" cybersecurity Archives - LuxSci

Posts Tagged ‘cybersecurity’

Pretexting: The Latest Threat to Email Security

Monday, June 12th, 2023

Verizon recently released its 2023 Data Breach Investigations Report- a comprehensive review of breaches and security incidents occurring over the last year. One surprising finding was a sharp rise in pretexting attacks. To properly respond to these threats, security professionals must understand the risks and prepare for exploitation attempts.

email breach frustration

What is a Pretexting Attack?

A pretexting attack is a type of social engineering scam where the attacker tries to convince the victim to give up valuable information or access to a service or system by creating a story or pretext.

These types of scams are a form of phishing. However, pretexting requires more effort than regular phishing attacks that aim to reach as many potential victims as possible and fool one of them into clicking on a malicious link.

To successfully execute a pretexting scam, attackers spend time learning about the target and use the information to manipulate human behavior to achieve a desired outcome. The threat actor may spend more time performing reconnaissance and engaging with the victim. This time investment means that pretexting is often used in attacks with a higher anticipated payout.

In the 2023 Data Breach Investigations Report, analysts found that 50% of all social engineering attacks are pretexting incidents. This represented a 2x increase from the 2022 report. With these types of attacks on the rise, organizations must understand the threat and how to protect themselves from these breaches.

What’s an Example of a Pretexting Attack?

In a business context, pretexting falls under the category of business email compromise scams. Every pretexting scam includes two main elements- a plausible situation and a character. First, by creating the right situation to present to the victim, it is possible to fool the target into believing it is legitimate. Secondly, selecting the right person or organization to impersonate is equally essential.

If the attacker fails to pick a plausible scenario or chooses the wrong entity to impersonate, it drastically reduces the likelihood of success. That’s why these schemes require surveillance and research to achieve their aims.

Some common pretexts or scenarios that you should watch out for include the following:

  • A CEO or manager asking for an urgent transfer of funds to an unusual account
  • A vendor or supplier asking for payment of an unpaid invoice
  • A coworker asking for a password to an account they should already have access to

If the attacker has adequately researched the target, they can be quite convincing in impersonating a legitimate source and convincing them to hand over valuable information or assets.

How to Protect Against Pretexting Attacks

Instilling a healthy dose of skepticism in employees is always recommended. Proper training and reminders can help employees remain suspicious of requests for information and funds they do not expect. In addition, implementing the right policies and technologies can help reduce the risk of falling for a pretexting scam. Some additional steps to take to secure your email accounts include:

  • Deploying SPF, DKIM, and DMARC to prevent spoofing.
  • Using email filtering tools to flag suspicious email activity.
  • Installing anti-malware software on all devices can help mitigate the effects if a malicious link is clicked.
  • Deploying multi-factor authentication to guard against the risk of password theft and stolen credentials.
  • Updating business processes to ensure financial payments are appropriately vetted and signed off on.

Do you need help securing your email accounts? Contact LuxSci today to learn how we can help your business avoid falling victim to pretexting scams.

Tags: bec, business email compromise, cybersecurity, email filtering, mfa, multifactor authentication, phishing, pretexting, social engineering
Posted in LuxSci Library: Security and Privacy
Comments Off on Pretexting: The Latest Threat to Email Security

The Security Risks of Staffing Challenges

Wednesday, March 29th, 2023

The cybersecurity talent shortage is a known issue that the government, industry groups, and educators are working to address. But as CISOs are asked to do more with fewer resources and support, it can risk healthcare organizations’ cybersecurity. The “Implications of Stress on CISOs 2023 Report” by Cynet found that many security teams faced retention challenges due to work-related stress that could put their data at risk.

The Security Risks of Staffing Challenges

When security teams are understaffed, they can become overworked and burnt out. As a result, they have less time to focus on updating security policies, training staff, and monitoring the attack surface. The impacts of staffing challenges can significantly affect the ability of security teams to detect and respond to threats. The survey found that 65 percent of CISOs stated that work-related stress affected their capacity to safeguard their organization. In addition, 77 percent of CISOs believed their insufficient bandwidth and inadequate resources caused critical security initiatives to be neglected. These lapses are not going unnoticed. Seventy-nine percent of CISOs have received complaints from colleagues claiming security tasks are not being adequately handled.

the security risks of staffing challengesWith limited choices, organizations must be wise and strategic in the technology they employ. When asked about the technology initiatives that could positively impact their work-related stress levels, 57 percent of the respondents cited consolidating multiple security technologies on a single platform or interface as a possible solution. Additionally, 51 percent of the respondents believed automating time-consuming and repetitive manual tasks would help reduce their workloads.

