Category

Information Security

May 19
1

The New Battlefront 101: Disinformation

By | Information Security | No Comments

Information Warfare: Disinformation

 

The Problem:

Disinformation is a type of misinformation where someone shares data that they know is incorrect in order to influence individual, group, or public opinion or obscure the truth.  Disinformation may include distribution of forged documents, videos, manuscripts, and photographs, or spreading dangerous rumors and fabricated intelligence.  China has been a major player in the disinformation strategy.

  • China created a “keyboard army” that is a large group of Chinese citizens paid to monitor the internet and influence public opinion on a massive scale online. The end goal is to aggressively defend and protect China’s image overseas[1].
  • Spamouflage Dragon is a pro-Chinese political spam network that camouflages their political messaging with innocent content (showing, for instance, cute animals and dancing girls)[2]. The innocent content creates simple clickbait, but once people click, Spamouflage Dragon shares their political message.
  • Another tactic is fake or hijacked social media accounts, where those accounts become the nexus for disinformation. China’s “wolf warrior” diplomats aggressively defend their home country online through building an audience with viral content, leveraging the influence networks of other autocrats, manufacturing the appearance of popular backing, posting conflicting conspiracy theories, and using ‘positive’ content to drown out criticism[3].

Disinformation contains false or out-of-context true information but the key components are that it always carries a malicious intent, it is deliberately deployed, and often part of a larger influence campaign. These longer term campaigns are often pushed over an extended period with concrete and continuous efforts with the “Big Lie” playbook being a good example. The six stages of media manipulation in the “Big Lie” – from Campaign Planning, to Seeding Information, Eliciting Responses, Adjusting Tactics, then restarting the cycle again and again.

Possible Solutions:

Understanding that first stage (the source and their intent) can go a long way in tackling the disinformation. First, always confirm the information from multiple reputable sources. Secondly, find out who benefits the most and how they are related to the spread of this information. These two questions can go long way with tackling the disinformation. If you don’t know who is pushing the information and whether it’s a true or not, you know it’s not trustworthy.

Combating disinformation at a national level is a hard problem to solve. However, it is possible with time and strategic approach. Grey Market Labs Engineer, Dhaval Vyas, states that “education is a key when it comes to combating disinformation. A well rounded education teaches critical thinking skills, which are extremely helpful with the identification of disinformation. Younger people are particularly vulnerable to fake news and disinformation. Therefore, developing critical thinking skills early on and teaching an ability to manage propaganda, fake news and disinformation effectively can go long way in combating disinformation.” However, this is a longer process.

The technology has amplified the problem of disinformation; however it can also offer a potential solutions. One approach could be using blockchain. Blockchain system uses a decentralized and immune ledger to manage information. It can help provide transparency into the lifecycle of the content by verifying origin and source reputation. The New York Times’s News Provenance Project is utilizing this approach. Another approach could be a use of global registries of labeled fake news. There are already websites available that helps with identification of fake news, such as factcheck.org and politifact.com. Integrating these websites with social media and news organizations through APIs could be very helpful. Lot of fake news is AI generated and it could also be used to identify fake news. Natural networks generate synthetic text, and they are also familiar with habits, quirks, and traits of the text. This makes them well-suited to detect content emerging from those networks.

The terms propaganda, misinformation, and disinformation need to be well defined. Legal structure needs to be added around these terms to allow accountability to be held for the organizations/persons spreading disinformation needs to be brought to justice using these laws. Presently there is little deterrence on spreading disinformation. At a global scale, formulating shared terminology for combating disinformation, and deliberately and continuously responding to foreign-sponsored disinformation is necessary to reduce the impact and potential harm from state sponsored campaigns.

 

***The next article in The New Battlefront 101 series will discuss cyber attacks on individuals.

___________________________________________________________________________________

Grey Market Labs® is a Certified B-Corp founded with the mission to protect life online. Our Replica™ platform orchestrates, automates, and secures Environments-as-a-Service, making organizations more protected with our patented privacy and Zero Trust architecture and more productive by increasing access to critical data, tools, and workflows simply, on-demand, anywhere. Replica™ support of dozens of use cases that span industries: from disrupting fraud on the dark web, to supporting military operations, combatting human trafficking, and enabling trusted data sharing in healthcare. 

