The Under Armour breach provides lessons in the do’s and don’ts of enterprise cyber security and compliance with the EU GDPR

Last week, athletic apparel manufacturer Under Armour announced that its popular MyFitnessPal weight loss and fitness tracking app had been hacked, compromising 150 million accounts. The Under Armour breach is the largest data breach so far this year and ranks among the top five to date. It also makes a good case study in the do’s and don’ts of enterprise cyber security. Let’s examine the lessons enterprises can take away from the Under Armour breach and its fallout, especially as the deadline for the EU GDPR approaches on May 25.

If a breach does happen, prompt disclosure is crucial.

The Under Armour breach was discovered on March 25 and disclosed only four days later; compare this to Equifax, which waited several weeks to notify users it had been hacked (and then chose to do so while the nation’s attention was focused on Hurricane Irma), and Uber, which waited more than a year (after attempting to cover the breach up). Prompt disclosure is going to be even more important under the GDPR, which will require organizations to report breaches within 72 hours.

Segment your data, and collect only the data you need.

The Under Armour breach involved only user names, email addresses, and encrypted passwords. The MyFitnessPal app does not collect Social Security numbers or other government identifiers, and payment information is stored separately, in a part of the system the hackers did not breach.

The GDPR requires organizations to bake data security into their products, policies, procedures, and systems from day one. While network segmentation alone does not constitute data security, it goes a long way towards demonstrating due diligence.

The GDPR will also require organizations to provide users with a plain-language explanation of what user data they are collecting and what they intend on doing with it. If you don’t absolutely need a particular piece of personal information to conduct your business, don’t collect it.

Properly encrypt and salt user passwords.

This is where Under Armour dropped the ball. The company states that while “the majority” of the compromised passwords were hashed using the robust bcrypt hashing function, at least some of the passwords were hashed using the notoriously hackable SHA-1 function. Under Armour has not disclosed why only some of the passwords were encrypted with bcrypt. It also has not specified whether the bcrypt-hashed passwords were salted for extra protection, which involves appending random data that is unique to each user and saving it along with their password.

To properly protect user passwords and fulfill the security requirements of the GDPR, make sure you are using a robust hashing function and salting user passwords. As strong as bcrypt is, it is not unbreakable; the Ashley Madison hack involved 36 million passwords hashed using bcrypt.

Do not reuse passwords.

Although the Under Armour breach yielded “only” email addresses and login credentials, not payment data or sensitive personal data like Social Security Numbers, a lot of people use the same set of login credentials on multiple sites. Armed with these credentials, hackers could attempt to use them on banking, shopping, or social media sites and to access victims’ email accounts. This underscores the importance of using a different, strong password for every system, website, and app.

If you have a MyFitnessPal account, you should log in and change your password right now. If you reused your MyFitnessPal password on any other sites, make sure to change those, too.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Proactive Steps to Promote Employee Cyber Security Compliance

Your organization’s people are your first line of defense against cyber criminals. Unfortunately, they’re also your weakest link. Insiders pose the biggest threat to cyber security in the healthcare industry, and only 13% of public sector employees “take personal responsibility for cyber security.” Here are 10 proactive ways to improve employee cyber security compliance.

Employee Cyber Security Training Should be Mandatory & Continuous

The cyber threat environment is constantly changing, so employee cyber security training is not “one and done.” It is a continuous process that should begin during the onboarding process and continue throughout the employee’s tenure.

Employee Cyber Security Training Is About More than Compliance

Many healthcare organizations make the mistake of focusing employee cyber security training exclusively on HIPAA compliance, and organizations in other industries can fall into similar traps. While compliance is important, it does not automatically equate to cyber security.

Keep Employee Cyber Security Rules & Procedures Simple

Often, employee cyber security manuals are written by the IT department or security personnel, who may fill them with so much “tech-speak” that they require a degree in computer science to decipher. Make sure that your rules and procedures are written in plain language that non-IT employees can easily understand.

Everyone Needs to be Trained

Cyber security is everyone’s responsibility. This includes all levels of employees, from the C-suite down to the receptionist. Don’t forget about part-time employees, seasonal workers and other temps, even interns. Everyone in your organization who has access to a computer must be trained on cyber security best practices.

Have Clear Cyber Threat Reporting Procedures

If one of your employees receives a suspicious email or finds a flash drive on the floor, who should they report the incident to, and how? Make sure your employees know exactly what to do next.

