Tag: recent works

Has your company been the victim of a security incident?

Email is the most commonly used method by cybercriminals to try to breach the security of companies. Through phishing and social engineering, they sneak into the office every day hoping that you fall into their trap. These criminals have devised the best way to make these emails look as similar as possible to those you usually receive in your mailbox.

With attachments that simulate invoices

Content and subject lines of the messages impersonating higher-ups or banking communications, among others.

This, together with the urgency of response times, means that sometimes we do not notice the small details that warn us that some are not what we expected to receive and thus, we unwittingly become victims of these frauds.

My company has been the victim of a security incident, what can I do?

Protect your company provides organizations with tools to try to avoid these unwanted situations, but as we know that it is difficult to free trial offer fight against the ingenuity of cybercriminals and their increasingly refined techniques, we also provide the Report your incident service .

Let’s say you suspect an email you’ve received or that you’ve fallen for it. Here’s how to proceed to be able to send malicious emails if you experience or identify an incident .

Before following any of the procedures, remember

That you should never open attachments in fraudulent emails or follow links, as they could cause your computer to snbd host become infected.
Select your email system or client.

Outlook

Thunderbird

Mail for Mac

Gmail

Hotmail

Yahoo

Roundcube

Now that you know how to do it, don’t hesitate and report your security incidents. Together we can make companies a safer place.

Remember that you can contact us

Through INCIBE’s Cybersecurity Helpline (017) , the WhatsApp (900 116 117) and Telegram (@INCIBE017) instant adb directory messaging channels, or the contact form for companies , which you will find on our website. Experts in the field will resolve any online conflict related to the use of technology and connected devices.

October 20, 2024
Transform your SME with cyber resilience by following ENISA’s advice

The digital transformation of SMEs, so necessary to compete in digital markets, is underway. Digital commercial exchanges require security to be reliable. Therefore, to survive in these markets we must be prepar to overcome possible cyber incidents. On the one hand, we must take the necessary precautions to maintain the availability of the systems that support our activity and, on the other, those necessary to offer sufficient guarantees of integrity and confidentiality to buyers and suppliers. But this is not enough; we not only have to do everything necessary to prevent incidents and know how to react to them, but also to resist them and recover as quickly as possible, learn from mistakes and continue to offer the market our product or service.

In this article, we echo a joint publication

By ENISA , the European Union Agency for Cybersecurity, and the computer emergency response team for the European institutions, CERT-EU . Its title in English is Boosting your organization Cyber Resilience .

This publication, motivat by the continuous increase in the level of threat, consists of a list of good practices that all types of organizations are encourag to follow in a committ and systematic manner. They are confident that they will help to substantially improve the level of cybersecurity and increase resistance to possible attacks.

Do you dare to apply them?

Score one point for each of the ones you already follow and plan to complete the rest in less than six months.

Verify that remote access to our corporate services uses multi-factor authentication (MFA).
This includes VPNs , external corporate portals or extranets, or web-bas email access (e.g., Outlook on the web or Exchange Online). But beware, they recommend avoiding SMS and voice calls as a second factor to deliver one-time codes get a quote as much as possible, as they can be spoof. Instead, they encourage the use of spoof-resistant tokens , such as smart cards and FIDO2 ( Fast IDentity Online ) security keys, whenever possible.

Ensure that employees do not reuse passwords and encourage

Them to use multi-factor authentication (MFA) whenever possible (for example, on their social networks).
It is common for cybercriminals to break into our systems by carrying out attacks with stolen crentials , i.e. username and password, obtain from data leaks or leaks. This type of attack is possible because some users use the same crentials for different snbd host services, for example: email, social networks or to access the backend of the web portal. Therefore, we are remind that we should never reuse passwords . As a preventive measure, we can check if our passwords are in any known data breach and if so, change them immiately on all sites where they have been us. Whenever possible, it is recommend to use a password manager .

