Cybersecurity Awareness and Training

Be Online Aware! October is National Cybersecurity Awareness Month.

Cybersecurity Awareness and Training

Your employees are arguably your largest attack vector. Therefore, one of the absolute best things you can do to improve your organization’s security posture is to provide employees with effective security awareness training.

Click here for ways to provide effective Security Awareness & Training.

Inspiring the Next Generation of Cybersecurity Professionals

Be Online Aware! October is National Cybersecurity Awareness Month.

Inspiring the Next Generation of Cybersecurity Professionals

In this day and age, technology seems to permeate evermore into not only our own lives, but our children’s as well. The general consensus towards the rapid integration of technology seems to be positive in most cases, and allows for the simplification and expedition of day-to-day tasks. As general computer knowledge and overall use continues to climb, our children are getting more facetime with technology than ever before. Fortunately for the iPad playing pre-teens, this baseline familiarity with technology will handily transfer to their future professional careers, albeit unbeknownst to them.

Click here for ways to inspire youth towards a promising career in Cybersecurity.

Make Your Home a Haven with Online Safety

Be Online Aware! October is National Cybersecurity Awareness Month.

Make Your Home a Haven with Online Safety

Every day, parents and caregivers teach kids basic safety practices ‒ like looking both ways before crossing the street and holding an adult’s hand in a crowded place. Easy-to-learn life lessons for online safety and privacy begin with parents leading the way. Learning good cybersecurity practices can also help set a strong foundation for a career in the industry. With family members using the internet to engage in social media, adjust the home thermostat or shop for the latest connected toy, it is vital to make certain that the entire household ‒ including children – learn to use the internet safely and responsibly and that networks and mobile devices are secure.

Click here to read more about basic cybersecurity essentials the entire family can deploy to protect their homes against cyber threats.

 

Struggling over NIST SP 800-171?

NIST has an early Holiday gift for you!

Struggling over NIST SP 800-171?

The National Institute of Standards and Testing has recently published a new document that should help guide organizations that must comply with the CUI/CDI regulations, such as DFARS 252.204-7012 and FAR CFR 32 Part 2002. 

They announced the release of this draft publication this month, along with the following information:

It’s crunch time for government contractors. They only have until Dec. 31, 2017, to demonstrate they are providing appropriate cybersecurity for a class of sensitive data called Controlled Unclassified Information (CUI)(link is external). Otherwise, they risk losing their contracts. For organizations that may be struggling to meet the deadline, the National Institute of Standards and Technology (NIST) has a new publication intended to help.

NIST’s Draft Special Publication (SP) 800-171A(link is external)Assessing Security Requirements for Controlled Unclassified Information, is a guideline for any organization seeking to comply with the CUI regulation governing the safe handling of information that is important to the U.S. government. CUI is a diverse classification that includes information involving privacy, proprietary business interests and law enforcement investigations.

Click here to download NIST SP800-171A publication.

 

Clarifications on DFARS 252.204-7012 & NIST SP 800-171

Notes from June 2017 DoD DFARS Information Day & MDA NDIA-TVC DFARS Track

As we get ever closer to the end of the year deadline for DoD contractors to complete their compliance of DFARS 252.204-7012, additional information has become available. 

On June 23, there were two events that provided additional clarification on the DFARS 7012 clause:

  • The DoD held an Industry Information Day on June 23, 2017 to address questions regarding DFARS Case 2013-D018 (related to cloud services), DFARS 252.204-7012, and 252.239-7010 (also related to Cloud Computing Services).
  • The Missile Defense Agency's National Defense Industry Association's Tennesee Valley Chapter was held on June 21-22, 2017.

The most important take-away from both events is the DoD is not contemplating any changes to the DFARS clauses addressing cybersecurity.

DoD Contractors should not expect any relief on the requirement to meet compliance by the end of this year, Dec 31, 2017. 

Additional clarifications and information can be read here.

