Tre av de topp 20 investorene i Microsoft Corp er lobbyvirksomhet styret å trykke i Bill Gates å gå av som leder av programvareselskapet han medgrunnlegger 38 år siden, ifølge folk kjent med saken.

Mens Microsoft-sjef Steve Ballmer har vært under press i år å forbedre selskapets ytelse og aksjekurs, synes dette å være første gang at store aksjonærer er tar sikte på porter, som fortsatt er en av de mest respekterte og innflytelsesrike figurene i teknologi.

En representant for Microsoft nektet å kommentere tirsdag.

Det er ingen indikasjon at Microsofts styret hadde akt ønskene til de tre investorene, som har samlet mer enn 5 prosent av selskapets aksjer, ifølge kildene. Forespurte identiteten til investorene være holdt anonyme fordi diskusjonene er privat.

Gates eier ca 4,5 prosent av 277 milliarder dollar selskapet og er den største enkelte aksjonæren.

De tre investorene er opptatt av at Gates' tilstedeværelse på styret effektivt blokkerer innføringen av nye strategier og begrenser kraften i ny direktør å gjøre omfattende endringer. Spesielt peker de til Gates' rolle på special committee søker etter Ballmers etterfølger.

De er også bekymret for at Gates - som tilbringer mesteparten av sin tid på hans filantropiske foundation - slår kraften ut av forhold til sin nedadgående eierandel.

Gates, som eide 49 prosent av Microsoft før det gikk offentlig i 1986, selger ca 80 millioner Microsoft aksjer et år under en pre-set plan, som hvis fortsatte ville forlate ham med ingen økonomisk eierandel i selskapet av 2018.

Gates senket sin profil hos Microsoft etter at han ga CEO rollen til Ballmer i 2000, gi opp sitt daglige arbeid det i 2008 å fokusere på $38 milliarder Bill & Melinda Gates Foundation.

I August sa Ballmer han ville pensjonere innen 12 måneder midt press fra aktivisten forvalter ValueAct Capital Management.

Microsoft er nå på jakt etter ny konsernsjef, om styret har sa Ballmers strategi vil gå fremover. Han har fokusert på å lage enheter som overflaten tavle- og Xbox gaming konsollen, og snu nøkkel programvare til tjenestene på Internett. Noen investorer si at en ny sjef ikke bør være bundet av denne strategien.

Microsoft er fortsatt en av verdens mest verdifulle teknologibedrifter, gjør et netto overskudd på $22 milliarder i regnskapsåret. Men kjernen Windows computing operativsystem, og i mindre grad Office-programvarepakke, under press fra nedgangen i personlige datamaskiner som smartphones og tabletter vokse mer populært.

Aksjer i Microsoft er i hovedsak statisk i et tiår, og selskapet har mistet bakken Eple Inc og Google Inc i farten mot mobil databehandling.

En av kildene sa Gates var en teknologi bransjens største pionerer, men investorene følte han var mer effektiv som konsernsjef enn som formann.

Kan du lese:

Aaron's Law for å hedre Internett aktivist, kan du omdefinere datamaskin svindel

The website Songsrpeople.com looks a lot like other amateur-video sites. It is wallpapered

with clips featuring "the most insane amusement park ever" and "your girlfriend's six friends."

The site draws tens of thousands of visitors a month, according to audience measurement firms. It also has ads for national brands, including Target Corp., Amazon.com Inc. and State Farm.

But Web-security investigators at a firm called White Ops contend that most of the site's visitors aren't people. Rather, they are computer-generated visitors, or "bots," designed to fool advertisers into paying for the traffic, says White Ops, which has blacklisted the site—and thousands more like it—so that ads from clients such as Zipcar don't land there.

An anonymous representative for Songsrpeople declined to discuss the site's traffic but in an email called the White Ops methodology into question.

State Farm said it was looking into the matter while Target declined to comment and Amazon didn't immediately respond to requests for comment.

Authorities and Internet-security  experts say tens of thousands of dubious websites are popping up across the Internet. Their phony Web traffic is often fueled by "botnets," zombie armies of hijacked PCs that are controlled from unknown locations around the world, according to Internet security experts.

The sites take advantage of the simple truth that advertisers pay to be seen. This creates an incentive for fraudsters to erect sites with phony traffic, collecting payments—often through middlemen and sometimes directly from advertisers.

"When you walk into this world, you walk with eyes wide open," said Brian Harrington, chief marketing officer at Zipcar, which ran a recent ad campaign, assisted by White Ops to filter out bogus traffic. "You know stuff is not real."

At their most sophisticated, botnets can mimic the behavior of online consumers, clicking from one site to the next, pausing at ads, watching videos, and even putting items in shopping carts. Further Information

Source

Mein letzte Beitrag eröffnet das Thema Internetsicherheit für Kleinunternehmer – was ungefähr und wann Sorgen machen? Dieser Beitrag wird auf Spear Phishing. Ich bat um die Hilfe eines unsere Information-Security-Spezialisten Scott "Shagghie" Scheferman mit technischen Details zu diesem Beitrag helfen. Spear-Phishing unterscheidet sich und ist mehr als eine einfache Phishing anfügen, dass es entweder auf eine Gruppen- oder noch schlimmer, beim Empfänger gezielt ist. Spear-Phishing ist ein Angriff, der in der Regel durchgeführt, über eine gezielte e-Mail entweder mit eine böswillige Anlage oder mit einem Link auf eine manipulierte Website. Die meisten unserer Leser wissen auch dies eine schlechte Sache ist, und dass mit einem Klick sollten nicht auf Links in e-Mails von Menschen, die der Leser weiß nicht oder Vertrauen. Eine gezielte und elegante Speer-Phishing-Attacke soll hingegen sind die bedingten Barrieren zu umgehen, hat ein typischer Benutzer auf das "Rauschen" im Internet.

Um wirklich sich vor Spear-Phishing-Attacken zu schützen, ist es wichtig zu verstehen, was passiert, bevor und nachdem die böse e-Mail in Ihrem Posteingang dort ankamen, und was passiert, wenn jemand in Ihrer Organisation zum Opfer fällt. Mit besseren Einblick in den Angriff von der Wiege bis zur Bahre ist selbst ein Teil Ihrer Organisation zu verteidigen.

Spear-Phishing ist Social-Engineering über elektronisch

Das erste, was zu erkennen ist, dass Spear-Phishing sehr langer Zeit seit ist und letztendlich nichts anderes als Social Engineering (SE) über elektronischem Wege ist. Der Kern-Fahrer hinter einem Spear-Phishing-Attacke ist, dass jemand da draußen will Ihnen, dem Benutzer eines Systems, etwas, das sie ohne irgendeine Form der Maßnahmen zum Erfolg Ende bringst du nicht. Ein klassisches (d.h. retro) Beispiel wäre jemanden zu wollen, überweisen Sie Geld oder senden Sie einen Scheck. Ein aktuelleres Beispiel würde sein jemand, die Sie benötigen, klicken auf einen Link in einer e-Mail, die Ihren Internet-Browser auf eine schädliche Website (etwas, das sie nicht allein von Ihrem Laptop) verweist, so dass eine in Ihrem Browser Sicherheitsanfälligkeit und Ihren gesamte Laptop dadurch beeinträchtigt wird. In diesem Zeitalter der Firewalls, Intrusion Detection Systeme (IDS), Anti-Virus und < hier einfügen-sicherheitstechnologie > ist der kürzeste Weg in einem Netzwerk durch die Schwäche in menschliches Verhalten verkörpert. Genauer gesagt, in der eine Person, die Neigung zu vertrauen, um zu helfen, zu gehorchen oder einfach zu neugierig oder unterhalten werden.

Dem Vorwand

Da die Spear-Phishing ist eine Form der elektronischen SE, dann daraus folgt, dass es in der Regel eine Art Vorwand enthält. Und da wir von Spear-Phishing (Vize-nur Phishing) sprechen, dieser Vorwand ist wahrscheinlich auf die Person (oder eine Organisation) wird Ziel. Dem Vorwand soll so viele Vermutungen, Inhibitoren und natürliche Reluctances wie möglich seitens des Opfers zu entfernen, während zugleich eine Motivation auf eine Klage. Die effektivsten Angriffe sind häufig die einfachste und einfach imitieren normale tägliche operative Tätigkeiten, die in der Opfer Rolle innerhalb der Organisation auftreten. Der Angreifer hofft auf eine heiter Entscheidung des Opfers, im Idealfall eine die behaviorally Pre konditionierten bedenkenlos ausgeführt werden. Dies ist, warum im Jahr 2013, wir alle lachen, wenn wir sehen eine Phishing-Mail aus einer afrikanischen Prinz, der braucht nur ein wenig Geld zu helfen, ihre Nichte, und wer verspricht, Ihren Rücken 3-fach für Ihre Bemühungen zu bezahlen. Im Jahr 1997 hätte sie haben jemand besonderes fühlen und ziehen auf einige Herz-Saiten. Heute ist es nur ein Ärgernis. Wir haben konditioniert worden, um diesen Angriff zu ignorieren. Wie alle Wettrüsten jedoch ändern die Angreifer ständig ihr Konzept um neue Verteidigungsmaßnahmen umgehen. Wenn ein Angreifer kennt Sie in Ford Mustangs, und schickt Ihnen einen Link zu einem Video, die zeigt einen Mustang, einen Camaro handlich zu schlagen, sind Sie möglicherweise genauso gut wie Sie 1997 waren auf den Link im Jahr 2013 klicken

Im Zeitalter der Facebook-Facebook, Twitter und Instagram ist es einfach genug über ein potenzielles Ziel Schaffung ausreichenden Vorwand um sogar die meisten bewusst Endnutzer hinters Licht führen zu entdecken. Versuchen Sie einfach Ihren vollständigen Namen in Klammern googeln und sehen Sie, was kommt. Dann einfach die Entwurfsergebnisse 'Bilder'. Alles, was ein Angreifer in der Regel wissen muss, kommt sofort.

Die elektronische Angriff

Der Angreifer einen Vorwand, mit arbeiten entschieden hat, ist der nächste Schritt, die e-Mail entsprechend zu konzipieren. Aber dies kann nicht geschehen, solange der Angreifer bestimmt, eigentlich nach was sie sind und wie sie es bekommen willst. Das Ziel Erpressung alles, was sie wollen, können ist, die Anmeldeinformationen zu einer Führungskraft-e-Mail-Konto. Wenn eine Datenbank von Kunden und Kreditkarteninformationen stehlen soll, müssen sie fassen im Netzwerk als Plattform, um weitere Angriffe auszuführen. Wenn das Ziel ist, die Identität des Opfers zu stehlen, müssen sie nur das Gerät Stamm, den das Opfer verwendet wird, wenn sie auf die e-Mail zugreifen. Der Punkt ist, dass Spearphishing-e-Mails gefertigt sind, um ein Ziel zu erreichen, und es viele Möglichkeiten gibt zu tragen dieses heraus, die einige davon werde ich hier auflisten:

·  Bösartige Anlage: Häufig verwendet, um das gesamte Betriebssystem (OS) Wenn kompromittieren doppelgeklickt

·  Böswillige Hyperlinks: Verwenden, um die Opfer-Internet-Browser auf eine schädliche Website zu verweisen, die entweder kann eine) bitten Sie die Benutzer zur Eingabe von Benutzername/Passwort in ein Formularfeld oder b) um einen Fehler im Browser oder in Java zum Ausführen von Code auf dem System des Benutzers und beeinträchtigen das gesamte OS.

·  Doppelattacke Barrel: Dies beginnt mit der e-Mail eine gutartige (locken), die ist harmlos und erfordert keine Antwort vom Opfer. Es könnte sein, eine einfache Einführung wie: "Hallo, wir trafen auf der CES letzte Woche und hatte ein großes Gespräch! Ich habe ein Weißbuch ich gemeinsam mit Ihnen auf der Grundlage möchte von was wir darüber gesprochen, und sendet es über kurz. " Ein wenig später, das oben genannten Weißbuch erscheint und das Opfer ist jetzt bereit, es zu erhalten. Beachten Sie, dass die Reihenfolge der Übermittlung auch rückgängig gemacht werden kann: senden die Verlockung nach der böswilligen e-Mail um dem Opfer ein Gefühl der Zuversicht in der ganzen Erfahrung zu geben. Wieder einmal ist Social-Engineering im Herzen jedes einzelnen Spearphishing-Angriffs.

·  Andere Methoden: Während wir oft an Spearphishing als eine e-Mail-basierte Bedrohungen denken, kann es tatsächlich erfolgen über alle elektronischen Medien von Handys, SMS-Nachrichten, Chat-Boxen, social Media-Sites, Blogs (aka Bewässerung Loch Angriffe), Kommentare gepostet in online-Artikeln, die als ein sehr spezifisches Publikum, etc. Ziel. Einige der effektivsten Attacken verwenden mehr als ein Medium, um jemand als Ziel. Und einige sogar beinhalten stoßen das Opfer absichtlich auf ihre Lieblings Kneipe, ein Gespräch, das dazu führt Kontaktinfos, beginnen und Erstellen von dem ursprünglichen pre Text für die e-Mail, die schließlich wird an das Opfer, ähnlich wie "Auschecken großen dich heute Abend zu treffen, und groß wie Mustangs gefreut... dieses Bild!" (und der Link verweist auf eine schädliche Website). Mit anderen Worten, können Angriffe einfach und beredt, oder sie können sein, komplexe und vielschichtige, je nachdem, wer das Opfer ist, richtet sein.

Post-Kompromiss-Aktivitäten

OK, so dass dem Vorwand festgelegt wurde, die e-Mail gesendet wurde, und das Opfer auf den Link geklickt hat, oder die Anlage öffnet. Was passiert nun? Kurze Antwort: Sie nennen Sie es, es passiert. Sicherheitslücken in Browsern sind allgegenwärtig, und wenn sie heute gepatcht werden, neue werden aufgedeckt morgen. Kombinieren, dass mit einem Exploit Umgebung wie der Social-Engineering-Toolkit (SET), und es hübsch ist, viel Spiel vorbei wenn ein Opfer sagen, Java auf ihrem Browser... läuft welche die meisten Menschen tun. Selbst wenn jemand nicht über Java läuft, ist eine infizierte Datei-Anlage alles, die was nötig ist. Gerade mit Blick auf die aktuellen Adobe-Sicherheitslücken in PDF-Dateien, kann die S.E.T der Angreifer, von jedem der folgenden Adobe-Sicherheitslücken zu wählen, um die Anlage zu erstellen:

1. Adobe CoolType singen Tabelle "UniqueName" Überlauf (0day)

2. Adobe Flash Player 'Newfunction' ungültiger Zeiger verwenden

3. Adobe Collab.collectEmailInfo Pufferüberlauf

4. Adobe Collab.getIcon Pufferüberlauf

5... ...und mehr

Erinnern wir uns auch, dass Antiviren-Lösungen immer Präsens Angriffe Trail werden und ein anspruchsvoller Angreifer speziell nach Ihren corporate "Family Jewels" Wer wird weniger wahrscheinlich, dass die gestrigen Schwachstellen zu verwenden, wenn es so viele "Null-Tage" im Anschlag gibt. Das heißt, einige neueren Lösungen wie die von Invincia gehen einen langen Weg zur Bekämpfung von bösartigen Dateianhänge, wenn Ihre Organisation glücklich genug, um sie umzusetzen ist.

