Request Demo

Company

TrACE Shield

TrACE Identity

TrACE Vigilance

TrACE Platform

Solutions

Partners

Support

Blog

+1-303-423-4500

Contact Us

 (then reboot if kernel has been patched)

yum update (then reboot if kernel has been patched) yum install glibc.i686 yum install openmotif yum install libgcc.i686 yum install openmotif22 yum install openmotif22.i686 yum install xauth yum install libXtst tar xvzf bisrvr_linuxi8664h_10.1.1_ml.tar.gz cd linuxi38664h/ ./isetup

Cognos 10.1 install on CentOS 6.3 64 bit

Analytics

Big Data

Billing

Business

Business Intelligence

Cloud Computing

Consulting

Cybersecurity

Data Warehouse

News

Services

Technology

Testing as a Service

On 2 July, just as most offices closed for Independence Day weekend in the United States, Kaseya announced that their system was compromised.

Kaseya is a SaaS company that provides software for Managed Service Providers (MSPs) all over the world; its VSA is used by hundreds of companies who manage everything from billing systems to contracts and finance reports. Most clients of these companies are small businesses who aren’t even aware of what software is running on the servers they’re using, that’s why they contract MSPs to look after their systems. Wietse Boonstra of the Dutch Institute for Vulnerability Disclosure (DIVD), a group of ethical hackers from the Netherlands, discovered a vulnerability of Kaseya VSA and alerted the company in early July. 

Engineers at Kaseya started working on patching the problem straight away, but REvil, a ransomware-as-service gang from Russia have also learned of the vulnerability and managed to hack VSA before the patch was released. "If we had a little more time, we would have succeeded," members of DIVD told NL Times.

According to Huntress Research, REvil exploited this zero-day vulnerability through an authentication bypass, and they uploaded code to affected servers without that code being checked. In other words, REvil uploaded their ransomware disguised as a management agent update, and because deployment was automated, the update went live instantly. Sophos noted that “by infiltrating the VSA Server, any attached client will perform whatever task the VSA Server requests without question. This is likely one of the reasons why Kaseya was targeted.” When we evaluated Kaseya back in 2017 we decided to advise our customers to select alternative options.. At the time we didn’t expect such a catastrophic breach caused by Kaseya, yet some weaknesses of the system were clear as compared to alternatives.

In a 5 July update, Kaseya said that a fix has been developed and would first be deployed to SaaS environments, once testing and validation checks are complete. 

The full scale of the attack is still unknown. Though the attack itself is reminiscent of the JBS and Colonial Pipeline attacks earlier this year, its victims make this attack stand out. The scale of the attack is yet unclear, but in a statement the FBI said that they “may be unable to respond to each victim individually.” This shows that even though hackers got in through a single crack in Kaseya’s system, they managed to shut down potentially hundreds of servers—servers that an untold number of vendors of at least 17 countries rely on for their daily operations.

Coop, a Swedish grocery chain had to close most of its 800 stores for days, and a Swedish petrol station chain, pharmacies, the state railways, and public broadcaster SVT were also affected. An unnamed German IT services company reported that thousands of its customers were compromised, and two Dutch IT services companies, VelzArt and Hoppenbrouwer Techniek, fell victim, too. There is no way accurately to estimate the number of end users who had to halt business as a consequence of the attack. Kaseya CEO Fred Voccola said that the brunt of the burden will be borne mostly by small businesses like “dental practices, architecture firms, plastic surgery centers, libraries, things like that.”

This is what sets these supply chain attacks apart; while the culprits are anonymous hackers who feed on the chaos they cause, and the fault at least partially lies with multi-million dollar companies, those affected are everyday people running small businesses. NewPush President urges us to look at the human cost of such an attack.  “Imagine what it must be like for the victims. Imagine the florist, the dentist, the restaurant owner working hard every day, building something for their families. They’re pushed from every direction; they can’t afford to get into the nitty gritty of cybersecurity, can’t afford not to have an online presence, and they definitely cannot afford to pay huge ransoms.” 

The question on the minds of everyone involved is, “What’s next?” It goes without saying that the attackers want money. Originally, REvil posted ransom demands of up to $5 million in varying sums, mostly around $45,000 in crypto. They claimed to have affected more than a million computers. However, perhaps because they misjudged the scale of the attack themselves, they later moved to a single $70 million ransom to decrypt all systems. That amount would make this the highest ever single ransom paid—and not the first to break that record this year. 

Demands following ransomware attacks have shot up significantly in 2020, and 2021 managed to beat the previous year every month so far.

Less than a month ago, during their meeting in Geneva, US President Biden took Russian President Putin to task, saying that Russia has harboured cyber criminals long enough. He stated that if the Kremlin doesn’t increase efforts to clamp down on these gangs, that will lead to escalating conflict between them and the rest of the world. On Monday, Putin’s spokesman Dmitry Peskov professed no knowledge of this latest attack, and said that details could be discussed during future consultations—though there are no plans as yet for such meetings.

What’s more, a recent report by Trustwave SpiderLabs uncovered that avoiding Russian language systems was hard coded into the ransomware used in the Kaseya attack. "They don't want to annoy the local authorities, and they know they will be able to run their business much longer if they do it this way," said Ziv Mador, Trustwave SpiderLabs' vice president of security research. Trustwave said the ransomware "avoids systems that have default languages from what was the USSR region”.

