{"id":628,"date":"2021-03-03T18:37:02","date_gmt":"2021-03-03T17:37:02","guid":{"rendered":"https:\/\/telecomkh.info\/?p=628"},"modified":"2021-03-03T18:37:02","modified_gmt":"2021-03-03T17:37:02","slug":"top-security-challenges-of-2020-show-us-how-to-protect-whats-next","status":"publish","type":"post","link":"https:\/\/telecomkh.info\/?p=628","title":{"rendered":"Top security challenges of 2020 show us how to protect what\u2019s next"},"content":{"rendered":"

The year like no other impacted the cybersecurity landscape in profound ways that will continue into 2021.<\/strong>
\n2020 was an unusual year where circumstances shifted at record pace. Amidst the scramble and confusion, security teams rose to the occasion. Perhaps most significantly, organizations had to rapidly protect and scale their remote access while facing new security risks<\/strong><\/p>\n

The past year has shown us just how cyber threats can impact our lives, and the need for everyone to prepare for evolving attacks in the future. Let\u2019s examine what happened last year in the world of security, celebrate those who were able to keep governments, businesses, and individuals cyber safe, and look to how we can prepare for 2021.<\/p>\n

Elections<\/strong>
\nOne thing that Cisco\u2019s cyber threat intelligence team Talos knows for sure\u2014 2020\u2019s election security landscape was more complicated and yet more secure than it was in 2016. While many were focused on foreign election interference, domestic disinformation campaigns were quick to rise as well. Talos Director Matt Olney says that the commercialization of disinformation campaigns, or Disinformation-as-a-Service, is now more widespread but also easier to spot. State and local officials were able to take what they saw in 2016, build the right procedures, and come better prepared four years on.
\n\u201cAs a result, a conversation with an election official in 2020 is fundamentally different than how it would be in 2016,\u201d says Olney, \u201cGone are the times where I would say, \u2018Let me tell you about this threat,\u2019 because they\u2019ve spent the last four years learning about those threats.\u201d
\nIn that time, the federal government created procedures and processes for election security as well\u2014the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC) created in 2018 uses network sensors and network flow monitors to be available at low cost to any state. The Cybersecurity and Infrastructure Security Agency, also created in 2018, works towards the security of the United States\u2019 cybersecurity and communications infrastructure.
\nTalos worked on the ground with the State of Mississippi, providing them a tabletop scenario that presumed some level of compromise had occurred. The group worked with the state\u2019s security office, as well as their communications and public relations teams. As Olney states, it\u2019s crucial to understand that security attacks are not just technical\u2014the most important moment of any potential security incident \u201c\u2026is the moment when the Secretary of State steps up to the podium and begins to talk about what happened.\u201d<\/p>\n

Healthcare<\/strong>
\nHealthcare also became a critical point of 2020 with the coronavirus outbreak, and CISO of Steward Healthcare Edmond Kane says that some bad actors used this to their advantage. Massive upticks in threats emerged through the pandemic, whether because of the rapid move to remote working or luring unsuspecting users into phishing, disinformation campaigns, and even COVID-related scams.
\nKane says that this is insidious because healthcare IT is the essential backbone of modern patient care\u2014individual\u2019s lives depend on whether this infrastructure is secure. A big challenge in the healthcare industry is legacy and outdated technology. Healthcare professionals and businesses are constantly balancing the risk of introducing new IoT technology and devices that may be insecure, while legacy technology may not be up to speed.
\nUltimately, communicating the value of security is vital because every person in the industry needs to know how to be vigilant. In healthcare, the consequences move beyond just information.
\n\u201cHealthcare is not about cybersecurity, it\u2019s about patients,\u201d says Kane, \u201cAnd it\u2019s our role to get in there and help them make sure that security doesn\u2019t enter the bedside of the patients.\u201d<\/p>\n

