Insider vs. Outsider: What’s the Greater Security Risk?
Posted on by Zuly GonzalezCategories SecurityLeave a comment on Insider vs. Outsider: What’s the Greater Security Risk?

Beau Adkins - CEO of Light Point SecurityThe Digital Guardian asked 47 security experts to discuss what they think is a bigger threat to an organization, an insider or an outsider. Light Point Security’s CTO, Beau Adkins, was invited to participate on the panel of security experts to discuss what he has seen over the course of his career. Here’s what he had to say:

“In my experience, the biggest threat to a company’s data is posed by…”

Insiders. However, they are most often not deliberately a threat. Outsiders are the ones who have bad intentions, but they don’t have access. Network restrictions are usually strong enough to keep them out. So instead they focus their efforts on tricking unsuspecting insiders into opening the doors for them. And once inside, they are indistinguishable from the insiders.

Employee web browsing is one of the most used pathways to accomplish this. Outsiders set up a website capable of exploiting any computer that browses to it, then they send emails to the insiders that entice them to click a link to that site. Most employees will not take the bait, but it just takes one person to give in to curiosity and click the link.

Malicious outsiders are very good at this. They can craft emails that look like they are from someone within the company and reference projects or people that the recipient knows. It can be very difficult to tell these emails are not legitimate. With a little perseverance, it’s just a matter of time before someone clicks.

Because of this, efforts to protect the company from malicious outsiders can only go so far. Companies today must prioritize protecting against threats from their own insiders. One employee clicking the wrong link doesn’t have to put the whole company at risk.

Check out what the other experts had to say by reading the full article on Digital Guardian.

Why Ransomware Gangs Love the Healthcare Industry
Posted on by Zuly GonzalezCategories Computer Security, Security, Web SecurityLeave a comment on Why Ransomware Gangs Love the Healthcare Industry

Ransomware Costs Healthcare MillionsRansomware. It’s the latest buzzword, and everyone is talking about it, especially in healthcare.

Ransomware has become increasingly prevalent over the last year because it’s been so successful for the bad guys. According to the FBI, cyber criminals are on pace to collect $1 billion from ransomware payments in 2016. And data breach response insurance provider, Beazley, projects ransomware attacks will grow 670% from 2014 to 2016. That’s insane!

The statistics for the healthcare industry are even grimmer. Healthcare is the most breached industry. It sees 340% more security incidents and attacks than the average industry, and is more than 200% more likely to encounter data theft. Healthcare is 4 times more likely to be impacted by advanced malware than any other industry, and is 4.5 times more likely to be impacted by ransomware. And healthcare is 74% more likely to be impacted by phishing attacks than any other sector.

The Impact of Ransomware on Healthcare

A successful breach on a healthcare organization can mean:

  1. the loss of money,
  2. the loss of brand reputation,
  3. the loss of Protected Health Information (PHI), and sadly
  4. the potential loss of life.

According to the Ponemon Institute’s 2015 Cost of Data Breach Study, the healthcare industry has the highest cost per record stolen of any industry at $363 per stolen record.

Unique to the healthcare industry, the impact of malware isn’t just a matter of losing money. As dramatic as it may sound, people’s lives are at stake. What happens if a hospital’s systems are down because of malware or a ransomware attack, and they can’t provide emergency services to a patient? Could that patient lose their life? Or could the delay in service cause additional health complications for that patient?

As an example, when MedStar was recently locked out of their systems as a result of a ransomware attack, they were unable to provide radiation treatment to cancer patients for several days. This is serious!

What Makes Healthcare a Prime Target

There are 3 main reasons why the healthcare sector is targeted so much by cyber criminals.

  1. Healthcare records contain the most valuable information. The data healthcare organizations store on patients includes personal identities and medical histories, which makes it a very complete data set. This is a goldmine for identity thieves. This is why healthcare records are about 10 times more valuable than credit card details on the black market.
  2. Healthcare data doesn’t change. Unlike other types of data cyber criminals steal, patient data stored by healthcare organizations can’t be easily changed. If your credit card company gets breached, you can easily change your username and password, and get a new credit card number. No big deal. But if your hospital gets breached, you can’t just go get a new social security number. Compromised health information can haunt you for a lifetime.
  3. Healthcare organizations don’t prioritize security. Because the healthcare sector in general hasn’t kept up-to-date with modern security practices like other industries have, attacks on them are more likely to be successful. If you compare healthcare to the financial industry, for example, the financial industry has devoted so many resources to protecting their data that attackers would rather focus on softer targets, like healthcare.

