WELCOME TO THE MARCH 2024 NEWSLETTER
Cyber Scoop is KeyStone Solutions monthly newsletter about the latest trends, topics, and articles relating to cybersecurity. As a Managed Service Security Provider (MSSP), KeyStone’s expert team helps small to medium sized businesses with IT services including virtual Chief Information Security Officer (vCISO), cybersecurity, help desk support, Governance, Risk, and Compliance (GRC), cloud solutions, and KeyStone’s signature service, IT Team as a Service (ITTaaS) which is an all-encompass solution.
From The Desk of the CISO
MFA… Annoyance or Essential?
By Rob Ashcraft, CISO at KeyStone Solutions
If there is one topic that I get a bevy of opinions from our customers, it is multifactor authentication (aka MFA). Some love the security layer if offers, some hate the inconvenience, some feel their employees will never adopt to consistent use, and others confess though inconvenient, they know they need it. Opinions certainly vary!
To understand better understand MFA, let’s first look at system authentication. Here are the three traditional authentication categories and common factors for each.
- Something you know (a password or a PIN)
- Something you have (an MFA app on a mobile phone or a token that renders a random number)
- Something you are (a fingerprint or other biometric data)
Authentication factors were first introduced to add a level of assurance that the user was who they said they were. But no authentication category is infallible on its own, as each category has its own strengths and weaknesses. Best practices dictates the use of multiple-factor authentication, which requires at least two factors from different categories to authenticate a login.
What Does This Mean For Your Business?
Commentary by KeyStone’s Rob Ashcraft
There’s an interesting article from Bleeping Computer titled “New ‘Gold Pickaxe” Android, iOS malware steals your face for fraud”. There are a few takeaways and thoughts that we would like to share. iOS is becoming more vulnerable and security measures are necessary. This attack starts with social engineering via email (phishing) or text message (smishing), making security awareness training more important than ever.
The messages attempt to trick the smartphone owner into installing fraudulent apps, such as fake apps or fake URLs. Examples of fake apps; “TestFlight” for iPhones and “DigitalPension” for Android. Do not download these! Review apps and links before downloading or clicking them.
iOS and Android owners alike, can be tricked into clicks on a fraudulent link or app and these new malware attacks such as “GoldPickaxe” can steal the biometric information, including thumbprints and facial images. images from iOS and Android phones. They will then show the victim’s face or trick the users into disclosing their face on video through social engineering.
To help, setting up a secure enclave will protect the devices biometric data; Newer iOS devices have a secure enclave feature. High-end Android devices have a trusted execution environment (TEE) chip which will serve this purpose. A VPN can also help secure your internet connection and prevent third parties from intercepting any biometric data you transmit.
Businesses should stay informed about potential threats and practice safe browsing habits. Talk to your IT provider about securing biometric data on mobile devices. Click on the link below to read the article from Bleeping Computer.
An Alarming Number of Ransomware Attacks in 2023
Proofpoint’s
2024 State of the Phish report reveals a concerning rise in successful ransomware attacks, with 69% of organizations affected, up by 5% from the previous year. Nearly 60% reported multiple incidents, underlining the scale of the threat. Despite this, only 41% of those who paid ransom regained data access. Alarmingly, 78% of ransom payers faced subsequent attacks. The study also highlights advanced techniques like MFA bypass and QR code phishing. Despite such risks, 71% of employees engage in unsafe behaviors, driven by convenience and time pressure. Proofpoint emphasizes the need for not just awareness but behavioral change to combat evolving cyber threats effectively.
View Live Cyber Threat Map From Check Point
