End of "AWS S3 security" excuse (when there is a data breach) - We have a new feature in AWS - AWS Identity & Access Management Access Analyzer

- It Monitors S3 bucket access policies and provides alerts if you have a cloud-storage bucket that is configured to allow access to anyone on the internet or that is shared with other AWS accounts. If the Access Analyzer tool discovers that a bucket is misconfigured you can respond to the alert by making a single click to "Block All Public Access,"

https://businessinsights.bitdefender.com/amazon-battles-leaky-s3-buckets-with-a-new-security-tool

End of "S3 security is complex" Excuse leading to data breach - Use the new feature - AWS Identity & Access Management Access Analyzer

It Monitors S3 bucket access policies and provides alerts if you have a cloud-storage bucket that is configured to allow access to anyone on the internet or that is shared with other AWS accounts. If the Access Analyzer tool discovers that a bucket is misconfigured you can respond to the alert by making a single click to "Block All Public Access," 

https://businessinsights.bitdefender.com/amazon-battles-leaky-s3-buckets-with-a-new-security-tool

Thanks Giving to Christmas is Vacation season - So, here is a simple security Tip from Sophos

We hear that Cybersecurity is a hot field, did you know that - 60% of IT Security Professionals are looking to leave current Job

• 53% - [An] unhealthy work environment ; 
• 46% - lack of IT security prioritization from C-level or upper management ; 
• 37% - unclear job expectations; 
• 30% -  lack of mentorship

In the workforce, it might look like this:
Situation -> Anger -> Action -> Unemployment and the cycle regenerates back to even more anger

https://www.hackread.com/information-security-professional-degeneration/

OWASP now has a new Top 10 list of API Security

As always five of them are Authentication, Authorization, Injection, Misconfiguration and Insufficient Logging+Monitoring (The last 2 are easily avoidable)

A1	Broken Object Level Authorization	APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface Level Access Control issue. Object-level authorization checks should be considered in every function that accesses a data source using input from the user.
A2	Broken Authentication	Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user's identities temporarily or permanently. Compromising system's ability to identify the client/user, compromises API security overall.
A3	Excessive Data Exposure	Looking forward to generic implementations, developers tend to expose all object properties without considering their individual sensitivity, relying on clients to perform the data filtering before displaying it to the user. Without controlling the client's state, servers receive more-and-more filters which can be abused to gain access to sensitive data.
A4	Lack of Resources & Rate Limiting	Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the client/user. Not only can this impact the API server performance, leading to Denial of Service (DoS), but also leaves the door open to authentication flaws such as brute force.
A5	Broken Function Level Authorization	Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws. By exploiting these issues, attackers gain access to other users’ resources and/or administrative functions.
A6	Mass Assignment	Binding client provided data (e.g., JSON) to data models, without proper properties filtering based on a whitelist, usually lead to Mass Assignment. Either guessing objects properties, exploring other API endpoints, reading the documentation, or providing additional object properties in request payloads, allows attackers to modify object properties they are not supposed to.
A7	Security Misconfiguration	Security misconfiguration is commonly a result of insecure default configurations, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information.
A8	Injection	Injection flaws, such as SQL, NoSQL, Command Injection, etc. occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's malicious data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
A9	Improper Assets Management	APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. Proper hosts and deployed API versions inventory also play an important role to mitigate issues such as deprecated API versions and exposed debug endpoints.
A10	Insufficient Logging & Monitoring	Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems to tamper with, extract, or destroy data. Most breach studies demonstrate the time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.

https://www.owasp.org/index.php/OWASP_API_Security_Project

"Security is Only as Strong as the Weakest Link" - cyberattack last month ripped off $4.2 million after one employee’s email account was compromised

The incident, which occurred Aug. 26, affected the Oklahoma Law Enforcement Retirement System, or OLERS, which supports retired state troopers, park rangers and campus police at public universities.


https://statescoop.com/hackers-took-4-2-million-pension-fund-oklahoma-troopers/

"Threat Landscape" , we security folks get it , what about "Trust Landscape"?. This is an interesting phrase highly relevant to this "everything is connected" world and has a big impact on how we manage risk.

In the digital world, 3rd through Nth party risk is far greater than first party risk. It's like when you trust your home to your teenage kids, it's the friends of their friends you should worry about the most.

https://www.rsa.com/en-us/blog/2019-03/the-trust-landscape

As long as we spend more money on security tech and less on people , we will continue to see more breaches and security incidents. Technology CANNOT think so, to adapt to the ever changing threat landscape we need intelligent people (do not confuse them with "power point" experts or "Yes-men") to protect our organization.

Indeed, the number of attacks are on the rise, taking longer to address than ever before. It's estimated that the average cost of a data breach in 2018 was up 6.4% over the previous year to $3.86 million. This is why companies cannot afford to simply rely on preventative technologies, which often lull them into a false sense of security.