Luckily, Light Point Security’s isolated web browser can protect healthcare organizations from ransomware and other web-based malware. Our Full Isolation technology is the strongest in the industry, and offers the best user experience. Contact us today to learn how we can keep your data safe.

Zuly Gonzalez Recognized As One of Maryland’s Women in Technology Leaders
Posted on by Zuly GonzalezCategories Light Point Security UpdateLeave a comment on Zuly Gonzalez Recognized As One of Maryland’s Women in Technology Leaders

Zuly Gonzalez Women in Tech Leader in MarylandI’m honored to be in such great company. The Maryland Department of Commerce published a list of 18 women that are leading the charge for women in technology in The State. They recognized standout women leading technology companies, conducting critical government work in technology, and breaking new ground in developing new technologies. I’m flattered to have been included in the list, and will continue to lead the way in cybersecurity.

According to the article, CompTIA’s Cyberstates analysis ranks Maryland second in the ratio of female to male workers in IT occupations (24%).

You can see the full list of Maryland’s women in tech leaders here.

Who would you recognize as a female leader in technology?

 

Tech Faceplant: Dropbox Infinite
Posted on by Beau AdkinsCategories Computer Security, Opinion, SecurityLeave a comment on Tech Faceplant: Dropbox Infinite

Dropbox Project InfiniteLast month, Dropbox pulled back the curtains on their next new major feature, titled “Dropbox Infinite”. However, the details about how they were going to implement this feature left the majority of the audience dumbfounded. This is another one of those occasions where tech companies make a decision against the outcries of their customers, and even in the face of that backlash, just chug happily along.

Dropbox Infinite sounds like a pretty cool idea. It would make your Dropbox storage area appear as its own drive in your OS. It’s an idea that few people would complain about. However, when Dropbox revealed that they would implement this with kernel mode extensions, people’s heads started exploding.

By implementing this in the kernel, it puts the user’s system security at much higher risk than if it were implemented in user-mode. When code runs in the kernel, it has complete system access. It can read, write, or delete any file. If malware gets a foothold in your computer’s kernel, then it’s no longer your computer. Any programming mistake in the kernel means the whole system crashes (the infamous Blue Screen of Death). For these reasons, users should be wary of every piece of code they allow to run there. A product like Dropbox, used to manage remote shared file backups, seems like a poor candidate for kernel level code. It would be like Microsoft announcing the next version of Internet Explorer will run primarily in the kernel. It would be the worst idea in the history of computing.

The Dropbox article mentioned an open-source project called FUSE, which could have been used to implement this in user-mode. But they scrapped that idea because it incurred an extra kernel-mode context switch which has performance implications. Like a commenter observed, the performance of a context switch is practically nonexistent compared to the cost of performing network operations with the Dropbox servers.

The article received numerous comments, which were mostly negative. A common theme in those comments was the hope that this feature was optional. Dropbox never clarified if this was mandatory or not. If they make it mandatory, it will be an enormous faceplant. It’s quite obvious that the users are not ready for it. Maybe one day they will be, but not today. Forcing it on users now will only hurt Dropbox.

Sadly, this sort of thing happens all the time. Tech companies come up with an idea that they believe their users will go gaga over. But when they announce it, it is met with vitriol. Instead of just admitting a mistake and scrapping the idea, they double down, and shove it down their users’ throats anyway. Think Windows Metro or Chrome removing support for plugins. Listen to your customers. If you announce a new product change that causes your customers to threaten to leave, its not too late to go back to the drawing board.