On Saturday, 3 July, President Biden said he has directed intelligence services to investigate the Kaseya attack. He told reporters on tour in Michigan that he hadn’t l yet learned who was responsible. "The initial thinking was it was not the Russian government but we're not sure yet," he said.

The only thing certain amidst all this chaos is that ransomware is an ever-growing cybersecurity concern, and that IT services are still vulnerable to sophisticated attacks. I think we will continue to see headlines of highest-ever ransom demands, and we have to bear in mind that whatever makes the news is just the tip of the iceberg. Due to the nature of these attacks, both IT services providers and their clients will share as little of the details as possible. Companies need to take cybersecurity seriously and invest in it with adequate resources because the race between gangs of unleashed cyber criminals and cybersecurity firms is on.

A ransomware attack whose sophistication and scale go beyond anything we've ever seen has recently hit Kaseya, an IT Management Software provider. We look into what has been uncovered so far, and what experts think will happen next.

Kaseya 2021 - Thousands Compromised in Latest Ransomware Attack

Secure and protected passwords are the bedrock of every user’s internet security, the first and best defence against intruders into any system.

Back in more innocent times, when my entire presence online was a yahoo and an MSN messenger account, my password was the name of my dog, Rufus, and my year of birth. I kept using the same, signing up for pizza delivery, online games, even Gmail back then. What’s worse, I considered myself an advanced user, someone who knows better than to use passwords like 123456 or password (still on NordPass’ list of most common passwords in 2020). 

I also remember that we were specifically told never to write passwords on a piece of paper for fear of that paper falling into the wrong hands.

Now, thanks to mandatory cybersecurity training and rising public awareness of the dangers users face if they’re victims of a data breach, I know better. It’s fairly common best practice advice to use different passwords on each account, preferably random words (or, even better, letters and symbols) that have no meaning to you, so they can’t easily be guessed knowing a few facts about your life.

Top tips for creating strong passwords are well known; create long strings of random letters, enlist a mix of characters, don’t use keyboard paths (like QWERTY), and change passwords regularly.

The best, most secure passwords are gobbledygook—utter nonsense. However, there are those of us who like to have some fun with their login, or make a challenge of memorising multiple passphrases. A good method for them is known as the Bruce Schneier Method. All you need is a memorable sentence (say, Are you suggesting that coconuts migrate?) and a rule (take the first and last letter of every word) to come up with AeYuSgTtCsMe?, a password that would take 180 Million years to crack. 

This deluge of passwords is a bit of a pain to keep track of, but thankfully, password managing services popped faster than you can say multi-factor authentication, so remembering all those random words and letters wasn’t an issue for long. Google have their own Password Manager, there’s Norton’s own, 1Password, and a host of other services to choose from. Most work with the more popular browsers, as well as on your Android or iOS device. 

So there’s a place for all our login data, and some of these apps even suggest strong passwords during signup for a new site. Google’s own password manager has an integrated Password Checkup feature which compares stored passwords against the millions of known compromised accounts that have been leaked in major breaches, and warns users if their passwords are already out there. They’ve even integrated change password links to make it easier for users to rectify the issue. 

All this is very convenient and totally free to use. Google’s Chrome, Microsoft’s Edge, and Mozilla’s Firefox all offer similar services to help users come up with and then store their passwords.

As long as I am logged in to my PC or phone, password managers fill in my logins on every site where I saved them. Alternatively, I can go to Settings to see a list of all my saved accounts, and can see each individual password if I enter my device’s login or PIN because all my passwords are stored in the device hardware. Chrome encrypts my logins with a key known only to my device, then sends an obscured copy of my data to Google. Firefox, if you have Sync functionality enabled, does the same. In other words, there’s decent protection on your login data, as long as access to your devices is controlled. 

This is all supremely convenient. However, there is an argument to be made that the downside of having password managers suggest, store, and insert your passwords is that they create a single point of failure. In other words, access to your device means access to all your logins.

A way around this issue is to create two-part passwords. One part is unique to each account, that’s the part the password manager gets to remember. The other part, which may be inserted anywhere in the password, is a phrase that repeats in all your passwords—this, you will have to simply remember. Whenever a login pops up, the password manager fills in part of the password, then the user inserts a little extra. This way, attackers will be left with incomplete passwords even if they gain access to your device, while the user doesn’t need to forgo all the convenience of the service.

The level of protection either browser-integrated or independent password managers provide may vary somewhat, but they all still require major know-how or brute force to crack. If access to accounts is what they’re after, hackers know that there are easier ways in through phishing and social engineering. Social media seem tailor-made for such attempts. We’ve all seen posts about incredible sales and unbelievable giveaways on Facebook or Instagram, which might scream scam to users who have gone through phishing training, but many still fall for them. Access to those accounts then provide credible gateways to the users’ friends, and so on. 

Funny and playful posts along the lines of Your hero name is the name of your first pet and the month you were born! crop up now and again, and answers provide little bits of information to attackers. After some investigative work and with a bit of luck, it’s possible to piece together enough, and gain access to just one account connected to someone inside a company (or an acquaintance of theirs). It’s not easy, but they only have to win once. 

It may be a difficult task to completely secure passwords, but there are a few rules of thumb. 

