Cloud Hosting

An insider threat is defined as a security risk that derives from within an organisation; and with the global cost averaging $11.45 million, it is critical that organisations address this issue. Frequently, the risk is attributed to malicious or negligent employees, as well as others close to the organisation, such as contractors and business associates, and think that employee monitoring software will prevent threats. Yet, this understanding of insider threats misleadingly unloads the blame on people; in other words, exposing them as the scapegoat.

Javvad Malik is a Security Awareness Advocate at KnowBe4.

While there are people who do actively seek to harm an organisation, according to the Ponemon Institutes 2020 Cost of Insider Threats Report, they only account for 23% of insider threats. The majority of people can be easily trained to become an asset rather than a liability for the organisation.

Rather than blaming people then, why are we not shifting our attention to the root of the problem? That is to say, security software.

Whether embedded with vulnerabilities, corrupted by governments, or used as a channel to harvest data for a profit, the use of security software at present is riddled with problems.

One of the largest and most commonly used security software providers, is the Czech-based company, Avast antivirus, with more than 435 million active users across 59 countries employing their antivirus protection. However, until the end of January 2020, Avast was also furtively gathering data from their users and selling that data on to third-party customers through their subsidiary, Jumpstart. In that sense, they have been working as a double agent against the very people who had entrusted them with their internet security and, specifically, their privacy.

In many cases, the software itself is faulty. According to the Veracode SOSS Report Vol. 10 published last year, around 10 million flaws were found across 85,000 applications and 83% of those applications had at least one flaw in the initial scan. Out of those flaws, 20% were marked high or very high severity. It is precisely through exploiting such vulnerabilities that bad actors are able to infiltrate an organisation and access its data.

Complicating things further, the sheer scale and complexity of vulnerabilities makes it that much harder to verify if a system has or has not been patched. Indeed, the majority of data breaches (60%) occur because software vulnerabilities were left unpatched. The Equifax data breach of 2017 and the Marriott breach in 2018 are two exemplars of this occurring, collectively exposing over 640 million records.

In certain instances, the government gets involved, and not in a way that resolves infringements on privacy rights or apprehends the criminals behind attacks. Rather, they themselves are the offender. The attacks carried out by APT5, otherwise known as Manganese, on high-end enterprise VPN servers are a clear example of this.

Since August 2019, it was revealed that Chinese state-sponsored hackers performed internet scans in search of Fortinet and Pulse Secure VPN servers. They then attempted to exploit two vulnerabilities within these VPN servers to gain access to files without the need for authentication. In this way, allowing the hackers to acquire access to passwords and VPN session data from vulnerable devices. The Iranians are not too far behind either. A report by cybersecurity firm ClearSky revealed that Irans government-backed hacking units have made it a priority to exploit VPN bugs as soon as they become public.

Fortinet and Pulse Secure VPN servers are both widely used, with hundreds of thousands of customers. More specifically, Pulse Secure is popular amongst numerous Fortune 500 companies, including some of the largest technology firms and government agencies. Their use of a VPN server is, primarily, to protect their internal servers from unauthorized access. Yet, if they fail to do so, how can we then turn around and blame the employees when a breach occurs?

Finally, there is scareware. As is implied by the name, scareware is a form of phishing that gambles on your fear and perception of an impending threat. Through a pop-up ad, cybercriminals send warnings suggesting that your computer is infected with malware or that it is running slow. They then capitalize on your concern and panicked reaction to provide a solution.

However, the solution, a fake or a bogus update, enables the bad actor to access your data and install malware on your computer, perhaps even ransomware. In this type of scenario, it is easy to point the finger at the individual who clicks on the ad, but what about the security software providers who let it happen? Is it not the responsibility of security software programs to identify malicious ads and block them from popping up on the screen?

In the end, we are left to wonder what the real insider threat is. All this time, people have been described as the weakest link and held responsible for exposing organisations to insecurity. Yet, looking at the evidence, the problems seem to stem from security software and their providers. Considering that they are the ones who are supposed to protect us, both individuals and organisations, from a cyberattack, it is rather ironic that they are, in reality, the problem.