Remote work<\/strong>
\nThe shift to remote working in 2020 meant two things\u2014 making sure all employees could safely work from home and ensuring that they could still access the company resources and assets. Because of this, many turned to Remote Desktops, the technology that allows users to connect to a computer from a remote location. Voila, your office computer is now at your home desk, but RDP (remote desktop protocols) often pose security concerns as well.
\nThese include stolen credentials, man-in-the middle attacks (a cyberattack where a bad actor puts themselves in the communication line between two parties), and remote code execution (a vulnerability where an attacker can run their own code on a machine or server of their choosing). Any remote desktop solution, if compromised, grants an attacker entry into the organization. Organizations who use RDP must implement extra security measures to keep themselves and their employees safe.<\/p>\n

Cisco outlines a few key steps<\/strong>:
\n– Don\u2019t connect RDP directly to the internet. Instead, use VPN before RDP to allow employees to get the access they need while staying secure
\n– Add MFA (multi-factor authentication)\u2014an extra security step that ensures users are legitimate by having them provide two pieces of evidence to prove their identity
\n– Block failed login attempts after a reasonable number<\/p>\n

Ransomware<\/strong>
\nRansomware trends saw the adoption of new tactics, techniques and procedures (TTP) on corporate networks in 2020. As malware gained traction and popularity, many actors refined their approaches and adopted new strategies like adding countdown timers on their ransom, threatening permanent deletion of data, and even big game hunting.
\nBig game hunting is when attackers leverage compromised systems as initial access points to the network. From there, the attack moves to gain access to additional systems while escalating privileges. The ransomware is only activated once these systems are accessed, so that the attacker creates maximum damage on the victim.
\nOnline sales postings have also become more frequent, where attackers try to sell access to multiple networks to other threat actors. In addition, bad actors are now exfiltrating large amounts of company data before unleashing ransomware to conduct what is called \u201cdouble extortion.\u201d. Double extortion also creates massive disruption in businesses who have to deal with compromised networks as well as the threat of the actors releasing their intellectual property, trade secrets, and other confidential information.
\nSo what can organizations do? Cisco recommends that businesses employ a comprehensive approach, including prevention, detection, and response.<\/p>\n

These include<\/strong>:
\n– Email security
\n– Patch management
\n– Least functionality
\n– Least privilege
\n– Systems and network monitoring
\n– Network segmentation
\n– Backup and recovery
\n– Policies and procedures
\n– Security Awareness Training<\/p>\n

Passwords<\/strong>
\nAccording to Verizon\u2019s 2020 Data Breach Investigations Report, stolen credentials are the second most common activity conducted by attackers during a breach. This is crucial because using authorized passwords is one way bad actors can gain access to a network while staying under the radar.
\nLike the ransomware trends, credentials are being used for future attacks\u2014\u201ccredential dumping\u201d is a technique when an attacker scours a computer for more credentials for further intrusions. Because there are plenty of areas within operating systems where credentials are stored, like memory, databases, or files, attackers can easily attempt to copy passwords once they have infiltrated and dump the credentials.<\/p>\n

To defend against credential dumping, organizations can<\/strong>:
\n– Monitor access to LSASS (Local Security Authority Subsystem Service) and SAM (Storage Area Management) data bases
\n– Watch for command line arguments used in credential dumping attacks
\n– Monitor logs for unscheduled activity on domain controllers
\n– Look for unexpected and unassigned connections from IP addresses to known domain controllers<\/p>\n

by Stephanie Ellen Chan, Editorial and Video Producer for Cisco’s technology news site The Network<\/em><\/span><\/p>\n

Above, Image credited to Cisco<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

The year like no other impacted the cybersecurity landscape in profound ways that will continue into 2021. 2020 was an unusual year where circumstances shifted at record pace. Amidst the scramble and confusion, security teams rose to the occasion. Perhaps most significantly, organizations had to rapidly protect and scale their remote access while facing new … <\/p>\n

Continue reading \u00abTop security challenges of 2020 show us how to protect what\u2019s next\u00bb<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":629,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[24],"tags":[],"_links":{"self":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/628"}],"collection":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=628"}],"version-history":[{"count":1,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/628\/revisions"}],"predecessor-version":[{"id":630,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/628\/revisions\/630"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/media\/629"}],"wp:attachment":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}