10-cyber-security-lingo

Top 10 Cyber Security Lingo You Need to Know

/in /by

10-cyber-security-lingo

“Jargon” is defined as a set of words that are used by a particular group, usually in a specific industry or profession, and difficult for others to understand. However, within the context of cyber security, certain jargon is starting to make its way into mainstream conversation and news, hinting at the increasing importance in understanding what these words mean. We’ve laid out our top 10 cyber security lingo that just might come in handy in your next conversation.

Phishing
21

Much like how a fisherman catches fish with bait, a “phisher” lures innocent victims into giving away their personal information. While this method used to be largely executed over the phone or even over text messaging, in recent years, phishers have transitioned to e-mails and websites as their weapons of choice.

Phishing works by spoofing sites, making it seem as if the user is looking at a legitimate website. They’ll trick users into updating their billing information, or even conducting transactions – resulting in loss of money, and in some cases loss of identity.

VPN
19

A VPN, or Virtual Private Network, is a method that adds privacy and security when users access potentially unsafe networks. Normally, when trying to connect to the internet, users pass through their Internet Service Provider (ISP) and the traffic is viewable by the ISP. However, when you’re using a VPN, connections are encrypted meaning that your ISP is left out of the loop.

Many people use VPNs to keep their information secure through the encrypted connection, or to utilize the IP of the VPN server. By hiding their real IP address, users may be able to use services that were previously barred for them.

Back Door
4

When cyber attacks occur, there’s always talk about a secret way that hackers accessed the system when it was supposed to be safe. This is called a back door – a way to get into a system, product, or device by installing software or configuring the software to bypass existing security mechanisms.

Most recently, we saw through the “NotPetya” attacks that a backdoor was written into updates in a Ukrainian software firm’s accounting software, allowing for potentially 1 million computers to be compromised.

Keylogger
5

To add onto the scariness that is a back door, a keylogger is spyware or monitoring software that keeps track of every key typed on your keyboard. This means that usernames, passwords, social security numbers… virtually every piece of information typed onto a keyboard is fair game for a malicious hacker.

While there are legitimate uses for keyloggers (perhaps a parent is watching over their child’s activity), most of the time, cyber criminals utilize keyloggers to gain access to financial accounts or networking accounts. Just this past month, two Latvian men were arrested on charges of providing keyloggers as a service.

SSL
9

SSL, or Secure Socket Layer, is a must for websites – especially if they handle sensitive information like credit cards or client names and addresses. SSL ensures a secure, encrypted connection between a browser and a server. Why is this important? While current speeds of the internet make it seem as if information is transferred from point A to point B automatically, in reality, any computer in between the browser and server is able to see unencrypted information. However, SSL prevents that by making sure that only the intended recipient is able to see the sensitive information.

How do you know if your site utilizes SSL? The URL will have HTTPS (hyper text transfer protocol secure), as opposed to just HTTP (hyper text transfer protocol). Check with your hosting provider or security service about what SSL options they offer.

2FA
6

We use this next acronym a lot when we’re talking about authorization and authentication for applications. 2FA, or two-factor authentication, is a type of authentication method where the proof of a user’s identity is gained by two independent sources. This might be a password and your fingerprint ID, or perhaps a username-password combo and a code from an OTP (one-time password) token.

With people still using silly combinations like hello or 123456 as their username or password, 2FA adds on an extra protective layer, making it a bit more difficult for an intruder to gain access to a user’s data.

FIDO
24

The best password is simple, secure, and unique… that’s the philosophy behind FIDO, or Fast Identity Online. FIDO is a set of security specifications supporting multi-factor authentication and public key cryptography. FIDO-compliant authentication means that users don’t have to use the traditional username and password combo, but instead use biometric authentication which can include fingerprints to irises.

When on a remote device, users can still utilize FIDO authentication through 2FA, using both an authorized device (such as a USB drive) and a separate PIN.

Dark Web
25

Though many of us use the internet for everyday purposes like buying commercial goods, communicating with peers, or checking up on the news, there are web users who have been using the web for more sinister purposes. The Dark Web is a part of the World Wide Web that’s only accessible by installing special software. It then allows users to access an encrypted network where users and operators remain anonymous and untraceable. Because it’s so hidden, this is a haven for illegal activities.

WAF
02

A WAF, or  “Web Application Firewall” is a device that filters, monitors, and blocks traffic to and from a web application. Many people have heard the term “firewall” but a WAF differs by filtering content of specific web applications, because the majority of cyber attacks target the application layer. WAFs function in a variety of ways but a majority of traditional web application firewalls utilize a signature method, where regular updates are necessary in order to make sure that malicious traffic is blocked.

However, there are options available where WAFs use a logic-based detection engine where rule-sets for certain characteristics of malicious traffic are analyzed to block traffic. This results in more accurate detections – a must for businesses who want to retain their customers.

SECaaS
10

With the rise of cyber threats and attacks, companies of all sizes and even individuals are starting to realize the grave consequences they could face if they were to ignore the need for security. This new insight has led to the rise of SECaaS, or “security-as-a-service” where security services are provided on a subscription basis. This means that individuals or smaller businesses who may not have an adequate budget for utilizing security appliances can still apply security in a more cost-effective way.

SECaaS is clearly skyrocketing, and it’s estimated that by 2020, “85% of large enterprises will be using a cloud access security broker solution for their cloud services.” That’s up from 5% in 2015.