Candidate Quality Staffing Challenges

When security teams cannot find qualified candidates to fill open positions, crucial tasks are left incomplete, and other team members must pick up the slack. In turn, this can lead to compounding issues with employee satisfaction and retention. Of the surveyed CISO teams, 74 percent reported losing team members due to work-related stress issues.

According to the report, nearly half of the teams had more than one CISO resign over the last 12 months. The impact of stress levels is seen in retention rates and recruitment efforts, with 83 percent of CISOs admitting they have had to compromise on the quality of new hires to fill vacancies left by departing employees.

Solving retention and recruitment issues is essential to improve your organization’s security posture. Rethinking the hiring process and investing in entry-level talent is just one approach to filling the cybersecurity talent pipeline.

Ways to Alleviate the Security Risks of Staffing Challenges

While solving staffing challenges will take time and investment from the public and private sectors, there are ways to streamline and automate tasks to reduce the burden on security teams.

According to Deloitte, email is a significant vector of security risk for many healthcare organizations. 91% of all cyber attacks begin with a phishing email. Healthcare organizations have more to worry about than cyberattacks. They are also vulnerable to insider threats and have serious data compliance obligations. Employees must understand data loss prevention and how to protect sensitive information that is shared externally.

By using LuxSci’s best-in-class secure email technology, it can drastically reduce the burden on security teams. Protect from external threats by employing advanced email filtering to stop cybercriminals from even reaching inboxes. In addition, LuxSci’s email encryption is enabled automatically to protect sensitive data in transit. It’s easy to administer and doesn’t require security and IT teams to spend hours developing keyword lists, analyzing gaps, and training employees. By reducing the risk of your email communications, security teams can focus their limited resources on critical security initiatives.

Contact LuxSci today to learn how our experienced team can help alleviate the burden on your security and IT teams.

Tags: ciso, cybersecurity, cybersecurity risk, email encryption, email filtering, email security, operational efficiency, phishing, risk assessment, secure connector, secure email, security risk, staffing
Posted in LuxSci Library: Security and Privacy
Comments Off on The Security Risks of Staffing Challenges

Medical Device Cybersecurity Standards Are on the Way

Thursday, December 29th, 2022

Internet-connected medical devices have transformed healthcare, but not without introducing significant risks. After years of lobbying, changes to medical device cybersecurity standards are finally coming as part of the Consolidated Appropriations Act. The omnibus spending bill includes language requiring medical device manufacturers to ensure that their devices meet specific cybersecurity requirements. This article looks at the proposed changes and how they could trickle down to include other wearable devices and applications in the future.

medical device security

The State of Medical Device Security

Over the past few years, politicians and healthcare leaders have pushed for further guidance and regulations surrounding medical device security. Healthcare organizations often maintain thousands of medical devices, many of which are internet-connected and could pose security risks.

It’s no secret that cybercriminals frequently target medical devices. Capterra recently surveyed 150 healthcare respondents in the United States to explore the current state of medical IoT security and determine whether medical practices with a high percentage of their medical devices connected to the internet were experiencing more cyberattacks. They found that medical practices with a higher percentage of connected medical devices experienced more cyberattacks than those with a low percentage of connected medical devices.

medical device cybersecurity stats

Ongoing struggles with securing and keeping track of medical devices, the industry’s reliance on legacy systems, and increased federal cybersecurity focus prompted legislative action.

Proposed Changes to Medical Device Security Standards

Once enacted, the omnibus bill would require device manufacturers to “submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, post-market cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures.”

Additionally, manufacturers must design and develop processes to ensure that their devices and related systems are secure, including post-market updates and patches. These updates will take effect 90 days after the bill is signed.

The bill would also require manufacturers to provide a software bill of materials (SBOM) to the Secretary detailing the software’s off-the-shelf, open-source, and commercial components. CISA defines a software bill of materials as “a nested inventory, a list of ingredients that make up software components.” SBOMs have grown in popularity because they make it easier to know if a specific threat impacts your software. For instance, one of the reasons that the log4j attack was so threatening was that log4j is widely used in various consumer and enterprise services, websites, and applications to log security and performance information. An average software user had no way of knowing if their services used log4j, putting them at risk of a breach. Having a SBOM makes it easy to know if the exploit threatens your software.

Finally, the omnibus bill would also require the Food and Drug Administration to issue further guidance on improving the cybersecurity of medical devices. The Government Accountability Office (GAO) would also be expected to release a report within the next year to identify remaining challenges surrounding device security. This bill represents only the first step in improving the security and regulations for medical devices.

