Defendify

defendify

People have been hacking devices forever. But humans have been hacking each other for even longer. From phone phreaking to ransomware, most technical exploitations are quickly discovered and interdicted. Your employees might be your company’s greatest strength, but they are also your network’s greatest vulnerability. What is Social Engineering? The perpetrator of a social engineering scam is an expert in human nature, using it to coax a target into revealing sensitive information. They might accomplish this through promises of friendship or romance or by misrepresenting themselves as someone with legitimate access to the information in question. That information could be anything from network protocols to your employees’ personally identifying information (PII) and, of course, passwords. As technical network security has become more robust, many of the latest hacks rely on at least one element of social engineering, which has long been a feature of telemarketing scams, especially those targeting the elderly. Employees may provide information to someone who successfully misrepresents themselves as a senior manager or IT department employee, a practice known as blagging. And not just companies are vulnerable to this kind of attack– so are the most secret government institutions, as demonstrated by the blagging-enabled hacking of a British intelligence officer’s laptop in 2012. The Facts and Figures One popular statistic floating around the Internet is that social engineering is responsible for 98% of cyberattacks. I wasn’t able to independently verify this “fact,” but anecdotally, social engineering is responsible for enabling an outsized number of attacks. It’s also one of the network protection techniques that employees receive the least amount of training on. In fact, Bitdefender, a network security company, found that the majority of employees receive no social engineering awareness training, which undoubtedly contributes to the continued prevalence of network penetrations. Why Social Engineering Works Social engineering works because we are victims of our own desires to be liked, respected and viewed as competent. Playing on these aspects of human nature enables a scammer to engineer risky behavior even when a network member knows they are doing something wrong. Added to that, we, as humans, consistently overestimate our ability to spot liars. The actual chance of us being able to correctly deduce if someone is lying is only about 50%-- the same probability that a flipped coin will land heads or tails, according to the American Psychological Association. What Should Companies Do? Network owners must prioritize including social engineering awareness in network security programs. That training should be conducted at least monthly, according to Defendify, which provides such training. When hiring network security trainers, companies should seek those that include regular social engineering awareness in their programs. For companies that develop their own training, social engineering should represent a key pillar with ongoing refreshers to reinforce the importance of not falling victim to social engineering techniques. People have been hacking devices forever. But humans have been hacking each other for even longer. People have been hacking devices forever. But humans have been hacking each other for even longer. From phone phreaking to ransomware, most technical exploitations are quickly discovered and interdicted. phreaking phreaking Your employees might be your company’s greatest strength, but they are also your network’s greatest vulnerability. What is Social Engineering? The perpetrator of a social engineering scam is an expert in human nature, using it to coax a target into revealing sensitive information. They might accomplish this through promises of friendship or romance or by misrepresenting themselves as someone with legitimate access to the information in question. That information could be anything from network protocols to your employees’ personally identifying information (PII) and, of course, passwords. As technical network security has become more robust, many of the latest hacks rely on at least one element of social engineering, which has long been a feature of telemarketing scams, especially those targeting the elderly . targeting the elderly targeting the elderly Employees may provide information to someone who successfully misrepresents themselves as a senior manager or IT department employee, a practice known as blagging . And not just companies are vulnerable to this kind of attack– so are the most secret government institutions, as demonstrated by the blagging-enabled hacking of a British intelligence officer’s laptop in 2012. blagging blagging British intelligence officer’s laptop British intelligence officer’s laptop The Facts and Figures One popular statistic floating around the Internet is that social engineering is responsible for 98% of cyberattacks . I wasn’t able to independently verify this “fact,” but anecdotally, social engineering is responsible for enabling an outsized number of attacks. 98% of cyberattacks 98% of cyberattacks It’s also one of the network protection techniques that employees receive the least amount of training on. In fact, Bitdefender, a network security company, found that the majority of employees receive no social engineering awareness training, which undoubtedly contributes to the continued prevalence of network penetrations. least no social engineering awareness no social engineering awareness Why Social Engineering Works Social engineering works because we are victims of our own desires to be liked, respected and viewed as competent. Playing on these aspects of human nature enables a scammer to engineer risky behavior even when a network member knows they are doing something wrong. Added to that, we, as humans, consistently overestimate our ability to spot liars. The actual chance of us being able to correctly deduce if someone is lying is only about 50%-- the same probability that a flipped coin will land heads or tails, according to the American Psychological Association . according to the American Psychological Association according to the American Psychological Association What Should Companies Do? Network owners must prioritize including social engineering awareness in network security programs. That training should be conducted at least monthly, according to Defendify, which provides such training. When hiring network security trainers, companies should seek those that include regular social engineering awareness in their programs. For companies that develop their own training, social engineering should represent a key pillar with ongoing refreshers to reinforce the importance of not falling victim to social engineering techniques.

You Can Hack People, Too: The Art of Social Engineering

Startups of The Year 2023 Winners: North America 

If your application includes fundamental features like login, registration, password reset/recovery, resend confirmation links, and other specific functionalities requiring server requests, it's crucial to implement mechanisms against brute force attacks and the generation of a substantial load on your service. Without such mechanisms, your application may be vulnerable to various threats, including sending an excessive number of emails/OTPs to users, potentially leading to financial and reputational damage. Many lack adequate rate-limiting measures, relying solely on the limitations imposed by their business logic, such as restricting the number of requests based on a payment model. Some applications, however, do incorporate rate limits, particularly for operations like login attempts, registration, and other critical functionalities. These implementations often depend on the X-Forwarded-For header for IP address tracking. web applications To illustrate a simple example, I came up with this code snippet on Flask from flask import Flask, request, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(
    app,
    key_func=get_remote_address,
    storage_uri="memory://",)

def get_ipaddr():
    # Retrieve the client's IP address from the request
    # X-Forwarded-For header is used to handle requests behind a proxy
    ip_address = request.headers.get('X-Forwarded-For', request.remote_addr)
    return ip_address

# Rate limit to 5 requests per minute per IP
@limiter.limit("5 per minute")
@app.route('/')
def index():
    ip_address = get_ipaddr()
    return ip_address In the following sections, I'll explain various approaches to testing and attempting to bypass rate limits in your application. To efficiently test your app for this type of vulnerability, automation is a powerful tool. You can achieve this by employing scripts, such as those in Python (as I often do), or using tools like Burp Suite (btw a great tool for testers and cybersecurity professionals). Also, tools like Postman might be used to automate checks relatively easily. Testing Rate Limit Changing IP value in X-Forwarded-For header X-Originating-IP: 127.0.0.1 Use different IP values in every request you send. Use double X-Forwared-For header. X-Forwarded-For:
X-Forwarded-For: 127.0.0.1 Try the same with different headers. X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Host: 127.0.0.1
X-Forwared-Host: 127.0.0.1 Change other headers Try changing the user-agent, content-type, accept-language, etc, or cookies, anything that could be used as a user identifier. If there is a rate limit of 3 tries per IP, every three tries, change the IP value of the header (or other headers or params in your requests). Add blank chars in params Try adding to the params you send %00, %0d%0a, %0d, %0a, %09, %0C, %20 For example param1=value1%%0d%0a 
param2=value2%00 For example, if you are requesting OTP for email verification and you only have 3 tries, use the 3 tries for example@email.com
example@email.com%00
example@email.com%0d%0a
And so on Use similar endpoints If you are testing, for example,/API/v1/signup endpoint, then try to perform brute-force to /Signup, /SignUp, /sign-up. Try adding blank chars (from the above) to the original endpoints. Adding extra params to the requested API endpoint If the limit is on the requests of /api/v1/resetpassword endpoint, try brute-forcing it by adding some query params - once the rate limit is reached, try, for example, /api/v1/resetpassword?param1=value1 Logins matter It might be the case that an app has flawed logic - if you log into your account before each attempt/series of attempts, the rate limit is reset for your IP, and you can continue your password brute-force attack. If you are testing a login feature, you can do this in Burp Suit with a Pitchfork attack in the settings (or you can write your own script for this) for each attempt/series of attempts. Here is my example of how I automated a simple check for the X-Forwarded-For header just to get a POW: from random import randint
import requests
import json


