Software is becoming an increasingly pivotal part of modern business and society. In turn, consumers have come to expect instant gratification. This has driven businesses to concentrate on innovation and speed to market. Businesses that can???t keep up with the hyper-competitive market of speed-to-value are falling behind.
But with rapid software deliveries comes increased risk. Businesses are shortening time to market, which, for many, has meant moving from a waterfall approach to a DevOps approach. Security in this model can???t be a gate at the end of the development process, but rather needs to be part of the development process, or ???security as code.??? Security as code is when you move security into the development stage and automate security scans at every code commit. It helps to ensure that security scans aren???t missed, and it shortens deployment times. As the world continues to prioritize speed, security as code will be increasingly critical.
What are the implications of security in the development phase?
By moving security to the development phase and making security scans the responsibility of the developers, it???s not uncommon for developers to raise concerns. They are oftentimes concerned that security scans will add extra work and slow down deployments. But with security as code, you can ease those concerns because the security scans are integrated and automated into the developer???s existing tools and processes. This means there is no interruption to the developer???s day-to-day activities.
That said, it???s still important to provide developers with security training to prevent flaws and aid remediation. According to the Modern Application and Development Security report by Enterprise Strategy Group, 35 percent of organizations reported that less than half of their development teams participate in formal security training. Without this knowledge, flaws will be identified from scans, but they will not be properly remediated, leaving applications vulnerable to attack.
At Veracode, we offer in-person, virtual, and hands-on training to get developers up to speed on securing code and remediating security flaws. With our hands-on training, Veracode Security Labs, developers can work on securing real-world code vulnerabilities in the language of their choice while receiving real-time feedback.
We also encourage organizations to implement a security champions program. Security champions are elected or self-nominated developers with an interest in learning more about security. They receive a higher level of security training than other developers so that they can be the voice of security on their scrum team. They???re essentially the conduit between security professionals and developers.
For a security champions program to be successful, the ???champions??? need to be invited to security meetings ??? including sprint planning ??? on a consistent basis. By including them in these meetings, they can help get their scrum team on board with security initiatives. The program should also be engaging and rewarding for participants. If developers feel like the program is a waste of time, they won???t attend security meetings and they won???t encourage other developers to join.
Data around security as code
Security as code isn???t just presumed to be effective, it is proven effective. According to findings from our recent State of Software Security (SOSS) report, scanning for security via API cuts the time to remediate 50 percent of security flaws by six days. And the faster you remediate security flaws, the fewer opportunities there are for a cyberattack.
The Modern Application and Development Security report also establishes the importance of automating and integrating security scans, citing it as the number one element of effective application security programs.
The bottom line is that speed-to-market is only going to increase, and security as code is ??? and will continue to be ??? the way of the future. To learn more about the current security landscape and recent trends, check out our State of Software Security report.ﾂ?
ﾂ?
According to Risk Based Security’s 2020 Q3 report, around 36 billion records were compromised between January and September 2020. While this result is quite staggering, it also sends a clear message of the need for effective database security measures. Database security measures are a bit different from website security practices. The former involve physical steps, […]… Read More
The post 10 Database Security Best Practices You Should Know appeared first on The State of Security.
Our vulture Iain argues against this week’s motion
Reader debate Welcome to the latest Register Debate in which writers discuss technology topics, and you – the reader – choose the winning argument. The format is simple: a motion was proposed this week, the argument for the motion was published on Wednesday, and the argument against is published today.…
In today’s rapidly evolving cybersecurity landscape, the battle for privacy and security is relentless. Cybercriminals are masters at using technology and psychology to exploit basic human trust and compromise businesses of all sizes. What’s more, they often hide in plain sight, using both covert and overt tactics to cause disruption, steal money and data, and wreak havoc with MSPs and SMBs.
While cybersecurity advice is often focused on technology like endpoint protection, firewalls and anti-virus, it’s important to remember that behind every breach is a human. Knowing who they are and why they target your business is essential to remaining cyber resilient.
As we mentioned in a previous blog, hackers come in many forms, but their methods can generally be classified into three distinct types of cybercriminals:
- The Impersonator – Hackers that pretend to be others, often using social engineering and human psychology to trick users.
- The Opportunist – Hackers that exploit public events and socio-political crises for disruption or personal gain.
- The Infiltrator – Hackers that target specific organizations and work to breach systems using a variety of tools and tactics.
Each one has their own methods and protecting against them requires a multi-layered approach. Let’s look at a few primary examples.
Who is the Impersonator?
