Internal attackers account to be 43 percent of data breach !!!

Although companies are always at risk for data security threats from the external hackers, employee activities cause a fair share of data breaches, too; simply cause people within the organizations do not understand the consequences of their erroneous actions or habit related to their company systems or critical data is alike if not excessive risk. 

Every person within their organization has an access to some or the other company information which causes unauthorized release of data from within network. It is also seen that, although companies have protocols in place to prevent data breaches, many employees often break company policy. 53% of companies said employees use company-issued devices to send business-related information to personal email and cloud-based file-sharing accounts, such as Gmail and DropBox.

And for this reason, proper education for all the members of the organisation that encourages IT security safety is extremely important. Investing in security awareness sessions, professional development & trainings for existing staff can help to boost security. For anyone to stay ahead of hackers, people need to be up-to-date on this front.

Hackers will always be out there, adapting to the newest & most multifarious technology to set their targets. To counteract data breaches, we need to first work on the root cause of the problem i.e. invest in security and more emphasize the importance of education. 

What do you think on this? Where to start with?

Take the below easy steps and there you are:

1) Awareness sessions about how a hacker can get in and poach your sensitive data

On an average, employees are aware of most likely keywords - virus, firewalls, malware, ransomware, cyberattacks, threats - but here again what does it all means has to explained to them at a basic level along with the consequences of the same. More highlighted area would be on how an external attacker can use them to get access to the company data.   

2) Improvising employees erroneous actions

IT practices, protocols & polices could be well defined & handed over to the employees on the initial front itself. Very high chances, that won't come up with a surprise to you is of people violating these rules & policies set. For e.g.: Strict NO for attaching company files to any personal emails, uploading company files to cloud based sharing accounts, transferring data on non-encrypted USB's, etc. 

For this yearly security awareness training & recapping sessions should be done as a part of company approach.  

3) To lead people, walk besides them

By walking your talk, you become a person others want to follow. When leaders say one thing, but do another, they erode trust--a critical element of productive leadership. 

As we all know, mostly management scares their employees into following policies but sometimes they tend to ignore it by themselves. The major turning issue here could be that if a manager violates a company policy while interacting with their employees, higher chances of employees do following the same path at their time of action. Showing employees that their concerns are a part of the IT security strategy is important because it diminishes the feeling that the policies are implemented to restrict them.

General things to be undertake would be likely:

• Elect who can access various systems and easily turn off someone’s access when it’s no longer needed.

• Regular password changes for highly sensitive accounts.

• Frequently rotate passwords to prevent brute-force or offline cracking attacks.

• Administer OTP's that will expire after a set period of time.

• Require users to present multiple types of authentication (two factor authentication) when logging into certain accounts.

Your mind is a storage room full of information, keep the door locked.
 THINK before you CLICK, CONNECT & DOWNLOAD 

Another data breach that catches the eyeballs this week is LinkedIn's Lynda.com

Though the passwords were more or less secure, but the training site isn't taking any risk.

Many of us would want to check our Lynda account on LinkedIn, whether we have one, & as it is in broadcast that it has been penetrated or something.

Less than a week after Yahoo confirmed a second data breach affecting nearly one billion users, another online social network has been targeted by hackers.

LinkedIn bought Lynda.com in April last year in a cash and stock deal valued at approximately $1.5 billion.
In June, LinkedIn was acquired by Microsoft in an all-cash transaction worth $26.2 billion.

In September, LinkedIn publicized the LinkedIn learning availability, which was a combination of Microsoft's resources with Lynda.com's content and LinkedIn's massive trove of professional and networking data.

LinkedIn's training site - Lynda.com is notifying users of a database breach that includes the passwords of just under 55,000 accounts — is the latest hack attack victim, although with a much lower number of affected victims.

During this, LinkedIn began notifying Lynda.com's 9.5 million users that an unauthorized third party had recently access a database containing customer information, their learning data & courses information.

“We are informing you of this issue out of an abundance of caution, while we have no evidence that your specific account was accessed or that any data has been made publicly available, we wanted to notify you as a precautionary measure" Lynda.com said in a notice to users.

Google Accounts Hacked !! More than a million...

The security research team of Check Point revealed that a new Android malware, dubbed as Gooligan, breached security of more than a million Google accounts and the number is increasing by 13000 every day.

The malware roots infect devices and steals authentication tokens stored on them. The hackers then are able to access data from Google Play, Gmail, Google Photos, Google Docs, G Suite, Google Drive, and more.

This malware, Gooligan, mostly affects devices on Android 4 and 5. It is found that the fake applications looked apparently legitimate and once downloaded and installed by an Android user, the malware will start sending the stolen data from the user’s devices to its Command and Control (C&C) server.

Gooligan then downloads a rootkit from the C&C server that takes advantage of multiple Android 4 and 5 exploits including the well-known VROOT (CVE-2013-6282) and Towelroot (CVE-2014-3153), report the researchers.

This module injects code into running Google Play or GMS (Google Mobile Services) to mimic user behaviour so that Gooligan can avoid detection. The module allows Gooligan to:

1) Steal a user’s Google email account and authentication token information. 

2) Install apps from Google Play and rate them to raise their reputation

3) Install adware to generate revenue

An online web tool,  https://gooligan.checkpoint.com/ --  has been created by Check Point to check if your Android device has been infected with Gooligan virus.  To find this, after opening “Gooligan Checker”, just enter google email ID.  If the device shows infected, you are recommended to run a clean installation of the operating system, by a certified technician or mobile service provider, on your Android device.

San Francisco Metro System hacked with Ransomware

The San Francisco Municipal Transport Agency (SFMTA) said “on Nov. 25, the SFMTA was a victim of a ransomware attack,” and “the situation is now contained, and we have prioritized restoring our systems to be fully operational.” More than 2000 computer and payment systems were affected. According to the San Francisco Examiner, SFMTA confirmed a Ransomware attack against the station fare systems, causing to shut down of ticket kiosks and make rides free this weekend. Nearly 30 GB of sensitive data, including databases and employee information were under threat.

On the screen of SFMTA computer system, the message displayed was “You Hacked, ALL Data Encrypted. Contact For Key(cryptom27[@]yandex.com)ID:681, Enter”.

The attackers purportedly used the ransomware HDDCryptor, also known as Mamba, to carry out the attack. The ransomware is unique, in the sense that it encrypts a target’s hard drive rather than individual files.

The target machine is typically infected by accidentally opening a malicious executable in an email or download, and then the malware spreads out across the network.

The attackers were demanding a ransom of roughly $73,000 to restore the SFMTA computer system.

In an email exchange the attacker wrote: “We Don’t live in USA but I hope Company Try to Fix it Correctly and We Can Advise Them But if they Don’t , We Will Publish 30G Databases and Documents include contracts , employees data , LLD Plans , customers and… to Have More Impact to Company To Force Them to do Right Job!”

The spokesperson of SFMTA, Paul Rose, denied the allegations of attackers, and told that customer privacy and transaction information were in order. He further said that “we have never considered paying ransom and don’t intend to”. He also said that they are investigating the matter and "working to resolve the situation,"

The identity of hackers and the extent at which the threat happened are all a secret at present.  But the everyday instances remind us as to how far vulnerable our infrastructure is.