url = "https://yourapp.net/api/v1/regconfirm-resend"
data = {
   "email": "yourtest@mail.com"
}

N = 100


def generate_random_ip():
   return '.'.join(
       str(randint(0, 255)) for _ in range(4)
   )


for _ in range(N):
   headers = {
       "Host": "yourapp.net",
       "Content-Type": "application/json",
       "X-Forwarded-For": generate_random_ip()
   }
   response = requests.post(url, headers=headers, data=json.dumps(data))
   print(headers)
   print(f"Status Code: {response.status_code}, Response: {response.text}") Restoring original visitor IPs A possible solution might be the use of Cloudflare and its mechanisms. A detailed explanation can be found here . I will provide only a brief overview of its defense mechanisms. restoring-original-visitor-ips If you use applications that depend on the incoming IP address of the original visitor, a Cloudflare IP address is logged by default. The original visitor IP address appears in an appended HTTP header called CF-Connecting-IP. By following our web server instructions, you can log the original visitor IP address at your origin server. If this HTTP header is not available when requests reach your origin server, check your Transform Rules and Managed Transforms configuration. If Pseudo IPv4 is set to Overwrite Headers - Cloudflare overwrites the existing Cf-Connecting-IP and X-Forwarded-For headers with a pseudo IPv4 address while preserving the real IPv6 address in CF-Connecting-IPv6 header. Remember, when implementing such a defense mechanism, perform thorough testing. This approach might be subsequently applied to the entire cluster and could adversely affect certain functions and microservices where it is unnecessary. In a nutshell, while fixing a security breach, be cautious, as it could potentially impact the entire application. Analyze which part of your system might be affected negatively and test everything before shipping changes to the prod env. NOTE: Also published . here

Defending Your Web App: A Guide to Rate Limiting and Brute Force Attack Prevention

আপনার ওয়েব অ্যাপকে রক্ষা করা: রেট লিমিটিং এবং ব্রুট ফোর্স অ্যাটাক প্রতিরোধের জন্য একটি নির্দেশিকা

Verteidigen Sie Ihre Web-App: Ein Leitfaden zur Ratenbegrenzung und zur Verhinderung von Brute-Force-Angriffen

Defendiendo su aplicación web: una guía para limitar la velocidad y prevenir ataques de fuerza bruta

Défendre votre application Web : un guide sur la limitation du débit et la prévention des attaques par force brute

अपने वेब ऐप का बचाव: दर सीमित करने और क्रूर बल के हमले की रोकथाम के लिए एक गाइड

Web アプリの防御: レート制限とブルート フォース攻撃防止のガイド

웹 앱 방어: 속도 제한 및 무차별 대입 공격 방지 가이드

Defendendo seu aplicativo da Web: um guia para limitação de taxa e prevenção de ataques de força bruta

Защита вашего веб-приложения: руководство по ограничению скорости и предотвращению атак методом перебора

Web Uygulamanızı Koruma: Hız Sınırlama ve Kaba Kuvvet Saldırısını Önleme Kılavuzu

Bảo vệ ứng dụng web của bạn: Hướng dẫn giới hạn tỷ lệ và ngăn chặn tấn công vũ phu

