classic | mobile
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn
 

Search...
Hi-Tech Security Solutions Business Directory
Residential Estate Security Handbook 2018


The risks of social media
November 2018, Cyber Security

Even for companies that have robust IT security solutions in place, protecting networks and data is growing increasingly complex as security gaps emerge where they are least expected. With the emphasis on technology to protect data assets from threats from the outside, internal threats – such as a company’s employees – are often overlooked.

“Employees, their social media profiles and the devices they use to access a company’s network and resources provide a plethora of gateways into the infrastructure for cyber criminals. Organisations should take care to not focus purely on traditional defences. Attackers will quickly change their strategy from trying to bypass a strong perimeter defence to attacking the human element,” says Charl Ueckermann, CEO at AVeS Cyber Security.

AVeS recently conducted a vulnerability assessment as well as internal and external penetration tests for a large mining company. The company has 5500 users on its system, with 1281 of them using company-associated LinkedIn profiles. This equates to 23% of employees on LinkedIn. The company’s IT security status appeared to be excellent, with a few vulnerabilities detected, until AVeS Cyber Security suggested a simulated social engineering attack.

Open information on social media

With just a week of researching employees’ LinkedIn profiles and gathering information about them using publicly available resources on the Internet, AVeS Cyber Security’s team was able to identify employees that would be suitable targets for the social engineering project. Social engineering is the process of deceiving people into giving away access to protected systems and confidential information. Attackers use a variety of means to con their targets into giving away sensitive data or personal details, with phishing emails and social media monitoring being amongst the most commonly used. It is a formidable threat to even the most secure networks.

“We were able to get their contact details, designations and other relevant business information. This allowed us to contact them under the guise of being from internal IT support and request that they conduct an update on their computer. This way, we were easily able to convince a number of employees to install unauthorised and dubious software on their systems. None of them questioned the legitimacy of the request to install software from an Internet site that did not form part of the organisation’s approved IT landscape.

“This gave us full access to the computers, including private and sensitive data, without the user knowing that their system had been compromised. We were also able to crack into a machine that was part of a local admin group, and through this account, we were able to get access to almost all of the computers in the company’s network.”

In a real-life attack scenario, this is a breach of data – where information that is sensitive, protected, valuable or confidential is copied, transferred, viewed or taken by a person who is not authorised to do so. Data breaches can include financial data where your credit card details, personal information, trade secrets, customer information, and intellectual property is used by someone else. The loss of sensitive or confidential data can result in financial losses, penalties and reputational damage. Data breaches that results in identity theft or a violation of government or industry compliance regulations can cause a business to face fines or other civil or criminal prosecutions.

“The defence against social engineering should have multiple layers of protection so that if an attacker is able to penetrate one level, such as an individual user’s computer, they would be stopped at the next level. Remember that a social engineering predator will keep searching for a weak spot until they find one. That is why it is so important for the network to have several layers of protection to fight back, and at the very least be able to recognise when it is under attack.”

The importance of education

He stresses that employee education should be part of every organisation’s IT security strategy given that social engineering is not a technology shortfall but rather a human one. When people are properly educated about the dangers of giving away personal details, clicking on unsafe links, responding to strange requests for information, downloading unsafe applications or posting too much information on social media, they are less inclined to do so.

“Importantly, employees must understand the risks of social engineering. Good training and procedures can help reduce the risk of accidental data loss. They also need to understand the value of data to the business. A loss of critical data or intellectual property can have severe consequences,” says Ueckermann.

Ueckermann concludes with some advice for companies and their employees to take heed of:

• Don’t publish confidential company information on social media.

• Don’t take pictures of your desk and post it online. A picture tells a thousand words (i.e. an attacker can see what type of computer you are using and where you are based with geo-tagging, even if no confidential company information is visible in the picture).

• Do not accept social media requests from people that you do not know. Your social media contacts/connections have access to your connections. This means that they can view your detailed profile and career history, among other information.

• Never action requests to conduct updates on your system, even if the caller or emailer seems legit. If they claim to be from IT support, tell them you will call them back on their extension.

• Never install or update programmes from public facing websites, even if someone posing as IT support asks you to do so. Only download updates from your computer when prompted by the specific application’s update centre (i.e. Adobe, Microsoft, etc.).

• Never switch off vulnerability scanning on your computer. These scans, which run through endpoint security software, are crucial.

• Do weekly vulnerability scans on your computer at work and home.

• Never click on links in emails if you don’t trust the sender or the link’s destination. These could be phishing emails that put your device and information at risk. Scroll over the link to see if it is the correct URL.

• Do not save your passwords in an unencrypted format. Use a password manager to create and save passwords on your behalf – then you can easily change your passwords every three months.


Credit(s)
  Share via Twitter   Share via LinkedIn      

Further reading:

  • Managing who, what and why
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security
    Today’s access control isn’t only concerned with who has access, but also what has access, why they need it and what they are doing with it.
  • Physical/logical convergence
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Integrated Solutions, IT infrastructure
    The convergence between physical and logical (or cyber) security will be a game-changer because it will change the way we do everything, from planning to design and all the way to installation and maintenance.
  • Using tomorrow’s tools to solve ­today’s security problems
    November 2018, Access Control & Identity Management, Cyber Security, Integrated Solutions
    It is the companies that are already investing in tomorrow’s tools to solve today’s problems that will survive the ongoing onslaught to circumvent security solutions.
  • NEC XON talks Industry 4.0 and disruption
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Integrated Solutions, Conferences & Events, Training & Education
    NEC XON held its seventh annual summit at Sun City in October this year in which it focused on the Fourth Industrial Revolution (IR4) and how it would disrupt the status quo.
  • Our dependence on cyber-connectivity
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Government and Parastatal (Industry)
    The health, safety, security, economic well-being of citizens, effective functioning of government and perhaps even the survival of the industrialised world relies heavily upon interconnected critical systems.
  • How close has video analytics grown to AI?
    November 2018, Technews Publishing, CCTV, Surveillance & Remote Monitoring, Cyber Security, Integrated Solutions
    Hi-Tech Security Solutions asks how far artificial intelligence has changed the video analytics market and how it will make an impact in future.
  • Digital forensics is crucial to the security chain
    November 2018, Cyber Security
    Forensics involves the application of forensic tools to recover, scrutinise and analyse masses of data and logs to uncover what has happened.
  • The need for resilience in national infrastructure
    November 2018, Government and Parastatal (Industry), Cyber Security, Security Services & Risk Management
    The industries and infrastructure on which so much of our daily lives depend are deep in the midst of mass digitisation.
  • Protecting constantly connected users
    November 2018, Products, Cyber Security
    The latest versions of ESET security products offer multi-layered protection, enhanced IoT protection, product referral and a new security report feature.
  • Blockchain explained
    November 2018, IT infrastructure, Cyber Security
    Blockchain: What is it, how it works and how it is being used in the market? A closer look at the technology that is rapidly growing in popularity.
  • J2 launches Home Secure
    November 2018, J2 Software, News, Cyber Security
    J2 Software has announced the launch of J2 Home Secure, aimed at protecting home/personal users from online fraud and cyber threats.
  • Protect your money this festive season
    November 2018, Cyber Security, News
    The South African Banking Risk Information Centre (SABRIC), on behalf of the banking industry, would like to make the public aware of how they can protect their money this festive season and shared the following modus operandi to enable greater awareness.

 
 
         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual
         
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.