Wenn jemandes OS gefährdet ist, öffnet sie die Tür zu einer Vielzahl von Folgenahrung Angriffe, die weitere Gefährdung des anderen Hosts in demselben Netzwerk wie Packet-sniffing, anfällige Dienste usw. zur Folge haben kann. In einem Fall, wo das Opfer hat gefallenen Opfer Eingabe ihre e-Mail oder banking Anmeldeinformationen in eine gefälschte Website, die legitime aussieht, ist es offensichtlich was da passieren kann. Aber vielleicht nicht so offensichtlich ist das enorme Risiko erpresst vom Angreifer nach, mit der Gefahr offenbart dem erfolgreichen Angriff oder andere Informationen, die der Angreifer entdeckt haben könnte. Oder schlimmer noch, der Angreifer nicht finanziell motiviert aber ist eine Hacktivist, die stark macht, dass sie das wohl von dienen

Die Verteidigung

So wie Sie sich und Ihr Unternehmen gegen diese Bedrohung zu verteidigen? Der erste Schritt besteht darin, die Bedrohung verstehen: anzuerkennen, dass es gibt viele Motive und motiviert Parteien draußen und sie sind bewaffnet mit relativ einfach zu bedienende Werkzeuge und die große Informationen über das Internet und social Media-Sites zur Verfügung. Wenn eine Bedrohung bedeutet, Gelegenheit und Motiv in aufgeteilt werden kann, ist dann zu verstehen, was diese Komponenten möglicherweise der beste Weg um zu starten. Beginnen Sie sich zu Fragen, welche Motive, die jemand haben könnte, um Ihre Organisation anzugreifen. Welche Informationen wäre vorteilhaft für Konkurrenten oder schädlich für Ihr Unternehmen treffen, sofern? Welche Daten leisten können nicht einfach, verloren oder geändert, ohne ernsthaft Auswirkungen auf die Fähigkeit des Unternehmens, seine Ziele zu erreichen? Das ist die Daten wahrscheinlich ausgerichtet sein und erfordert den größten Schutz. Als Unternehmer oder Executive sind Sie bereits ein Ziel durch Ihre Position und wahrscheinlich zur Verfügung, die Ihre Anmeldeinformationen in das Königreich Unternehmensdaten liefern können. In der Tat, es ist ein Begriff für Führungskräfte speziell targeting: anstelle von Spear-Phishing, nennt man "Walfangschiffe."

Nach dem Verständnis der Bedrohung, ist der nächste Schritt zu die zwei Kerngebieten Sicherheitsanfälligkeit zu beheben:

1) Ihre Menschen: Start durch die Aufklärung selbst und Ihre Benutzer. Es gibt viele Ressourcen und professionelle Organisation, die können die Spear-Phishing-Bedrohung zu beschreiben und zeigen die Tiefe des Schadens, der aus eine erfolgreiche Spear-Phishing-Attacke erreicht werden kann. Fokussierung auf die Grundlagen, wie ein Angreifer kann strukturieren den Angriff, wie eine e-Mail-Adresse oder Telefonnummer leicht gefälscht werden kann, wie Hyperlinks können Sie auf ein anderes Ziel nehmen, als es scheint, alle grundlegenden Verkehrsregeln sind jeder kennen sollte, bevor hopping hinter dem Lenkrad im Internet. Eine wirksame Anti-Spear-Phishing-Kampagne muss nicht nur die Bildung, jedoch aber auch Verhalten. Die am besten ausgebildeten Endbenutzer in der Welt können noch tappen um Phishing-Angriffe zu Speer, wenn sie nicht wissen, wie ihre normalen Verhaltensmuster um ihr Risiko zu minimieren ändern. Dies bedeutet, zeigt, wie anhalten vor dem Klicken auf Links, wie auf Hover über Hyperlinks zu sehen, wo sie eigentlich zu zeigen, wie verdächtige Text und Grammatik zu erkennen und was zu tun, wenn sie eine verdächtige e-Mail erhalten. Es gibt Lösungen wie Phishme.com, die eigentlich Spear-Phishing-Mails zu senden, und sollten sie auf einen Link oder eine Datei öffnen, werden sie sofort benachrichtigt, dass sie Spear Phishing hätte und sie sofort zu einer Trainingsübung gebracht sind, um ihr Bewusstsein zu fördern. Im Laufe der Zeit lernt das Kind nicht zu den heißen Griff auf dem Herd zu berühren, und das ist was Verhaltenänderung dreht sich alles um: Klimaanlage.

2) Ihre Technologie: Während Anti-Virus-Lösungen sind weitgehend wirkungslos auf Kompromiss zu verhindern, gibt es andere technischen Lösungen, die wirkungsvoll sind. Invincia hat eine Technologie, dass Sandboxen alle Anlagen, die geöffnet sind und untersucht das Verhalten der was geht auf danach, um feststellen, Muster, Verbindungen und Memory Access verarbeitet, die fragwürdig ist. E-Mail-Spam-Filter sind auch effektiv bei Entfernen der Abschuss von allgemeinen Phishing-Angriffe, wie reverse-Proxy-Lösungen, Black-List-Abo-Dienste, etc.. In größeren Organisationen können Produkte, die für atypische Netzwerkverbindungen zu sehen in identifizieren kompromittierten Computern nach der Exploit, wirksam sein, obwohl zu diesem Zeitpunkt bereits Schaden gekommen haben kann.

Ich hoffe, dieser Beitrag war hilfreich für Unternehmer und Führungskräfte bei der beschreiben der Gefahr, dass Spear-Phishing-Angriffe Pose und wie Sie Ihre Unternehmensdaten vor dieser Bedrohung zu schützen.

We all live in public, at least as far as the US National Security Agency is concerned. As Internet users and global citizens become more aware of surveillance activities that the US and other countries are doing on the World Wide Web, there are those who seek to ensure that privacy and personal freedoms aren’t trampled upon.

Tor technology aims to help appease privacy advocates and offer a way in which the Internet can be enjoyed without the prying eyes of surveillance programs or other tracking software. This free piece of software has certainly become mainstream in light of recent events, but what is Tor and why does it matter to you, your family, neighbors, co-workers, and the rest of the Internet?

Peeling back the onion layers

It might surprise you that the Tor Project, originally an acronym for The Onion Router Project, was initially funded by the US Naval Research Laboratory and helped launch the development of onion routing (anonymous communication over a computer network) on behalf of DARPA. It had also received the backing from the Electronic Frontier Foundation.

When users installed Tor software onto their computers, it would conceal their identity and network activity from anyone spying on their behavior. This was accomplished by separating the identification and routing information. The data is transmitted through multiple computers via a network of relays run by like-minded volunteers — almost like how users installed SETI software to look for extraterrestrial beings.

Tor isn’t the only service that helps you hide in the shadows away from the prying eyes of the federal government, or any other person who would do it for malicious purposes. However, some say that it’s better because it works at the Transmission Control Protocol stream level. Full post

The personal battle of owner-operators against fraudsters

For autonomous entrepreneurs, fraud is a truly ominous and pervading risk. Private businesses are very susceptible to the threat of fraud because of the character of their enterprises.

Majority have no corporate structure to identify and/or engage with an occurrence, choosing often to shrug their shoulders and let it go.

Yet, there is a lot businesses can do to protect themselves. Like any big company, owner-operators can take steps to detect the signs of fraud and reduce the damage within their group.

A KPMG report entitled, “Who is the typical fraudster?”, recently released findings based on 350 fraud investigations. It showed a “distinctive model” that describes qualities and work habits of fraudsters. Appreciating these telltale signs can help you establish a workable risk management approach.

The study also disclosed that most fraudulent events are either steps to cover up losses or low productivity, or includes the misuse of assets (misappropriation or purchasing fraud). A revealing fact derived from the study is that the main cause for majority of the proliferation of frauds remains to be the exploitation of faults in internal controls (a surprising 74% of all cases had such unstable internal controls). In short, the opportunity for fraud is potentially high.

One other reason clearly arises from human nature: motivation. Fraudsters are often enticed by personal desire to satisfy a need such as an addiction or driven by a pressing financial problem. Strongly related to that is psychological justification. This factor must be present to lead people to breach the law and to commit unlawful deeds. For instance, they rationalize and convince themselves they are being short-changed and tell themselves they are merely “taking out a loan” and are planning to pay it back anyway.

Once fraud is committed, usually it is personal; and being so, private businesses are very prone to considerable damages. And more importantly, the effects of duplicity can considerably ruin an environment wherein senior workers are also treated as intimate friends.

Dealing with our customers who are private firms, we observe so many common organizational qualities which engender the opportunities for fraud. First, there exist no internal control systems, whether due to lack of knowhow, time, or, simply, due to childish trust.

Second, business owners have a tendency to foster more intimate personal connections with their employees and tend to trust them with major tasks.

Which leads us to a third threat. Trusted employees in private business usually perform independently, and, in most instances, manage a variety of responsibilities. A big company would never give to one employee the tasks of handling deposits, mail, and bank statement reconciliation, for instance. It is obvious that one person handling both record-keeping and assets, subjects the person to the temptation of misusing assets and manipulating accounting records to hide the fraud.

What then can a private business do to reduce the danger of fraud?  Seven tips below will show you some best practices that can help you improve in your risk-management capability:

1. Never give the task of handling your assets to only one person. Doing so can place you in a very risky situation and allows that person to manipulate your assets in case the opportunity and motivation arise. Make sure your banking procedures (e.g., withdrawals, deposits, account reviews, etc.) are assigned to different employees.

2. Be watchful on your financial tasks. Make certain that have access to electronic banking and remittance activity records. Impose a monthly report of your financial statement as well reviews and check if numbers match the sub-ledgers.

3. Never sign blank checks. This seems an obvious mistake; but many enterprises practice this to simplify payments. Determine to whom those checks are for. Are they individuals or firms you know?

4. Conduct independent assessments of financial procedures and examine the figures. Oftentimes, entrepreneurs overestimate the loyalty of persons and stop scrutinizing these kinds of tasks.

5. Conduct background evaluation on new employees. Fraud is not limited only to long-standing workers. There are persons who have the modus operandi of shifting from one business to another in order to commit fraud.

6. Beware of the “red flags” with your personnel. These are telltale signs showing aggressive attitudes, secrecy, arrogance, emotional stress, desire to micromanage, passing on blame and intimidation, and many others.

7. Never let your desire to remain “lean and mean” cause you to disregard the value of legal counselling services. Hire someone with the ability to assist you on the vital task of identifying possible risks, apply controls and prevent likely damages.

Private businesses are prone to fraudulent schemes. These businesses often have a built-in culture of intimate personal relationships and confidence. Hence, although the amounts involved may seem smaller compared to other firms, the potential for fraud are significantly higher, and the resulting damages can be even bigger and much more tragic.

Understanding the proclivities of the 2014 FIFA World Cup fans gives criminals an advantage. The World Cup provides a window of opportunity and a tremendous vehicle for online fraud such as phishing. Not only do the targets accept that they will receive a barrage of World Cup-related solicitations, but they often desire said solicitations and are excited to “click”.

This “perfect storm” isn’t specific to the World Cup. Phishing scams are often associated with current events such as:

Entertainment in the form of movie trailers, awards and celebrity photos

Sporting events with large, preferably global audiences

Natural disasters, political elections and military actions

Viral videos of animals seeing themselves in mirrors

Unfortunately for the targets of phishing, the fraudsters have nefarious ulterior motives. The fraudsters may be interested in identity theft, stealing credentials, stealing financial information, locking your system and holding it for ransom, or adding your device to their botnet army to be controlled at will. The results of phishing can impact individuals and organisations. The impact can be felt in a number of ways including depleted bank accounts, credit debt, sensitive/personal data theft, countless hours of negation with financial institutions, embarrassment, stress–the list goes on.

The risks to the criminals are low. This is because the likelihood of being apprehended and the severity of the punishment for phishing, and mostcybercrimes depending on country, are low. Thus legal deterrence is ineffective.

Phishing Safeguards

While there is no anti-phishing panacea that will mitigate all threats, there are technical and non-technical controls that can reduce the risk of a phishing attack being successful. Here are 15 safeguards to consider:

Verify before you click, download and open

Use bookmarks instead of clicking on a link, or typing in a URL with potential misspellings; that URL could take you to a malicious site

Don’t respond to emails with sensitive data

Don’t enter sensitive data it into a form indiscriminately

Don’t enter sensitive data into pop-up windows

Understand criminal tactics and if in doubt pick up the phone – criminals will try to create a compelling event such as

Enter your password or all your cloud data will be corrupted

Click here to avoid your Internet service being disconnected

Final warning – download this anti-malware tool to avoid shutdown

You have five seconds to comply or your bank account will be frozen

Your smartphones and tablets are computers too and the security best practices you apply to traditional computers like laptops should apply to them

Keep your operating systems and applications patched and up-to-date

Use web filtering software to disallow access to known bad sites — many are free

Use browser phishing protection — common in most modern browsers

Install and update endpoint security controls

All legitimate websites requesting personal information such as your bank should be encrypting communications — look for “HTTPS” and or the lock icon in the browser’s URL field

Keep an eye on your account activity — many sites provide last login date, location, and so on

Use credit activity monitoring services

Report suspicious activity and opt in to share threat intelligence via your security solutions — use the crowd as a force multiplier

With events like the World Cup where information is flooding our laptops, tablets and smartphones from all directions, it is important not to get so caught up in the moment and forget the criminals are working overtime.

By considering these 15 safeguards and successfully mitigating phishing attacks, you’re negatively impacting the criminal revenue stream and making this type of fraud less appealing.

Card fraud was up 16 per cent to $304 million in 2013, with the number of transactions on lost or stolen cards continuing to rise, spiking 26 per cent to $34 million.

Related Article:

http://hassassociates-online.com

http://hassassociates-online.com/articles

OTTAWA - Many of the Justice Department's finest legal minds are falling prey to a garden-variety Internetscam.

An internal survey shows almost 2,000 staff were conned into clicking on a phoney "phishing" link in their email, raising questions about the security of sensitive information.