Light Point Security CEO Discusses Cybersecurity and Terrorism Prevention
Posted on by Beau AdkinsCategories Computer Security, Opinion, SecurityLeave a comment on Light Point Security CEO Discusses Cybersecurity and Terrorism Prevention

Zuly Gonzalez discusses cybersecurity and terrorismLight Point Security CEO, Zuly Gonzalez, was interviewed on the Emmy Award winning Live TV show Fresh Outlook, which aired on Saturday April 2, 2016 at 2pm ET. Fresh Outlook is a weekly talk show that airs every Saturday Live, and examines a variety of topics and current events.

Zuly discussed Apple vs the FBI, encryption, terrorism, and how to protect yourself from cyber threats, among other topics. For example, she was asked why if less skilled adversaries are able to hack into devices, does the FBI with all of the resources at their disposal have such a hard time getting into the encrypted iPhone of one of the San Bernardino terrorists. Zuly talked about how not all things are equal and that a combination of skill level and protection mechanisms must be taken into account when comparing successful and unsuccessful attacks. She also discussed the importance of the data being protected and how consumers should also value their data. Zuly also touched on the irony of Apple asking the FBI for help in strengthening their protections.

It was an informative segment with several other security experts on the panel. The segment is below for your viewing pleasure.

Two Ways Google Chrome Sacrifices Security in the Name of Speed
Posted on by Beau AdkinsCategories Computer Security, Security, Web SecurityLeave a comment on Two Ways Google Chrome Sacrifices Security in the Name of Speed

Google ChromeGoogle Chrome is now the most popular web browser in the world, with an estimated 45% of all website views. Google claims that security is a top priority, which is why they push frequent, automatic updates and use a sandbox. But an even higher priority for Google is speed.

Sometimes they need to make the choice between speed and security, and this article lists two cases where they chose a minimal speed improvement at the expense of introducing a much larger security risk.

Prerendering

Prerendering is a technology used in Chrome that can make pages appear to load faster. For example, if you browse to http://example1.com and that page includes a link tag like “<link rel=”prerender” href=”http://example2.com”>”, Chrome will automatically and silently load example2.com in the background while you are viewing example1.com. The hope is that the next link you click will be to example2.com, so the browser can display it instantly, making things seem faster.

The most likely place you see this feature in use is on google.com. Based on a user’s search terms, they may decide there is a very high likelihood that they can anticipate which link the user will click next. In that case, they can mark that link to be prerendered, so the page appears to load faster.

Google Chrome itself can also decide to prerender pages. If you start typing “reddit” into the URL bar, there is a decent chance that Chrome will begin prerendering reddit.com in the hopes that is what you were in the process of typing.

What’s so Bad About Prerendering?

  1. Exposure to malware: When a page is prerendered, it has limitations. It can’t initiate downloads, or play audio. But it can execute scripts, and that is all that is needed for a malicious site to infect your computer. Because of prerendering, you can be infected by a site just because a link to it appears in a Google search results page, or you typed something similar to it in the Chrome address bar. You don’t even need to visit the page anymore.
  2. Loss of privacy: When Chrome prerenders a page, it exposes your IP address and browser information to the website. For users performing sensitive online research, this can be a big deal. Some users need to learn about a company or organization without tipping their target off about it. Because of prerendering, just Googling the name of the target will likely expose them.

How to Turn Off Chrome Prerendering

  1. Open the Chrome Settings by clicking the 3 horizontal lines icon in the top-right of Chrome and choose “Settings”.
  2. Scroll to the bottom and click “Show advanced settings”.
  3. Under “Privacy”, uncheck the box labeled “Prefetch resources to load pages more quickly”.

Disable Chrome Prerendering

Automatic Downloads

By default, Google Chrome is configured to automatically download any file that a website decides to push to you. In the interest of speed, instead of asking you if you want to accept a download, it will happily download it immediately, into the “Downloads” folder of your user profile.

The obvious threat here is that malware can get downloaded without your permission. But just downloading a malicious file isn’t actually enough to infect you. You have to execute it somehow.

After the download completes, it will show up in a box in the bottom left corner of Chrome, until the user dismisses it. If the user clicks the box for a download, Chrome will open that file. If this file is malicious, there is a good chance you will be infected.

