Cybersecurity

DNS Cache poisoning: What every SMB must know

DNS Cache poisoning: What every SMB must know In one of the most common poisoning attacks, the attacker poisons the DNS Cache with the aim of leading visitors to a fake website. In a DNS cache poisoning case, the attacker gains control of the DNS server and then manipulates cache data such that anyone typing the URL of the actual website is redirected to the fake one. This could be a phishing site where the attacker would have carefully laid out a trap to capture the unsuspecting victim’s personal data or secure information. For example, the visitor thinks they are logging into their bank’s website online, but are actually on the attacker’s phishing site, where they enter the login credentials. Protecting yourself against DNS poison attacks Here are some ways to protect yourself and your customers from becoming victims of DNS poison attacks. As discussed before, one of the most common poisoning attacks is the DNS attacks. Cybercriminals try to corrupt your DNS server using theirs. You can prevent this by bringing a trained professional onboard for your DNS server set-up. An expert will know to set up your DNS server such that it has a minimum relationship with other, external DNS servers, thus limiting your attacker’s ability to corrupt your DNS server using theirs. As a best practice, ensure that your DNS servers only store data related to your domain and not any other information. It is harder to corrupt the system when it focuses on a single element. Another best practice is to ensure that you are up-to-date on all DNS security mechanisms and are using the most recent version of the DNS. Ensure your site has, in layman terms, an SSL certificate and make sure it is HTTPS. Using encryption, a site with HTTPS protocol allows for a more secure connection between its server and the internet and is better at keeping cybercriminals out. Having an SSL certificate also ensures your site’s name shows up alongside the URL in the address bar. This is an easy way for visitors to identify if they are on a genuine site or not, thus helping them steer clear of phishing attacks and clone sites. Data poisoning is one of the lesser-known and hence less talked about forms of cybercrime. But, it can inflict great damage–perhaps even more damage than the other obvious threats such as viruses and ransomware, because, unlike a Denial of Service (DoS) attack or a Ransomware attack where you know the moment the malware has hit your system, in a data poisoning attack, the malware is incorrect data that slithers into your system quietly like a snake and changes its overall functioning before delivering the big blow.

Cybersecurity

Protecting yourself against poison attacks

Protecting yourself against poison attacks Data poisoning by way of logic corruption, data manipulation and data injection happen when the attacker finds a way to access your data set. The kind of poison attack varies depending on the level of access the attacker is able to achieve Here’s what you can do to ensure such access is prevented. The data poisoning attacks discussed above adversely affect your IT system’s machine learning capabilities. So, the first logical step would be to invest in a good machine learning malware detection tool. These tools are different from the typical anti-malware tools you get in the market and are specifically designed to prevent machine learning capability poisoning. Always follow general IT security best practices such as- Training your employees to identify spam, phishing attempts, and possible malware attacks Following good password hygiene, which means never sharing passwords and only using passwords that meet the required security standards Having a powerful IT audit process, tracking and version control tools, so as to thwart any possible insider attacks Ensuring the physical security of your IT systems by way of biometric access, CCTV systems, etc., Whether it is data poisoning or a malware attack, you certainly don’t have the time to look into all the security aspects yourself. Even if you happen to have an in-house IT team, this 24/7 monitoring may be too much for them to handle as you grow. Consider bringing a reputed MSP on board to help you with this, so you can focus on your business, worry-free, while they ensure your data is safe.

Cybersecurity

Poison Attacks: A quick overview

Poison Attacks: A quick overview Smart technology is everywhere. Not just in our offices, but even in our day-to-day lives with tools like Google Home and Alexa becoming a commonplace. With technology becoming smarter every minute, the risks are increasing by the minute as well. Cybercriminals are finding new ways to corrupt our IT networks to disrupt our businesses, hold our data hostage and even clear our personal bank accounts. Some of the more overt, commonly known acts of cybercrime include hacking, phishing, and ransomware attacks. This blog discusses a lesser-known cybercrime–Poison attacks. What are Poison attacks Poison attacks are attacks on the ability of the system to make smart decisions. Think about this. How do systems make intelligent decisions? Based on the training or data they receive. This data is used to hone the artificial intelligence of the system to help make smart decisions. Poison attacks mess the very base–the training data set. Poison attacks basically skew the system’s data model in such a way that the output is no longer as intended. They create a new normal for everything. Poison attacks are primarily backdoor attacks. In a backdoor poison attack, the attacker creates a loophole in the core data rule and trains the system to adhere to that rule so it can be exploited at a later time. For example, let’s say, the access control for a particular file is set such that it will allow only those beyond the VP level to view the data. If someone changes the main parameter to include manager level in there, the core data set is violated and the system will not detect an intrusion by someone at the manager level, even if they log in with their credentials. Unlike Ransomware, poison attacks don’t make much noise but cause far more damage as they can go undetected for a longer time. Follow our blog next week as we discuss the 3 common types of poison attacks Watch out for these poison attacks! Poison hamper the ability of the system to make smart decisions by disturbing the very core data set that is used to make a decision. Poison attack methodologies typically fall into one of the following 3 categories. Logic corruption Data manipulation Data injection Logic corruption In logic corruption, the attacker changes the basic logic used to make the system arrive at the output. It essentially changes the way the system learns, applies new rules and corrupts the system to do whatever the attacker wants. Data manipulation In data manipulation, as the name suggests, the attacker manipulates the data to extend data boundaries that result in backdoor entries that can be exploited later. Unlike logic corruption, the attacker doesn’t have access to the logic, so they work with the existing rule and push data boundaries further with a view to accommodate them later. Data injection In data injection, the attacker inserts fake data into the actual data set to skew the data model and ultimately weaken the outcome. The weakened outcome then serves as an easy entryway for the attacker into the victim’s system.