Use random words or (even better) random characters

Shun words with a personal connection like pet names, or significant dates

As we’ve seen, there are multiple ways to heed this final piece of advice. The objective here is to make absolutely sure that no-one has access, and there are many ways that provide varying levels of protection. I find myself going back and reconsidering one of the earliest pieces of advice I received: Never ever write down your passwords. 

Passwords are like keys, they’re required to open access points, the same way I use my keys to enter my home, similar to how I use my ID at the bank where I am then allowed to initiate transfers and so on. I have to guard these objects jealously, and I’d run into trouble if they fell into the wrong hands—much like my passwords.

The crypto world actually recognises the merits of analogue notes. When you create a wallet, you are advised to write down your recovery phrase (a randomly generated set of 12-24 words, also known as mnemonic seed, wallet backup, etc.) and store it securely; this is your ultimate backup for recovery. It’s all about how users treat their notes: discarding them willy-nilly, leaving them taped to a screen, or losing them in heaps of other papers leads to endless trouble, but keeping them safe and away from prying eyes could be a good way to secure your logins.

Ultimately, the best method depends on use as well as risk, and one solution won’t work for everyone. There is only one golden rule to follow, whatever your circumstances.

Finally, let me leave you with this nugget of wisdom from Chris Pirillo.

Passwords are like underwear. Don't leave them out where people can see them, change them regularly, and don't loan 'em out.

Secure and protected passwords are the bedrock of every user’s internet security, but coming up with new passwords for each account, as well as securely storing all your data presents a daily challenge.

Passwords - Nothing stays secret forever

Possibly the worst security breach ever has left organisations reeling, but consensus on the best ways to respond is still far out of reach.

What was described by Microsoft President Brad Smith as the “largest and most sophisticated attack the world has ever seen” should have been enough to make the world sit up and pay attention. But when the story broke in December 2020, there were many other global events that meant the SolarWinds Orion Hack didn’t get the attention it deserved. The US government is now facing a possible 18 months to recovery, according to the acting head of CISA, Brandon Wales. 

SolarWinds is the name of the software company that provides network management services to thousands of government and private organisations worldwide through a platform called Orion. The attackers installed malware by rewriting 4,032 lines of code in a software update that opened up a backdoor to 18,000 organisations around the world. When the update went live, all of these were infected with the malware, with the unwitting approval of SolarWinds. 

The attack was less a conventional cyber attack than a complex form of espionage. It was first discovered in November 2020 by cybersecurity firm, FireEye, who reported the hack on 13 December. It was only revealed when a FireEye employee noticed two phones registered for the multi-factor authentication of another employee. The hackers had apparently found their way into the system by impersonating employees and investigating the company, but there is still no definitive evidence of this. 

Although the malware campaign first came to light in December, the intrusion went undetected for months. The SUNBURST malware was deployed for the update in February 2020 and it became available for customers in the following month. 

Brad Smith reckoned that the attack had been the work of “at least 1,000 very skilled, very capable engineers.” 

At first, the FBI, NSA, and CISA have attributed the attack to Russian Intelligence, and later confirmed that they found evidence linking the attack on both SolarWinds and Colonial Pipeline to cyber criminals likely based in Russia, though not directly tied to the Russian government. In April, the Biden Administration imposed sanctions on Russia in retaliation for the attacks, and further pressed their concern over Russia harbouring criminal activity. President Biden said after the Geneva summit with president Putin that the US will not allow such attacks to go on without consequence. In addition to the sanctions, Biden said, “I pointed out to him we have significant cyber capability, and he knows it, he doesn’t know exactly what it is, but it’s significant “ and “if they violate these basic norms, we will respond.”

We now know that at least nine federal agencies were compromised, including the Department of Justice and the Nuclear Weapons Agency, as well as 100 private firms. The attack on the government is limited to unclassified systems but its scope has been enormous. The full extent of the attack is still unknown, but it is thought that the hackers were able to leave additional backdoors and that the malware spread to other systems. 

A Senate Intelligence Committee hearing in February 2021 saw that it was not only Orion users that were infected with the malware. Almost a third of the breaches were not caused by Orion software. Some organisations still don’t know if they were hacked or not, and it could be years before government networks are completely secure.   

Initial reactions to the SolarWinds Orion hack

There is no doubt that the magnitude and capabilities of this new variety of this attack are alarming. In the case of SolarWinds, attackers have revealed the kinds of devastating breaches they have the capacity to unleash, though the damage here has so far been kept to a minimum. Still, the breach escaped the notice of numerous IT departments, tech giants like Microsoft, and the U.S. Government—which doesn’t bode well for the future. Business leaders now face the possibility of indiscriminate attacks that are apparently out of their control. 

There has been a mixed response from those affected, which is not just the organisations using Orion software, but a wider web of unsuspecting victims. A sophisticated attack of this scale has shown its potential in deceiving some of the most advanced security systems on the planet, and is continuing to evade them. As a full recovery for the US government could take well over a year, many executives will see a breach of this size as a resounding wake-up call. 

But corporations have been anything but unified in their response to the SolarWinds Orion breach. Microsoft claims that all of the attacks they could identify were against systems on-premises. President Brad Smith said at the committee hearing that “cloud security is essential to improving security maturity across many organizations”. He also said that the levels of detection within the cloud are more advanced than those of an on-site environment. Microsoft has suggested in their blog that a blended or hybrid approach to data storage leaves an additional seam to be secured, and a focal point for attacks on cloud services.  