保护您的 Web 应用程序：速率限制和暴力攻击预防指南

Overview Digital fingerprinting is a technique used to identify users across different websites based on their unique device and browser characteristics. These characteristics - fingerprint parameters, can include various software, hardware (CPU, RAM, GPU, media devices - cameras, mics, speakers), location, time zone, IP, screen size/resolution, browser/OS languages, network, internet provider-related and other attributes. The combination of these parameters creates a unique identifier - fingerprint, that can be used to track a user's online activity. Fingerprints play a crucial role in online security, enabling services to identify and authenticate unique users. They also make it possible for users to trick such systems to stay anonymous online. However, if you can manipulate your fingerprints, you can run tens or hundreds or more different accounts to pretend that they are unique, authentic users. While this may sound cool, it has serious implications as it can make it possible to create an army of bots that can spread spam and fakes all over the internet, potentially resulting in fraudulent actions. Note: Obviously, I won’t discuss here how you can do "bad" things; you must always be careful, stay away from the “dark side,” and avoid committing illegal actions. This article is about the technology behind this, so use the information wisely. This is the first (and maybe not the last) article in this domain, so it will be more like an overview. The content offers an intro to the topic. There are dozens of tools and ways to detect, collect, and spoof fingerprints, and there are many different parameters and technologies that can reveal or hide your real identity or the fact that you're spoofing fingerprints (meaning you're not an authentic user). Parameters in Digital Fingerprints Let's consider some of them, some examples of obvious, simple, or well-known params, some that are rarer, less-know, and difficult to spoof. this string provides information about the user's browser, operating system, and device. User-Agent: it reveals the user's network and geo-location. Services use IP addresses for security and to prevent malicious activities. If you use one account from different IPs or many different accounts from the same IP, some services may view this activity (in combination with other params) as suspicious and use some level of bot protection against you. This can also be triggered if you use IPs that are already used or in some kind of banned list (proxies). IP: Information about installed plugins and extensions can be used to create a unique fingerprint - it helps in identifying users based on their browser's additional functionalities. Browser Plugins and Extensions: different users often have different display characteristics. Screen Resolution and Color Depth: they are important factors in fingerprinting - if you have random values, e.g., Japan timezone Norwegian language this is a bit unusual. Timezone and Language Settings: it involves rendering hidden graphics in the user's browser to gather information about the graphics hardware. Quite a tricky one because if you spoof your hardware info, then you can’t have the proper canvas value - you can’t render it on your different real hardware. Canvas: it exploits the unique capabilities and limitations of the user's graphics hardware in rendering 3D graphics - additional information about the user's device. WebGL Fingerprinting: the list of fonts installed on a user's system can be used as a fingerprinting parameter. This information is accessible through JavaScript. The list of fonts has to be realistic - so e.g. you can’t have Win fonts on macOS or you can’t have just 1 or 2 fonts, this is a very suspicious indicator. Fonts: it allows websites to determine the device's battery level and charging status, the combination of battery attributes can be used for fingerprinting. Battery status API: websites can use the web audio API to generate unique audio fingerprints by analyzing the audio processing characteristics of the device. Audio Fingerprinting: This information includes details about the software and hardware components of the device, such as the graphics card, network adapter, and operating system. This adds to the uniqueness of the fingerprint. Hardware Concurrency: This information includes details about the network connection, such as the IP address, ISP, and DNS server. Network Information: some users may use some software that listens to specific ports which also might be useful for some specific cases. Open and used ports: Navigating the Web incognito Digital fingerprint manipulation is a difficult task that demands a proactive approach to avoid detection. The are lots of strategies and tools to hide your identity (fingerprints) or pretend that you are someone else. Use privacy-focused browsers Opting for privacy-focused browsers, such as Brave, Ghostery, Tor, Octo Browser, or Vivaldi with enhanced privacy settings, provides a fundamental defense against common fingerprinting techniques. These browsers prioritize user privacy and incorporate features designed to hide your real fingerprints, making it harder to track your activities. For example, the Tor Browser, grounded in principles of anonymity, routes internet traffic through the Tor network. This strategic routing obscures the user's identity by bouncing connections through a series of volunteer-operated servers, enhancing overall online anonymity. Browser Extensions Privacy-centric browser extensions, including AdBlock, uBlock Origin, Privacy Badger, or CanvasBlocker, could be active defenses against tracking scripts, cookies, and fingerprinting attempts. These tools operate in the background, protecting and preserving user anonymity. VPN and Proxies The use of VPNs or proxy services adds an additional layer of protection by masking the user's real IPs (location, timezone, language, etc) and encrypting internet traffic. This is not only used to change your fingerprints but also to provide a more anonymous online presence and a higher security level. Motivations behind fingerprint spoofing Understanding the Whys Individuals concerned about personal privacy and the growing digital surveillance often spoof fingerprints to shield themselves from relentless online tracking. Privacy: Spoofing fingerprints prove useful for circumventing geo-restrictions, allowing users to access content restricted to specific regions. VPN and proxy services play a crucial role here by not only hiding the user's identity but also providing access to servers in different geographic locations. Geo-restriction: Avoiding targeted advertising and online profiling serves as a compelling motive for individuals to manipulate their digital fingerprints. Some tools can block 3rd-party tracking scripts and cookies, disrupting the profiling process. Ads: Web scraping, multi-accounting, e-commerce, bounty&airdrop, bonus-hunting, social networks bots, and affiliate marketing are often sources of income or bases for medium businesses. Digital agencies, individuals, and influencers engaged in these activities may require fingerprint spoofing to navigate through complicated bot detection systems. Avoiding detection becomes vital for some services, ensuring that legitimate activities are not mistakenly flagged or restricted (though quite often, such activities and accounts are not really legit but pretend to be so). Some of the most popular tools are Multilogin, X-Browser, Octo Browser, AdsPower, Incogniton, Scrapy, Surfsky, Web Scraper.io, ScrappingBee, etc. Strategic needs in the digital arena, bot detection, and protection systems: Collecting Users' Fingerprints Websites use JS (obviously) to harvest details about users to construct comprehensive digital portraits. This involves probing screen resolution, device orientation, mouse movements, keystroke dynamics, etc. Sophisticated fingerprinting scripts enumerate a wide range of browser and hardware attributes. JavaScript: Persistent cookies and data stored in local storage work to track users across sessions and platforms. Techniques include leveraging browser cookies and storing unique identifiers for user tracking. Depending on your purposes you need to know when you need an "empty" browser with unique fingerprints or when you need to trick a service showing that you have particular cookies and the same fingerprints. Cookies and local storage: The inclusion of 3rd-party scripts for analytics and advertising embeds invisible trackers often used to adjust systems behavior for a specific user based on collected fingerprints. You can use the aforementioned tools and approaches to selectively block or trick such scripts to get the needed behavior. 3rd-party scripts: Understanding Your Online Identity Panopticlick (EFF), Pixelscan, deviceinfo.me, and BrowserLeaks show your browser's fingerprint parameters such as User-Agent, canvas fingerprinting, fonts, etc. These checkers provide insights into the uniqueness and stability of your digital fingerprint across different browsing sessions. Online checkers: they allow users to inspect network requests, cookies, and other fingerprinting parameters, fostering a deeper understanding of their digital imprint and how websites detect bots and unique legit users and collect fingerprints. Examining the Network and Application tabs in browsers provides a real-time view of the data exchanged between the browser, websites, and servers. Browser developer tools: Here are some examples of how you can get some info about users' fingerprints in the browser. GEO: navigator.geolocation.getCurrentPosition(function(position) { var userLocation = position.coords; }); Microphone: navigator.mediaDevices.enumerateDevices() .then(function(devices) { var microphones = devices.filter(device => device.kind === 'audioinput'); }); Camera: navigator.mediaDevices.enumerateDevices() .then(function(devices) { var cameras = devices.filter(device => device.kind === 'videoinput'); }); Speakers: navigator.mediaDevices.enumerateDevices() .then(function(devices) { var speakers = devices.filter(device => device.kind === 'audiooutput'); }); Audio: var audioContext = new (window.AudioContext || window.webkitAudioContext)(); var oscillator = audioContext.createOscillator(); var analyser = audioContext.createAnalyser(); oscillator.connect(analyser); analyser.connect(audioContext.destination); GPU: var canvas = document.createElement('canvas'); var gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl'); var renderer = gl.getParameter(gl.RENDERER); console.log(renderer); Fonts: var fonts = []; var fontList = document.fonts.forEach(function(font) { fonts.push(font.family); }); console.log(fonts); Canvas (hashing): var canvas = document.createElement('canvas'); var context = canvas.getContext('2d'); var dataURL = canvas.toDataURL(); var canvasHash = MurmurHash3(dataURL); console.log(canvasHash); RAM and CPU: function getCPUInfo() { return navigator.hardwareConcurrency || 0; } function getDeviceMemory() { return navigator.deviceMemory || 0; } var cpuInfo = getCPUInfo(); var deviceMemory = getDeviceMemory(); console.log(`CPU Cores: ${cpuInfo}`); console.log(`Device Memory (GB): ${deviceMemory}`); Bot Detection Systems: Defending Against Automation A couple of examples of such systems: It is a global leader in bot detection and mitigation. It provides a proactive and precise way to verify that legitimate human users are accessing your website, mobile app, and APIs. Distil Networks uses a combination of techniques to detect bots. It studies a range of variables such as cursor movement, click patterns, and web browsing patterns across other websites. It uses , which checks all visitors against hundreds of different characteristics, focusing on their behavior. Distil Networks defends against web scraping, competitive data mining, account takeovers, transaction fraud, unauthorized vulnerability scans, spam, click fraud, denial of service, and API abuse. It can automatically block 99.9% of malicious traffic without impacting legitimate users. It also offers Distil Bot Defense for Web and API, which protect your website and API servers respectively. Distil Networks: Bot Detection: device fingerprints and Are You a Human technology It actively pulls additional data from the browser to identify devices with precision. When a browser request comes in, Distil interrogates the headers to see if the visitor is lying about their identity. This unique identifier can be used to fully or partially identify individual devices even when cookies cannot be read or stored in the browser, the client IP address is hidden, or one switches to another browser on the same device. It uses machine learning to detect biometric patterns in mouse activity and scrolling, as well as looking at browsers, devices, and other factors for clues. It can detect many simple or medium complexity bots that run JS from a web page. Resource Protection: It's a comprehensive cybersecurity platform that integrates fingerprint-based identification to discern legitimate users from potential threats. Utilizing advanced behavioral analysis and anomaly detection, Imperva builds profiles based on a combination of factors, including IP reputation, user-agent, different fingerprint params, and behavioral characteristics. This allows the system to detect suspicious activities indicative of bot traffic and mitigate potential threats effectively. Imperva: It's a prominent content delivery and cloud service provider that incorporates robust bot detection mechanisms within its security offerings. Leveraging a combination of fingerprint-based detection, behavior analysis, and machine learning, Akamai identifies and mitigates various bots. Akamai's global network allows for real-time threat intelligence, enabling proactive defense against evolving bot tactics. Akamai: It's a widely used content delivery network and security service that employs a multifaceted approach to bot detection. Cloudflare distinguishes between human users and bots by analyzing parameters such as IP reputation, user-agent characteristics, and behavioral patterns. The platform also utilizes threat intelligence and community-driven insights to stay ahead in the battle against emerging bot threats. Cloudflare uses to profile SSL/TLS clients and block potential bot requests. It also uses to apply rules and route traffic based on HTTP request information. is used to identify specific files and prevent data loss. These techniques help in detecting not real users. Cloudflare: JA3 Fingerprinting HTTP Filtering Data Fingerprinting Role of Bot Detection Systems: They play a pivotal role in enhancing bot detection capabilities. With servers strategically positioned around the globe, they can leverage geographical insights and real-time threat intelligence to identify and mitigate bot traffic effectively. The platform's WAF and bot managers contribute to a comprehensive defense against automated "users.” In this ongoing cat-and-mouse game, Bot Detection Systems continue to evolve, leveraging advanced technologies to stay ahead of fingerprint spoofing tech. The collaboration between security providers, businesses, and the wider online community remains crucial in defense against the tactics of automated threats but also, in a way, used against users' privacy, anonymity, and experience online, bringing intrusive ads and sophisticated user tracking tools that are only beneficial for businesses not for users. However, privacy protection, fingerprint hiding and spoofing, and ads and trackers blocking tools are also developing to evade even the most sophisticated user tracking systems. Websites' additional verification steps If a fingerprint appears suspicious, such as frequent changes or unusual combinations of data points, the website may trigger additional verification steps. Suspicious behavior: Websites may present users with captcha challenges to verify their identity. This involves solving puzzles or identifying distorted text, tasks that are difficult to perform for primitive bots. Captcha: Websites may request users to verify their mobile phone numbers to establish a stronger connection between a unique identity and a real-world entity. This can help prevent fraudulent activities. Mobile verification: the idea is the same as with mobile phones, but you need to submit your ID ID verification: Examples: Google doesn't require additional verification for new users with clear, consistent fingerprints. If a user's fingerprint changes frequently or resembles those used by known bots (or just already known for Google), Google may ask for a mobile phone number or ask to deal with a captcha. Financial websites often enforce stricter verification measures due to the sensitive nature of transactions. They may require users to provide additional personal information, verify their identity through secure channels, or pass more complex captcha challenges. Opinion: spoofing is better than hiding Hiding fingerprints can enhance privacy, security, and online anonymity, but spoofing them to appear as a unique, legitimate user offers even greater advantages. By blending in with the crowd and avoiding suspicion from systems that detect anti-detection tools, you can maintain credibility and trust. This approach allows you to enjoy the benefits of being perceived as a unique, legitimate user, minimizing the chance of facing additional protecting measures or obstacles. and, obviously, it helps in preventing leaking of your real data and identity. Also published . here

