This blog was written by an independent guest blogger.

I was logging into one of my favorite online shopping sites the other day, and, as with all my other sites, I was presented with the multi-factor authentication prompt to complete the login process.  Anyone who knows me, knows that I have been a long-time supporter of multi-factor, or 2-step verification of any kind. 

The only problem I had with the login on this occasion, was that my phone was dead.  Like most folks, my phone contains the authenticator applications that allow me to log into most of the sites that do not allow the use of a FIDO hardware token.   This created an unusual conundrum, whereas, not only does my phone contain the authenticator application, but the only backup method the site offers is to send a text message to a registered phone number if the authenticator application is unavailable.   The problem is that the registered phone number is attached to the same dead phone that contains the authenticator application.

Usually, this is not a problem, as most sites that have fully thought through their implementation of multi-factor authentication have also considered the problem of the lost, or otherwise non-functioning phone, and they issue one-time codes when the 2FA process is first enabled.  These codes can be stored in a safe place.

Recently, when Google announced to a select group of GMail users that their mail account will be forced to use multi-factor authentication, many people protested.  While I can understand the shock that many felt at the imposition of an unsolicited change to the login process, I commended the fact that steps were being taken to protect these vulnerable accounts.  Google also did everything right, that is, they gave people multiple options to verify the log in process, including one-time backup codes to be used if the authenticating device is unavailable.

Many people who dislike multi-factor will lament at the thought of also having to store what amounts to other passwords, as one-time codes can arguably be thought of as just another password.  This is where a password manager can serve double-duty to assist the password-weary.

Most password managers offer text fields that often go ignored and unused. However, that big open space can be used to store a ton of useful information.  For example, the one-time codes can be stored there, in addition to the random answers to the common security questions asked by many sites.

None of what I am positing here should be misinterpreted to think that I am against multi-factor authentication in any way.  Until passwordless technology replaces the current methods, I will remain committed to supporting 2FA as the best method we have right now.  In the meantime, the problem that needs to be addressed is how to get more sites to fully realize their multi-factor implementations, and offer one-time codes along with whatever other methods they use for their enhanced security options.  One has to wonder why this was overlooked in the first place?  Until these solutions are established, I suppose I need to be more diligent about keeping my phone charged.  Happy shopping!

Read More

For years, “The Spine Collector” has been haunting publishers around the world, attempting to steal manuscripts by famous authors.

Read more in my article on the Hot for Security blog.

Read More

Security researchers say they have seen a “massive wave” of hackers exploiting the comment feature in Google Docs to spread malicious content into the inboxes of unsuspecting targeted users.

Read more in my article on the Tripwire State of Security blog.

Read More

The internet’s greatest feat? Fundamentally shifting how we live. Once a revelation, it quickly set our long-standing beliefs about how we work, play, and connect into a whole new context. 

Today, the shifts come fast. Video meetings once felt alien. Now, they’re part of our routine. We’ve gone from setting doctor’s appointments online to actually seeing the doctor online—and from family visits to seeing everyone in seconds on a screen.  

At McAfee, we’ve seen our share of shifts as well. Looking back across our thirty-plus years, we were among the first to deliver antivirus technology. First to create a biometric password manager. First to give people an intuitive Protection Score, and so much more. And we’re not stopping. We’re protecting people and their ever-changing lives. That means covering all your life online, from security to privacy to identity, in a way that adds to your confidence and enjoyment too. 

Confidence and enjoyment. Those two words mark our next shift in online protection. We’re bringing those feelings to life across the McAfee experience. And it’ll redefine the way you stay safe online.  

Safety has an unmistakable feeling. As we bring that feeling to online protection, you’ll see a remarkable evolution. It will look and act in bold new ways, guide you, reassure you, and most importantly, keep you safe. In all, it’s a new breed of online protection that’s helpful, even thoughtful, in the ways it looks out for you. 

And this evolution is already underway. You’ll find that feeling in everyday moments as we make them simpler, freer, and safer—such as paying your bills at a coffee shop, managing your family’s healthcare from your laptop, and booking flights to catch up with old friends. Across them all, our protection will have your back, and even offer guidance when needed, all while you do you—wherever your day takes you and no matter what “online” looks like next. 

There’s simply so much to see out there. And with us by your side, you’ll feel safe and stay that way. Life online will continue to surprise us. In the best of ways. And people have a right to enjoy every moment of it, confident that they’re safe and secure, in ways they can point to and feel.  

That’s our next big shift. Giving you the unmistakable feeling of safety. You deserve it. More than that, it’s your right. And we’re proud to bring it to you. 

The post The Feeling of Safety appeared first on McAfee Blogs.

Read More

This blog was written by an independent guest blogger.

Online transactions are essential for every modern business. From online shopping to banking, transferring funds, and sending invoices, online transactions ensure utter convenience and efficiency.

However, the familiarity of making financial transactions online can make people forget about security and all the dangers that they may be facing. On top of that, new cybersecurity threats keep popping up constantly.

That’s why it’s crucial to have a robust IT security strategy in place.

