# data[].attributes.headline
(Group 3) Megan McDowell, David Carman, Jessie Spires   Forensics was run on an enterprise breach to find that initial access  was made through a web server to a database server through a roundabout route where the data thefts occurred, where accesses were amplified via malware targeting “low-hanging fruit.”  It should be warned that when web applications used as front-ends for databases are used, they become vulnerable to simple attacks such as SQL Injection.  The tech went on the internet and mocked such injection, finding his way into the server and to sensitive information as a test.  He warns that even if attacks are simple, defenses should not fail to be complex to protect from multiple variants of such attacks.

# data[].attributes.subject
(Group 3) Megan McDowell, David Carman, Jessie Spires   Forensics was run on an enterprise breach to find that initial access  was made through a web server to a database server through a roundabout route where the data thefts occurred, where accesses were amplified via malware targeting “low-hanging fruit.”  It should be warned that when web applications used as front-ends for databases are used, they become vulnerable to simple attacks such as SQL Injection.  The tech went on the internet and mocked such injection, finding his way into the server and to sensitive information as a test.  He warns that even if attacks are simple, defenses should not fail to be complex to protect from multiple variants of such attacks.

# data[].attributes.attachment_link.readable_text
The threats to applications are evolving beyond the simple notion of "find exploit, access system, steal current data." In the cloud and on the network, both nation-state and criminal hackers are employing two very specific techniques to gain access to valuable data: ultra-targeted malware that is custom crafted to attack particular organizations, and persistent access, whereby miscreants are compromising systems, but then silently modifying them such that they can continually access sensitive data over long periods of time without detection. The bottom line on application security is that even with the best of effort it is almost impossible to guarantee security, but, as this new ebook from SC Magazine explains, there's every reason to strive to implement a best practices approach to protect the enterprise network, one that balances business realities with technical challenges.

Click here to download this ebook on application security.

# data[].attributes.attachment_link.description
The threats to applications are evolving beyond the simple notion of "find exploit, access system, steal current data." In the cloud and on the network, both nation-state and criminal hackers are employing two very specific techniques to gain access to valuable data: ultra-targeted malware that is custom crafted to attack particular organizations, and persistent access, whereby miscreants are compromising systems, but then silently modifying them such that they can continually access sensitive data over long periods of time without detection.

# data[].attributes.body
This is a very recent webcast that we found good enough to share. This session looks at the current state of application security and why treating the application seriously makes sense.

# data[].attributes.attachment_link.readable_text
The application layer is quickly becoming the most under-protected attack vector within the enterprise for data security. While wrangling with the explosion of resident and web-based applications, organizations are balancing the need for greater security in their applications. This session looks at the current state of application security and why treating the application as the "new data security perimeter" makes sense.

Techscape is SC Media's content marketing platform. Industry experts share their views in the following categories

Partner Content is sponsored content brought to you by a vendor

# data[].attributes.attachment_link.description
The application layer is quickly becoming the most under-protected attack vector within the enterprise for data security. While wrangling with the explosion of resident and web-based applications, organizations are balancing the need for greater security in their applications. This session looks at the current state of application security and why treating the application as the "new data security perimeter" makes sense.

# data[].attributes.headline
Group 8 (Mark Deel, Jonathan Pintos, Rachel Hale, and Long Phan)

# data[].attributes.subject
Group 8 (Mark Deel, Jonathan Pintos, Rachel Hale, and Long Phan)

# data[].attributes.body
In this case, the interception of an authentication token leads to unhindered access to a large amount of personal information as well as access to customer's devices.

# data[].attributes.attachment_link.readable_text
Check Point Researchers developed an attack to hijack DJI drone user accounts that may contain the user's sensitive information as well as access to the device itself.

Researchers developed an XSS attack that could be posted on a DJI forum that is used by hundreds of thousands of DJI customers, to intercept the identifying token and use it to log in as the customer, according to a Nov. 11 blog post.

The attack demonstrates the vulnerability in the drone's cloud network which can be accessed from anywhere by highlighting the need for a two-factor authentication mechanism, better identification mechanisms, and the importance of segmentation for organizations across their IT networks in order to contain and limit the damage inflicted by a potential attack.

The attacker enters the web forum, steals the cookie ID and login, then either uses the stolen information to either bypass SeNeo Mobile protection to access a DJI mobile app or to access the full DJI Flight Hub.

Once this is done, the threat actor has access to the drone's flight records, photos taken during flight, payment details, real-time access to the drones camera, , and a live view of the drone pilot's camera and location. Due to a loophole in DJI's customer identification process, researchers were able to hijack a user's account and take complete control over any one of the cloud-based platforms and the data stored there.

