The Digital Guardian asked 47 security experts to discuss what they think is a bigger threat to an organization, an insider or an outsider. Light Point Security’s CTO, Beau Adkins, was invited to participate on the panel of security experts to discuss what he has seen over the course of his career. Here’s what he had to say:
“In my experience, the biggest threat to a company’s data is posed by…”
Insiders. However, they are most often not deliberately a threat. Outsiders are the ones who have bad intentions, but they don’t have access. Network restrictions are usually strong enough to keep them out. So instead they focus their efforts on tricking unsuspecting insiders into opening the doors for them. And once inside, they are indistinguishable from the insiders.
Employee web browsing is one of the most used pathways to accomplish this. Outsiders set up a website capable of exploiting any computer that browses to it, then they send emails to the insiders that entice them to click a link to that site. Most employees will not take the bait, but it just takes one person to give in to curiosity and click the link.
Malicious outsiders are very good at this. They can craft emails that look like they are from someone within the company and reference projects or people that the recipient knows. It can be very difficult to tell these emails are not legitimate. With a little perseverance, it’s just a matter of time before someone clicks.
Because of this, efforts to protect the company from malicious outsiders can only go so far. Companies today must prioritize protecting against threats from their own insiders. One employee clicking the wrong link doesn’t have to put the whole company at risk.
Check out what the other experts had to say by reading the full article on Digital Guardian.
Ransomware. It’s the latest buzzword, and everyone is talking about it, especially in healthcare.
Ransomware has become increasingly prevalent over the last year because it’s been so successful for the bad guys. According to the FBI, cyber criminals are on pace to collect $1 billion from ransomware payments in 2016. And data breach response insurance provider, Beazley, projects ransomware attacks will grow 670% from 2014 to 2016. That’s insane!
The statistics for the healthcare industry are even grimmer. Healthcare is the most breached industry. It sees 340% more security incidents and attacks than the average industry, and is more than 200% more likely to encounter data theft. Healthcare is 4 times more likely to be impacted by advanced malware than any other industry, and is 4.5 times more likely to be impacted by ransomware. And healthcare is 74% more likely to be impacted by phishing attacks than any other sector.
The Impact of Ransomware on Healthcare
A successful breach on a healthcare organization can mean:
the loss of money,
the loss of brand reputation,
the loss of Protected Health Information (PHI), and sadly
the potential loss of life.
According to the Ponemon Institute’s 2015 Cost of Data Breach Study, the healthcare industry has the highest cost per record stolen of any industry at $363 per stolen record.
Unique to the healthcare industry, the impact of malware isn’t just a matter of losing money. As dramatic as it may sound, people’s lives are at stake. What happens if a hospital’s systems are down because of malware or a ransomware attack, and they can’t provide emergency services to a patient? Could that patient lose their life? Or could the delay in service cause additional health complications for that patient?
As an example, when MedStar was recently locked out of their systems as a result of a ransomware attack, they were unable to provide radiation treatment to cancer patients for several days. This is serious!
What Makes Healthcare a Prime Target
There are 3 main reasons why the healthcare sector is targeted so much by cyber criminals.
Healthcare records contain the most valuable information. The data healthcare organizations store on patients includes personal identities and medical histories, which makes it a very complete data set. This is a goldmine for identity thieves. This is why healthcare records are about 10 times more valuable than credit card details on the black market.
Healthcare data doesn’t change. Unlike other types of data cyber criminals steal, patient data stored by healthcare organizations can’t be easily changed. If your credit card company gets breached, you can easily change your username and password, and get a new credit card number. No big deal. But if your hospital gets breached, you can’t just go get a new social security number. Compromised health information can haunt you for a lifetime.
Healthcare organizations don’t prioritize security. Because the healthcare sector in general hasn’t kept up-to-date with modern security practices like other industries have, attacks on them are more likely to be successful. If you compare healthcare to the financial industry, for example, the financial industry has devoted so many resources to protecting their data that attackers would rather focus on softer targets, like healthcare.