Grey Market Labs® is the first cybersecurity product company recognized as a Certified B-Corp organization.

Contact us to see how we can work together.

Mar 08
1

Ukraine is at war, and so are you

By | Cyber Warfare, Information Security | No Comments

The full-scale invasion of Ukraine was beyond most expectations. Many of us watching the developments felt that Russia would take the easy gains of the eastern separatist region of Ukraine and slowly eat away at the rest of a sovereign nation over the coming years. The brutal and relentless approach Russia is taking instead shows the broad and global power grab taking place.

The Ukraine military is and will continue to put forth a strong fight against an opponent with overwhelming resources. Cyber-attacks including distributed Denial of Service (DDoS) that hit the Ukrainian defense and banking sectors will be launched as often as actual bombs in this war. The lack of widespread reporting of cyber attacks does not mean they aren’t happening. Much like a cancer, cyber is mostly invisible and once the attack is public or the effects seen, it is too late.

Unlike a cancer, this war and associate damage will not stay within the borders of Ukraine. On the digital battlefield, the intensive attacks and methods Russia and Russian-sponsored hacker groups (like Sandworm) use to weaken Ukraine are indiscriminate. These sophisticated attacks automatically and autonomously search out and infect other systems that can be compromised. Once these “worms” are launched, no human has control over where and when these virus’ attack or how far they will reach. Two public and destructive instances have already been used by Russia.

First, in conjunction with the start of the Ukraine invasion, satellite internet provider Viasat (a U.S. company) had a large outage of its service due to a cyber attack. This affected Ukraine but also tens of thousands of subscribers across EU and NATO countries. More importantly, 5300 wind turbines were knocked offline in Germany and Central Europe. Clearly attributed to Russia, these are examples of the widespread collateral damage of modern cyber warfare.

Second, last Wednesday the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced that an older threat called “Cyclops Blink” was reactivated and may be able to access more networking devices that originally thought when it was discovered in 2019. Russian-backed hacking groups used similar approaches to deploy malware like WannaCry and NotPetya, which each inflicted worldwide damage costing billions of dollars.

So now, if we consider that these cyber attacks have been as destructive as bombs or guns, Central and Western Europe and a U.S. company have already been attacked and every internet connected country is vulnerable to the cyber battle in Ukraine. Vladimir Putin has declared that a “no-fly zone” or direct military support to Ukraine would be considered an act of war. What do we call a cyber attack that takes out major electricity providers in Germany? Does that not equate to an already launched act of war? The US and our allies need to revisit the rules of what is considered an “act of war” and increase the accountability of any nation that threatens national sovereignty in any domain: land, sea, air, space, and cyberspace. Bring together a coalition to rewrite the rules of engagement for cyber, bring the commercial community (with their experts and skilled Threat Centers) to the table as partners in this effort and as fellow combatants in this war.

Today, we need to continue the pressure and increase support to defeat the Ukraine invasion on both the physical and cyber battlefield. A fallen Ukraine changes the physical security of Europe. Even worse, a fallen Ukraine tells Russia, and others, that there is no consequence for cyber damage, collateral or otherwise. If that is the case, NATO nations should prepare themselves to be the next targets.

___________________________________________________________________________________

Grey Market Labs® is a Certified B-Corp founded with the mission to protect life online. Our Replica™ platform orchestrates, automates, and secures Environments-as-a-Service, making organizations more protected with our patented privacy and Zero Trust architecture and more productive by increasing access to critical data, tools, and workflows simply, on-demand, anywhere. Replica™ support of dozens of use cases that span industries: from disrupting fraud on the dark web, to supporting military operations, combatting human trafficking, and enabling trusted data sharing in healthcare. 

Grey Market Labs® is the first cybersecurity product company recognized as a Certified B-Corp organization.

Contact us to see how we can work together.