However, this attack method is weak because it requires the user to decide to click that box. A more sinister approach involves the use of DLL hijacking. When a Windows executable loads, it often also loads a set of DLL files that it requires. These DLLs can be specified with an absolute path (like C:\Windows\System32\user32.dll) or with just a name (like user32.dll). When the DLL is specified with just a name, Windows will search for a DLL with the right name across a few different places. The first place it looks is the same directory as the executable.

An attacker can then create a malicious DLL with the same name as a common Windows DLL, like user32.dll, kernel32.dll, or UxTheme.dll. Chrome will happily automatically download this DLL into the user’s Downloads directory. After that, it’s just a matter of time before the user downloads a legitimate executable (into their Downloads directory) that doesn’t specify an absolute path to the DLL, and when the user executes it, the malicious DLL gets loaded and the user is infected.

How to Turn Off Automatic Downloads

  1. Open the Chrome Settings by clicking the 3 horizontal lines icon in the top-right of Chrome and choose “Settings”.
  2. Scroll to the bottom and click “Show advanced settings”.
  3. Under “Downloads”, check the box labeled “Ask where to save each file before downloading”.

Disable Chrome Automatic Downloads

Light Point Web Protects Against Both of These Threats

Light Point Web protects against these, and other security issues commonly seen in web browsers. Learn how our secure remote browser can protect your home or business.

When NSA employees leave to start their own companies
Posted on by Zuly GonzalezCategories Light Point Security Update, StartupsLeave a comment on When NSA employees leave to start their own companies
Zuly Gonzalez and Beau Adkins founders of Light Point Security and former NSA employees
Zuly Gonzalez and Beau Adkins are co-founders of Light Point Security. (Lloyd Fox / Baltimore Sun)

In October, Ian Duncan, intelligence and military reporter for the Baltimore Sun, interviewed me for a story about former NSA employees that left the Agency to start their own companies. Titled “When NSA employees leave to start their own companies,” the story looks at several Agency entrepreneurs and examines the challenges facing the NSA in retaining the top notch talent they helped to train. It’s an interesting read and I thought it was worth sharing here on the blog. Below is an excerpt from the story.

Adam Fuchs and his small team labored for years inside the National Security Agency on a system that would enable analysts to access vast troves of intelligence data and spot hidden patterns.

“We very much had a startup feel,” Fuchs said. The team worked in an office at Fort Meade with ideas scrawled across whiteboards and old furniture scattered around.

Their work helped analysts identify terrorist groups. But the ordinarily secretive NSA did something else with the technology: Figuring that others could make use of it, too, the agency released it to the world for free.

And that was when those who had built the tool saw an opportunity. Half eventually left the agency to develop it on the outside. Fuchs and others founded a company.

Their departure exemplifies a challenge facing the NSA: The agency spends years training some of the nation’s brightest minds in cutting-edge skills only to watch them take those skills to more lucrative jobs in the private sector.

You can read the full story on the Baltimore Sun’s website here.

Powered By Women: Meet Maryland’s Female Tech Leaders
Posted on by Zuly GonzalezCategories Light Point Security Update, StartupsLeave a comment on Powered By Women: Meet Maryland’s Female Tech Leaders

Zuly Gonzalez CEO Light Point SecurityI’m honored to have been recognized by The Daily Record as one of Maryland’s top female leaders in the tech industry. The Daily Record’s latest edition of the Path to Excellence magazine featured the top female leaders in tech in the State, including myself. They profiled each one of us, and asked us to share quick tips for the upcoming generation of women leaders in Maryland.

Below is an excerpt from the story, but please head on over to The Daily Record’s website to read the full article.

 

 

Women make up roughly 37.9 percent of Maryland’s technology workforce, according to data from the state’s Department of Commerce. Educators and experts attribute the disparity to as far back as middle school, when many young girls lose interest in science and math. You’ll learn more about the reasons for this drop off on page 14. In this issue of Path to Excellence, you’ll meet several of the women who are leading the state’s tech industry. They are leading some of the state’s most innovative companies as they improve cybersecurity, health care and help to grow the next generation of female leadership in the tech industry.