Security teams understand they need to think like hackers. And they understand that it's not computers attacking their companies. Rather, it's the people behind them — people with real-life experience and intuition.

https://www.darkreading.com/threat-intelligence/to-mitigate-advanced-threats-put-people-ahead-of-tech/a/d-id/1333913

AI in cybersecurity - The term has quickly evolved in the industry from FUD factor to buzzword. Believing AI is the silver bullet that can address all cybersecurity challenges is as dangerous.AI still needs humans to provide reliable data.

 A lack of quality data leads to poor results. Even with quality data, trained AI tends to produce false positives and is not very good at explaining how it arrived at a certain conclusion, as it lacks the ability to understand context.

For this reason, humans remain a critical part of the equation. They are still needed to fine-tune AI systems and to investigate the alerts, validate and stratify the severity of threats, and determine the best way to remediate an attack.


https://www.scmagazine.com/home/opinion/balancing-ai-with-human-intelligence-in-cybersecurity/

AML (Adversarial Machine Learning) - If you don't understand this then, buzzwords like Artificial intelligence (AI) machine learning (ML) to deep learning (DL) are not going to help.

AML - A type of malicious interference with AI-based security systems. Adversaries have the ability to manipulate AI data and algorithms to the point where the AI system is defeated. Malware can then pass through undetected, putting vital corporate data, systems, and users at risk.

EXAMPLE-1 - Evasion attacks. In this case, adversaries deluge the system with false negatives (malware disguised as benign code), causing security analysts to completely ignore alerts or de-prioritize them.

EXAMPLE-2 - Poisoning attacks, which inject false data with the intent of poisoning the training data set and creating biases to certain classifications. This can actually change the AI model and significantly impact decisions and outcomes

Vendors and enterprise security teams need to be extra vigilant about continually monitoring AI-based security systems to ensure that they are doing what they are meant to do as they evolve and adapt to the changing threat landscape

https://www.scmagazine.com/home/opinion/artifical-intelligence-in-cybersecurity-is-vulnerable/

Why is "Security in the cloud" (your responsibility) important? (Don't confuse it with "security of the cloud", which is the vendor's responsibility)

Nearly half – 46 percent – of 37,000 Twitter users polled by Armor over a 13-week period said they’ve put sensitive data in the cloud, while 41 percent said they’d do so in the next two years.

In addition, 47 percent did not understand what shared responsibility means in the realm of cloud security.

https://www.scmagazine.com/home/security-news/armoru-poll-finds-46-of-37k-twitter-users-have-put-sensitive-data-in-cloud/

Good News for windows 10 users - Microsoft has built Windows Defender to run in a sandboxed environment.

With Windows Defender running in a restrictive process execution environment, attackers who break in are stuck inside the isolated environment and can't affect the rest of the system.

The feature is now available to Windows Insiders to test in upcoming versions of Windows 10. If you are not in the program and can't wait for Microsoft to release it in full, you can force-enable Windows Defender to run in a sandbox on Windows 10 version 1703 and later.

Windows Defender runs with high privileges to scan systems for malicious content; because of this, it's already a prime target for cyberattacks. If someone successfully exploits a bug in Windows Defender, an entire system can be taken over.



https://www.darkreading.com/analytics/windows-defender-first-full-antivirus-tool-to-run-in-a-sandbox/d/d-id/1333141

Third party apps may be reading our Gmail. If this message does not bother you then,ignore this message.

Third-party developers often reading a Gmail message content, once relevant authorization is available to them.

To increase your privacy, use Security Checkup

To get access to this tool, you will need to sign in to your Google Account (Myaccount.google.com) and manage specific settings.
(There is one feature to be noted above the others as it shows the number of applications having access to the data)
In order to proceed, click the squares at the right upper corner, and choose Account in the drop-down list. Continue with finding Security Checkup tab. This option enables viewing the number of devices used for signing in your Account. It also informs whether any security issues have occurred over recent 28 days.

https://www.hackread.com/third-party-apps-may-read-your-email-learn-how-to-protect/

Collaboration is good but, are you aware of some of the risks these integrations bring?