Dec 16
0

Multi-cloud by Design, or You Fail

By | Information Security, Risk and Liability | No Comments

A scaling issue took out huge swaths of AWS last week. In the same week, the Log4j exploit required 84 updates from Amazon across dozens of their major AWS services. Every major software company has issued emergency patches and will be cleaning up the aftermath from this pervasive vulnerability for months, if not years. That is a problem, and the blame is only slightly on the Apache developers having a flaw in their software. Flaws and errors are going to happen, forever, even when DevSecOps is fully adopted. People make mistakes.

The problem here is the oversized impact of these flaws on companies that rely on AWS for critical and core aspects of their business. The weakness in most cloud strategies has been in the adoption of a single cloud platform or provider. Even when an organization uses multiple providers, their cloud hosted data and applications are not designed to fail over to another cloud, they just fail. Redundancy within a cloud system is great but a single point of failure, no matter how large or backed up, is still a single point of failure.

First, adopt new technology with a mandate to be multi- or hybrid-cloud. Demand failovers, at least for critical users and processes. If you can afford it, make sure data availability is part of that multi-cloud strategy.

Second, leadership needs to get on board and stop putting irrational constraints or mandates on the use of cloud resources and Zero Trust architecture. Yes, demand transparency, observability, and the data to support it but stop forcing your organization to use Azure because, “the CEO signed a memorandum.” Agreements like that put corporate privacy and security in jeopardy.

Third, get educated on the topics and know your options. Seek out companies that give you multi-cloud, reduce your IT costs, and at the same time, increase your Privacy and Security. Ask for responsiveness and partnership from your software vendors to understand their deployment strategy, dependencies and Software Bill of Materials.

And finally, get every last log4j instance patched across your organization. Reach out if you need us, we are here to help. https://www.replicacyber.com

___________________________________________________________________________________

Grey Market Labs is a Certified B-Corp founded with the mission to protect digital life. We build revolutionary software including Replica and hardware products, and partner with like-minded industry leaders, to create a future with “secure-environments-as-a-service”.

Contact us to see how we can work together.

Dec 08
1

Christmas Cookies

By | Data Privacy, Information Security | No Comments

Ho! Ho! Ho! It’s that time of year again, and old Saint Nick is back to deliver toys and sample tasty cookies left for him on his travels across the globe. With so many homes to visit, there are a lot of cookies waiting for him of all shapes, sizes, and flavors. Fortunately, Nicholas is impervious to viruses like Covid-19, so he has no qualms gobbling down the many treats he finds along his journey. It’s no secret to him that there have been lively debates in online forums for many years now discussing how in the world he could possibly make the journey to so many homes in just one night (and eat so many cookies). However, neither the jolly, old Saint nor his most technically savvy elves know that there have been plans brewing on the dark web to gather data to determine when and where Santa makes his deliveries.

A lively debate begins to brew in one online forum of #NorthPoleTruthSeekers.

ElfSlayer1225: NORAD’s Santa Tracker is a hoax perpetrated by the Big Toy Industry

Frosty☃Fanatic: How can you be sure? Surely if NORAD can detect ballistic missiles, it has the capability to track flying reindeer pulling a sleigh through the skies!

Anonymous: There has to be a way to figure this out

Frosty☃Fanatic: Well, how could we possibly even find this so-called Santa if he could be anywhere in the world at any time on Christmas Eve? It’s like Heisenberg’s uncertainty principle; the moment you try to determine where he is, you don’t know when he is, or vice-versa. I dunno, the whole thing makes my head spin.

ElfOnShelf 🧝🏽: I’ve been following this forum for a while now but never felt a need to contribute given all the half-baked conspiracy theories folks like ElfSlayer1225 love to espouse

ElfSlayer1225: 😠 Great, we’ve got a troll on here. The truth is out there, you’ll see! Say that again and I’ll rip you off that shelf 🗡️ elfie!!

ElfOnShelf: 🧝🏽: Look, no offense, I’ve actually got an idea and I need everyone’s help.

Dasher16: Ohh, not a reindeer trap, I hope

ElfOnShelf 🧝🏽: No of course not… no animals will be injured in this experiment

ElfOnShelf 🧝🏽: Here’s what I propose. I’ve actually been tinkering with this for a while. You know how Santa loves those cookies sitting out for him every year. He scarfs them all down at every house he delivers presents. How he does it, I have no idea. And somehow he deactivates any cameras or recording equipment so we never see it happen nor can we pinpoint the time of his arrival. Trust me, I’ve tried. I’m not called ElfOnShelf for nothing!