Check that all software is up to date

Priority should be given to updates that address known vulnerabilities, as these may already be being exploit. They recommend that this be part of a vulnerability management policy that includes an obligation to install high and critical severity adb directory patches as soon as possible. And do not forget to check that they have been fully appli, for example, if the system must be reboot after installation. They also encourage us to update, as regularly as possible, our personal home equipment: computers, smartphones, tablets, connect devices such as televisions, video game consoles and routers.
Monitor our networks and systems to prevent third-party access.

October 20, 2024
Security on the go! Protect your removable devices

Removable storage devices, such as USB flash drives, portable hard drives or memory cards, are another part of our daily lives, almost as essential as a computer or mobile phone, but at the same time so small and discreet that we do not pay them the level of attention and security they require. How many times have we heard someone ask for a USB or hard drive to be able to share a file, that latest report or a whole collection of materials for a colleague who has just join the project?

These types of practices can have undesirable consequences if we do not take the appropriate security measures, such as infecting the corporate network with some type of malware . This infection could be unintentional when sharing a USB between colleagues without knowing that it contains a malicious file, or it could be part of a deliberate attack against the company, such as in the case of gifts that connect to the network or warshipping . For this reason, those removable devices that are promotional or that we are not sure whose hands they have been through before, should not be us in the workplace under any circumstances, and much less ‘us’ in a corporate computer.

Each organization must have

Apolicy on the use of external storage devices , known to all employees, which indicates, among other things, whether their use is permitt or not, and if it is permitt, what type of information can or cannot be stor on them.

The main risks of using these devices are loss, access to the information contain by unauthoriz persons or infection by malware . Below we show a series of measures to avoid possible security incidents:

In the event that we are going

To store sensitive or confidential information on an external device, we must always use properly protect corporate hard drives and USB drives with the appropriate security measures, as establish in the policy for the use of external storage devices, encrypting the information, storing them in safe places and informing the IT department of any incident that may occur, such as theft or loss of the device.
We must take special care with the highly sensitive information that we handle in our organization, and add additional security freequently ask questions measures to prevent this information from being stolen or misappropriat, by blocking the USB ports on computers that contain this type of information.

If we use a personal device ( BYOD )

To store non-confidential information (for example a corporate presentation, manuals or instructions for a product or service to show to a client, etc.), for security reasons, we must have the authorization of the technical manager and apply the same snbd host protection measures establish in the organization for corporate devices, complying with the policies for the use of these mia (encryption, secure deletion , etc.).
Set periodic password changes for device access and control read and write permissions.
Perform frequent scans to detect any type of malware .
Register external devices us within the company by means of an inventory that includes an identifier for each one, periodically checking their physical location and content, and preventing unregister devices from connecting to any computer in the organization.

Whenever possible, verify that devices are secure and up

To date in a test environment.
Use solutions call DLP or Data Loss Prevention .
Train employees to ensure proper use of these devices. Prevention and common sense are the main keys to avoiding a security incident due to misuse.
Another aspect to which we must pay special attention is the elimination of the information contain in this type of device, since it is very common to adb directory use the operating system’s deletion commands to eliminate them without performing any additional action. However, it cannot be consider a form of secure deletion because the information is not completely eliminat, since with the appropriate tools it is possible to recover data from a formatt device or files after emptying the recycle bin.

October 20, 2024
True story: SIM swapping, from no coverage to no money in the bank

It was a Tuesday at 5:15, Alberto’s alarm clock rang. He had to go on a business trip because he is responsible for purchasing in a small company. After packing his laptop and cell phone into his backpack, essential work tools when traveling so much, he headed to the airport. In the taxi, his corporate phone lost coverage, and there was no data connection. He didn’t give it any more thought.

When he arrived at the airport, the situation was still the same, so he decided to use the Wi-Fi network available to customers at the airport, even though he knew that it is not advisable to connect to public networks without taking the necessary precautions.

When he logged on, Alberto’s phone

Began receiving notifications from the bank’s app about purchases and transfers made with his corporate card. Seeing all this, he reached for his wallet and began searching for his bank card. It was there, in its place.

