The Anti-Fraud Technology Benchmarking Report assessed data from more than 1000 ACFE members regarding their organizations’ use of tech to fight fraud, discovering that while only 13% of businesses currently use AI and machine learning to detect/deter fraudulent activity, another 25% plan to do so in the next year or two.
Other key findings discovered that 26% of organizations are using biometrics as part of their anti-fraud programs, with another 16% expecting to deploy biometrics by 2021, while more than half of respondents (55%) plan to increase their anti-fraud tech budgets over the next two years.
“As criminals find new ways to exploit technology to commit schemes and target victims, anti-fraud professionals must likewise adopt more advanced technologies to stop them,” said Bruce Dorris, JD, CFE, CPA, president and CEO of the ACFE.
The business ISP analyzed traffic for its customers during the period and found them to be on the receiving end of 146,491 attempted attacks each, on average. That’s 179% higher than the same period in 2018, when firms faced down 52,596 attacks on average.
IoT devices and file sharing services were most frequently targeted, hit by 17,737 and 10,192 attacks respectively during the quarter.
This chimes somewhat with a FireEye report from last month which revealed a dramatic increase in attacks exploiting file-sharing services to deliver malware via email. From hardly being used in any attacks in Q4 2018, OneDrive was seen in over 60% by Q1, it claimed.
Germany’s federal interior minister, Horst Seehofer, wants companies such as WhatsApp and Telegram to give security authorities access to end-to-end encrypted messages or calls. Not complying with this could end with companies being banned by the Federal Network Agency.
The latest issue of Der Spiegel reports that Seehofer wants the order to be implemented quickly, especially with the move to 5G potentially causing “complications” for security authorities. This comes after WhatsApp had to fix its app due to a remote code execution (RCE) vulnerability, which may have been exploited by a national-state.
As Infosecurity reported at the time, the Facebook-owned mobile communication giant, with 1.5 billion users, rolled out a fix on the vulnerability that allowed users to be infected with spyware by being phoned by the attacker.
A bipartisan bill proposed last week by New York representatives Kathleen Rice (D) and John Katko (R), who co-sponsored the act, requires members of Congress to receive annual cybersecurity and IT training. The Congressional Cybersecurity Training Resolution of 2019 adds to the existing requirement that House employees receive annual training by mandating that the House members themselves also receive cybersecurity and IT training, according to The Hill.
“The chief administrative officer shall carry out an annual information security training program for members (including the delegates and resident commissioner), officers, and employees of the House,” the act states.
“We strongly encourage support for the Congressional Cybersecurity Training Resolution,” said Jack Koziol, CEO and founder at Infosec. “Cyber-criminals are responsible for hundreds of billions of dollars’ worth of damage to the global economy and undermine democracy around the world.”
This article is divided in two parts. First, it guides you into thinking about cyber-resilience: What is it about? What are its characteristics and its differences with the more traditional cases of unavailability of information technologies? The second part proposes an exploration of responses through the development of a “Cyber Resilience Plan” integrated with the other plans of the Business Continuity Management System.
The question is no longer when you will be impacted, but how you will react when faced with three major risks:
The Israel Defense Forces (IDF) claim to have thwarted a cyber-attack from Hamas by targeting the building where Hamas cyber operatives work, according to IDF.
After the alleged cyber-attack, IDF responded with a physical attack in what Forbes contributor Kate O’Flaherty called “a world first.”
According to the commander of the IDF’s cyber division, identified only by his rank and first Hebrew letter of his name, Brigadier General Dalet, this was also the first time that Israel cyber forces had to fend off an attack while they were also under fire, which required both Israeli technology soldiers and the Israeli Air Force, according to The Times of Israel.
Imagine the following scenario. The weather outside is awful. It has been snowing for three days now and a lot of the white stuff has accumulated on the ground. In addition, the temperatures have hovered around zero (Celsius or 32 Fahrenheit) so there is a real risk of ice on the roads.
Every TV station, online news site and weather expert is saying it is not a good idea to go out under these conditions. Taking that chance could lead to a very bad ending. Stay inside, put the coffee on and watch Netflix is what everyone seems to be saying.
Except that there is this one guy – we’ll call him Bob – ignores all this. Bob decides that the information is bogus or that the warnings are fake (fake news!) or exaggerated. Bob elects to go out anyway in his car. Bob ends up in a ditch. Bob is dead.
So whose fault is this tragedy?