Intro to Digital Fingerprints: Understanding, Manipulating, and Defending Against Online Tracking

ডিজিটাল ফিঙ্গারপ্রিন্টের ভূমিকা: অনলাইন ট্র্যাকিংয়ের বিরুদ্ধে বোঝা, ম্যানিপুলেট এবং ডিফেন্ডিং

Einführung in digitale Fingerabdrücke: Online-Tracking verstehen, manipulieren und sich dagegen wehren

Introducción a las huellas digitales: comprensión, manipulación y defensa contra el seguimiento en línea

Introduction aux empreintes digitales : comprendre, manipuler et se défendre contre le suivi en ligne

डिजिटल फ़िंगरप्रिंट का परिचय: ऑनलाइन ट्रैकिंग को समझना, हेरफेर करना और उसके विरुद्ध बचाव करना

デジタル指紋の概要: オンライン追跡の理解、操作、および防御

디지털 지문 소개: 온라인 추적에 대한 이해, 조작 및 방어

Introdução às impressões digitais: compreensão, manipulação e defesa contra rastreamento on-line

Введение в цифровые отпечатки пальцев: понимание, манипулирование и защита от онлайн-слежения

Dijital Parmak İzlerine Giriş: Çevrimiçi Takibi Anlamak, Yönetmek ve Savunmak

Giới thiệu về Dấu vân tay kỹ thuật số: Hiểu, thao tác và bảo vệ chống lại việc theo dõi trực tuyến