An impersonation attack recently made headlines with the 2020 Twitter/Bitcoin scam, in which 130 high-profile Twitter accounts were compromised by outside parties to steal bitcoin. The perpetrators gained access to Twitter’s administrative tools in order to pose as legitimate CEOs and celebrities to trick users into sending bitcoin with the promise of doubling their investment. Unfortunately, attacks like this work, and the hackers received $ 121,000 that was never paid back. This is a scam that’s been around for years and since no one can reverse a cryptocurrency transaction, it’s very likely here to stay.
This type of cybercriminal manipulates victims into opening doors to systems or unwittingly sharing sensitive information by pretending to be someone you would inherently trust. The most notable attack is the “Nigerian prince” email scam, also known as “foreign money exchange” scams. These typically start with an email from someone overseas claiming to be royalty, offering to share a financial opportunity in exchange for your bank account number. Nowadays, you’re more likely to receive an email from your boss’ boss asking for gift cards or money, but these scams are still active in many forms, as the Twitter attack shows.
Impersonators are known to use phishing, Business Email Compromise (BEC) and domain spoofing to lure victims, and they’re always looking for new ways to innovate. In fact, our 2020 Threat Report found that impersonators are now imitating legitimate business websites to release malicious payloads or steal data, and a shocking 27% of phishing sites use HTTPS to trick the user into clicking phishing links, which makes these attacks even more dangerous. It’s easy to assume an official-looking website with an HTTPS address is safe, but hackers can also use HTTPS sites to launch phishing emails and distribute BEC scams as obtaining SSL certificates is trivial now. This is why a multi-layered approach that can block phishing sites (including HTTPS) in real time, is key for staying safe.
What Does the Opportunist Want?
While attacks of opportunity are nothing new, the tactics of the opportunist have gone to a new level with the recent coronavirus pandemic. According to our COVID-19 Clicks report, at least one in three people have fallen for a phishing email in the past year. This year has been all about the pandemic and the fear surrounding it. These phishing attempts often appear in the form of articles about the best ways to avoid coronavirus or links to documents that have lists of people with COVID-19 “in your area.” These documents will ask users to enable an embedded macro that then delivers malware, usually in the form of ransomware. Over 90% of malware campaigns used the pandemic in their initial phishing email this past year.
Opportunists wait for the right opportunity to strike, and just as impersonators take advantage of trust, opportunists also rely on trust and familiarity to deceive users into downloading malicious payloads. Unlike other hackers, however, they don’t have specific victims in mind. The opportunist capitalizes on urgency, fear and unpreparedness to catch as many victims in their net as possible.
As we point out in a popular Hacker Personas podcast, other opportunist attacks like those exploiting U.S. government stimulus payments are also on the rise. Business leaders in particular should watch out for these tactics, as phishing emails can compromise company devices. With the increase of remote workers using unsecured systems and personal devices to access corporate networks, all businesses are at risk from opportunists who bait remote employees.
How Do Infiltrators Breach Systems?
One of the best examples of an infiltration attack is the 2020 SolarWinds breach, in which a foreign state hacked the SolarWinds supply chain to infiltrate at least 18,000 government and private networks including over 425 of the fortune 500. Nation-state hackers took advantage of SUNSPOT malware to insert the SUNBURST backdoor into software builds of the Orion platform, and unbeknownst to SolarWinds developers, they released it as a normal update to their customers. Several significant US agencies, including parts of the Pentagon, the Department of Homeland Security, the State Department, the Department of Energy, the National Nuclear Security Administration, and the Treasury were attacked. What’s more, the fallout of this attack is still ongoing and we may never know the full damage.
The Infiltrator is the opposite of an opportunist in that they target specific victims and have a clear-cut approach to getting what they want. Rather than casting a wide net and hoping for the best, they usually know the system they want to infiltrate, and they use stealthy measures to breach systems, often coming away with a large payout in the form of a costly ransom to criminal enterprises or valuable intel to nation states.
What Steps Should MSPs and SMBs Take to Stay Cyber Resilient?
If knowing your enemy is the first step to protecting your business, the next step is to develop a strong cyber resilience posture that protects against their attacks. Part of that is understanding that cyberattacks are often a matter of “when, not if.” Even if you’re not the target of an infiltrator, for example, your business or employees may be the unknowing victims of an opportunist or impersonator.