Frosty☃Fanatic: Haha, so how can we help?

ElfOnShelf 🧝🏽: Ok, so do you know how tracking cookies work in a web browser because my idea kind of goes something like that? When you go to visit a website, it will store information on your computer called cookies which allow it to basically identify you on subsequent visits and monitor your behavior over time. There are many other advanced methods of attribution as well but I digress. Now only the site you’re visiting can see that cookie data when you go to it, but sometimes these sites also use 3rd party services like Google and Facebook to track your behavior on their site. And since most sites use these trackers, those 3rd party services can then see the flow of your traffic across many pages on the web and begin to build a map of where you’ve been and when…

Dasher16: I think I see where you’re going here, we’re going to follow the reindeer droppings so to speak 💩

Frosty☃Fanatic: Or the cookie crumbs, hehe

ElfOnShelf 🧝🏽: errr, yeah something like that…. Anyway, imagine now that instead of browser cookies we put real trackers in the cookies left for Santa! I’ve found a programmable nanochip that can be exposed to liquids and extreme temperatures. Perfect for baking into your favorite cookie recipe. Before you know it, Santa will be loaded with them. They’re super cheap and all you have to do is order them from this site and then download my open-source code to program them with you’re unique location data. Once swallowed the nanochips will record the time and voila, we have the information we need!

ElfSlayer1225: Alright, maybe you’re on to something here but you’re missing something too. How are you going to actually get the data off the chips?

ElfOnShelf 🧝🏽: good question, so unlike when a person visits a website, we can’t just record the visit on our server. We need a way to read the chips. Fortunately, the chips work on a short-range Bluetooth connection. And since we know that Santa will visit every home to deliver presents, then each time he visits a home and he has some trackers in his belly, we can scan the chips and get a status on each place he visited and when. Plus! We’ll get the data of when the scan took place to cross-reference it against the other data. So, each one of you will also need to turn on Bluetooth on your mobile or computer and run my other open-source software that will scan and aggregate that data to this forum in real-time so we can see the results. With this we can compare to NORAD’s data and see if NORAD really is a hoax!

ElfSlayer1225: NORAD is a hoax! Send me one of those chips ASAP, can’t wait to prove it! So, what are you going to do with the data once you have it?

ElfOnShelf 🧝🏽: Sell it to BIG Toy! Cha-ching! 💰

And thus, the commercialization of Christmas was finally complete thanks to the always watching eye of an elf on a shelf and a little help from the North Pole Truth Seekers. For the price of accepting a few “harmless” cookies Santa had unwittingly sold himself out. ElfOnShelf sold Santa’s secrets to the highest paying data brokers and lived happily ever after with a private island in the Caribbean.

___________________________________________________________________________________

Grey Market Labs is a Certified B-Corp founded with the mission to protect digital life. We build revolutionary software including Replica and hardware products, and partner with like-minded industry leaders, to create a future with “secure-environments-as-a-service”.

Contact us to see how we can work together.

May 17
1

Ransomware Attacks from Critical Infrastructure to Police Departments

By | Data Protection, Information Security, Risk and Liability | No Comments

Ransomware attacks have been growing over the past three years and in just the past 2 weeks have shown how public these attacks have become.  The first attack on Washington DC (Metropolitan) Police resulted in a massive leak of internal information because they did not meet the blackmail demands1.  The second major attack was on the Colonial Pipeline, which shut down the pipeline, resulting in fuel shortages up and down the East Coast.  The Colonial Pipeline operators decided to pay the ransom of 75 Bitcoin or nearly $5 million USD2.  Government organizations can’t pay ransom per longstanding practices, but commercial groups decide to pay or not based almost purely on cost and impact to their bottom line. The latter could encourage more ransomware attacks since they are so lucrative, but there is very little to guarantee that systems or data are completely “released” once ransom payments are made. We need a better way.