Luckily, Light Point Security’s isolated web browser can protect healthcare organizations from ransomware and other web-based malware. Our Full Isolation technology is the strongest in the industry, and offers the best user experience. Contact us today to learn how we can keep your data safe.
Last month, Dropbox pulled back the curtains on their next new major feature, titled “Dropbox Infinite”. However, the details about how they were going to implement this feature left the majority of the audience dumbfounded. This is another one of those occasions where tech companies make a decision against the outcries of their customers, and even in the face of that backlash, just chug happily along.
Dropbox Infinite sounds like a pretty cool idea. It would make your Dropbox storage area appear as its own drive in your OS. It’s an idea that few people would complain about. However, when Dropbox revealed that they would implement this with kernel mode extensions, people’s heads started exploding.
By implementing this in the kernel, it puts the user’s system security at much higher risk than if it were implemented in user-mode. When code runs in the kernel, it has complete system access. It can read, write, or delete any file. If malware gets a foothold in your computer’s kernel, then it’s no longer your computer. Any programming mistake in the kernel means the whole system crashes (the infamous Blue Screen of Death). For these reasons, users should be wary of every piece of code they allow to run there. A product like Dropbox, used to manage remote shared file backups, seems like a poor candidate for kernel level code. It would be like Microsoft announcing the next version of Internet Explorer will run primarily in the kernel. It would be the worst idea in the history of computing.
The Dropbox article mentioned an open-source project called FUSE, which could have been used to implement this in user-mode. But they scrapped that idea because it incurred an extra kernel-mode context switch which has performance implications. Like a commenter observed, the performance of a context switch is practically nonexistent compared to the cost of performing network operations with the Dropbox servers.
The article received numerous comments, which were mostly negative. A common theme in those comments was the hope that this feature was optional. Dropbox never clarified if this was mandatory or not. If they make it mandatory, it will be an enormous faceplant. It’s quite obvious that the users are not ready for it. Maybe one day they will be, but not today. Forcing it on users now will only hurt Dropbox.
Sadly, this sort of thing happens all the time. Tech companies come up with an idea that they believe their users will go gaga over. But when they announce it, it is met with vitriol. Instead of just admitting a mistake and scrapping the idea, they double down, and shove it down their users’ throats anyway. Think Windows Metro or Chrome removing support for plugins. Listen to your customers. If you announce a new product change that causes your customers to threaten to leave, its not too late to go back to the drawing board.
Light Point Security CEO, Zuly Gonzalez, was interviewed on the Emmy Award winning Live TV show Fresh Outlook, which aired on Saturday April 2, 2016 at 2pm ET. Fresh Outlook is a weekly talk show that airs every Saturday Live, and examines a variety of topics and current events.
Zuly discussed Apple vs the FBI, encryption, terrorism, and how to protect yourself from cyber threats, among other topics. For example, she was asked why if less skilled adversaries are able to hack into devices, does the FBI with all of the resources at their disposal have such a hard time getting into the encrypted iPhone of one of the San Bernardino terrorists. Zuly talked about how not all things are equal and that a combination of skill level and protection mechanisms must be taken into account when comparing successful and unsuccessful attacks. She also discussed the importance of the data being protected and how consumers should also value their data. Zuly also touched on the irony of Apple asking the FBI for help in strengthening their protections.
It was an informative segment with several other security experts on the panel. The segment is below for your viewing pleasure.
Google Chrome is now the most popular web browser in the world, with an estimated 45% of all website views. Google claims that security is a top priority, which is why they push frequent, automatic updates and use a sandbox. But an even higher priority for Google is speed.
Sometimes they need to make the choice between speed and security, and this article lists two cases where they chose a minimal speed improvement at the expense of introducing a much larger security risk.
Prerendering is a technology used in Chrome that can make pages appear to load faster. For example, if you browse to http://example1.com and that page includes a link tag like “<link rel=”prerender” href=”http://example2.com”>”, Chrome will automatically and silently load example2.com in the background while you are viewing example1.com. The hope is that the next link you click will be to example2.com, so the browser can display it instantly, making things seem faster.