The department launched the mock scam in December as a security exercise, sending emails to 5,000 employees to test their ability to recognize cyberfraud.

The emails looked like genuine communications from government or financial institutions, and contained a link to a fake website that was also made to look like the real thing.

Across the globe, an estimated 156 million of these so-called "phishing" emails are sent daily, and anyone duped into clicking on the embedded web link risks transferring confidential information — such as online banking passwords — to criminals.

The Justice Department's mock exercise caught 1,850 people clicking on the phoney embedded links, or 37 per cent of everyone who received the emails.

That's a much higher rate than for the general population, which a federal website says is only about five per cent.

The exercise did not put any confidential information at risk, but the poor results raise red flags about public servants being caught by actual phishing emails.

A spokeswoman says "no privacy breaches have been reported" from any real phishing scams at Justice Canada.

Carole Saindon also said that two more waves of mock emails in February and April show improved results, with clicking rates falling by half.

"This is an awareness campaign designed to inform and educate employees on issues surrounding cyber security to protect the integrity of the department's information systems and in turn better protect Canadians," she said in an email.

"In this case, this exercise specifically dealt with the threat from phishing which is increasingly being used as an attack vehicle of choice by cyber criminals."

"As this project progresses, we are pleased that the effectiveness of this campaign is showing significant improvement."

A February briefing note on the exercise was obtained by The Canadian Press under the Access to Information Act.

The document indicates there are more such exercises planned — in June, August and October — and that the simulations will be "graduating in levels of sophistication."

Those caught by the simulation are notified by a pop-up window, giving them tips on spotting malicious messages.

The federal government's Get Cyber Safe website says about 10 per cent of the 156 million phishing emails globally make it through spam filters each day.

Of those, some eight million are actually opened by the recipient, but only 800,000 click on the links — or about five per cent of those who received the emails.

About 10 per cent of those opening the link are fooled into providing confidential information — which represents a worldwide haul of 80,000 credit-card numbers, bank accounts, passwords and other confidential information every day.

"Don't get phished!," says the federal website, "Phishing emails often look like real emails from a trusted source such as your bank or an online retailer, right down to logos and graphics."

The site says more than one million Canadians have entered personal banking details on a site they don't know, based on surveys.

In late 2012, Justice Canada was embroiled in a major privacy breach when one of its lawyers working at Human Resources and Skills Development Canada was involved in the loss of a USB key.

The key contained unencrypted confidential information about 5,045 Canadians who had appealed disability rulings under the Canada Pension Plan, including their medical condition and SIN numbers. The privacy commissioner is still investigating the breach.

There are times — many, in fact — when I love online banking.

Then there are other times when I find it so frustrating — and costly — that I think maybe I should pull the virtual plug. That’s because I make careless mistakes in paying my bills.

Maybe you do, too. If so, I’d like to spare you some of the same pain, so I’m here to offer tips to help you avoid similar banking frustrations.

But first: How do I love online banking? Let me count the ways.

(MORE: 9 Ways to Simplify Your Financial Life)

What I Love About Online Banking

First, there’s the ease of being able to check my balance at any time of day or night on my computer or smartphone. I also adore online banking’s simple bill-paying features. At one sitting, I can arrange my payments and schedule them for different days, often weeks in advance, closer to the due dates.

And just last week, my bank launched a mobile phone app that lets me deposit a check simply by taking a photo of the front and (after I endorse it) back. Zap, zip and it’s done.

What I Don’t Love About Online Banking

What’s not to love about online banking? Unfortunately, I’ve learned the hard way that it can sometimes be my nemesis. Three examples:

The forgotten click. Once, in my rush to complete a batch of electronic payments, I neglected to click the “schedule payments now” button. I discovered the error when the next batch of bills came due — with outstanding balances and penalty fees. (Fortunately, I got the fees waived after explaining the error; but if I made this faux pay again, I don’t think the companies would be so accommodating.)

(MORE: 3 Simple Tips for Easier Computing)

The water torture. A few months ago, our public utility notified us that they were about to cut off our water since we hadn’t paid our quarterly bill. Turns out I’d entered the date for a month after it was due, so the payment failed to arrive.

Unfortunately, I didn’t open the notice until 5:15 p.m. on a Friday, after the utility’s office closed. So I nervously sweated out the error over the weekend. When the office opened on Monday, I went there to pay my bill.

Beyond my blues — Verizon. Once I sent my electronic payment for Verizon Wireless to my Verizon landline account. I discovered the mistake when the next Verizon Wireless bill arrived past due and with a penalty. I quickly paid up and asked Verizon to return my money from the landline account, but the company said I had to wait 60 (!!) days to get it.  Grrr.

Those mistakes are nothing compared to a friend who sent her health insurer $254,600 electronically for a $254.60 bill. You guessed it: She misplaced a decimal point. Fortunately, the insurer caught the mistake, notified her and never deposited the money. Still, the thought that it could have prompted both of us to have all sorts of nightmarish thoughts of bounced checks, overdraft fees and penalties.

Experts say the government should get involved with tackling the challenge of social engineering scams

Research just published claims to show that more than £21 million has been lost in the UK to social engineering scams in the first five months of the year - with around 23 percent of people in the UK having received a cold call requesting personal or financial information.

To raise awareness of the issue, Get Safe Online (GSO) - the Internet safety and security agency - has produced a new series of informative videos offering advice and tips.

According to GSO – a sponsored agency that seeks to promote education on Internet safety - social engineering is the use of deceit to manipulate or trick victims into certain actions including divulging personal or financial information.

Examples, says the agency, include phishing emails and fraudulent phone calls asking for personal or financial information - known as vishing - or phone calls from fraudsters impersonating computer technical support agents.

Tony Neate, the agency’s chief executive - who helped set up GSO in the mid-2000s after a lengthy career in the Police – says it is important that the public are aware of what social engineering actually is, as there are so many types which can lead to the theft of your money or identity.

It can be easy to fall prey to social engineering, he says, as schemes can be elaborate and highly convincing, with approaches usually made by somebody you think you should trust or who appears to be in authority.

"It’s not just individuals who are likely victims, it’s also businesses. We hope that by raising awareness of how to avoid becoming a victim of social engineering through our online videos and activity with our partners, we can help prevent it from happening to others," he explained.

The Head of the NFIB and Action Fraud, detective superintendent Peter O’Doherty, said that the face of crime has significantly changed in recent years, with much of today’s offending being conducted over the phone and through a computer rather than face-to-face.

"People need to be aware there are ruthless, calculating criminals using social engineering scams to obtain personal and financial information that makes them a profit and makes individuals and businesses victims of crime. This multimedia Get Safe Online campaign will shine a light on these practices and help the public know when they are being targeted and the best ways to protect themselves," he explained.

Commenting on GSO’s latest Internet user education move, Professor John Walker, a visiting professor with Nottingham Trent University’s School of Science and Technology, said that social engineer attacks are popular, simply because cyber-criminals have a lot of attack surface area to exploit.

"They don’t have to get that high a success rate before they generate the required revenue from their scams," he said, adding that the government, rather than sponsored agencies like GSO, needs to tackle what has become a growing problem.

The problem with the current government and its security education efforts, he noted, is that we are in a situation of the ill-informed talking to the uninformed, with predictable consequences.

"And we’re not just talking about money here. Some of these scams have wiped out people’s life savings and have directly affected people’s health. It really is a serious problem," he explained.

Peter Wood, CEO of pen-testing specialist First Base Technologies, said that social engineering is now a continuing attack model that originally centered on home users of the Internet, but is now expanding into business attacks.

The good news, he says, is that his team at First Base is now starting to see a lot better awareness of the problem among clients, as their understanding of the threat has risen in recent times.

"It was the same with ISO 27001 - people gave us blank looks when we mentioned it. Now they understand and specifically ask for social engineering testing as part of their pen testing processes, which is good news," he said.

Tim Keanini, CTO with Lancope picked up on Walker’s suggestion that government needs to act on the issue.

"I think it is worth pointing out that if we include the fraud that occurs online with email phishing, txt, instant messaging, online dating, and factor in that a certain percentage of these victims are still unreported, these numbers could easily approach 40 percent of the population," he said, adding that businesses need to establish - as a part of new customer enrolment - social and technical means of authenticating the communication.

"If not, it is just too easy for these attackers to impersonate that business and make these customers victims,” he explained.

Mark Sparshott, EMEA director at Proofpoint, said that the old ‘vishing’ (voice phishing) attacks have given way to large-scale email based social engineering attacks - most of which start with spear-phishing, long-lining and phishing emails - and which are so sophisticated they fool security software and humans alike into thinking the emails are genuine and that the malicious Web sites they link to harmless.

"The most successful email lures are social networking, preying on the human desire for social interaction and belonging, financial account warnings and order confirmations (preying on the desire for financial stability) and breaking news stories (preying on human curiosity and compassion). However, fake LinkedIn Invitations are by far the most dangerous - achieving a click rate 4x that of any other type of email lure," he said, adding that Proofpoint’s advice is to ‘think before you click.’

Nearly one-third of the world's computers could be infected with malware, suggests a report released last week by the Anti-Phishing Working Group.

Malicious apps invaded 32.77 percent of the world's computers, a more than 4 percent jump from the previous quarter's 28.39 percent, the report estimates.

The increase in infected computers has come hand-in-hand with a jump in the appearance of malware samples, said Luis Corrons, technical director of PandaLabs, the research arm of Panda Security, one of the sponsors of the APWG report.

"The creation of malware samples is skyrocketing," Corrons told TechNewsWorld. "It has doubled from the last quarter to the first quarter of this year."

In the last quarter of 2013, some 80,000 malware samples a day were discovered by Panda researchers. In the first quarter of 2014, that number jumped to 160,000.

Hiding in Numbers

By far, most of the new malware strains (71.85 percent) and malware infections (79.70 percent) are Trojans. Less than a quarter of new malware strains (22.70 percent) and malware infections (12.77 percent) are viruses and worms.

"At the end of the day, malware is created to steal information," Carrons explained. "Trojans are the most suitable malware to do that."

The primary motivation behind creating so many new malware strains is to avoid detection by antivirus programs. Those programs use signatures to identify malicious software. Since each new bad app strain contains a new signature, constantly introducing new strains extends the time a malicious app can remain virulent.

"In the old days, they might be able to infect 1,000 users with a Trojan," Corrons said. "It was easy for antivirus to catch that. Now you'll have 1,000 users infected with 1,000 different Trojans."

The number of phishing sites in the world increased quarter-over-quarter by 10.7 percent, from 111,773 to 125,215 -- the largest site total for a quarter seen since 2012, the APWG report noted.

A slight uptick in brands targeted by phishers also was spotted by APWG researchers -- from 525 in the fourth quarter of 2013 to 557 in the first quarter of this year.

The Dragonfly Campaign

An international gang of hackers has been surreptitiously planting Remote Access Trojans on the systems of energy companies in Spain, the United States, Japan, France, Italy and Germany, security researchers and CERT's ICS team revealed last week.

The campaign, called "Dragonfly" by Symantec, could pose grave risks to a nation's energy infrastructure.

"Depending on how deep the attackers can get into the energy infrastructure, the damage could be great," Adam Kujawa, head of malware intelligence at Malwarebytes, told TechNewsWorld.

"Intelligence gained from cyberespionage could be very useful in the right hands -- and if passwords, IP addresses and user names have been pulled from infected systems, that could allow attackers onto more secure networks and obtain direct control of energy resources," he said. "The damage done would be very serious."

Dragonfly is a painful reminder of a dilemma every nation is facing.

"There is a nasty convergence happening as we speak: Our lives are getting ever more dependent on reliable and available energy, but at the same time, the infrastructure of energy companies is getting more complicated," RedSeal Networks CTO Mike Lloyd told TechNewsWorld.

"This complexity adds weakness and multiplies the pathways attackers can exploit," he added.

The automation of the advertising industry was supposed to reduce waste. But in a quest for greater efficiency, marketers have exposed themselves to a new challenge: fraud.

The uncomfortable truth about the $120bn digital advertising market is that the fastest-growing and most innovative part of the sector – open exchanges – is increasingly being exploited by criminals.

With concern among its clients mounting, WPP, the world’s biggest ad agency, last month said it would stop buying ad slots through such exchanges. These technology platforms, operated by Google, Facebook, AOL and Yahoo, allow marketers to place ads on hundreds of thousands of sites across the internet. But in doing so they have left the industry vulnerable to fraudsters.

Many worry that if unchecked, fraud will undermine confidence in digital advertising. That could hinder the industry’s efforts to capture the $400bn that brands spend on traditional media advertising such as television and newspapers.

“Everyone who deals in internet advertising realises that there’s a huge opportunity that hasn’t unleashed itself,” says Cameron Hulett of Undertone, a company that helps brands advertise online.

“The more that marketers hear about [online fraud], the more it makes them think ‘let’s stick with TV advertising’,” he says.

The trouble is that hidden among the multitude of honest publishers plugged in to the exchanges are sites operated by rogues. The most sophisticated fraudsters operate networks of automated computer programmes – known as bots – which they direct to their websites to attract advertisers. The bots mimic cursor movements and mouse clicks, giving the impression that a person is visiting the sites.

As the Financial Times reported in May, part of a Mercedes-Benz online campaign was viewed more often by bots than by human beings. Other techniques used by fraudsters include inserting large numbers of invisible ad units into web pages, which rack up costs for advertisers but are never actually seen, and generating traffic through malware installed on hijacked computers.

Vivek Shah, chairman of the Interactive Advertising Bureau, warned this year that fraud had “reached crisis proportions”.

His fears are supported by findings from ComScore that more than a third of web traffic is originated by robots or other “non-human” activity. ComScore also found that the majority of ads appear in parts of a web page that cannot be seen by a consumer, rendering them useless.

For Group M, WPP’s media buying division, the solution is to avoid open exchanges entirely. The company, which spends about $10bn a year on digital advertising, instead plans to buy all its digital ad slots through direct deals with big publishers such as Facebook, Hulu and Fox.

“It’s extraordinarily important that our clients have complete trust in the ad inventory that they buy,” says Rob Norman, chief digital officer of GroupM. “Fraud is a binary issue where the only good number is zero.”

But GroupM’s rivals believe it is making a mistake.

Buying ad slots through exchanges accounted for just $12bn of the $516bn global ad market last year, according to eMarketer. But that spending is forecast to double in size over the next two years.

Brands such as American Express, Netflix and Procter & Gamble are increasingly spending through automated platforms.

Arun Kumar of Mediabrands Audience Platform, part of Interpublic Group, says that marketers are pouring money into advertising on the “long tail” of sites available through exchanges because doing so produces good results.

