Check Point

Almost One Third U.S. Businesses breached in 2017

December 26th, 2017

Twenty-nine percent of U.S. businesses were affected by a data breach in the 2017. The analysis was done by HSB of 403 senior executives in the U.S., and conducted by Zogby Analytics.

Company reputation gets a hit after the breach says two third of respondents. The amount spent was $5,000 and $50,000 to respond to a breach as per the twenty seven respondents. Thirty  percent said they spent between $50,000 and $100,000.

Fifty one percent mentioned that lack of knowledge is the reason behind the success of the attack.

“The results highlight how closely our economy and society are interconnected digitally,” HSB vice president Timothy Zellman said in a statement. “Almost all of our personal and business data can be accessible on the Internet through online business connections, websites and social media. And that exposes our private information to attacks from hackers and cyber thieves.”

Another survey conducted by Balabit of 222 IT executives and IT security professionals shows that 35 percent of respondents see themselves as the largest internal security risk to networks within their companies. IT staff has higher rights than other users.

The report also has below findings –

Forty seven percent of respondents mentioned that the time and location of login, followed by private activities using corporate devices (41 percent), and biometrics identification characteristics such as keystroke analytics (31 percent) is the most important user data for spotting malicious activity

“As attacks become more sophisticated, targeted attacks and APTs more commonly involve privileged users inside organizations — often via hacks involving stolen credentials,” Balabit security evangelist Csaba Krasznay said in a statement. “Today, IT security professionals’ tough job has become even tougher. It is not enough to keep the bad guys out; security teams must continuously monitor what their own users are doing with their access rights.”


AlertSec ACCESS is a patent pending technology. It is designed to enforce that devices are encrypted before access to a network is granted. 

Cyber Attacks

December 25th, 2017

Austin Manual Therapy mentioned that they suffered data breach due to unauthorized access to its system. As per the reports, limited parts of the system were accessed. There is no data which shows that the attack was also carried on the organization’s core EHR system.

“Despite conducting a comprehensive forensic analysis, we have very little evidence as to what documents or information the attacker was able to access or steal,” Austin Manual Therapy stated. “We know that the attacker was able to access one of our computers and a shared file system.”

Affected information included addresses, phone numbers, occupations, dates of birth, insurance policy information, insurance coverage and eligibility information, charge amounts, dates of service, driver’s license information, diagnosis, health screening information, referring physician information, and full or partial Social Security numbers.

As per the OCR tool, total 1,750 individuals may have been affected.

“While our investigation is substantially complete, it remains ongoing and will likely continue through the end of the year,” Austin Manual explained. “We also have implemented and are continuing to implement additional security measures designed to prevent a recurrence of this type of attack, to quickly identify unusual activity, and to further protect the privacy of your information.”

CA Facility Data Breach

California-based Stanislaus County Behavioral Health and Recovery Services (BHRS) mentioned that it suffered data breach due to a ransomware attack.

“The network has been shut down and isolated from the County-wide network while online services and communication are being provided by other means temporarily, and client care has continued,” read a Stanislaus County statement from December 15, 2017.

Stanislaus County said that it has previously mitigated ransomware attacks, but this time “the particular techniques used in this attack were able to get past the security mechanisms that are in place.”

“All BHRS computers are being held in quarantine to prevent any further infection,” the statement read. “No breech of personal information has been detected at this time.”

Stanislaus County did not mention the affected number of individuals.

BHRS has more than 400 employees and provides services “for about 14,000 adults and children, including mental health services and help with overcoming addictions.”


AlertSec ACCESS is a patent pending technology designed to check that devices are encrypted before access to a network is granted.

Devices and Data Breach

December 24th, 2017

Pennsylvania-based Washington Health System (WHS) Greene mentioned that it suffered data breach due to missing external hard drive.

The device was used for Bone Densitometry machine. Facility mentioned that data of patients who underwent bone density studies at WHS Greene from 2007 until October 11, 2017 may have been present in the hard drive.

Affected information included certain patient information which includes patient names, height, weight, race, and gender information, medical record numbers and health issues may have been included for some patients. Social Security and financial information were not present.

WHS Greene mentioned that there are no signs of information misuse.

“Washington Health System Greene is committed to maintaining the privacy and security of patient information, including regular review and evaluation of the security of all processes in place,” WHS Green stated. “This unprecedented situation has our full attention and please be assured that we have taken and will continue to take steps to ensure that a breach of this nature will not happen in the future.”

