by Steve Freidkin

One of the most insidious cybersecurity schemes today, ransomware is projected to have cost over $20 billion in 2021. That number is only expected to multiply in the coming years, so it’s crucial for business owners to guard their organizations against emerging cybersecurity threats and develop thorough mitigation and response plans. 

Approximately 37% of global corporations were subject to a ransomware attack in 2021, and 70 percent of CISOs surveyed expect an imminent attack on their organization. The concern is justified when looking at the sharp upward trend within the last two years.

The spike is largely attributed to the surge in remote work during the COVID pandemic that led to an explosion in the global digital economy. As more industries move their operations online, the shift has created a growing market for unscrupulous actors looking to exploit cybersecurity vulnerabilities, of which there are many if you know where to look. 

The rise of “ransom as a service” (RaaS) platforms has also made it much easier for such nefarious exploits to occur. This subscription-based model enables hackers to use already-developed ransomware tools to execute attacks. Now would-be cyber-kidnappers no longer need the skill to develop malware on their own or even possess the technical know-how to conduct ransomware attacks—anyone can become a cybercriminal. 

It’s thus imperative that companies protect themselves by understanding who ransomware attackers are, how they operate, and the best practices to stop them in their tracks.

How RaaS enables unskilled actors

RaaS gives anyone, even those with zero experience, the ability to launch ransomware attacks by simply signing up for a service or purchasing a toolkit. Ransomware kits are sold on the dark web and are often purchased as a monthly subscription service. Subscribers also receive 24/7 access to technical support and user forums, complete with Q&As and troubleshooting sections. 

Subscriptions go for as little as $40 a month, which makes the technology all too accessible to anyone interested in committing financial crimes. Moreover, the developers are invested in their clients’ success; they design easy-to-use software to ensure repeat customers, and may even receive a cut of their customers’ ill-gotten gains. 

Guarding against common vulnerabilities 

Beginner ransomware attackers usually opt for one of three basic schemes: email phishing, exploiting Remote Desktop Protocols (RDPs), or preying on vulnerabilities in out-of-date software.

Email phishing scams typically trick employees into taking some form of action that gives hackers access to an company system, whether by an employee clicking on a viral attachment or entering login credentials into a fake form. 

Another insidious method has recently emerged through the rise in remote work—Remote Desktop Protocols (RDPs), which are designed to allow employees’ computers to remotely connect to a company system, but they also leave organizations vulnerable to backdoor attacks. Typically, all of the employees of a particular ogranization will connect remotely to the same system, which allows attackers easy access to an entire network if the RDP is left unprotected and not shielded behind a firewall. In 2020, over 50 percent of ransomware attacks used RDPs as their initial line of attack. 

Despite the ubiquity of RDP attacks, the simplest form of ransomware attack to both execute and prevent comes from the use of out-of-date software, which presents a host of vulnerabilities. When software is not properly updated or patched, attackers can easily access networks, even without stolen credentials.

Protecting your cyber infrastructure 

Your employees are your first and most effective line of defense from nefarious attacks. It is crucial to educate staff about the dangers of phishing emails, backdoor attacks, and out-of-date software so they can be your organization’s most prominent firewall. 

Institute a mandatory employee security-awareness program, which should include multiple diverse modules to help employees understand the various routes of attack and how to block them. This helps ensure that your employees are collectively working toward strong internal cybersecurity.

After training, consider executing simulated scams to see how employees perform in real-world scenarios. Evaluate their performance to identify where your liabilities are, as well as who might require additional training or assistance. 

After establishing a strong foundation with a well-trained internal personnel, take the following steps: 

• • Enable multifactor authentication,  which requires an additional security level on top of a password to log into a system. This usually means employees must verify their identity through a device that the system recognizes. While there are various techniques to steal passwords, it is more difficult to access a remote physical device like an individual’s phone. An amateur who has merely purchased a RaaS toolkit is unlikely to be able to bypass two-factor authentication. 
  • Limit access to Remote Desktop Protocols (RDPs). Hide RDPs behind a firewall to limit access to outside users, and check RDPs frequently to ensure they remain secure. 
  • Patch regularly and frequently. Updated software is less likely to have holes and vulnerabilities ripe for exploitation. 
  • Enlist a spam filter that blocks all encrypted attachments. Encrypted attachments are bad news, period. You can live without them. 

Even if you have anti-ransomware infrastructure and protocols in place, your organization may still fall victim to a RaaS attack. Therefore, it is crucial to have a robust backup process. Backups should be regular and frequent, and it’s imperative that company data is stored in multiple secure locations. If your systems are infiltrated in the end, you will have less to lose, and thus a lower ransom to pay.