The most likely place you see this feature in use is on google.com. Based on a user’s search terms, they may decide there is a very high likelihood that they can anticipate which link the user will click next. In that case, they can mark that link to be prerendered, so the page appears to load faster.
Google Chrome itself can also decide to prerender pages. If you start typing “reddit” into the URL bar, there is a decent chance that Chrome will begin prerendering reddit.com in the hopes that is what you were in the process of typing.
What’s so Bad About Prerendering?
Exposure to malware: When a page is prerendered, it has limitations. It can’t initiate downloads, or play audio. But it can execute scripts, and that is all that is needed for a malicious site to infect your computer. Because of prerendering, you can be infected by a site just because a link to it appears in a Google search results page, or you typed something similar to it in the Chrome address bar. You don’t even need to visit the page anymore.
Loss of privacy: When Chrome prerenders a page, it exposes your IP address and browser information to the website. For users performing sensitive online research, this can be a big deal. Some users need to learn about a company or organization without tipping their target off about it. Because of prerendering, just Googling the name of the target will likely expose them.
How to Turn Off Chrome Prerendering
Open the Chrome Settings by clicking the 3 horizontal lines icon in the top-right of Chrome and choose “Settings”.
Scroll to the bottom and click “Show advanced settings”.
Under “Privacy”, uncheck the box labeled “Prefetch resources to load pages more quickly”.
By default, Google Chrome is configured to automatically download any file that a website decides to push to you. In the interest of speed, instead of asking you if you want to accept a download, it will happily download it immediately, into the “Downloads” folder of your user profile.
The obvious threat here is that malware can get downloaded without your permission. But just downloading a malicious file isn’t actually enough to infect you. You have to execute it somehow.
After the download completes, it will show up in a box in the bottom left corner of Chrome, until the user dismisses it. If the user clicks the box for a download, Chrome will open that file. If this file is malicious, there is a good chance you will be infected.
However, this attack method is weak because it requires the user to decide to click that box. A more sinister approach involves the use of DLL hijacking. When a Windows executable loads, it often also loads a set of DLL files that it requires. These DLLs can be specified with an absolute path (like C:\Windows\System32\user32.dll) or with just a name (like user32.dll). When the DLL is specified with just a name, Windows will search for a DLL with the right name across a few different places. The first place it looks is the same directory as the executable.
An attacker can then create a malicious DLL with the same name as a common Windows DLL, like user32.dll, kernel32.dll, or UxTheme.dll. Chrome will happily automatically download this DLL into the user’s Downloads directory. After that, it’s just a matter of time before the user downloads a legitimate executable (into their Downloads directory) that doesn’t specify an absolute path to the DLL, and when the user executes it, the malicious DLL gets loaded and the user is infected.
How to Turn Off Automatic Downloads
Open the Chrome Settings by clicking the 3 horizontal lines icon in the top-right of Chrome and choose “Settings”.
Scroll to the bottom and click “Show advanced settings”.
Under “Downloads”, check the box labeled “Ask where to save each file before downloading”.
Light Point Web Protects Against Both of These Threats
Light Point Web protects against these, and other security issues commonly seen in web browsers. Learn how our secure remote browser can protect your home or business.
Our CEO, Zuly Gonzalez, will be speaking at the CyberMaryland 2015 Conference later this week. She will join other cybersecurity founders on a panel discussion about their experiences with the Northrop Grumman and bwtech@UMBC CYNC Program as part of the conference’s Cyber Innovation Track. If you will be attending the CyberMaryland Conference, stop by Room 303 on Thursday, October 29 from 9:45am – 10:30am to hear about industry partnerships and the benefits they provide to growing cybersecurity companies.
If you plan to attend the conference, but haven’t registered yet, use our discount code SpeakerGuest to receive a 25% discount off of your registration.