Abandoning exchanges would be like not surfing the internet just because it is possible to catch a virus, he says. “Exchanges are a bit like the wild west today, but they’re evolving.”

Indeed exchanges and other intermediaries are ramping up their investments in technology to detect nefarious activity, responding to brands’ growing concerns about fraud.

Google this year acquired Spider.io, a London-based start-up that has exposed scams such as the Chameleon botnet that defrauded advertisers of $6m a month.

AppNexus, one of the biggest platforms for online advertising, now employs 20 people “to seek and destroy bad actors”, says its chief executive Brian O’Kelley. “It’s a constant fight,” he adds.

Meanwhile, specialist online media verification companies such as DoubleVerify, White Ops, and Integral Ad Science are also developing new solutions to detect deception. But according to Telemetry, the company that exposed the bots that targeted Mercedes, fraudsters are developing new techniques at a much faster pace than the companies tackling them.

Fighting fraud requires more than just developing better detection systems, says Marco Bertozzi of VivaKi, the digital ad buying division of Publicis. A big problem, he says, is that the entire advertising industry is too fixated on chasing cheap slots, even if that means “fishing in a cesspool”. Advertisers need to start looking much more closely at the quality of what they are buying, he says.

For now though, money is continuing to pour through the exchanges, particularly into video ads. Video ads cost about ten times more than banner ads, which has made them a prime target for fraud. Last month, DoubleVerify uncovered a fraudulent scheme involving 500 sites and 1 per cent of all video ad impressions across the internet.

Keith Eadie of Tube Mogul, an online video buying platform, says the arms race against unscrupulous operators shows no sign of slowing. “It’s like viruses,” he says. “They become more sophisticated each day.”

Automated ad buying: how it works

Traditionally, advertisers and their agencies purchased slots by negotiating with publishers in person or via telephone, email or letter.

All that is changing because of the internet. While the automation of ad buying is in its early stages, it is proceeding rapidly and has big implications for marketers and publishers – not to mention ordinary people whose attention is being traded like never before.

At the leading edge of the new technology, ad spots are increasingly being bought and sold via real-time auctions – in a similar way to the trading of financial instruments on a stock exchange.

While human beings set the parameters for the trading, it is carried out entirely by machines.

Before an ad appears on a website or in an app, it often moves through a chain of intermediaries. At the core of this system are exchanges, which connect advertisers to hundreds of thousands of different publishers.

What is radically different about the exchange model is that it allows advertisers to buy ad slots based on the person who will see the advert, rather than the website where it will appear.

Using data such as the location and browsing history of an internet user, marketers can target particular audiences wherever they are on the web. Complex trading algorithms adjust the bidding strategy on the fly in order to maximise the effectiveness of the campaign.

In one common tactic known as retargeting, a brand – typically an online retailer – serves ads to people who have visited its website without completing a transaction. When an ad appears to follow you around the internet, this is what is occurring.

In late 2011 and early 2012, activists, progressive politicians and Internet companies led in part by Internet freedom advocate Aaron Swartz came together to defeat the Stop Online Piracy Act (SOPA) and the Protect IP Act (PIPA). Advertised as measures against copyright infringement, the bills would have opened any website that contained copyrighted material it was not authorized to publish on any of its pages to a forced shutdown. A site that unknowingly held a copyrighted image in a comment section, for instance, would have been eligible as a violator. Virtually everyone was susceptible to closure.

The Cyber Intelligence Sharing and Protection Act (CISPA) followed SOPA and PIPA in April 2012. CISPA was worse than its predecessors, proposing that private companies be allowed to share user information, a provision that would have violated many privacy protections of the Internet. Recognizing this, Swartz fought again. “It sort of lets the government run roughshod over privacy protections and share personal data about you,” he said of the bill at the time. Again, he prevailed.

Now, a year and a half after Swartz killed himself, there is the Cybersecurity Information Sharing Act. CISA is a lot like CISPA, but could end up being even worse. Privacy and civil rights groups including the ACLU and the Electronic Frontier Foundation are standing up to fight it. In an article about the bill, the ACLU’s Sandra Fulton wrote: CISA “poses serious threats to our privacy, gives the government extraordinary powers to silence potential whistleblowers, and exempts these dangerous new powers from transparency laws.” The bill has been approved by the Senate Select Committee on Intelligence and will move to the Senate soon.

Gabe Rottman, a legislative counsel and policy adviser for the ACLU, spoke with Truthdig about CISA. He said the legislation resembles not only CISPA, but the proposed Cybersecurity Act of 2012, which according to him would have been a better bill for protecting privacy and preventing government overreach. “It represented a compromise between the privacy community, industry and the folks pushing cybersecurity on the Hill,” he said of the 2012 legislation. That bill did not pass. CISA borrows some of its elements and removes its privacy and civil rights protections.

“It would allow the use of information that is shared with the government for cybersecurity purposes to be used in the prevention and investigation of crime under the Espionage Act, which includes national security leaks and whistle-blowers,” Rottman added. He said CISA would allow government intelligence agencies not only to retrieve metadata from communication companies on a “voluntary” basis, but also to collect content from emails, texts or other written communications without a warrant. Once the information is in the possession of the Department of Homeland Security, the measure would allow it to be shared with other government entities such as the NSA and the military and possibly even local police forces.

“It could quite literally become an investigative tool,” Rottman said. CISA could enable the government to approach a communications company and find bundles of communications from a number of suspects anytime a new whistle-blower is suspected. It has a provision that is meant to protect people. Personal information is supposed to be removed if it isn’t related to a cybersecurity threat, but it’s unclear how much information would actually be scrubbed.

A further problem with CISA is that it removes protections under Freedom of Information Act and state laws that would allow people to inquire whether their communications have been collected. Rottman said that “the chance you’ll find out that your information has been shared is lessened because of the FOIA exception, and there is an incentive for oversharing, and the information automatically gets shared with the rest of the government.” Furthermore, the bill protects companies that share information from being scrutinized for having done so.

Additionally, CISA doesn’t affect just whistle-blowers and those people who could be considered serious threats to intelligence agencies. It applies to anyone the government could deem a cybersecurity threat as well. This qualification for suspicion is very broad.

In the case against Swartz over his massive, unauthorized downloading of commercial academic journals from MIT, the courts used the Computer Fraud and Abuse Act of 1984 to prosecute him, alleging that downloading the journals was a violation of the network’s terms of service. Under the CFAA, violating the terms of service for any website or Internet tool is considered a criminal offense. For instance, lying about one’s age when registering with a website or accidentally breaking a rule listed in user contracts with Facebook or an email platform could make one a culprit. Under CISA, such harmless violations would make user communications legally vulnerable to government access.

Privacy and civil rights groups also contend CISA does not contain any provisions to protect Net neutrality. Where the Cybersecurity Act of 2012 maintained that terms like “cybersecurity threat” could not be used to inflict damage on open Internet rules, CISA contains no such language.

The ACLU, Electronic Frontier Foundation and many organizations believe CISA would be a boon to the NSA and other intelligence agencies, as well as a serious threat to privacy and protection from warrantless investigation. The Fourth Amendment is meant to protect Americans from such monitoring, but CISA could erase that civil right. Swartz led the fight against the death of our privacy, an open Internet and protection from persecution online. In his absence, others are stepping up to the plate. People continue to be outraged over the revelations made by NSA whistle-blower Edward Snowden, but the government continues to pump steroids into the spy agency’s far-reaching arms.

The UK is upping its spending on cyber defense as a report warns that the country’s increasing reliance on a connected infrastructure could create new opportunities for criminals and terrorists.

Prime minister David Cameron said that £800m will be spent on intelligence and surveillance equipment, which he said “includes the latest in cyber defense technology”. The Ministry of Defence (MoD) was unable to provide any breakdown of the spending or detail what projects this would include.

Cameron said: “We are equipping our armed forces for the conflicts of this century, not the last. The threats we face have changed utterly in 30 years — from the clarity of the Cold War to the complex and shifting challenges of today: global terrorism, organized crime, hostage taking, and the risk of nuclear proliferation, cyber-attack, and energy security.

"It is not massed tanks on the European mainland we need, but the latest in cyber warfare, unmanned aircraft technology and special forces capability… in the 21st century; you cannot defend the realm from the white cliffs of Dover.”

The UK’s National Security Strategy lists cyber-attacks as a ‘tier one’ threat to national security, alongside international terrorism and warns the threat from cyber-attacks “is real and growing”.

In addition, the newly published Global Strategic Trends report by the MoD’s Development, Concepts and Doctrine Centre sets the context for defense and security out as far as 2045, and warns: “As more of our work and social activities depend on a richly interconnected information and communications network (which may, in places, be extremely vulnerable to attack) there could be more opportunities for criminals and terrorists to have a greater impact on our day-to-day lives.”

But, unsurprisingly, it’s hard to work out how much the government is already spending on cyber defense projects. The Strategic Defence and Security Review in 2010 allocated £650m over four years for a national cyber security programmer, with another £210m added after the 2013 spending review for 2015-16.

On the cyber-offensive side, defense secretary Philip Hammond told the Conservative party conference last year: “Simply building cyber defenses is not enough. As in other domains, we also have to deter… Britain will build a dedicated capability to counter-attack in cyber-space and, if necessary, to strike in cyberspace as part of our full-spectrum military capability.”

Spending on this project could reach £500m over the next few years, according to one report. On top of this, other agencies such as GCHQ are also involved with cyber warfare projects.

Data breaches can have a big effect on a merger's overall value.

There appears to be a worrying level of complacency toward the assessment of cyber-risks during M&A deals, despite increasing awareness of the cybersecurity risks facing businesses.

International law firm Freshfields Bruckhaus Deringer found in a survey shared with Infosecurity that 90% of respondents believe cyber-breaches would result in a reduction in deal value; and 83% of dealmakers believe a deal could be abandoned if cybersecurity breaches are identified during deal due diligence or mid-transaction.

Yet, too few tie-up architects are addressing the threat. A majority (78%) say that cybersecurity is not a risk that is currently analyzed in-depth or dealt with in deal due diligence.

“It’s surprising that dealmakers recognize the growing threat of cyber-attacks to businesses, but generally aren’t addressing that risk during deals,” said Chris Forsyth, co-head of the firm’s international cybersecurity team. “You wouldn’t dream of buying a chemicals plant without assessing environmental risk, so why would you buy a data-driven business without assessing the risks its faces around data management and cyber-security?”

The firm said that the effect of a cyber-incident on value would work both ways – a business with a good track record and robust processes could be worth more than competitors, while a business with a bad track record could be worth less.

Dealmakers’ top concerns include targets suffering cyber-attacks during deal discussions, the target being a proven victim of data or intellectual property (IP) theft by cyber-attack, and evidence of a target not handling a past breach effectively (leading to fines, damage to reputation etc.). Interestingly, acquirers (30%) are most concerned about cybersecurity issues derailing transactions, whereas 81% of sellers are unconcerned or only slightly concerned about the risk of derailment.

“It is odd that most respondents to the survey said they were concerned about cybersecurity risks, but that most respondents aren’t actually doing anything about them during an M&A process,” said Forsyth. “One possible explanation is that it is a relatively new area that is not well-understood, and buyers are hesitant about how to tackle it.”

However, awareness of the threat posed by cyber-attacks is growing, according to the survey, with 82% of dealmakers saying that the risk of cyber-attacks will change deal processes over the next 18 months.

The survey also reveals that more North American respondents (51%) than European (39%) have seen cybersecurity become a key part of due diligence in the last year. Further, the US has seen more suppliers and counterparties audited (38% to 22%), more internal cybersecurity specialists appointed (33% to 17%) and more external cybersecurity consultants engaged to review risks (28% to 17%).

“Differences in cultural attitudes and the perception of cyber risk may be reflective of the varying levels of exposure to follow-on litigation and class actions in the US compared with Europe,” said Jane Jenkins, co-head of the firm’s international cybersecurity and defense teams. “While the environment is starting to change, there is still much more emphasis on transparency in the US than in Europe, with the SEC threatening enforcement action against companies for failure to notify cyber-breaches.”

Investors and corporates are starting to wake up to cyber-risk. As demonstrated in the Target breach, more companies are being penalized by shareholders for being a victim of an attack and executives are having to step down as a result.

Edward Braham, global head of corporate, added, “The message to dealmakers – whether buyer or seller - is to evaluate cyber-risk in the same way they would any other risk that could affect the value of a target. Cyber risk presents a significant threat to the operations, reputation, and the bottom line of virtually every company, regardless of industry. While market practice is still developing in this area, buyers can use an M&A process to understand better the cyber risk a target faces.”

(EurActiv) — Insurers are eagerly eyeing exponential growth in the tiny cyber coverage market. But their lack of experience and skills handling hackers and data breaches may keep their ambitions in check.

High profile cases of hackers seizing sensitive customer data from companies, such as US retailer Target Corp or e-commerce company eBay Inc, have executives checking their insurance policies.

Increasingly, corporate risk managers are seeing insurance against cyber crime as necessary budget spending rather than just nice to have.

The insurance brokerage arm of Marsh & McLennan Companies estimates that the US cyber insurance market was worth $1 billion (€0.73bn) last year in gross written premiums, and could reach as much as $2 billion (€1.4bn) this year. The European market is currently a fraction of that, at around $150 million (€110mn), but is growing by 50 to 100% annually, according to Marsh.

Those numbers represent a sliver of the overall insurance market, which is growing at a far more sluggish rate. Premiums are set to grow only 2.8% this year in inflation-adjusted terms, according to Munich Re, the world’s biggest reinsurer.

Cyber coverage

The European cyber coverage market could get a big boost from draft EU data protection rules in the works that would force companies to disclose breaches of customer data to them.

“Companies have become aware that the risk of being hacked is unavoidable,” said Andreas Schlayer, responsible for cyber risk insurance at Munich Re. “People are now more aware that hackers can attack and do great damage to central infrastructure, for example in the energy sector.”

Insurers, which have more experience handling risks like hurricanes and fires, are now rushing to gain expertise in cyber technology.

“It is a difficult risk to price by traditional insurance methods as there currently is not statistically significant actuarial data available,” said Robert Parisi, head of cyber products at insurance brokers Marsh.

Andrew Braunbergon, research director at US cybersecurity advisory company NSS Labs, said that some energy companies have trouble persuading insurers to provide them with cyber coverage as the industry is vulnerable to hacking attacks that could trigger disasters like an explosion in a worst-case scenario.

Pricing on policies for retailers has climbed in the wake of recent high-profile breaches at Target, Neiman Marcus, and other merchants, he added.

A necessary cost

Though still very much in its infancy, the market’s potential is vast, with cyber crime costing the global economy about $445 billion (€326bn) every year, according to an estimate last month from the Washington-based Center for Strategic and International Studies.