As per the OCR data breach reporting tool, total 4,145 individuals may have been affected.

Data sold online in another breach

New Jersey-based Chilton Medical Center recently mentioned that an employee removed a computer hard drive. The person sold it on the internet. Hard drive was sold in the last month.

Patients treated May 1, 2008 to October 15, 2017 may have had their information present on the device.

Affected information included patients’ names, dates of birth, addresses, medical record numbers, allergies, and medications the patient may have received at Chilton Medical Center.

“During our investigation, we determined that the former employee removed other devices and assets from Chilton Medical Center to sell on the internet in violation of policy,” the statement explained. “While we currently have no indication that any of these devices or assets contain patient information, we continue to investigate this incident and, if we determine additional patients are affected, we will notify them as appropriate.”


AlertSec ACCESS checks for full disk encryption on PCs running Windows 7, 8, and 10 Home, Pro and Enterprise as well as Mac OS El Capitan and Sierra.

Security Budgets After WannaCry, NotPetya Attacks

December 22nd, 2017

AlienVault conducted survey of 233 IT professionals worldwide. The report shows that only 14 percent increased budgets for cyber security after the WannaCry and NotPetya cyber attacks. Only twenty percent were able to apply changes or implement security projects that had previously been put on hold.

Only 16 percent mentioned that their company leadership and boards took interest in security after the attacks.

“WannaCry and NotPetya are generally believe to have marked a turning point in cyber awareness, but the reality on the ground paints a different picture,” AlienVault security advocate Javvad Malik said in a statement. “Destructive malware poses existential threats to companies across all industries and can no longer be ignored.”

“To improve our cyber resilience, corporate strategy needs to be developed that covers how to plan for, detect, mitigate and recover from such destructive attacks,” Malik added.

“The IT security profession remains a very tough place to work, where resilience is the key to success — particularly if you are blamed in the event of your company suffering a security incident,” Malik said.

Twenty percent said that IT advice is now taken seriously after the attacks.

Another survey conducted by Spiceworks shows that thirty two percent hope to look for another job.

Eight one percent mentioned that its critical to have cyber security expertise.

“Although the majority of IT professionals are satisfied with their jobs, many also believe they should be making more money, and will take the initiative to find an employer who is willing to pay them what they’re worth in 2018,” Spiceworks senior technology analyst Peter Tsai said in a statement.

“Many IT professionals are also motivated to change jobs to advance their skills, particularly in cyber security,” Tsai added. “As data breaches and ransomware outbreaks continue to haunt businesses, IT professionals recognize there is high demand for skilled security professionals now, and in the years to come.”


AlertSec ACCESS checks all computers and smartphones and detects all encryption types.

Google Encryption for Clouds

December 13th, 2017

Largest cloud networks in the planet is operated by Google. It employs multiple techniques to keep the data secure. Company is now providing some insight about the encryption techniques.

Google, like others, uses Transport Layer Security (TLS) to encrypt connections for data in motion from external hosts to the Google Cloud. But Google has its own method for encrypting data connections within its own data centers. It is called Application Layer Transport Security (ALTS).

“We get a lot of customer questions about encryption, so we’re trying to build trust through transparency,” Maya Kaczorowski, Security and Privacy Product Manager at Google, told eSecurityPlanet.

Kaczorowski mentioned that when a user connects to the Google Cloud, by default the connection is encrypted with TLS. Google is making use of TLS 1.3, which is not yet an official IETF standard.

Container vendor Docker has a model similar for its Swarm orchestration technology called mutually authenticated TLS (mTLS).

“TLS uses X.509 certificates, while ALTS uses protocol buffers,” Kaczorowski said.

Kaczorowski said that Protocol Buffers are a language-neutral technology for serializing data.

“It’s not based in hardware, Protocol Buffers are just a way for storing and transmitting information,” Kaczorowski said.

Kaczorowski mentioned that BeyondCorp is all about how Google employees access internal applications and resources.

“With ALTS, what we’re talking about is how every service at Google can authenticate with each other,” Kaczorowski said.

Company is also working on the open-source Istio service mesh project for Kubernetes.

“Istio authentication automatically aims to encrypt data transit between services,” she said. “The concept is similiar to ALTS.”