These are our top 10 picks for must-know cyber security lingo – do you have any other favorites? Feel free to contact us on our Facebook page, where we regularly introduce new jargon with simple explanations you can understand. Who knows? Maybe you’ll see your word next week!

db database encryption

Debunking 5 DB Encryption Misconceptions

/in /by

 

db database encryption

Businesses handle an enormous amount of data. All of this data is stored in hundreds or even thousands of databases, so it’s impractical for a database administrator to oversee the security of these databases with only basic access control functions. Instead, businesses are realizing that data encryption is a must-have component to their existing cyber security strategies. DB encryption ensures that a database is being protected even if hackers somehow replicate the database or move it to another location.

While critical to a business’s cyber security strategy, DB encryption isn’t always deployed by businesses. But thankfully, there is a positive trend occurring: in the past few years database encryption usage among businesses in the US has risen from 42% to 61%. This blog post will address five misconceptions that put to rest some concerns businesses may have before implementing DB encryption.

1. I use SSL so I don’t need DB encryption

SSL involves encrypting communication between a web user and web browser, but does not take into account data that is at “rest,” or data that is stored in a database. In other words, SSL ensures secure connection for the data that is in motion (at the time that requests are being made to the web browser). SSL is important for encrypting web traffic but there is also unprotected data that is being stored either on a disk or database which SSL does not take into account and therefore needs added protection.

2. If I use DB encryption, database performance will degrade

The performance of a database is determined by multiple factors such as excessive indexing and inefficient memory allocation. While businesses may be reluctant to incorporate database encryption into their existing security deployments due to performance or latency concerns, businesses should be reminded that it really depends on the type of DB encryption solution a business decides to utilize, whether that be file-level or column-level encryption. Typically, file-level encryption is the least resource intensive and has the least effect on the overall performance of a database.

3. Encrypting the database is enough protection for my website

Even if the security of a database is compromised, the database will be protected if the information inside is encrypted. But this doesn’t mean that the website itself will be safe  should it come under attack. Thankfully, with no access to the decryption key, a hacker cannot read files that are encrypted in a stored database. Businesses can rest assured that their most sensitive data is being protected. However, the website can still be brought down by attacks. In order to protect web applications (i.e. websites) an additional security solution will be needed.

4. DB encryption and key management requires hardware appliances, which is inconvenient

These days it’s pretty common for key management solutions to be available in a variety of both hardware and cloud platforms. But it mostly depends on where a business may be storing company data or what kind of needs they have. Not all businesses have their own data center. Instead, many rely on some kind of Software-as-a-service (SaaS) solution, removing the need to rely on hardware appliances. Therefore, it’s less likely that the traditional key management solution is implemented internally.

5. DB encryption is too complicated and requires modifications to my current operating system

Once a business answers basic questions like what kind of data needs to be encrypted and who should have authorized access to it, database encryption should not be complicated. Encryption is made easy thanks to the readily available tools in the market that cater to the needs of each business. There are plenty of DB encryption solutions that reside beneath the application layer, thereby eliminating the need to make modifications to a business’s operating system or storage. If an encryption engine is supplied for example, then no source code changes to the database environment or application are required.

Businesses should not shy away from using DB encryption due to these common misconceptions. DB encryption is not so much of a trend than it is a security necessity for all businesses. The drivers for using database encryption come down to compliance requirements and businesses recognizing the need to protect specific data types. So whether it’s to meet industry standards or to safeguard sensitive information, DB encryption is here to stay.

bring your own device (BYOD)

Bring Your Own Device (BYOD) Security Pitfalls

/in /by

bring your own device

The Bring Your Own Device (BYOD) movement is gaining a strong foothold in the US with 72% of organizations already implementing BYOD or planning to do so. In the workplace, BYOD presents an attractive business model to be followed, allowing for greater flexibility and increased productivity among employees. However, there are several security risks that need to be addressed. With personal devices like smart phones and tablets handling corporate data, there is now an enormous burden placed on companies to find a balance between preventing outside intrusion and respecting the privacy of their employees.

SMBs and enterprises alike are responsible for maintaining data security standards and this task can get easily complicated with the introduction of BYOD. To take control of your company’s BYOD policies, consider these associated challenges:

1. BYOD allows personal and business data to intertwine and mix

A big challenge for companies is managing both personal and corporate data on the same device of each employee. This is because the likelihood of employees having the same level of security protecting a company’s internal networks on their personal devices is pretty low. That brings into question potential cyber threats arising from unsecured networks. Logging into a secured company network is one thing but logging into an unsecured public network can be disastrous for both the company and the employee. Furthermore, malicious malware may further corrupt an entire company’s system should an employee accidentally install it onto their device.

2. BYOD increases the risk of data and information leakage

When an organization has a BYOD policy in place, it can open multiple backdoors for hackers to access confidential data, thereby increasing the overall risk of cyber threats against the entire organization. Mobile phones and tablets are more risky than PCs and laptops since they require constant (even daily) updating to patch security bugs. While BOYD has its benefits, companies must realize that personal devices present a weak link to security within the workplace and need special attention.

3. BYOD introduces human error/physical obstruction possibilities

Even if employee devices have password controls, remote lock features, or encryption enabled, there is always the possibility of an employee device being misplaced or stolen. Careless employees might be an IT administrator’s worst nightmare as there is not much they can do to retrieve the device once it has been stolen. One simple but effective measure to prevent outsiders from gaining access to the device is by using a PIN code. However, with hackers becoming increasingly clever at cracking down PIN codes, added protection like a wiping solution may be necessary to eliminate the possibilities of data theft.