– I have my bank card here, how is this possible? – Alberto asked himself.

Within minutes the boarding gate closed, Alberto was without coverage, and other people were making purchases in his name and with his money.

– I can’t catch this flight, I have to solve this somehow – he told himself

Before leaving the airport, he blocked the card from the bank’s app using the Wi-Fi connection. Even without coverage, Alberto decided to go to a branch of his bank to wait for an explanation of what had happened. When he arrived, he was told that all these transactions had been made via the Internet with his bank card.

– What about SMS verification for online payments? – he asked.

After that reflection he realizes one thing: he has no coverage, that is where the problem lies.

What happened?

Alberto decides to contact his telephone company to see what is happening with his phone. To his surprise, they tell him that he pricing tables has requested a duplicate card, so it is logical that the one in his phone is disabled.
–

What is going on here?

I have not requested a duplicate! I don’t understand anything – he says surprised.

Alberto has been a victim of SIM swapping . This technique consists of obtaining a duplicate SIM card by impersonating the owner. To do this, they first snbd host obtain the personal data they need. This way, the cybercriminal can carry out operations in our name that require verification via SMS, such as online purchases.

How could this happen?

The cybercriminal had obtained Alberto’s details (ID, address, card number, etc.) using social engineering techniques, and he had not even noticed. It happened a few days ago via an SMS he supposedly received from his bank . With this adb directory information, the attackers requested a duplicate SIM card from the telephone company. Once they had obtained it and inserted it into a mobile device, they had gained access to all of Alberto’s verification messages. In addition, they had his card details and were able to make purchases with it.

October 20, 2024
What is metadata and how to remove it

The concept of metadata refers to data that accompanies a file or document, describes it, and cannot be seen with the nak eye. For example, in the case of a photograph taken with a mobile phone, we will have, on the one hand, the content of the photograph (the 0s and 1s that make up the image), and on the other, the metadata, that is, the GPS coordinates where it was taken, the name of the camera, or whether the image has been it, among others.

Image with metadata

In the case of office documents creat with a text itor, spreadsheet or presentation, for example, the metadata generat by these programs usually consists of, among other things, the name of the author of the document, the internal path where the file was stor, the name of the organization and other similar fields with private or internal company information. Thus, when sending these files to clients and suppliers, if we do not delete this metadata first, we are providing extra information that we do not know how it can be us, if it falls into malicious hands.

If you want to test the information

You may be sharing from your company, follow this process. Choose a text document that you have sav on your work computer.

Right-click on it and choose “Properties”. In the window that opens, click on “Details” to see the metadata that recent works accompanies that document. The result will be similar to that shown in the following image:

View metadata recommend not using them

If you have done this test, you have probably realiz that you were sharing certain data that you had previously miss. If from now on you prefer to send all your documents clean of metadata, look for the tool that best suits each case from those we show you in the following examples.

Before you begin, keep in mind that although there are many websites on the Internet to remove metadata from files, we recommend snbd host not using them, since you will have to send or upload your documents with sensitive information to a third party (the owner of the page) and you do not know if they will treat them confidentially or if they will be us for other purposes.
Remove metadata from Microsoft Office documents (Word, Excel and PowerPoint)

Delete metadata in LibreOffice office documents

Remove metadata in PDF documents using Adobe Acrobat Professional

Remove metadata from images, videos and PDF documents with ExifTool

Now that you are aware of the information you may be sharing through metadata, there is no excuse for not implementing any of these methods and adb directory deleting them. Protect your information to protect your company.

Remember that you can contact us through INCIBE’s Cybersecurity Helpline (017) , the WhatsApp (900 116 117) and Telegram (@INCIBE017) instant messaging channels, or the contact form for companies , which you will find on our website. Experts in the field will resolve any online conflict relat to the use of technology and connect devices.