Model of a Successful Industry Partnership – Northrop Grumman at bwtech@UMBC Cyber Incubator: CYNC Program
The Northrop Grumman Cync Program is a unique partnership between Northrop Grumman and the bwtech@UMBC Cyber Incubator, with an eye towards commercializing technology to protect the nation from a growing range of cyber threats. The Northrop Grumman Cync Program builds on bwtech@UMBC’s successful business-incubation framework by offering a scholarship program for companies with the most promising cybersecurity solutions. Selected participants are able to draw on UMBC’s extensive research resources, bwtech’s programming and entrepreneurial services, and Northrop Grumman’s technical and business advisory support to further the development and market readiness of CYNC company technologies. Hear from four innovative product companies currently in CYNC and members of the CYNC Executive Committee.
Moderator Ellen Hemmerly, Executive Director and President, UMBC Research Park Corporation and Special Assistant to the Vice President for Institutional Advancement at UMBC
Speakers Mike Gormley, Vice President for Government Services, Ayasdi Christopher Valentino, Director, Contract Research and Development Cyber Solutions Division, Northrop Grumman Information Systems Tim Gooch, CEO and Executive Director, iWebGate Gregg Smith, CEO, OptioLabs Zuly Gonzalez, Co-founder and CEO, Light Point Security Dr. Jennifer Reynolds, Director of Venture Creation, bwtech@UMBC
I am excited to share that Light Point Security has been named one of the top 500 cybersecurity companies in the world. How exciting and cool is that! Cybersecurity Ventures released their Q3 2015 edition of the Cybersecurity 500, which is a global compilation of the world’s hottest and most innovative cybersecurity companies, and we are thrilled to be included among the best of the best.
The Cybersecurity 500 companies were selected based solely on merit – companies could not apply to get on the list, nor could they pay to get on it. The criteria used to select the 500 companies includes:
Cybersecurity Sector (market category)
Feedback from CISOs and Decision Makers
Feedback from IT Security Evaluators & Recommenders
Stephen Babcock, the Lead Reporter for Technical.ly Baltimore, recently interviewed me for a feature story on “Why Light Point Security is all about ‘isolation’” where we discussed Light Point Security’s technology, why isolation is better than detection and our latest partnerships. In case any of you missed it, below is an excerpt from the story.
Light Point Security is looking to pick up some new customers.
The cybersecurity firm, which is based out of bwtech@UMBC, recently inked a pair of new deals that are designed to grow the customer base, said CEO Zuly Gonzalez.
The five-person company makes a product called Light Point Web, which protects users’ computers from malware by providing a separate server for browsing. That separate server ensures that malware never reaches the users’ computer.
Gonzalez said it’s a different approach from other cybersecurity products, which rely on algorithms to detect potential threats.
“There’s so much new bad stuff being created everyday that these algorithms can’t keep up,” Gonzalez said. “We take a different approach. Our security is based on isolation.”
You can read the full story on Technical.ly Baltimore’s website here.
We recently added a new feature to Light Point Web that warrants some extra recognition. We have added a server-side integration with OPSWAT’s Metascan Online service to provide yet another best-in-class layer of security for our users.
Metascan Online is a cloud service that can scan files with over 40 anti-virus engines, and do so in a matter of seconds. The fact that Metascan Online uses so many anti-virus engines is important. Just because one anti-virus engine claims that a file is safe, it doesn’t mean it is. It could be safe… or it could just be that this is a newer virus that has not been identified by that anti-virus vendor yet. It is actually common for new malware to only be identified by a small number of the anti-virus engines. With Metascan Online using so many anti-virus engines, we can get a much greater level of confidence that a safe file is indeed safe.
With our integration with Metascan Online, our users will get an extra level of assurance that every file they download is safe without having to wait around for the results. We offer this service for no extra charge for our cloud users.
How Does It Work?
When a user wants to download a file, Light Point Web will ask for their permission. If they say yes, that file will be downloaded to the Light Point Web server. Light Point Web will then ask Metascan Online to scan that file. If it is safe, the file is streamed to the user’s computer and the user is informed of the scan results.
If, on the other hand, the file is found to be malicious, the download is blocked and a message informs the user why.
This all happens seamlessly to the user, so no extra work is required by the user to get this additional layer of protection.