4. BYOD makes it harder to keep track of vulnerabilities and updates

Not all mobile devices are created equal. They have different capabilities and operating systems that run different programs and with different levels of security. As more personal devices are added under a BYOD policy, it will become more difficult to keep track of the vulnerabilities and updates of each device. This is because employees are utilizing different applications on their devices and, without proper encryption or other security measures, the risks expand. Worst still, if it is an older device, a different set of unknown or undocumented vulnerabilities may arise, making it all the more dangerous. Security experts may suggest investing in a mobile device management (MDM) platform, but that will require employees to install an agent on their personal devices, which many employees are likely to oppose.

Even before setting up a BYOD policy, a company should research the current security options that are available for them. Single Sign-On (SSO) for example is an effective method for preventing hackers from logging into employee devices. If an organization has one centralized platform to handle identity management, then it becomes easier to handle web application access across the different devices in the network, as employees will log in to this platform only once to have their credentials authenticated and approved. While it is important for thorough BYOD policies and procedures to be put in place to secure employee devices, it’s also vital to educate employees on these basic security practices for protecting their personal devices so security becomes a company-wide effort.

gdpr data protection law in EU

Data Protection Laws and Cybersecurity: Mitigating the GDPR Challenge

/in /by

gdpr data protection law in EU

It looks like data privacy has and will continue to be a topic of hot debate, especially when industry standards and written law regulations require compliance across the board. On May 28, 2018 the GDPR (General Data Protection Regulation), which will replace the EU Data Protection Directive, will go into effect. Banks, and other public and private organizations in Europe are preparing for the changes to come with this updated regulation.

For example, in anticipation of the new regulations, European financial organizations are preparing to lend €4.7 billion to organizations as part of a breach response readiness initiative. But preparing to comply with the GDPR isn’t a task undertaken only by European companies. but any company conducting business in the EU or affecting EU citizens. So what will the GDPR mean for US-based companies? And what will it focus on?

What does the GDPR focus on?

The GDPR will shift how the legalities work when it comes to data use. This means both controllers (the party ensuring the protection of data) and processors (the party who processes the data on behalf of the controller) may be jointly liable for data breaches and other types of unauthorized use of personal data.

Differing from the previous EU Data Protection Directive, the GDPR will also focus on personally identifiable information, or PII. PII is any kind of information that is collected by a business through any means. This includes credit card numbers, Social Security numbers (or similar), birth dates, among various other types of data”. When data is collected by an organization, a decision must be made about the data storage process for PII which may involve assistance from a third party. This further complicates the steps needed to meet all the GDPR requirements.

How will the new GDPR affect US-based companies?

If this private information is leaked or breached in any way or fashion, then organizations must be prepared to face the consequences, and US companies are no exception. In fact, they may even face greater fines if they chose not to play by the rules. Noncompliance fines can range between 2-5% of global turnovers.

Once there is an understanding of where data such as PII resides within an organization, defining where the risks could arise from can become clearer. Because the GDPR stipulates that organizations must take “reasonable” steps to safeguard private information, it means US companies that handle data from European customers must not only keep track of US data regulations but also ensure that they are fully compliant with the GDPR.

What are organizations doing to protect PII?

It’s obvious security management will play a vital role once the GDPR comes into effect. Encryption in particular will play a major role. Encryption ensures that even if data is retrieved, hackers will have no way of decrypting it or making use of it. Besides having their internal systems and data safeguarded, CIOs and CISOs must also ensure that any of the organization’s cloud service providers are also adhering to the GDPR.

With cloud services becoming increasingly popular, organizations using any Infrastructure as a service (IaaS), Software as a service (SaaS), or Security as a service (SECaaS) must ensure data protection follows the guidelines provided by the GDPR. In the SECaaS model, this includes data loss prevention (DLP), network security, vulnerability scanning, and web security, which widens the scope of where data might be processed or stored. The GDPR explicitly mandates that an organization’s network or information system must be able to resist malicious actions that compromise “the integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems.”

For this reason we should expect organizations to start taking cyber security a lot more seriously and begin implementing defenses such as DDoS protection to their networks if they haven’t already. Not only that, but organizations are more likely to invest in high quality security that is reliable and trustworthy — as the last thing these organizations want is to pay huge fines for causing data breaches. A cloud WAF, for example, is responsible for monitoring, filtering, and blocking traffic to and from a web application, especially data exchange involving PII. Because they are also responsible for protecting against data leakage, organizations should only invest in advanced WAFs that filter traffic with high precision.

Currently, Gartner predicts that by the end of 2018, more than 50% of companies that will be affected by the GDPR will not yet be in full compliance with its requirements. This means a grand majority of businesses do not fully understand the impact the GDPR will have on them. The GDPR is not simply about allocating budgets to accommodate privacy and data compliance regulations. It means organizations must remain informed about the current cyber security threat landscape. With the GDPR affecting more than just Europe, countries around the world doing business in Europe need to stay informed about the best security and business practices to ensure the protection of a single organization’s most sensitive asset: data.

ransomware attacks in various industries

7 Industries Where Hackers Are Using Ransomware

/in /by

ransomware attacks in various industries

Even before WannaCry spread throughout the world at an alarming rate, infecting millions of public and private organizations along the way, ransomware had already taken foothold across various parts of the world since 2012 and has been responsible for disrupting the everyday functions of all types of organizations in various industries. In many cases, the payment that the hackers demand in the form of ransom can range in the tens of thousands of dollars. And with 76 percent of ransomware attacks striking via email, the probability of ransomware attacks reaching your industry is high. Below are just some of the industries where ransomware has taken root:

1. Healthcare

Gone are the days of depending solely on handwritten logs, and hospitals are no exception when it comes to record keeping. With huge databases storing and patient records managing as well as other medical files, security is extremely important to health providers. Because medical data is highly valuable, hospitals are repeated targets of ransomware attacks long before WannaCry crippled several UK hospitals with devastating consequences. In February 2016 for example, it was reported that the Hollywood Presbyterian Memorial Medical Center paid $17,000 in bitcoin to restore and regain access to their systems. The hospital cited that paying up was the most effective way to quickly remedy the situation. The Hollywood Presbyterian case was one of the earliest cases in which a ransomware attack attempted to shut down a hospital, and it won’t be the last.