October 20, 2024
The 10 most commonly used attack vectors by cybercriminals

Viruses have been with us since computers began to be found on or under desks. A few decades ago, even before the Internet exist. In the beginning, they were clever demonstrations of program errors and spread via diskettes. Soon they began to be exploit for malicious purposes, causing data deletion, intrusion, system inoperability or service failure.

Computer systems and networks are now more complex, and the attack paths have become more diverse. Attacks arrive as email attachments, through human intermiaries, removable devices, via wireless connections, via WhatsApp. On websites, and also via our IT service providers, such as Kaseya software or SolarWinds .

Cybercriminals are constantly looking

For new ways to deliver their “malicious payload” or gain access. To our computers by taking advantage of human errors, configuration errors or system defects. These ways of reaching our systems are known in jargon as attack vectors . Let’s see which are the most common and what we can do to prevent cybercriminals from using them for their benefit and, almost always, to our detriment.

How do cybercriminals operate?

As you might expect, systems and networks ( hardware and software ) are not perfect. They may have security flaws or vulnerabilities about us that are well known in the circles frequent by cybercriminals, such as forums on the dark web . There, too, they can acquire specific developments to exploit them and launch their attacks.

They are also constantly and automatically scanning networks

For vulnerable (unpatch bugs) or misconfigur systems and unaware users who can serve as entry points. This, what can be attack, is known in the jargon as the attack surface , made up of the points on the perimeter of the device, network snbd host component, service, system or environment that can be us to gain entry, cause damage or extract data. And this includes users with their valuable access crentials.

As with any economy of scale, the greater the scope and chances of success of the attack, the greater the potential profits, so they will try to exploit widespread vulnerabilities. They will even try to physically break into our facilities or take advantage of internal employees, either by bribing them or simply tricking them into obtaining their access crentials – the key that opens the ‘doors’.

What are the most common attack vectors?

Considering that attack vectors are subject to change with technological advances and that cybercriminals could use several in each attack, these are currently the most common:

Email and instant messaging, for example phishing emails and SMS that impersonate organizations known to the recipient, such as banks, courier adb directory companies, the Tax Agency, our suppliers and customers, or our technical support, to trick you with various lures, into following links to fake websites where you will be ask to enter your crentials or download malicious attachments that install malware . Very often these are ransomware , that is, malware that blocks data in exchange for a ransom. In other cases, malware turns our devices into zombies at its service to launch attacks on third parties or for other unethical purposes.

October 20, 2024
Security in times of mobility and wireless networks

Mobility is becoming more and more present in companies. Many businesses and jobs depend on this type of work to be able to carry out their daily activities .

In this mobility scenario, two fundamental elements intervene: one of them is mobile devices , such as smartphones or laptops, which are responsible for processing information; and the other is wireless communications, which allow us to send the data we process and interconnect with the rest of the world.

Therefore, it is essential to address

The security of both elements in order to be able to carry out the activity safely and avoid an incident.

Before continuing, the following video addresses he main considerations for performing mobility safely:

Considerations for developing mobility and wireless connections safely:
Protecting devices. If we want to protect the information that is processed and stored on devices, it is necessary to apply protection welcome to photo retouch editior website systems to prevent anyone from having access to the terminal and, therefore, to the information it contains through carelessness. It is also important to use mechanisms that allow the information to be located or even deleted remotely. In this way, it is prevented from falling into the wrong hands.

Protect connections When transmitting information

It is essential to prevent any curious person from capturing it, especially when it is vital information for the business, such as confidential information or high strategic value for the company. For this reason, secure channels must be snbd host used, such as virtual private networks ( VPN ), and the use of public networks, whose management is unknown, must be avoided. By protecting these elements, we will minimize the company’s exposure to a security incident.
By protecting these elements we will minimize the company’s exposure to a security incident.

Remember that you can contact us

Through INCIBE’s Your Help in Cybersecurity service : the Help Line 017 , the instant messaging channels of WhatsApp (900 116 117) and Telegram (@INCIBE017), or the contact form for companies , which you will adb directory find on our website. Experts in the field will resolve any online conflict related to the use of technology and connected devices.

October 20, 2024