While many companies have in the past counted on their general commercial liability policies for coverage, they are increasingly taking out standalone contracts.

One reason for the change in attitude is a New York state court ruling in February against Sony Corp. The company, which has appealed the decision, had sought to force providers of its general commercial liability insurance to foot the bill for class action lawsuits following a major 2011 cyber attack on Sony PlayStation Network.

“This issue with Sony is that it did not have a standalone cyber product,” said Peter Beshar, general counsel at the Marsh & McLennan Companies.

Target was better protected when some 40 million payment card numbers were stolen last year. It had $100 million (€73.4mn) in cyber insurance, according to the trade publication Business Insurance.

With low interest rates limiting revenues from insurers’ vast bond portfolios, the extra underwriting income from the fast growing new market is all the more welcome.

The cost of cyber insurance varies depending, but on average $1 million (€0.734mn) in protection ranges from about $20,000 to $25,000 (€14,683 to €18,354), according to Beshar.

German insurance giant Allianz says its premiums for €10-50 million in protection run about €50,000-90,000 in annual premiums. For protection of over €50 million, companies can get coverage up to €300 million through co-insurance policies involving multiple underwriters.

Whether insurers are offering coverage at prices commensurate with the risks is anyone’s guess, as long as underwriters have scant experience with hackers.

Online to Offline (O2O) Commerce Signals Demand for Increase in Mobile Payment Security,“ says mobile payments expert Omlis

Digital payments are forecasted to almost double in the next 5 years, with an increase from £2.5 to £4.7 trillion from 2014 to 2019, according to a recent report from Juniper Research. Businesses worldwide are answering this demand, by implementing new business models. Traditional “brick and mortar” businesses are offering product delivery options, creating an onset of “bricks and clicks” companies.

Transactions processed via mobile payments for traditional retailers are expected to grow by 600 percent by the end of 2017, according to a Chinese research firm iResearch. These economic forecasts signal the growing global shift from online-to-offline (O2O) commerce, integrating use of mobile phone technology and E-commerce with traditional business models. This highlights a growing need for innovative mobile payment technology and enhanced fraud prevention techniques, according to Omlis, a leading Global Mobile Payment Solutions Provider.

Online to Offline (O2O) business models reflect the movement of E-Commerce and M-Commerce activity toward integration with physical, offline processes. This is highly due to the growing worldwide adoption of mobile phones and incorporation of digital payment procedures. In commerce, O2O pushes for user interaction through a website, app, or mobile phone allowing customers to virtually reach the physical storefront or services provided by an organization. Through consistent launch of new apps, the internet has become an innovative way to complete tasks, such as monitoring and controlling home appliances. Innovation leaders Apple recently released the Homekit, which allows users to control lighting, thermostats, and even home security via a mobile device.

Consumers in O2O environments gain more efficient services, improved access to goods, and enhanced online shopping experiences, as well as innovative opportunities to get customizable goods, personalized services, and 24/7 service from industries that traditionally relied on physical interaction. This model could prove profitable for businesses who can aim to increase their consumer base with more efficient systems and a much larger geographical reach.

The push back toward offline relationships has initiated through the private sector due growing consumer reliance on online shopping. However, Omlis believes it may also be due to social and cultural implications from widespread internet use. This trend originated in the Asia Pacific, a technologically advanced market that adopted mobile payments early, and now boasts 32 percent of sales attributed to mobile devices according to a recent report from mobile advertising service provider Buzzcity.  Omlis believes that this foretells similar trends across the globe, with the UK following closely behind with twice as many mobile payments than the global average in Q2 of 2014. A recent report from Accenture showed that although UK customers are banking via mobile, visits to bank branches have increased since last year by almost 10%. This could be due to increased O2O business models, or may possibly be attributed to lack of customer service over online portals.

A major concern facing online to offline business models is fraud, due to heightened reliance on mobile payments, an increase in personal data stored on phones, mixed with hackers and no standard security protocol for mobile commerce. The most significant example of fraud activity on mobile devices is credit card fraud according to a report by Iovation, which looked at mobile fraud cases on both Android and iPhone platforms. This fraud occurs most frequently via the mobile web, which still harnesses 60% of global transactions.

“The mobile payments market has key hurdles to clear in fraud prevention, and businesses adopting new models incorporating digital and mobile payments must consider best practices to guarantee consumer confidence, consistency, and convenience,“ said Omlis CEO Markus Milsted. “Online to offline models call for improved security for mobile payments and uncompromised technology which can function effectively on mobile phones.“

Omlis believes businesses must work to ensure consistency within an O2O experience, including a differentiated focus on customer satisfaction and implementation of new techniques for effective and secure customer service.

“It is necessary to anticipate imminent issues that will arise as mobile devices are incorporated further into daily life, and ensure consumer confidence through use of secure systems,“ said Milsted.

The integration of offline and online will continue to change and grow as consumers and businesses find an ideal balance, and security will surely play a large part. Omlis technology offers a powerful and innovative secure payments technology designed to proactively address issues faced by the mobile payments industry.

About Omlis – Omlis is a global mobile payment solutions provider bringing market proven, highly powerful, differentiated and most effective solutions to all mobile commerce security. Providing completely secure, unique and uncompromised technology with 100% fault-tolerant tracking of all payments in real-time for full transaction accountability.

Summary - Online-to-offline commerce, which utilizes mobile phones as an intermediary between businesses and consumers, is a worldwide trend that faces new challenges. Online shopping and innovative apps have created a new consumer environment that encourages new ways of shopping and conducting daily life. Mobile payments are becoming the norm, but must become more secure due to a currently insecure mobile payments market. This article examines current trends in online-to-offline business models, and anticipates the imminent issues in mobile fraud, calling for more secure mobile payment techniques.

I know it is easy to be skeptical of government initiatives, but a burgeoning federal initiative to help us better manage our online identities deserves our attention—and trust.

The White House cybersecurity czar Michael Daniel said in June that he’s on a mission to “kill the password dead.” It’s a laudable goal. The problem with passwords is the false sense of security they provide. In fact, they’re easy to crack—and getting easier every day.

A typical eight-character password has 6.1 quadrillion possible combinations. In 2011, it would have taken a year for a fast desktop computer to crack an eight-character password. Today, thanks to new crowd-hacking technologies, it takes an average of 5.5 hours.

Or less. Any hacker with a decent smartphone can take a seat next to you at the coffee shop and use his phone’s camera to record your keystrokes as you type away on your laptop, capturing all your sensitive usernames and passwords.

That’s why we need to get rid of passwords. And that’s why the White House is implementing an ambitious plan called the National Strategy for Trusted Identities in Cyberspace (NSTIC), which promises to stamp out fraud at government sites by giving users a better way to prove they are who they say they are. The initiative is focused on moving all government sites, and potentially all public-sector sites too, away from usernames and passwords and toward stronger identity management.

As a first step, NSTIC will connect different government agencies with third-party credential providers that will verify certain personal information about their online users and issue secure credentials for them to use in transactions at government sites.

For instance, the system could allow the same person to use a single credential to apply for a driver’s license, fill out a student aid form and file taxes online, all without ever entering a password. The idea is that this secure ID—what some are calling a personal driver’s license for the internet—can eventually be used at other sites around the web not related to government. Because if people have a simple, secure way to prove who they are online, without using passwords, it will be easier and safer for everyone to do business on the internet.

I believe consumers will welcome this proposal, which offers more secure access to important personal websites like banking sites. Passwords are just not good enough. People need stronger proof of identity, like the one envisioned by NSTIC, to better trust authentication—and better trust the internet.

Inevitably, some privacy advocates are crying foul over NSTIC. They fear that if the U.S. government has your ID, it will end up mining that information for its own nefarious purposes. In the wake of the NSA surveillance revelations, critics are concerned that a push toward a single-ID system will enable the government to more closely track citizens online.

That possibility can’t be ruled out, I suppose. But people should realize that the far more immediate threat to their personal information is posed by hackers who crack their passwords—and NSTIC promises to stop them. It’s designed to protect internet users by providing authentication far stronger than can be accomplished by passwords alone.

In fact, those who are most concerned about privacy are the ones who should embrace NSTIC identities, which, like a driver’s license, will come with a reliable vetting process. What’s more, they’ll be based on a cryptographic signature generated by a trusted authority, which for the most part will be third-party certificate authorities.

NSTIC’s goal is not evil. It simply aims to create an “identity ecosystem,” built and maintained by the private sector, in which government agencies can accept log-on credentials issued by nongovernment third-party providers. And in which members of the ecosystem can prove their identity to others who are also in the ecosystem. In this way, NSTIC authentication doesn’t expose your identity, it helps protect it. And you can still choose when and where to use your stronger NSTIC identity—or not.

Furthermore, under the NSTIC guidelines, the service must preserve anonymity around the public data it collects. For instance, personal identifiers like age, gender and address cannot be linked back to their owners. The guidelines also stipulate that activity on government websites cannot be linked to third-party identity providers and vice versa.

Even the Electronic Frontier Foundation, a leading digital rights group, is optimistic about the future of NSTIC. “The NSTIC system is voluntary, run by private companies rather than the government itself and, most importantly, it is decentralized, so that individuals will be able to choose between different providers,” said Lee Tien, a senior staff lawyer at the Electronic Frontier Foundation, in a recent interview.

If we want to achieve a higher level of security for internet users, there is no better place start than the elimination of passwords. And NSTIC is a significant step in that direction.

According to a recent study by credit bureau Compuscan, 1 370 cases of identity fraud had been reported to the Southern African Fraud Prevention Service (SAFPS) by the end of April, with 17 percent of incidents occurring in KZN.

Gauteng, South Africa’s economic hub, has the highest amount of identity theft (48 percent) followed by KZN and Western Cape (10 percent).

And, according to Compuscan, this hike is likely to continue, with the number expected to rise above 4 000 by the end of the year.

Compuscan director, Frank Lenisa, said the trend was worrying.

“What worries us more is that consumers are often unaware that they have fallen victim to such a crime and this could have a negative knock-on effect in their ability to obtain credit in future,” he said.

According to the National Credit Regulator’s latest quarterly publication, Credit Bureau Monitor, there were 20.64 million credit-active consumers in South Africa as at the end of last year.

“Each one of these is urged to pay close attention to the threat of fraudulent activity that could affect their credit records,” Lenisa said.

Consumers usually only find out they have become victims of identity theft when checking their credit report while applying for a home loan or car finance, he said.

Carol McLoughlin, executive director at SAFPS, a non-profit fraud prevention company, said they worked with its members - comprising all the large banks, retail groups and insurance companies - to track fraud trends with the hope of preventing them.

Her organisation also offers free protection to members of the public who have become victims of identity fraud, as their ID numbers are filed on the SAFPS database under the category “Victims of Impersonation” to give them protection against further attempts at fraud.

“A copy of the innocent victim’s ID is scanned in and attached to the record, so that member companies can compare the true victim’s ID against the ID of any future applicants (impersonators/fraudsters) who attempt to use this same ID to open accounts and submit claims,” she said.

In some instances, the details of the actual impersonator can also be uploaded on to the database.

“For example the fraudster might use his or her own cellphone number and ID photo when applying for a loan or opening an account using an innocent victim’s name, ID number and address. These records are filed under the ‘Impersonator’ category on the database.”

McLoughlin could not say why KZN was experiencing the second-highest incidence of identity fraud in the country, but explained that incidents often took place in a different province to where the victim resided.

“Every day we hear about a new type of scam or method being used by fraudsters to gain access to personal information.

“At the end of the day, consumers need to be far more vigilant when giving out their personal information online and must avoid being hoodwinked into clicking on to web links that they receive via SMS and e-mail,” she said.

“They must shred unnecessary documents containing personal information and always make sure that they authenticate websites before they fill in online applications and forms.”

Compuscan urged people to check their credit report regularly, saying that every South African was entitled to one free credit report annually, according to the National Credit Act.

Despite the amount of credit-active consumers in the country, only about 14 000 request a report from Compuscan each year.

Compuscan has launched a personal online credit report portal called My Credit Check (www.mycreditcheck.co.za) that allows users with valid ID numbers to monitor their complete financial history. Continue reading…

Kaspersky Lab, in collaboration with B2B International, recently conducted a global study which shows that nearly a third of institutions consider the implementation costs ofsecurity systems to be more expensive than simply repaying the damage due to internet fraud to their customers.

It’s a theme that also pervades many organizations that manage online payments: 28% of representatives of financial institutions and 32% of employees of online shops who were questioned are convinced that the total damage caused by cybercrime, including the repayment of the stolen money, would not exceed the cost of implementing appropriate security solutions.

Only 19% of financial institutions and 7% of online firms cite the cost of compensating customer losses in the top three most serious consequences of cyber-fraud.

But, the issue is escalating. According to the Kaspersky Security Network, almost four million users of Kaspersky Lab products have faced in 2013 with financial malware software to steal their money (an increase of 18.6% compared to 2012). In December 2013, several US banks have lost more than $200 million due to loss of personal information of their clients or their credit cards. The total damage is probably much higher, the firm noted, adding that it is clear that the continued growth of cybercrime will irremediably lead to a situation where the costs of refunds that institutions pay will be higher than the protection of financial transactions and compensation budgets.

"Financial institutions should not only accrue large sums of money in their budgets to repay the stolen money to their customers, but also to cover the cost of filings by their customers. The most important is that customers, so when the victims are repaid quickly, there may be shall dream twice before using the services of a bank that fails to ensure that their online accounts are safe. It is therefore better to prevent damage and loss rather than compensate,” said Martijn van Lom, CEO of Kaspersky Lab Benelux and Nordic, in a statement. "Customized solutions designed to protect online transactions can reduce the risk of Internet fraud to a minimum. This means that resources earmarked for compensation would be released and could be used in the development of the company. "

Another argument for the use of specialized security solutions is the neglect of clients. A former Kaspersky Lab survey shows that 57% of users take (almost) no account of the security of their online payments, because they think that their bank will do what it takes. This, in turn, increases the risk of becoming the target of cybercriminals.

What ramifications will businesses and Apple itself face following the celebrity leaks.

The dust has barely begun to settle following the massive celebrity 'nude photo' leak over the weekend, yet allegations and claims are flying here, there, and everywhere.

Fingers are being pointed at suspect iCloud security despite no concrete evidence of exactly how theimages became public in the first place (that is, apart from the original 'leakers' confession of obtaining the images from iClouds)

Firstly, it has to be unlikely that iCloud itself sustained a large attack, especially as the service is 128-bit encrypted both ways of delivery.

What is much more likely was that this was an attack of social engineering, an exploitation which works by manually deciphering information about the target ie. email addresses, date of birth, secret question answers, to try and attempt a spoof access to an account.