数字指纹简介：理解、操纵和防御在线跟踪

In today's interconnected world, almost every individual has had some experience with malicious links. These can manifest in various forms through emails, text messages, social media direct messages, or other online communication channels. digital traps Malicious links are the preferred tools of cybercriminals, who use social engineering and deception to manipulate their targets into clicking on these potentially harmful URLs. These deceptive links can lead to various malicious activities, from downloading malware or ransomware onto the victim's device to directing them to counterfeit websites designed to steal personal information or money. Understanding malicious links, comprehending the damage they can inflict, and knowing how to spot them is paramount, particularly for businesses safeguarding sensitive data. Defining and Identifying Malicious Links Malicious links are like Swiss Army knives in a cybercriminal's toolkit, offering versatility in delivery and an array of potential threats. They provide an uncomplicated means of infiltrating unsuspecting individuals, as many recipients click on links without pausing to consider their origins or the potential risks involved. or a text message containing a malicious link and achieve a broad spectrum of outcomes, from stealing user credentials to monetary gain. Being vigilant and exercising caution when interacting with digital content is essential to maintaining security. Cybercriminals can send an email Recognizing a malicious link requires a discerning eye, even when it appears benign at first glance. Hovering over a link reveals its URL, enabling users to check if it's a recognized and safe destination. To reduce risks, avoiding clicking on shortened links that obscure their final destination is advisable. Analyzing the entire message can also provide crucial insights; unexpected communications, messages from unknown senders, or messages that pressurize the recipient into clicking on the link should all raise suspicions. The Impact of Malicious Links Like other forms of cyberattacks, malicious links can cause significant harm to individuals and organizations. It takes just one unsuspecting click from an employee to download malware that can infiltrate an entire network through their device. While malicious attachments are increasingly used, malicious links remain a substantial threat. The consequences of falling victim to a malicious link can range from minor inconveniences to catastrophic outcomes, depending on the link's purpose and the target's ability to mitigate the damage. Individuals who click on such links, whether acting on their own behalf or on behalf of an organization, are vulnerable to having their account credentials stolen and misused, their devices infected with malware, their data breached or stolen, financial losses, and reputational damage. For organizations without robust cybersecurity measures in place, compromising even a single device or account via a malicious link can serve as the entry point for a more extensive and damaging attack. Malicious Link Tactics The world of cybercriminals is vast and diverse, with various tactics and methods employed to exploit potential targets. of the broader category of phishing, and they can be further subdivided into various subcategories. Attackers use many tricks to entice their targets into clicking on harmful links. The ultimate aim of cybercriminals is to persuade users to click on the malicious link, which, when activated, can automatically download malware or ransomware onto the victim's device. Alternatively, the link can lead to a counterfeit website, requiring the victim to enter their credentials or provide data or money to the attacker. Malicious links represent just one facet Many of the maneuvers used by cybercriminals rely on social engineering and deception to lure the target into clicking on the malicious link. These tactics include impersonating loved ones, work supervisors, or legitimate corporate entities to instill a false sense of security and gain trust. Urgency is a common theme in their messages, often accompanied by offers that appear "too good to be true," compelling the target to click on the link without critically assessing the decision. These tactics are insidious and effective, underscoring the importance of learning to recognize them. Conclusion Malicious links are pervasive on the internet, and although many people are well-versed in identifying the typical signs of a scam or phishing email, cybercriminals continue to rely on tried-and-true social engineering methods to deceive their targets. Staying informed about the evolving landscape of these scams is vital. Additionally, understanding other , such as insider threats and data breaches, is crucial for businesses looking to protect themselves from common incidents. Awareness and vigilance in the digital realm are the keys to guarding against the hidden threat of malicious links. forms of cyber threats

Guarding Against the Hidden Threat: Recognizing and Defending Against Malicious Links

With the surge in popularity of tools and large language models, individuals now have the incredible capability to amplify the quantity and caliber of their work like never before. generative AI However, all great advancements have a dark side. The world of is not exempt from this revolution, as malicious actors can now employ AI-enabled tools to outwit organizations and capitalize on vulnerabilities on a grand scale. cybersecurity To stay ahead of emerging AI-powered threats, it’s crucial for your organization to be adequately prepared. This post outlines essential steps that you can take to safeguard against these challenges. Strengthening Your Organization’s Security Foundations Even before the popularization of AI tools, most organizations were not adequately prepared for serious cybersecurity attacks. There are dozens of reasons for this, but at its core, maintaining a strong security posture is like running on a treadmill. There are always new vulnerabilities being uncovered and exploited. Malicious actors don’t stand idle while organizations undergo changes in management, backfill team members, implement new policies, or accrue technical debt. The gap between the demand for cybersecurity jobs and the supply of experts has been . The reality is that many organizations are falling behind compared to the threats they face. It’s never been more important to build out a robust cybersecurity team and empower them to develop lasting security systems. well documented Get the Security Basics Right While the new AI technologies can accelerate how hackers attack, organizations still need to execute the basic security best practices: Is MFA enabled on critical applications? Are you using strong passwords? Do you have endpoint security and device management tools installed everywhere? Do you have firewalls and strong network security settings? Are you rotating access keys periodically? Are you following the principle of least privilege when assigning permissions? By reducing weak links and variability across your attack surface, you can ensure a maintainable baseline security posture. If you don’t have the basics solved, you’re vulnerable regardless of what technologies bad actors are using. Expand Security Education Across Teams Your security is only as strong as your weakest link. In many attacks, all it takes is one non-vigilant employee to open the door to a breach. Consistent education and training for all employees is a core component of strong security posture. Phishing attacks in particular have grown eerily convincing. It’s simple to use generative-AI tools to build webpages, write persuasive messages, and even impersonate someone’s tone with a sample of their writing. Organizations with higher cyber literacy and a culture of security awareness have the competitive advantage and are more resilient against attacks. Consider what your security training program looks like for employees across the entire company. What threats are not currently covered in your regular training? How frequently do you remind employees of social engineering attack red flags? How can you make it easier for employees to know what actions are risky? By providing security education and training, organizations can ensure their employees are better equipped to detect and report threats. A security-first company culture makes for easier and faster responses to severe threats from the security team. Monitor Attack Surfaces and Manage Alerts It’s critical to equip your organization with the proper tools to monitor for malicious activity and malware. Now is the time to consider every possible attack surface: company and personal devices, email inboxes, networks, exposed digital resources, APIs, SaaS applications, and even corporate offices. Do you have tools or processes that monitor your organization’s status in each area and notify you of any suspicious activity? Many organizations have a dedicated Security Operations Center (SOC) that receives alerts from various security tools, prioritizes which alerts are serious threats, and investigates to determine whether they are critical, contained, or false positives. If you are in a large organization with a large attack surface, you could see thousands of alerts every day. Some of these alerts are native to the tools you use. For example, will notify you about suspicious login attempts and will notify you if malware is detected on a device. If you have custom rules and policies your team has set using a cloud security or security automation platform, you would receive alerts from events that meet that criteria. Okta CrowdStrike Triaging security alerts at scale is a discipline that requires your team to iterate constantly. They must prioritize which alerts require thorough investigation, which alerts should be resolved with automated workflows, and what policies can be implemented and enforced to minimize common low-level alerts.\ If you don’t have an efficient way of fielding alerts, your team will end up with alert fatigue, burn out faster, and struggle to make the most out of their time. Launch Proactive Security Automation at Scale So far, we’ve walked through some fundamentals to invest in a security team, implement basic security best practices, create a culture of security awareness, and monitor for malicious activity across your organization. If your team is already at this stage, then you are in good shape to face the security threats of… 2015? The security landscape changes constantly. The shift to cloud computing, SaaS applications, and a new generation of monitoring tools has added significant complexity for security and IT teams to manage. Streamline Communication Workflows Across Your Organization Maintaining a strong security posture in 2023 requires coordination across multiple teams. Large organizations have teams designated for specific security use cases: Security Operations Center (SOC) Identity and Access Management (IAM) Governance Risk and Compliance (GRC) IT/ SaaS Security Cloud Security To create streamlined communication and amplify the impact of your security team, you need automated workflows to connect your tools to your people in a seamless way. For example, when Okta sends out an , does your team need to manually read the alert, draft an email or message, send it to the employee to verify that they were the person trying to log in, and resolve the alert if it’s a false alarm? alert for a suspicious login Handling tasks like this manually has a serious opportunity cost when you could be spending that time proactively improving your security posture. Enforce Security Best Practices with Modern Automation at Scale While fielding alerts in a sophisticated way is important, taking steps to implement security best practices as enforced policies can reduce the overall volume of alerts. For example, once you set an automated policy that checks whether a new AWS S3 bucket is publicly-accessible, you can catch poor security configurations upfront and notify the AWS user that launched it that they need to change the settings. Without the automation in place to run this check, you only avoid public-accessible buckets by routinely querying across your AWS account and manually following up with users and updating settings. The context-switching required for this makes it impractical, especially considering how many different AWS resources could have insufficient security settings. In this framing, consider how easy it is for your team to create automated workflows. Does it require scripting or submitting a request to a security analyst? Your team’s ability to create automated workflows (whether it’s to handle alerts, enforce policies, or streamline communication) is the exponential lever on the impact of your daily work. Security automation previously required scripting, then came low-code tools that enable you to drag-and-drop actions into a canvas and build custom automation across tools faster than ever. And now, there’s another seismic shift. Incorporate AI Capabilities into Your Security Systems “When a new S3 bucket is created, check if it is publicly accessible. If it is public-accessible, notify the AWS user that they need to update the settings to block public access.” This is a security workflow in two sentences. How powerful can a couple of lines be? Much more powerful than you’d think. Introducing generative AI into the security automation equation means now all you need is a prompt to generate an automated workflow. In other words, it’s never been easier to turn security best practices into active security policies for your organization. This comes at a critical time since malicious actors are also adopting AI technology to formulate new attacks and extract more damage. next generation of security automation If you have brittle or legacy security infrastructure, you may be prepared for the types of attacks we’ve seen in recent years, but you may not be able to adapt to the new types of attacks that we haven’t seen yet. Fundamentally, security teams will need to embrace AI-powered tools to gather information faster, enforce new security policies at scale, and interact with targeted employees in-real time to validate their identity and obtain additional context.