But this view is not shared by all. Senior Vice President of Hybrid Cloud Services at Hewlett Packard, Keith White, said that many customers believe internal storage to be safer and they prefer to know where their data is located. Hewlett Packard customers have not been found to be affected by the SolarWinds breach. 

Senior Vice President of Cloud Business at Dell, Deepak Patil, also brings Microsoft’s criticisms of hybrid cloud into question. He says that “for a majority of customers, their workloads run on-premises”, so a complete migration to the cloud is not even practical. 

Red Hat is the company providing hybrid cloud services that IBM acquired in 2019. Its chief executive, Paul Cormier, told the Wall Street Journal that “Any software could get broken into. The cloud providers could get broken into as well”. 

This lack of consensus on the security of cloud approaches leaves many businesses in a state of uncertainty over how to restructure their services in the post-SolarWinds era.    

Corporate interests come before IT security

It is easy to see from the disagreement in cloud approaches that the leading providers are putting their own interests first, rather than the security of their customers. 

As one of the largest cloud providers in the world, it is no surprise that Microsoft has pushed for an increased use of cloud as the best security option. In the last decade, Microsoft and Amazon have been market leaders in popularizing pay-as-you-go remote software services as a business model. Amazon has so far been able to steer clear of the SolarWinds issue, though its data centres were used in launching part of the attack, so it was suggested they should have given evidence at the recent Senate committee hearing.  

Although Microsoft also provides security for on-premises deployments, the company suggests that this is the more challenging option in terms of security as their primary interests are in cloud migration. On the other hand, companies that provide hybrid cloud options recommend an approach that combines the cloud with on-site deployments. Advocates of both of these contrasting approaches give security as the main reason for adoption but few opinions put forward are without bias. 

For enterprises that are looking for a robust response to the unsettling future that the SolarWinds hack presents, it would be wise to look beyond the distracting issue of warring cloud providers. While the security of your cloud strategy should not be downplayed, it is not the only concern in preparing for sophisticated and large-scale advanced persistent threats. 

It is recommended that organisations review their incident response plans and develop or revoke them as needed. This must be informed by new facts uncovered, as well as by input from external sources, and it needs to be coordinated across the organisation. An in-depth investigation is required for all software that has been compromised. 

For federal agencies, an emergency directive was issued by CISA that enumerates ways to identify the data that was compromised by the malware from Orion, and measures to reduce risk for this breach. Businesses should also review their agreements with third-party vendors and see which of these have been using Orion. They should also consider how they will communicate the issue towards their partners, customers, and employees within their community. 

But in the larger picture, all businesses could benefit by introducing a new form of security that makes all of the important connections in an organization before cyber criminals are able to. Vulnerabilities are found in the places where the solutions of an organisation are disjointed, so what is needed is a connective tissue that can bring together key elements at every operational level.

In the case of the SolarWinds Orion hack, enterprises and government bodies have been compromised by a third-party supplier and while their cloud strategies may have been able to mitigate the damage, they probably would not have prevented the breach. A powerful connective tissue has the potential to reduce the disorder created by the use of multiple independent tools, and puts organisations in a better position to combat attacks from every angle. 

There are still many unknowns surrounding the attack, and we have yet to find a silver bullet that can faultlessly safeguard against this level of sophistication. But that is not to say we cannot deploy sophisticated solutions with the ability to detect threats and reduce risk. 

Security solutions offered by NewPush provide ways for dealing with the approaches used by the SolarWinds attackers. Bob Besharat,  Executive Director of R&D and Security Portfolio at NewPush, makes the following points concerning the breach and the capabilities of NewPush products:

The SolarWinds Attackers used elevating credentials to steal certificates 

Through its regular reviews, TrACE Identity would pick up on this activity. Access Audit is a comprehensive tool with the ability to detect unusual behaviour in identity management, so the espionage against SolarWinds employees would have been noticed. 

The attackers used vulnerabilities to execute malware remotely

With TrACE Shield, organisations are able to identify the vulnerabilities that allow remote execution. TrACE Shield also notices unusual activity through the use of Intrusion Prevention/Detection System (IPS/IDS) or Endpoint Detection and Response(EDR). 

The attackers used known vulnerabilities (CVE-2020-14005 and CVE-2020-13169) to exfiltrate data from the victim's environment 

These vulnerabilities are identified using our TrACE Platform, so provided the severity reaches the right level, the situation is addressed. 

The attackers used known malware (Kazuar) to penetrate

The discovery of this malware by any anti-malware (AM) program immediately triggers alarm due to AM integration into TrACE Shield.

A vast, sophisticated attack like SolarWinds is able to compromise government agencies and IT corporations because this level of connectedness is not in common deployment. What organisations are in need of now more than ever, is an intelligent connective platform that leaves no room for malicious intruders or, at the very least, reduces risk to an absolute minimum.

The Connective Platform™ integrates a host of cybersecurity tools into one system faster than any of our competitors, but that alone wouldn't give our partners the edge over cybercriminals. Simply gathering all the data from a number of connected elements would still require an army of experts to make sense of it; it's analogous to how gathering stock prices from markets all around the world doesn't tell you where to invest your money next. Our platform goes on to analyse that massive amount of data to give our partners the information they need: where the weak points of their cyber defence are, and how to address them.