Of course this does raise issues about the surrounding security of iCloud against social engineered attacks, but businesses should have a much higher level of security than your regular Hollywood celebrity.

Steve Jones, head of R&D at UK penetration tester RandomStorm, said: "Although Apple's encryption of the data itself is considered robust, Apple could apply AES 256 bit encryption to the images. This would put the majority of hackers off, or really slow them down.

"However, access to the celebrities' images could have been gained through more indirect means, such as guessing the celebrities' passwords, or by finding their email address and then correctly answering traditional security questions.

"Apple could improve the security of iCloud by enforcing the use of much stronger, unique passwords and by introducing two factor authentication to iCloud accounts, to ensure that access is from the correct device and/or account owner."

Weak passwords could be what is at the heart of this leak, and if your business is not operating at a level where it is creating stronger passwords than a layman then things needs to change.

Paco Hope, Principal Consultant at software security company, Cigital, also argues that iCloud is not in itself risky for businesses if used correctly. "Businesses build security in by using secure software to access their data. The choice of cloud provider is just part of that overall picture. This hack means nothing with respect to the security of iOS: iOS devices were merely the cameras in this situation. No one should change their position on iOS versus Android versus Windows based on this incident."

Furthermore, large firms such as Apple obviously have trained and dedicated in-house security teams which are constantly patching and working around flaws in the armour. Rik Ferguson, VP of security research at Trend Micro, said: "A wide scale 'hack' of Apple's iCloud is unlikely. Even the original poster is not claiming that."

Steve Jones further argues that the security responsibility does not solely lie with the cloud storage provider. He said: "Businesses observing this hack should already understand that any digital asset that is valuable, whether it be employee login details, customer data, patient records, financial details, or intellectual property, is a target for cyber thieves and needs to be protected appropriately.

"This also means that businesses cannot delegate information security to their cloud service provider. If your business is faced with a determined assailant you need to put in place your cyber fire drill: change the rules on your firewall to shut the ports until further notice, move the assets, hide the assets and block access until you have had time to assess which vulnerability was exploited."

Mike Ellis, CEO at ForgeRock, also argues that it is indeed businesses that need to be more aware of cloud security. He said: "Big businesses as well as large, trusted government organisations need to manage vast and growing numbers of employee and customer digital identities.

"Global brands and large organisations that fail to take the right steps to address the growing complexity of identity relationship management risk not just a big dent in their reputation and trust, as iCloud is surely likely to face, but serious commercial or social consequences too as customers switch to more trusted brands or switch off entirely altogether. This example is just the tip of the iceberg and must be addressed sooner than later."

But Egemen Tas, VP of Engineering at Comodo Group, highlights some of the ramifications he thinks businesses with lapsed cloud security face. He said: "Cloud service providers should realise that they are expected to be as liable as a bank would be when it comes to catching fraudulent activities or having security and compliance procedures in place.

"Banks have legal compliancy requirements and regulations hence they have ways to combat similar threats to the cloud. Why shouldn't cloud storage providers have similar legal regulations and liabilities? Just like we are more than one password away from our personal online banking accounts, we should be more than one password away from our cloud storage accounts. Having one password on our cloud accounts is not enough to combat attacks of this nature."

This breach, no matter who to blame, ultimately still alerts businesses to the risk of cloud storage, but this unforunate opportunity should be used to highlight areas where improvements can be made and cloud security awareness can be heightened. Alex Raistrick, from Palo Alto Networks comments: "The recent scandal involving leaked photos of celebrities stolen from Apple's iCloud storage facility serves to highlight that security is still one of the greatest barriers preventing cloud computing from reaching its full potential. However, amid the negativity there are now more opportunities than ever for channel partners who specialise in cloud security to move in and toughen up security, particularly on previously 'trusted' platforms."

BILLINGS - From major companies like Home Depot, Target and Albertsons -- to everyday people -- data breaches are becoming more and more common. If you are shopping or banking online, experts have a few tips to keep your data safe.

If you're using a phone, start by assigning a passcode, and turn off your Bluetooth and Wi-Fi when you're not at home. Using different passwords for every account is also a good idea, according to CNN Money. Before entering your card details online, make sure there is a lock symbol in the task bar, which ensures the connection is secure.

Stockman Bank Vice President of Operations Rhonda Moore says if fraud is involved in online purchases, with a debit card, the money in your account becomes unsafe, but with a credit card, the money belongs to the credit card company.

"If you're going to be shopping online with your debit card, you should also have online access to your bank account, so you can make sure the charges are all valid and they're all yours," she said.

Staysafeonline.org suggests the following tips:

"Keep a clean machine: Having the latest security software, web browser and operating system are the best defenses against viruses, malware and other online threats.

Make passwords long and strong: Combine capital and lowercase letters with numbers and symbols to create a more secure password.

Unique account, unique password: Separate passwords for every account helps thwart cybercriminals.

When in doubt, throw it out: Links in email, tweets, posts, and online advertising are often the way cybercriminals compromise your computer. If it looks suspicious, even if you know the source, it's best to delete or if appropriate, mark as junk email

Get savvy about Wi-Fi hotspots: Limit the type of business you conduct and adjust the security settings on your device to limit who can access your machine."

If you notice something suspicious on your statement, immediately call your bank or credit card company, Moore said.

Next, delete emails and personal messages with any banking information, and change all of your passwords.

The video game industry is still talking about the violent threats made against Anita Sarkeesian, a video game critic, who alerted the police last week and went into hiding, according to her Twitter posts.
In a column, I wrote about the questions Sarkeesian raises in her critiques such as how do video game makers treat female characters at a time when women are playing games more than ever.

Some may be puzzled why Sarkeesian’s critique caused such a stir, as she refers to in her tweet Monday (above) when talking with the police. Sarkeesian received vitriol, and not just from the person who threatened her, for pointing out the obvious, The New Statesman writes.

I’m not a gamer, but I have kids who play. There seems to be an insider culture of mostly young male players who want to keep their game world safe from both female players and any criticism that might diminish their enjoyment.

In reporting the column, I was surprised by accounts of women who feel they have to hide their gender while playing social games or face abuse. Or, if they play as female, they are called on to prove their abilities, something male players do not face.

Sarkeesian connects the content of video games to the behavior of video gamers:

So what will it take to change the video game industry, the games and the gamers? After all, the gaming audience is broadening and becoming more diverse, with women in particular gravitating to MOBILE GAMES. Shouldn’t video game companies want to appeal to this audience?
James McQuivey, an industry analyst at Forrester, told me that it may take awhile for the gaming industry to change:

The best way to break this habit is to promote alternative ecosystems of GAME DEVELOPMENT, which is exactly what mobile gaming is and we do see more diversity in mobile gaming. But so far the industries haven’t collided sufficiently that the more expansive culture of mobile gaming has helped the console gaming business rethink itself.

Företag och konsumenter kan vidta åtgärder för att förhindra bedrägerier, identitetsstöld och offentlig spridning av personuppgifter. Attorney General Dustin McDaniel ut denna konsument alert idag för att informera konsumenterna om hur man håller känslig data ur fel händer.

"Oftare än någonsin vi hör om hur finansiella och personliga information är stjäls av brottslingar, och detta är en oroväckande trend som tjänstemän för brottsbekämpning och attorneys general över hela landet arbetar för att stoppa," sade McDaniel. "Jag uppmuntra konsumenterna att ansluta sig till oss för att göra vår information säkrare genom att vara försiktig om de uppgifter de lagra och dela."

Tyvärr, konsumenter som har haft sina känsliga uppgifter stulna löper större risk för identitetsstöld, bedrägerier och andra bedrägerier som e "phishing". McDaniel sa konsumenter påverkas av säkerhetsöverträdelser bör vara flitigare i översyn av kontoutdrag och kreditkort räkningar och bör vara försiktig med oombedd e-post och telefonsamtal där den emailer eller ringer söker ytterligare personuppgifter.

McDaniel som dessa proaktivt sätt att konsumenterna kan göra deras känslig information säkrare:

Personlig information kan vara lika värdefull som kontanter, så tänk två gånger innan du lämnar Social trygghet, bankkonto eller kreditkort nummer till någon. Se till att enskilde kan lita med data innan du delar det. Fråga varför informationen som behövs och hur det kommer att skyddas.

Använd långa och starka lösenord. Blanda bokstäver, siffror och specialtecken för att skapa lösenord som är minst tio tecken lång. Undvik att använda samma lösenord för flera platser och inte använda lösenord som innehåller namn, födelsedagar eller vanliga ord.

Erkänna att foton, videor, meddelanden och andra data som lagras på en telefon kan backas upp någon annanstans, på vad som brukar kallas ett "moln". Konsumenterna bör läsa deras tjänsteleverantörens integritetspolicy för att bestämma huruvida de vill säkerhetskopiera data till "molnet".

Om med "molnet," genomföra två steg kontroll, som inte tillåter konto eller lösenord förändringar göras såvida inte en konsument anmäls på ett annat sätt, som en CVV-kod skickas via SMS.

När du handlar på nätet, använda en säker webbläsare. Dessa har ett "lock"-ikonen i statusfältet och en URL som börjar med "https".

Alltid anta att någon kan se något som skickas över en offentliga trådlösa "hotspot", och se till att trådlösa hemnätverk är krypterade för att förhindra obehörig åtkomst.

Använd den senaste säkerhetsprogram och kontrollera datorer, smartphones och tabletter alltid kör de senaste programvaruversioner. Uppdaterad programvaruversioner innehåller ofta säkerhetskorrigeringar som skyddar mot skadliga program.

Inte overshare på sociala nätverk webbplatser. Kom ihåg att vänner eller anhängare inte kanske alltid har en konsumentens bästa intresse i åtanke. Aldrig skicka personnummer, kontonummer, adresser eller telefonnummer offentligt.

Läs den ursprungliga artikeln: Vidta åtgärder för att skydda personlig Information

At ProgrammableWeb's API conference next week in London (Sept 24-26), my keynote session will identify patterns in some of the recent cybersecurity transgressions, what could have been done to stop them, and why Internet security is currently a trainwreck.

It Will Fappen To You. It's Only a Matter of Time.

It was apparently a wake-up call for the general public when, in what is now being called the "Fappening," headlines revealed that hackers were able to publish nude photos belonging to celebrities like Jennifer Lawrence that were thought to be both private and secure in Apple's iCloud. Though Lawrence very bravely acknowledged that the photos were indeed of her and not Photoshopped fabrications, make no mistake about it; for her and the other impacted celebrities, it was the ultimate digital violation of their privacy.

For Apple, which was on the verge of announcing Apple Pay -- a means by which iPhone 6 users would be able to make NFC-based contactless payments at supporting merchants -- the timing could not have been worse. When it comes to handling personal payments, nothing matters more than trust. Just ask Home Depot and Goodwill; two big national brands suffering an erosion of trust after hackers gained access to the credit card data of hundreds of thousands of their customers. 

Likewise, thanks to the revelation that the so-called hackers gained unauthorized access to celebrity iCloud accounts, Apple's trust took a hit. But, in the scheme of things for Apple, it's really more like a flesh wound. Compared to other vendors of personal technology, Apple has enjoyed a relatively stellar track record when it comes to security. Meanwhile, fearful that it could happen to them, iCloud users everywhere scrambled to change their passwords, remove any sensitive content from their iCloud accounts, and reconfigure their iOS devices so as not to automatically upload newly taken photographs and video to Apple's iCloud.

But for many of us who are closer to the nuances of Internet and digital security, this was not a wake up call. This was just another successful hack in a long line of transgressions that collectively point to (1) the lengths to which hackers with nefarious intent will go to achieve their objectives, (2) the fundamental problems with the way the Internet is secured, and (3) how APIs are increasing the Internet's vulnerable surface area and what API providers must do about it. After all, while Apple will very likley regain the trust of most of its customers, a transgression of this nature could mean death for a smaller brand. The stakes are not to be underestimated.

While Apple has, in its press release regarding the incident, admitted that celebrity iCloud accounts were victimized by a targeted attack, it has also said that the attack was not a result of a breach in the security of its systems and infrastructure. While the meaning of "breach" is like "beauty" (it's in the eyes of the beholder), Apple, for its part, has not disclosed the exact details of the transgression (transparency is still a major problem in our industry) and so much of what is public at this point still falls into the journalistic bucket of speculation. Nevertheless, if true, the currently prevailing non-Apple account of the celebrity iCloud incident offers some very visceral clues as to the lengths that  hackers will go to achieve their objectives.

A world-first cyber crime fighting training centre opened in Bristol aiming to help businesses government agencies and even police forces keep ahead of this growing threat.

The centre, run by Protection Group International, was opened by Organised Crime Minister Karen Bradley, who said it was a “major step forward” in the ongoing fight against cyber crime.
She said: “To stay one step ahead of the cyber criminals, we need to ensure enough people in all sectors of the economy have the right skills to understand and take action against the threat they pose.
“PGI’s innovative training facility is an excellent example of how British know-how and capability can help governments and businesses around the world protect themselves in cyberspace.”

The £5-million centre in Aztec West is the first of its kind and already employs 50 people recruited from specialist fields.

Chief executive Barry Roche told the Post Bristol was the perfect site for its new facility.
“Bristol rose to the top of the shortlist very quickly because of the talent pool in the South West,” he said. “Bristol has a long technology heritage as well as fantastic transport links. It is the right place.”
Customers range from large corporate firms to public sector organisations such as councils and police forces and foreign governments.

The 4,000 square metre facility includes three classrooms and a dedicated network, giving people the chance to work in a so-called sandbox – a safe environment where they can play around without fear of damaging their own network.

Barry said training courses for IT and CYBER SECURITY professionals are “very technical”. But there are also courses for chief executives and board members, with facilities to host board meetings on site at the same time.

He said it was often at the highest level of an organisation that awareness and understanding of cyber crime was lowest.

“The need for organisations to protect themselves against cyber crime has never been greater,” he said. “Regulators, customers and employees all expect their data to be kept secure and the burden of accountability rests squarely with those responsible for maintaining that security.
“Whether you’re a board member, IT manager or IT professional, ensuring that you’re not the weak link when it comes to CYBER SECURITY is a business-critical issue.”

Barry is a former Royal Marine while managing director Brian Lord is the former deputy director of Government listening base GCHQ in Cheltenham, where he ran the intelligence and cyber crime operations.

Brian said the threat was as much the people as the technology.
“Attackers exploit human vulnerabilities and the weaknesses inherent in IT systems and infrastructure due to human errors in coding, design, maintenance or procurement,” he said. “Consequently, a strong cyber security programme should also consider human factors from the vulnerability of the systems’ users to the motivations guiding attackers.”