2. Entertainment

The infamous Sony hacking revealed that the entertainment industry is a major target of cyberattacks. The leak ended up costing the company millions thanks to  associated costs like legal fees, restoration fees and system upgrades. Last month, hackers obtained a copy of Netflix’s original series Orange is the New Black and threatened to leak episodes of the new season if ransom was not paid. The company remained unresponsive prompting the hacking group behind the threat to leak the episodes. While hackers did not compromise the internal systems themselves, it is evident that ransomware attacks have inspired cyber crooks to hold valuable web assets, in this case an entire online series, hostage for ransom.

3. Hospitality & Tourism

In the hospitality and tourism industries, it is top-notch customer service that sets a company apart from its competitors. After all, a happy customer is a loyal customer, and companies will go to great lengths to ensure customer satisfaction. For one Austrian luxury hotel, a ransomware attack meant customer safety may have been compromised. Initially, reports claimed hotel guests were being physically locked out of their rooms through their electronic door locking system until ransom was paid. Fortunately, their internal system was able to unlock the keypads but no new room keys could be issued. The ransomware attack prompted the company to not only pay up but also switch back to traditional keys.

4. Government

Because of their influence in public affairs, government and its officials have also become major targets of cyber attacks. Although government systems are sure to be highly secured, there is always the possibility of a hacker breaking into the system. Earlier this year, the democrats in Pennsylvania’s state Senate became victims of a ransomware attack leaving the government officials unable to access their computer network. While there was no indication on whether sensitive data had been compromised, officials declined to reveal further information or whether or not backups were installed. Besides monetary gain, there is no definite way of telling whether the ransomware attack was politically motivated.

5. Education

Educational institutions rely heavily on computer networks to store and manage data for both faculty and staff. From emails to school records, it’s hard to imagine how administrators can operate an entire school without access to computers. A ransomware attack would mean student records and grades are inaccessible, which can bring chaos with a new semester quickly approaching. Such was the case with the Los Angeles Community College District who agreed to pay a hefty sum of $28,000 to regain access to their systems and data after being hit with a ransomware attack. The school was able to use money from a cybersecurity insurance policy to cover the demands of the hackers and were given the decryption keys to unlock files and restore the files back to the computers.

6. Public Services

We rely on core infrastructure like electricity to operate our cities but because the average person is not typically at the forefront of these operations, we rarely think of the severe consequences that a potential ransomware attack on these key infrastructure may have on our daily lives. For example, an attack aimed at a city’s water treatment plant can mean repercussions for water management utilities and the general population’s heating, and air conditioning systems. At a recent RSA Conference, security researchers simulated a ransomware attack and demonstrated how hackers could hold critical utilities hostage until the city paid ransom (in this particular simulation, threatening to release dangerous levels of chlorine into water supplies, which would make water unsafe to drink). San Francisco’s transit stations were hacked in a similar case, leading city officials to open fare gates and to shut down ticket kiosks.

7. News media

Many find new sites to be credible sources of information, but that doesn’t mean readers are not subject to cyber attacks when visiting their sites. Big media names are a source of the current news around the globe, meaning daily readership is high, so what better way for hackers to reach their target of tens of thousands of readers through ads? Media sites such as The New York Times, the BBC, MSN, and AOL became victims of cyber attacks after hackers injected malicious ads into their sites which forcefully install ransomware on the computers of the visitors. While the ransomware did not infiltrate the computer networks of the big media sites, ransomware attacks found another pathway through malicious ads.  

 

Conclusion

Corporations or even small and medium sized businesses who were not affected by WannaCry should still be wary of ransomware attacks. Ransomware has hit different industries across the board, and with ransomware evolving to target IoT devices (coined “jackware”) there is a growing need to secure key infrastructure and vulnerable industries. Applying preventative measures like monitoring security networks and performing regular penetration tests to exploit the weaknesses in the network can be an effective form of defense but it’s not the only defense. For more information on managing ransomware check out these tips.

 

ciso working at business from a window

Why More Companies Are Looking for a CISO

/in /by

more-ciso-title-header

A growing number of web and data threats has companies scrambling to find someone to take charge.

Since the birth of computing, there’s been a need for the “IT-guys,” the ones you could call when an issue required technical assistance and would come running to the rescue. But with the dotcom boom of 2000, this need has spiked even more. Not only has technology changed from centralized computer centers to cloud environments, but hackers’ strategies for attacking have become increasingly complicated. While IT geniuses used to be portrayed in popular TV shows or movies as hooded loners in basement corner offices, now the IT department is an integral part of any enterprise dealing with sensitive and valuable information. In fact, some companies are going as far as to place a Chief Information Security Officer, or CISO, in their c-suite.

While many ask if there really is a need for a CISO when you could simply have an IT-manager to look over the security of the organization, more companies are scrambling to find someone to take charge of this sensitive area, and we stand behind them in that choice. Here are three reasons that hiring a CISO can work in your company’s favor.