Drones have also been used to carry out their own attacks.

DJI drones are used in several industries ranging from critical infrastructure, manufacturing, agricultural, construction, emergency-management, government agencies, military and other sectors meaning an attacker could potentially gain access to crucial information.

Researchers noted that data provided by the drones could offer valuable reconnaissance information in the form of flight paths, photos, aerial video footage and maps. Those looking to target critical infrastructure could gain access to intricate details and images from facilities such as energy plants or water dams.

Attackers targeting delivery and logistics companies could gain insight to routes and may gain insight into which packages are being delivered where and to whom in order to intercept them.

DJI was informed of the vulnerability in March 2018 and the vulnerability has since been patched.

# data[].attributes.attachment_link.title
Drone vulnerability could compromise enterprise data | SC Media

# data[].attributes.attachment_link.description
Check Point Researchers developed an attack to hijack DJI drone user accounts that may contain the user's sensitive information as well as access to the device itself. Researchers developed an XSS attack that could be posted on a DJI forum that is used by hundreds of thousands of DJI customers, to intercept the identifying token and use it to log in as the customer, according to a Nov.

# data[].attributes.body
Back in May of this year, a bug was identified within Facebook's search page that potentially allowed attackers to monitor search queries of users, as well as capture other information. According to the article, the search end point was not CSRF protected and had other flaws. This would have allowed users to be tricked into clicking into a malicious website that revealed numerical data related to their accounts, such as number of friends, etc. On the 13th, Facebook announced that the bug had been closed thanks in part to their bug bounty program. This article shows the importance of constant vigilance and safeguarding personal info even on websites that are believed to be safe or trusted. In addition, this shows that security flaws are important to actively monitor for in all applications as user data is constantly at risk from attackers.

https://www.scmagazine.com/home/security-news/facebook-reportedly-fixes-search-bug-that-could-have-threatened-user-privacy/

# data[].attributes.body
https://www.scmagazine.com/home/security-news/companies-customers-will-avoid-you-after-a-breach-survey-says/

Our group chose this article because it stood out as unique in the way it addressed application security. Instead of focusing on the technical side of things, this article explains the negative impact that lax or compromised app security can have on a business. Lost revenue and decreased faith from customers can break an entity.

# data[].attributes.body
With the latest Facebook breach, Keith Casey from Okta API Problem Solver brings steps for mitigating challenges for organizations.
1. Require MFA at the IDP level
2. Require MFA Before Linking Accounts
3. Zero Trust for Social Authentication
4. The Real Problem: Don’t Allow Impersonation
No matter the IDP (Identity Provider) it should be standard practice to have a second authentication factor. The same should be needed before linking accounts. Things like resetting passwords, transferring money or booking hotels ant etc. should require reauthentication or additional factors to confirm user's approval or identity to mitigate fraud, support issues and brand damage no matter the inconvenience. impersonation seems beneficial to organizations, but it comes with some potential drawbacks that could leave your system vulnerable so it’s better to not allow impersonation because the small advantages it gives aren’t worth the risks.

# data[].attributes.attachment_link.readable_text
By Keith Casey, Okta API Problem Solver

Another day, another breach headline. What's unique about the latest Facebook breach is that it's the source of truth for many other companies and applications who use social platforms for authentication. A vulnerability in a social authentication service has far-reaching effects across thousands of apps and millions of users. But while social authentication or identity federation look like the major culprits here, at the end of the day, they just allowed the issue to spread, and there are steps that organizations can take to mitigate these challenges.

1. Require MFA at the Identity Provider Level. First, at a basic level, requiring a second factor of authentication should be a standard practice for your Identity Provider (IDP), be it an enterprise IDP like Okta or a social network such as Facebook. Using an IDP makes authentication simpler and more secure for both the end user and the organization: with social authentication, when a consumer visits a new website, instead of creating a new account, they can "Log in with X" and use Facebook, Google or LinkedIn. After authenticating on that site, the user is redirected back to their desired site and their profile is created. Some websites will go a step further and use their profile information, such an email address, to look up and combine this new account with a previous profile. Loyalty programs do it for marketing purposes, and banks, healthcare, and other may do it for convenience and flexibility for ever-connected consumers.