However, the most important action is still to build good habits amongst your workforce. Managers must ensure that employees are not afraid to ask for help in instituting effective cybersecurity practices and work to foster a cooperative culture where everyone collectively prevents and mitigates attacks. 

By instituting these measures, you can protect your organization against those looking to make a quick buck and reverse the upward trend in attacks, flattening the curve. 

About the author: Steven Freidkin is the CEO and founder of Managed Security Services Provider (MSSP), Ntiva and has over 17 years of experience within the MSP industry.

by Ankit Pahuja

A web pen-test, also known as a penetration test, is an attempt to find vulnerabilities on your website. A web pen-test checklist is a list of items that should be tested on the target site. Web pen-tests are used for many reasons, including compliance audits and security audits. This post will guide you through the steps involved in conducting a successful web pen-test, as well as how to utilize a few useful tools.

What Is a Web Pen Test Checklist?

A web pen-test is an attempt to find vulnerabilities on your website. A penetration test, or pen-test for short, looks at the security of a system by simulating real-life attacks against it. As corporations expand their digital presence in business processes, they are increasingly concerned with website security.

Why Use a Web Pen Test Checklist?

A web pen-test checklist is a list of items that should be tested on the target site. This can aid in the detection and mitigation of any prospective threats. Having a checklist also helps to ensure that all aspects of the website are covered, including both the front-end and back-end. It also helps to ensure that all items are tested.

Web Pen Test Checklist

A web pen-test is a method for testing your website’s security. A penetration test, also known as a pen test, is an attempt to identify flaws in a system using real-world assaults. As businesses take over digital territory in their business processes, many organizations are placing more emphasis on the security of their websites. This is the checklist to keep track of when planning a web pen-test-

• Identify the target website.
• Determine the goals of the pen test.
• Gather information about the target website and its users.
• Select the right tools to use in the pen test.
• Conduct reconnaissance of the target website.
• Find and exploit vulnerabilities on the target website.
• Conduct pentesting.
• Attack the target website using the selected tools.
• Report on findings and conclusions from the pen test.

Tools Available For a Web Pen Test

There are a variety of tools for performing a web pen test. Some of the most popular ones include:

• Astra Pentest
• Metasploit Framework
• Nmap
• Burp Suite
• WebInspect
• OWASP Zed Attack Proxy (ZAP)
• Acunetix WVS
• Nikto

These are just a few examples, and there are many more tools available. Each tool has its own strengths and weaknesses, so it is important to choose the right one for the job.

Outline for A Web Pen Test

Now that you know what a web pen test is and some of the benefits of using one, let’s walk through the basics parts for conducting one. The following phases will outline how to plan and execute a successful web pen test:

• Planning Phase – In this phase, you should start by choosing the right tools for your pen test. It is also critical that you identify the correct items to target during testing and determine what type of access testers will require throughout this phase.
• Executing Phase – In this step, it’s important that you carefully execute both manual and automated techniques as part of a comprehensive test. Testers should also be aware of the legal implications of their activities during this phase.
• Reporting Phase – The final stage is to compile all findings and present them in a detailed report. This will help organizations understand the risks associated with their website and determine what steps need to be taken to improve security.

By following these simple steps, you can conduct a successful pen-test to identify vulnerabilities in your website.

Steps To Conduct a Web Pen Test

Now that you know what a web pen-test is and why you should use a checklist, let’s walk through the steps of how to conduct one.

• Get a list of relevant URIs

When starting your web pen test, this is the first step you should take. You will need to collect all potential target sites and group them together by relevance. This step can be done automatically using tools such as Burp Suite’s Site Map function or manually with Google Dorks. Make sure to include all potential subdomains and parameters in your list.

• Scan the target site for vulnerabilities

Once you have your list of URIs, it is time to start scanning them for vulnerabilities. This can be done with a variety of tools, including Burp Suite, Astra Security, OWASP ZAP, and Acunetix WVS.

• Analyze the vulnerabilities discovered

Now that you have found all of the vulnerabilities, it is time to analyze them and see which ones are actually exploitable. This step will also include determining what aspects of your site can be exploited using each vulnerability (e.g., cross-site scripting (XSS) vs redirects). This information can be used to prioritize the vulnerabilities and create a remediation plan.

• Fix the vulnerabilities

Once you have determined which vulnerabilities are most important, it is time to start fixing them. This process can be difficult and time-consuming, but it is necessary for ensuring the security of your website. Make sure to test your fixes before putting them into production to ensure that they work properly.

Conclusion

A web pen-test checklist is an important tool for identifying website vulnerabilities. By following the steps outlined in this article, you can create your own checklist and use it to find and fix security flaws in your website.