 The SolarWinds attack was, to date, the largest scale cyber attack that affected hundreds of organisations. Because it went undetected for so long, its reach and effects are still the subject of investigation, and there will be ongoing debate as to the ways to prevent such attacks in the future.

Reactions to The SolarWinds Orion Hack

Have you given any thought to your SIM card lately? I have been using mine for nearly a decade now, and tend to forget that it even exists until it’s time to get a new phone. That’s the only time I see it, as I go through the fiddly procedure of getting the tiny card into the card tray,  and negotiating the assembly into the card slot—I always swear that I’ll get a new card, one that’s cut more precisely, then forget about it until the next time.

You and I might forget about the little card, consider it part of our phones, but scammers know that a SIM card is all they need to hijack a person’s entire online presence.

A friend working for a phone carrier shared the story of an older gentleman who had his Google account taken over after he was directed to make a few calls.

On a Monday morning, the man, let’s call him Jack, received a text letting him know that he won two tickets to a cruise, and all he had to do was call the provided number and claim his prize. He was excited, and dialled straight away. Unfortunately, the first number didn’t work—some technical problem the company was very sorry about—and he was directed to make another call. He rang the second number, where a recorded voice informed him that the cruise was cancelled. Shame, he thought, would have been fun.


That was the last Jack thought of the whole episode, but little did he know that his troubles had just begun.


The next day, Jack woke to a notification from Google on his phone: your password was successfully changed. He went into a panic. There have been stories of hacked accounts, but Jack never thought he’d be a target, he was hardly wealthy, after all. But that didn’t matter. With access to his Google account, scammers found the photo of his passport he sent to his son, found the doc where he kept all his passwords, gained access to his online banking, and made off with his entire savings account. It took almost a year for Jack to regain control of all his accounts. Thankfully, he had family and friends to help him out in the meantime, but his personal data is still out there, giving him sleepless nights.

What happened to Jack is by no means unique. Scammers gained access to his SIM card, because the recovery procedure Jack’s mobile provider was using was faulty. The same thing happened to Twitter CEO Jack Dorsey, in 2019, when he inexplicably started tweeting racial slurs and praise for Adolf Hitler.

If you want to keep using your phone as the backup for your Google account, make sure that you don’t call unknown numbers, or contact your provider to learn about their security procedures. Better still, all Goggle customers have the option to use their smartphones for two-step verification; this way, users can confirm their login through a pop-up on their phone (Android and IOS options available).


Connective Platform™ integrates a host of cybersecurity tools into one system faster than any of our competitors, but that alone wouldn't give our clients the edge over cybercriminals. Simply gathering all the data from a number of connected elements would still require an army of experts to make sense of it; it's analogous to how gathering stock prices from markets all around the world doesn't tell you where to invest your money next. Our platform goes on to analyse that massive amount of data to give our partners the information they need: where the weak points of their cyber defence are, and how to address them.

Scammers get very creative in gaining access to user data, and some US mobile providers' security systems allow for a little-thought-of way in. What is a SIM Swap Scam, and how can it be avoided?

The Little Card That Could

In a world where more and more aspects of our professional and personal lives are moving to the online space, it's not enough to say that cybersecurity is important, we need to take a close look at individual aspects of our cyber defences. 

Companies of all sizes, as well as cybersecurity providers are in a constant race with cybercriminals: as one develops new solutions, the other improves their techniques, and new threats arise. Our aim is to help companies to overcome these challenges. 

The cybersecurity solutions required by organisations (with scores of users and multiple devices for each user) may roughly be sorted into the technical, which is a vast and varied category, and the personal, which are solutions that address mistakes users can and do make. As necessary as securing systems is, neglecting the human element can leave organisations open to attacks that target users directly.

The Achilles’ heel of all security systems is the human element, and who is in a better position to help over 37,000 companies worldwide but The World's Most Wanted Hacker? Kevin Mitnick incorporated his own social engineering tactics in the design of KnowBe4’s New-school security awareness training.

At NewPush we see the system developed by KnowBe4 as the perfect complement to our Connective Platform™: IT Security and Compliance dashboards driving targeted training are enhancing cybersecurity and identifying risk.  Thanks to our unique integration approach, our Connective Platform™ is strengthening the KnowBe4 system to provide analysis and functionality that is otherwise unavailable.

The trends of increasing numbers of connected devices and more people working remotely necessarily engender more sophisticated techniques from bad actors intent on breaching the defences protecting those devices and people. Just one example from many is Phishing via text messages, also known as Smishing. This is a type of social engineering attack that relies on and exploits people's trust, circumventing technical safeguards. Smishing is an effective means of attack for the same reason SMS marketing is effective: 98% of text messages are read as opposed to 21.33% of emails. Once it's got the user's attention, the scam is already miles ahead of the email-based variety. Response rates are also higher; SMS messages elicit a reaction 45% of the time, as opposed to email's 8%.

As a form of Phishing, these texts will contain a link of some sort, but as an added security risk, the sender of the text is not authenticated beyond the attached phone number, and even that can be manipulated. Cybercriminals often use one of two general methods when going Smishing.

