Week Commencing 20th February 2017.
This week the news focuses largely on Cyber Security, what issues businesses have faced, what the government and suppliers are looking to do to help these businesses and advice to help businesses understand what to look out for in regards to cyber security. These BizTech Brief articles summarise the biggest news from the IT industry into one place.
To read my other BizTech Brief articles, click here.
Why businesses need a more enlightened approach to phishing attacks
Raj Samani, chief technology officer for Europe, Middle East and Africa (Emea) at Intel Security, said the widespread practice of making falling for email scams a sackable offence in City firms is simply bad for security.
It is surprisingly easy for fraudsters to concoct highly convincing emails by monitoring the victim’s social media accounts and checking publicly available information about the target company and Samani feels that people need to feel they can report potential incidents to IT security without risking their careers, and each case should be investigated on its own merits, he said.
Psychologists have now identified six psychological tricks that Cyber Criminal’s use to bypass the normal psychological alarms that alert people to suspicious emails. These are:
- Reciprocation
- Scarcity
- Consistency
- Liking
- Authority
- Social Validation
Hundreds of websites vandalized after Brit web host server hacked
Last week on 22nd February hundreds of websites have been defaced by hackers who hijacked a web-hosting server run by UK domain registrar DomainMonster.
The index.php pages on the attacked sites were rapidly vandalized by miscreants late on Tuesday, with 612 domains and sub-domains overwritten within seconds of each other. The server(s) behind that IP address have been successfully attacked in the past, too, in 2016 and 2015.
A group called the National Hackers Agency claimed to be behind the mass defacements.
Microsoft issues critical patches but not for zero days
After missing the monthly security update for 14 February, Microsoft has issued some patches but not for zero-day vulnerabilities despite the availability of exploit code.
A week later than schedule, Microsoft issued via patches via Windows Update to fix vulnerabilities in Adobe Flash for Internet Explorer on Windows 8.1 and later, as well as Edge for Windows 10. But the updates did not include fixes for two vulnerabilities that have publicly disclosed exploit code, and Microsoft told customers not to expect any more security updates until 14 March 2017.
The first zero-day exploits a Windows server message block (SMB) flaw. Proof of concept exploit code was released just days before Microsoft’s scheduled February software update. The second zero-day exploits a Windows graphics library flaw that Google’s Project Zero team went public with on 14 February 2017.
Government is quietly asking suppliers to pick up the tab for cyber security
The government’s new approach to working with cyber security suppliers is bringing a shift in responsibility and risk to the private sector.
Recently, the government set out its views on cyber issues in the energy sector and their relevance to defending the national infrastructure, with the Department for Business, Energy and Industrial Strategy (BEIS) publishing its Civil nuclear cyber security strategy. Ostensibly, the new strategy has a narrow focus on a unique industry, but in fact precedents are being set for every company that works with the public sector – and even for all of the companies in the supply chains of those firms.
The traditionally steady evolution of cyber security measures is becoming less and less acceptable and the government wants to see measurable evidence that action is being taken by suppliers to boost cyber security measures, with the threat of even more active intervention by the authorities if it does not happen.
Leave a Reply