Ransomware can infiltrate an organization through hacking or in the ways that a computer virus might spread. Once executed, the ransomware essentially holds your data and systems hostage. It’s rather effective because rather than attempting to steal all your data, it typically will encrypt all your data and make your systems unusable and unreadable until a ransom is paid for the decryption key.

Ransomware with the release of the Executive Order on Improving the Nation’s Cybersecurity has become a top priority of the White House. Previous attacks against police departments have resulted in cases being dropped due to the offices being locked out of their computers3.  Police departments need to protect sensitive data such as background check files by keeping them separate and ensuring that they can recover the data if they are locked out.

It’s impossible to prevent all forms of hacking. Therefore, one must also develop a strategy to mitigate the effects of an attack. As referenced in the recent Executive Order, Zero Trust is a framework that assumes you and your organization has or will be compromised is a tremendous step forward in changing how computing systems are built and how truly resilient they can be. This involves the same strategies one would implement for a disaster recovery plan, which includes taking regular backups of all the data and rebuilding the infrastructure supporting that data in a short amount of time. Isolated Secure Enclaves, provided by Grey Market Labs, are one possible solution to the problem that police departments face when trying to keep information protected, allowing sensitive forensics (e.g., exploitation reviews) to take place on modern technology and providing increased access for officers while increasing the security of all their digital work.

___________________________________________________________________________________

Grey Market Labs is a Public Benefit Corporation founded with the social mission to protect life online. We build revolutionary software and hardware products, and partner with like-minded industry leaders, to create a future with “privacy-as-a-service”.

Simply: we prevent data from being compromised and protect our customers work, online.

Contact us to see how we can work together.

Apr 27
1

Pattern-of-Life through Electricity Monitoring

By | Data Privacy, Information Security, Risk and Liability | No Comments

Household electricity monitoring provides insight into the usage of electronics in the home. Monitoring can be accomplished through commercial products (e.g. those described here https://www.bobvila.com/articles/best-home-energy-monitor) or through a utility provider’s service (such as the Duke Home Energy Report). These insights can help pinpoint which devices are wasting energy to help the homeowner save money. The analysis of electricity by these products or providers is so in-depth that they extract exact brand information on individual devices based on how much electricity that device is using and the unique electrical signature it produces

This information can also be used for Pattern-of-life analysis to expose the daily activities inside the home – which could be used for anything from targeted advertising to exploiting security weaknesses. It is important for homeowners to be aware of how this data is being used and what rights they have over it in order to make informed decisions when managing risk and participating in politics.

#GREYdient Score: 3/10

___________________________________________________________________________________

Grey Market Labs is a Public Benefit Corporation founded with the social mission to protect life online. We build revolutionary software and hardware products, and partner with like-minded industry leaders, to create a future with “privacy-as-a-service”.

Simply: we prevent data from being compromised and protect our customers work, online.

Contact us to see how we can work together.

Dec 10
5

DNS: Still Insecure By Default

By | Data Privacy, Data Protection, Information Security | No Comments

The use of encryption on the internet has grown tremendously over the past decade; HTTPS has quickly shifted from a technology used primarily to protect e-commerce, to an industry standard for website development.[1]  Many users now know to look for the padlock in their browser’s address bar to confirm that their connection is securely established via HTTPS.  But that padlock is not telling the whole story.

Before your computer ever establishes a connection with a website, it must translate the website address into an IP address.  Your operating system typically handles this task, asking a Domain Name System (DNS) server to look up the address, much like a phonebook.   Unfortunately, the DNS system has changed relatively little since it was originally designed for the needs of the 1980’s internet, when there was little consideration for security or privacy.

Even now, most devices by default will pass these queries to the DNS server configured by the network operator or ISP that you are connected to – and in nonencrypted plain text!   While DNS queries do not expose the content of your internet activity, they do expose which sites you connect to, and when.  Anyone eavesdropping on DNS traffic can ascertain someone’s general browsing history, learn a lot about the device they are using, and the patterns of how they use it.  There is also a potential to block or change DNS records, preventing access to certain web addresses or redirecting your browser to malicious endpoints.  The collection of this data is a huge risk to privacy; earlier this year, a Thai ISP accidentally leaked an astounding 8 billion DNS records they collected about their customers’ internet usage. [2]

Luckily, the industry is starting to address these weaknesses by implementing support for newer DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) standards, both of which encrypt your DNS queries while in transit.  The latest versions of macOS and iOS have added support for encrypted DNS using both protocols [3], and Microsoft is currently testing DoH support for Windows 10 [4].  Unfortunately, these solutions are not turned on by default, and they still assume ultimate trust in the DNS provider, but they are a step in the right direction when configured properly with a provider you trust.