Malware—the URL in the text might trick users into downloading malicious software masquerading as a legitimate app. Once the software is installed, it might ask the user for all kinds of permissions, start sending their personal data, and take over their phone.

Phishing site—just like in the case of emails, the link could also lead to a site that tricks the user into giving away their username, personal information, or access to systems, Sites like these are designed to look just like reputable ones belonging to banks, service providers, or the users' own organisations'.

KnowBe4 has been warning users about Smishing and its coming rise for years; their knowledge of the deep, which they integrated into their training, is both extensive and up-to-date.

Smishing is just another form of phishing. Scammers are hugely motivated to innovate as well as pursue existing tactics.

Users are catching on to COVID-19 phishing tactics

Thanks to a global effort the coronavirus pandemic has entered a slow downward curve, but living with the virus for over a year has changed our lives in countless ways. One small positive effect was that continued exposure has honed users’ senses in spotting COVID-related email scams. Unfortunately, as users are catching on to these tactics, cybercriminals are turning to social media phishing emails. According to the Q1 2021 top-clicked phishing report compiled by KnowBe4, LinkedIn and Facebook are emerging as favourites for social-media themed phishing attempts. Watch out for emails with subjects like You appeared in new searches this week!, Please add me to your LinkedIn network, or Your friend tagged you in a photo on Facebook.

The report examined tens of thousands of real examples of phishing emails reported to IT departments as suspicious, looking for recurring, general subject lines. The leader, with 31% was some version of Password Check Required Immediately, and the list continued with fake updates on sick-time policy (15%), remote work policy (13%), and vaccine interest (10%).

Advice from Stu Sjouwerman, CEO of KnowBe4

‘Always check with your IT department through a known good phone number, email address or internal system before clicking on an email related to checking or changing a password because it only takes one wrong click to cause monumental damage.’

As anyone who has ever attended cybersecurity training knows, keeping trainees engaged with the material is perhaps the major challenge educators have to face. There are external incentives organisations can utilise when directing their employees to attend training, but the abstract nature of the threat against which the classes aim to arm users means that keeping up the interest is no mean feat.

Any training programme worth its salt has to address the issue of participant interest, since the effectiveness of the training is directly linked to engagement. Clearly, if users leave the classroom only to commit the blunders they were trained to avoid, their time would have been better spent watching Amazon Prime instead. Hang on... who says they can't do both?

The first season of the award-winning KnowBe4 original security thriller, The Inside Man has just been released on Amazon Prime video, making the popular educational series available to broader audiences.

Inside Man Season 1 Trailer

The show, now on its third series, deals with topics like social engineering, physical security, insider threats, and deepfakes through the all-too-human story of Mark Shepherd, a hacker-cum-hero embroiled in a sinister plot to penetrate Khromacom corporation. The show’s been praised for adding entertainment value to security training and shining a light on the human cost of cybercrime.

I gotta say – this series is a blast! Sure, it’s educational but, I confess, I watched each episode to see what happens next. There is no “dry” teaching in this series but learn you will!

Technical aspects of cybersecurity aside, improving employee training is the best investment a company can make. Let's look at social engineering tactics, Smishing and Phishing, and the training programme Kevin Mitnick developed.

Building a human firewall —an essential weapon in your arsenal

Four Vulnerabilities of Higher Education in IT Security

Although cybercrime has seen steady growth in recent years, 2020 has been a particularly devastating year. Global ransomware showed a year-on-year increase of 715 percent. A quantitative change on this scale suggests that bad actors fully intend on capitalising on changes the global pandemic has brought about, mainly remote work practices and organisations' lack of preparedness as masses of users leave the relative safely of the office environment to work from home.

The education sector in particular saw a 30 percent increase in cyber attacks in the U.S. in July and August 2020, according to a study from Check Point. This figure seems all the more concerning when compared to an average of 6.5 percent increase in all other sectors. It is part of a general trend in increased cyberattacks in education throughout the year, across the U.S.A, Europe, and Asia, which has affected educational organisations all across the board. 

Though cyber attacks are increasingly common, institutes of higher education are understandably reluctant to disclose the details of attacks. Time and again, as news of ransomware attacks on universities and colleges surface, information on the ransom paid or the exact nature of the attack is withheld.  

Clearly, cyber criminals have increased their efforts in 2020, and the education sector has been identified as a prime target. High profile attacks on higher education have included the following:

Michigan State University was hit by NetWalker malware, which enabled attackers to steal sensitive data, however, the ransom money was not paid. The same university was victim to another breach later in the year, through their online shop. 

The University of California San Francisco reported the payment of $1.14 million in bitcoin to recover data from the School of Medicine from the NetWalker criminal group.

The University of Utah paid a ransom of $457,000 in bitcoin to an unnamed group for a decryption key to return student and faculty data. 

By breaking into the cyber-assets of the University of Oxford and Samsung Canada, attackers were able to send out phishing emails to Office 365 users. This meant the emails were genuinely from the Oxford University system though the method was fraudulent. A link in the emails redirected users to a webpage asking for their Office 365 credentials.

Both Northumbria and Newcastle Universities in the northeast of England were hit by attacks that caused the former to close down temporarily, and the latter to suffer weeks of disruption.

Though higher education institutions are emerging as a prime target for ransomware attacks, the larger part of the increase can be attributed to DDoS attacks. These saw a 350 percent year-on-year increase in the first six months of 2020, according to Kaspersky. 