Defending Your Organization Against AI-Powered Hackers

Defendiendo su organización contra piratas informáticos impulsados por IA

Défendre votre organisation contre les pirates utilisant l'IA

एआई-संचालित हैकरों के विरुद्ध अपने संगठन का बचाव करना

AI を利用したハッカーから組織を守る

Defendendo sua organização contra hackers com tecnologia de IA

Bảo vệ tổ chức của bạn chống lại tin tặc do AI cung cấp

保护您的组织免受人工智能黑客的攻击

In today’s episode of the Brains Byte Back podcast, we speak with , Founder & CMO at , a company offering web app security, WAF and SSL Certificates to keep businesses safe. Venkatesh Sundar Indusface In the conversation, Sundar shares tips to help listeners defend their businesses from . He starts off by stressing the importance of ensuring that all software and systems are kept up to date with the latest security patches and updates. Doing this can help to shut down any known vulnerabilities that hackers may look to exploit. hackers Additionally, he underlines that it’s important to make use of strong access controls and authentication measures to allow only trusted users access to sensitive data or systems. This consists of measures such as two-factor authentication, strong password policies, and limiting access to only those who require it. Sundar adds that regular security assessments and penetration testing can be effective when it comes to identifying vulnerabilities before hackers can take advantage of them. This can entail simulating real-world attacks and attempting to exploit weaknesses in the system, to find potential areas where improvement is necessary. Alongside the above, Sundar highlights specific tactics that listeners can use to defend against ransomware attacks, such as ensuring that data backups are regularly performed and stored securely. This can help to reduce the impact of a ransomware attack by allowing businesses to restore their systems and data from a previous backup. And finally, Sundar covers why it is important to teach those within your organization about the danger of phishing attacks and other social engineering tactics that hackers frequently use to gain access to sensitive data or systems. He encourages business owners to provide regular awareness training to make sure that employees are more knowledgeable and fully aware of the latest threats and how to avoid falling victim to them. security Watch the Video https://youtu.be/Q-zGfmaYRcQ?embedable=true Venkatesh Sundar: Okay. So, I am Venkatesh Sundar, the founder of Indusface. I was the founding CTO who wrote the first line of code and built the minimum viable product, which gave us the right to win and get the first set of customers. I was the first presales engineer in the deployment of the first few set of customers. Venkatesh Sundar:  As we evolved and the product market fit was established and we had large enterprises, banks, insurance, manufacturing, and large manufacturing, adopt our product and use it for securing their Web API, and mobile apps. And as we scale, I was able to get better people than me to solve the scale problem and take on a marketing, digital marketing role to build, what we have built with our success closer to our home base in Asia. And India, I took on a marketing role to see how I bring the message out to the international market. So an accidental marketer from a technologist and then that problem again the day zero problem of marketing to get international customers were solved. Venkatesh Sundar:  And we are at a point where we have 100 plus customers in the US, we have 5,000 plus customers globally, including the freemium versions 1500 plus customers, using the freemium version. But the paying customers, large enterprises, a big market segment in the US, is also 100 plus and building on that. I’m now taking the third day zero problem to build on the enterprise US business as a president of America’s, so now in the process of moving from here to the US Right now, I travel quite a bit but yeah, replicate our enterprise success here. Build on the mid-market success that we acquired digitally from internationally and now focusing on the US market to build the pre-sales sales business development, customer success in the US Enterprise Market. So that’s my long answer. I can keep talking about this but yeah, we have established product market fit at every stage proven, the product at every market, and then building on scale, on top of it. And in a nutshell, I Think I would define myself as solving the day zero problem. I mean, startup by different day zero but you break it down into many d0 problems. As we scale up. Then the day zero problem, I’ve tried to find somebody better than me to scale it up and then I try to move on to do something else. Samuel Brake Guia: Fantastic. Well, congratulations on all this growth. You’ve seen and I was really curious about how the company started and you gave quite a good summary there. But I’d like to know how did you come up with the name Indusface, what’s the story behind that? Venkatesh Sundar: Yeah the story is more related to a roots. We’ll I mean I’m obviously living in India and my origins in India and India has gone through different transformations, different stages, especially in technology, India ended up becoming the go-to place for services, outsourcing software development, those kinds of stuff, but the product innovation from India was still lacking when we started this. So, I think it is more an emotional type to route. We wanted to be the face of India. And India’s roots are in India’s civilization. For a product made in India, that goes internationally, right? And in this day and age of global globalization, they have a right product, anybody in the world anywhere can buy it, but we want to have the footprint of the roots and the founders. Venkatesh Sundar:  Also, tied to our team. So Indus civilization represents the ancient civilization, which had phenomenal, innovation progress, two thousand of years back. We want to do that now in the New Age, era of information technology, In cyber security, which is where, which is my domain, and that’s about it, so nothing, very exciting. But yeah, that’s probably more an emotional founder’s emotion attached to it. Samuel Brake Guia: I’d say that’s very exciting, that’s cool. I did not know that. I’m always so curious to know what the story is behind a company’s name because I always find it so important. And that you usually find actually that’s quite an interesting story. And I like the fact that this is a fusion of different words. So, that is really cool. And you mentioned there about cybersecurity and last year, you folks publish an article, to keep your business prepared for It hacking season and obviously as you mentioned in the article 89% of organizations, reportedly experience holiday ransomware attacks. But as we know these attacks can happen at any time of year. So what advice do you have for listeners to best defend their businesses from hackers? Venkatesh Sundar:  So I mean ransomware is not an attack. Ransomware is an outcome of an attack where somebody’s data is held for ransom, and during holiday seasons, people are most vulnerable, they are looking for shopping and users are looking for deals. Businesses are trying to come out with new promotions and speeds of more importance to get those promotions in their applications out. And in that process, there might be many vulnerabilities, that leaves them open, which is what gives an open playground for hackers. So it happens during holiday season. Venkatesh Sundar:  It’s an automatic function of speed for the businesses to roll out their promotions exploit, make use of the holiday seasons, and for consumers who are looking for deals combination of all those things leaves open many vulnerabilities. So my advice to people especially businesses because we are in the business of protecting applications for businesses because applications are central to the way they interact with their consumers employees partners and everybody, right? So we protect applications. so we tell that makes security and integral part of your software development life cycles and all the way into production. So that at least your application does not become the segway through which your customers, your consumers on your data at risk. So, do not compromise speed, but make security an integral part without compromising speed and, that cannot be done unless and until you accept that this is my domain, this is my area of expertise in terms of what we do, it can be a CRM application. It can be a D to see. E-commerce application. It can be a cab riding platform, whatever it is right at the end of it. Central to any of those businesses interacting with their consumers and application. And businesses have to focus on the security of their application because that is the heartbeat of any digitization initiatives. And speed of business is now imperative for anybody to stay relevant. Venkatesh Sundar: It’s not about how big you are, but how fast you adapt to the changing needs of consumers, trends and everything, is how every business operates to stay relevant. And with speed comes risk, and the need for speed is even further higher during the holiday season, especially for certain types of businesses, which have different promotions. And hence, you see a correlation between a higher amount of attacks and public reports during holiday seasons for ransomware. Because it’s not my chance or correlate or coincidence, right? There is a very strong cause and effect there because of speed people end up having more vulnerabilities that are, can be exploited and hackers are waiting to exploit those vulnerabilities and during holiday seasons. The customers might be even more vulnerable to succumb to ransomware attacks as opposed to. Even though they’re ethical call and reasons, might be never to succumb to it, and not pay a single buck. Even if it is going to cost me less