Cybersecurity Employee Training

Employee training and Cybersecurity

Employee training & Cybersecurity Employee training will form a big part of the cybersecurity initiative that you will take on as an organization. You need to train your employees to identify and respond correctly to cyberthreats. Here are some employee training best practices that you can make a part of your cybersecurity training program. Create an IT policy handbook Make sure you have a handbook of your IT policy that you share with every new employee, regardless of their position in the company. This IT policy handbook must be provided to everyone–right from the CEO to the newest intern in your organization. Also, ensure this handbook is consistently updated. IT is evolving at great speed and your handbook must keep up Make cybersecurity training a part of your official training initiatives Cybersecurity training should be a part of your corporate training initiatives for all new employees. You can also conduct refresher sessions once in a while to ensure your existing employees are up-to-date on the latest cyberthreats. At the end of the training session, conduct tests, mock drills, certification exams. Good training includes assessment. Provide follow up training for those who need it. This strong emphasis on training will ensure your employees take cybersecurity seriously. Day zero alerts As discussed, the cybercrime landscape is constantly evolving. Every day, cybercriminals are finding new vulnerabilities to exploit, and new methods to steal your data or to hack into your system. Day zero alerts are a great way to keep your employees updated. Has a new security threat been discovered or an important plug-in released for the optimal functioning of a browser? Send an email to everyone spelling out clearly what the threat is and what they can do to mitigate it. Then, follow up to verify they took the necessary steps. Transparency Let your employees know who to contact in the event of any IT related challenges. This is important because someone troubleshooting on the internet for a solution to something as simple as a zipping up a file could end up downloading malware accidentally. Considering the serious ramifications brought on by cybercrime attacks, it makes sense for organizations to strengthen their first line of defense against cybercriminals–their own employees.

Cybersecurity Policies

Strengthening your cybersecurity policies

Strengthening your cybersecurity policies Formulating strong IT policies and laying down the best practices for your staff to follow is one of the best ways to prevent your business from becoming a victim of cybercrime. In this blog, we explore the various areas your IT policy should ideally cover. Passwords: Your IT policy should cover Rules regarding password setting Password best practices The implications of password sharing Corrective actions that will be taken in the event the password policy is not followed Personal devices Rules regarding the usage of personal devices at work or for work purposes. Answer questions like Are all employees allowed to use personal devices for work or do you want to limit it to those handling lesser sensitive data, or to those at higher in the corporate hierarchy as you assume they will need to be available 24/7? Regardless, you should spell out the regulations that they must follow. For example, requiring a weekly or monthly check for malware and updates to anti-malware software, etc., If only certain kinds of devices, software or operating systems may be approved as they are presumed to be more secure, then that should be addressed in the policy Discuss best practices and educate your employees on the risks related to connecting to open internet connections (Free WiFi) such as the ones offered at malls or airports. Cybersecurity measures Document the cybersecurity measures that you have in place for your business. This should include your digital measures such as the software you have deployed to keep malware out–like anti-virus tools, firewalls, etc., and also the physical measures such as CCTV systems, biometric access controls, etc., Another example of a good practice is how you handle employee turnover. When someone quits your organization or has changed positions, how is the access issue addressed? Spell out the rules and regulations regarding the removal of a user from the network, changing passwords, limiting access, etc.,

Cybersecurity Security the Cloud

Is the Cloud really risk-free?