One of the biggest causes of cyber attacks in higher education is the various methods of phishing that cyber criminals use to gain access to universities' internal systems, networks, or servers. 

Many see the sharp increase in this kind of attack as an inevitable consequence of the shift to remote access. 

What makes higher education so vulnerable?

It seems that many who have access to universities' networks could be better educated when it comes to cybersecurity. Though they may come from a diverse range of fields of study, it is possible to offer them the same basic training in how to avoid typical mistakes, recognise most common threats. This is especially important as universities use expansive networks that often incorporate external elements of widely varying levels of security.

Unfortunately, a self-reported 54 percent of educators is unfamiliar with the threats of ransomware and common cyber attacks, with as much as 16 percent admitting to a complete lack of knowledge on the subject. Only a small proportion of educators know how to respond to phishing emails or what to do after clicking a malicious link. In addition to this, as many as 30 percent of security breaches in the institutions of higher education surveyed were traced back to “unintentional disclosure” as students were fooled by phishing emails or misused social media. 

While educational institutions are geared at the open exchange of information, IT security measures aim to restrict access to sensitive data. Across a large organisation, students and teachers often choose to share material that, in legal terms, might belong to the university or third parties. Controlling this information at every level and endpoint can be a considerable challenge for security teams. Including classrooms and on-campus dormitories, universities represent large surface areas for hackers to target. 

Universities and research facilities that work closely with the government could have additional security concerns in terms of national security. Another challenge is to find vendors that can handle organizational issues and protect sensitive data while enabling an appropriate level of information sharing. 

Institutions of higher education are often dependent on public or private funding, and when funds run low, one of the areas to be hit by budget cuts is cybersecurity. After a year that has already seen a significant reduction in student enrolment, funding will inevitably be more difficult to access. Across the entire network of a university, there are thousands of endpoints that need to be secured and users that need to be properly educated in everyday security practices. This, of course, takes additional funding, which many university and college administrators may struggle to access. 

Universities and colleges are often at the disadvantage of falling under the requirements of various sets of regulatory compliance. Those with medical facilities, or even just processing medical records or offering health plans, will need to meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA). Those that are using payment card systems to process card transactions can only do so within the constraints of the Payment Card Industry Data Security Standard (PCI-DSS). Institutions that partner with government agencies will need to check regulations like the Federal Information Security and Management Act (FISMA) among others. 

In 2020, institutions of higher education were hit by a wave of cyberattacks in an especially difficult year. This trend is likely to continue in the near future, as colleges and universities hold a large amount of valuable sensitive data and they are relatively likely to pay ransoms. Institutions around the world are presented with a series of challenges in gaining complete control of data, security, and compliance, but with the right tools and organisation these challenges are theirs to overcome.


Learn how the groundbreaking and sophisticated IT security solutions from NewPush can take your organisation to another level of security and compliance.


Cybercrime shot up in 2020, and institutes of higher education are near the top of the target list. Hackers looking for ways in have an easy job with faculty and students largely unaware of the dangers and unfamiliar with phishing tactics.  

The COVID-19 pandemic has seen a huge rise in cybercrime with the healthcare sector having been one of the main targets. Clearly, healthcare organizations (HCO) faced with the biggest public health crisis in memory didn’t need this added distraction and threat. 

It’s difficult to comprehend the thinking of criminals who would carry out such attacks, but some cybercrime gangs such as Maze have claimed the moral high ground and indicated that they will stop attacks on healthcare organizations during the pandemic. Of course, no-one can be sure how much we can trust such declarations.

The coronavirus pandemic has caused terrible losses and damage that has been added to by a rise in cybercrime. But to make matters much worse, cyberattacks have been particularly damaging for the healthcare sector. 

Attacks targeted healthcare at an early stage in the pandemic

Microsoft reported that ransomware groups had planned for months to activate multiple attacks in the first two weeks of April 2020. Data from a detection and response team showed that in many cases the compromises that enabled these attacks occurred in the months before, but the attackers were waiting for the critical moment at which they could maximize their financial gain. Unsurprisingly, this came at the time when HCOs were at their most vulnerable. These kinds of Advanced Persistent Threat (APT) attacks commonly breach networks by exploiting basic levels of authentication, or outdated systems and servers. 

There was a 45% increase in cyber attacks on healthcare in the last two months of 2020

A report from Check Point showed a sharp increase on previous months which appears to have been financially motivated. For other industry sectors, the average rise in attacks for the period was 22% – less than half that of the attacks targeting HCOs. The data showed a weekly average of 626 attacks for every HCO in November, as compared with 430 in the previous month. This increase included ransomware, Distributed Denial Of Service (DDOS) attacks, botnets, and remote code execution. By far the biggest rise was in ransomware attacks, mainly from the Ryuk and Sodinokibi ransomware groups. 

A greater dependency on remote access has increased risks to organizations

The coronavirus pandemic has led to a huge increase in employees working remotely. This tendency has amplified security risks from a number of sources such as vulnerable network infrastructures and poor security on mobile devices. This is particularly true in the healthcare industry, where a higher level of vulnerabilities is caused by employees that need immediate access to organizational data and are therefore dependent on mobile devices to access their networks. It only takes a single compromised device for hackers to access the entire network and launch a damaging attack. 