 

Zuly Gonzalez | Light Point Security
Zuly Gonzalez is the co-founder and CEO of Light Point Security, based in Catonsville.
She co-founded the firm to solve the biggest program in cybersecurity today: web-based malware.
Gonzalez has more than 10 years of experience in the U.S. federal government working to secure national security information systems.

CEO Zuly Gonzalez to Speak at the 2015 Entrepreneur Expo
Posted on by Zuly GonzalezCategories Events, Light Point Security UpdateLeave a comment on CEO Zuly Gonzalez to Speak at the 2015 Entrepreneur Expo

TEDCO 2015 Entrepreneur ExpoI am pleased to share that TEDCO has asked me to speak at their annual Entrepreneur Expo on the topic of cybersecurity technology and trends along with CyberPoint CEO Karl Gumtow. TEDCO’s 2015 Entrepreneur Expo will take place Tuesday, November 17, 2015 at the BWI Marriott (1743 W Nursery Rd, Linthicum Heights, MD 21090). TEDCO has put together a great program and line up of speakers, and I hope you will join us for what is sure to be an educational and inspirational day of community building.

My Session Information

Track: Tech Trends
Session Title: Seeing All in Cyber-Security
Time: 1:35 – 2:05

Description: The format will be the smaller company “interviewing” the larger company on cybersecurity technology and trends. We’ll be discussing topics like what is the hottest thing in the market, how do large companies see the market, where do they and other large corporations find technologies, what are they looking for, where do they look and more.

Session Timeline:
Introduction of speakers – 1-2 min
Interview – 15 min
Q&A from the audience – 10 min

Have any cybersecurity technology questions or topics you’d like us to discuss? Tweet us at @LightPointSec using the hashtag #E2E15 with your topics.

To register for the 2015 Entrepreneur Expo click here.

Light Point Security CEO, Zuly Gonzalez, to Speak at CyberMaryland 2015
Posted on by Beau AdkinsCategories Events, SecurityLeave a comment on Light Point Security CEO, Zuly Gonzalez, to Speak at CyberMaryland 2015

Our CEO, Zuly Gonzalez, will be speaking at the CyberMaryland 2015 Conference later this week. She will join other cybersecurity founders on a panel discussion about their experiences with the Northrop Grumman and bwtech@UMBC CYNC Program as part of the conference’s Cyber Innovation Track. If you will be attending the CyberMaryland Conference, stop by Room 303 on Thursday, October 29 from 9:45am – 10:30am to hear about industry partnerships and the benefits they provide to growing cybersecurity companies.

If you plan to attend the conference, but haven’t registered yet, use our discount code SpeakerGuest to receive a 25% discount off of your registration.

Presentation Information

Model of a Successful Industry Partnership – Northrop Grumman at bwtech@UMBC Cyber Incubator: CYNC Program

The Northrop Grumman Cync Program is a unique partnership between Northrop Grumman and the bwtech@UMBC Cyber Incubator, with an eye towards commercializing technology to protect the nation from a growing range of cyber threats. The Northrop Grumman Cync Program builds on bwtech@UMBC’s successful business-incubation framework by offering a scholarship program for companies with the most promising cybersecurity solutions. Selected participants are able to draw on UMBC’s extensive research resources, bwtech’s programming and entrepreneurial services, and Northrop Grumman’s technical and business advisory support to further the development and market readiness of CYNC company technologies. Hear from four innovative product companies currently in CYNC and members of the CYNC Executive Committee.

Moderator
Ellen Hemmerly, Executive Director and President, UMBC Research Park Corporation and Special Assistant to the Vice President for Institutional Advancement at UMBC

Speakers
Mike Gormley, Vice President for Government Services, Ayasdi
Christopher Valentino, Director, Contract Research and Development Cyber Solutions Division, Northrop Grumman Information Systems
Tim Gooch, CEO and Executive Director, iWebGate
Gregg Smith, CEO, OptioLabs
Zuly Gonzalez, Co-founder and CEO, Light Point Security
Dr. Jennifer Reynolds, Director of Venture Creation, bwtech@UMBC

Zuly Gonzalez at the CyberMaryland 2015 Conference

Categories
Archives