How safe are your company’s online transactions?

Source; Pexels

From hardware or software issues and hidden backdoor programs to vulnerable process controls, weak passwords, and other human errors, many problems can put your transactions at risk and leave the door open to cybercriminals.

Did you know that human error is the main culprit of 95% of data breaches? Many people still don’t realize the dangers of phishing, malware, ransomware, unpatched software, and weak passwords. They could expose your sensitive data and put you, your employees, clients, and customers at risk of identity theft and fraud.

Believe it or not, pay stubs are among the most common vulnerabilities because many companies don’t store them carefully, risking theft of their employee data and confidential files.

That’s why savvy businesses have started using online generators for making stubs. With a paystub generator, you can create and store your pay stubs online, so you don’t have to keep them in your system, preventing cybercriminals from gaining access to your sensitive data.

No cybersecurity experts

Cybersecurity is a complex issue that requires comprehensive knowledge. Sadly, most companies don’t hire any cybersecurity experts. What they don’t realize is that they could be supercharging their productivity.

What can a business do to improve its productivity?

By putting experts in charge of  cybersecurity, companies can keep other employees productive. They can work with up-to-date  technology, reduce their workload, work  smarter, and improve their performance.

A cybersecurity team can even train your employees and teach them how to identify and avoid threats. This way, your employees won’t make security mistakes, and can focus on their core competencies.

How to protect your transactions

Given that the average cost of a data breach is $3.86 million, implementing proper security measures  to protect your transactions is a no-brainer. Here are some of the best ways to do so.

Use a Secure Sockets Layer

Secure Sockets Layer (SSL) is a standard security protocol that encrypts the connection between a web browser and a server. It prevents a third party from intercepting the data that is exchanged between the two.

This is especially  beneficial for financial transactions as all the data, including credit card information, remains private. .

An SSL certificate is beneficial  for your SEO as well, since Google uses HTTPS as a ranking signal.

To secure your transactions with an SSL certificate, you need to purchase the right one for your business and install it on your server with the help of your web host manager. This only takes a few clicks, because an SSL certificate is a text file with encrypted data.

Implement multi-layered protection

A multi-layered security approach is a defense mechanism for cybersecurity protection. It’s about  implementing multiple components to protect your entire IT infrastructure.

If a potential hacker finds a loophole and tries to break into your system, they will be prevented from doing so by another layer of security. .

Some of the most important security layers include the network (IP and ICMP), the application (e.g., HTTPS and DNS), data link (e.g., Ethernet and MAC), the session (WEB sockets), transport (SSL, TCP, and UDP), perimeter (firewalls), and physical layers (securing endpoint devices).

Avoid storing payment data from your customers

If you store payment details from your customers, a potential data breach could expose their personal and sensitive information. This could severely damage your company’s reputation.

So, once a customer completes a purchase, make sure there are no logs of their financial information

If you want to ensure a seamless shopping experience by allowing your customers to save payment details for future purchases, you should use a reliable e-commerce platform and a secure payment processor. This will  help you detect and prevent potential cyberattacks.

Use data encryption

Data encryption is the key to keeping sensitive data private. It ensures integrity, authentication, and non-repudiation.

There are three main types of data encryption:

3DES (Triple Data Encryption Standard) — 3DES uses three 56-bit keys to encrypt data, but it takes a long time. Its predecessor, DES (Data Encryption Standard), is no longer secure  on its own.
AES (Advanced Encryption Standard) — AES is the best and most widely-used type which uses symmetric key encryption where only one key can encrypt and decrypt data. It’s the most secure method you can use.
RSA (Rivest-Shamir-Adleman) — RSA uses an asymmetric key encryption (one public key to encrypt data and one private key to decrypt). This is time-consuming but great for verifying digital signatures.

Consider tokenization

Tokenization involves replacing sensitive data, such as credit card numbers, with random strings of characters (tokens) that have no meaningful value. If a hacker were to steal tokenized data, they could not exploit it.

Furthermore, tokenization removes the original data from the system and serves only as a reference. That’s quite different from data encryption, where the data is preserved but can only be accessed with the right key.

Use electronic signatures

Like data encryption, electronic signatures ensure integrity, authentication, and unforgeability.

They also increase security and speed up transactions by enabling the authentication of  electronic documents and online forms in seconds.

Create a verification process

Verifying accounts, addresses, and transactions helps  you prevent identity theft and fraud.

An AVS (Address Verification Service) can help you verify your customers’ billing addresses. At the same time, a card security code (a CVV number) is the best way to verify bank accounts and transactions.

Don’t forget to enable 2FA (Two-Factor Authentication) and MFA (Multi-Factor Authentication), which are among the best ways to secure user authentication protocols. They provide additional protection for the login process, and effectively prevent fraudulent login attempts.

Conclusion

These are the most proven methods to keep your online transactions and company information private, but you should consider other security tips, too.

Don’t forget to comply with the PCI DSS before you start accepting online payments. This way you can eliminate any vulnerabilities beforehand and ensure that your customers’ data remains safe and secure.

Read More