishing attacks.

SD-WAN for IoT security provides device visibility, prevents threats

Prisma SD-WAN with integrated IoT security enables accurate detection and identification of branch IoT devices, Palo Alto stated. It allows customers to enable security controls from within the familiar cloud management for Prisma SASE without the need for additional appliances and sensors to be deployed in the network in order to gain visibility into IoT devices and prevent threats.

To read this article in full, please click here

Read More

USN-5952-1: OpenJPEG vulnerabilities

Read Time:51 Second

Sebastian Poeplau discovered that OpenJPEG incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 18.04
LTS. (CVE-2020-6851, CVE-2020-8112)

It was discovered that OpenJPEG incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2020-15389, CVE-2020-27814, CVE-2020-27823, CVE-2020-27824,
CVE-2020-27841, CVE-2020-27845)

It was discovered that OpenJPEG incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2020-27842, CVE-2020-27843)

Read More

USN-5954-1: Firefox vulnerabilities

Read Time:1 Minute, 0 Second

Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2023-25750,
CVE-2023-25752, CVE-2023-28162, CVE-2023-28176, CVE-2023-28177)

Lukas Bernhard discovered that Firefox did not properly manage memory
when invalidating JIT code while following an iterator. An attacker could
potentially exploits this issue to cause a denial of service.
(CVE-2023-25751)

Rob Wu discovered that Firefox did not properly manage the URLs when
following a redirect to a publicly accessible web extension file. An
attacker could potentially exploits this to obtain sensitive information.
(CVE-2023-28160)

Luan Herrera discovered that Firefox did not properly manage cross-origin
iframe when dragging a URL. An attacker could potentially exploit this
issue to perform spoofing attacks. (CVE-2023-28164)

Khiem Tran discovered that Firefox did not properly manage one-time
permissions granted to a document loaded using a file: URL. An attacker
could potentially exploit this issue to use granted one-time permissions
on the local files came from different sources. (CVE-2023-28161)

Read More

Beyond Identity launches Zero Trust Authentication to align verification with zero-trust principles

Read Time:26 Second

Multifactor authentication (MFA) provider Beyond Identity has announced the launch of Zero Trust Authentication — a sub-category of zero trust security that the firm says aligns verification with zero-trust principles. Zero Trust Authentication has several key features including passwordless capability and phishing resistance that allow businesses to verify the identities of people and devices with zero-trust-level certainty, according to Beyond Trust. Without such enhanced verification capacities, organizations cannot truly implement zero trust security, it said.

To read this article in full, please click here

Read More

10 Ways B2B companies can improve mobile security

Read Time:5 Minute, 50 Second

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

Mobile security refers to the technologies and processes that are used to protect mobile devices from malicious attacks, data breaches, and other forms of cybercrime. It also includes measures taken to safeguard personal information stored on these devices, as well as protecting them from physical damage or theft. Mobile security is becoming increasingly important due to the rapid proliferation of smartphones and tablets being used for business purposes around the world.

Businesses need to take steps to ensure their data remains secure when accessing company networks via mobile devices, including implementing a few key measures. Below are ten ways B2B companies can do better mobile security.

1. Use a secure email provider

A secure domain email address is one of the most important ways to ensure that company emails and other sensitive data remain safe. Email providers such as Google, Microsoft, Zoho, and Postale offer secure domain email addresses which encrypt all emails sent and received in transit. This makes it more difficult for hackers to gain access to confidential information or launch attacks on vulnerable systems.

Using a secure email provider is essential for any organization looking to maximize its data protection efforts. By taking advantage of these services, businesses can rest assured knowing their emails are secure and protected from malicious actors.

2. Implement strong authentication

Strong authentication refers to the use of two or more forms of authentication to authenticate a user’s identity. This could include using a one-time password for each login, biometric factors such as fingerprints, or utilizing an encrypted token. Strong authentication ensures that only authorized users can access company networks and confidential data.