Read the original post:
The real insider threat is the use of security software - TechRadar

The coronavirus pandemic is testing our nations resolve and already disrupting our way of life. But we cant afford to let it disrupt the November election.

Six states have already postponed their primaries. More will likely follow in the weeks and months ahead.

With a risk that the pandemic will continue through November, the hard work to plan for the election must begin now. The American people deserve a national bipartisan effort including leadership from the policy and technology communities to ensure the integrity and continuity of American democracy.

The good news is that this important work was underway long before the pandemic. Since 2016, national and state leaders have prioritized strengthening the security and integrity of U.S. elections with bipartisan engagement from the Obama and Trump administrations. Congress has invested more than $800 million in new funding for state and local election systems over the past two years.

Recent efforts to modernize state and local election systems have focused on addressing potential cybersecurity vulnerabilities. Managing this risk should remain a priority, particularly given the recent cybersecurity attack against the Department of Health and Human Services. We should plan for foreign adversaries to exploit potential opportunities to undermine and divide our country.

But we now face a new, graver threat in COVID-19. National, state and local officials will need to work together to adapt the American election system to address the challenges of a pandemic.

We all hope that society returns to normal sooner rather than later. But if social distancing to flatten the curve of potential infections is required through November, state and local election officials must consider new strategies to administer the election.

One promising strategy is to expand vote-by-mail, which is already common for absentee ballots and Americans living overseas. According to the National Association of Secretaries of State, 33 states and Washington, D.C. now allow vote-by-mail for non-absentee voters. Sens. Amy KlobucharAmy KlobucharWhy Klobuchar should be Biden's vice presidential pick Changing antitrust rules will cause confusion Who should be the Democratic vice presidential candidate? MORE (D-Minn.) and Ron WydenRonald (Ron) Lee WydenDemocrats fume over GOP coronavirus bill: 'Totally inadequate' Sticking points force stimulus package talks to spill into Sunday Democrats call for stimulus to boost Social Security benefits by 0 a month MORE (D-Ore.) recently introduced legislation to allow all Americans to vote by mail.

Expanding this option to all communities, combined with widespread early voting, offers a promising option for states seeking to support social distancing while encouraging voter turnout and participation.

But vote-by-mail does come with risks, particularly concerns about voter integrity and ballot harvesting. We must ensure that votes sent by mail are counted accurately. The policy and technology community should work together to quickly develop best practices and practical solutions to address these concerns to ensure voter confidence.

One aspect of vote-by-mailto consider would be to design ballots in a manner that provides voters with an electronic receipt (such as a QR code) that they can use to electronically verify their vote was counted. This process, combined with other checks-and-balances, such as the creation of a state election integrity ombudsman, could establish a system where voters can independently audit whether their vote was counted accurately.

Officials should explore other ways to use technology. For example, mobile applications could allow voters to gauge the voting location wait times and check in to their preferred paper ballot drop-off or in-person voting location. This activity would alert the poll registration system to the increased voting demand and likely resulting wait times. The same monitoring data can be shared with a variety of services supporting voting wait time web sites and mobile mapping applications like Waze, Google Maps, and Apple Maps. This could allow for the election day voters to maximize their options for voting while supporting social distancing.

Experts from the policy and technology community should work together to consider these and other options to support our state and local election officials.

We should all have confidence in the public servants responsible for administering our elections. In January, the nations Secretaries of State and state election directors met in Washington. While Congress debated impeachment across town, state officials were having nuanced discussions about all aspects of election administration. In our deeply partisan times, these state leaders are working together in a spirit of nonpartisanship that should make us all proud.

Much is uncertain about the weeks and months ahead. But history shows us that we can hold an election during even the most difficult times. The United States held elections in 1864 during the height of the Civil War and in 1944 when the Greatest Generation was fighting World War II.

It may be our responsibility to hold a presidential election during a pandemic. The time to prepare is now.

Dan Lips is Director of Cyber and National Security and Sean Roberts is a Senior Internet Security Engineer with the Lincoln Network.

Link:
Preparing for November's election must be a national priority | TheHill - The Hill