This Week In Cybersecurity

This week Between the Hacks reports on phish-testing remote employees, 70% of mobile and desktop apps contain open-source security flaws, the Red Cross calls for governments to band together to stop cyberattacks against hospitals, updates on BlackHat USA 2020’s virtual event, and tips to better secure your Gmail account.

Should Companies Phish Test their Remote Workforce?

Between The Hacks reports frequently on phishing tactics, news, and tips to prevent becoming a victim of a phishing attack. With most of the world working from home for the past few months, not only has the physical landscape changed for these workers, so has their digital landscape. Threat actors are counting on the fact that this sudden change has caused confusion and resulted in workers leaving their guard down. This is evident by the rapid increase in COVID-19 phishing and attacks on VPN solutions.

In response, companies are looking for ways to educate their employees and reduce the likelihood that they will be successfully phished. Infosec Institute reports, “When it comes to phishing, the most effective way to defuse the threat is arming the workforce with as much knowledge as possible, so that they can recognize and avoid it. Lack of security awareness training makes employees the most susceptible targets as phishing attempts easily slip through software and hardware defenses.”

The generally accepted method for managing the phishing risks in a company is to establish a security education and awareness program that includes.

1. Education - Teach the employee about phishing tactics like, BEC, spear-phishing, smishing, vishing and pharming.

2. Verify - Have the employee take a quiz to ensure that they understand what was presented in the education modules.

3. Phishing Simulation Test - Periodically send non-malicious phishing email to employees to see if they fall for different types of phishing and see how vulnerable the company is to phishing attacks.

Many companies already have these programs in place but it is important to change the education and the phish-tests regularly to reflect the types of attacks that we are seeing in the wild today.

70% of Mobile and Desktop Apps Contain Open-Source Security Flaws

According to Veracode’s annual, State of Software Security report, 70% of mobile and desktop applications that are being used today have at least one security flaw which stems from the use of open-source libraries, reports CISOmag.com.

This shines a light on two problems. First, the report states that a, “lack of awareness about where and how open source libraries are being used and their risk factors is a problematic practice.”

Second, many IoT devices and applications that use open source libraries, are not being updated when these libraries are patched for security flaws.

Annual cybersecurity reports are a valuable resource. If you want to read more, there are fourteen reports listed at the end of this Between The Hacks blog on the Verizon DBIR.

Please Stop attacking The Medical Industry

Peter Maurer, the President of the International Committee of the Red Cross (ICRC) tweeted, “Attacks on health care are unthinkable - and frankly outrageous - especially during the #COVID pandemic. Today we are calling on States to assert in unequivocal terms: cyber operations against healthcare facilities are unlawful and unacceptable.”

Maurer and more than 40 international leaders are calling on the world's governments to, “take immediate and decisive action to prevent and stop cyber attacks that target hospitals, health care, research organizations, and international authorities providing critical care and guidance in the midst of the ongoing COVID-19 pandemic” according to an ICRC article published on Tuesday.

To date, much of the work to thwart cyberattacks against the medical industry has fallen on the shoulders of private, voluntary groups of cybersecurity professionals. You an learn more about these groups in the Between The Hacks COVID-19 Cybersecurity Resources blog.

Black Hat USA 2020

Three weeks ago, Between The Hacks reported that Hacker Summer Camp, consisting of the annual Black Hat and DEFCON conferences, are going virtual for the first time due to the COVID-19 pandemic. Since then, more information about the Black Hat virtual conference has surfaced.

In it’s 23rd year, Black Hat USA’s first virtual event looks as if it will include its usual high-quality speakers and content. “Taking place August 1-6, this year's virtual Black Hat USA will offer a robust lineup of content, including nearly 80 Trainings, 90 Briefings, networking opportunities, community and sponsored programming, the Arsenal program, PWNIE Awards, CISO Summit, and a virtual Business Hall that’s free to access” according to DarkReading.

Registration is open now. The Business Pass is free and grants attendees access to the Business Hall and additional features, including Arsenal, Sponsored Sessions, and Sponsored Workshops. While the Briefing Pass is not free, it is less expensive than previous years and gives pass-holders access to more than 90 highly-curated, vendor-neutral Briefings will be presented by world-renowned researchers over the course of two-days. A Briefings Pass includes access to view all Briefings, plus access to the Business Hall, Arsenal open-source tool demos and additional Features listed here.

Tip of the Week

Five Tips to Better Secure Your Gmail Inbox

Not everyone uses Gmail but if you are one of the 1.5 billion monthly active users, you likely created your account but never navigated through the settings and options. Gmail has a lot of security controls that work in the background to protect you from phishing and malware but there are some user-controlled settings that you may find useful as well. This week, Wired shared five tips to better secure your Gmail account, that you may not have known about.

1. Block Persistent Spammers

2. Increase the Undo Send Time

3. Use Confidential Mode

4. Delete Cached Offline Data

5. Hide External Images

Picture of the Week