Preventing Damage Before It Happens

First and perhaps most obviously, a CISO’s job is to make sure that the information and assets of a company are secure. Unlike Chief Security Officers (or CSOs), a CISO has the added responsibility of making sure that digital assets are protected. This makes life a bit harder as digital assets don’t have a tangible presence, meaning that simply locking it in a safe and guarding it won’t do much in terms of security.

There are various things that CISO can do after an incident in order to take care of the damage, but a large part of being a CISO involves setting up protocols so that damage can be prevented before it even happens. For example, they can set up access controls so that only a select few at the corporation have access to certain servers and permissions, backup storage regularly, and utilize encryption solutions to protect sensitive data. CISOs are also the ones that have the final say in which web or data security solution to go with; whether it’s a web application firewall (WAF) or WAF service, data encryption solution, or a multi-factor authentication system, the CISO has it under control.

executive-2051414_1920Aligning Security Policy with Business Outcome

However, at this point you might say that the above is something that even an entry-level employee could do, if given the time and resources. However, most will agree that in any company, there’s a large gap between different departments. The IT department may not understand sales, business development might not understand web developers, etc. These miscommunications may be from the language, demeanor, or even the strategic mindset that the other may hold. While before, security managers were mainly technical in nature, at the end of the day, the corporation must stay financially viable in order to continue. Therefore, now the CISO must have both business and technical skills and ultimately be the senior-level executive who’s responsible for balancing the technical policies along with the business factors.

He or she is, in a way, a bridge to connect the gap between the two sides. A CISO offers a unique perspective on how to deal with the risks and dangers of data breach that neither side may be able to grasp. The CISO is a difficult position to fill because of this balance of business and technical: most corporations look for someone with an academic background in information security and/or business with CPA, CISSP or PMP certifications, OWASP or CISO forum memberships, as well as 10+ years of experience in information systems leadership. Not an easily acquired curriculum vitae.  

The Face of Security

Last of all, having a CISO for the organization tells the world that your company stresses the importance of valuing customer data. While other companies may be fully capable of dealing with vulnerabilities and threats on their own, customers can gain a tremendous amount of respect for a company if they’re able to see publicly and visibly that there is someone working on the company’s behalf to secure their sensitive information.

Many CISOs will work inside the office as well as outside to educate partners and the general public on information security issues. Other companies may see this and also be encouraged to hire their own CISO. If companies start to prioritize information security as much as they do finances, executive administrative duties, and technology and put a face to information security among the top level of executives, perhaps the entire world of business and industry will start to put security at the forefront of business decisions.

Smartest IoT devices

The 10 Smartest IoT Devices to Look Out For in 2017

/in /by

Smartest IoT devices

According to Gartner, we should expect to see 8.4 billion connected devices by the end of this year, a 31% increase from 2016. With an increasing number of businesses jumping on the IoT bandwagon, it seems like every day there is a new connected device out on the market. Even a simple internet search on “IoT devices 2017” spews a comprehensive list of both current and upcoming smart devices that users can try out relatively easily. Smart devices are certainly no longer restricted to smartphones, tablets, and computers. In fact, the new IoT trend is gravitating toward the “home automation space,” meaning the concept of a smart home is not just a fantasy but an accessible reality. Lifestyle and home IoT appliances are making life easier and convenient, streamlining our household duties after a long day at work. From automatic smart cleaning devices to smart coffee machines, IoT is not only making life easier but also saving us time and money. Excluding smartphones and computers, here is a list of our top picks for the 10 smartest IoT devices and gadgets that you can look out for this year.

1. Smart Locks

Sometimes we leave our homes only to suddenly start wondering if we forgot to lock our doors. We’ve all been in this nightmare situation, so smart locks were obviously one of the first things that became “smart” when it comes to home appliances in IoT. Smart locks are in fierce competition as the industry is steadily growing. Researchers predict the smart lock market to reach USD$1.101 billion by 2024. Smart locks are also getting creative as several smart locks like the Schlage smart lock now allow for intuitive voice commands and include guest-access features. Others opt for simplicity, allowing you to unlock your doors with the tap of a finger on the lock itself.

2. Smart Sprinklers

Garden lovers, have you ever wanted to automate your watering habits? Besides giving you full control from the convenience of your smartphone, smart sprinklers like Rachio minimize runoff, saving you water and money in the long run. It also lets you input specific yard details such as plant types, soil types, and sun exposure to give you a more customized watering schedule. Like with most IoT devices, you can monitor the status of your yard and receive alerts when there are changes due to weather or seasonal changes right from your phone.

3. Smart Plugs

Small, convenient, and safe – it seems like smart plugs are here to stay with a myriad of models already on the market. Smart plugs save you the trouble of having to go directly to an app every time to turn your electronics on or off. Instead, you can create a daily schedule for them so they can automatically turn on and off at desired times. And even if they are not on a schedule, the smart device can turn them off based on an integrated heat sensor. Some smart plugs such as the Zuli Smartplug even recognize the edges of a room to help users automate lights based on which room they are in. Smart plugs are not only great for conserving energy but also reducing your electricity bill.

4. Smart Baby Monitors

Digital parenting is now an idea of the present with IoT devices such as smart baby monitors and smart cribs. However, it is the smart baby monitors that take the win as they are constantly evolving. High-resolution monitoring is possible with most smart baby monitors, and some are even implementing infrared vision wide lens making it a great option for nighttime monitoring. For worried parents who are concerned about their baby’s health, a monitor like Withings Home can even monitor air quality.