Phishing scams have been around for quite some time now. But not many people are aware of what it is and what it can do to them. It is simply a ploy used by fraudsters to lead you to divulge personal information by pretending to be legitimate online business companies. In fact, they trick you to believe they are popular companies, such as Facebook, in order to get your trust.

Beware! Once they have your information, they will then collect information or money from you through your computer or online bank accounts. Here are some tips on how to recognize phishing emails and also how you can protect yourself:

• Poor grammar and spelling. Often, fraudsters, unlike legit companies, are not (or do not employ) copy editors and post emails that are not well written. So, chances are, if you read an email with grammatical errors, it could be a scam dealer.

• Avoid clicking links in emails. Links included in dubious email messages could be traps. Simply move your cursor (without clicking) on the link and check if the address is the same as the one in the message.

Sometimes, the real web address (that pops up when you move the cursor) is not the same as the company’s supposed web address.

Links could also bring you to .exe files which could infect your PC with malicious software.

• Scammers often use threats. Fraudsters, and swindlers in general, are good at causing their victims to feel guilty or fearful. They will threaten to close your account or say that your security has been compromised in order to cause people to act according to their wishes. Such tactics are not used by professional companies. Get more information on how you can protect yourself from such ploys.

• Copying popular companies or sites. Cybercriminals employ logos, pop-up windows and other graphics that appear to link you to legitimate websites but in reality lead you to fake scam sites. One of the most-often spoofed companies is Microsoft. Protect yourself by getting more information on how scammers do it.

Here are some other tips to protect you from scammers:

• Only make use of dependable security software and set it to stay updated automatically. Moreover, learn standard security practices available on this link: computer security practices.

• Never give out your email personal or financial information. The email is not a protected means of sending out confidential information.

• Post personal or bank information only through a company’s website if you yourself typed in the web address and have checked that the site is secure. A URL that is secure will have this: https (the “s” means secure). This is not totally reliable though, as scam artist have also found a way around it.

• Inspect credit card and bank account statements right after you receive them to see if there are any unauthorized transactions. If your statement arrives a few days late, call to verify the billing address used and check out your account balances.

• Be careful when you click on attachments and downloading files from emails, regardless of who sent them. These files may contain viruses or other malware that can compromise your PC’s security.

The world has suddenly become not just convenient but also complicated. Yes, we can do banking and shopping online; but the burglars have also followed us on the virtual highway and found ways to steal our personal information and our money as well. We can protect ourselves from these criminals by knowing where they come from and how they operate.

From Target to Home Depot to JPMorgan, this year was a bad one for massive security breaches. Expect more of the same next year.

Let's face it, 2014 was a terrible year for computer security, leaving everyone feeling a little more vulnerable.

Hackers stole 56 million credit card numbers and 53 million email addresses from Home Depot between April and September. They took contact information for 76 million households and 7 million small businesses from JPMorgan's vaults. And Target started the year on the wrong foot, coughing up 40 million credit and debit cards, and personal information on 110 million people.

"It'd be hard to find anybody in the US who hasn't had a credit card affected," said H.D. Moore, chief research officer at security firm Rapid7. "People are just numb to the fact."

Will 2015 be the year we learn to care about who to trust with our personal data? Experts have some dour thoughts on what's coming, even as US stores begin to support credit cards with more secure computer chips. There's going to be heightened risks from old threats like email phishing attacks, and new threats posed by the Internet of Things, the idea of having appliances, objects, and electronic devices all connected to each other and the Internet. Here's what to expect next year.

Smarter credit cards

Credit cards containing a computer chip and requiring a separate personal identification number are commonplace in many other developed countries, but have been held back in the US in large part because of the costs. Financial institutions have to pay more to make the new cards, and it's expensive for retailers to upgrade their payment terminals to accepted chipped cards. But they are expected to decrease some types of credit card fraud, a problem with current swipe-and-signature cards, because the chips are harder to counterfeit, according to a report from the financial research firm Aite Group. The equipment required to clone a chipped card the way counterfeiters currently fake magnetic stripe cards can cost around $1 million, according to mobile payment company Square.

It's this level of protection that prompted Apple to move forward with its mobile-payments service, Apple Pay, which runs on the same security model as a chip and pin credit card. Next year, retailers will have to accept chipped cards or bear the legal burden of future credit card breaches. The retailers, however, don't have any legal obligation to accept Apple Pay, even as Apple has lined up an impressive group of partners.

The shift in credit card fraud responsibility and tougher security measures will force criminals to refocus their attacks on smaller companies as bigger companies invest their capital in preventing embarrassing, costly breaches, said Andy Daudelin, the vice president of security solutions at AT&T. "Small and medium businesses are going to need to step up in their [physical] place of business and online to protect consumers, and to protect themselves from lawsuits," he said.

Phishing goes mobile

Another risk that could get worse next year are phishing attacks, or malicious emails that try to trick you into clicking on a link, according to Steve Durbin, managing director of the Information Security Forum. "I had a number of [faked] emails allegedly from Amazon on Black Friday and Cyber Monday that said that I had a problem with my Prime account," he said

Had he clicked on the links in the email, Durbin could've been struck by automatically downloading malware, or conned into turning over account credentials. It's not hard to get from there to financial fraud. Emails are a valuable resource for cybercriminals because they're an easy gateway for far greater access. While avoiding emails from strangers may seem like common sense, some phishing sites are effective as often as 45 percent of the time, according to a recent Google study.

Moore also cautioned against trusting anything with an Internet connection, a challenge as connectivity explodes across every kind of device from door locks to thermostats. 2015 will see a rise in connected appliances such as refrigerators, and a broader push for smart home products.

"If you can't update it, it's not going to be secure," Moore said. Free-to-use, free-to-modify software was found this year to suffer from catastrophic flaws like Heartbleed and Shellshock, which could lead to malicious device takeovers -- not something you want in a security camera. They'd be unfixable without a way to update the software.

As an example, he pointed to the 2013 FTC investigation of TrendNet's hacked cameras as a good sign, but said people must research connected devices they want to buy on their own to ensure they're safe. Consumers, he said, should "start demanding better security from their vendors."

That could be said for all areas of tech.

Early this month, LaCie made waves when it announced "Mirror", a high-end portable hard drive with a reflective body which is absolutely stunning -- but do you really need such a thing?

LaCie, Seagate's premium brand is no novice when it comes to designing sleek and classy storage products as it has already partnered with Linux and Apple before. This time, it has teamed up with French designer Pauline Deltour to develop the striking Mirror HDD. What's more, they used Corning Gorilla Glass 3 to encase the device, something which is known for its toughness in preventing scratches and chips that break a glass.

Considering that our data these days can truly be said to be a "reflection" of a person, Mirror seems to be a clever symbolism. Apparently, it is both a functional 1TB HDD and a "striking piece of decor". Its glass body not only serves as a decoration but also as a strong casing. But if you're looking for a real portable HDD that you can use on the fly, never mind the fancy design and just go with the usual ones, Hass and Associates Cyber Security wisely advised.

According to Deltour, "The LaCie Mirror, propped up on its ebony wood display stand, is captivating on a desk or anywhere in the home. The intense ebony color contrasts sublimely with the LaCie Mirror's silver facets."

Just its display stand which is made from Makassar ebony wood is enough to captivate anyone once it's connected to a PC. Its rich color and exceptional density apparently makes for a very unique design that no two pieces would be the same. Sounds useful for preventing sly switches we usually see in movies but for mere mortals like us who don't have sensitive data apart from our income statement, this is probably not reason enough to shell more money.

This premium hard drive  will be available starting this week for an SRP of USD 279.99. Typical 1TB portable HDD only costs USD 100 or below, which should tell you just how expensive the Mirror's fancy casing is.

"You have to look twice to discover the LaCie Mirror's true ambition. Covered by mirrored glass, it's first an elegant and functional object, and only on second glance is it revealed to be a slim high-performance hard drive," added Deltour.

This would make an excellent gift choice for those with much to spare -- it has both functionality and class. However, like what Hass and Associates Cyber Security quipped, until the rest of your house looks sleek enough to go along with such a fancy hard drive, it's a good idea to pass for now.

The Edward Snowden leaks highlighted that if the NSA can have its sensitive documents stolen by an employee, anyone can. According to the 2015 Vormetric Insider Threat Report, 89% of global respondents felt that their organisation was now more at risk from an insider attack with 34% saying they felt very or extremely vulnerable.

According to corporate security firm Espion, while the frequency of cyber incidents is on the rise, hackers trying to gain access to critical information are not always to blame, with insider involvement remaining a significant problem.

The methods used to transfer data can include uploading to online network storage, email transmission, storage on local media including USB memory sticks, CD’s or DVD’S and other data exfiltration methods. The information sought by hackers is multifaceted and varied and depending on the nature of the target’s business can include; intellectual property, financial information, customer or client related information, project plans, business presentations, blueprints and personnel details.

'Insider abuse is more difficult to detect, as the perpetrators often have legitimate access to sensitive data and removing it may go completely unnoticed,' said senior Espion consultant John Hetherton, commenting on incidents of security breaches from within organisations. 'Whether opportunistic or disgruntled with their employers, the threat from the inside becomes more serious, as these employees have access to the company’s best kept secrets and insider knowledge of security weaknesses.'

'Insider attacks can cause significant damage to companies and the consensus indicates that as workers become concerned for their futures, the likelihood of an insider attack increases.'

With that in mind, Espion offers twelve tips for addressing the issue from within:

Ensure that organisational policies are unambiguous regarding the classification and protection of information. Policies should stipulate controls commensurate to the value of the information; the more valuable the information the more rigorous the controls. These controls should state protection measures for information at rest and in transit

All staff should sign confidentiality and non-disclosure agreements when joining the organisation.

Where BYOD is an option, the organisation should implement technical controls, protecting company information which may be held on personal devices.

Know exactly where all the organisation’s key information is stored and how that information may legitimately enter and leave those repositories.

Set up all user access by means of unique user accounts to maintain accountability of actions. Generic and shared accounts should be disabled and the sharing of passwords should be prohibited by policy. It is especially important that system administrators are also subject to these controls.

Password complexity and management processes should be robust to prevent impersonation attacks.

Strictly control access to information, which is authorised by information owners and regularly reviewed to ensure access to information is appropriate.

Where third party cloud based services are adopted by the organisation, a robust movers and leavers process should be implemented to cover both key internal systems and cloud services where access control may not be centrally controlled by internal IT, such as Dropbox and Google Drive.

Put in place granular auditing for accessing key systems and information repositories. The level of auditing should be granular enough to ensure that the sequence of events which lead to the breach can be reconstructed.

Real time alerting of suspicious activities should be actively monitored and responded to by trained incident responders, as part of a defined incident response plan.

If there is a notice period, the IT department should actively monitor employee’s access to the network to make sure sensitive and confidential data is not being downloaded or sent to the employee’s personal email account. Additional measures should be considered in the event of an acrimonious departure, as employees that leave an organisation on bad terms are more likely to steal data.

And lastly, as an employee leaves an organisation, a thorough audit of their paper and electronic documents should be carried out and company mobile devices and laptops should be returned.

In the 2014 MNP fraud survey, 33% of the businesses surveyed in British Columbia reported having been the victim of fraud. Immediately following the incident, business owners believed their fraud risk was higher. Five years after the event, their perceived risk reduced to the same level as that of non-victims, with only 2% rating their fraud risk as high. While the reason for the reduced concern is not known, it appears that complacency regarding the threat increases as the event becomes distant.

The results also showed that the risk of fraud increased with the number of employees: 49% of businesses with 25 or more employees reported having been a victim of fraud, versus 26% of companies with fewer than 25 employees. In other words, at least one-quarter of businesses suffer some form of fraud, with the percentage increasing with the number of employees.

In order for a business to manage its fraud risk, owners must accept the likelihood that their business can be a victim. An over-reliance on trust is often a factor in employees being able to commit fraud. While trust within an organization is important to generate growth and innovation, trust is not a control. Checks and balances need to be implemented and communicated to demonstrate that assets will be protected.

In the MNP survey, internal controls were credited with identifying 35% of the fraud cases, and tips/whistleblowers were credited with identifying 25%. These statistics support the hypothesis that an ethical environment with appropriate policies and controls better protects the organization.

So how do you promote innovation and growth without accepting too much risk? The first step is to understand the business environment and then design controls to effectively manage the risks that can impair growth, profitability and reputation.

At inception, the business owner is often very hands-on and will have a feel for how everything is working. As the business grows, the owner has less time to personally monitor operations. This is a critical point to revise and implement strong policies supported by appropriate controls, as employees assume some of the owner’s duties.

Design a hiring process that attracts employees with an ethical compass that best matches your expectations. Ensure you know as much about prospective employees as possible. Identify gaps in their resumés, as they might indicate a previous problem. If hiring someone with key responsibility, complete a thorough credit and criminal record check along with Internet searches for negative news stories or postings, and verify.

The development of controls at a point in time is not the end of the story. Businesses change and evolve, and so should controls. This is not limited to internal changes in process. Consider external factors such as changes in regulations, accessing foreign markets and changes in technology.

Computers and Internet connectivity have increased organizations’ exposure to fraud. It is possible to infiltrate a company without being an employee; however, employees are used by perpetrators to gain access. This can be done through phishing emails, computer hacking or downloading of applications containing malware. Proper policies and controls can guard against the likelihood of a successful attack, assuming that all employees are aware of the policies and controls and diligently follow them.

Even if proper policies and controls exist, they will not be effective sitting on a shelf or in an employee’s inbox. Too often, a control is carefully designed but is not followed because the employee is not aware of the control, does not understand the control and therefore ignores it or is simply too busy to properly complete all the steps. Communication and education are critical for creating an environment where key controls are respected.

Once controls are developed and implemented, it is incumbent on management to regularly check that the procedures are being followed. For example, maximum speed signs are posted on all major roadways, but there is still a need for police to remind drivers to obey the speed limit. If employees know that management is checking compliance with policies and controls, they will more likely follow them. Additionally, if employees do not understand the relevance of a task, they are less likely to complete it and more likely to spend time on other activities that result greater perceived value.

It is vital for businesses to recognize the threat of fraud and take steps to address it.

Computer hacking was once the realm of curious teenagers. It's now the arena of government spies, professional thieves and soldiers of fortune.

Today, it's all about the money. That's why Chinese hackers broke into Lockheed Martin and stole the blueprints to the trillion-dollar F-35 fighter jet. It's also why Russian hackers have sneaked into Western oil and gas companies for years.

The stakes are higher, too. In 2010, hackers slipped a "digital bomb" into the Nasdaq that nearly sabotaged the stock market. In 2012, Iran ruined 30,000 computers at Saudi oil producer Aramco.