The Future of Medical Devices and the Internet of Medical Things (IoMT)

These improvements are necessary considering the recent popularity of personal medical devices. Though the proposed regulations do not necessarily apply to fitness trackers and smartwatches, it’s easy to imagine a future in which medical providers use similar devices to record and transmit patient data to electronic health records.

As smartwatches, remote patient monitoring tools, and other devices that allow individuals to track, send, and store health data are gaining market share, they will also come under scrutiny by regulators. Organizations must decide how to safely use these tools and make decisions to ensure interoperability with their systems. Not all medical devices and applications are designed with patient security and privacy in mind.

People love how easy it is to track step counts with a Fitbit or Apple Watch, but as we know, balancing usability with security is a challenging task. Tracking physical activity is one thing, but as these devices evolve to collect more sensitive health information, integrating them with health systems while maintaining patient privacy will be a considerable challenge. It is clear that as health tech evolves, so too must our security practices. These new regulations are only the first step to securing the vast quantities of digital health data that are collected and distributed by third parties not subject to HIPAA requirements.

Tags: cisa, cybersecurity, cybersecurity policy, health applications, iomt, medical devices, remote patient monitoring, sbom, secure apps, smartwatch
Posted in Industry News, LuxSci Library: Security and Privacy
Comments Off on Medical Device Cybersecurity Standards Are on the Way

4 Security Tips for Cybersecurity Awareness Month

Wednesday, October 26th, 2022

October is Cybersecurity Awareness Month, and it’s worth taking a minute to reflect on your security stance and what you can do better to protect sensitive data and accounts.

cybersecurity awareness month tips

The Current State of Cybersecurity in 2022

Cybersecurity incidents and data breaches continue to increase across all industries. A 2022 report noted a 42% increase in cyberattacks for the first half of 2022 compared to the same period in 2021.

The healthcare sector also continues to be a target. The same report noted a 69% increase in cyberattacks targeting the healthcare sector. The Office of Civil Rights also noted that breaches affecting 500 or more individuals increased from 663 in 2020 to 714 in 2021.

Even more concerning, 74% of the breaches reported to OCR in 2021 involved hacking or IT incidents. In the healthcare sector, hacking represents the greatest threat to the privacy and security of PHI. Organizations must take the threat seriously and take concrete steps to protect their systems.

4 Essential Steps for Better Cybersecurity

So what can you do to avoid falling victim to a cyberattack? The Cybersecurity & Infrastructure Security Agency (CISA) recommends these four essential steps that all employees can take to protect their accounts.

Watch Out for Phishing Scams

Think before you click! Educate employees on common phishing tactics, create policies to help reduce risk, and invest in tools that flag suspicious emails. Phishing tactics are successful because they prey on common human impulses to manipulate individuals into taking quick actions.

Teaching employees what to look out for and putting in place email filtering systems to flag suspicious senders and links can drastically reduce your risk and the probability of your organization falling victim to a hacking incident.

Update Software

Many people find software updates annoying and snooze them for as long as possible. However, many software updates include security patches for recently identified vulnerabilities. By not updating to the latest version, it leaves your organization vulnerable to attacks.   

Use Strong Passwords

It’s an obvious tip to many security professionals, but many people still use weak passwords that are easy to guess. Today it is easier than ever to crack simple passwords using dictionary attacks or finding credentials on the dark web.

Employees should use unique passwords for each account. In addition, passwords should be:

  • Randomly generated
  • Use a combination of letters, numbers, and characters
  • At least ten characters
  • Stored securely in a password manager
  • Not shared with other employees

Enable Multifactor Authentication

As we mentioned above, cracking passwords is getting easier, especially if employees are not using strong, complex credentials. Enabling multifactor authentication adds another layer of security to account logins. Multifactor authentication requires users to present two or more credentials to log in to their accounts. The first factor required is a typical username and password. The second factor is usually a code contained within a text, email, or push notification. The user must enter this numerical code to confirm that they are logging into the account. Even if your username or password is compromised, a hacker will not be able to access the account without that second factor. It’s wise to require the use of multifactor authentication, especially for accounts that contain sensitive data. 

Conclusion

Of course, these tips only scratch the surface of a successful security and compliance program. To get started, complete a risk assessment to identify gaps and areas to improve. LuxSci is here to help improve your email security.