Tie Workplace Cyber Security to Personal Cyber Security

Illustrating why cyber security hygiene is important both in and outside the office is a great way to reinforce training lessons and bolster employee buy-in. Use real-world examples that employees can relate to, such as phishing scams that seek to steal personal account credentials.

Employ User Behavior Analytics & Continuous Monitoring

User behavior analytics, paired with continuous monitoring of network activity, protect your organization on two fronts. First, they allow you to identify employees who are snooping around in areas of your system they don’t need to access to do their jobs. Second, they allow you to identify stolen credentials by flagging logins at odd hours and/or from unusual locations. In either case, you can set up the system to temporarily suspend access until you determine what’s going on.

Regularly Review Employee System Access

The best way to ensure that employees don’t misuse their credentials is to prevent them from doing so in the first place. Employees should be given the minimum amount of system access to perform their jobs, and no more. Access levels should be regularly reviewed for appropriateness.

Don’t Flog Employees for Making Mistakes

Even the most diligent employee can make a mistake. If employees fear being fired for inadvertently clicking on a phishing link, not only will they not report the incident; they may try to cover it up, which could make things even worse. Encourage employees to report missteps as soon as possible, and ensure them that they won’t be disciplined for doing so.

Reward Employees for Good Cyber Behavior

In addition to not beating your employees with sticks, offer some carrots. Recognize employees who flag phishing schemes and other attempted cyber attacks.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

This Year’s Crop of Tax Phishing Scams Target Individuals, Employers, and Tax Preparers

Tax season is stressful enough without having to worry about becoming the victim of a cyber crime. Here are three different tax phishing scams targeting employers, individuals, and even tax preparers that are currently making the rounds.

Employers: W-2 Phishing Emails

The W-2 phishing scams that have plagued employers for a couple of years are back with a vengeance. The IRS noticed a significant uptick in these tax phishing scams beginning in January and recently issued an official warning. Also known as spear phishing or business email compromise (BEC) scams, these campaigns differ from traditional phishing scams in that they are highly targeted. They are sent to specific employees within organizations who have access to employee tax data, usually human resources personnel, and often appear to come from a company executive. Occasionally, the IRS reports, the email will request a wire transfer along with employee W-2 data.

Individuals: Phony “Tax Notification” Emails

While the hackers behind this particular scam are not seeking tax ID data, they are harnessing the stress of tax season and victims’ fear of the IRS to get them to click on phishing links. The targets are Microsoft 365 users, and Dark Reading reports that “tens of millions” may have received the emails. The messages purport to be from the IRS, warn recipients that there is some sort of problem with their taxes and that dire consequences will result if they do not take immediate action, and include attachments with names such as “taxletter.doc.” Downloading and opening the attachment installs password-stealing malware on the victim’s machine.

Tax Preparers and Individuals: New Tax ID Theft Phishing Scheme

These highly sophisticated tax phishing scams are executed in two phases. In the first phase, hackers send traditional or spear phishing emails to tax preparers, which install malware on their computers and allow the hackers to steal client tax and bank account data.

In the second phase, the hackers use the data to file fraudulent tax returns – then have IRS refunds deposited in the victims’ bank accounts. In some cases, the return is filed using one victim’s tax data and the money deposited in another victim’s bank account. The bank account owners are then contacted by someone claiming to be an IRS representative, demanding that they take specific (and irreversible) steps to “return” the money.

Fighting Back Against Tax Phishing Scams

There are several ways to prevent falling victim to these and other tax phishing scams. Organizations should ensure that all employees are trained to identify phishing emails, including spear phishing, have a specific and clear procedure to report suspicious emails, and take all other appropriate proactive cyber security measures. Individuals should also be aware of the warning signs of a phishing email, including text written in broken English and return addresses that appear to be off, such as a government agency with a .com address.

The IRS requests that suspected tax-related phishing emails be forwarded to phishing@irs.gov. If you receive an erroneous refund deposit to your bank account, follow the IRS’s instructions for returning it:

1. Contact the Automated Clearing House (ACH) department of the bank/financial institution where the direct deposit was received and have them return the refund to the IRS.
2. Call the IRS toll-free at 800-829-1040 (individual) or 800-829-4933 (business) to explain why the direct deposit is being returned.
3. Interest may accrue on the erroneous refund.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.