Today, Cloudflare announced a new proposed standard: Oblivious DoH (ODoH) [5].  This proposal takes DoH one step further, by adding a proxy between your device and the DNS server.  This approach aims to further increase privacy by hiding the identity of the request from the DNS server.  But, like any new internet protocol, it will likely be years before we see widespread adoption.

DNS is a foundational part of the internet and is critical to its security and privacy.  At Grey Market Labs, we think it is important to build solutions with security and privacy by design, and we hope to see the industry do the same with DNS.

____________________________________________________________________________________

Grey Market Labs is a Public Benefit Corporation founded with the social mission to protect life online. We build revolutionary software and hardware products, and partner with like-minded industry leaders, to create a future with “privacy-as-a-service”.

Simply: we prevent data from being compromised and protect our customers work, online.

Contact us to see how we can work together.

 

 

Nov 04
4

The New Dirty Word: Default

By | Data Privacy, Information Security | No Comments

It’s 10PM and you’re ending your day but hackers are just getting started. Maybe a cup of brute-force strength hacking techniques to start their day? Before you drift to sleep, you can’t help but start thinking about that new corporate application you installed today. Did you configure everything correctly with the right passwords, settings, and certificates? You can check tomorrow but business doesn’t stop and with employees working from home, “business hours” are a thing of the past. Besides, everything you tested worked great and did what it was supposed to do so you know things will probably work fine. And they do for months… until something strange starts happening and you see that new competitors are taking your business by selling a product that looks eerily similar to yours. How could they have copied it so well? You suspect that you may have a mole in your organization and so you begin analyzing the network traffic of all your employees. But what you end up seeing is something unexpected, outside traffic not tied to any of your users is coming in and stealing your internal corporate data. How is this happening? After much investigation and discussions with the provider of the application, you discover that there were default settings you had to change and you are told it’s your fault for not changing them.

It was recently reported by Hacker News that over 200,000 businesses were susceptible to being hacked because of not changing a default setting in Fortigate VPN.  Customers have been told that it’s unfortunate they didn’t follow instructions but nothing is going to change.  “For its part, Fortinet said it has no plans to address the issue, suggesting that users can manually replace the default certificate and ensure the connections are safe from MitM attacks.”  I don’t know about you but if I have 200,000 clients buying a VPN that can be hacked because my clients aren’t aware of what they need to configure, then something needs to change. “‘The Fortigate issue is only an example of the current issues with security for the small-medium businesses, especially during the epidemic work-from-home routine,’ Hertz and Tashimov noted.  ‘These types of businesses require near enterprise grade security these days, but do not have the resources and expertise to maintain enterprise security systems. Smaller businesses require leaner, seamless, easy-to-use security products that may be less flexible, but provide much better basic security.’”

This is akin to the early days of home Wi-Fi where every router was public and not password protected. A common tactic of wardriving forced the consumer router industry to wake up and make their routers private and put default random passwords on the box like happypuppy632.  Perhaps this bad publicity will force a change to the default behavior for Fortigate VPN but that remains to be seen. For liability, Fortinet may publicly be pushing a hard line but perhaps changes will be quietly made in future releases. It defeats the purpose of an application explicitly designed for privacy to be insecure out of the box when so many will just plug it in and start using it while unaware of the dangers.

 

At Grey Market Labs we believe you shouldn’t need a computer science degree to be safe online. That’s why our solutions are built with Security and Privacy by Design, striving toward our mission to protect life online. Our products accelerate your business and work online and in the cloud, making you more productive and ensuring privacy and security especially with in a world of remote work.

Simply: we prevent data from being compromised and protect our customers work, online.

Contact us to see how we can work together.