Having strong authentication measures in place is an essential step in protecting data, as it helps to prevent unauthorized access and keeps sensitive information secure.

3. Install mobile security software

Mobile security software (also known as mobile device management or MDM) can help protect devices from malicious attacks. Mobile security software can be installed on all company-owned devices, providing a layer of protection by scanning for and blocking malicious applications. It can also offer additional layers of protection such as remote wiping capability, encryption, and the ability to remotely lock lost or stolen devices.

4. Enforce use policies

By having clear use policies in place, businesses can ensure their employees understand the importance of mobile security and that they are adhering to the established rules. These policies should include restrictions on downloading or installing unapproved apps, accessing unknown or suspicious websites, or sharing confidential information with unauthorized personnel.

Enforcing use policies is essential for keeping company networks and data secure. By ensuring that all employees abide by the same set of rules, businesses can greatly reduce their risk of a data breach or other malicious attack.

5. Utilize cloud storage

Cloud storage provides an effective way to store business data securely off-site. Data stored in the cloud is encrypted and kept safe from physical damage or theft. It also eliminates the need for large servers and other physical infrastructure, reducing both costs and the potential risk of data breaches. Additionally, cloud storage allows employees to access their data from any device, anytime and anywhere.

Utilizing cloud storage is an efficient way to keep sensitive information secure while still providing easy access for authorized users.

6. Use virtual private networks (VPNs)

A virtual private network (VPN) provides an extra layer of security by encrypting all traffic between two devices. This means that even if an unauthorized user were to intercept the data transmitted over the connection, they would be unable to read it due to the encryption. VPNs are especially useful for businesses that need to securely access company networks when using public Wi-Fi or other shared networks.

Using a VPN is an important step in protecting data from malicious attacks, as it ensures that all traffic is securely encrypted and less susceptible to being accessed by unauthorized parties.

7. Educate employees about the latest cybersecurity threats

Even with good policies and procedures in place, your employees still represent a vulnerable point in your data security. That’s why it’s important to regularly educate them about the latest cybersecurity threats and how they can avoid falling victim to them. This could include information on phishing scams, malware infections, mobile device security, and more.

By providing employees with the knowledge needed to recognize potential threats and take the necessary measures to protect themselves and their organization from attackers, businesses can greatly reduce their risk of suffering a data breach or other malicious attack.

8. Use two-factor authentication

Two-factor authentication (2FA) is an extra layer of security that requires users to provide two pieces of evidence when logging into an account or system. Typically, this consists of something that you know (such as a password), and something that you have (such as a mobile device). By requiring two different pieces of evidence, it makes it much more difficult for unauthorized parties to gain access to confidential data.

By implementing 2FA on all accounts and systems, businesses can greatly reduce their risk of suffering a data breach or other malicious attack. Doing so will ensure that only authorized users are able to access sensitive information, which helps keep confidential data always secure.

9. Monitor user activity

User activity monitoring is an important step in protecting your organization from malicious actors. By tracking user activities such as logins, downloads, file transfers and other system changes, businesses can detect suspicious activity in real-time and respond quickly to mitigate any potential damage.

By monitoring user activity on a regular basis, businesses can greatly reduce their risk of suffering a data breach or other malicious attack. Doing so will help ensure that all systems always remain secure and confidential information remains protected from unauthorized access.

10. Regularly back up your data

Backing up your data on a regular basis is an important step in protecting it from malicious actors. By having multiple copies of your files stored in separate locations, you can recover them quickly in the event of a data loss or system failure. This ensures that sensitive data remains safe and secure even if one copy is compromised by an attacker.

Using an automated backup system is a great way to ensure that your data remains protected and secure. Your IT department can set up an automated backup process that regularly creates backups of all company files on an external drive or in the cloud, ensuring that your data will always be available when needed.

Conclusion

By following these ten tips, B2B companies can greatly reduce their risk of suffering a data breach or other malicious attack. By taking the necessary steps to maximize their data protection efforts, businesses can ensure that confidential information remains secure at all times.

Read More