5. Smart Cookers

How can we forget about one of the most important duties in our daily life? Many take pleasure in preparing delicate meals, and smart kitchen appliances make it that much easier for us to maneuver our way around the kitchen. Imagine being able to cook while sitting in traffic on the way home. The Tefal Actifry Smart XL is one smart cooker that lets you “cook” directly from over 200 devices. It does the hard work for you by controlling the temperature and gives step-by-step video instructions for bits the fryer can’t quite do on its own.

6. Smart Thermostats

Keeping your home cozy while saving money is ideal for homeowners. With electricity bills running high, a smart thermostat is a smart move. As with others on the list, a smart thermostat allows users to control heating or cooling settings from internet-connected devices like smartphones, wearables, or other devices. The majority of smart thermostats can learn temperature preferences like Nest so when you roll out of bed you won’t even have to touch the thermostat or open an app. It will automatically raise or lower the temperature depending on your preferences. Saving you time, perhaps it can even allow you a couple more minutes in bed.

7. Smart Mirrors

Besides our homes and gardens, IoT devices have made their way to.. .our faces –with a smart mirror. Smart mirrors enable users to intelligently analyze and assess skin conditions including wrinkles, dark circles, pores, and other blemishes. HiMirror, for example, recommends personalized skincare routines to improve whatever skin condition you may have. The device does this by anonymously collecting data and using the power of big data to develop custom routines. The mirror is equipped with a camera that can only be activated with an individual security key. With a built-in system and data protection, HiMirror promises to prevent any invasion of privacy.

8. Smart Cleaners

Robot vacuums aren’t anything new. But now, they are smarter than ever. Everyone dreads chores, and after a long day of work the last thing we want to do is clean the house. Coming home to a clean den is ideal for work professionals who may be living alone or lack time to tidy up. Depending on the design, smart vacuums come with various features, including being able to squeeze into tight corners, having a “self-rescue” function in the case it gets stuck, offering a multifunction navigation system, and offering different cleaning power settings. A smart cleaner like iRobot Roomba 870 automatically returns to its charging base when the battery is running low so there is no need to worry about it being out of commission when you are away from home gathering dust.

9. Smart Refrigerators

Who hasn’t woken up in the middle of the night and snuck into the kitchen for a late night snack? Weren’t there times you walked away disappointed that there was nothing in the fridge? Smart fridges are changing the way we manage our groceries. With Smarter’s FridgeCam users can visibly see what is in the fridge from the palm of their hands, even without getting up from bed. The Fridge Cam can also detect expiration dates, offer tips on how to use the groceries before they spoil, and even display the location of nearby grocery stores.

10. Connected Cars

To top off the smart IoT list, we’ve listed connected cars as our “smartest.” While self-driving cars make it seem like we are heading towards a futuristic “Jetson’s” world soon, in a way we are already there. Connected cars, not to be confused with fuel efficient gas “smart” cars, have been in existence since 1996. General Motors was the first automaker to introduce connected features to the market. However, a modern connected car can launch an automatic self-check once the engine starts. Features range from personalized greetings, alerts on weather conditions, and preferred destinations based on settings. Car owners can now remotely unlock and start their cars with a smart device and even track their cars if stolen.

IoT has become a field where creativity and innovation come together. Over the recent years we have seen the launch of intriguing concepts for everyday device and gadgets. But what makes a “smart” IoT device? An IoT device worth spending money on should be easy to install, customizable, flexible, and most of all – secure.

We’ve listed our top “smartest” IoT devices, did your favorite make the cut?

1484806777641_1_111339 (1) (1) (1)

The Blockchain Hype

/in /by

blockchain hype blog post title

With technology advances a-plenty – what’s going to be the next revolutionary technological development?

Big data? The Internet of Things (IoT)? Nope.

It’s going to be the blockchain

With more than 25 countries investing in the technology, and $1.3 billion invested – it looks like individuals, companies, and governments alike are putting their eggs in the blockchain basket.

The public blockchain is, simply put, a digital ledger where digital transactions are recorded publicly. Most widely-known for its use with cryptocurrencies like the Bitcoin, blockchain technology has enabled peer-to-peer transactions to be conducted without a banking system middle man, thereby challenging the power of banks to control currency. However, the applications of blockchain go far beyond cryptocurrency transactions to include supporting all kinds of informational exchange.

The idea of the blockchain is revolutionary because it allows for transparency and a new way of organizing the millions of transactions that society now handles on a daily basis. Its workings are defined perfectly by its name: transactions are recorded in “blocks” and placed chronologically in “chains.” Once a block is complete of transactions, a new block is added on and chained. Therefore, when the chain gets longer and longer, it becomes nearly impossible for hackers to penetrate it for scams, defacement, or theft. With security at maximum – what is there to worry about?

But let’s cut to the chase. Is blockchain technology secure? The short answer is, yes — yes it is.

The long answer is: Maybe. It depends on your perspective.

Time is (not) of the essence

First, there are many who complain about issues in terms of transaction verification. Because the blockchain is a distributed ledger, every block of transactions must compete to be added to the chain. This is done through a consensus process of selecting blocks contributed by miners who solve complex mathematical equations in the fastest time to receive a reward. This process can be sped up by paying an added fee, bumping up the transaction, but the average wait can be upwards of 40 minutes. In rare cases, it may take days for a transaction to be verified. Just so you can see how slow that time is: MasterCard’s 2012 report claimed that its network could take upwards to 160 million transactions every hour, with average response time of 130 milliseconds per transaction.

The duration of the wait is not only a cumbersome issue in terms of service, it’s also a security issue – a lot can happen in 40 minutes, and most people aren’t interested in being patient in exchange for reassurance in security.

Where are my keys?

