Back to Basics

Feb

2023

Insider Security Threats

A new report reveals that the growing use of cloud data makes insider security threats more difficult to detect and prevent. Insider security threats affect more than 34% of businesses and have increased by 47% over the past two years as many industries move to cloud storage.

Most insider security threats come from negligence. Only about one-third of insider threats come from malicious or disgruntled employees or contractors looking to do damage. The other two-thirds of threats are due to users disobeying security rules for convenience or human error. These users may store confidential data on personal devices or share passwords to make their job easier. Negligent users may also share data with a criminal in a phishing attack.

Malicious insider threats include former employees who steal data during their offboarding process or current employees working with third-party organizations seeking to harm the company.

Storing business data in the cloud introduces new insider security threats that may not have been an issue on physical servers. Many businesses are adding cloud storage without an understanding of segmentation, monitoring, and access controls.

Education is the first line of defense against insider security threats. Businesses should have clear guidelines on personal device use, including USB drives, and those policies should be communicated regularly to employees. A large percentage of insider data breaches occur from an employee trying to make their job easier, so it’s essential to communicate how confidential and privileged data should be used.

Next, users should only have access to the data they need to perform their job. The Principle of Least Privilege is still important in cloud data management and is an aspect of security that’s being overlooked in the transition online. Businesses can also implement tools that restrict the copying and transferring of data, so users can access assets to do their job but cannot move them.

Lastly, pay attention to third-party vendors. Often vendors are granted access to cloud data, which may not have the same security policies in place as the original organization. Additionally, the data transfer method to the third party is another avenue for a breach.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Nov

2022

Clone Phishing

Clone phishing attacks are a new type of social engineering attack that can be more difficult to detect than typical phishing emails. Clone phishing attacks generally use a clone of a legitimate email to entice users to click a link or enter information. A standard clone phishing tactic would be an email that looks like it’s from PayPal on the same day of the month you typically receive your account balance notification. The email would look exactly like the one users receive every month and might even show a high or past-due balance to create urgency and make users more likely to click the link.

Another form of clone phishing can be a follow-up to an initial email. Clone phishing emails can appear to come from a company or colleagues inside your business if a business email compromise (BEC) has occurred. Hackers will resend the previous email and refer to updated links or resources in the new email. Since the attack is based on a previously received email, users are more likely to click on the new email to see what changed. Cloning the original email creates a more trusting environment where users are less likely to check links or email addresses. In the event of a business email compromise, the email could come from a real and trusted email address, increasing the likelihood that users will click the malicious link.

Like other phishing campaigns, the malicious links ask for personal information, login credentials, or credit card information which should be the first red flag for users. Criminals are also using clone phishing tactics to install malware which can be more challenging to detect.

Users should be aware of this new phishing tactic and be reminded to ‘think before you click’ especially during the holiday season. Like other phishing tactics, criminals try to create urgency with clone phishing to steal data. Click here to read our blog post on Holiday Phishing.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Nov

2022

Hive Ransomware

The FBI and U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an alert on the increased impact of Hive ransomware on businesses. “As of November 2022, Hive ransomware actors have victimized over 1,300 companies worldwide, receiving approximately US$100 million in ransom payments, according to FBI information.” from CISA alert. The attackers use Hive ransomware as a ransomware-as-a-service (RaaS) model and target a wide range of industries, from government and critical infrastructure to communication and manufacturing. However, the group targets Healthcare and Public Health (HPH) businesses by a large margin over all other sectors.

The group uses various attack vectors to infiltrate business networks. Investigation into the ransomware group has shown Hive gained access through remote desktop applications and virtual private networks (VPNs) with single-factor and multi-factor authentication (MFA) logins. The group also used traditional phishing emails with malicious logins to install malware. After gaining access, the group tried to cover its tracks by terminating processes related to backup and antivirus. They also deleted system logs that could help the company realize they have been infected.

The ransomware price is negotiated on the dark web, and criminals demand payment in Bitcoin. Hive actors also threaten to publish stolen data or reinfect business networks if the victim refuses to pay the ransom. “Hive actors have been known to reinfect—with either Hive ransomware or another ransomware variant—the networks of victim organizations who have restored their network without making a ransom payment.” from CISA alert.

The healthcare and public health sector was the leading industry targeted by ransomware in 2021 by a large margin. Financial services came in second with about one-third the number of attacks as healthcare. The healthcare sector is a favorite target for hackers because of the inconsistency of cybersecurity across the industry. Additionally, healthcare facilities store highly sensitive and personal data, so the probability of payment is higher when the criminal threatens to publish the data.

The alert listed several mitigations and preparations for a cyber incident, including monitoring external remote connections and implementing a recovery plan. Read the complete alert here.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Nov

2022

Holiday Phishing

As the holiday season quickly approaches, hackers are hard at work targeting businesses and consumers. Now is an excellent time to review traditional phishing methods and the evolution of tactics we’ve seen this year. Even though most people can recognize and avoid email phishing attacks, they still account for 90% of data breaches. This time of year, consumers look for deals in their emails, and criminals are getting much more strategic with phishing campaigns.

Hackers are trying to steal a wide variety of data with phishing techniques, including personal and financial information, login credentials for retail sites, or business login credentials to install malware and steal business data. Since the pandemic, shopping from work computers and accessing work data from personal computers has become such common practice criminals are using retail phishing tactics to attack business resources.

Email phishing is still the top phishing tactic, even with all the consumer education and email filtering. Phishing emails typically create urgency or work on the reader’s emotion to click a link. Phishing email campaigns target a large number of users, normally sent out to thousands of people, hoping a percentage will click on the link.

Spear phishing is the next most prominent type of phishing. Spear phishing campaigns target individual users with information pertinent to that person. Spear phishing emails may use your name, city, bank, workplace, or other publicly available information.

Smishing is the third most prominent type of phishing. Smishing uses text or SMS messages to initiate the attack. Common smishing techniques are fake discount deals, delivery confirmation, and password recovery.

All phishing attack vectors attempt to create urgency or work on the emotions of the user. They may offer a black Friday deal or say that your account needs attention because the password has been changed. A common vector is to ask the user to confirm an expensive online order or show a fake shipping confirmation for a retailer you frequent. The holiday season is a great time of year to remind employees and family members of the dangers and tactics of phishing campaigns.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Back to Basics

Search Quanexus.com

White Paper: Corporate Account Takeovers, Business Email Compromise and Ransomware

What Our Clients Think

Contact Us