Protecting your business includes:
- Implementing a multi-layered cybersecurity approach that includes complete endpoint protection, firewalls, real time anti-phishing as well as Security Awareness Training
- Continuously educating and training employees, staff and customers to follow cybersecurity best practices and to stay up to date on cyberattack news
- Using a backup and recovery solution that can restore critical files after an attack and keep the business up and running during a crisis.
To learn more about hacker personas and strategies to protect against their various attacks, check out our eBook, Hacker Personas: A Deeper Look Into Cybercrime. You can also follow our Hacker Files and Lockdown Lessons series that include a variety of guides, podcasts and webinars covering these topics and more.
The post Hacker Personas Explained: Know Your Enemy and Protect Your Business appeared first on Webroot Blog.
Most people would categorically agree that increased privacy online is a good thing. But in practice, questions of privacy online are a bit more complex. In recent months, you’ve likely heard about DNS over HTTPS, also known as DNS 2.0 and DoH, which is a method that uses the HTTPS protocol to encrypt DNS requests, shielding their contents from malicious actors and others who might misuse such information. It can even address several DNS-enabled cyberattack methods, such as DNS spoofing or hijacking. On the other hand, obfuscating the content of DNS requests can also reduce admins’ visibility and control, as well as negatively affect business network security.
Ultimately, this DNS privacy upgrade has been a long time coming. While its creators’ original 1983 design has undoubtedly proven itself by scaling to meet the demands of today’s internet, privacy just wasn’t a consideration 38 years ago; thus, the need for DoH.
“Privacy just wasn’t a consideration 38 years ago; thus, the need for DoH.”
When weighing the obvious privacy and security benefits against the visibility and potential security drawbacks, some businesses are having difficulty managing these new protocols. That’s likely why the NSA recently released a guide that not only explains the need for DoH, it strongly recommends that businesses protect their networks from rogue DNS sources to improve their network security. But what their guide doesn’t really focus on is how.
Correctly managing encrypted DNS can be very challenging. According to Jonathan Barnett, Webroot sr. product manager and DNS security expert, here’s what businesses need to know about the NSA’s guide and how to successfully embrace DoH.
What does the NSA guide recommend?
The NSA supports the privacy and security improvements DoH provides. However, they also recommend that DNS be controlled, which may leave some admins scratching their heads.
“The enterprise resolver should support encrypted DNS requests, such as DoH, for local privacy and integrity protections, but all other encrypted DNS resolvers should be disabled and blocked.”
What does the NSA caution against?
The NSA specifically warns about applications that can make DNS requests for themselves. Previously, if an application needed DNS, it would ask the local system for the resolution, ideally following whatever configuration the admin had set. These requests would then be sent to the network DNS resolver. This process provides a wealth of information to the network, helping with visibility in the case of a malware attack, or even in the event of a user accidentally clicking a phishing link.
With DNS encryption like DoH, this visibility not only disappears, but now DNS itself becomes incredibly difficult to control. The real challenge comes in as DoH hides the DNS requests using SSL, just as your web browser does when connecting to your online banking website. With this method, DNS requests appear as regular website traffic to most firewalls and networks, and can’t be identified by them as legitimate or malicious.
What other challenges should I consider?
DoH is fairly early in its adoption and only a few applications currently use it, though adoption will continue to grow. In North America, Mozilla Firefox uses DoH for DNS resolution by default. Other browsers, such as Google Chrome and Microsoft Edge have also begun to support DoH, though their default behavior will not enable DoH on most business networks.
Worth noting is that Microsoft itself has yet to support DoH on their DNS servers, so enforcing the NSA’s recommendations may be somewhat difficult. Additionally, as DoH traffic runs on port 443, just like a secure connection to a website, it is not easily regulated or blocked. You can’t just block port 443 at your firewall either, as this action would also block all secure websites. You could block some of the known DoH providers, but as with any new technology solution, more DoH resolvers appear daily.
How does Webroot address security with DoH?
The Webroot® DNS Protection agent already secures DNS requests by using DoH for all of its communications and leverages the power of Webroot BrightCloud® Threat Intelligence to identify and block alternate DoH connections. Our DNS Protection solution also includes an option to echo all DNS requests to your local resolver, so it maintains visibility into the DNS requests being made, leaving intact the powerful information provided by DNS.
Essentially, with a solution that works like Webroot DNS Protection, you still get the power of DNS filtering while also benefitting from DoH encryption. This protection secures remote and on-site users, devices, and networks, effectively fulfilling the NSA’s recommendations.
The post The NSA Wants Businesses to Use DoH. Here’s What You Need to Know. appeared first on Webroot Blog.