even it’s going to or even, it’s going to cost me more for the downtime it creates, but that ethical reason goes for a toss when they are when their businesses shut down. And even further, so during holiday seasons So my advice, which is the question you asked is to consumers, do not click on any random links or do not click on links. That you do not know, do not share your OTP to unknown people, and make sure that the endpoint that we have which are interacting is trusted. It is encrypted Venkatesh Sundar:  Have an eye for detail that is only through consumer education, education and awareness that can address that, but to businesses, which becomes a segue through which because you consumers interact with them, they had to make sure that their own application that their own services that they provide lives up to the trust, the consumers and the businesses and other people place on them and to live up to the trust. They had to make sure they proactively, take effect effort to mitigate those risks. And if it proactively take those effort and mitigate those risks, it can also deal with when those attacks happen, much better. And it also wins consumer confidence because most of the breaches, the problem of erosion of consumer confidence is not because of the attack or the downtime itself, but because of the lack of transparency that businesses have in communicating, clearly what is that happen. Those transparency doesn’t exist, but if they show that clear, Venkatesh Sundar: These are the things we have in place in spite of this happen. But we learn from this, and we are improving it, and This is the impact and these are on the workarounds then. Actually those situations turns around to build the trust further. So, the long answer again is to businesses, pay important attention to applications security, and do not compromise on application security practices in the, in favor of speed, make it an integral part and do not compromise on speed, but make it integral part of How do I keep the agile development going on with speed as an integral. With security is an integral part of that. Samuel Brake Guia:  You got some pretty solid advice and what you mentioned about transparency and being clear. I think that’s what’s so important and I also I’m very curious to know like Oh there are other companies operating in this space and if so like how do you differentiate yourself from the competition? Venkatesh Sundar: Yeah, I think it goes back to the story. You asked the first question, How did you start in space? I mean, right from day zero and this was like when we went to the I mean again, if you look at the history, the first product that we build in in this phase was basically a risk detection product, a malware detection product. and once we got a critical mass of customers and some traction from it, it got acquired by trend micro, right? And it was a set purchase. We’ve got acquired by Trend Micro with a little bit of money that we made from that and we went back to the drawing board and said that we want to start something else and obviously my domain expertise was on security application, security specifically. And it was a crowded market. We were not the only vendors. We are not creating a new category, but in an existing category, how do I create a blue ocean? How do I create a differentiation especially when there are many players and there has to be a compelling enough aha for in terms of value to the customer. Even if we are a new startup coming up, the version one product, right? Venkatesh Sundar:  And that differentiation that we identify 10 years back that even though we are building a software product even though we are building a tool that is trying to solve a specific problem in this case protecting applications and establishing the intent of the traffic and the user that is coming into the transaction. Is it? Good or bad? Other players are doing it. Venkatesh Sundar:  But there is a set of policies that we had to build, but the key differentiator was We just don’t throw it all in and walk away. We combine management of it updates of it, making sure that your applications are protected from new threats. Your applications are protected relevant to your current application risks, like a holiday season example, that you mentioned that you are rolling out this feature, but there is this vulnerability that exists because of speed and they’re not going to the proper QA, do not worry about it, let that vulnerability exist, but we as a gateway, that instantly virtually patch it as a part of the managed services. So it’s a tool that we combined with managed services offering As part of my 24 by 7 support license, became that one singular Aha factor that we provided to the customers, and guess what? 10 years later since the drawing board situation when it was just PPT vision mission statement and differentiation and everything. The same differentiation holds good today. And imitation is the best form of compliment. Some of the biggest players in the competition, who are our competitors are actually copying the same capability. Now, So we have the first advantage. We have the critical mass but the fact that they are copying the same value feature differentiation that we have is actually some kind of pride for me as an individual and also the company because yeah we have done something right? And we have to follow the report game and innovate further so management. Combined with the application, security, and within application security. If you really lay down the landscape, that is this detection of the application which requires specialized skills. Venkatesh Sundar:  That is accurate surgically, accurate risk protection? Specific to the risk of your application, that requires a specialized grid skill, which is a web application firewall. And there is detection, typically security, scanning pen testing. And there is continuous risk monitoring, which is not just configure and walk away. There are new threats, your application itself is changing, it is integrating with third-party components. New APIs are being added. Venkatesh Sundar: All of these three together under one umbrella with the 24 by 7 support management, to you becoming a single SOAP application security, vendor rent management will just don’t throw a tool and walk away becomes a most compelling differentiator and then the delivery of it to the customer and references and everything then helps to sustain it. So, in terms of capability piecing together, all the aspects of the application security, and providing our expertise, on top of the product, became our, a hard differentiation, which was my minimum viable product launch based on which you want it and it continues to remain a key differentiation today based on our ability to build on the first more advantage and process integration, a lot of other things and now our competition and the industry itself and even analysts are telling that OEM vendors have to up their game. In terms of the services component, they provide as part of support, you cannot just be incident management. It has to be this, which further validates our original vision, and our differentiation as well. Samuel Brake Guia: Mm-hmm. Yeah, I think what you said definitely makes sense to me, the fact that imitation really is the greatest compliment and I can understand how you have such a competitive offering when you offer all of that and it does sound like you’re working on a lot at the moment and I’d love to know. Like what’s next on the horizon? Venkatesh Sundar:  Yeah, so if we look at how the application has evolved, right? I mean there’s Web 1.2.or, people are talking about 3.0 The fundamentals of communications and applications and providing some service doesn’t change. But what has changed? is like if you look at Internet traffic today, The user to website, related conversations is a small, it’s certainly a big part, but it comparatively, it’s the Internet traffic. The bigger part of Internet traffic is going to be at communication more than human to app communication. Device to App, Communication App to add communication. An example, you go to your website or a golden app, you go ahead and engage in a transaction. You want to buy something or you want to download a document or upload a document. Then finally, there are other pieces like a payment gateway. That’s a third-party component that those applications integrates with. Venkatesh Sundar:  And that payment Gateway is an API call between the application and communicating with and some other application that application is communicating it for providing the service to the consumers, right? So the app-to-app communication is going to be such an integral part of the app economy evolution that API security has become a big pain point. APA Security paradoxical is easier to solve from a technical standpoint, but from an operational standpoint, people are talking about Shadow API. People are talking about How do I discover those unknown APIs. How do I make sure I have a surgically accurate policy for my API definition, which really requires a swagger file, or some sort of documentation, which people don’t have because, you know how developers and documentation work together, right? So, those are big challenges and we try to address those challenges and APA security is a big thing. The second big team is ransomware, then, the power for a hacker to bring down a system is becoming cheaper and cheaper. Independent of vulnerabilities and risks and waiting for a targeted attack. They can just do a blind DDoS attack. Samuel Brake Guia: Fantastic. well, we’re gonna include a link to your website in the show notes of this episode but otherwise Venky, those are my questions today and I just want to say thank you so much for joining me. Venkatesh Sundar: Fantastic. It has been a pleasure. Thank a lot. This article was originally published by Sam Brake Guia on The Sociable.