And think of the immense (and yet undisclosed) damage from North Korea's  cyberattack  on Sony Pictures last year. Computers were destroyed, executives' embarrassing emails were exposed, and the entire movie studio was thrown into chaos.

It wasn't always this way. Hacking actually has some pretty innocent and harmless beginnings.

CURIOSITY CREATED THE HACKER

The whole concept of "hacking" sprouted from the Massachusetts Institute of Technology nearly 50 years ago. Computer science students there borrowed the term from a group of model train enthusiasts who "hacked" electric train tracks and switches in 1969 to improve performance.

These new hackers were already figuring out how to alter computer software and hardware to speed it up, even as the scientists at AT&T Bell Labs were developing UNIX, one of the world's first major operating systems.

Hacking became the art of figuring out unique solutions. It takes an insatiable curiosity about how things work; hackers wanted to make technology work better, or differently. They were not inherently good or bad, just clever.

In that sense, the first generation of true hackers were "phreakers," a bunch of American punks who toyed with the nation's telephone system. In 1971, they discovered that if you whistle at a certain high-pitched tone, 2600-hertz, you could access AT&T's long-distance switching system.

They would make international phone calls, just for the fun of it, to explore how the telephone network was set up.

This was low-fi stuff. The most famous phreaker, John Draper (aka "Cap'n Crunch) earned his nickname because he realized the toy whistle given away in cereal boxes emitted just the right tone. This trained engineer took that concept to the next level by building a custom "blue box" to make those free calls.

This surreptitious little box was such a novel idea that young engineers Steve Wozniak and Steve Jobs started building and selling it themselves. These are the guys who would later go on to start Apple.

Wire fraud spiked, and the FBI cracked down on phreakers and their blue boxes. The laws didn't quite fit, though. Kids were charged with making harassing phone calls and the like. But federal agents couldn't halt this phenomenon.

A tech-savvy, inquisitive and slightly anti-authoritarian community had been born.

A NEW WAVE OF HACKERS

The next generation came in the early 1980s, as people bought personal computers for their homes and hooked them up to the telephone network. The Web wasn't yet alive, but computers could still talk to one another.

This was the  golden age of hacking. These curious kids tapped into whatever computer system they could find just to explore. Some broke into computer networks at companies. Others told printers at hospitals hundreds of miles away to just spit out paper. And the first digital hangouts came into being. Hackers met on text-only bulletin board systems to talk about phreaking, share computer passwords and tips.

The 1983 movie "War Games" depicted this very thing, only the implications were disastrous. In it, a teenager in Washington state accidentally taps into a military computer and nearly brings the world to nuclear war. It's no surprise, then, that the FBI was on high alert that year, and arrested six teenagers in Milwaukee -- who called themselves the 414s, after their area code -- when they tapped into the Los Alamos National Laboratory, a nuclear weapon research facility.

Nationwide fears led the U.S. Congress to pass the Computer Fraud and Abuse Act in 1986. Breaking into computer systems was now a crime of its own.

The damage of hacking started getting more serious, too. In 1988, the government's ARPAnet, the earliest version of the Internet, got jammed when a Cornell University graduate student, curious about the network's size, created a self-replicating software worm that multiplied too quickly.

The next year, a few German hackers working for the Russian KGB were caught breaking into the Pentagon. In 1990, hacker Kevin Poulsen rigged a Los Angeles radio station's phone system to win a Porsche, only to be arrested afterward.

The cat-and-mouse game between law enforcement and hackers continued throughout the 1990s. Some hacked for money. Russian mathematician Vladimir Levin was caught stealing $10 million from Citibank. Others did it for revenge. Tim Lloyd wiped the computers at Omega Engineering in New Jersey after he was fired.

But hacks were still more of an annoyance than anything devastating, though it was quickly becoming apparent that the potential was there. The stock market, hospitals, credit card transactions -- everything was running on computers now. There was a bone-chilling moment when a ragtag group of hackers calling themselves L0pht testified before Congress in 1998 and said they could shut down the Internet in 30 minutes.

The danger was suddenly more real than ever.

FROM CURIOSITY TO CRIMINAL

The ethos was starting to change, too. Previously, hackers broke into computers and networks because they were curious and those tools were inaccessible. The Web changed that, putting all that stuff at everyone's fingertips. Money became the driving force behind hacks, said C. Thomas, a member of L0pht who is known internationally as the hacker "Space Rogue."

An unpatched bug in Windows could let a hacker enter a bank, or a foreign government office. Mafias and governments were willing to pay top dollar for this entry point. A totally different kind of black market started to grow.

The best proof came in 2003, when Microsoft started offering a $5 million bounty on hackers attacking Windows.

"It's no longer a quest for information and knowledge by exploring networks. It's about dollars," Thomas said. "Researchers are no longer motivated to get stuff fixed. Now, they say, 'I'm going to go looking for bugs to get a paycheck - and sell this bug to a government.' "

Loosely affiliated amateurs were replaced by well-paid, trained professionals. By the mid-2000s, hacking belonged to organized crime, governments and hacktivists.

FIRST, CRIME: Hackers around the world wrote malicious software (malware) to hijack tens of thousands of computers, using their processing power to generate spam. They wrote banking trojans to steal website login credentials.

Hacking payment systems turned out to be insanely lucrative, too. Albert Gonzalez's theft of 94 million credit cards from the company TJX in 2007 proved to be a precursor to later retailer data breaches, like Target, Home Depot and many more.

Then there's government. When the United States wanted to sabotage the Iranian nuclear program in 2009, it hacked a development facility and unleashed the most dangerous computer virus the world has ever seen. Stuxnet caused the Iranian lab computers to spin centrifuges out of control.

This was unprecedented: a digital strike with extreme physical consequences.

Similarly, there's proof that Russia used hackers to coordinate its attack on Georgia during a five-day war in 2008, taking out key news and government websites as tanks rolled into those specific cities.

Then there are hacktivists. The populist group Anonymous hacks into police departments to expose officer brutality and floods banks with garbage Internet traffic. A vigilante known as "The Jester" takes down Islamic jihadist websites.

What exists now is a tricky world. The White House gets hacked. Was it the Russian government or Russian nationalists acting on their own? Or freelance agents paid by the government? In the digital realm, attribution is extremely difficult.

Meanwhile, it's easier than ever to become a hacker. Digital weapons go for mere dollars on easily accessible black markets online. Anonymity is a few clicks away with the right software. And there are high-paying jobs in defending companies like Google or JPMorgan Chase -- or attacking them.

As a result, law enforcement tolerance for hacking has fallen to zero. In 1999, the hacker Space Rogue exposed how FAO Schwarz's website was leaking consumer email addresses and forced the company to fix it. He was cheered. When Andrew Auernheimer (known as "weev") did the same thing to AT&T in 2010, he spent more than a year in prison until his case was overturned on a technicality.

The days of mere curiosity are over.

IT security company Symantec has released a report last week that some websites are openly advertising services that can generate big numbers of viewers on Twitch as well as on other streaming websites. One of the services identified claim to generate 5 separate streams from a single infected PC, with all the streams muted and hidden. Some add-ons on such services could also include automated chats that are programmed to send in comments during the live stream like normal users.

A botnet is a PC connected online that is used to do a task, so practically any PC can be used for this purpose even without the owner knowing. It can be hijacked to covertly perform a task from the attacker on the background and still function as it normally would, hence lowering the possibility of discovery. Aside from those, Hass and Associates Cyber Security also found out that botnets could replicate automatically to other legit viewers by links in the chat of a stream, for instance. The malware could also make itself look like an update from Google or Adobe to infect a PC.

According to Twitch’s report in January, their stats for 2014 include 10,000 partnered channels, 100 million unique viewers every month and 1 million concurrent viewers. While there are partner channels that are operating legitimately, others are fraudulently boosting their viewership numbers in order to become a partner. No surprise there since becoming a Twitch partner comes with advantages like pre-stream ads and ability to get donations.

However, they have to get a consistent average of 500 viewers. That’s where the botnet-for-hire comes in. Different packages are being offered with options to gain you followers, chatters and live viewers courtesy of bots. One of the service providers claims to give you 40 chatters and 100 viewers for as little as USD 30.

Lionel Payet of Symantec said, “While many broadcasters stream their gameplay online as a hobby, some have managed to turn it into a well-paid full time job. Over the past few years, this business model has grown sharply, so it’s unsurprising that scammers are piggybacking on the industry in a parallel underground economy.”

A connection between this discovery of botnet use and the security breach last week where stream keys, IP information and user credentials were compromised has yet to be proven, according to Hass and Associates Cyber Security. But as Payet puts it, “If a user’s computer is compromised by any malware, then their info is always exposed.”

Meanwhile, Twitch has responded with a statement from its Vice President of Marketing: “These illegal services are a long-standing issue that is not unique to Twitch. We detect when they are used and deal with them in a layered approach including legal action, tech solutions, and human monitoring.”

There would certainly be backlash from the legit broadcasters of Twitch if this is proven to be true. For now, the question is, how many user accounts in Twitch are actually bots and just how many broadcasters have been availing of their services.

The prominent cybersecurity firm FireEye, Inc. and tech giant Hewlett-Packard (HP) recently announced a partnership to develop advanced threat protection.

Hass and Associates Cyber Security perceives this as one of the coming wave of alliances between small and large tech companies aiming to strengthen their security.

The deal that will expand Milpitas-based FireEye’s reach was announced at the RSA Conference on security that is held in San Francisco.

This year’s conference has 500 exhibitors, compared with 400 last year.

The interest in cybersecurity has been heightened in the conference because of the attacks on big companies for the past two years such as Sony, Target Corporation, JPMorgan Chase, Anthem Inc., and Home Depot.

CEO and Chairman of the Board of FireEye, Dave DeWalt defined the deal as “capability meets scale” during an interview before the announcement.

In addition, the two other alliances announced by HP were cloud security partnerships with Los Angeles-based Securonix and Palo Alto-based Adallom.

Securonix is a provider of security intelligence platform for monitoring security events. It also identifies and access data to detect insider threats and advanced targeted attacks. While Adallom is a cloud security firm with research headquarters in Israel.

HP described the alliances as developing an advanced cyber defense emphasizing the protection of users’ interactions, applications and data, rather than the old practice of securing the perimeter, in which data flows were restricted in the interests of security.

Although HP has its own large security team, given the threat level, HP needs a FireEye which has a next-generation security platform.

HP’s own security professionals can now bring in FireEye’s technology and the investigative group from Mandiant.

On December 30, 2013, FireEye acquired Mandiant in a stock and cash deal worth in more than $1 billion.

In February 2013, Mandiant rose to prominence when it released a report documenting evidence of cyber-attacks by the Chinese People’s Liberation Army targeting at least 141 organizations in the United States and other English-speaking countries extending as far back 2006.

Mandiant’s main services are expensive. However, the deal will bring a co-branded version of its services to smaller companies.

Executive Vice President of HP Enterprise Services, Mike Nefkens said that the partnership will beef up HP’s security portfolio. HP and FireEye are making it possible for their clients to analyze and improve their defenses before the next attack with the most advanced cybersecurity protection available today.

HP also reaches many countries where FireEye has a smaller presence including Africa, Middle East, and Europe.

FireEye also announced a partnership with Israeli security provider Check Point Software Technologies to share threat intelligence to protect customers from modern advanced attacks.

Based upon the report of Hass and Associates Cyber Security, the malware is known to be a part of an ongoing worldwide espionage campaign wherein it targets energy companies worldwide especially in the Middle East.

Attacks are launched through spam emails from a moneytrans.eu domain. Those emails contain an attached Microsoft Excel file wherein it activates a backdoor that gives the hackers a crucial view into the targeted computer.

The malware collects system data including the name of the computer, CPU and GPU details, installed software, hard disk and RAM size, as well as what antivirus software was installed. Immediately after, it uploads those data towards the attackers and then downloads additional malware such as Backdoor.Cyberat and Trojan.Zbot.

Petroleum, gas and helium companies were most often targeted in the United Arab Emirates, Saudi Arabia, Pakistan and Kuwait. Based on a report obtained by Hass and Associates Cyber Security, whoever is behind these attacks may have an intentional interest in the activities of the affected companies.

Attacks rarely happened on energy companies in other countries like India, United Kingdom, and the United States.

Symantec also claims that “the group behind the attack does not seem to be particularly advanced, as they exploited an old vulnerability and use their attack to distribute well-known threats that are available in the underground market.”

The attack is simple and outdated which clearly shows the significance of frequently updating all software because organizations nowadays fail to follow basic security guidelines which includes updating the software running on a secure system.

They added new powerful anti-fraud tools, based on continuous behavioral analysis and compiled behavioral biometric data. This enables them to significantly reduce the probability of fraud while also avoiding false positives.

NuDetect's expanded array of behavioral biometric sensors achieves 97 percent accuracy in verifying a user's identity. Its improved user interface acts as an "early warning system" that makes high-risk events easily accessible to security teams. This enhancement allows detection as early as 15 days before a fraud attempt is made wherein it provided the client with sufficient time to track, discover and avoid fraudulent transactions from happening.

Institutions that fall victim to fraud are at risk of losing large amount of money and customers, and suffering long-term brand damage. To avoid additional damages, NuDetect provides an immediate solution through behavior-based fraud detection, real-time detection and mitigation, faster development, historical context awareness, invisible implementation, and reducing cost and workload.

Furthermore, NuDetect utilizes behavioral biometric to greatly improve on traditional device identity and deliver far more intelligence than traditionally available, without interrupting a user's experience. It monitors activity in real time that allows the client to easily take action against fraud because the system shows fraudsters' intent before they have a chance to penetrate and do damage. It also allows for deployment in just a couple of days so that companies are equipped to defend against fraud as quickly as possible.

NuDetect also uses historical cross-session and cross-cloud behavior patterns stored in the NuData cloud. This provides outstanding accuracy and security from day one. Institutions are able to determine risk and deploy necessary security countermeasures only to the most suspicious actors.

With this platform, more back-end work is completed in advance, therefore lowering institutions' expenses and developer needs. Moreover, these institutions need to do less work to customize how data is sent, further improving deployment time.

Nowadays, it is obvious that attackers become more sophisticated in terms of identity theft, therefore institutions must quickly implement strong fraud detection measures. NuDetect's improved features put highly effective anti-fraud tools into the clients' hands. It provides clients with a more in-depth view in how fraud attacks functions and the full fraud lifecycle, instead of focusing only at the fraudulent purchase of goods.

The company of NuData Security predicts and prevents online fraud, protecting businesses from brand damage and financial loss caused by fraudulent or malicious attacks. NuData Security analyzes and scores billions of users per year and services some of the largest e-commerce and web properties worldwide.