Is the Cloud really risk-free? The Cloud presents plenty of benefits that make it a very attractive choice, especially for SMBs who don’t want to be burdened with higher in-house IT costs, putting your data in the Cloud is not risk-free. Just as storing data on physical servers has its security threats, the Cloud presents certain security concerns as well. These include Data breach: A data breach is when your data is accessed by someone who is not authorized to do so. Data loss: A data loss is a situation where your data in the Cloud is destroyed due to certain circumstances such as technological failure or neglect during any stage of data processing or storage. Account hijacking: Like traditional servers, data in the Cloud could be stolen through account hijacking as well. In fact, Cloud account hijacking is predominantly deployed in cybercrimes that require entail identity thefts and wrongful impersonation Service traffic hijacking: In a service traffic hijacking, your attacker first gains access to your credentials, uses it to understand the online activities that happen in your domain and then uses the information to mislead your users or domain visitors to malicious sites. Insecure application program interfaces (APIs): Sometimes, Cloud APIs, when opened up to third parties, can be a huge security threat. If the API keys are not properly secured, it can serve as an entry point for cybercriminals and malicious elements. Poor choice of Cloud storage providers: A security lapse from the Cloud storage provider’s end is a huge security concern for businesses. It is very important to choose a trusted and experienced Cloud service provider who knows what they are doing. Apart from the above, there are some common threats that apply to both the Cloud and traditional data storage environments such as a DDoS attack, or a malware attack where your data in the Cloud becomes susceptible because it is being shared with others and at other places. Some Cloud security mechanisms that SMBs can invest in to keep their data safe Cloud firewalls: Much like the firewalls you deploy for your local IT network, Cloud firewalls work to prevent unauthorized Cloud network access. Penetration testing: Penetration testing is a sort of a Cloud security check where IT experts try hacking into the Cloud network to figure out if there are any security lapses or vulnerabilities that could serve cybercriminals. Obfuscation: In obfuscation, the data or program code is obscured on purpose such that the system delivers unclear code to anyone other than the original programmer, thus mitigating any malicious activity. Tokenization: Tokenization is the process of replacing sensitive data with unique identification symbols that retain all the essential information about the data without compromising its security.1 Virtual Private Networks (VPN): Another, more commonly used mechanism is the VPN. VPN creates a safe passage for data over the Cloud through end-to-end encryption methodology. Investing in a good Cloud security system is a must, but, in the end, you also need to remember that Cloud security is not only about antivirus software, firewalls, and other anti-malware tools. You need to pick the right MSP and work closely with them to implement a Cloud security solution that works for you. 1https://searchsecurity.techtarget.com/definition/tokenization

Budgeting Cybersecurity Policies Productivity ROI Security the Cloud

Things to consider before switching to the Cloud

Things to consider before switching to the Cloud More and more businesses are switching to the Cloud to store their data and rightly so. The Cloud offers numerous benefits over the traditional, physical on site server. For example, Anytime, anywhere access to your data: Information in the Cloud can be accessed from anywhere using an internet connection, unlike in the case of traditional servers, where you need a physical connection to the servers Significant cost savings: You cut hardware costs, because the Cloud follows a ‘pay-as-you-use’ approach to data storage SaaS compatibility and support: The Cloud allows the use of Software-as-a-Service since the software can be hosted in the Cloud Scalability: The Cloud lets you scale up and down as your business needs change 24/7 monitoring, support, and greater access reliability: When your data is in the Cloud, the Cloud service provider is responsible for keeping it safe and ensuring it is securely accessible at all times. They monitor the Cloud’s performance and in the event of any performance issues, they provide immediate tech support to resolve the problem Your big Cloud move: What to consider If you are considering moving to the Cloud, you will find it helpful to sign-up with an MSP who is well-versed with the Cloud. They can advise you on the benefits and risks of the Cloud and also offer the Cloud solution that’s right for you. In any case, before you migrate to the Cloud, make sure you are dealing with a reputed Cloud service provider who has strong data security measures in place. You can even explicitly ask them what security mechanisms they have invested in to manage data access and security. Yes, moving to the Cloud has it benefits, but it also has its challenges including security risks. Learn more in our next blog, “Is the Cloud really risk-free?”

Sep 17

Cybersecurity Dark Web

A short guide to mitigating the risk of the dark web

The dark web is a nefarious place, where criminals lurk and communicate, buy, sell, plot, and plunder. The clue, of course, is in the name. Speaking to NBC, FBI Supervisory Special Agent Mark Knoll referred to it as “like your new drug dealer on the corner in the virtual world.” READ MORE

Jul 11

Cybersecurity Printing

Save your unprotected printers from dangerous printer pranks

When printers around the world began spewing silly messages urging recipients to subscribe to a YouTube channel a few weeks ago, many considered the incident a joke. But while social media users laughed off the prank, trading stories and photos of their home and office equipment’s absurd printouts, IT pros came to a chilling realization. READ MORE

Cybersecurity Wi-Fi

10 Wi-Fi security tips

Wireless networking can be kind of scary from a security standpoint. It opens up whole new attack vectors that were not present with wired network infrastructures. That doesn’t mean you can’t do it securely, however, and I aim to give you some ideas that can help you in that regard. READ MORE

Archives

Provide comprehensive and innovative solutions.Empower our customer partners to achieve their business goals.Leverage cutting-edge tech and best practices.Cultivate a culture of continuous improvement.

PENETRATION TESTING

Learn how easy it is to employ the expertise of a CIO, without the high cost.

Premium Content Locked!

We'll help you find out.

GET BETTER SERVICE

WORRY-FREE IT START UP

Provide comprehensive and innovative solutions.

Empower our customer partners to achieve their business goals.

Leverage cutting-edge tech and best practices.

Cultivate a culture of continuous improvement.