When people talk about the blockchain, you’ll also hear the word “bitcoin” quite often – but don’t interchange these two terms, as they’re two very different ideas. The blockchain is a decentralized ledger, a database of transactions. Bitcoin is a form of virtual currency, or the preferred terminology “cryptocurrency” (encrypted currency). Bitcoin or ether, another cryptocurrency, are used in transactions that are noted on the blockchain. The currency is stored in a virtual “wallet” that will store and manage these currencies.

To make transactions, private keys (which many store in virtual wallets) are a necessity. Now, private keys are a completely separate entity from the blockchain, making security a bit more difficult to ensure. Despite the myriad of “must-do, top security tips” articles out there, many are still foolish in the way they store or remember their private keys. By choosing to save their keys in an unsafe digital or physical location, it no longer matters how secure the blockchain itself is – breach is still possible with a legitimate, albeit stolen, private key.

On top of possible theft, there’s the issue of the loss of a private key. Just like one may be able to lose a physical car key, private keys can also be lost. The loss isn’t a failure of the blockchain technology, but a result of the user’s misaction. This is a huge area of concern within the public blockchain, as some put the value of lost bitcoins at over $948 million.

Old habits don’t die hard

The reality of blockchain is that in order to truly deliver on the “revolution” in terms of economy, the traditional structures of government, financial institutions, and societal ideas of transactions will have to change.The most hyped up “security issue” with the blockchain technology was in 2016, when the Decentralised Autonomous Organisation (the DAO), an investment fund relying on the Ethereum platform, had 3.6 million “ether” (a cryptocurrency unit of the ethereum blockchain) stolen from them by a hacker who exploited a vulnerability in their system. With multiple heists, the DAO ended up losing around $150 million.

Now, did this mean that the blockchain technology isn’t secure? Not necessarily – the technology itself was and is secure, and strong cryptography is used to make sure that assets are transferred safely. Units of ether are also traceable, meaning that even if the hacker were to try to re-sell his goods, it would be flagged right away. Within the DAO, payouts also take a few weeks – which gave the DAO developers a bit more time to figure out how to remedy the hack. The damage was, however, done in terms of the credibility of the blockchain and the DAO. Ethereum enthusiasts were not fans of the incident, and it caused many to raise their eyebrows at the idea of a public ledger.

The future of the blockchain

So we can see that the “issues” deal more with the applications rather than the technology itself. But the reality is that resolving the security issues, albeit secondary from the actual technology of the blockchain, takes time and effort as public blockchains need acceptance by the community that is utilizing it in order to have any value within the social construct. Will the blockchain technology still catch on? Not only will it catch on, it’s already taking the world by storm. With the gargantuan amounts of money (both physical and virtual) being invested, this isn’t a hype that looks short lived. It still helps to keep in mind that no matter how secure a technology is, the applications surrounding the technology may still need quality security.

DDos types include volumed based, protocol, and application layer attacks

Types of DDoS Attacks: Explanation for the Non-Tech-Savvy

/in /by

DDos types include volumed based, protocol, and application layer attacks

When major cyber attacks are made public, we often hear about their magnitude and strength. More often than not, the media is talking about DDoS attacks. Deloitte for example revealed that the year 2016 “saw the first two [DDoS] attacks of one terabit per second (Tbps) or more.” But what does this actually mean? One terabit in itself sounds huge, but in order to understand what these measurements mean it’s important to understand the different types of DDoS attacks. It’s likely that you’ve heard of very specific DDoS attacks with unique names like ‘Ping of Death’ and ‘Smurf DDoS.’ But in spite of these fancy names DDoS attacks can generally be divided into three broad categories: volume-based attacks, protocol attacks, and application layer attacks. With these frameworks in mind, you’ll be able to decode all that talk about DDoS – even if you consider yourself to be among the non-tech-savvy. 

Volume-Based Attacks


Volume-based DDoS attacks are the most common out of the three. To carry out this kind of cyber attack, hackers utilize many computers and internet connections (often distributed around the world) to flood a website with traffic so that an overwhelming amount clogs up the website’s available bandwidth. As a result, legitimate traffic is unable to pass through, and hackers are able to successfully take down the website. Volume-based attacks are measured in bits per second (Bps).

An example of a volume based attack is the UDP flood. Hackers take advantage of a sessionless networking protocol known as the User Datagram Protocol (UDP), which is essential to the Internet protocol (IP) suite. (To read about how UDP works read here). In a UDP flood, a hacker overwhelms random ports on the targeted host so that as more UDP packets are received and answered, the system is unable to handle the volume of requests and thus becomes unresponsive.

Protocol Attacks


Unlike volume-based attacks, protocol attacks aim to exhaust server resources instead of bandwidth. They also target what is known as “intermediate communication equipment,” which in simpler terms refers to intermediaries between the server and website, such as firewalls and load balancers. Hackers overwhelm websites and these server resources by making phony protocol requests in order to consume the available resources. The strength of these attacks are measured in packets per second (Pps).

One example of this type of attack is the Smurf DDoS. Hackers exploit Internet Control Message Protocol (ICMP) packets which contain the victim’s spoofed IP and then broadcast the IP to a computer network using an IP broadcast address (used to transmit messages and data packets to network systems). If the number of devices on the network is large enough, the victim’s computer will be flooded with traffic since most devices on network respond by default to the source IP address.

Application Layer Attacks

Generally, application layer attacks require fewer resources than volume-based attacks and protocol attacks. This type of attack targets vulnerabilities within applications (hence their name) such as Apache, Windows and OpenBSD. In true DDoS nature, application layer attacks bring down servers by making a large number of requests that appear legitimate at first by mimicking a users’ traffic behavior. But because application layer attacks are only targeting specific application packets, they can go unnoticed. Application layer attacks look to disrupt specific functions or features of a website such as online transactions. The strength of these attacks are measured in requests per second (Rps).

