GDPR is coming. Rapidly, as it so happens, and at the time of writing there is just over 6 months to go until the 25th May 2018 deadline for compliance. Since the GDPR was adopted by the EU in 2016, businesses have been trying their best to understand the impending data protection regulation and, ultimately, ensure they are compliant. The GDPR is no straight-forward matter, though, as much of the phrasing is purposely vague to allow for possible technological advances, and to ensure that the regulation itself does not become obsolete in the near future. The idea is that if the GDPR specified which technologies were to be employed by a business in order to safeguard its data, it may be superseded by new technologies – thus reducing the effectiveness of the regulation. A key GDPR requirement, under Article 32, states that data controllers and processors are required to “implement appropriate technical and organizational measures” taking into account “the state of the art and the costs of implementation” and “the nature, scope, context, and purposes of the processing”. But what exactly does state of the art mean?
Cyber Security Is Not Just for IT – It’s for Everyone
Traditionally, cyber security has been seen as an IT department’s problem. They make sure everyone has antivirus on their PCs and take care of the firewall – and as long as they’re doing it right, then everyone else is safe… right? This has lulled users and business owners into a false sense of security of late, believing that cyber security simply isn’t their area or that it’s not in their job description. However, this attitude is now being taken advantage of in a big way by cyber criminals, who have discovered that individual users are much easier to target and deceive. As a result, users often takes actions which inadvertently allows the hackers to bypass the IT security systems. Traditional antivirus is dead, and even more advanced next-generation antivirus simply can’t stop the most deadly attacks. Now, everyone in an organisation has a part to play in keeping it secure, from the bottom all the way up to the CEO.
Hackers are now finding it easier to target regular users, who often lack cyber security training, than to try and bypass complex technical measures put in place by IT
Social Engineering
Hoes does it work? It is often as simple as an email asking you to view an invoice, check out suspicious logins on your account, or even update your password. Cyber criminals will make these emails look as legitimate as possible, and then use social engineering to convince you to carry out the action without second-guessing the action. In more advances attack, such as spear-phishing, the emails may even appear to come from within your organisation. All of this is to convince you to do something that would allow hackers to infect your PC with ransomware or other forms of malware. Often, criminals will attempt to convince you that their email is ‘urgent’, and that something bad will happen if you do not click the link, such as you being locked out of one of your accounts. This tone of urgency is a classic social engineering ploy, and is big factor to look out for when you suspect an email may not be legitimate.
Remember: Always Think Before You Click
New Mass-Ransomware Strain ‘BadRabbit’ Hits Global Companies
In May of this year, the world was shook by a global ransomware attack, the now-infamous WannaCry, which is believed to have affected more than 400,000 machines. It shook the world, crippling business big and small across a wide variety of industries. It utilised a vulnerability in the outdated Windows protocol Server Message Block (SMB) v1, and Microsoft even developed a patch for Windows XP to help defend against it. How could such an attack have caught so many organisations off guard? Well, lack of patching, cited the experts, and lack of security awareness on behalf of their employees. Patch your machines now, train your staff, and you’ll be OK going forward. Then, the following month, it happened again – the world was hit by NotPetya, a ransomware strain believed to have infected a further 250,000 machines around the world. It’s worth noting that both attacks managed to affect PCs in Ireland, and that the second of the two major attacks could have been prevented if these companies had taken appropriate measures following WannaCry.
BadRabbit is the latest in a streak of mass-ransomware attacks this year, and may have been unleashed by the creators of NotPetya
As of this week, yet another strain of mass-ransomware is out in the wild, which has been dubbed BadRabbit. While it doesn’t utilise the same vulnerability as the previous two infections, its modus operandi is very similar in that it relies on both the SMB v1 protocol (which is largely defunct in 2017) and heavy use of social engineering to trick employees into clicking their malicious links. It’s an epidemic, and too few companies are learning the lessons that the cyber and business communities have gleaned from these attacks.
KRACK – The Vulnerability That Affects Nearly Every Wi-Fi Device on the Planet
On Monday, it was announced publicly that Wi-Fi security, specifically the WPA2 standard, was essentially broken. The culprit is a bug named KRACK (Key Reinstallation Attack) which takes advantage of fundamental flaws in how WPA2 operates, and has exposed many shortcomings in how the industry responds to such attacks as well. WPA2 (Wi-Fi Protected Access II) is hugely prevalent, as it is the current generation of authentication used on wireless networks. That means that almost every wireless device could be affected by KRACK, as most devices use WPA2. This includes everything from laptops and phones to routers and IoT (Internet of Things)/Smart devices.