Apr 15
3

Security Considerations for Enterprise Remote Access

By | Data Privacy, Data Protection, Information Security | No Comments

Remote-access technologies are top-of-mind for most IT professionals now, and remote work is a trend which is likely here to stay for the long term. If you’re looking to update your organization’s security policy, NIST has recently published an excellent bulletin outlining some of the unique security challenges posed by remote work.

NIST categorizes remote-access technologies into four main categories: Tunneling, Portals, Direct Application Access, and Remote Desktop Access.  With the rise of BYOD (bring your own device) policies and cloud-based applications, it has become common for organizations to employ multiple solutions for remote access, each with their own unique security considerations.   Regardless of which remote-access technologies your organization is using, it is important to continually ensure each is being used in a way that protects data from compromise.

The NIST bulletin highlights a few important points:

  • Organizations should assume that devices used for remote work will be compromised. Make sure that sensitive data is encrypted, or better yet, implement solutions that don’t store any sensitive data on client devices.
  • Devices used in external environments are under greater risk for compromise than devices in enterprise environments, so tighter security controls are advisable. Security controls can also vary widely by device, so you may need to give more specific security guidance for BYOD devices used for remote work.
  • Each additional form of remote access that is exposed increases the risk of compromise. This can be mitigated by implementing tiers of access for different client devices, and by situating remote access servers so they serve as a single point of entry.

Grey Market Labs is a Public Benefit Corporation with the mission to “protect life online”. Our Advisory services can help you navigate the conflicting and overwhelming enterprise privacy and data protection guidance. Our products provide cost-effective and comprehensive privacy-as-a-service, delivering proactive internet protection for remote work and distributed teams. Simply: we prevent data from being compromised, establish trust between users and protect our customers work, online. CONTACT US to see how we can solve some hard problems together.

Oct 18
3

Cyber Liability Insurance: Part of a comprehensive security plan

By | Data Privacy, Information Security, Risk and Liability | No Comments

It seems like every day there is a new story about a data breach and how millions of sensitive user records have been exposed.  The financial and healthcare industries are two of the biggest targets with some of the most sensitive data about people’s daily lives.  Theft and exposure of this data can open up these institutions to huge financial losses in the form of lawsuits and lost business.  Companies need ways to prevent and mitigate these potential losses.  Well-designed security protocols and software can prevent many of the data breaches that happen daily.  There will always be some risk of a breach but the use of best practices and strong security software reduces the number of attack vectors and thus significantly diminishes the risk.

Knowing that there always remains the risk of a breach, the question every company should be asking is: Should Your Business Get Cyber Liability Insurance?  As the CEO of LowCards.com (a free consumer resource website covering the credit card industry) points out, “many businesses are now turning to cyber liability insurance to minimize their risk of loss.”  Bill Hardekopf provides a great 101 on Cyber Liability Insurance and why you should consider it.  An important takeaway from the article is that “The insurance provider will evaluate policies, software and hardware to check for potential areas of weakness.”  The provider may even set a minimum standard for obtaining insurance or charge higher premiums for companies with weaker practices and software. Even if the standards aren’t there today, they will be emerging, and they will begin to affect rates and overall liability of a data compromise or a breach.

A good analogy to cyber liability insurance is property insurance, something every business should have.  Basic safety measures like fire extinguishers and smoke detectors are often minimum standards for even obtaining property insurance.  More advanced features like a security alarm system result in discounts on the premium paid for insurance.  In the same way with cyber liability insurance, installing anti-virus software or an advanced counter-exploitation platform could be considered a minimum standard or result in reduced premiums.

Given the importance of preventing a data breach most companies already implement counter measures.  However, given the likelihood a business will be the target of a successful data breach, companies should also consider adding cyber liability insurance.   Having a comprehensive plan for prevention and mitigation will help a company weather any storm that confronts them.

 

 

Grey Market Labs is a Public Benefit Corporation founded with the social mission to protect life online for people and organizations. Our software and hardware products are creating a future with privacy-as-a-service, delivering proactive internet protection from the moment of access to countering exploitation of digital behavior and activity. Simply: we prevent data from being compromised, establish trust between users and protect our customers work, online

Contact us to see how we can work together.