One example of an application layer attack is the Slowloris. Slowloris is able to cause one web server to take down another. By establishing connections to the target server and only sending partial requests, Slowloris “holds” open many connections to the server for as long as possible. As it constantly sends more HTTP headers (HTTP headers allow the client and the server to exchange additional information) and only sends partial requests, it never completes a request which eventually overwhelms the maximum allowed and prevents further connections from being made.

While volume-based attacks, protocol attacks, and application layer attacks define broad categories of DDoS attacks, not all attacks fall into a perfect category. This is because DDoS attack methods are evolving everyday. In fact, a new trend includes “blended attacks.” Hackers may launch a protocol attack to create a distraction and then launch an application layer attack since they take more time to find the vulnerabilities within the application layer. Blended attacks are increasing in frequency, complexity and size. Without the proper defense system in place, they have the potential to cause unimaginable damage. To read more about how DDoS attacks affect different industries check the blog post, “DDoS Attacks: Their Top 5 Favorite Industry Targets.”

six personalities and types of hackers online kids older white hat and black hat

The 6 Types of Hackers You May Come Across Online

/in /by

 

These days it’s easy to look at the mountain of cyber crime news out there, and imagine a hoodie-wearing, tech-savvy loner in a dark corner of a room trying to get into a network for information. However, times have changed. It’s not just technology that changes or security measures that evolve. Hackers are also evolving.

In order to properly detect hacking attempts, it’s also important to understand who’s behind the attacks as well. Hackers come in all shapes, sizes, and intentions, so never judge a hacker by their cover as it might be a whole different facade then what you believe. We’ll give you our top six types of hackers you may come across online.

six personalities and types of hackers online kids older white hat and black hat

The White Hat Hacker

The least malicious of the bunch, the white hat hacker breaks into protected systems to either test the security of the system, or conduct vulnerability assessments for a client. Most of the time, they work for a security company which makes the security software or product and wants to find weaknesses in the software before releasing it for open or commercial usage. Most recently, white hat hacker Tavis Ormandy discovered the vulnerability for Cloudflare. Ormandy, employed at Google, found and reported the bug, termed Cloudbleed, which was affecting millions of sites worldwide. 

While they may use methods similar to “mal-intentioned” hackers, white hat hackers do not use the data that they’ve found for ill will. Simply put, the white hacker does what he or she does for ethical reasons, and there are even classes and certifications available to become a white hat hacker.

The Black Hat Hacker

A black hat hacker is most likely what the general public thinks of when they hear the word “hacker.” The black hat hacker is the opposite of the white hacker, where their intentions are always for personal gain rather than for the good of society. Also known as “crackers,” they gain joy from cracking into systems and bypassing security. A black hat hacker usually intends to profit from breaking into systems or does so simply to satisfy a craving for mischief – they can be differentiated from hacktivists who have a political motive for their hacking.

The Grey Hat Hacker

You guessed it, the grey hat hacker is a mix of the white hat and black hat hackers. While the grey hat hacker might break some rules and violate laws, they usually don’t have the malicious intent that the black hat hacker has. The white hat hacker will always hack under supervision or prior consent, but the grey hat hacker will not go to the lengths to receive permission before breaking into systems.

When a grey hat hacker finds a vulnerability, instead of alerting the authorities or the company, they will most likely offer to repair it for a fee – utilizing it as an opportunity to make some financial gain. Grey hat hackers argue that they only violate the law to help others, but because of the nature of their breaking and entering – companies may choose to prosecute rather than appreciate the “help.”

The Hacktivist

A hacktivist uses the world of computing and networks for a political movement. Whether it’s related to free speech, freedom of information, or proving a conspiracy theory, hacktivists span many ideals and issues. Many hacktivists work towards a common goal without reporting to a boss or an organization.

Even people unfamiliar with the IT world have heard of hacktivist groups like Anonymous, who have been active in their political movement over the past decade. Whether it’s combatting terror groups or calling for protests of retaliation, hacktivist groups hope to impact change in the real world through their programming skills in the cyber world.

The Script Kiddie

This is a wannabe hacker who lacks expertise. Just like it takes time to earn your Ph.D., it is difficult to go up the ranks to becoming a skilled hacker. A script kiddie is usually nowhere near the level of being able to hack into an advanced system, hence tending to stick to weakly secured systems. This “kid” may also get premade scripts or codes from other sources because they lack the knowledge to develop their own code. Script kiddies’ careers are generally short-lived as they might lack the discipline and creativity it takes to become an advanced hacker.

The Green Hat Hacker

Unlike a script kiddie, the green hat hacker is a newbie to the hacking game but is working passionately to excel at it. Also referred to as a neophyte or “noob,” this is a hacker who is fresh in the hacking world and often gets flak for it, having little to no knowledge of the inner workings of the web. Although it may seem unlikely that this newbie may cause any serious issues, because they’re blind to their own actions, green hat hackers can cause significant damage to a system without knowing what they’ve done and worse – how to reverse it.

It’s easy to compartmentalize hackers into good or bad, but it’s not always so black and white (pun intended). Whatever colored hat the hacker may wear, it’s important to note the differences in their techniques, results, and intentions. Then, once you understand the motives, it may be easier to either ask for assistance or perhaps look for a better security solution to guard your data and applications.

For more information on security solutions for your data or applications, visit www.pentasecurity.com or email us at info@pentasecurity.com.