Cyber Security Tips for 2018 and Beyond

Now that the year is coming to an end, all eyes are on what’s possibly around the corner. More attacks on cryptocurrencies? An escalation in attacks by state-sponsored cyber criminals? Chaos as the EU’s GDPR is implemented? In cyber security, only one thing is certain: It’s a continuous game of Spy vs. Spy. As soon as one hole is plugged, hackers find another way in, and with every new technology comes a brand-new set of risks. Here’s a list of cyber security tips for 2018 that will protect your enterprise not only in the New Year but in the years to come.

Secure Your Cloud, Secure Your Cloud, Secure Your Cloud

The AWS breach epidemic made our list of the worst cyber attacks of 2017, so it’s not surprising that cloud security is at the top of our cyber security tips for 2018. The rule of thumb is that your cloud service provider is responsible for the security of your cloud, but your organization is responsible for the security in it. Understand that cloud security is quite different from on-premises cyber security, and make sure to seek professional help to ensure a successful and secure cloud migration.

Make Sure Your Business Associates Are Secure

The next item on our list of cyber security tips for 2018 addresses another epidemic we saw over this past year: incidents where hackers targeted the smaller, third-party vendors of larger organizations such as Verizon, the Republican National Committee, and Netflix. It is estimated that over 60% of all breaches now involve third-party business associates. Often, hackers target these firms because they tend to be smaller than their corporate customers and have less robust cyber security. Make sure to vet your vendors’ information security very carefully and ensure that they aren’t cutting corners. Ask us about Vendor Risk Assessments.

Keep Your Software & Systems Updated

Both the WannaCry and NotPetya attacks targeted older, unpatched versions of Microsoft Windows, and the Equifax breach was the fault of the organization not updating its installation of Adobe Struts. Because hackers often exploit known vulnerabilities that developers have patched in security updates, one of the easiest ways to fend off cyber attacks is to keep your operating systems and software up to date.

Don’t Forget About Your Employees

The biggest security vulnerability in any organization is its own people. All of the updates, firewalls, and technical controls in the world will do you no good if an employee clicks on a link in a phishing email, shares their password “just this one time,” or “goes rogue” and decides to strike back against the company. Your cyber security plan should include continuous employee training on cyber security best practices as well as precautions to guard against malicious insiders.

Remember that Compliance Does Not Equal Cyber Security

It is of the utmost importance to comply with regulatory and industry standards such as HIPAA, PCI DSS, SOC, FedRAMP, and the upcoming GDPR. However, compliance is the starting point, not the do-all, end-all, of cyber security. Because today’s data environments are complex and unique, and the threat environment changes daily, it is impossible for any standard or framework to address every single possible risk and vulnerability that an individual organization may face.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

A look back at 7 of the worst cyber attacks of 2017

Cyber criminals upped their game this past year, launching everything from cryptocurrency thefts to international ransomware attacks. Here, we examine seven of the worst cyber attacks of 2017.

1. The Equifax Breach

Any list of the worst cyber attacks of 2017 would be remiss if it did not include the Equifax breach, which put the PII of everyone who has ever applied for or held a credit card, mortgage, rental lease, car loan, or anything else that required a credit report at risk. While the Equifax hack was not the largest data breach in terms of sheer numbers, it was one of the most troubling because of its massive scope, the nature of the information stolen, and the absolutely awful way in which it was handled. Not to mention, while consumers can choose not to patronize a private-sector company with poor cyber security practices, their information is handed over to Equifax without their consent, and there is no choice to opt out.

2. The SEC, NFA Hack

What’s at least as bad, and possibly even worse, than half of America being compromised in one of the worst cyber attacks of 2017? Having it turn out that the agency in charge of enforcing cyber security on Wall Street, the same agency that called cyber attacks “the greatest threat to our [financial] markets,” cannot keep its own cyber security house in order. Apparently having learned nothing from Yahoo’s mistakes, the SEC, NFA spent years ignoring warnings about cyber security vulnerabilities, including a DHS report released in January 2017 that found five “critical weaknesses” on SEC, NFA computers.

3. The WannaCry Attacks

EternalBlue, a code execution vulnerability from the Shadow Brokers NSA hack, was used to launch two of the worst cyber attacks of 2017. The first one was WannaCry, the largest ransomware attack in history. WannaCry infected hundreds of thousands of computers in 150 countries. The worst part is that all of these attacks could have been prevented. About 98% of victims were running Windows 7. While this OS is quite old, Microsoft still supports it, and they’d issued a patch for the Eternal Blue vulnerability about two months before WannaCry. However, a lot of users never downloaded it and ended up learning, the hard way, about the importance of keeping operating systems and software updated.

4. The NotPetya Attacks

On the heels of WannaCry came NotPetya, another attack made possible by EternalBlue. However, unlike WannaCry, NotPetya didn’t just encrypt files; it destroyed Windows machines’ master boot record (MBR), doing irrevocable damage to the system. Because the release of NotPetya coincided with a national holiday in Ukraine that is not observed in other countries, it appeared to have been aimed squarely at computers in that country, where it hit organizations ranging from shipping companies to the infamous Chernobyl plant. NotPetya ranks among the worst cyber attacks of 2017 both for its destructiveness and the fact that it may have been a “trial run” for a much larger future attack, possibly one that will take advantage of organizations letting their guard down during a much more widely observed holiday. Hackers don’t take holidays, and neither should your cyber security measures.