Ankit Pahuja

Author Bio: Ankit Pahuja is the Marketing Lead & Evangelist at Astra Security. Ever since his adulthood (literally, he was 20 years old), he began finding vulnerabilities in websites & network infrastructures. Starting his professional career as a software engineer at one of the unicorns enables him in bringing “engineering in marketing” to reality. Working actively in the cybersecurity space for more than 2 years makes him the perfect T-shaped marketing professional. Ankit is an avid speaker in the security space and has delivered various talks in top companies, early-age startups, and online events. Linkedin: https://www.linkedin.com/in/ankit-pahuja/

Guest Post

by Paddy Srinivasan, Chief Product & Technology Officer, LogMeIn

Given the rise of the Delta variant in the U.S, more employees are working from home than ever before. However, as convenient as remote work may be for employees, it’s not as convenient for IT teams. Data breaches and cyber attacks have increased by 238% during the pandemic, and remote workers are only feeding the problem. This is especially an issue for the public sector, as Verizon’s Data Breach Investigations Report found that government agencies accounted for the highest number of breaches of all sectors studied (17 percent) in 2020. State and local employees have found that many back-end operations cannot be managed remotely, opening up the possibility for vulnerable access points. IT teams are struggling to come up with account management solutions for remote employees that are secure and easily implemented company-wide.

Paddy Srinivasan

Recently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its cyber bad practices to include single-factor authentication (SFA) on the list of “exceptionally risky” cybersecurity operations. This list includes practices that open up the potential to expose critical infrastructure, as well as the government, to threat actors looking to expose sensitive information. With many organizations still operating remotely, logging on to an account using SFA can provide an easy entry point for a cybercriminal. How can IT teams protect employees working in the public sector from threat actors without disrupting day-to-day operations? They should implement multi-factor authentication (MFA).

Heightening Security Using MFA

Across the public sector, IT teams of all sizes are quickly realizing that there are wide gaps in their cyber hygiene and security strategies. With 80% of data breaches occurring as a result of weak or reused passwords, IT teams need to require an additional layer of security to ensure their sensitive information remains secure without the risk of slowing down operations. MFA is the most effective method to protect against these cyber attacks.

In fact, recent research found that 62% of IT decision-makers believe MFA is the most effective way to secure an organization. While SFA only requires one method of authentication to log into accounts, such as a password, MFA requires two or more methods before granting access. These methods may include something an employee knows (a password) and something they have (a phone or fingerprint). The convergence of two or more modes of authentication can more accurately verify that a person is who they claim to be and has the ability to access sensitive information. Since passwords have proven again and again to be unreliable and vulnerable to attacks, implementing MFA on all devices adds the strength needed to secure sensitive information.

Overcoming Challenges

The main challenge IT teams face when implementing MFA is finding the right balance between accessibility and security. Employees should not feel as though they are wading through clunky software and experiencing unnecessary friction during their workday. This is why using biometrics in MFA utilizes assets an employee already has on hand – their smartphone and their fingerprint – to ensure a convenient and secure login. Biometrics offers employees a seamless authentication process and a higher level of security. With a quick scan of a fingerprint or face, employees can securely gain access to work resources and sensitive information while allowing IT teams to gain increased control and visibility.

Looking Ahead

The era of working from home has catapulted IT teams into more challenging roles given the increased risk that remote employees bring, particularly for government agencies, where data security is of the utmost priority. With exposed remote access points and rapidly growing online government services leaving IT teams in the dark, the public sector faces a strong risk of security breaches. In order to effectively balance account and password security with user experience, IT teams looking to pivot their security strategies to the defensive should ensure all access is granted through MFA.

by Sam Ingalls 

Since the days of Hammurabi – nearly four thousand years ago – insurance has been a system where two parties agreed to financial terms to protect an asset. Today, the next big prospect for financial protection could be the ever-volatile cryptocurrency space.

In modern society, nearly everything can be insured. Our livelihoods through life, disability, and health insurance. Our tangible assets, protected by insurance for the car, home, and family heirloom. In the scope of financial planning, insurance is the foundation that secures an individual or organization’s future by managing existing risk. But how do organizations and investors insure their newest digital assets?

For startups or organizations that went headfirst into cryptocurrency, insuring their financial stake hasn’t been easy. However, a growing market of financial products rooted in blockchain technology, as well as an increasing acceptance by private and public institutional stakeholders, means crypto assets could soon receive the same protections as traditional financial assets.

This article looks at how we got here and how one crypto segment is approaching insurance through decentralized finance.

The Road for Crypto Assets

Why Is It Taking So Long?

For years institutional advisors downplayed cryptocurrency, and can we blame them? The financial ecosystem has long strived to correlate investments in companies and assets with quantitative data to back up the purchase. Crypto was an exciting innovation, but an asset’s lack of understanding and legitimacy tabled further discourse. Add consistent volatility, and we’ve got a good argument for why it’s taken this long.