Because your IDP is the source of truth trusted by all other systems it is therefore the single most important place to protect. Let's face it: organizations need to be right 100% of the time, while attackers only have to be right once. With 80% of breaches today caused by poor or compromised credentials, adding multi-factor authentication (MFA) is a critical component of modern security hygiene for every app or website today - helping to prevent a poor password or credential-focused attack from becoming the weak link that allows an attacker into your ecosystem.

2. and Also Before Linking Accounts. Next, require MFA before you link existing and social accounts. Take an example of what this latest exploit could look like when it comes to using social authentication with your bank's online portal: if I have your Facebook/Google/etc. account and I go to a banking app and choose "Log in with X," I bounce to the social site, come back to the bank as "you" for all intents and purposes. If your bank and social account are already linked, I'm you. If your accounts aren't linked, your bank may be "helpful" and offer to link it for me based on email address. Once again, I'm you.

That's not to say that federated identity management should be abandoned as a result: the core values of social authentication still hold true. It's simpler for both the organization and the end user, and ultimately can play a role in helping to minimize the potential attack surface of users by limiting the number of accounts they're managing credentials. But whether you are a bank, hotel chain, or a similar consumer-facing business, you should use previously provided information such as email or phone number to confirm this linking is the actual user. At minimum, you could notify the user of the newly linked account to give them the opportunity to mitigate the attack in progress. Alternatively, if your Identity Provider supports step up multi-factor policies, you can designate certain applications as high security/risk and require MFA for them regardless of how the user authenticates. Many Okta customers do this internally for payroll systems and externally for changing travel reservations.

3. Zero Trust for Social Auth. Treat social authentication as a minimally trusted or even untrusted within your ecosystem. Between quizzes, silly apps, exploits, and the like, most people don't treat security seriously in social media. When the worst consequence is an inappropriate post, that may be okay. When that social network is a major basis for identity and single sign-on for the Internet, the consequences could be catastrophic. This isn't specific to any particular social network, it's just not within the realm of how the public considers security and modern digital identities. Therefore, as app creators and users of social authentication, we need to act to mitigate attacks.

In the near term, any transaction such as booking a hotel room, transferring money, or resetting a password must require a reauthentication or additional factor to confirm the user's approval. While this feels inconvenient in the short term, it can mitigate fraud, support issues, and corporate brand damage.

4. The Real Problem: Don't Allow Impersonation. Finally, the core of this entire issue is impersonation, or the ability to look at a system as someone else. The initial scenario for Facebook was, "How does this person see my profile?" - but instead of acting like that person, Facebook allowed you to become that person by generating an access token for that user. It's the equivalent of going to a hotel to meet your friend for dinner, and the front desk giving you their room key. Usually companies want user impersonation so their support team can see issues first hand or test out features. Unfortunately, when we have someone that lets us look and act like someone else, the boundaries become blurred. Can the impersonator add things to your shopping cart? Can they check out? If something goes wrong, can your logging distinguish the two?

Impersonation seems beneficial until you consider the consequences, implications, and every use case that might occur. When you combine the two, you have a potentially vulnerable system that could compromise downstream systems and impact every user and potentially every use case. I say "potentially" because it's now impossible to separate fact from fiction. So how to mitigate this issue? This one is simple: don't allow impersonation. The advantages are minor and the risks are catastrophic.

The benefits of social authentication are clear: simple, secure authentication for both the user and the app. By taking the simple steps above, organizations can take advantage of social authentication while also mitigating potential threats to their users.
Keith Casey works on Identity and Authentication APIs at Okta. His goal is to get great tools and technologies into smart people's hands to do amazing things

# data[].attributes.attachment_link.title
Using Social Auth with Your App? 4 Steps to Protect Your Users and Mitigate Security Concerns | SC Media

# data[].attributes.attachment_link.description
By Keith Casey, Okta API Problem Solver Another day, another breach headline. What's unique about the latest Facebook breach is that it's the source of truth for many other companies and applications who use social platforms for authentication. A vulnerability in a social authentication service has far-reaching effects across thousands of apps and millions of users.

# data[].attributes.headline
SC- Application Security - Jessie Reddish (Group4)

# data[].attributes.subject
SC- Application Security - Jessie Reddish (Group4)

# data[].attributes.body
https://www.scmagazine.com/home/security-news/report-reveals-struggles-of-smbs-navigating-cyber-threat-landscape/
Report reveals struggles of SMBs navigating cyber threat landscape - 47% Small/Medium businesses have no understanding of how to defend their companies against attacks. A lack of resources, training, and personal is the leading cause to a company's data breach. SMBs are losing the battle to high tech attacks and will need to make a serious investment in cyber security to shore up their data protection.