A Cybersecurity Startup Founder's Insights: Defending Your Business from Hackers (Podcast)

Perspectivas del fundador de una startup de seguridad cibernética: defender su negocio de los piratas informáticos (podcast)

Les idées d'un fondateur d'une start-up de cybersécurité : Défendez votre entreprise contre les pirates (Podcast)

एक साइबर सुरक्षा स्टार्टअप संस्थापक की अंतर्दृष्टि: हैकर्स से अपने व्यवसाय की रक्षा करना (पॉडकास्ट)

サイバーセキュリティ スタートアップ創設者の洞察: ハッカーからビジネスを守る (ポッドキャスト)

Insights de um fundador de startup de segurança cibernética: defendendo sua empresa contra hackers (Podcast)

Thông tin chi tiết của nhà sáng lập công ty khởi nghiệp về an ninh mạng: Bảo vệ doanh nghiệp của bạn khỏi tin tặc (Podcast)

网络安全初创公司创始人的见解：保护您的企业免受黑客攻击（播客）

Ransomware is a severe and persistent problem. A Nordlocker study from January 2020 to July 2022 with $4.15 trillion in combined revenue. indicated ransomware attacks targeted companies These cybersecurity issues also affected more than 12 million employees during the studied period. Thus, ransomware protection methods are a much-discussed topic. As types of ransomware get more advanced and devastating, what are the best ways to defend a business? People often bring up access controls as they plan or improve strategies to safeguard against ransomware. However, they’re not total solutions. Limiting what people can access within an organization can minimize the damage linked to a ransomware attack. The Least-Privilege Principle Minimizes Possible Access One best practice for ransomware protection is to deploy the least-privilege principle for access. It means people to do their jobs. only have what’s required However, this approach also encourages hackers to find the accounts of the people within the organization who have the most privileged access. It’s also helpful to restrict which users can install and run the software. Hackers often try to do those things when putting malware on a machine. However, it’s necessary to strike the right balance between security and productivity. If people believe a company’s cybersecurity procedures prevent them from doing their jobs well, they might try to circumvent those measures. Privileges-Based Access Management Thwarts Hackers A privileged access management (PAM) strategy is also an excellent preventive measure against successful ransomware attacks. That approach significantly limits how far they can spread. PAM relies on single-use for a person’s session. It’s then useless for a hacker to steal those passwords and try to access systems with them. PAM sessions also get recorded and monitored. passwords that only remain valid Security team members can end them remotely if a person’s behavior becomes suspicious or exceeds a predetermined threshold. Companies also use behavioral analytics to create profiles of each privileged user. The details could include how fast they type, what sites or platforms they visit, for how long, and from which location the person accesses the system. A deviation from the norm does not necessarily signify something amiss, but it could encourage security teams to keep a closer watch. Using the Latest Tech Matters, Too Access control is only part of a well-developed strategy against ransomware. Companies should also invest in the latest technologies. That might mean ensuring all employees use the latest operating systems and software versions. It could also entail purchasing cybersecurity solutions that rely on artificial intelligence and other advanced options to help people spot and defend against cyber threats. Legacy systems with new and improved processes. That’s one of the common problems that encourage investments in new technologies. often can’t keep up However, companies should still consider tech-related cybersecurity tools even if they have the most recent computers and software versions. For example, some access control products allow people to see login attempts and current sessions on a centralized dashboard. IT managers and others in authority can then detect anything that seems out of the ordinary. Discouraging Password-Sharing Could Make a Difference It’s impossible to know precisely what kind of supercharged ransomware is on the horizon. However, something practical that people can keep doing is following best practices for accessing tools and platforms. One of the basic principles is always to keep passwords private and never share them. However, that advice often gets overlooked or ignored. A 2021 study found had shared passwords over email or text messages. However, password-sharing may also be a company policy. 62% of United States employees Such was the case for 46% of workers who said their employers directed them to share passwords for resources used by multiple people. Password-sharing could circumvent an IT team’s best efforts to implement tight access controls. Also, the more people with access to one password, the easier it is for at least one of them to misuse it and erode security even further. This problem is most impactful when a password associated with a high-privilege account spreads between people at an organization with fewer access rights. Treat Access Control as One of Many Vital Aspects Ransomware is an ever-present threat, and cybercriminals are orchestrating attacks that are more disabling, costly, and difficult to recover from. However, creating and implementing an all-encompassing ransomware prevention and response plan can keep companies safer. Access control can limit what a hacker can affect and do within an organization. It can also stop ransomware from spreading through a network. However, people must view access control as one measure among many to keep ransomware at bay. Sources: https://nordlocker.com/ransomware-attack-statistics/ ​​ https://www.cisa.gov/stopransomware/ransomware-guide https://www.techradar.com/news/how-to-prevent-ransomware-attacks-using-access-controls https://www.watermarkinsights.com/resources/blog/how-to-know-when-its-time-for-new-tech https://www.prnewswire.com/news-releases/new-survey-finds-enterprise-password-security-is-as-flimsy-as-a-sticky-note-301262779.html

Is Configuring Access Control Effective When Defending Your Business Against Supercharged Ransom?

Defending Bitcoin with John Carvalho

An FAQ for Defending Net Neutrality

Stories, News & Mentions about DEFENDIFY

Defendify’s Stories on HackerNoon