FFT news digest — 27 July 2018
FFT news digest — 27 July 2018
BA meets GDPR
BA meets GDPR
Enterprise targets
Enterprise targets
Key to success
Google appears to have provided a clear example of how to defeat phishing emails. Security journalist, Brian Krebs, says Google told him that none of its employees have been attacked successfully since it began requiring them to use physical security keys instead of passwords and one-time passcodes. Given that Google has more than 85,000 employees, that’s quite an achievement. Security keys are USB devices which allow users to complete the login process on supported services by inserting the key in their computer and pressing a button on it. The underlying standard (known as U2F) is relatively new and the list of sites using it is relatively short, though it does include Dropbox, Facebook, Github and most leading password managers. Where it’s not available, we highly recommend setting up another form of 2 Factor Authentication. Twofactorauth.org has a list of what works where.
Operational insecurity
A security company has accused journalists covering the meeting between Presidents Trump and Putin of being “entirely too complacent about their cyber security.” F-Secure, which is based in Helsinki (where the meeting took place), said journalists “seemed like sitting ducks.” Among the rules it said were broken; laptops left open and unlocked so they wouldn’t go to sleep, and Bluetooth connnectivity left active. F-Secure also noticed that many computers and phones identified their user by name, providing information that could be used to target an individual or a news outlet. And many of the booths and cubicles at the summit were unsecured. Anyone who has covered major planned events will know security is often the last thing on the minds of journalists who are working around the clock under extreme pressure. The view of an outsider like F-Secure is a useful reminder that security shouldn’t be ignored.
Attacking the supply chain
Compromising the software supply chain is a well-known way of attacking companies and many companies are not prepared to deal with the threat. A report for security company, CrowdStrike, found that two thirds of companies surveyed had suffered such an attack in the previous 12 months at an average cost of $1.1 million. Despite this, only a quarter said they felt fully prepared to defend against the threat. The report found under a third of the companies had vetted all their suppliers in the previous year. The same proportion identified the issue as the top concern for their company. Among supply chain attacks, last year’s NotPetya incident stands out for the damage it caused, described by the White House as “the most destructive and costly cyber-attack in history.” Russia denied accusations that it was responsible for the incident which initially targeted a Ukrainian accountancy product.
Setting a bad example
A report has revealed atrocious security habits among business leaders…and illustrates how hard it is to persuade people to behave sensibly. Among Code42’s findings ; 72% of CEOs admitted stealing data from their former companies and 59% said they had downloaded software without knowing whether it had been approved by their company. To underline the scale of the problem, 93 percent of CEOs said they keep copies of work on personal devices but 78% believe intellectual property is a business’s most precious asset. This disconnect is unlikely to come as a surprise to anyone who has had the pleasure of helping senior executives with their technology issues. But it supports our view that it’s essential to translate these issues so that their importance can be understood.
Ts & Cs
The UK’s Investigatory Powers Tribunal has again ruled that bulk surveillance by spy agencies was unlawful because there was insufficient oversight of them. But the Tribunal said the activities did not contravene the European Convention on Human Rights. A flaw has been found in some Bluetooth implementations which could allow data to be intercepted. The issue has been addressed in the latest updates for macOS, Android, iOS and for LG and Huawei devices. There’s been an upsurge in reports of data breaches to the UK regulator since the GDPR began to be enforced in May. The ICO says it received 1,750 breach reports in June; that’s up from 400 in April. Phishing works, as a US bank found out to its cost. Brian Krebs reports that the National Bank of Blacksburg fell victim twice and lost $2.4 million as a result.
Updates
Chrome : version 68.0.3440.75 for Windows, Mac, and Linux addresses vulnerabilities that an attacker could exploit to take control of an affected system. It’s also the first version which will mark HTTP sites as “Not Secure.” Apple : macOS High Sierra 10.13.6 Supplemental Update aims to overcome performance issues with MacBook Pro with Touch Bar (2018) machines. Apache : security updates to address vulnerabilities in Apache Tomcat versions 9.0.0.M9 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. A remote attacker could exploit one of these vulnerabilities to obtain sensitive information. Sony : Update to address multiple vulnerabilities in Sony IPELA E Series Camera.