Healthcare organizations are often much more susceptible to attacks

Unfortunately HCOs can often be seen as an easy target for hackers. Recent advances in healthcare technology have meant that there is a wide range of connected devices and equipment throughout well-equipped hospitals and medical centers. This means that there are more endpoints for hackers to target and then access the server. The devices do not actually need to be connected to the corporate network to represent a potential entry point.

This is only the beginning of the security challenges for healthcare organizations. The very nature of HCOs means that information needs to be shared immediately and constantly. During a medical emergency, security is naturally not the first concern. Hospitals frequently have busy schedules and limited budgets so they can be slow to update computer systems, which makes them more vulnerable to security breaches. Healthcare workers are also often pushed to their limits so it is easy for best security practices and safeguards to be neglected. 

Attacks on healthcare organizations are more profitable for cybercriminals

One thing that attracts hackers to HCOs is that they store a large amount of confidential data which is a valuable commodity in their eyes. They are easily able to sell this valuable data to others who can profit from it, and this makes the healthcare sector an increasingly common target for attacks. Due to regulations like HIPAA and GDPR, HCOs have more reason to avoid data breaches that could result in heavy penalties. Sadly, this means that they can be identified as organizations that are more likely to pay ransoms which, in turn, makes them more attractive prospects for attackers.

The security challenges faced by healthcare organizations have intensified during the coronavirus pandemic, which has already had a devastating impact throughout the world. Cyber threats are constantly evolving so security measures need to be sufficiently sophisticated and HCOs vigilant to deal with Advanced Persistent Threats (APT) and other attacks. HCOs can no longer afford to deploy anything but the highest level of security defences to ensure they are not the next victim of pernicious cyber attacks. 

NewPush are the security and compliance experts that optimize cyber defences for every healthcare organization.

The major trends that have affected the healthcare industry in the coronavirus period as a way of preparing the organizations involved. 

Cyber Threats to the Healthcare Sector in the New Normal

Wherever you are in the world and whatever your occupation, we have all been affected by the coronavirus pandemic. In the first few months, there was a widely held hope that the damage would be minimal and short-lived, but as time passed and the threats have remained, more people have realized that the virus is unlikely to be eliminated in the near future. This leaves us in the position of making all of the necessary adjustments and best practices for survival in a very different environment. 

Best Security Practices for Enterprises in the Post-COVID World

As COVID-19 quickly spread around the world, another pernicious threat caused damage to public and private organizations. A report from the FBI showed that cybercrime figures rose by as much as 300 percent in the wake of the pandemic. Some attackers also displayed a chilling disregard for human life by targeting healthcare facilities and research centers.  

Although cybersecurity was of paramount importance to all organizations before 2020, the coronavirus pandemic has ushered in a new era in which defenses must be secured on a continual basis. This can be achieved by implementing the following best practices. 

1. Introduce an updated organization-wide security policy that is clear and strictly followed 

When there is a clear security policy that is communicated to all levels of the organization and strictly enforced, there is a much lower chance of bad practices creeping in without notice. Employees can be found guilty of compromising security by breaking protocol to save time, while in other cases they may be unaware of their negligence due to a failure in communication. COVID-19 has brought about a disruption in working routines and security measures, so it is probably best to create a new security policy that is better aligned with your organizational changes. The next stage is to ensure it is rigorously enforced. 

2. Make use of a secure Virtual Private Network (VPN) for all of your remote employees

Providing your employees with VPN access is a minimum requirement for enterprises that offer their employees the chance to work remotely. This provides an encrypted connection to the corporate network when it is accessed over the public internet. Without this, employees that are gaining access to the network while working from home would be vulnerable to attacks from cybercriminals that have adapted to the new mode of working. A respected VPN service must be used that is reliable and secure. 

3. Secure all of the endpoint devices that are connecting to your corporate network

When there are multiple devices that are able to gain access to sensitive data on the cloud network, there is a greater number of vulnerabilities that hackers can identify and exploit. This means keeping to a strict bring your own device (BYOD) practice as part of your security policy and securing all endpoint devices that are used internally. All devices must be tested to ensure they meet the security requirements detailed in the policy, they must have adequate security software and ready for the use of detection and monitoring. 

4. Ensure that all of your remote employees have all of the security measures in place and are not compromised in any way

In addition to installing a VPN, there are some other security practices that need to be kept to when your staff is working remotely. Multi-factor authentication (MFA) is an important way of securing remote access, in which at least two forms of verification are used in the authentication process. This may be a slight inconvenience for individuals but according to Microsoft, it can potentially block 99.9 percent of account attacks. Other good practices are to reset home Wi-Fi routers, which may be open to attacks when default passwords are not changed, and introducing a password management policy.  

5. Enforce a higher level of encryption for all data used by the enterprise

Encryption is an essential measure to secure different types of data that is vulnerable to attacks. This is especially important for sensitive data, such as personal information and financial records. Cloud data that is both stored and in transit must be encrypted so that vulnerabilities cannot be easily identified by attackers. Encryption may be symmetrical or asymmetrical, it may use the AES standard, and it may be applied to files, folders, volumes, or whole disks. There are many encryption services, such as BitLocker or FileVault.  

6. Maintain very high standards when choosing your vendors