Cyber Attacks in 2017: Who is the Next Target?

Forrester Research Forecasters Predict Health Care Industry will be Most Heavily Targetted

Cyber Attacks in 2017: Who is the Next Target?

We're getting close to the end of 2016 and people are already thinking about their New Year's Resolutions. Everyone at Sentar hopes you'll resolve to be a more secure cyber citizen. Change your passwords! Stop clicking on those links in email you receive from people or companies you don't know. Pick up the phone and talk more often. 

2017 is expected to have severe issues caused by cyber attacks, including expectation that "hackers could hurt the American economy by, among other things, taking down huge parts of the national electricity grid."

Before you peer into the future, here's the facts on 2016 cyber attacks that we know of, to date, as reported in this article posted by 247WallSt.com:

"Identity Theft Resource Center reports that there have been 957 data breaches recorded this year through December 6, 2016, with more than 35 million records exposed. Since beginning to track data breaches in 2005, ITRC has counted 6,766 breaches, involving more than 886 million records."

The Rise of the Bot Machines

Internet of Things P0wned! Major sites taken off Internet by Webcams, thermostats and DVRs

The Rise of the Bot Machines

On Friday, October 21, 2016, millions of 'smart' home devices designed to connect to cloud services on the Internet began generating traffic intended to shut down many popular websites, such as eBay, Amazon and Twitter.

This attack is known as a Distributed Denial of Service (DDoS) and it targeted a company called Dyn, who provides major infrastructure for large, popular websites. This "Internet of Things" based attack use recently released hacker software, called Mirai, to find and take over these devices--converting them into a botnet. This Mirai malware targets "smart" devices connected to the Internet, like security cameras, baby monitors, DVR's, refrigerators...you get the idea. The main design point for these IoT Devices has been to make it easy for anyone to pull it out of the box, plug it in and be connected.

Because of their nature, IoT 'smart home' devices are often very insecure, and are rarely, if ever, updated with security patches.

Social Engineering: The Easiest Way to Hack?

Be Online Aware! October is National Cybersecurity Awareness Month.

Social Engineering: The Easiest Way to Hack?

It has often been said that the easiest hack in IT security is the Social hack. Why? People are creatures of habit and, with insufficient training and a bit of prodding, are far easier to “con” than a firewall or IDS.

Webster’s defines Social Engineering as “an act of psychological manipulation of a human” and "any act that influences a person to take an action that may or may not be in their best interests."

Click here to learn more about Social Engineering.

How to Launch a Career in Cybersecurity

Be Online Aware! October is National Cybersecurity Awareness Month.

How to Launch a Career in Cybersecurity

Cybersecurity is a high-growth industry with a serious shortage of available talent. According to the U.S. Department of Commerce there are currently over 300,000 open cybersecurity positions across the United States and experts expect the labor shortage to continue. Because of this, rather than making hiring decisions based on experience, organizations tend to hire based on potential. Organizations evaluate a candidate’s potential to learn the technical skills based on a range of skills and traits such as problem solving and critical thinking, opening up the doors to a wider range of candidates.

Click this link for tips on pursuing a career in Cybersecurity.

How Secure is Your Password?

Be Online Aware! October is National Cybersecurity Awareness Month.

How Secure is Your Password?

If you had 10 security professionals in a room and asked them to create the most secure password, you’d probably walk out with 11 different answers. However, all security professionals will agree that a strong, secure password is your first line of defense from the ever increasing barrage of information breaches and malicious users.

Click here for tips on creating a more secure online experience.

Keep Updating Your Computer & Phone OS!

Major OS design flaw could have serious ramifications

Keep Updating Your Computer & Phone OS!

A serious flaw in the design of almost every CPU and/or operating system will result in cybersecurity-required updates, or patches, being published for Microsoft, Apple, and Linux operating systems.