Tags: 2fa, access control, cybersecurity, cybersecurityawarenessmonth, email filtering, mfa, multifactor authentication, password manager, password security, phishing, risk assessment, software updates
Posted in LuxSci Library: Security and Privacy
Comments Off on 4 Security Tips for Cybersecurity Awareness Month

How to Avoid Business Email Compromise Attacks

Tuesday, July 5th, 2022

Business email compromise (BEC) attacks are on the rise and are poised to eclipse ransomware as the biggest threat to cybersecurity. Since 2016, $43 billion has been stolen through BEC. Even more concerning, there has been a 65% increase in BEC from 2019 to 2021. This article explores what business email compromise scams are and what steps organizations can take to avoid them.

business email compromise

What are Business Email Compromise Attacks?

In business email compromise scams, attackers infiltrate or impersonate a legitimate corporate email account. They then send phony invoices or initiate contract payments that trick unsuspecting businesses into wiring money to criminals.

These scams rely on humans making the wrong choices. Some examples of business email compromise scams include:

  • A criminal impersonates a vendor and sends a fake invoice to the accounting department.
  • Someone who appears to be the company CEO asks an assistant to make a wire transfer to an unknown account.

Some of the tactics used include:

  • Domain name spoofing: Domain name spoofing involves changing the sender’s “From” address to match the recipient’s domain in the message envelope. Criminals can also use a legitimate domain as the “From” address and a spoofed “Reply-To” domain in the message header.
  • Display name spoofing: The attacker registers a free email account to impersonate a vendor or employee. The attacker would configure the display name to match the employee’s name and then send phishing messages from this account. This technique is effective because recipients often only look at the display name, not the email address. In fact, many email clients will only show the display name when viewing the message, making it easier to hide the sender’s real identity.
  • Lookalike domain spoofing: The attacker may register fake domain names that contain characters that look similar to those in the actual domain name. For example, replacing the lowercase “l” in luxsci.com with an uppercase “I.” The criminal will send phishing emails from this domain to trick the recipient into thinking the message is legitimate.
  • Email Account Compromise: Another common tactic is taking over legitimate email accounts that have been compromised through malware or social engineering to steal data or funds.

How to Prevent Business Email Compromise Attacks

One of the reasons that business email compromise attacks are increasing is because they are often successful. Email filters and content scanning can do little to stop sophisticated social engineering attacks. Nevertheless, there are steps that organizations can take to stop BEC scams.

SPF, DKIM, and DMARC

Implementing technical controls can help prevent BEC scams from succeeding. As discussed above, many attacks use display or domain name spoofing to impersonate company accounts or individuals.

Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC) are anti-spoofing email authentication techniques that use DNS records to validate the sender of an email. Ensure the organization’s domain has valid SPF, DKIM, and DMARC records. Make sure the email provider analyzes all inbound email traffic using these tools.

Viewing the headers of a suspicious message is also an excellent way to detect fraudulent domains. See Gmail, Outlook, Apple Mail, and More: How to View Headers in Email to learn how to see these in the most popular email clients. This can help reveal the actual sender of someone using a spoofed domain or display name.

In addition, implementing email filtering and scanning tools can help flag suspicious links and protect against phishing attacks.

Employee Training

Helping employees recognize business email compromise scams is essential to avoiding them. All employees, not just those with access to sensitive data or financial information, should understand the tactics used by cybercriminals in BEC scams.

Employees should be aware that attackers can use the information they share online via social media against them. Birthdates, pets’ names, nicknames, and information about time off can be used to impersonate others and trick individuals.

Ensure employees are implementing strong passwords and using multifactor authentication to prevent account compromise and stop them from changing account credentials.

Policy and Procedures

Creating clear policies and procedures can help alleviate confusion and prevent individuals from taking action without thinking. For example, organizations should have clearly defined procedures for how and when vendors will send invoices and be paid. That way, when an unexpected email comes in from a “vendor,” employees will know what to do. It’s also essential to keep up-to-date contact information for vendors and employees. Many BEC schemes ask recipients to call a phone number with account credentials or payment information. If the number differs from the contact information on file, it’s wise to pause and call the contact through established channels to confirm the message’s accuracy before proceeding.

By creating clearly defined and enforced policies and procedures, it will be very obvious when deviations occur. Empowering employees with the tools they need to identify business email compromise scams will help protect your company and keep financial information secure.

Tags: bec, business email compromise, cyberattack, cybercrime, cybersecurity, dkim, DMARC, email fraud, email headers, email scams, phishing, spear phishing, spf
Posted in Email, LuxSci Library: Security and Privacy
Comments Off on How to Avoid Business Email Compromise Attacks

« Older Entries