“For encryption in transit we have encryption at the network layer (Layer 3) and at the application layer (Layer 7),” Kaczorowski said. “With encryption at rest we’re encrypting both at the storage device layer and at the storage system layer.”

“We want to have multiple layers that we can fall back on,” she said.


AlertSec ACCESS checks all computers and smartphones and detects all encryption types

NiceHash Breach

December 10th, 2017

The cryptocurrency mining marketplace NiceHash mentioned that its payment system had been affected by data breach. Contents of its Bitcoin wallet were stolen.

Company didn’t mention the number of bitcoin affected but according to Reddit, the hacker bitcoin address has 4,736 Bitcoin which values $83 million.

“Clearly, this is a matter of deep concern and we are working hard to rectify the matter in the coming days,” the company said in a statement. “In addition to undertaking our own investigation, the incident has been reported to the relevant authorities and law enforcement and we are cooperating with them as a matter of urgency.”

Company has temporarily stopped operations.

Webroot senior threat research analyst Tyler Moffitt mentioned email that the breach should serve as a reminder to the mining community that when mining for a pool, it’s always best to have payouts trigger at the smallest amount. “Even though there are fees associated with using the minimum payout, having the amount sit in the mining pool’s wallet is risky,” he said.

Cybercriminals targeting cryptocurrencies has increased. Imperva’s Global DDoS Threat Landscape Report shows that 73.9 percent of all Bitcoin exchanges were attacked by DDoS method.

“As a rule, extortionists and other cybercriminals are commonly drawn to successful online industries, especially emerging ones that are less likely to be well-protected,” Imperva security evangelist Igal Zeifman said by email. “Attackers can make a lot of money when attacking crypto exchanges due to factors such as the anonymity of the cryptocurrencies, hence the ability to ‘get rid’ of the stolen goods with limited risk.”

Recorded Future report also reported a rapid spike in mining malware.

“Our research has confirmed that cybercriminals are shifting attack vectors from highly damaging ransomware infections to long-term, low-velocity crypto mining operations,” the report states.

The researchers also found out that there are sixty two different types of cryptomining malware available for sale online.


AlertSec ACCESS checks for full disk encryption on PCs running Windows 7, 8, and 10 Home, Pro and Enterprise as well as Mac OS El Capitan and Sierra.

IoT Security Skills in Energy Companies

December 5th, 2017

Inmarsat survey of senior IT decision makers from 100 large energy companies worldwide shows that fifty four percent need additional security skills to deliver successful IoT projects. Fifty three percent need to make significant investments to fulfill requirements.

Other findings include-

Only two percent mentioned that IoT do not create new challenges

Thirty percent said they have given special consideration for IoT in security apparatus

Fifty nine percent mentioned that their board has insufficient knowledge of IoT

“The core operations of energy companies have traditionally been insulated from the destructive cyber attacks that have destablized other industries, as they were not connected to the Internet,” Inmarsat senior director for energy Chuck Moseley said in a statement. “But with the advent of IoT, more and more parts of their infrastructure are being connected, creating new vulnerabilities and risks.”

“Worryingly, our research shows that many energy businesses lack the security processes and skills to address these new vulnerabilities,” Moseley added. “This needs to be quickly addressed, and it must be driven by senior leadership within energy businesses, to ensure that they do not miss out on the huge potential value that IoT can bring to the energy sector.”

Another survey conducted by CyberX study of 375 industrial networks worldwide shows that thirty one percent are connected to the public Internet. Seventy six percent are running outdated and unpatchable operating systems like Windows XP and Windows 2000.

“Most of these ICS/SCADA sites were built years ago, long before the proliferation of Internet connectivity and the need for real-time intelligence,” the report states. “The key priorities were performance and reliability rather than security.”

“We don’t want to be cyber Cassandras — and this isn’t about creating FUD — but we think business leaders should have a realistic, data-driven view of the current risk and what can be done about it,” CyberX CEO and co-founder Omer Schneider said in a statement.


AlertSec ACCESS checks for full disk encryption on PCs running Windows 7, 8, and 10 Home, Pro and Enterprise as well as Mac OS El Capitan and Sierra.

New Google Patch for Android

December 2nd, 2017

Google released possibly its final Android security update for 2017. The latest patch addresses at least 42 different vulnerabilities which includes 11 flaws in the media framework (five are critical remote code execution issues).

“The most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process,” Google warned in its advisory.