Coming soon: If a file is found to be malicious, the dialog will also include a link to the scan results so that you can see further details on the threat detected and which engines detected it.
For our enterprise customers, we offer a couple of options: Metascan Online or Metascan on-premises. OPSWAT offers both a cloud version and an on-premise version of Metascan. This gives our enterprise customers the flexibility of choosing the option that works best for them.
If you are interested in learning more about how Light Point Web protects you while browsing the web, contact us, or sign up for a free trial to experience worry free web browsing for yourself.
Are your employees creating a security risk in your company? Did you know that employees were the second highest cause for data breaches, after criminal attacks? Here are some common ways well-meaning employees can cause data breaches:
People are quick to trust banks, universities, and friends, and will instinctively want to open the email and click on the link. Even when the mail filter sends the e-mail to the junk/spam folder, employees have been known to open that email anyway, because the subject line has caught their interest.
Not only are employees targets, but contractors working for companies are targets as well. It was recently noted that the massive Target breach last year was initiated through a phishing e-mail to Target contractors working for an HVAC company. This incident is proof that when employees open emails, not only is your company data at risk, but your customer data is as well.
Shortened links can fool anyone, especially when it seems it’s from a trusted source, such as a news source. It’s always a good idea for employees to expand the shortened link to see where it’s taking them, before clicking on the link.
Online advertising is growing every year, and with that growth comes more malware. How easy is it to accidentally click on an ad? It’s very easy! I did this two weeks ago on accident. I have been a Mac user for 6 years and my previous time using Windows had been nearly erased from my memory. I felt clumsy bumping around that operating system. When I went to go download an open source program for a class, I hit download. And then I hit run. As I was watching it load, within 15 seconds I knew this was not the program I needed, but it was too late. I had loaded mysearchdial and it was proud to be on my computer. It didn’t want to leave. Luckily, it was just that and nothing more nefarious.
On my Mac, the ad above the real download link was something unrelated to the page. I could easily tell the difference.
On Windows, I was easily fooled. Had I paid more attention, I would have noticed it was an ad. If I had squinted my eyes more I would have seen the word advertisement. Imagine how easy it is for an employee to do this and possibly cause a major issue for their company, not to mention their customers.
What Can a Business Do to Protect Against Employee Missteps?
Security training and awareness for employees can go a long way. Some may not know to leave the junk mail in the junk mail folder. They may not be able to help their curiosity because the subject line or link is just too enticing. If it seems too good to be true, you’re probably right. A simple training meeting could bring the needed security awareness to the company and possibly mitigate employee negligence.
However, while security awareness training is helpful, it’s not enough on its own. The hard truth is that your employees will never care as much about your company’s security as you do. If they receive an especially enticing link, and even if they have been trained to ignore it, they may still feel it’s worth the risk to take a quick peek.
And in a perfect world where all your employees followed all of their training perfectly, they can still be putting your company’s security at risk. For example, earlier I stated that shortened links should be expanded before clicking. What if it points to a well-known, reputable news site? Their training would say it’s safe to click. But even the most well-known, most reputable sites can and have been hacked to spread malware to its visitors. This is a problem that goes way beyond training and trust.
This is the problem that we solve. When employees use Light Point Web, your security no longer depends on training and trust. Light Point Web can allow your employees to browse the web without any sites reaching your computers. So the most dangerous site in the world poses no more threat than the safest site in the world. You can set policies to say what types of files employees can download, from what sources, or stop them from downloading anything at all. Clicking links in email will automatically launch it in Light Point Web, because it integrates seamlessly into your standard browsers.
If you are interested in learning more about how Light Point Web can protect your business, contact us.
Light Point Security was founded by former National Security Agency (NSA) employees with 30 years of combined experience in both offensive and defensive security.
It is an award-winning and internationally recognized company with customers ranging from multi-national financial institutions and federal government agencies all the way to SMBs and individual home users.
Its flagship product, Light Point Web, is an isolated web browsing solution designed to thwart even the most sophisticated attacks.
5520 Research Park Dr.
Baltimore, MD 21228