Cloud Access Management Moving to the cloud has countless advantages, from fostering collaboration to allowing employees to work from almost anywhere in the world. The importance of this flexibility was on display when the global COVID-19 pandemic hit. But switching to a cloud-based service can carry a fair amount of risk — oftentimes due to human error. Wyze Labs, a company that specializes in low-cost smart home products, experienced this first hand. An almost-prolific breach occurred at the startup when an employee built a database for user analytics, only to accidentally remove the necessary security protocols. As a result, a database-worth of customers’ personal information was exposed. What you need to know: Managing permissions for your organization has become increasingly important in order to avoid a cloud-based breach. Lax or nonexistent security — and in this case, incorrectly configured security controls — can easily jeopardize the security of your data, exposing your ...
Supply Chain Attack The SolarWinds attacks, which some experts have called the worst series of cybersecurity attacks in history, are a prime example of the damage a supply chain attack can inflict. In 2020, sophisticated attackers believed to have been directed by the Russian intelligence service, compromised SolarWinds software. They embedded it with malware that was then deployed through a product update, giving them backdoor access to all of SolarWinds Orion Platform customers’ networks. Up to 18,000 customers installed updates that left them vulnerable to hackers, including Fortune 500 companies and multiple agencies in the U.S. government. As Tim Brown, vice president of security at SolarWinds, said recently, “it’s really your worst nightmare.” What you need to know: A supply chain attack is a powerful cyberattack that can breach even the most sophisticated security defenses through legitimate thirdparty vendors. Because vendors need access to sensitive data in order to...
Web Session Cookie Theft Almost every web application we use, from social media and streaming platforms to cloud services and financial applications, runs on authentication cookies. Though cookies make our experience on the web much more convenient, they also create a vulnerability that can be abused to great effect. In late 2019, a group of loosely connected hackers made a name for themselves by executing cookie theft malware to hijack various YouTube channels, then luring unsuspecting owners with bogus offers to broadcast cryptocurrency scams or sell the accounts to the highest bidder. What you need to know: When an attacker successfully steals a session cookie, they can perform any actions the original user is authorized to take. A danger for organizations is that cookies can be used to identify authenticated users in single sign-on systems, potentially giving the attacker access to all of the web applications the victim can use, like financial systems, customer records o...
Comments
Post a Comment