5. The Uber Hack

After spending the better part of the year grappling with allegations of gender discrimination and sexual harassment, in November, ride-sharing titan Uber ended up back in the headlines for all the wrong reasons. Not only did Uber fail to disclose an October 2016 breach that compromised 57 million customers and drivers, but they attempted to cover it up by paying the hacker $100,000 to delete the data and keep his mouth shut. Even worse, shortly after the breach became public, Reuters reported that Uber had funneled the hush money through its bug bounty program, possibly in an attempt to evade the attention of regulators.

6. The NiceHash Bitcoin Theft

In July, cryptocurrency investors were on edge after two Ethereum ICOs were hacked within a week of each other, and a few days later, smart contract coding company Parity’s Ether wallet software was breached. In all, over $45 million in Ether was stolen. In December, the cryptocurrency world suffered another black eye when digital currency platform NiceHash was hacked; this time, hackers made off with at least $70 million in Bitcoin. With cryptocurrency investing going mainstream and the value of Bitcoin rising into the stratosphere, watch for more attacks on ICOs and digital wallets in 2018.

7. The Epidemic of AWS Breaches

Amazon Web Services (AWS) is perfectly secure – if customers configure their AWS servers properly. Problem is, a lot of organizations don’t, so near-daily AWS breaches ranked among the worst cyber attacks of 2017. Amazon itself even sent out a mass email to customers with unprotected AWS S3 buckets, imploring them to review their security settings. Notably, most AWS breaches involved the smaller third-party vendors of very large organizations, such as Verizon and the Republican National Committee, underscoring how important it is for organizations to secure their entire cyber ecosystem.

Here’s hoping for a more secure 2018!

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

The General Data Protection Regulation and GDPR Compliance Explained

The deadline for GDPR compliance is right around the corner; is your company ready? Here’s what you need to know about this important new data protection law and what your organization must do to prepare for it.

What is GDPR?

The General Data Protection Regulation, or GDPR, was adopted by the European Parliament in April 2016 as a replacement for an outdated data privacy directive that passed in the 1990s. The goal of the GDPR is to protect the personal data of EU citizens in the digital age. EU citizens will have numerous data privacy rights under the GDPR, including the right to prompt notification of a breach, the right to access their personal data, and the “right to be forgotten.”

What Constitutes “Personal Data” Under the GDPR?

Under the GDPR, “personal data” is a broad term encompassing “[a]ny information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person.” This covers everything from an individual’s name and street address to their physical address to their health or biometric information. Even social media posts are considered “personal data.”

Who Must Comply With GDPR?

Although the GDPR is technically a European regulation, in reality, it applies internationally. In addition to applying to all companies with a presence in the EU, any company that sells goods and services to individuals or companies located in the EU or that “monitor[s] the behaviour of EU data subjects” must comply with the GDPR, regardless of where the company is located.

This means that GDPR compliance applies to nearly all large businesses, as well as many small and medium-sized businesses; if you have even one customer located in the EU, you must comply.

When is the GDPR Compliance Deadline?

Organizations must comply with the GDPR by May 25, 2018.

How Will Brexit Impact GDPR Compliance? What If I Only Sell to UK Customers?

Companies that are located in the UK or that sell to UK customers should still prepare to comply with GDPR. The UK is not scheduled to leave the EU until March 29, 2019, 10 months after the GDPR compliance deadline. Further, the British government has stated that it intends to pass its own data protection bill that will be at least as stringent as the GDPR, if not more so.

What Constitutes GDPR Compliance?

At its core, the GDPR is about data governance. Organizations will need to change the way in which they process, store, and protect customers’ personal data, keeping in mind the various data privacy rights outlined in the GDPR. Similar to HIPAA, the GDPR does not outline specific technical controls but instead tells organizations what they need to achieve; it’s up to them to figure out how.

One of the biggest changes is the GDPR breach notification requirement; companies must notify the authorities and affected customers within 72 hours of detecting a breach. This requirement is meant to prevent scenarios like the Uber hack, where the company not only waited a year to notify its customers but actually tried to cover the incident up.

The GDPR also addresses the growing problem with third-party vendor breaches. Organizations that hire third-party vendors who will be handling the personal data of their EU customers will have to ensure that their contracts with those vendors comply with the GDPR.

Additionally, some organizations will have to appoint a Data Protection Officer (DPO) to oversee GDPR compliance and overall data security. This requirement applies to organizations that are public authorities, “engage in large scale systematic monitoring,” or “engage in large scale processing of sensitive personal data.”

What Are the Penalties for Non-Compliance?

Depending on the severity of the infraction, organizations can be fined up to 4% of their annual global turnover, or 20 million euros (approximately USD $24 million).

How Can I Get Ready for GDPR Compliance?

The best way to prepare for the GDPR is to enlist help from an experienced IT audit and compliance firm like the GRC experts at Lazarus Alliance. The full text of the GDPR is 88 pages long, and what “compliance” means for your organization depends on your individual data environment, cyber ecosystem, risks, and vulnerabilities. For example, the GDPR specifies that companies must provide “reasonable” levels of data privacy and protection to EU customers, but what is considered “reasonable” is left open for debate – and you don’t want to end up on the losing side of that one!

While many organizations are dreading GDPR compliance, in the end, it will be a net positive for everyone. The GDPR will force companies to closely examine their data governance policies and controls and enact proactive cyber security measures to prevent breaches.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.