Libmedia and libstagefright components of the Android media framework is patched in every single security update provided by Google since August 2015. Google provided update every single month after the Stagefright vulnerability which was first publicly disclosed at Black Hat USA 2015.

“The state of the union for Android security is strong and I have spent time making sure it stays strong,” Adrian Ludwig said, the man who runs Android security for Google. “It’s not just about building a safe; it’s about building something that can react and respond to security quickly.”

In this new update, the critical remote code execution flaw in the system component is also addressed.

“We’re updating all Nexus devices — the Nexus 4, 5, 6, 7, 9 and 10 and even the Nexus players — and we’re patching for libstagefright,” Ludwig said. “This is the single largest mobile software update the world has ever seen.”

Security support will extend for three years from a time Nexus device appears in the market.

“The industry has looked at recent events and realized that it needs to move fast, and we need to tell people what we’re doing,” Ludwig said.

“The most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process,” Google warned in its advisory.

Ludwig also mentioned that, “We’re taking an aggressive stance to see if an application is doing something wrong, and we’re working with the developers and the development process to make it right.”


AlertSec ACCESS is a patent pending technology designed to check that devices are encrypted before access to a network is granted.

IoT Security

November 30th, 2017

Healthcare organizations are now implementing connected medical devices for better services to patients. But healthcare technology leaders are worried about IoT security with connected devices.

Business technology professionals survey in healthcare shows that seventy one percent are skeptical towards IoT devices.

“Emerging technologies have to be embraced,” ISACA CEO Matt Loeb said in a statement. “As the research shows, the reluctance to deploy them is linked to the need to understand and mitigate the risks of doing so. Organizations that implement a strong information and technology governance program will better understand their capabilities, which leads to more effective risk management and increased confidence in deployment of these technologies.”

The survey also mentioned that forty seven percent do not consider their organizations’ head is digitally literate.

“The resounding message from our research is clear: senior leadership needs to invest in increasing its digital fluency,” Loeb said. “Organizations with digitally fluent leadership are more clearly recognizing the benefits and risks of emerging technologies.”

The trend shows that IoT devices are there to stay even there is resistance from senior leadership.

“[IoT] can also be remotely controlled and is highly automated across existing network infrastructure, resulting in improved efficiency, accuracy and economic benefit in addition to reduced human intervention,” researchers stated.

The research team also mentioned that there is variety of sectors and savings due to increasing automation. As per the Deloitte poll, the biggest cyber security challenge is to identify and mitigate potential risks in legacy and connected devices.

“Legacy devices can have outdated operating systems and may be on hospital networks without proper security controls,” said Russell Jones, Deloitte Risk and Financial Advisory partner, Deloitte & Touche LLP. “Connected device cybersecurity can start in the early stages of new device development, and should extend throughout the product’s entire lifecycle; but even this can lead to a more challenging procurement process. There is no magic bullet solution.”


AlertSec ACCESS checks for full disk encryption on PCs running Windows 7, 8, and 10 Home, Pro and Enterprise as well as Mac OS El Capitan and Sierra.

Uber Breach

November 27th, 2017

Uber mentioned that it had covered up a massive data breach of 57 million customers’ and 600,000 drivers’ information in late 2016 by shelling out the hackers a $100,000 ransom.

Uber CEO Dara Khosrowshahi mentioned that two hackers “inappropriately accessed user data stored on a third-party cloud-based service that we use.”

Affected information includes 600,000 U.S. drivers’ names and driver’s license numbers, and 57 million global users’ names, email addresses and mobile phone numbers.

“At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,” Khosrowshahi said. “We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed. We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage account.”

Uber paid the hackers a $100,000 ransom not to publish the data.

“None of this should have happened, and I will not make excuses for it,” Khosrowshahi said.

“While I can’t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes.”

“Breach disclosure is critical to get right, because it can have long lasting effects on the organization and its customers,” SecureAuth chief security architect Stephen Cox said by email.

“To the organization, every breached customer has a financial impact, and long term viability comes into question because of damage to the brand.”

AsTech chief security strategist Nathan Wenzler said the decisions made by Uber’s CISO is shocking after the incident.

“Quite simply, legitimate security professionals know better than this, and the community at large is built upon integrity in all matters,” Wenzler said. “When you act as the front line of defense for an organization, it is imperative that your security team operates in the most honest and forthright manner possible.”


AlertSec ACCESS checks all computers and smartphones and detects all encryption types.