The TV’s? The Internet? Your local weather specialist? All of the above? Was this a ‘weather warning failure’? No, this is solely Bob’s fault. Bob had all the necessary data to assess the situation and determine risk. Bob elected to pooh-pooh it and take his own chances Bob is now dead.
“Intelligence failure” vs “failure to communicate”
Do you see where this is going? I am reading a lot about the Easter Sunday attacks in Sri Lanka as an ‘intelligence failure’. Except it was nothing of the sort. This was actually an intelligence success. What we have here is a ‘failure to communicate’ (and to act).
It is becoming quite clear that officials in Sri Lanka had ample data and ample warning about the attacks thanks to intelligence collection. Here is an excerpt from The Economist:
National intelligence agencies had issued their warnings as early as April 4th. In a letter on April 9th the chief of national intelligence had even named suspects—a level of detail that is very rare for such warnings. And shortly before the attacks, the spy agencies’ foreign counterparts had again alerted Sri Lankan authorities that places of religious worship, especially of Catholics, and areas with high concentrations of tourists “may be targeted”.
But here is where things went badly wrong. The Prime Minister was not aware of this intelligence because he had not even been invited to meetings of the national security council, which are chaired by the president, since October last year. Because the PM and the President don’t get along, the latter favouring another person for the job. This has nothing to do with intelligence and everything to do with politics. In addition, those who had seen the intelligence could have taken action to put security in place. This is a failure on their parts as well.
The Prime Minister was not aware of this intelligence because he had not even been invited to meetings of the national security council
I may be a little sensitive to these claims given my 32 years in Canadian intelligence but it seems crystal clear to me that the spy agencies did exactly what they are paid to do: collect data, assess it for accuracy, analyse it and pass it on. That it was not done so in Colombo cannot be laid at the feet of the intel bodies.
There are indeed many occasions on which intelligence is poor, lacking or non-existent. Yes, we do miss things and yes we do get it wrong sometimes. But we get it right more often and hence we do provide a needed service. The level of detail available to Sri Lankan officials from their own spies and foreign ones before Sunday seems to me (I of course have not seen it) to be remarkably detailed: this is very, very rare.
So the next time you see the phrase ‘intelligence failure’ stop and ask yourself: whose failure?
Released over the Easter weekend (April 21, 2019), the report also found that the most-used password from global cyber breaches was “123456,” with “ashley” the most-used name as a password. The global password-risk list was published to disclose passwords already known to hackers.
The polling was independently carried out on behalf of NCSC, a part of GCHQ and the Department for Digital, Culture, Media and Sport (DCMS). The findings, as well as 100,000 passwords already known to have been breached by hackers, were released ahead of NCSC’s CYBERUK 2019 conference, which will be taking place in Glasgow this week.
These will inform government policy and guidance offered to the public.
With the use of deep learning, researchers Yisroel Mirsky, Tom Mahler, Ilan Shelef and Yuval Elovici at Cyber Security Labs at Ben-Gurion University demonstrated in a video proof of concept (PoC) that an attacker could fool three expert radiologists by falsifying CT scans, inserting or removing lung cancer, the Washington Post reported.
“In 2018, clinics and hospitals were hit with numerous cyber attacks leading to significant data breaches and interruptions in medical services,”
“In 2018, clinics and hospitals were hit with numerous cyber attacks leading to significant data breaches and interruptions in medical services,” the researchers wrote. “Attackers can alter 3D medical scans to remove existing, or inject non-existing medical conditions. An attacker may do this to remove a political candidate/leader, sabotage/falsify research, perform murder/terrorism, or hold data ransom for money.”
Using a test dummy to highlight the vulnerabilities in picture archiving and communication systems (PACS), researchers demonstrated that 98% of the times they injected or removed solid pulmonary nodules, they were able to fool radiologists and state-of-the-art artificial intelligence (AI).
Despite the growing number of employees that work remotely, security professionals fear that remote workers pose risks to the enterprise, according to a new study published by OpenVPN.
An overwhelming majority (90%) of survey respondents said that remote workers are a security risk to the organization, according to the report Remote Work Is the Future – But Is Your Organization Ready for It? The report’s findings are based on a survey of 250 IT leaders, from the manager level through the C-suite.
Still, 92% of respondents agreed that the benefits of remote work outweigh the security risks. “For employees, it provides greater efficiency and lower stress levels: 82% of telecommuters reported less stress and 30% said it allowed them to accomplish more work in less time,” the report said. In addition, companies reportedly save an average of $11,000 per year per remote employee.