Here are 7 of them

1. API - APIs are the programming glue that holds collaboration systems together in cohesive architectures for specific groups and applications. The trouble is, history shows that this glue can develop cracks that allow hackers to attack the components at the point where they're joined. Consider a zero-trust architecture in which every component and API must authenticate at each transaction. 
2. Encrpytion Errors - A zero-trust architecture requires encryption within the collaboration application, rather than simply around the application. And the storage systems where data from the collaboration system are stored should be encrypted if that data is at all sensitive to the organization.
3. Mobile Apps - Even when the software is legitimate, the actions of the user may not be. Phishing, smishing (credential-hunting via SMS), and whishing (the same, via WhatsApp) are all threats that can hit companies that have taken care with all of the app-based vulnerabilities of their mobile devices. While these may not directly use the collaboration system, once credentials are compromised through one of the "-ishing" methods, the credentials for the collaboration system should be considered compromised, as well.
4. Privilege Escalation -  Users inherit their privilege level from the AD, LDAP, or other directory system in use by the organization. That works well in many situations, but the nature of projects and collaboration means there can be privilege mismatch. Worse, a privilege escalation attack on one side of the application/OS equation can mean an increased vulnerability on the other side, as well.
5. 3rd Party vulnerability - Every third-party integration comes access to the vulnerabilities that may exist within those third-party tools. The issue for the IT department may well be creating rules for expansion that cover ad-hoc employee experiments and conditions for their safe deployment.
6. Voice Control -  voice assistants are always listening, which means they are always vulnerable to exploits that let unauthorized listeners hear privileged conversations.
7. Web - Where there are Web browsers there are Web applications, and where there are Web applications there are vulnerabilities. 

https://www.darkreading.com/application-security/7-ways-a-collaboration-system-could-wreck-your-it-security/d/d-id/1333064?image_number=1

Fact is stranger than fiction - Can you remotely spy on the content on a Screen with a Mic?

 Remote surveillance dubbed "Synesthesia": a side-channel attack that can reveal the contents of a remote screen, providing access to potentially sensitive information based solely on "content-dependent acoustic leakage from LCD screens."

https://arstechnica.com/information-technology/2018/08/researchers-find-way-to-spy-on-remote-screens-through-the-webcam-mic/

Security Issues - Lets review them tomorrow

Security Architecture is more important than adding new security technology

Organizations flock to purchase the latest "next-generation" security technology but meanwhile ignore the basic tenants of security. A mature, secure architecture design does not require the most expensive best-of-breed solutions. However, it does involve taking time to think about one's environment and to design a secure architecture accordingly.

If you take the time to learn about your assets, you will be able to layer in multiple prevention and detection solutions and have a highly effective security architecture

The firewall should also be configured to implement internal layers of network segmentation. Controls should not only face the Internet but implemented to secure authorized access from internal assets to internal assets.


Modern challenges also must be overcome. For instance, consider an intrusion detection/prevention device, web proxy, data loss prevention sensor, network antivirus, or any other Layer 7 network inspection solution. These are all crippled by network encryption


https://www.darkreading.com/cloud/creating-a-defensible-security-architecture/a/d-id/1332169

Firefox Monitor - A new security tool from Mozilla

Similar to the existing function of HIBP (Have I Been Pwned), Firefox Monitor allows users to enter their email addresses to check if they’re part of hacker databases that have been publicly released.


Firefox Monitor users can see the details on sites and other sources of breaches and the types of personal data exposed in each breach, and receive recommendations on what to do in the case of a data breach.

Mozilla said it is also considering a service to notify people when new breaches include their personal data

Mozilla said currently it is testing initial designs of the Firefox Monitor tool – but beginning next week, the company will invite approximately 250,000 users, mainly U.S.-based, to try it out.

https://threatpost.com/mozilla-announces-firefox-monitor-tool-testing-firefox-61/133087/

If you are serious about securing container apps then, here is a 8-Point Security Checklist.

Organizations need to think about security through the application stack both before deploying a container and throughout its life cycle. "While containers inherit many of the security features of Linux, there are some specific issues that need to be considered when it comes to the model,"

1. Secrets Management
2. Image Provenances
3. Visibility Into Container Workflow
4. Standardized Configuration and Deployment
5. Discovery and Monitoring 
6. Container-Specific Host OS
7. Container Risk-Prioritization
8. Group Containers

https://www.darkreading.com/cloud/containerized-apps-an-8-point-security-checklist/d/d-id/1332045

Card skimming at the Pump is easy on older pumps but, how can you differentiate between old and new pumps?

Newer pumps - Include not only custom keys for each pump, but also tamper protections that physically shut down a pump if the machine is improperly accessed

Feature a horizontal card acceptance slot along with a raised metallic keypad — much like a traditional payphone keypad and referred to in the fuel industry as a “full travel” keypad



Older pumps - Are secured via a master key that opens not only all pumps at a given station, but in many cases all pumps of a given model made by the same manufacturer.

Have a vertical card reader and a flat, membrane-based keypad.


In virtually all cases investigated by the SAPD, the incidents occurred at filling stations using older-model pumps that have not yet been upgraded with physical and digital security features which make it far more difficult for skimmer thieves to tamper with fuel pumps and siphon customer card data (and PINs from debit card users).

https://krebsonsecurity.com/2018/06/how-to-avoid-card-skimmers-at-the-pump/