The Legitimization of Cryptocurrency

In 2009, Bitcoin launched as the world’s first successful decentralized exchange. Over a decade later, public financial institutions are now asking if cryptocurrencies are a feasible alternative to existing fiat currencies. With more investors, startups, and traditional institutions looking at cryptocurrency or already engaging somehow, the chances of broader market adoption grow.

A crucial ingredient to any financial market is investor participation. With tens of millions of crypto investors and more starting every day, institutions don’t want to miss out on what some perceive as the newest gold rush. Individual and institutional crypto investing only further legitimizes their value as assets. It’s a matter of time before every 401(k) portfolio contains a strategic portion of crypto assets.

Crypto Investing Opportunities Grow

In the realm of crypto investing, it seems new types of assets emerge every year. Cryptocurrency tokens like Bitcoin and Ethereum are the most familiar and popular. While just this last year, non-fungible tokens (NFTs) emerged as the next-generation medium for trading creative works, and blockchain-based insurance is a natural addition.

As a whole, crypto tokens are often broken down into types: utility tokens and security tokens.

Utility Tokens: Ticket to Ride

Utility tokens offer a right to a future service or product. Unlike crypto coins, which predominantly serve as an alternative to cash, utility tokens represent the value of the service or product. An online services vendor like a videogame developer can initiate an Initial Coin Offerings (ICO) to offer players tokens for use on the game platform. Like a voucher, utility tokens can be exchanged for their monetary value or used directly for their intent.

Security Tokens: Digitization of the Stock Market

In contrast, security tokens are digital contracts that represent an ownership stake in an asset. Through Security Token Offerings (STO), this new era offers tokenized forms of stocks that grant the owner the same rights as a stock owner. Bringing the traditional financial market and crypto space together, security tokens give investors the opportunity to buy fractions of assets, like stocks, backed by blockchain technology and regulated by traditional institutions like the SEC.

DeFi Insurance

Decentralized finance (DeFi) uses cryptocurrency markets that employ smart contracts in place of traditional brokers, exchanges, and banks. Besides adopting one of the hottest new assets, DeFi protocols have shown far stronger yields than conventional bank accounts.

For those interested in securing their crypto trading, DeFi can offer protection against exchange hacks, smart contract vulnerabilities, and higher premiums. Existing DeFi insurance vendors include Nexus Mutual, Unslashed Finance, iTrust Finance, and Cover Protocol.

Nexus Mutual

Nexus Mutual, run by its members, holds insurance claims accountable via a community-based system of governance. Having an NXM token doesn’t cover the risk of an exchange hack, personal key loss, or phishing attacks. Still, it can mitigate unintended uses of smart contracts due to code vulnerabilities.

Unslashed Finance

Unslashed Finance is a pay-as-you-go insurance vendor covering stable coin pegs, validator hashing, smart contract vulnerabilities, and oracle failures. The London firm currently manages over $500m with 3,210 capital providers in their decentralized autonomous organization (DAO) that secures insurance contracts.

iTrust Finance

iTrust Finance focuses on building cover capacity for insurance protocols (like Nexus Mutual) to lower premiums and increase adoption. Vaults provided to clients manage the staking of tokens. In the future, iTrust looks to adopt ETH, BTC, and more for protocol options and expand to simple cross-insurer exposure.

Cover Protocol

Cover Protocol also seeks to address the insurance gap with peer-to-peer coverage via fungible tokens (not NFTs). These tokens serve as the collateral to cover a product and a source of liquidity when traded. Coverage demand and supply set the coverage premium, and clients don’t need a KYC to start.

The Need for Greater Protection

Though DeFi insurance is in its early stages, it’s encouraging to see organizations addressing the risks presented by crypto investing. Until underwriters become more available or willing to cover crypto assets, investors can continue to expect higher premiums. Factors like a lack of historical data, volatility in cryptocurrency tokens, and the extent of personal responsibility all play into why insuring the market at large isn’t currently feasible.

In the meantime, investors holding crypto assets must be vigilant and implement the best cybersecurity practices. These include:

• Understanding crypto: how tokens, crypto exchanges, and blockchains work
• Cold wallets: disconnected token storage to prevent cyber compromise
• Wallet diversification: splitting assets between multiple wallets to reduce total risk
• Robust access controls: including MFA to ensure authentic access
• Understanding malware: avoid excessive sharing privileges and malicious links

Disclaimer: Investing in cryptocurrencies and crypto tokens remains a highly risky and speculative endeavor. This analysis is not a recommendation by the author or publishing website to invest in crypto assets, and interested parties should consult with a financial professional before investing.

About the Author:

Sam Ingalls is a writer and researcher covering enterprise technology, IT trends, and network security for eSecurityPlanet.com, Webopedia.com, ChannelInsider.com, and ServerWatch.com.