One of our cybersecurity engineers noticed a flurry of Linux and Windows emergency kernel patches being published that are enabling and implementing KPTI (Kernel Page Table Isolation) protections (or barriers). Enabling KPTI for all operating systems will likely impact the computer's performance, in some cases running 30% slower.

[ Jan 4, 2018 Update: This exploit was discovered by Google back in the early summer of 2017. The exploits are known as "Meltdown" and "Spectre" — two methods of exploiting a security vulnerability found in Intel, AMD, and ARM processors that, between them, threaten almost all PCs, laptops, tablets, and smartphones, regardless of manufacturer or operating system. ]

Why is there a need to do this now?

Smart money seems to be that a variation of a known cyber attack, called rowhammer, has been found in the wild. This attack is likely a hypervisor exploit ... meaning the Big Brandsin the virtualization world (Amazon S3, Google Computer Engine, Microsoft Azure) could be at risk of a process in one Virtual Machine (VM) gaining access to data in another VM.

Click here to read more about this cybersecurity issue.

 

How NOT to respond to the Equifax Hacking News

Use ONLY the Equifax Website to check your account!

 

Another massive data breach has occurred. This time, one of the three primary credit records companies, has announced that almost half of all American's personal information INCLUDING Social Security Numbers, have been stolen from Equifax. Because the information includes names, addresses, SSI, credit card numbers and more, this breech may cause more harm to individuals than any previous cyber attack.

One thing you shouldn't do about this?  DON'T click on any website that promises to show whether your account is one of the stolen records. Some of those sites will definitely be set up to capture more information about you and won't even be related to the Equifax.

What should you do? Equifax has set up this website you should use to check your account status. 

PWN a Whole City with IoT Zigbee Virus?

Researchers hack Philips Hue bulbs to create IoT meltdown.

PWN a Whole City with IoT Zigbee Virus?

As we've previously blogged, the Internet of Things (IoT) is embedding itself into all aspects of our culture. We're concerned that most IoT technology doesn't address much about cybersecurity, rather they are focused on ease of connectivity and use. That's a nightmare we're still facing with our more traditional computing and networking platforms.

A new paper was published by research scientists out of Israel which exposes how a popular IoT communication standard, called Zigbee, can be exploited using the Philip Hue IoT smart lighting products. The paper opens with the following statement:

″Within the next few years, billions of IoT devices will densely populate our cities. In this paper we describe a new type of threat in which adjacent IoT devices will infect each other with a worm that will rapidly spread over large areas, provided that the density of compatible IoT devices exceeds a certain critical mass.

In particular, we developed and verified such an infection using the popular Philips Hue smart lamps as a platform. The worm spreads by jumping directly from one lamp to its neighbors, using only their built-in ZigBee wireless connectivity and their physical proximity. The attack can start by plugging in a single infected bulb anywhere in the city, and then catastrophically spread everywhere within minutes. It enables the attacker to turn all the city lights on or off, to permanently brick them, or to exploit them in a massive DDOS attack."

More on how this was done can be read here.

UK Hospital System Crippled by Computer Virus - Cancels Surgeries!

Trauma Patients diverted to other Hospitals; Surgeries cancelled.

UK Hospital System Crippled by Computer Virus - Cancels Surgeries!

Brian Krebs of KrebsonSecurity.com posted an in-depth article about a UK Hospital System that has been crippled by a computer virus. This cybersecurity breach has forced multiple hospitals to cancel surgeries and divert trauma patients and "at risk" women in labor. Although no information was released about what kind of computer virus infected the Hospital systems, it is likely an infestation of ransomware — a malware scourge whose purveyors have taken to targeting hospitals and healthcare facilities.

Ransomware scours an infected computer for documents, audio files, pictures and other things likely to be of value to the system’s owner, and then encrypts that data with very powerful encryption software. Most ransomware variants also scour the local network for other systems or network shares to infect. Victims usually can only get their files back after paying a specified ransom demand using a virtual currency, such as Bitcoin.